From c871a5511604288fa1ec3480890f53b5de73f4a6 Mon Sep 17 00:00:00 2001
From: lb <542828+lukebuehler@users.noreply.github.com>
Date: Tue, 27 Oct 2026 13:51:03 +0100
Subject: [PATCH 1/5] envd review and hardening

---
 Cargo.lock                                    |   22 +-
 clients/typescript/schema/api.schema.json     |  578 +-
 clients/typescript/src/generated/methods.ts   |   30 +-
 clients/typescript/src/generated/types.ts     |  270 +-
 crates/api/contract/api-reference.md          |   10 +-
 crates/api/contract/api.schema.json           |  578 +-
 crates/api/contract/methods.json              |   10 +-
 crates/api/contract/openrpc.json              |  588 +-
 crates/api/src/deployment.rs                  |   68 +-
 crates/api/src/environments.rs                |  187 +-
 crates/api/src/handshake.rs                   |    5 +-
 crates/api/src/rpc.rs                         |    4 +-
 crates/api/src/tests.rs                       |   38 +-
 crates/cli/src/env_cli.rs                     |   14 +-
 crates/cli/tests/resource_commands.rs         |    8 +-
 crates/environment-client/Cargo.toml          |   15 +-
 .../src/conformance/controller.rs             |  631 ++
 .../environment-client/src/conformance/mod.rs |    8 +
 crates/environment-client/src/connection.rs   |  774 +++
 crates/environment-client/src/control.rs      |  132 -
 crates/environment-client/src/controller.rs   |  169 +
 crates/environment-client/src/data.rs         |  472 +-
 crates/environment-client/src/dial.rs         |  244 +
 crates/environment-client/src/error.rs        |  227 +-
 crates/environment-client/src/lib.rs          |   76 +-
 crates/environment-client/src/options.rs      |  112 +
 crates/environment-client/src/rpc.rs          |  169 -
 crates/environment-client/src/transport.rs    |  114 -
 crates/environment-client/tests/client.rs     |  897 ++-
 crates/environment-daemon/Cargo.toml          |    7 +-
 crates/environment-daemon/src/config.rs       |  473 +-
 crates/environment-daemon/src/dispatch.rs     |  278 +
 crates/environment-daemon/src/exec.rs         |  323 +
 .../environment-daemon/src/exec/execution.rs  |  551 ++
 crates/environment-daemon/src/exec/input.rs   |  310 +
 .../environment-daemon/src/exec/job_store.rs  |  613 ++
 crates/environment-daemon/src/exec/log.rs     |  422 ++
 crates/environment-daemon/src/exec/outcome.rs |  179 +
 .../src/exec/spawn_record.rs                  |  101 +
 crates/environment-daemon/src/filesystem.rs   | 2180 ++++---
 .../src/filesystem/backend/mod.rs             |   85 -
 .../src/filesystem/backend/unix.rs            |  504 --
 .../src/filesystem/confinement.rs             |  721 +++
 .../environment-daemon/src/filesystem/os.rs   |  487 ++
 .../environment-daemon/src/filesystem/scan.rs |  812 ++-
 .../src/filesystem/search.rs                  |  546 ++
 .../src/filesystem/transfer/capture.rs        |  416 ++
 .../src/filesystem/transfer/journal.rs        |  262 +-
 .../src/filesystem/transfer/mod.rs            | 1383 +++-
 .../src/filesystem/transfer/publish.rs        |  970 +++
 .../src/filesystem/transfer/session.rs        | 1531 -----
 .../src/filesystem/transfer/tests.rs          | 2015 +++---
 .../environment-daemon/src/filesystem/walk.rs |  754 +++
 crates/environment-daemon/src/identity.rs     |  189 +-
 crates/environment-daemon/src/jobs.rs         | 3557 +++++-----
 crates/environment-daemon/src/lib.rs          |  707 +-
 crates/environment-daemon/src/main.rs         |  109 +-
 crates/environment-daemon/src/process.rs      | 2792 +++-----
 .../environment-daemon/src/process_group.rs   |  367 +-
 crates/environment-daemon/src/redaction.rs    |    2 +-
 crates/environment-daemon/src/registration.rs | 1637 ++++-
 crates/environment-daemon/src/rpc.rs          |   82 -
 crates/environment-daemon/src/server.rs       | 1403 ++--
 crates/environment-daemon/src/upgrade.rs      |  416 +-
 .../tests/client_round_trip.rs                |  497 ++
 crates/environment-protocol/Cargo.toml        |   12 +
 .../contract/controller.openrpc.json          | 1701 +++++
 .../contract/controller.schema.json           | 1324 ++++
 .../contract/data.openrpc.json                | 5768 +++++++++++++++++
 .../contract/data.schema.json                 | 4285 ++++++++++++
 .../contract/registration.openrpc.json        | 1420 ++++
 .../contract/registration.schema.json         | 1117 ++++
 .../fixtures/bootstrap/build-facts.json       |    7 +
 .../bootstrap/discovery-document.json         |   14 +
 .../fixtures/controller/ingress.ensure.json   |   49 +
 .../fixtures/controller/ingress.remove.json   |   45 +
 .../fixtures/controller/initialize.json       |   33 +
 .../fixtures/controller/target.adopt.json     |   44 +
 .../fixtures/controller/target.close.json     |   33 +
 .../fixtures/controller/target.create.json    |   34 +
 .../fixtures/controller/target.get.json       |   48 +
 .../fixtures/controller/target.setPower.json  |   46 +
 .../fixtures/controller/template.list.json    |   34 +
 .../controller_create_target_params.json      |   10 -
 .../controller_create_target_response.json    |   36 -
 .../controller_initialize_params.json         |    4 -
 .../controller_list_targets_response.json     |   38 -
 .../fixtures/data/env.getIdle.json            |   15 +
 .../fixtures/data/fs.createDirectory.json     |   15 +
 .../fixtures/data/fs.getMetadata.json         |   24 +
 .../fixtures/data/fs.globFiles.json           |   33 +
 .../fixtures/data/fs.readDirectory.json       |   40 +
 .../fixtures/data/fs.readFile.json            |   21 +
 .../fixtures/data/fs.remove.json              |   16 +
 .../fixtures/data/fs.rename.json              |   16 +
 .../fixtures/data/fs.scan.json                |   89 +
 .../fixtures/data/fs.searchText.json          |   47 +
 .../fixtures/data/fs.writeFile.json           |   20 +
 .../fixtures/data/initialize.json             |   97 +
 .../fixtures/data/job.cancel.json             |   43 +
 .../fixtures/data/job.read.json               |  115 +
 .../fixtures/data/job.start.json              |   75 +
 .../fixtures/data/process.read.json           |   63 +
 .../fixtures/data/process.start.json          |   38 +
 .../fixtures/data/process.terminate.json      |   17 +
 .../fixtures/data/process.write.json          |   18 +
 .../fixtures/data/rpc.cancelRequest.json      |    5 +
 .../fixtures/data/transfer.abort.json         |   22 +
 .../fixtures/data/transfer.advance.json       |   38 +
 .../fixtures/data/transfer.append.json        |   40 +
 .../fixtures/data/transfer.begin.json         |   43 +
 .../fixtures/data/transfer.commit.json        |   22 +
 .../fixtures/data/transfer.getStatus.json     |   23 +
 .../fixtures/data/transfer.listMissing.json   |   20 +
 .../fixtures/data/transfer.read.json          |   18 +
 .../fixtures/data/transfer.readInventory.json |   35 +
 .../fixtures/data/transfer.write.json         |   19 +
 .../fixtures/data_initialize_params.json      |    9 -
 .../fixtures/fs_read_file_response.json       |    3 -
 .../fixtures/job_read_response.json           |   39 -
 .../fixtures/job_start_params.json            |   27 -
 .../fixtures/process_read_response.json       |   25 -
 .../fixtures/process_start_params.json        |   15 -
 .../registration/registration.challenge.json  |    6 +
 .../registration/registration.closed.json     |    6 +
 .../registration/registration.goodbye.json    |    5 +
 .../registration/registration.openStream.json |   16 +
 .../registration/registration.register.json   |   37 +
 .../src/bin/export-contract.rs                |   25 +
 crates/environment-protocol/src/bootstrap.rs  |   70 +
 crates/environment-protocol/src/bytes.rs      |  303 +
 crates/environment-protocol/src/contract.rs   |  345 +
 .../src/control/handshake.rs                  |   70 +-
 .../src/control/ingress.rs                    |   47 +-
 .../src/control/methods.rs                    |   13 -
 .../environment-protocol/src/control/mod.rs   |   22 +-
 .../src/control/target.rs                     |  230 +
 .../src/control/targets.rs                    |  250 -
 .../src/control/template.rs                   |   63 +
 .../environment-protocol/src/data/events.rs   |   43 -
 crates/environment-protocol/src/data/exec.rs  |  373 ++
 crates/environment-protocol/src/data/fs.rs    |  545 +-
 .../src/data/handshake.rs                     |  231 +-
 crates/environment-protocol/src/data/idle.rs  |   61 +-
 .../src/data/inventory.rs                     |  122 -
 crates/environment-protocol/src/data/job.rs   |  302 +
 crates/environment-protocol/src/data/jobs.rs  |  240 -
 .../environment-protocol/src/data/methods.rs  |   36 -
 crates/environment-protocol/src/data/mod.rs   |   12 +-
 .../environment-protocol/src/data/process.rs  |  258 +-
 crates/environment-protocol/src/data/scan.rs  |  231 +
 .../environment-protocol/src/data/transfer.rs |  442 +-
 .../src/data/transfer_session.rs              |  149 -
 crates/environment-protocol/src/error.rs      |  870 ++-
 crates/environment-protocol/src/gateway.rs    |    8 -
 crates/environment-protocol/src/handshake.rs  |  257 +
 crates/environment-protocol/src/ids.rs        |  334 +
 crates/environment-protocol/src/jsonrpc.rs    |  601 ++
 crates/environment-protocol/src/lib.rs        |  100 +-
 crates/environment-protocol/src/limits.rs     |   80 +
 crates/environment-protocol/src/manifest.rs   |  651 ++
 crates/environment-protocol/src/metadata.rs   |  400 ++
 crates/environment-protocol/src/paths.rs      |  475 ++
 .../environment-protocol/src/registration.rs  |  647 +-
 crates/environment-protocol/src/routes.rs     |  464 ++
 crates/environment-protocol/src/serde_util.rs |   13 +
 crates/environment-protocol/src/shared.rs     |  461 --
 crates/environment-protocol/src/version.rs    |   17 +
 crates/environment-protocol/tests/contract.rs |   47 +
 crates/environment-protocol/tests/fixtures.rs |  203 +
 crates/environment-protocol/tests/serde.rs    |  516 +-
 crates/environment-provider-incus/CLUSTER.md  |    5 +-
 crates/environment-provider-incus/Cargo.toml  |    7 +-
 crates/environment-provider-incus/README.md   |   88 +-
 .../config.cluster.example.json               |    2 +
 .../config.example.json                       |    2 +
 .../environment-provider-incus/src/config.rs  |  354 +-
 crates/environment-provider-incus/src/edge.rs |   28 +-
 .../environment-provider-incus/src/incus.rs   |  943 ++-
 .../environment-provider-incus/src/ingress.rs |   36 +-
 .../environment-provider-incus/src/policy.rs  |  115 +-
 .../environment-provider-incus/src/relay.rs   |  140 +-
 .../environment-provider-incus/src/server.rs  | 2127 ++++--
 .../tests/incus_live.rs                       |  224 +-
 crates/environments/src/endpoint.rs           |  270 +
 crates/environments/src/lib.rs                |  680 +-
 crates/environments/src/memory.rs             |  388 +-
 crates/environments/src/tests.rs              |  467 +-
 crates/harness/src/storage/blobs.rs           |   13 +-
 crates/harness/src/storage/mod.rs             |    3 +-
 .../tests/fixtures/builtin_catalogs.json      |    6 +-
 crates/profiles/src/lib.rs                    |    9 +-
 crates/store-fs/src/blob.rs                   |    2 +-
 .../migrations/012_environment_endpoints.sql  |  138 +
 crates/store-pg/src/auth.rs                   |    8 +-
 crates/store-pg/src/blob.rs                   |    2 +-
 crates/store-pg/src/environment.rs            |  660 +-
 .../store-pg/src/environment_registration.rs  |   10 +-
 crates/store-pg/src/lib.rs                    |   29 +-
 crates/store-pg/src/migrations.rs             |    7 +-
 crates/store-pg/tests/store_pg_live.rs        |  257 +-
 crates/temporal-runtime/Cargo.toml            |    1 +
 crates/temporal-runtime/src/bots/fires.rs     |   27 +-
 crates/temporal-runtime/src/config.rs         |   18 -
 .../src/credential_injection.rs               |  138 +-
 .../src/environments/fake_controller.rs       |  754 +++
 .../src/environments/gateway.rs               |  129 +-
 .../src/environments/lifecycle.rs             | 1489 ++++-
 .../temporal-runtime/src/environments/mod.rs  |    9 +-
 .../src/environments/power.rs                 |  133 +-
 .../src/environments/prompts.rs               |   96 +-
 .../src/environments/provider_controllers.rs  | 1340 ++--
 .../src/environments/providers.rs             |  103 +-
 .../src/environments/registration.rs          |  188 +-
 .../src/environments/resolver.rs              |  699 +-
 .../src/environments/runtime.rs               |   13 +-
 .../src/environments/skills.rs                |   79 +-
 .../src/environments/sources.rs               |  160 +-
 .../src/gateway/deployment.rs                 |  141 +-
 crates/temporal-runtime/src/gateway/http.rs   |  769 ++-
 .../src/gateway/registration.rs               | 1913 ++++--
 .../src/gateway/request_context.rs            |    2 +-
 .../src/gateway/service/mod.rs                |    6 +-
 .../src/gateway/service/session_jobs.rs       | 1028 +--
 .../src/gateway/service/tests.rs              |    1 +
 crates/temporal-runtime/src/main.rs           |   17 +-
 crates/temporal-runtime/src/universe.rs       |   38 +-
 .../src/worker/activities/environment_jobs.rs |  935 ++-
 .../src/worker/activities/mod.rs              |    2 +-
 .../src/worker/session_tools.rs               |  328 +-
 .../tests/code_capabilities_live.rs           |   15 +-
 .../tests/environment_provider_live.rs        |  147 +-
 .../tests/environment_registration_live.rs    |  631 +-
 .../temporal-runtime/tests/profiles_live.rs   |   21 +-
 .../temporal-runtime/tests/subagents_live.rs  |   14 +-
 .../tests/vfs_transfer_live.rs                |  307 +-
 crates/temporal-workflow/Cargo.toml           |    1 -
 crates/temporal-workflow/src/activities.rs    |   11 +-
 .../temporal-workflow/src/environment_jobs.rs |  495 ++
 crates/temporal-workflow/src/lib.rs           |   50 +-
 crates/temporal-workflow/src/types.rs         |  129 -
 .../src/workflows/environment_job.rs          |  265 +-
 .../src/workflows/session/preparation.rs      |   74 +-
 crates/tools/Cargo.toml                       |    5 +-
 crates/tools/src/builtin/canonical.rs         |   15 +-
 .../tools/src/builtin/output_schema_tests.rs  |   61 +-
 crates/tools/src/builtin/shared.rs            |    3 +
 crates/tools/src/environment.rs               |    1 +
 crates/tools/src/environment/jobs.rs          |  922 ++-
 crates/tools/src/environment/output.rs        |  411 ++
 crates/tools/src/environment/process/mod.rs   |    2 +-
 crates/tools/src/environment/sources.rs       |   80 +-
 crates/tools/src/environment/tools/jobs.rs    |  273 +-
 .../src/environment_protocol/conformance.rs   | 1517 ++++-
 crates/tools/src/environment_protocol/mod.rs  |    8 +-
 .../tools/src/environment_protocol/remote.rs  | 2084 +++---
 crates/tools/src/fs/apply_patch/engine.rs     |   41 +-
 crates/tools/src/fs/local.rs                  |   77 +-
 crates/tools/src/fs/memory.rs                 |  103 +-
 crates/tools/src/fs/mod.rs                    |  120 +-
 crates/tools/src/fs/pattern.rs                |  141 +
 crates/tools/src/fs/read_only.rs              |   52 +-
 crates/tools/src/fs/scoped.rs                 |   46 +-
 crates/tools/src/fs/scoped_local.rs           |   96 +-
 crates/tools/src/fs/tools/edit_file.rs        |   18 +-
 crates/tools/src/fs/tools/glob.rs             |  165 +-
 crates/tools/src/fs/tools/grep.rs             |  142 +-
 crates/tools/src/fs/tools/mod.rs              |    1 +
 crates/tools/src/fs/tools/read_file.rs        |   29 +-
 crates/tools/src/fs/tools/shared.rs           |  137 +-
 crates/tools/src/fs/tools/write_file.rs       |    2 +-
 crates/tools/src/fs/vfs.rs                    |  182 +-
 crates/tools/src/prompts/environment.rs       |  135 +-
 crates/tools/src/skills/environment.rs        |  293 +-
 crates/tools/src/transfer.rs                  |  846 ++-
 .../documentation/deployment/configuration.md |    3 +-
 docs/documentation/deployment/self-hosting.md |    9 +-
 .../deployment/upgrades-and-recovery.md       |   20 +-
 .../development/changing-contracts.md         |   51 +-
 .../development/testing-and-evaluation.md     |    6 +-
 .../environments/bring-your-own-compute.md    |   34 +-
 docs/documentation/environments/incus-vms.md  |   83 +-
 .../environments/networking-and-ingress.md    |   27 +-
 docs/documentation/environments/overview.md   |    9 +-
 .../environments/power-and-cleanup.md         |   33 +-
 .../environments/processes-and-jobs.md        |  108 +-
 .../environments/using-environments.md        |   13 +
 .../environments/vfs-transfer.md              |  112 +-
 docs/documentation/index.md                   |    4 +-
 .../environment-providers.md                  |  466 +-
 .../reference/environment-protocol.md         |  640 ++
 .../reference/environment-variables.md        |   57 +-
 .../using-lightspeed/workspaces-and-skills.md |    8 +-
 docs/site/astro.config.mjs                    |    1 +
 .../src/routes/environment-deployment.ts      |   14 +-
 platform/backend/src/routes/gateway.ts        |    5 +-
 .../configurator-mcp/src/generated/tools.ts   |   70 +-
 .../src/demo/fixtures/personal-assistant.ts   |    2 +-
 platform/web/src/demo/fixtures/platform.ts    |    7 +-
 .../web/src/demo/fixtures/software-factory.ts |    2 +-
 platform/web/src/demo/routes/admin.ts         |   49 +-
 platform/web/src/demo/routes/environments.ts  |   15 +-
 .../pages/AdminEnvironmentProvidersPage.tsx   |   95 +-
 platform/web/src/pages/EnvironmentsPage.tsx   |   19 +-
 release/metadata.env                          |   11 +-
 release/release-manifest.schema.json          |    6 +-
 scripts/release/create-manifest.mjs           |   19 +-
 scripts/release/smoke.sh                      |    2 +-
 scripts/release/verify-manifest.mjs           |    9 +-
 scripts/release/verify-metadata.sh            |    6 +-
 310 files changed, 68930 insertions(+), 22964 deletions(-)
 create mode 100644 crates/environment-client/src/conformance/controller.rs
 create mode 100644 crates/environment-client/src/conformance/mod.rs
 create mode 100644 crates/environment-client/src/connection.rs
 delete mode 100644 crates/environment-client/src/control.rs
 create mode 100644 crates/environment-client/src/controller.rs
 create mode 100644 crates/environment-client/src/dial.rs
 create mode 100644 crates/environment-client/src/options.rs
 delete mode 100644 crates/environment-client/src/rpc.rs
 delete mode 100644 crates/environment-client/src/transport.rs
 create mode 100644 crates/environment-daemon/src/dispatch.rs
 create mode 100644 crates/environment-daemon/src/exec.rs
 create mode 100644 crates/environment-daemon/src/exec/execution.rs
 create mode 100644 crates/environment-daemon/src/exec/input.rs
 create mode 100644 crates/environment-daemon/src/exec/job_store.rs
 create mode 100644 crates/environment-daemon/src/exec/log.rs
 create mode 100644 crates/environment-daemon/src/exec/outcome.rs
 create mode 100644 crates/environment-daemon/src/exec/spawn_record.rs
 delete mode 100644 crates/environment-daemon/src/filesystem/backend/mod.rs
 delete mode 100644 crates/environment-daemon/src/filesystem/backend/unix.rs
 create mode 100644 crates/environment-daemon/src/filesystem/confinement.rs
 create mode 100644 crates/environment-daemon/src/filesystem/os.rs
 create mode 100644 crates/environment-daemon/src/filesystem/search.rs
 create mode 100644 crates/environment-daemon/src/filesystem/transfer/capture.rs
 create mode 100644 crates/environment-daemon/src/filesystem/transfer/publish.rs
 delete mode 100644 crates/environment-daemon/src/filesystem/transfer/session.rs
 create mode 100644 crates/environment-daemon/src/filesystem/walk.rs
 delete mode 100644 crates/environment-daemon/src/rpc.rs
 create mode 100644 crates/environment-daemon/tests/client_round_trip.rs
 create mode 100644 crates/environment-protocol/contract/controller.openrpc.json
 create mode 100644 crates/environment-protocol/contract/controller.schema.json
 create mode 100644 crates/environment-protocol/contract/data.openrpc.json
 create mode 100644 crates/environment-protocol/contract/data.schema.json
 create mode 100644 crates/environment-protocol/contract/registration.openrpc.json
 create mode 100644 crates/environment-protocol/contract/registration.schema.json
 create mode 100644 crates/environment-protocol/fixtures/bootstrap/build-facts.json
 create mode 100644 crates/environment-protocol/fixtures/bootstrap/discovery-document.json
 create mode 100644 crates/environment-protocol/fixtures/controller/ingress.ensure.json
 create mode 100644 crates/environment-protocol/fixtures/controller/ingress.remove.json
 create mode 100644 crates/environment-protocol/fixtures/controller/initialize.json
 create mode 100644 crates/environment-protocol/fixtures/controller/target.adopt.json
 create mode 100644 crates/environment-protocol/fixtures/controller/target.close.json
 create mode 100644 crates/environment-protocol/fixtures/controller/target.create.json
 create mode 100644 crates/environment-protocol/fixtures/controller/target.get.json
 create mode 100644 crates/environment-protocol/fixtures/controller/target.setPower.json
 create mode 100644 crates/environment-protocol/fixtures/controller/template.list.json
 delete mode 100644 crates/environment-protocol/fixtures/controller_create_target_params.json
 delete mode 100644 crates/environment-protocol/fixtures/controller_create_target_response.json
 delete mode 100644 crates/environment-protocol/fixtures/controller_initialize_params.json
 delete mode 100644 crates/environment-protocol/fixtures/controller_list_targets_response.json
 create mode 100644 crates/environment-protocol/fixtures/data/env.getIdle.json
 create mode 100644 crates/environment-protocol/fixtures/data/fs.createDirectory.json
 create mode 100644 crates/environment-protocol/fixtures/data/fs.getMetadata.json
 create mode 100644 crates/environment-protocol/fixtures/data/fs.globFiles.json
 create mode 100644 crates/environment-protocol/fixtures/data/fs.readDirectory.json
 create mode 100644 crates/environment-protocol/fixtures/data/fs.readFile.json
 create mode 100644 crates/environment-protocol/fixtures/data/fs.remove.json
 create mode 100644 crates/environment-protocol/fixtures/data/fs.rename.json
 create mode 100644 crates/environment-protocol/fixtures/data/fs.scan.json
 create mode 100644 crates/environment-protocol/fixtures/data/fs.searchText.json
 create mode 100644 crates/environment-protocol/fixtures/data/fs.writeFile.json
 create mode 100644 crates/environment-protocol/fixtures/data/initialize.json
 create mode 100644 crates/environment-protocol/fixtures/data/job.cancel.json
 create mode 100644 crates/environment-protocol/fixtures/data/job.read.json
 create mode 100644 crates/environment-protocol/fixtures/data/job.start.json
 create mode 100644 crates/environment-protocol/fixtures/data/process.read.json
 create mode 100644 crates/environment-protocol/fixtures/data/process.start.json
 create mode 100644 crates/environment-protocol/fixtures/data/process.terminate.json
 create mode 100644 crates/environment-protocol/fixtures/data/process.write.json
 create mode 100644 crates/environment-protocol/fixtures/data/rpc.cancelRequest.json
 create mode 100644 crates/environment-protocol/fixtures/data/transfer.abort.json
 create mode 100644 crates/environment-protocol/fixtures/data/transfer.advance.json
 create mode 100644 crates/environment-protocol/fixtures/data/transfer.append.json
 create mode 100644 crates/environment-protocol/fixtures/data/transfer.begin.json
 create mode 100644 crates/environment-protocol/fixtures/data/transfer.commit.json
 create mode 100644 crates/environment-protocol/fixtures/data/transfer.getStatus.json
 create mode 100644 crates/environment-protocol/fixtures/data/transfer.listMissing.json
 create mode 100644 crates/environment-protocol/fixtures/data/transfer.read.json
 create mode 100644 crates/environment-protocol/fixtures/data/transfer.readInventory.json
 create mode 100644 crates/environment-protocol/fixtures/data/transfer.write.json
 delete mode 100644 crates/environment-protocol/fixtures/data_initialize_params.json
 delete mode 100644 crates/environment-protocol/fixtures/fs_read_file_response.json
 delete mode 100644 crates/environment-protocol/fixtures/job_read_response.json
 delete mode 100644 crates/environment-protocol/fixtures/job_start_params.json
 delete mode 100644 crates/environment-protocol/fixtures/process_read_response.json
 delete mode 100644 crates/environment-protocol/fixtures/process_start_params.json
 create mode 100644 crates/environment-protocol/fixtures/registration/registration.challenge.json
 create mode 100644 crates/environment-protocol/fixtures/registration/registration.closed.json
 create mode 100644 crates/environment-protocol/fixtures/registration/registration.goodbye.json
 create mode 100644 crates/environment-protocol/fixtures/registration/registration.openStream.json
 create mode 100644 crates/environment-protocol/fixtures/registration/registration.register.json
 create mode 100644 crates/environment-protocol/src/bin/export-contract.rs
 create mode 100644 crates/environment-protocol/src/bootstrap.rs
 create mode 100644 crates/environment-protocol/src/bytes.rs
 create mode 100644 crates/environment-protocol/src/contract.rs
 delete mode 100644 crates/environment-protocol/src/control/methods.rs
 create mode 100644 crates/environment-protocol/src/control/target.rs
 delete mode 100644 crates/environment-protocol/src/control/targets.rs
 create mode 100644 crates/environment-protocol/src/control/template.rs
 delete mode 100644 crates/environment-protocol/src/data/events.rs
 create mode 100644 crates/environment-protocol/src/data/exec.rs
 delete mode 100644 crates/environment-protocol/src/data/inventory.rs
 create mode 100644 crates/environment-protocol/src/data/job.rs
 delete mode 100644 crates/environment-protocol/src/data/jobs.rs
 delete mode 100644 crates/environment-protocol/src/data/methods.rs
 create mode 100644 crates/environment-protocol/src/data/scan.rs
 delete mode 100644 crates/environment-protocol/src/data/transfer_session.rs
 delete mode 100644 crates/environment-protocol/src/gateway.rs
 create mode 100644 crates/environment-protocol/src/handshake.rs
 create mode 100644 crates/environment-protocol/src/ids.rs
 create mode 100644 crates/environment-protocol/src/jsonrpc.rs
 create mode 100644 crates/environment-protocol/src/limits.rs
 create mode 100644 crates/environment-protocol/src/manifest.rs
 create mode 100644 crates/environment-protocol/src/metadata.rs
 create mode 100644 crates/environment-protocol/src/paths.rs
 create mode 100644 crates/environment-protocol/src/routes.rs
 create mode 100644 crates/environment-protocol/src/serde_util.rs
 delete mode 100644 crates/environment-protocol/src/shared.rs
 create mode 100644 crates/environment-protocol/src/version.rs
 create mode 100644 crates/environment-protocol/tests/contract.rs
 create mode 100644 crates/environment-protocol/tests/fixtures.rs
 create mode 100644 crates/environments/src/endpoint.rs
 create mode 100644 crates/store-pg/migrations/012_environment_endpoints.sql
 create mode 100644 crates/temporal-runtime/src/environments/fake_controller.rs
 create mode 100644 crates/temporal-workflow/src/environment_jobs.rs
 create mode 100644 crates/tools/src/environment/output.rs
 create mode 100644 crates/tools/src/fs/pattern.rs
 create mode 100644 docs/documentation/reference/environment-protocol.md

diff --git a/Cargo.lock b/Cargo.lock
index 074ab70de..f73f85622 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1304,7 +1304,7 @@ dependencies = [
 name = "environment-client"
 version = "0.1.0"
 dependencies = [
- "async-trait",
+ "environment-client",
  "environment-protocol",
  "futures-util",
  "serde",
@@ -1319,8 +1319,6 @@ name = "environment-daemon"
 version = "0.4.0"
 dependencies = [
  "anyhow",
- "api",
- "async-trait",
  "clap",
  "dotenvy",
  "ed25519-dalek",
@@ -1328,7 +1326,7 @@ dependencies = [
  "environment-protocol",
  "flate2",
  "futures-util",
- "glob",
+ "globset",
  "grep-regex",
  "grep-searcher",
  "harness",
@@ -1351,6 +1349,7 @@ dependencies = [
  "thiserror 2.0.21",
  "tokio",
  "tokio-tungstenite 0.30.0",
+ "tokio-util",
  "tools",
  "vfs",
  "webpki-roots 1.0.9",
@@ -1361,9 +1360,12 @@ name = "environment-protocol"
 version = "0.1.0"
 dependencies = [
  "base64 0.23.1",
+ "environment-protocol",
  "schemars",
  "serde",
  "serde_json",
+ "serde_path_to_error",
+ "sha2 0.11.0",
  "thiserror 2.0.21",
 ]
 
@@ -1376,6 +1378,7 @@ dependencies = [
  "axum",
  "clap",
  "dotenvy",
+ "environment-client",
  "environment-protocol",
  "futures-util",
  "release-info",
@@ -1387,6 +1390,7 @@ dependencies = [
  "thiserror 2.0.21",
  "tokio",
  "tokio-tungstenite 0.30.0",
+ "tools",
  "uuid",
 ]
 
@@ -1854,12 +1858,6 @@ dependencies = [
  "weezl",
 ]
 
-[[package]]
-name = "glob"
-version = "0.3.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e4eba85ea1d0a966a983acd07deee566e67395d2d96b6fb39e62b5a833f1eb0b"
-
 [[package]]
 name = "globset"
 version = "0.4.20"
@@ -5281,7 +5279,6 @@ dependencies = [
  "bots",
  "channels",
  "chrono",
- "environment-protocol",
  "futures",
  "futures-util",
  "harness",
@@ -5934,8 +5931,9 @@ dependencies = [
  "environment-client",
  "environment-protocol",
  "futures-util",
- "glob",
+ "globset",
  "harness",
+ "ignore",
  "jsonschema",
  "regex",
  "reqwest",
diff --git a/clients/typescript/schema/api.schema.json b/clients/typescript/schema/api.schema.json
index d2bce1b0a..f36246cf9 100644
--- a/clients/typescript/schema/api.schema.json
+++ b/clients/typescript/schema/api.schema.json
@@ -8763,21 +8763,6 @@
       ],
       "type": "object"
     },
-    "DeploymentEnvironmentProviderConnection": {
-      "properties": {
-        "endpoint": {
-          "type": "string"
-        },
-        "transport": {
-          "$ref": "#/definitions/DeploymentEnvironmentProviderTransport"
-        }
-      },
-      "required": [
-        "endpoint",
-        "transport"
-      ],
-      "type": "object"
-    },
     "DeploymentEnvironmentProviderDeleteParams": {
       "properties": {
         "providerId": {
@@ -8800,6 +8785,24 @@
       ],
       "type": "object"
     },
+    "DeploymentEnvironmentProviderFeaturesView": {
+      "description": "Optional controller methods the provider's controller advertised.",
+      "properties": {
+        "adoptTarget": {
+          "description": "Existing targets can be adopted (`environment/adopt`).",
+          "type": "boolean"
+        },
+        "ingress": {
+          "description": "Public ingress can be enabled on environments.",
+          "type": "boolean"
+        }
+      },
+      "required": [
+        "adoptTarget",
+        "ingress"
+      ],
+      "type": "object"
+    },
     "DeploymentEnvironmentProviderListParams": {
       "type": "object"
     },
@@ -8818,9 +8821,18 @@
       "type": "object"
     },
     "DeploymentEnvironmentProviderPutParams": {
+      "description": "Register or replace a provider. `credential` is the bearer token\nLightspeed presents to the provider's controller and data routes: it is\nsealed on receipt and never returned by any method. `Debug` output\nredacts it; request logging must never echo these params.",
       "properties": {
-        "controllerConnection": {
-          "$ref": "#/definitions/DeploymentEnvironmentProviderConnection"
+        "controllerEndpoint": {
+          "description": "`ws://`, `wss://` or `unix://` URL of the provider controller.",
+          "type": "string"
+        },
+        "credential": {
+          "description": "Required when the provider is new; omit to keep the stored one.",
+          "type": [
+            "string",
+            "null"
+          ]
         },
         "displayName": {
           "type": [
@@ -8840,7 +8852,7 @@
       },
       "required": [
         "providerId",
-        "controllerConnection"
+        "controllerEndpoint"
       ],
       "type": "object"
     },
@@ -8877,83 +8889,34 @@
       ],
       "type": "object"
     },
-    "DeploymentEnvironmentProviderTransport": {
-      "oneOf": [
-        {
-          "properties": {
-            "type": {
-              "const": "webSocket",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "const": "http",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "const": "stdio",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "const": "ssh",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "type": "object"
+    "DeploymentEnvironmentProviderView": {
+      "properties": {
+        "controllerEndpoint": {
+          "description": "`ws://`, `wss://` or `unix://` URL of the provider controller.",
+          "type": "string"
         },
-        {
-          "properties": {
-            "providerType": {
-              "type": "string"
+        "controllerFeatures": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/DeploymentEnvironmentProviderFeaturesView"
             },
-            "type": {
-              "const": "provider",
-              "type": "string"
+            {
+              "type": "null"
             }
-          },
-          "required": [
-            "type",
-            "providerType"
           ],
-          "type": "object"
-        }
-      ]
-    },
-    "DeploymentEnvironmentProviderView": {
-      "properties": {
-        "controllerConnection": {
-          "$ref": "#/definitions/DeploymentEnvironmentProviderConnection"
+          "description": "What the controller advertised at its last successful handshake;\nabsent until Lightspeed first reached it at this endpoint."
         },
         "createdAtMs": {
           "format": "int64",
           "type": "integer"
         },
+        "dataRouteBase": {
+          "description": "Base URL of the provider's data routes, as its controller advertised\nit; absent until then.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
         "displayName": {
           "type": [
             "string",
@@ -8976,7 +8939,7 @@
       },
       "required": [
         "providerId",
-        "controllerConnection",
+        "controllerEndpoint",
         "createdAtMs",
         "updatedAtMs"
       ],
@@ -9339,54 +9302,6 @@
       ],
       "type": "object"
     },
-    "EnvironmentConnectionTransportView": {
-      "oneOf": [
-        {
-          "enum": [
-            "webSocket",
-            "http",
-            "stdio",
-            "ssh"
-          ],
-          "type": "string"
-        },
-        {
-          "additionalProperties": false,
-          "properties": {
-            "provider": {
-              "properties": {
-                "provider_type": {
-                  "type": "string"
-                }
-              },
-              "required": [
-                "provider_type"
-              ],
-              "type": "object"
-            }
-          },
-          "required": [
-            "provider"
-          ],
-          "type": "object"
-        }
-      ]
-    },
-    "EnvironmentConnectionView": {
-      "properties": {
-        "endpoint": {
-          "type": "string"
-        },
-        "transport": {
-          "$ref": "#/definitions/EnvironmentConnectionTransportView"
-        }
-      },
-      "required": [
-        "endpoint",
-        "transport"
-      ],
-      "type": "object"
-    },
     "EnvironmentCreateParams": {
       "properties": {
         "bindingId": {
@@ -9609,7 +9524,7 @@
           "type": "string"
         },
         "protocolVersion": {
-          "description": "Environment protocol version the gateway speaks. A daemon registers\nonly when it reports exactly this number.",
+          "description": "The envd protocol version (data plane and registration channel)\nthe gateway speaks. A daemon registers only when it reports exactly\nthis number.",
           "format": "uint32",
           "minimum": 0,
           "type": "integer"
@@ -9635,20 +9550,16 @@
     },
     "EnvironmentExternalCreateParams": {
       "properties": {
-        "connection": {
-          "allOf": [
-            {
-              "$ref": "#/definitions/EnvironmentConnectionView"
-            }
-          ],
-          "description": "Connection to an envd instance reachable from Lightspeed."
-        },
         "displayName": {
           "type": [
             "string",
             "null"
           ]
         },
+        "endpoint": {
+          "description": "`ws://`, `wss://` or `unix://` URL of an envd instance reachable from\nLightspeed.",
+          "type": "string"
+        },
         "metadata": {
           "additionalProperties": {
             "type": "string"
@@ -9661,7 +9572,7 @@
       },
       "required": [
         "requestId",
-        "connection"
+        "endpoint"
       ],
       "type": "object"
     },
@@ -9918,7 +9829,8 @@
     },
     "EnvironmentJobReadParams": {
       "properties": {
-        "afterSeq": {
+        "after": {
+          "description": "Byte offset to read each job's output from: a previous entry's\n`outputNext`. Omitted with `tailBytes` omitted reads from the start.",
           "format": "uint64",
           "minimum": 0,
           "type": [
@@ -9926,18 +9838,24 @@
             "null"
           ]
         },
-        "includeArtifacts": {
-          "default": false,
-          "type": "boolean"
-        },
         "jobs": {
           "items": {
             "$ref": "#/definitions/SessionJobHandleInput"
           },
           "type": "array"
         },
-        "outputBytes": {
-          "format": "uint",
+        "maxBytes": {
+          "description": "Most output bytes per job; omit for the server's default page.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": [
+            "integer",
+            "null"
+          ]
+        },
+        "tailBytes": {
+          "description": "Read each job's last `tailBytes` of output instead; excludes `after`.",
+          "format": "uint64",
           "minimum": 0,
           "type": [
             "integer",
@@ -9962,6 +9880,29 @@
       },
       "type": "object"
     },
+    "EnvironmentLifecycleErrorView": {
+      "properties": {
+        "firstAtMs": {
+          "description": "When the current run of errors began.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "lastAtMs": {
+          "description": "When `message` was recorded.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "message": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "message",
+        "firstAtMs",
+        "lastAtMs"
+      ],
+      "type": "object"
+    },
     "EnvironmentLifecycleStatusView": {
       "oneOf": [
         {
@@ -10500,8 +10441,9 @@
         },
         {
           "properties": {
-            "connection": {
-              "$ref": "#/definitions/EnvironmentConnectionView"
+            "endpoint": {
+              "description": "`ws://`, `wss://` or `unix://` URL Lightspeed dials envd at.",
+              "type": "string"
             },
             "type": {
               "const": "external",
@@ -10510,7 +10452,7 @@
           },
           "required": [
             "type",
-            "connection"
+            "endpoint"
           ],
           "type": "object"
         },
@@ -10592,6 +10534,36 @@
       ],
       "type": "object"
     },
+    "EnvironmentTemplateResourcesView": {
+      "description": "A template's compute, in provider-neutral units. Each field is absent\nwhen the provider does not fix it.",
+      "properties": {
+        "diskBytes": {
+          "format": "uint64",
+          "minimum": 0,
+          "type": [
+            "integer",
+            "null"
+          ]
+        },
+        "memoryBytes": {
+          "format": "uint64",
+          "minimum": 0,
+          "type": [
+            "integer",
+            "null"
+          ]
+        },
+        "vcpus": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": [
+            "integer",
+            "null"
+          ]
+        }
+      },
+      "type": "object"
+    },
     "EnvironmentTemplateView": {
       "properties": {
         "bindingId": {
@@ -10621,6 +10593,17 @@
         "publicIngress": {
           "type": "boolean"
         },
+        "resources": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/EnvironmentTemplateResourcesView"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Compute targets of this template get; absent when the provider does\nnot fix it."
+        },
         "templateId": {
           "type": "string"
         }
@@ -10679,6 +10662,17 @@
             "null"
           ]
         },
+        "lifecycleError": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/EnvironmentLifecycleErrorView"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Why the environment failed, or the latest error (or what the\nprovider reports it is waiting on) while its lifecycle converges;\nabsent once it reaches a steady state."
+        },
         "metadata": {
           "additionalProperties": {
             "type": "string"
@@ -10686,12 +10680,14 @@
           "type": "object"
         },
         "publicEndpoint": {
+          "description": "The public endpoint the provider last reported. It lags\n`publicIngressEnabled` while the lifecycle reconciler converges.",
           "type": [
             "string",
             "null"
           ]
         },
         "publicIngressEnabled": {
+          "description": "Lightspeed-owned public ingress intent; `publicEndpoint` is what the\nprovider realized.",
           "type": "boolean"
         },
         "requestId": {
@@ -15777,29 +15773,6 @@
       ],
       "type": "object"
     },
-    "SessionJobArtifactView": {
-      "properties": {
-        "kind": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "metadata": {
-          "additionalProperties": {
-            "type": "string"
-          },
-          "type": "object"
-        },
-        "path": {
-          "type": "string"
-        }
-      },
-      "required": [
-        "path"
-      ],
-      "type": "object"
-    },
     "SessionJobCancelEntryView": {
       "properties": {
         "error": {
@@ -15862,6 +15835,49 @@
       ],
       "type": "string"
     },
+    "SessionJobExitView": {
+      "description": "How a job's root process ended.",
+      "oneOf": [
+        {
+          "description": "Normal exit with this status code.",
+          "properties": {
+            "code": {
+              "format": "int32",
+              "type": "integer"
+            },
+            "type": {
+              "const": "code",
+              "type": "string"
+            }
+          },
+          "required": [
+            "type",
+            "code"
+          ],
+          "type": "object"
+        },
+        {
+          "description": "Killed by this signal, named like `SIGSEGV`.",
+          "properties": {
+            "coreDumped": {
+              "type": "boolean"
+            },
+            "signal": {
+              "type": "string"
+            },
+            "type": {
+              "const": "signal",
+              "type": "string"
+            }
+          },
+          "required": [
+            "type",
+            "signal"
+          ],
+          "type": "object"
+        }
+      ]
+    },
     "SessionJobHandleInput": {
       "properties": {
         "environmentId": {
@@ -15897,7 +15913,8 @@
         "dataBase64": {
           "type": "string"
         },
-        "seq": {
+        "offset": {
+          "description": "Byte offset of the chunk's first byte in the job's combined output.",
           "format": "uint64",
           "minimum": 0,
           "type": "integer"
@@ -15907,12 +15924,50 @@
         }
       },
       "required": [
-        "seq",
+        "offset",
         "stream",
         "dataBase64"
       ],
       "type": "object"
     },
+    "SessionJobOutputGapReasonView": {
+      "oneOf": [
+        {
+          "const": "overflow",
+          "description": "Dropped from the middle because the job's retained output exceeded\nits cap; the head and the newest bytes are kept.",
+          "type": "string"
+        },
+        {
+          "const": "expired",
+          "description": "Released after it was delivered.",
+          "type": "string"
+        }
+      ]
+    },
+    "SessionJobOutputGapView": {
+      "description": "Output bytes in `[offset, offset + omittedBytes)` that cannot be\nreturned.",
+      "properties": {
+        "offset": {
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "omittedBytes": {
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "reason": {
+          "$ref": "#/definitions/SessionJobOutputGapReasonView"
+        }
+      },
+      "required": [
+        "offset",
+        "omittedBytes",
+        "reason"
+      ],
+      "type": "object"
+    },
     "SessionJobOutputStreamView": {
       "enum": [
         "stdout",
@@ -15921,13 +15976,8 @@
       "type": "string"
     },
     "SessionJobReadEntryView": {
+      "description": "One job's summary and output page, or why it could not be read: an\nentry with `error` and no summary names a job the environment does not\nknow (never created, or garbage-collected).",
       "properties": {
-        "artifacts": {
-          "items": {
-            "$ref": "#/definitions/SessionJobArtifactView"
-          },
-          "type": "array"
-        },
         "error": {
           "type": [
             "string",
@@ -15945,12 +15995,27 @@
           ]
         },
         "outputChunks": {
+          "description": "Output in offset order.",
           "items": {
             "$ref": "#/definitions/SessionJobOutputChunkView"
           },
           "type": "array"
         },
-        "outputNextSeq": {
+        "outputEnd": {
+          "description": "Output bytes the job produced so far; final once it is terminal.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "outputGaps": {
+          "description": "Output ranges between the requested start and `outputNext` that\ncannot be returned.",
+          "items": {
+            "$ref": "#/definitions/SessionJobOutputGapView"
+          },
+          "type": "array"
+        },
+        "outputNext": {
+          "description": "Byte offset to continue reading from: pass it as `after`.",
           "format": "uint64",
           "minimum": 0,
           "type": "integer"
@@ -15967,7 +16032,8 @@
         }
       },
       "required": [
-        "outputNextSeq"
+        "outputNext",
+        "outputEnd"
       ],
       "type": "object"
     },
@@ -16087,26 +16153,84 @@
       "type": "object"
     },
     "SessionJobStatusView": {
-      "enum": [
-        "accepted",
-        "queued",
-        "running",
-        "succeeded",
-        "failed",
-        "cancelRequested",
-        "cancelled",
-        "timedOut",
-        "dependencyFailed",
-        "interrupted",
-        "lost"
-      ],
-      "type": "string"
+      "description": "Job lifecycle. `queued` and `running` are live; the rest are terminal.",
+      "oneOf": [
+        {
+          "enum": [
+            "running"
+          ],
+          "type": "string"
+        },
+        {
+          "const": "queued",
+          "description": "Waiting for dependencies or its queue.",
+          "type": "string"
+        },
+        {
+          "const": "succeeded",
+          "description": "Exited with code 0.",
+          "type": "string"
+        },
+        {
+          "const": "failed",
+          "description": "Exited otherwise, or could not start.",
+          "type": "string"
+        },
+        {
+          "const": "timedOut",
+          "description": "Its timeout expired and it was stopped.",
+          "type": "string"
+        },
+        {
+          "const": "cancelled",
+          "description": "Stopped or never started because of a cancel.",
+          "type": "string"
+        },
+        {
+          "const": "dependencyFailed",
+          "description": "A dependency did not finish as the dependency policy requires.",
+          "type": "string"
+        },
+        {
+          "const": "interrupted",
+          "description": "The environment daemon stopped while the job was queued or running.",
+          "type": "string"
+        }
+      ]
+    },
+    "SessionJobStoppedByView": {
+      "description": "Why Lightspeed stopped a running job.",
+      "oneOf": [
+        {
+          "const": "timeout",
+          "description": "Its timeout expired: terminate, a grace period, then kill.",
+          "type": "string"
+        },
+        {
+          "const": "terminate",
+          "description": "A cancel without `force`: terminate, a grace period, then kill.",
+          "type": "string"
+        },
+        {
+          "const": "kill",
+          "description": "A cancel with `force`: killed at once.",
+          "type": "string"
+        }
+      ]
     },
     "SessionJobSummaryView": {
+      "description": "What a job is and how it ended. Instants are the environment's wall\nclock.",
       "properties": {
+        "cancelRequestedAtMs": {
+          "description": "When a cancel reached the job while it ran.",
+          "format": "int64",
+          "type": [
+            "integer",
+            "null"
+          ]
+        },
         "createdAtMs": {
-          "format": "uint64",
-          "minimum": 0,
+          "format": "int64",
           "type": "integer"
         },
         "dependencies": {
@@ -16115,13 +16239,26 @@
           },
           "type": "array"
         },
-        "exitCode": {
-          "format": "int32",
+        "durationMs": {
+          "description": "Run time from start to finish, immune to clock jumps.",
+          "format": "uint64",
+          "minimum": 0,
           "type": [
             "integer",
             "null"
           ]
         },
+        "exit": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/SessionJobExitView"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "How the job's root process ended, once it ran and exited."
+        },
         "failure": {
           "type": [
             "string",
@@ -16129,8 +16266,7 @@
           ]
         },
         "finishedAtMs": {
-          "format": "uint64",
-          "minimum": 0,
+          "format": "int64",
           "type": [
             "integer",
             "null"
@@ -16145,9 +16281,6 @@
             "null"
           ]
         },
-        "namespace": {
-          "type": "string"
-        },
         "orphanedDescendants": {
           "description": "True when the job's root process exited while descendants it spawned\nwere still running; the host terminated them best-effort at job\ncompletion.",
           "type": "boolean"
@@ -16159,16 +16292,18 @@
           ]
         },
         "queuedAtMs": {
-          "format": "uint64",
-          "minimum": 0,
+          "format": "int64",
           "type": [
             "integer",
             "null"
           ]
         },
+        "requestId": {
+          "description": "The start request that created the job; part of its identity.",
+          "type": "string"
+        },
         "startedAtMs": {
-          "format": "uint64",
-          "minimum": 0,
+          "format": "int64",
           "type": [
             "integer",
             "null"
@@ -16176,11 +16311,22 @@
         },
         "status": {
           "$ref": "#/definitions/SessionJobStatusView"
+        },
+        "stoppedBy": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/SessionJobStoppedByView"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Set when Lightspeed stopped the running job."
         }
       },
       "required": [
-        "namespace",
         "jobId",
+        "requestId",
         "status",
         "createdAtMs"
       ],
diff --git a/clients/typescript/src/generated/methods.ts b/clients/typescript/src/generated/methods.ts
index e9e78e345..fe535acfe 100644
--- a/clients/typescript/src/generated/methods.ts
+++ b/clients/typescript/src/generated/methods.ts
@@ -368,7 +368,7 @@ export const METHOD_INFO = {
     scope: "universe",
     access: {"action":"configure_resource","kind":"universe"},
     summary: "Configure environment public ingress",
-    description: "Synchronously enables or disables one provider-authorized HTTPS endpoint for a provisioned environment. The provider owns hostname allocation, the approved guest port, routing, TLS, and health.",
+    description: "Records the public ingress intent of a provisioned environment; the lifecycle reconciler converges it while the environment is ready, and `publicEndpoint` shows the realized endpoint. Rejected when the provider does not offer ingress. The provider owns hostname, guest port, routing, TLS, and health; an intent its template refuses is dropped.",
   },
   "environments/power/put": {
     scope: "universe",
@@ -416,7 +416,7 @@ export const METHOD_INFO = {
     scope: "universe",
     access: {"action":"read","kind":"universe"},
     summary: "Read environment jobs",
-    description: "Reads selected job handles with bounded output, optional sequence continuation, and optional artifacts; use returned status/sequence data for polling.",
+    description: "Reads selected job handles with bounded output from a byte offset or the output tail; continue from each entry's outputNext and poll on the returned status.",
   },
   "environments/jobs/cancel": {
     scope: "universe",
@@ -944,19 +944,19 @@ export const METHOD_INFO = {
     scope: "deployment",
     access: {"kind":"deployment"},
     summary: "Put an environment provider",
-    description: "Registers or replaces one deployment provider and its controller connection. The provider does not call this API or require access to Lightspeed.",
+    description: "Registers or replaces one deployment provider: its controller endpoint URL and the bearer credential Lightspeed presents to the controller and data routes. The credential is write-only: required for a new provider, kept when omitted, never returned. The provider does not call this API or require access to Lightspeed.",
   },
   "deployment/environment-providers/list": {
     scope: "deployment",
     access: {"kind":"deployment"},
     summary: "List environment providers",
-    description: "Returns every deployment-registered deployment provider and its controller connection.",
+    description: "Returns every deployment-registered provider with its controller endpoint and the optional features its controller last advertised.",
   },
   "deployment/environment-providers/read": {
     scope: "deployment",
     access: {"kind":"deployment"},
     summary: "Read an environment provider",
-    description: "Returns one deployment-registered deployment provider and its controller connection.",
+    description: "Returns one deployment-registered provider with its controller endpoint and the optional features its controller last advertised.",
   },
   "deployment/environment-providers/delete": {
     scope: "deployment",
@@ -1330,7 +1330,7 @@ export interface MethodMap {
   /**
    * Configure environment public ingress
    *
-   * Synchronously enables or disables one provider-authorized HTTPS endpoint for a provisioned environment. The provider owns hostname allocation, the approved guest port, routing, TLS, and health.
+   * Records the public ingress intent of a provisioned environment; the lifecycle reconciler converges it while the environment is ready, and `publicEndpoint` shows the realized endpoint. Rejected when the provider does not offer ingress. The provider owns hostname, guest port, routing, TLS, and health; an intent its template refuses is dropped.
    */
   "environments/ingress/put": {
     params: Api.EnvironmentIngressPutParams;
@@ -1402,7 +1402,7 @@ export interface MethodMap {
   /**
    * Read environment jobs
    *
-   * Reads selected job handles with bounded output, optional sequence continuation, and optional artifacts; use returned status/sequence data for polling.
+   * Reads selected job handles with bounded output from a byte offset or the output tail; continue from each entry's outputNext and poll on the returned status.
    */
   "environments/jobs/read": {
     params: Api.EnvironmentJobReadParams;
@@ -2194,7 +2194,7 @@ export interface MethodMap {
   /**
    * Put an environment provider
    *
-   * Registers or replaces one deployment provider and its controller connection. The provider does not call this API or require access to Lightspeed.
+   * Registers or replaces one deployment provider: its controller endpoint URL and the bearer credential Lightspeed presents to the controller and data routes. The credential is write-only: required for a new provider, kept when omitted, never returned. The provider does not call this API or require access to Lightspeed.
    */
   "deployment/environment-providers/put": {
     params: Api.DeploymentEnvironmentProviderPutParams;
@@ -2203,7 +2203,7 @@ export interface MethodMap {
   /**
    * List environment providers
    *
-   * Returns every deployment-registered deployment provider and its controller connection.
+   * Returns every deployment-registered provider with its controller endpoint and the optional features its controller last advertised.
    */
   "deployment/environment-providers/list": {
     params: Api.DeploymentEnvironmentProviderListParams;
@@ -2212,7 +2212,7 @@ export interface MethodMap {
   /**
    * Read an environment provider
    *
-   * Returns one deployment-registered deployment provider and its controller connection.
+   * Returns one deployment-registered provider with its controller endpoint and the optional features its controller last advertised.
    */
   "deployment/environment-providers/read": {
     params: Api.DeploymentEnvironmentProviderReadParams;
@@ -2564,7 +2564,7 @@ export const rpc = {
   /**
    * Configure environment public ingress
    *
-   * Synchronously enables or disables one provider-authorized HTTPS endpoint for a provisioned environment. The provider owns hostname allocation, the approved guest port, routing, TLS, and health.
+   * Records the public ingress intent of a provisioned environment; the lifecycle reconciler converges it while the environment is ready, and `publicEndpoint` shows the realized endpoint. Rejected when the provider does not offer ingress. The provider owns hostname, guest port, routing, TLS, and health; an intent its template refuses is dropped.
    */
   environmentsIngressPut(client: RpcCaller, params: Api.EnvironmentIngressPutParams): Promise<Api.AgentApiOutcomeOfEnvironmentIngressPutResponse> {
     return client.call("environments/ingress/put", params);
@@ -2628,7 +2628,7 @@ export const rpc = {
   /**
    * Read environment jobs
    *
-   * Reads selected job handles with bounded output, optional sequence continuation, and optional artifacts; use returned status/sequence data for polling.
+   * Reads selected job handles with bounded output from a byte offset or the output tail; continue from each entry's outputNext and poll on the returned status.
    */
   environmentsJobsRead(client: RpcCaller, params: Api.EnvironmentJobReadParams): Promise<Api.AgentApiOutcomeOfEnvironmentJobReadResponse> {
     return client.call("environments/jobs/read", params);
@@ -3332,7 +3332,7 @@ export const rpc = {
   /**
    * Put an environment provider
    *
-   * Registers or replaces one deployment provider and its controller connection. The provider does not call this API or require access to Lightspeed.
+   * Registers or replaces one deployment provider: its controller endpoint URL and the bearer credential Lightspeed presents to the controller and data routes. The credential is write-only: required for a new provider, kept when omitted, never returned. The provider does not call this API or require access to Lightspeed.
    */
   deploymentEnvironmentProvidersPut(client: RpcCaller, params: Api.DeploymentEnvironmentProviderPutParams): Promise<Api.AgentApiOutcomeOfDeploymentEnvironmentProviderPutResponse> {
     return client.call("deployment/environment-providers/put", params);
@@ -3340,7 +3340,7 @@ export const rpc = {
   /**
    * List environment providers
    *
-   * Returns every deployment-registered deployment provider and its controller connection.
+   * Returns every deployment-registered provider with its controller endpoint and the optional features its controller last advertised.
    */
   deploymentEnvironmentProvidersList(client: RpcCaller, params: Api.DeploymentEnvironmentProviderListParams): Promise<Api.AgentApiOutcomeOfDeploymentEnvironmentProviderListResponse> {
     return client.call("deployment/environment-providers/list", params);
@@ -3348,7 +3348,7 @@ export const rpc = {
   /**
    * Read an environment provider
    *
-   * Returns one deployment-registered deployment provider and its controller connection.
+   * Returns one deployment-registered provider with its controller endpoint and the optional features its controller last advertised.
    */
   deploymentEnvironmentProvidersRead(client: RpcCaller, params: Api.DeploymentEnvironmentProviderReadParams): Promise<Api.AgentApiOutcomeOfDeploymentEnvironmentProviderReadResponse> {
     return client.call("deployment/environment-providers/read", params);
diff --git a/clients/typescript/src/generated/types.ts b/clients/typescript/src/generated/types.ts
index 1092bbcb8..297865264 100644
--- a/clients/typescript/src/generated/types.ts
+++ b/clients/typescript/src/generated/types.ts
@@ -1385,7 +1385,10 @@ export type EnvironmentSourceView =
       type: "provisioned";
     }
   | {
-      connection: EnvironmentConnectionView;
+      /**
+       * `ws://`, `wss://` or `unix://` URL Lightspeed dials envd at.
+       */
+      endpoint: string;
       type: "external";
     }
   | {
@@ -1394,17 +1397,6 @@ export type EnvironmentSourceView =
       registrationKeyId: string;
       type: "registered";
     };
-/**
- * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
- * via the `definition` "EnvironmentConnectionTransportView".
- */
-export type EnvironmentConnectionTransportView =
-  | ("webSocket" | "http" | "stdio" | "ssh")
-  | {
-      provider: {
-        provider_type: string;
-      };
-    };
 /**
  * What Lightspeed does with a registered environment while its daemon is
  * disconnected. Registration-key policy, copied onto each environment.
@@ -1422,27 +1414,6 @@ export type EnvironmentLifecycleStatusView =
   | "paused"
   | "suspended"
   | "offline";
-/**
- * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
- * via the `definition` "DeploymentEnvironmentProviderTransport".
- */
-export type DeploymentEnvironmentProviderTransport =
-  | {
-      type: "webSocket";
-    }
-  | {
-      type: "http";
-    }
-  | {
-      type: "stdio";
-    }
-  | {
-      type: "ssh";
-    }
-  | {
-      providerType: string;
-      type: "provider";
-    };
 /**
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
  * via the `definition` "EnvironmentProviderBindingStatusView".
@@ -1466,26 +1437,53 @@ export type EnvironmentCredentialSourceView =
       type: "directSecret";
     };
 /**
+ * How a job's root process ended.
+ *
+ * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
+ * via the `definition` "SessionJobExitView".
+ */
+export type SessionJobExitView =
+  | {
+      code: number;
+      type: "code";
+    }
+  | {
+      coreDumped?: boolean;
+      signal: string;
+      type: "signal";
+    };
+/**
+ * Job lifecycle. `queued` and `running` are live; the rest are terminal.
+ *
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
  * via the `definition` "SessionJobStatusView".
  */
 export type SessionJobStatusView =
-  | "accepted"
-  | "queued"
   | "running"
+  | "queued"
   | "succeeded"
   | "failed"
-  | "cancelRequested"
-  | "cancelled"
   | "timedOut"
+  | "cancelled"
   | "dependencyFailed"
-  | "interrupted"
-  | "lost";
+  | "interrupted";
+/**
+ * Why Lightspeed stopped a running job.
+ *
+ * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
+ * via the `definition` "SessionJobStoppedByView".
+ */
+export type SessionJobStoppedByView = "timeout" | "terminate" | "kill";
 /**
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
  * via the `definition` "SessionJobOutputStreamView".
  */
 export type SessionJobOutputStreamView = "stdout" | "stderr";
+/**
+ * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
+ * via the `definition` "SessionJobOutputGapReasonView".
+ */
+export type SessionJobOutputGapReasonView = "overflow" | "expired";
 /**
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
  * via the `definition` "EnvironmentRegistrationKeyStatusView".
@@ -4736,10 +4734,24 @@ export interface EnvironmentView {
    * control connection.
    */
   lastSeenAtMs?: number | null;
+  /**
+   * Why the environment failed, or the latest error (or what the
+   * provider reports it is waiting on) while its lifecycle converges;
+   * absent once it reaches a steady state.
+   */
+  lifecycleError?: EnvironmentLifecycleErrorView | null;
   metadata?: {
     [k: string]: string;
   };
+  /**
+   * The public endpoint the provider last reported. It lags
+   * `publicIngressEnabled` while the lifecycle reconciler converges.
+   */
   publicEndpoint?: string | null;
+  /**
+   * Lightspeed-owned public ingress intent; `publicEndpoint` is what the
+   * provider realized.
+   */
   publicIngressEnabled: boolean;
   requestId: string;
   source: EnvironmentSourceView;
@@ -4779,11 +4791,18 @@ export interface EnvironmentIncarnationView {
 }
 /**
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
- * via the `definition` "EnvironmentConnectionView".
+ * via the `definition` "EnvironmentLifecycleErrorView".
  */
-export interface EnvironmentConnectionView {
-  endpoint: string;
-  transport: EnvironmentConnectionTransportView;
+export interface EnvironmentLifecycleErrorView {
+  /**
+   * When the current run of errors began.
+   */
+  firstAtMs: number;
+  /**
+   * When `message` was recorded.
+   */
+  lastAtMs: number;
+  message: string;
 }
 /**
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
@@ -4805,8 +4824,21 @@ export interface DeploymentEnvironmentProviderDeleteResponse {
  * via the `definition` "DeploymentEnvironmentProviderView".
  */
 export interface DeploymentEnvironmentProviderView {
-  controllerConnection: DeploymentEnvironmentProviderConnection;
+  /**
+   * `ws://`, `wss://` or `unix://` URL of the provider controller.
+   */
+  controllerEndpoint: string;
+  /**
+   * What the controller advertised at its last successful handshake;
+   * absent until Lightspeed first reached it at this endpoint.
+   */
+  controllerFeatures?: DeploymentEnvironmentProviderFeaturesView | null;
   createdAtMs: number;
+  /**
+   * Base URL of the provider's data routes, as its controller advertised
+   * it; absent until then.
+   */
+  dataRouteBase?: string | null;
   displayName?: string | null;
   metadata?: {
     [k: string]: string;
@@ -4815,12 +4847,20 @@ export interface DeploymentEnvironmentProviderView {
   updatedAtMs: number;
 }
 /**
+ * Optional controller methods the provider's controller advertised.
+ *
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
- * via the `definition` "DeploymentEnvironmentProviderConnection".
+ * via the `definition` "DeploymentEnvironmentProviderFeaturesView".
  */
-export interface DeploymentEnvironmentProviderConnection {
-  endpoint: string;
-  transport: DeploymentEnvironmentProviderTransport;
+export interface DeploymentEnvironmentProviderFeaturesView {
+  /**
+   * Existing targets can be adopted (`environment/adopt`).
+   */
+  adoptTarget: boolean;
+  /**
+   * Public ingress can be enabled on environments.
+   */
+  ingress: boolean;
 }
 /**
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
@@ -5192,18 +5232,31 @@ export interface SessionJobHandleView {
   jobId: string;
 }
 /**
+ * What a job is and how it ended. Instants are the environment's wall
+ * clock.
+ *
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
  * via the `definition` "SessionJobSummaryView".
  */
 export interface SessionJobSummaryView {
+  /**
+   * When a cancel reached the job while it ran.
+   */
+  cancelRequestedAtMs?: number | null;
   createdAtMs: number;
   dependencies?: string[];
-  exitCode?: number | null;
+  /**
+   * Run time from start to finish, immune to clock jumps.
+   */
+  durationMs?: number | null;
+  /**
+   * How the job's root process ended, once it ran and exited.
+   */
+  exit?: SessionJobExitView | null;
   failure?: string | null;
   finishedAtMs?: number | null;
   jobId: string;
   name?: string | null;
-  namespace: string;
   /**
    * True when the job's root process exited while descendants it spawned
    * were still running; the host terminated them best-effort at job
@@ -5212,8 +5265,16 @@ export interface SessionJobSummaryView {
   orphanedDescendants?: boolean;
   queueKey?: string | null;
   queuedAtMs?: number | null;
+  /**
+   * The start request that created the job; part of its identity.
+   */
+  requestId: string;
   startedAtMs?: number | null;
   status: SessionJobStatusView;
+  /**
+   * Set when Lightspeed stopped the running job.
+   */
+  stoppedBy?: SessionJobStoppedByView | null;
 }
 /**
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
@@ -5261,37 +5322,59 @@ export interface EnvironmentJobReadResponse {
   jobs?: SessionJobReadEntryView[];
 }
 /**
+ * One job's summary and output page, or why it could not be read: an
+ * entry with `error` and no summary names a job the environment does not
+ * know (never created, or garbage-collected).
+ *
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
  * via the `definition` "SessionJobReadEntryView".
  */
 export interface SessionJobReadEntryView {
-  artifacts?: SessionJobArtifactView[];
   error?: string | null;
   handle?: SessionJobHandleView | null;
+  /**
+   * Output in offset order.
+   */
   outputChunks?: SessionJobOutputChunkView[];
-  outputNextSeq: number;
+  /**
+   * Output bytes the job produced so far; final once it is terminal.
+   */
+  outputEnd: number;
+  /**
+   * Output ranges between the requested start and `outputNext` that
+   * cannot be returned.
+   */
+  outputGaps?: SessionJobOutputGapView[];
+  /**
+   * Byte offset to continue reading from: pass it as `after`.
+   */
+  outputNext: number;
   summary?: SessionJobSummaryView | null;
 }
-/**
- * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
- * via the `definition` "SessionJobArtifactView".
- */
-export interface SessionJobArtifactView {
-  kind?: string | null;
-  metadata?: {
-    [k: string]: string;
-  };
-  path: string;
-}
 /**
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
  * via the `definition` "SessionJobOutputChunkView".
  */
 export interface SessionJobOutputChunkView {
   dataBase64: string;
-  seq: number;
+  /**
+   * Byte offset of the chunk's first byte in the job's combined output.
+   */
+  offset: number;
   stream: SessionJobOutputStreamView;
 }
+/**
+ * Output bytes in `[offset, offset + omittedBytes)` that cannot be
+ * returned.
+ *
+ * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
+ * via the `definition` "SessionJobOutputGapView".
+ */
+export interface SessionJobOutputGapView {
+  offset: number;
+  omittedBytes: number;
+  reason: SessionJobOutputGapReasonView;
+}
 /**
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
  * via the `definition` "AgentApiOutcomeOfEnvironmentListResponse".
@@ -5498,8 +5581,25 @@ export interface EnvironmentTemplateView {
   };
   providerId: string;
   publicIngress: boolean;
+  /**
+   * Compute targets of this template get; absent when the provider does
+   * not fix it.
+   */
+  resources?: EnvironmentTemplateResourcesView | null;
   templateId: string;
 }
+/**
+ * A template's compute, in provider-neutral units. Each field is absent
+ * when the provider does not fix it.
+ *
+ * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
+ * via the `definition` "EnvironmentTemplateResourcesView".
+ */
+export interface EnvironmentTemplateResourcesView {
+  diskBytes?: number | null;
+  memoryBytes?: number | null;
+  vcpus?: number | null;
+}
 /**
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
  * via the `definition` "AgentApiOutcomeOfEnvironmentTemplateReadResponse".
@@ -5603,8 +5703,9 @@ export interface ServerInfo {
 export interface EnvironmentDaemonInfo {
   gitSha: string;
   /**
-   * Environment protocol version the gateway speaks. A daemon registers
-   * only when it reports exactly this number.
+   * The envd protocol version (data plane and registration channel)
+   * the gateway speaks. A daemon registers only when it reports exactly
+   * this number.
    */
   protocolVersion: number;
   /**
@@ -7426,11 +7527,23 @@ export interface DeploymentEnvironmentProviderDeleteParams {
  */
 export interface DeploymentEnvironmentProviderListParams {}
 /**
+ * Register or replace a provider. `credential` is the bearer token
+ * Lightspeed presents to the provider's controller and data routes: it is
+ * sealed on receipt and never returned by any method. `Debug` output
+ * redacts it; request logging must never echo these params.
+ *
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
  * via the `definition` "DeploymentEnvironmentProviderPutParams".
  */
 export interface DeploymentEnvironmentProviderPutParams {
-  controllerConnection: DeploymentEnvironmentProviderConnection;
+  /**
+   * `ws://`, `wss://` or `unix://` URL of the provider controller.
+   */
+  controllerEndpoint: string;
+  /**
+   * Required when the provider is new; omit to keep the stored one.
+   */
+  credential?: string | null;
   displayName?: string | null;
   metadata?: {
     [k: string]: string;
@@ -7583,11 +7696,12 @@ export interface EnvironmentCredentialUnbindParams {
  * via the `definition` "EnvironmentExternalCreateParams".
  */
 export interface EnvironmentExternalCreateParams {
+  displayName?: string | null;
   /**
-   * Connection to an envd instance reachable from Lightspeed.
+   * `ws://`, `wss://` or `unix://` URL of an envd instance reachable from
+   * Lightspeed.
    */
-  connection: EnvironmentConnectionView;
-  displayName?: string | null;
+  endpoint: string;
   metadata?: {
     [k: string]: string;
   };
@@ -7669,10 +7783,20 @@ export interface SessionJobDependencyInput {
  * via the `definition` "EnvironmentJobReadParams".
  */
 export interface EnvironmentJobReadParams {
-  afterSeq?: number | null;
-  includeArtifacts?: boolean;
+  /**
+   * Byte offset to read each job's output from: a previous entry's
+   * `outputNext`. Omitted with `tailBytes` omitted reads from the start.
+   */
+  after?: number | null;
   jobs: SessionJobHandleInput[];
-  outputBytes?: number | null;
+  /**
+   * Most output bytes per job; omit for the server's default page.
+   */
+  maxBytes?: number | null;
+  /**
+   * Read each job's last `tailBytes` of output instead; excludes `after`.
+   */
+  tailBytes?: number | null;
 }
 /**
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
diff --git a/crates/api/contract/api-reference.md b/crates/api/contract/api-reference.md
index d3a9902cc..efde1c5b2 100644
--- a/crates/api/contract/api-reference.md
+++ b/crates/api/contract/api-reference.md
@@ -484,7 +484,7 @@ Creates an environment backed by a Lightspeed-reachable envd WebSocket endpoint,
 
 **Configure environment public ingress**
 
-Synchronously enables or disables one provider-authorized HTTPS endpoint for a provisioned environment. The provider owns hostname allocation, the approved guest port, routing, TLS, and health.
+Records the public ingress intent of a provisioned environment; the lifecycle reconciler converges it while the environment is ready, and `publicEndpoint` shows the realized endpoint. Rejected when the provider does not offer ingress. The provider owns hostname, guest port, routing, TLS, and health; an intent its template refuses is dropped.
 
 - Access: `{"kind":"universe","action":"configure_resource"}`
 - Group: `environments`
@@ -588,7 +588,7 @@ Starts a dependency-aware job group on one environment instance, injecting the e
 
 **Read environment jobs**
 
-Reads selected job handles with bounded output, optional sequence continuation, and optional artifacts; use returned status/sequence data for polling.
+Reads selected job handles with bounded output from a byte offset or the output tail; continue from each entry's outputNext and poll on the returned status.
 
 - Access: `{"kind":"universe","action":"read"}`
 - Group: `environments`
@@ -1747,7 +1747,7 @@ Revokes the key with this display prefix; revoking a revoked key keeps its first
 
 **Put an environment provider**
 
-Registers or replaces one deployment provider and its controller connection. The provider does not call this API or require access to Lightspeed.
+Registers or replaces one deployment provider: its controller endpoint URL and the bearer credential Lightspeed presents to the controller and data routes. The credential is write-only: required for a new provider, kept when omitted, never returned. The provider does not call this API or require access to Lightspeed.
 
 - Access: `{"kind":"deployment"}`
 - Group: `deployment/environment-providers`
@@ -1760,7 +1760,7 @@ Registers or replaces one deployment provider and its controller connection. The
 
 **List environment providers**
 
-Returns every deployment-registered deployment provider and its controller connection.
+Returns every deployment-registered provider with its controller endpoint and the optional features its controller last advertised.
 
 - Access: `{"kind":"deployment"}`
 - Group: `deployment/environment-providers`
@@ -1773,7 +1773,7 @@ Returns every deployment-registered deployment provider and its controller conne
 
 **Read an environment provider**
 
-Returns one deployment-registered deployment provider and its controller connection.
+Returns one deployment-registered provider with its controller endpoint and the optional features its controller last advertised.
 
 - Access: `{"kind":"deployment"}`
 - Group: `deployment/environment-providers`
diff --git a/crates/api/contract/api.schema.json b/crates/api/contract/api.schema.json
index d2bce1b0a..f36246cf9 100644
--- a/crates/api/contract/api.schema.json
+++ b/crates/api/contract/api.schema.json
@@ -8763,21 +8763,6 @@
       ],
       "type": "object"
     },
-    "DeploymentEnvironmentProviderConnection": {
-      "properties": {
-        "endpoint": {
-          "type": "string"
-        },
-        "transport": {
-          "$ref": "#/definitions/DeploymentEnvironmentProviderTransport"
-        }
-      },
-      "required": [
-        "endpoint",
-        "transport"
-      ],
-      "type": "object"
-    },
     "DeploymentEnvironmentProviderDeleteParams": {
       "properties": {
         "providerId": {
@@ -8800,6 +8785,24 @@
       ],
       "type": "object"
     },
+    "DeploymentEnvironmentProviderFeaturesView": {
+      "description": "Optional controller methods the provider's controller advertised.",
+      "properties": {
+        "adoptTarget": {
+          "description": "Existing targets can be adopted (`environment/adopt`).",
+          "type": "boolean"
+        },
+        "ingress": {
+          "description": "Public ingress can be enabled on environments.",
+          "type": "boolean"
+        }
+      },
+      "required": [
+        "adoptTarget",
+        "ingress"
+      ],
+      "type": "object"
+    },
     "DeploymentEnvironmentProviderListParams": {
       "type": "object"
     },
@@ -8818,9 +8821,18 @@
       "type": "object"
     },
     "DeploymentEnvironmentProviderPutParams": {
+      "description": "Register or replace a provider. `credential` is the bearer token\nLightspeed presents to the provider's controller and data routes: it is\nsealed on receipt and never returned by any method. `Debug` output\nredacts it; request logging must never echo these params.",
       "properties": {
-        "controllerConnection": {
-          "$ref": "#/definitions/DeploymentEnvironmentProviderConnection"
+        "controllerEndpoint": {
+          "description": "`ws://`, `wss://` or `unix://` URL of the provider controller.",
+          "type": "string"
+        },
+        "credential": {
+          "description": "Required when the provider is new; omit to keep the stored one.",
+          "type": [
+            "string",
+            "null"
+          ]
         },
         "displayName": {
           "type": [
@@ -8840,7 +8852,7 @@
       },
       "required": [
         "providerId",
-        "controllerConnection"
+        "controllerEndpoint"
       ],
       "type": "object"
     },
@@ -8877,83 +8889,34 @@
       ],
       "type": "object"
     },
-    "DeploymentEnvironmentProviderTransport": {
-      "oneOf": [
-        {
-          "properties": {
-            "type": {
-              "const": "webSocket",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "const": "http",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "const": "stdio",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "const": "ssh",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "type": "object"
+    "DeploymentEnvironmentProviderView": {
+      "properties": {
+        "controllerEndpoint": {
+          "description": "`ws://`, `wss://` or `unix://` URL of the provider controller.",
+          "type": "string"
         },
-        {
-          "properties": {
-            "providerType": {
-              "type": "string"
+        "controllerFeatures": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/DeploymentEnvironmentProviderFeaturesView"
             },
-            "type": {
-              "const": "provider",
-              "type": "string"
+            {
+              "type": "null"
             }
-          },
-          "required": [
-            "type",
-            "providerType"
           ],
-          "type": "object"
-        }
-      ]
-    },
-    "DeploymentEnvironmentProviderView": {
-      "properties": {
-        "controllerConnection": {
-          "$ref": "#/definitions/DeploymentEnvironmentProviderConnection"
+          "description": "What the controller advertised at its last successful handshake;\nabsent until Lightspeed first reached it at this endpoint."
         },
         "createdAtMs": {
           "format": "int64",
           "type": "integer"
         },
+        "dataRouteBase": {
+          "description": "Base URL of the provider's data routes, as its controller advertised\nit; absent until then.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
         "displayName": {
           "type": [
             "string",
@@ -8976,7 +8939,7 @@
       },
       "required": [
         "providerId",
-        "controllerConnection",
+        "controllerEndpoint",
         "createdAtMs",
         "updatedAtMs"
       ],
@@ -9339,54 +9302,6 @@
       ],
       "type": "object"
     },
-    "EnvironmentConnectionTransportView": {
-      "oneOf": [
-        {
-          "enum": [
-            "webSocket",
-            "http",
-            "stdio",
-            "ssh"
-          ],
-          "type": "string"
-        },
-        {
-          "additionalProperties": false,
-          "properties": {
-            "provider": {
-              "properties": {
-                "provider_type": {
-                  "type": "string"
-                }
-              },
-              "required": [
-                "provider_type"
-              ],
-              "type": "object"
-            }
-          },
-          "required": [
-            "provider"
-          ],
-          "type": "object"
-        }
-      ]
-    },
-    "EnvironmentConnectionView": {
-      "properties": {
-        "endpoint": {
-          "type": "string"
-        },
-        "transport": {
-          "$ref": "#/definitions/EnvironmentConnectionTransportView"
-        }
-      },
-      "required": [
-        "endpoint",
-        "transport"
-      ],
-      "type": "object"
-    },
     "EnvironmentCreateParams": {
       "properties": {
         "bindingId": {
@@ -9609,7 +9524,7 @@
           "type": "string"
         },
         "protocolVersion": {
-          "description": "Environment protocol version the gateway speaks. A daemon registers\nonly when it reports exactly this number.",
+          "description": "The envd protocol version (data plane and registration channel)\nthe gateway speaks. A daemon registers only when it reports exactly\nthis number.",
           "format": "uint32",
           "minimum": 0,
           "type": "integer"
@@ -9635,20 +9550,16 @@
     },
     "EnvironmentExternalCreateParams": {
       "properties": {
-        "connection": {
-          "allOf": [
-            {
-              "$ref": "#/definitions/EnvironmentConnectionView"
-            }
-          ],
-          "description": "Connection to an envd instance reachable from Lightspeed."
-        },
         "displayName": {
           "type": [
             "string",
             "null"
           ]
         },
+        "endpoint": {
+          "description": "`ws://`, `wss://` or `unix://` URL of an envd instance reachable from\nLightspeed.",
+          "type": "string"
+        },
         "metadata": {
           "additionalProperties": {
             "type": "string"
@@ -9661,7 +9572,7 @@
       },
       "required": [
         "requestId",
-        "connection"
+        "endpoint"
       ],
       "type": "object"
     },
@@ -9918,7 +9829,8 @@
     },
     "EnvironmentJobReadParams": {
       "properties": {
-        "afterSeq": {
+        "after": {
+          "description": "Byte offset to read each job's output from: a previous entry's\n`outputNext`. Omitted with `tailBytes` omitted reads from the start.",
           "format": "uint64",
           "minimum": 0,
           "type": [
@@ -9926,18 +9838,24 @@
             "null"
           ]
         },
-        "includeArtifacts": {
-          "default": false,
-          "type": "boolean"
-        },
         "jobs": {
           "items": {
             "$ref": "#/definitions/SessionJobHandleInput"
           },
           "type": "array"
         },
-        "outputBytes": {
-          "format": "uint",
+        "maxBytes": {
+          "description": "Most output bytes per job; omit for the server's default page.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": [
+            "integer",
+            "null"
+          ]
+        },
+        "tailBytes": {
+          "description": "Read each job's last `tailBytes` of output instead; excludes `after`.",
+          "format": "uint64",
           "minimum": 0,
           "type": [
             "integer",
@@ -9962,6 +9880,29 @@
       },
       "type": "object"
     },
+    "EnvironmentLifecycleErrorView": {
+      "properties": {
+        "firstAtMs": {
+          "description": "When the current run of errors began.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "lastAtMs": {
+          "description": "When `message` was recorded.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "message": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "message",
+        "firstAtMs",
+        "lastAtMs"
+      ],
+      "type": "object"
+    },
     "EnvironmentLifecycleStatusView": {
       "oneOf": [
         {
@@ -10500,8 +10441,9 @@
         },
         {
           "properties": {
-            "connection": {
-              "$ref": "#/definitions/EnvironmentConnectionView"
+            "endpoint": {
+              "description": "`ws://`, `wss://` or `unix://` URL Lightspeed dials envd at.",
+              "type": "string"
             },
             "type": {
               "const": "external",
@@ -10510,7 +10452,7 @@
           },
           "required": [
             "type",
-            "connection"
+            "endpoint"
           ],
           "type": "object"
         },
@@ -10592,6 +10534,36 @@
       ],
       "type": "object"
     },
+    "EnvironmentTemplateResourcesView": {
+      "description": "A template's compute, in provider-neutral units. Each field is absent\nwhen the provider does not fix it.",
+      "properties": {
+        "diskBytes": {
+          "format": "uint64",
+          "minimum": 0,
+          "type": [
+            "integer",
+            "null"
+          ]
+        },
+        "memoryBytes": {
+          "format": "uint64",
+          "minimum": 0,
+          "type": [
+            "integer",
+            "null"
+          ]
+        },
+        "vcpus": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": [
+            "integer",
+            "null"
+          ]
+        }
+      },
+      "type": "object"
+    },
     "EnvironmentTemplateView": {
       "properties": {
         "bindingId": {
@@ -10621,6 +10593,17 @@
         "publicIngress": {
           "type": "boolean"
         },
+        "resources": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/EnvironmentTemplateResourcesView"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Compute targets of this template get; absent when the provider does\nnot fix it."
+        },
         "templateId": {
           "type": "string"
         }
@@ -10679,6 +10662,17 @@
             "null"
           ]
         },
+        "lifecycleError": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/EnvironmentLifecycleErrorView"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Why the environment failed, or the latest error (or what the\nprovider reports it is waiting on) while its lifecycle converges;\nabsent once it reaches a steady state."
+        },
         "metadata": {
           "additionalProperties": {
             "type": "string"
@@ -10686,12 +10680,14 @@
           "type": "object"
         },
         "publicEndpoint": {
+          "description": "The public endpoint the provider last reported. It lags\n`publicIngressEnabled` while the lifecycle reconciler converges.",
           "type": [
             "string",
             "null"
           ]
         },
         "publicIngressEnabled": {
+          "description": "Lightspeed-owned public ingress intent; `publicEndpoint` is what the\nprovider realized.",
           "type": "boolean"
         },
         "requestId": {
@@ -15777,29 +15773,6 @@
       ],
       "type": "object"
     },
-    "SessionJobArtifactView": {
-      "properties": {
-        "kind": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "metadata": {
-          "additionalProperties": {
-            "type": "string"
-          },
-          "type": "object"
-        },
-        "path": {
-          "type": "string"
-        }
-      },
-      "required": [
-        "path"
-      ],
-      "type": "object"
-    },
     "SessionJobCancelEntryView": {
       "properties": {
         "error": {
@@ -15862,6 +15835,49 @@
       ],
       "type": "string"
     },
+    "SessionJobExitView": {
+      "description": "How a job's root process ended.",
+      "oneOf": [
+        {
+          "description": "Normal exit with this status code.",
+          "properties": {
+            "code": {
+              "format": "int32",
+              "type": "integer"
+            },
+            "type": {
+              "const": "code",
+              "type": "string"
+            }
+          },
+          "required": [
+            "type",
+            "code"
+          ],
+          "type": "object"
+        },
+        {
+          "description": "Killed by this signal, named like `SIGSEGV`.",
+          "properties": {
+            "coreDumped": {
+              "type": "boolean"
+            },
+            "signal": {
+              "type": "string"
+            },
+            "type": {
+              "const": "signal",
+              "type": "string"
+            }
+          },
+          "required": [
+            "type",
+            "signal"
+          ],
+          "type": "object"
+        }
+      ]
+    },
     "SessionJobHandleInput": {
       "properties": {
         "environmentId": {
@@ -15897,7 +15913,8 @@
         "dataBase64": {
           "type": "string"
         },
-        "seq": {
+        "offset": {
+          "description": "Byte offset of the chunk's first byte in the job's combined output.",
           "format": "uint64",
           "minimum": 0,
           "type": "integer"
@@ -15907,12 +15924,50 @@
         }
       },
       "required": [
-        "seq",
+        "offset",
         "stream",
         "dataBase64"
       ],
       "type": "object"
     },
+    "SessionJobOutputGapReasonView": {
+      "oneOf": [
+        {
+          "const": "overflow",
+          "description": "Dropped from the middle because the job's retained output exceeded\nits cap; the head and the newest bytes are kept.",
+          "type": "string"
+        },
+        {
+          "const": "expired",
+          "description": "Released after it was delivered.",
+          "type": "string"
+        }
+      ]
+    },
+    "SessionJobOutputGapView": {
+      "description": "Output bytes in `[offset, offset + omittedBytes)` that cannot be\nreturned.",
+      "properties": {
+        "offset": {
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "omittedBytes": {
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "reason": {
+          "$ref": "#/definitions/SessionJobOutputGapReasonView"
+        }
+      },
+      "required": [
+        "offset",
+        "omittedBytes",
+        "reason"
+      ],
+      "type": "object"
+    },
     "SessionJobOutputStreamView": {
       "enum": [
         "stdout",
@@ -15921,13 +15976,8 @@
       "type": "string"
     },
     "SessionJobReadEntryView": {
+      "description": "One job's summary and output page, or why it could not be read: an\nentry with `error` and no summary names a job the environment does not\nknow (never created, or garbage-collected).",
       "properties": {
-        "artifacts": {
-          "items": {
-            "$ref": "#/definitions/SessionJobArtifactView"
-          },
-          "type": "array"
-        },
         "error": {
           "type": [
             "string",
@@ -15945,12 +15995,27 @@
           ]
         },
         "outputChunks": {
+          "description": "Output in offset order.",
           "items": {
             "$ref": "#/definitions/SessionJobOutputChunkView"
           },
           "type": "array"
         },
-        "outputNextSeq": {
+        "outputEnd": {
+          "description": "Output bytes the job produced so far; final once it is terminal.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "outputGaps": {
+          "description": "Output ranges between the requested start and `outputNext` that\ncannot be returned.",
+          "items": {
+            "$ref": "#/definitions/SessionJobOutputGapView"
+          },
+          "type": "array"
+        },
+        "outputNext": {
+          "description": "Byte offset to continue reading from: pass it as `after`.",
           "format": "uint64",
           "minimum": 0,
           "type": "integer"
@@ -15967,7 +16032,8 @@
         }
       },
       "required": [
-        "outputNextSeq"
+        "outputNext",
+        "outputEnd"
       ],
       "type": "object"
     },
@@ -16087,26 +16153,84 @@
       "type": "object"
     },
     "SessionJobStatusView": {
-      "enum": [
-        "accepted",
-        "queued",
-        "running",
-        "succeeded",
-        "failed",
-        "cancelRequested",
-        "cancelled",
-        "timedOut",
-        "dependencyFailed",
-        "interrupted",
-        "lost"
-      ],
-      "type": "string"
+      "description": "Job lifecycle. `queued` and `running` are live; the rest are terminal.",
+      "oneOf": [
+        {
+          "enum": [
+            "running"
+          ],
+          "type": "string"
+        },
+        {
+          "const": "queued",
+          "description": "Waiting for dependencies or its queue.",
+          "type": "string"
+        },
+        {
+          "const": "succeeded",
+          "description": "Exited with code 0.",
+          "type": "string"
+        },
+        {
+          "const": "failed",
+          "description": "Exited otherwise, or could not start.",
+          "type": "string"
+        },
+        {
+          "const": "timedOut",
+          "description": "Its timeout expired and it was stopped.",
+          "type": "string"
+        },
+        {
+          "const": "cancelled",
+          "description": "Stopped or never started because of a cancel.",
+          "type": "string"
+        },
+        {
+          "const": "dependencyFailed",
+          "description": "A dependency did not finish as the dependency policy requires.",
+          "type": "string"
+        },
+        {
+          "const": "interrupted",
+          "description": "The environment daemon stopped while the job was queued or running.",
+          "type": "string"
+        }
+      ]
+    },
+    "SessionJobStoppedByView": {
+      "description": "Why Lightspeed stopped a running job.",
+      "oneOf": [
+        {
+          "const": "timeout",
+          "description": "Its timeout expired: terminate, a grace period, then kill.",
+          "type": "string"
+        },
+        {
+          "const": "terminate",
+          "description": "A cancel without `force`: terminate, a grace period, then kill.",
+          "type": "string"
+        },
+        {
+          "const": "kill",
+          "description": "A cancel with `force`: killed at once.",
+          "type": "string"
+        }
+      ]
     },
     "SessionJobSummaryView": {
+      "description": "What a job is and how it ended. Instants are the environment's wall\nclock.",
       "properties": {
+        "cancelRequestedAtMs": {
+          "description": "When a cancel reached the job while it ran.",
+          "format": "int64",
+          "type": [
+            "integer",
+            "null"
+          ]
+        },
         "createdAtMs": {
-          "format": "uint64",
-          "minimum": 0,
+          "format": "int64",
           "type": "integer"
         },
         "dependencies": {
@@ -16115,13 +16239,26 @@
           },
           "type": "array"
         },
-        "exitCode": {
-          "format": "int32",
+        "durationMs": {
+          "description": "Run time from start to finish, immune to clock jumps.",
+          "format": "uint64",
+          "minimum": 0,
           "type": [
             "integer",
             "null"
           ]
         },
+        "exit": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/SessionJobExitView"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "How the job's root process ended, once it ran and exited."
+        },
         "failure": {
           "type": [
             "string",
@@ -16129,8 +16266,7 @@
           ]
         },
         "finishedAtMs": {
-          "format": "uint64",
-          "minimum": 0,
+          "format": "int64",
           "type": [
             "integer",
             "null"
@@ -16145,9 +16281,6 @@
             "null"
           ]
         },
-        "namespace": {
-          "type": "string"
-        },
         "orphanedDescendants": {
           "description": "True when the job's root process exited while descendants it spawned\nwere still running; the host terminated them best-effort at job\ncompletion.",
           "type": "boolean"
@@ -16159,16 +16292,18 @@
           ]
         },
         "queuedAtMs": {
-          "format": "uint64",
-          "minimum": 0,
+          "format": "int64",
           "type": [
             "integer",
             "null"
           ]
         },
+        "requestId": {
+          "description": "The start request that created the job; part of its identity.",
+          "type": "string"
+        },
         "startedAtMs": {
-          "format": "uint64",
-          "minimum": 0,
+          "format": "int64",
           "type": [
             "integer",
             "null"
@@ -16176,11 +16311,22 @@
         },
         "status": {
           "$ref": "#/definitions/SessionJobStatusView"
+        },
+        "stoppedBy": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/SessionJobStoppedByView"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Set when Lightspeed stopped the running job."
         }
       },
       "required": [
-        "namespace",
         "jobId",
+        "requestId",
         "status",
         "createdAtMs"
       ],
diff --git a/crates/api/contract/methods.json b/crates/api/contract/methods.json
index ad1d9c68d..201b46ab2 100644
--- a/crates/api/contract/methods.json
+++ b/crates/api/contract/methods.json
@@ -904,7 +904,7 @@
         "action": "configure_resource",
         "kind": "universe"
       },
-      "description": "Synchronously enables or disables one provider-authorized HTTPS endpoint for a provisioned environment. The provider owns hostname allocation, the approved guest port, routing, TLS, and health.",
+      "description": "Records the public ingress intent of a provisioned environment; the lifecycle reconciler converges it while the environment is ready, and `publicEndpoint` shows the realized endpoint. Rejected when the provider does not offer ingress. The provider owns hostname, guest port, routing, TLS, and health; an intent its template refuses is dropped.",
       "group": "environments",
       "method": "environments/ingress/put",
       "params": {
@@ -1104,7 +1104,7 @@
         "action": "read",
         "kind": "universe"
       },
-      "description": "Reads selected job handles with bounded output, optional sequence continuation, and optional artifacts; use returned status/sequence data for polling.",
+      "description": "Reads selected job handles with bounded output from a byte offset or the output tail; continue from each entry's outputNext and poll on the returned status.",
       "group": "environments",
       "method": "environments/jobs/read",
       "params": {
@@ -3289,7 +3289,7 @@
       "access": {
         "kind": "deployment"
       },
-      "description": "Registers or replaces one deployment provider and its controller connection. The provider does not call this API or require access to Lightspeed.",
+      "description": "Registers or replaces one deployment provider: its controller endpoint URL and the bearer credential Lightspeed presents to the controller and data routes. The credential is write-only: required for a new provider, kept when omitted, never returned. The provider does not call this API or require access to Lightspeed.",
       "group": "deployment/environment-providers",
       "method": "deployment/environment-providers/put",
       "params": {
@@ -3313,7 +3313,7 @@
       "access": {
         "kind": "deployment"
       },
-      "description": "Returns every deployment-registered deployment provider and its controller connection.",
+      "description": "Returns every deployment-registered provider with its controller endpoint and the optional features its controller last advertised.",
       "group": "deployment/environment-providers",
       "method": "deployment/environment-providers/list",
       "params": {
@@ -3337,7 +3337,7 @@
       "access": {
         "kind": "deployment"
       },
-      "description": "Returns one deployment-registered deployment provider and its controller connection.",
+      "description": "Returns one deployment-registered provider with its controller endpoint and the optional features its controller last advertised.",
       "group": "deployment/environment-providers",
       "method": "deployment/environment-providers/read",
       "params": {
diff --git a/crates/api/contract/openrpc.json b/crates/api/contract/openrpc.json
index 36c83ce67..59903a515 100644
--- a/crates/api/contract/openrpc.json
+++ b/crates/api/contract/openrpc.json
@@ -8763,21 +8763,6 @@
         ],
         "type": "object"
       },
-      "DeploymentEnvironmentProviderConnection": {
-        "properties": {
-          "endpoint": {
-            "type": "string"
-          },
-          "transport": {
-            "$ref": "#/components/schemas/DeploymentEnvironmentProviderTransport"
-          }
-        },
-        "required": [
-          "endpoint",
-          "transport"
-        ],
-        "type": "object"
-      },
       "DeploymentEnvironmentProviderDeleteParams": {
         "properties": {
           "providerId": {
@@ -8800,6 +8785,24 @@
         ],
         "type": "object"
       },
+      "DeploymentEnvironmentProviderFeaturesView": {
+        "description": "Optional controller methods the provider's controller advertised.",
+        "properties": {
+          "adoptTarget": {
+            "description": "Existing targets can be adopted (`environment/adopt`).",
+            "type": "boolean"
+          },
+          "ingress": {
+            "description": "Public ingress can be enabled on environments.",
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "adoptTarget",
+          "ingress"
+        ],
+        "type": "object"
+      },
       "DeploymentEnvironmentProviderListParams": {
         "type": "object"
       },
@@ -8818,9 +8821,18 @@
         "type": "object"
       },
       "DeploymentEnvironmentProviderPutParams": {
+        "description": "Register or replace a provider. `credential` is the bearer token\nLightspeed presents to the provider's controller and data routes: it is\nsealed on receipt and never returned by any method. `Debug` output\nredacts it; request logging must never echo these params.",
         "properties": {
-          "controllerConnection": {
-            "$ref": "#/components/schemas/DeploymentEnvironmentProviderConnection"
+          "controllerEndpoint": {
+            "description": "`ws://`, `wss://` or `unix://` URL of the provider controller.",
+            "type": "string"
+          },
+          "credential": {
+            "description": "Required when the provider is new; omit to keep the stored one.",
+            "type": [
+              "string",
+              "null"
+            ]
           },
           "displayName": {
             "type": [
@@ -8840,7 +8852,7 @@
         },
         "required": [
           "providerId",
-          "controllerConnection"
+          "controllerEndpoint"
         ],
         "type": "object"
       },
@@ -8877,83 +8889,34 @@
         ],
         "type": "object"
       },
-      "DeploymentEnvironmentProviderTransport": {
-        "oneOf": [
-          {
-            "properties": {
-              "type": {
-                "const": "webSocket",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type"
-            ],
-            "type": "object"
-          },
-          {
-            "properties": {
-              "type": {
-                "const": "http",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type"
-            ],
-            "type": "object"
-          },
-          {
-            "properties": {
-              "type": {
-                "const": "stdio",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type"
-            ],
-            "type": "object"
-          },
-          {
-            "properties": {
-              "type": {
-                "const": "ssh",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type"
-            ],
-            "type": "object"
+      "DeploymentEnvironmentProviderView": {
+        "properties": {
+          "controllerEndpoint": {
+            "description": "`ws://`, `wss://` or `unix://` URL of the provider controller.",
+            "type": "string"
           },
-          {
-            "properties": {
-              "providerType": {
-                "type": "string"
+          "controllerFeatures": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/DeploymentEnvironmentProviderFeaturesView"
               },
-              "type": {
-                "const": "provider",
-                "type": "string"
+              {
+                "type": "null"
               }
-            },
-            "required": [
-              "type",
-              "providerType"
             ],
-            "type": "object"
-          }
-        ]
-      },
-      "DeploymentEnvironmentProviderView": {
-        "properties": {
-          "controllerConnection": {
-            "$ref": "#/components/schemas/DeploymentEnvironmentProviderConnection"
+            "description": "What the controller advertised at its last successful handshake;\nabsent until Lightspeed first reached it at this endpoint."
           },
           "createdAtMs": {
             "format": "int64",
             "type": "integer"
           },
+          "dataRouteBase": {
+            "description": "Base URL of the provider's data routes, as its controller advertised\nit; absent until then.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
           "displayName": {
             "type": [
               "string",
@@ -8976,7 +8939,7 @@
         },
         "required": [
           "providerId",
-          "controllerConnection",
+          "controllerEndpoint",
           "createdAtMs",
           "updatedAtMs"
         ],
@@ -9339,54 +9302,6 @@
         ],
         "type": "object"
       },
-      "EnvironmentConnectionTransportView": {
-        "oneOf": [
-          {
-            "enum": [
-              "webSocket",
-              "http",
-              "stdio",
-              "ssh"
-            ],
-            "type": "string"
-          },
-          {
-            "additionalProperties": false,
-            "properties": {
-              "provider": {
-                "properties": {
-                  "provider_type": {
-                    "type": "string"
-                  }
-                },
-                "required": [
-                  "provider_type"
-                ],
-                "type": "object"
-              }
-            },
-            "required": [
-              "provider"
-            ],
-            "type": "object"
-          }
-        ]
-      },
-      "EnvironmentConnectionView": {
-        "properties": {
-          "endpoint": {
-            "type": "string"
-          },
-          "transport": {
-            "$ref": "#/components/schemas/EnvironmentConnectionTransportView"
-          }
-        },
-        "required": [
-          "endpoint",
-          "transport"
-        ],
-        "type": "object"
-      },
       "EnvironmentCreateParams": {
         "properties": {
           "bindingId": {
@@ -9609,7 +9524,7 @@
             "type": "string"
           },
           "protocolVersion": {
-            "description": "Environment protocol version the gateway speaks. A daemon registers\nonly when it reports exactly this number.",
+            "description": "The envd protocol version (data plane and registration channel)\nthe gateway speaks. A daemon registers only when it reports exactly\nthis number.",
             "format": "uint32",
             "minimum": 0,
             "type": "integer"
@@ -9635,20 +9550,16 @@
       },
       "EnvironmentExternalCreateParams": {
         "properties": {
-          "connection": {
-            "allOf": [
-              {
-                "$ref": "#/components/schemas/EnvironmentConnectionView"
-              }
-            ],
-            "description": "Connection to an envd instance reachable from Lightspeed."
-          },
           "displayName": {
             "type": [
               "string",
               "null"
             ]
           },
+          "endpoint": {
+            "description": "`ws://`, `wss://` or `unix://` URL of an envd instance reachable from\nLightspeed.",
+            "type": "string"
+          },
           "metadata": {
             "additionalProperties": {
               "type": "string"
@@ -9661,7 +9572,7 @@
         },
         "required": [
           "requestId",
-          "connection"
+          "endpoint"
         ],
         "type": "object"
       },
@@ -9918,7 +9829,8 @@
       },
       "EnvironmentJobReadParams": {
         "properties": {
-          "afterSeq": {
+          "after": {
+            "description": "Byte offset to read each job's output from: a previous entry's\n`outputNext`. Omitted with `tailBytes` omitted reads from the start.",
             "format": "uint64",
             "minimum": 0,
             "type": [
@@ -9926,18 +9838,24 @@
               "null"
             ]
           },
-          "includeArtifacts": {
-            "default": false,
-            "type": "boolean"
-          },
           "jobs": {
             "items": {
               "$ref": "#/components/schemas/SessionJobHandleInput"
             },
             "type": "array"
           },
-          "outputBytes": {
-            "format": "uint",
+          "maxBytes": {
+            "description": "Most output bytes per job; omit for the server's default page.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": [
+              "integer",
+              "null"
+            ]
+          },
+          "tailBytes": {
+            "description": "Read each job's last `tailBytes` of output instead; excludes `after`.",
+            "format": "uint64",
             "minimum": 0,
             "type": [
               "integer",
@@ -9962,6 +9880,29 @@
         },
         "type": "object"
       },
+      "EnvironmentLifecycleErrorView": {
+        "properties": {
+          "firstAtMs": {
+            "description": "When the current run of errors began.",
+            "format": "int64",
+            "type": "integer"
+          },
+          "lastAtMs": {
+            "description": "When `message` was recorded.",
+            "format": "int64",
+            "type": "integer"
+          },
+          "message": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "message",
+          "firstAtMs",
+          "lastAtMs"
+        ],
+        "type": "object"
+      },
       "EnvironmentLifecycleStatusView": {
         "oneOf": [
           {
@@ -10500,8 +10441,9 @@
           },
           {
             "properties": {
-              "connection": {
-                "$ref": "#/components/schemas/EnvironmentConnectionView"
+              "endpoint": {
+                "description": "`ws://`, `wss://` or `unix://` URL Lightspeed dials envd at.",
+                "type": "string"
               },
               "type": {
                 "const": "external",
@@ -10510,7 +10452,7 @@
             },
             "required": [
               "type",
-              "connection"
+              "endpoint"
             ],
             "type": "object"
           },
@@ -10592,6 +10534,36 @@
         ],
         "type": "object"
       },
+      "EnvironmentTemplateResourcesView": {
+        "description": "A template's compute, in provider-neutral units. Each field is absent\nwhen the provider does not fix it.",
+        "properties": {
+          "diskBytes": {
+            "format": "uint64",
+            "minimum": 0,
+            "type": [
+              "integer",
+              "null"
+            ]
+          },
+          "memoryBytes": {
+            "format": "uint64",
+            "minimum": 0,
+            "type": [
+              "integer",
+              "null"
+            ]
+          },
+          "vcpus": {
+            "format": "uint32",
+            "minimum": 0,
+            "type": [
+              "integer",
+              "null"
+            ]
+          }
+        },
+        "type": "object"
+      },
       "EnvironmentTemplateView": {
         "properties": {
           "bindingId": {
@@ -10621,6 +10593,17 @@
           "publicIngress": {
             "type": "boolean"
           },
+          "resources": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/EnvironmentTemplateResourcesView"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "Compute targets of this template get; absent when the provider does\nnot fix it."
+          },
           "templateId": {
             "type": "string"
           }
@@ -10679,6 +10662,17 @@
               "null"
             ]
           },
+          "lifecycleError": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/EnvironmentLifecycleErrorView"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "Why the environment failed, or the latest error (or what the\nprovider reports it is waiting on) while its lifecycle converges;\nabsent once it reaches a steady state."
+          },
           "metadata": {
             "additionalProperties": {
               "type": "string"
@@ -10686,12 +10680,14 @@
             "type": "object"
           },
           "publicEndpoint": {
+            "description": "The public endpoint the provider last reported. It lags\n`publicIngressEnabled` while the lifecycle reconciler converges.",
             "type": [
               "string",
               "null"
             ]
           },
           "publicIngressEnabled": {
+            "description": "Lightspeed-owned public ingress intent; `publicEndpoint` is what the\nprovider realized.",
             "type": "boolean"
           },
           "requestId": {
@@ -15777,29 +15773,6 @@
         ],
         "type": "object"
       },
-      "SessionJobArtifactView": {
-        "properties": {
-          "kind": {
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "metadata": {
-            "additionalProperties": {
-              "type": "string"
-            },
-            "type": "object"
-          },
-          "path": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "path"
-        ],
-        "type": "object"
-      },
       "SessionJobCancelEntryView": {
         "properties": {
           "error": {
@@ -15862,6 +15835,49 @@
         ],
         "type": "string"
       },
+      "SessionJobExitView": {
+        "description": "How a job's root process ended.",
+        "oneOf": [
+          {
+            "description": "Normal exit with this status code.",
+            "properties": {
+              "code": {
+                "format": "int32",
+                "type": "integer"
+              },
+              "type": {
+                "const": "code",
+                "type": "string"
+              }
+            },
+            "required": [
+              "type",
+              "code"
+            ],
+            "type": "object"
+          },
+          {
+            "description": "Killed by this signal, named like `SIGSEGV`.",
+            "properties": {
+              "coreDumped": {
+                "type": "boolean"
+              },
+              "signal": {
+                "type": "string"
+              },
+              "type": {
+                "const": "signal",
+                "type": "string"
+              }
+            },
+            "required": [
+              "type",
+              "signal"
+            ],
+            "type": "object"
+          }
+        ]
+      },
       "SessionJobHandleInput": {
         "properties": {
           "environmentId": {
@@ -15897,7 +15913,8 @@
           "dataBase64": {
             "type": "string"
           },
-          "seq": {
+          "offset": {
+            "description": "Byte offset of the chunk's first byte in the job's combined output.",
             "format": "uint64",
             "minimum": 0,
             "type": "integer"
@@ -15907,12 +15924,50 @@
           }
         },
         "required": [
-          "seq",
+          "offset",
           "stream",
           "dataBase64"
         ],
         "type": "object"
       },
+      "SessionJobOutputGapReasonView": {
+        "oneOf": [
+          {
+            "const": "overflow",
+            "description": "Dropped from the middle because the job's retained output exceeded\nits cap; the head and the newest bytes are kept.",
+            "type": "string"
+          },
+          {
+            "const": "expired",
+            "description": "Released after it was delivered.",
+            "type": "string"
+          }
+        ]
+      },
+      "SessionJobOutputGapView": {
+        "description": "Output bytes in `[offset, offset + omittedBytes)` that cannot be\nreturned.",
+        "properties": {
+          "offset": {
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "omittedBytes": {
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "reason": {
+            "$ref": "#/components/schemas/SessionJobOutputGapReasonView"
+          }
+        },
+        "required": [
+          "offset",
+          "omittedBytes",
+          "reason"
+        ],
+        "type": "object"
+      },
       "SessionJobOutputStreamView": {
         "enum": [
           "stdout",
@@ -15921,13 +15976,8 @@
         "type": "string"
       },
       "SessionJobReadEntryView": {
+        "description": "One job's summary and output page, or why it could not be read: an\nentry with `error` and no summary names a job the environment does not\nknow (never created, or garbage-collected).",
         "properties": {
-          "artifacts": {
-            "items": {
-              "$ref": "#/components/schemas/SessionJobArtifactView"
-            },
-            "type": "array"
-          },
           "error": {
             "type": [
               "string",
@@ -15945,12 +15995,27 @@
             ]
           },
           "outputChunks": {
+            "description": "Output in offset order.",
             "items": {
               "$ref": "#/components/schemas/SessionJobOutputChunkView"
             },
             "type": "array"
           },
-          "outputNextSeq": {
+          "outputEnd": {
+            "description": "Output bytes the job produced so far; final once it is terminal.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "outputGaps": {
+            "description": "Output ranges between the requested start and `outputNext` that\ncannot be returned.",
+            "items": {
+              "$ref": "#/components/schemas/SessionJobOutputGapView"
+            },
+            "type": "array"
+          },
+          "outputNext": {
+            "description": "Byte offset to continue reading from: pass it as `after`.",
             "format": "uint64",
             "minimum": 0,
             "type": "integer"
@@ -15967,7 +16032,8 @@
           }
         },
         "required": [
-          "outputNextSeq"
+          "outputNext",
+          "outputEnd"
         ],
         "type": "object"
       },
@@ -16087,26 +16153,84 @@
         "type": "object"
       },
       "SessionJobStatusView": {
-        "enum": [
-          "accepted",
-          "queued",
-          "running",
-          "succeeded",
-          "failed",
-          "cancelRequested",
-          "cancelled",
-          "timedOut",
-          "dependencyFailed",
-          "interrupted",
-          "lost"
-        ],
-        "type": "string"
+        "description": "Job lifecycle. `queued` and `running` are live; the rest are terminal.",
+        "oneOf": [
+          {
+            "enum": [
+              "running"
+            ],
+            "type": "string"
+          },
+          {
+            "const": "queued",
+            "description": "Waiting for dependencies or its queue.",
+            "type": "string"
+          },
+          {
+            "const": "succeeded",
+            "description": "Exited with code 0.",
+            "type": "string"
+          },
+          {
+            "const": "failed",
+            "description": "Exited otherwise, or could not start.",
+            "type": "string"
+          },
+          {
+            "const": "timedOut",
+            "description": "Its timeout expired and it was stopped.",
+            "type": "string"
+          },
+          {
+            "const": "cancelled",
+            "description": "Stopped or never started because of a cancel.",
+            "type": "string"
+          },
+          {
+            "const": "dependencyFailed",
+            "description": "A dependency did not finish as the dependency policy requires.",
+            "type": "string"
+          },
+          {
+            "const": "interrupted",
+            "description": "The environment daemon stopped while the job was queued or running.",
+            "type": "string"
+          }
+        ]
+      },
+      "SessionJobStoppedByView": {
+        "description": "Why Lightspeed stopped a running job.",
+        "oneOf": [
+          {
+            "const": "timeout",
+            "description": "Its timeout expired: terminate, a grace period, then kill.",
+            "type": "string"
+          },
+          {
+            "const": "terminate",
+            "description": "A cancel without `force`: terminate, a grace period, then kill.",
+            "type": "string"
+          },
+          {
+            "const": "kill",
+            "description": "A cancel with `force`: killed at once.",
+            "type": "string"
+          }
+        ]
       },
       "SessionJobSummaryView": {
+        "description": "What a job is and how it ended. Instants are the environment's wall\nclock.",
         "properties": {
+          "cancelRequestedAtMs": {
+            "description": "When a cancel reached the job while it ran.",
+            "format": "int64",
+            "type": [
+              "integer",
+              "null"
+            ]
+          },
           "createdAtMs": {
-            "format": "uint64",
-            "minimum": 0,
+            "format": "int64",
             "type": "integer"
           },
           "dependencies": {
@@ -16115,13 +16239,26 @@
             },
             "type": "array"
           },
-          "exitCode": {
-            "format": "int32",
+          "durationMs": {
+            "description": "Run time from start to finish, immune to clock jumps.",
+            "format": "uint64",
+            "minimum": 0,
             "type": [
               "integer",
               "null"
             ]
           },
+          "exit": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/SessionJobExitView"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "How the job's root process ended, once it ran and exited."
+          },
           "failure": {
             "type": [
               "string",
@@ -16129,8 +16266,7 @@
             ]
           },
           "finishedAtMs": {
-            "format": "uint64",
-            "minimum": 0,
+            "format": "int64",
             "type": [
               "integer",
               "null"
@@ -16145,9 +16281,6 @@
               "null"
             ]
           },
-          "namespace": {
-            "type": "string"
-          },
           "orphanedDescendants": {
             "description": "True when the job's root process exited while descendants it spawned\nwere still running; the host terminated them best-effort at job\ncompletion.",
             "type": "boolean"
@@ -16159,16 +16292,18 @@
             ]
           },
           "queuedAtMs": {
-            "format": "uint64",
-            "minimum": 0,
+            "format": "int64",
             "type": [
               "integer",
               "null"
             ]
           },
+          "requestId": {
+            "description": "The start request that created the job; part of its identity.",
+            "type": "string"
+          },
           "startedAtMs": {
-            "format": "uint64",
-            "minimum": 0,
+            "format": "int64",
             "type": [
               "integer",
               "null"
@@ -16176,11 +16311,22 @@
           },
           "status": {
             "$ref": "#/components/schemas/SessionJobStatusView"
+          },
+          "stoppedBy": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/SessionJobStoppedByView"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "Set when Lightspeed stopped the running job."
           }
         },
         "required": [
-          "namespace",
           "jobId",
+          "requestId",
           "status",
           "createdAtMs"
         ],
@@ -19905,7 +20051,7 @@
       "x-lightspeed-target": null
     },
     {
-      "description": "Synchronously enables or disables one provider-authorized HTTPS endpoint for a provisioned environment. The provider owns hostname allocation, the approved guest port, routing, TLS, and health.",
+      "description": "Records the public ingress intent of a provisioned environment; the lifecycle reconciler converges it while the environment is ready, and `publicEndpoint` shows the realized endpoint. Rejected when the provider does not offer ingress. The provider owns hostname, guest port, routing, TLS, and health; an intent its template refuses is dropped.",
       "name": "environments/ingress/put",
       "paramStructure": "by-name",
       "params": [
@@ -20129,7 +20275,7 @@
       "x-lightspeed-target": null
     },
     {
-      "description": "Reads selected job handles with bounded output, optional sequence continuation, and optional artifacts; use returned status/sequence data for polling.",
+      "description": "Reads selected job handles with bounded output from a byte offset or the output tail; continue from each entry's outputNext and poll on the returned status.",
       "name": "environments/jobs/read",
       "paramStructure": "by-name",
       "params": [
@@ -22579,7 +22725,7 @@
       "x-lightspeed-target": null
     },
     {
-      "description": "Registers or replaces one deployment provider and its controller connection. The provider does not call this API or require access to Lightspeed.",
+      "description": "Registers or replaces one deployment provider: its controller endpoint URL and the bearer credential Lightspeed presents to the controller and data routes. The credential is write-only: required for a new provider, kept when omitted, never returned. The provider does not call this API or require access to Lightspeed.",
       "name": "deployment/environment-providers/put",
       "paramStructure": "by-name",
       "params": [
@@ -22606,7 +22752,7 @@
       "x-lightspeed-target": null
     },
     {
-      "description": "Returns every deployment-registered deployment provider and its controller connection.",
+      "description": "Returns every deployment-registered provider with its controller endpoint and the optional features its controller last advertised.",
       "name": "deployment/environment-providers/list",
       "paramStructure": "by-name",
       "params": [
@@ -22633,7 +22779,7 @@
       "x-lightspeed-target": null
     },
     {
-      "description": "Returns one deployment-registered deployment provider and its controller connection.",
+      "description": "Returns one deployment-registered provider with its controller endpoint and the optional features its controller last advertised.",
       "name": "deployment/environment-providers/read",
       "paramStructure": "by-name",
       "params": [
diff --git a/crates/api/src/deployment.rs b/crates/api/src/deployment.rs
index 393efbce6..d6aecc5c0 100644
--- a/crates/api/src/deployment.rs
+++ b/crates/api/src/deployment.rs
@@ -272,24 +272,14 @@ pub struct DeploymentApiKeyRevokeResponse {
     pub api_key: DeploymentApiKeyView,
 }
 
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
-#[serde(tag = "type", rename_all = "camelCase")]
-pub enum DeploymentEnvironmentProviderTransport {
-    WebSocket,
-    Http,
-    Stdio,
-    Ssh,
-    Provider {
-        #[serde(rename = "providerType")]
-        provider_type: String,
-    },
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+/// Optional controller methods the provider's controller advertised.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
 #[serde(rename_all = "camelCase")]
-pub struct DeploymentEnvironmentProviderConnection {
-    pub endpoint: String,
-    pub transport: DeploymentEnvironmentProviderTransport,
+pub struct DeploymentEnvironmentProviderFeaturesView {
+    /// Existing targets can be adopted (`environment/adopt`).
+    pub adopt_target: bool,
+    /// Public ingress can be enabled on environments.
+    pub ingress: bool,
 }
 
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
@@ -298,22 +288,54 @@ pub struct DeploymentEnvironmentProviderView {
     pub provider_id: EnvironmentProviderId,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub display_name: Option<String>,
-    pub controller_connection: DeploymentEnvironmentProviderConnection,
+    /// `ws://`, `wss://` or `unix://` URL of the provider controller.
+    pub controller_endpoint: String,
     #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
     pub metadata: BTreeMap<String, String>,
+    /// What the controller advertised at its last successful handshake;
+    /// absent until Lightspeed first reached it at this endpoint.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub controller_features: Option<DeploymentEnvironmentProviderFeaturesView>,
+    /// Base URL of the provider's data routes, as its controller advertised
+    /// it; absent until then.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub data_route_base: Option<String>,
     pub created_at_ms: i64,
     pub updated_at_ms: i64,
 }
 
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+/// Register or replace a provider. `credential` is the bearer token
+/// Lightspeed presents to the provider's controller and data routes: it is
+/// sealed on receipt and never returned by any method. `Debug` output
+/// redacts it; request logging must never echo these params.
+#[derive(Clone, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
 #[serde(rename_all = "camelCase")]
 pub struct DeploymentEnvironmentProviderPutParams {
     pub provider_id: EnvironmentProviderId,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub display_name: Option<String>,
-    pub controller_connection: DeploymentEnvironmentProviderConnection,
+    /// `ws://`, `wss://` or `unix://` URL of the provider controller.
+    pub controller_endpoint: String,
     #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
     pub metadata: BTreeMap<String, String>,
+    /// Required when the provider is new; omit to keep the stored one.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub credential: Option<String>,
+}
+
+impl fmt::Debug for DeploymentEnvironmentProviderPutParams {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("DeploymentEnvironmentProviderPutParams")
+            .field("provider_id", &self.provider_id)
+            .field("display_name", &self.display_name)
+            .field("controller_endpoint", &self.controller_endpoint)
+            .field("metadata", &self.metadata)
+            .field(
+                "credential",
+                &self.credential.as_ref().map(|_| "<redacted>"),
+            )
+            .finish()
+    }
 }
 
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
@@ -663,11 +685,11 @@ deployment_api_methods! {
     METHOD_DEPLOYMENT_API_KEYS_REVOKE => revoke_api_key(DeploymentApiKeyRevokeParams) -> DeploymentApiKeyRevokeResponse =>
         ["Revoke a scoped API key", "Revokes the key with this display prefix; revoking a revoked key keeps its first revocation time. An unknown prefix is not found."], access: MethodAccess::Deployment,
     METHOD_DEPLOYMENT_ENVIRONMENT_PROVIDERS_PUT => put_environment_provider(DeploymentEnvironmentProviderPutParams) -> DeploymentEnvironmentProviderPutResponse =>
-        ["Put an environment provider", "Registers or replaces one deployment provider and its controller connection. The provider does not call this API or require access to Lightspeed."], access: MethodAccess::Deployment,
+        ["Put an environment provider", "Registers or replaces one deployment provider: its controller endpoint URL and the bearer credential Lightspeed presents to the controller and data routes. The credential is write-only: required for a new provider, kept when omitted, never returned. The provider does not call this API or require access to Lightspeed."], access: MethodAccess::Deployment,
     METHOD_DEPLOYMENT_ENVIRONMENT_PROVIDERS_LIST => list_environment_providers(DeploymentEnvironmentProviderListParams) -> DeploymentEnvironmentProviderListResponse =>
-        ["List environment providers", "Returns every deployment-registered deployment provider and its controller connection."], access: MethodAccess::Deployment,
+        ["List environment providers", "Returns every deployment-registered provider with its controller endpoint and the optional features its controller last advertised."], access: MethodAccess::Deployment,
     METHOD_DEPLOYMENT_ENVIRONMENT_PROVIDERS_READ => read_environment_provider(DeploymentEnvironmentProviderReadParams) -> DeploymentEnvironmentProviderReadResponse =>
-        ["Read an environment provider", "Returns one deployment-registered deployment provider and its controller connection."], access: MethodAccess::Deployment,
+        ["Read an environment provider", "Returns one deployment-registered provider with its controller endpoint and the optional features its controller last advertised."], access: MethodAccess::Deployment,
     METHOD_DEPLOYMENT_ENVIRONMENT_PROVIDERS_DELETE => delete_environment_provider(DeploymentEnvironmentProviderDeleteParams) -> DeploymentEnvironmentProviderDeleteResponse =>
         ["Delete an environment provider", "Deletes a deployment provider only when no universe binding references it."], access: MethodAccess::Deployment,
     METHOD_DEPLOYMENT_PROVIDER_BINDINGS_PUT => put_environment_provider_binding(DeploymentProviderBindingPutParams) -> DeploymentProviderBindingPutResponse =>
diff --git a/crates/api/src/environments.rs b/crates/api/src/environments.rs
index d53a85c5d..6273cf3c5 100644
--- a/crates/api/src/environments.rs
+++ b/crates/api/src/environments.rs
@@ -173,8 +173,9 @@ pub struct EnvironmentIdlePolicyPutResponse {
 #[serde(rename_all = "camelCase")]
 pub struct EnvironmentExternalCreateParams {
     pub request_id: EnvironmentProvisionRequestId,
-    /// Connection to an envd instance reachable from Lightspeed.
-    pub connection: EnvironmentConnectionView,
+    /// `ws://`, `wss://` or `unix://` URL of an envd instance reachable from
+    /// Lightspeed.
+    pub endpoint: String,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub display_name: Option<String>,
     #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
@@ -218,7 +219,8 @@ pub enum EnvironmentSourceView {
         binding_id: EnvironmentProviderBindingId,
     },
     External {
-        connection: EnvironmentConnectionView,
+        /// `ws://`, `wss://` or `unix://` URL Lightspeed dials envd at.
+        endpoint: String,
     },
     /// An envd that dialed the gateway outbound and was admitted by a
     /// registration key. The key is the environment's group; the daemon id
@@ -354,23 +356,6 @@ pub struct EnvironmentRegistrationKeyRevokeResponse {
     pub closed_environment_ids: Vec<EnvironmentId>,
 }
 
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
-#[serde(rename_all = "camelCase")]
-pub struct EnvironmentConnectionView {
-    pub endpoint: String,
-    pub transport: EnvironmentConnectionTransportView,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
-#[serde(rename_all = "camelCase")]
-pub enum EnvironmentConnectionTransportView {
-    WebSocket,
-    Http,
-    Stdio,
-    Ssh,
-    Provider { provider_type: String },
-}
-
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
 #[serde(rename_all = "camelCase")]
 pub struct EnvironmentIncarnationView {
@@ -403,7 +388,11 @@ pub struct EnvironmentView {
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub idle_policy: Option<EnvironmentIdlePolicyView>,
     pub incarnation: EnvironmentIncarnationView,
+    /// Lightspeed-owned public ingress intent; `publicEndpoint` is what the
+    /// provider realized.
     pub public_ingress_enabled: bool,
+    /// The public endpoint the provider last reported. It lags
+    /// `publicIngressEnabled` while the lifecycle reconciler converges.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub public_endpoint: Option<String>,
     #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
@@ -412,10 +401,25 @@ pub struct EnvironmentView {
     /// control connection.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub last_seen_at_ms: Option<i64>,
+    /// Why the environment failed, or the latest error (or what the
+    /// provider reports it is waiting on) while its lifecycle converges;
+    /// absent once it reaches a steady state.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub lifecycle_error: Option<EnvironmentLifecycleErrorView>,
     pub created_at_ms: i64,
     pub updated_at_ms: i64,
 }
 
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct EnvironmentLifecycleErrorView {
+    pub message: String,
+    /// When the current run of errors began.
+    pub first_at_ms: i64,
+    /// When `message` was recorded.
+    pub last_at_ms: i64,
+}
+
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
 #[serde(rename_all = "camelCase")]
 pub enum EnvironmentProviderBindingStatusView {
@@ -469,10 +473,27 @@ pub struct EnvironmentTemplateView {
     pub description: Option<String>,
     pub public_ingress: bool,
     pub deprecated: bool,
+    /// Compute targets of this template get; absent when the provider does
+    /// not fix it.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub resources: Option<EnvironmentTemplateResourcesView>,
     #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
     pub metadata: BTreeMap<String, String>,
 }
 
+/// A template's compute, in provider-neutral units. Each field is absent
+/// when the provider does not fix it.
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct EnvironmentTemplateResourcesView {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub vcpus: Option<u32>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub memory_bytes: Option<u64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub disk_bytes: Option<u64>,
+}
+
 #[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
 #[serde(rename_all = "camelCase")]
 pub struct EnvironmentTemplateListParams {
@@ -632,6 +653,9 @@ pub struct SessionJobStartedView {
     pub queue_key: Option<String>,
 }
 
+/// One job's summary and output page, or why it could not be read: an
+/// entry with `error` and no summary names a job the environment does not
+/// know (never created, or garbage-collected).
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
 #[serde(rename_all = "camelCase")]
 pub struct SessionJobReadEntryView {
@@ -639,11 +663,17 @@ pub struct SessionJobReadEntryView {
     pub handle: Option<SessionJobHandleView>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub summary: Option<SessionJobSummaryView>,
+    /// Output in offset order.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub output_chunks: Vec<SessionJobOutputChunkView>,
-    pub output_next_seq: u64,
+    /// Byte offset to continue reading from: pass it as `after`.
+    pub output_next: u64,
+    /// Output bytes the job produced so far; final once it is terminal.
+    pub output_end: u64,
+    /// Output ranges between the requested start and `outputNext` that
+    /// cannot be returned.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub artifacts: Vec<SessionJobArtifactView>,
+    pub output_gaps: Vec<SessionJobOutputGapView>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub error: Option<String>,
 }
@@ -667,25 +697,38 @@ pub enum SessionJobCancelScopeView {
     Dependents,
 }
 
+/// What a job is and how it ended. Instants are the environment's wall
+/// clock.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
 #[serde(rename_all = "camelCase")]
 pub struct SessionJobSummaryView {
-    pub namespace: String,
     pub job_id: String,
+    /// The start request that created the job; part of its identity.
+    pub request_id: String,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub name: Option<String>,
     pub status: SessionJobStatusView,
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub dependencies: Vec<String>,
-    pub created_at_ms: u64,
+    pub created_at_ms: i64,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub queued_at_ms: Option<i64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub started_at_ms: Option<i64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub finished_at_ms: Option<i64>,
+    /// When a cancel reached the job while it ran.
     #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub queued_at_ms: Option<u64>,
+    pub cancel_requested_at_ms: Option<i64>,
+    /// Run time from start to finish, immune to clock jumps.
     #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub started_at_ms: Option<u64>,
+    pub duration_ms: Option<u64>,
+    /// How the job's root process ended, once it ran and exited.
     #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub finished_at_ms: Option<u64>,
+    pub exit: Option<SessionJobExitView>,
+    /// Set when Lightspeed stopped the running job.
     #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub exit_code: Option<i32>,
+    pub stopped_by: Option<SessionJobStoppedByView>,
     /// True when the job's root process exited while descendants it spawned
     /// were still running; the host terminated them best-effort at job
     /// completion.
@@ -697,45 +740,91 @@ pub struct SessionJobSummaryView {
     pub queue_key: Option<String>,
 }
 
+/// Job lifecycle. `queued` and `running` are live; the rest are terminal.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
 #[serde(rename_all = "camelCase")]
 pub enum SessionJobStatusView {
-    Accepted,
+    /// Waiting for dependencies or its queue.
     Queued,
     Running,
+    /// Exited with code 0.
     Succeeded,
+    /// Exited otherwise, or could not start.
     Failed,
-    CancelRequested,
-    Cancelled,
+    /// Its timeout expired and it was stopped.
     TimedOut,
+    /// Stopped or never started because of a cancel.
+    Cancelled,
+    /// A dependency did not finish as the dependency policy requires.
     DependencyFailed,
+    /// The environment daemon stopped while the job was queued or running.
     Interrupted,
-    Lost,
+}
+
+/// How a job's root process ended.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[serde(
+    tag = "type",
+    rename_all = "camelCase",
+    rename_all_fields = "camelCase"
+)]
+pub enum SessionJobExitView {
+    /// Normal exit with this status code.
+    Code { code: i32 },
+    /// Killed by this signal, named like `SIGSEGV`.
+    Signal {
+        signal: String,
+        #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+        core_dumped: bool,
+    },
+}
+
+/// Why Lightspeed stopped a running job.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+pub enum SessionJobStoppedByView {
+    /// Its timeout expired: terminate, a grace period, then kill.
+    Timeout,
+    /// A cancel without `force`: terminate, a grace period, then kill.
+    Terminate,
+    /// A cancel with `force`: killed at once.
+    Kill,
 }
 
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
 #[serde(rename_all = "camelCase")]
 pub struct SessionJobOutputChunkView {
-    pub seq: u64,
+    /// Byte offset of the chunk's first byte in the job's combined output.
+    pub offset: u64,
     pub stream: SessionJobOutputStreamView,
     pub data_base64: String,
 }
 
+/// Output bytes in `[offset, offset + omittedBytes)` that cannot be
+/// returned.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
 #[serde(rename_all = "camelCase")]
-pub enum SessionJobOutputStreamView {
-    Stdout,
-    Stderr,
+pub struct SessionJobOutputGapView {
+    pub offset: u64,
+    pub omitted_bytes: u64,
+    pub reason: SessionJobOutputGapReasonView,
 }
 
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionJobArtifactView {
-    pub path: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub kind: Option<String>,
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    pub metadata: BTreeMap<String, String>,
+pub enum SessionJobOutputGapReasonView {
+    /// Dropped from the middle because the job's retained output exceeded
+    /// its cap; the head and the newest bytes are kept.
+    Overflow,
+    /// Released after it was delivered.
+    Expired,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+pub enum SessionJobOutputStreamView {
+    Stdout,
+    Stderr,
 }
 
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
@@ -759,12 +848,16 @@ pub struct EnvironmentJobCreateResponse {
 #[serde(rename_all = "camelCase")]
 pub struct EnvironmentJobReadParams {
     pub jobs: Vec<SessionJobHandleInput>,
+    /// Most output bytes per job; omit for the server's default page.
     #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub output_bytes: Option<usize>,
+    pub max_bytes: Option<u64>,
+    /// Byte offset to read each job's output from: a previous entry's
+    /// `outputNext`. Omitted with `tailBytes` omitted reads from the start.
     #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub after_seq: Option<u64>,
-    #[serde(default)]
-    pub include_artifacts: bool,
+    pub after: Option<u64>,
+    /// Read each job's last `tailBytes` of output instead; excludes `after`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub tail_bytes: Option<u64>,
 }
 
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
diff --git a/crates/api/src/handshake.rs b/crates/api/src/handshake.rs
index 33a9c7c2a..c20746ba4 100644
--- a/crates/api/src/handshake.rs
+++ b/crates/api/src/handshake.rs
@@ -96,8 +96,9 @@ pub struct ServerInfo {
 pub struct EnvironmentDaemonInfo {
     pub version: String,
     pub git_sha: String,
-    /// Environment protocol version the gateway speaks. A daemon registers
-    /// only when it reports exactly this number.
+    /// The envd protocol version (data plane and registration channel)
+    /// the gateway speaks. A daemon registers only when it reports exactly
+    /// this number.
     pub protocol_version: u32,
     /// Rust target triples the daemon is published for.
     pub targets: Vec<String>,
diff --git a/crates/api/src/rpc.rs b/crates/api/src/rpc.rs
index 08c2d47e5..e4320e92f 100644
--- a/crates/api/src/rpc.rs
+++ b/crates/api/src/rpc.rs
@@ -405,7 +405,7 @@ api_methods! {
     METHOD_ENVIRONMENTS_EXTERNAL_CREATE => create_external_environment(EnvironmentExternalCreateParams) -> EnvironmentExternalCreateResponse =>
         ["Register an external environment", "Creates an environment backed by a Lightspeed-reachable envd WebSocket endpoint, attributed to the caller. Reachability is checked on demand."], access: MethodAccess::Universe(UniverseAction::ConfigureResource),
     METHOD_ENVIRONMENTS_INGRESS_PUT => put_environment_ingress(EnvironmentIngressPutParams) -> EnvironmentIngressPutResponse =>
-        ["Configure environment public ingress", "Synchronously enables or disables one provider-authorized HTTPS endpoint for a provisioned environment. The provider owns hostname allocation, the approved guest port, routing, TLS, and health."], access: MethodAccess::Universe(UniverseAction::ConfigureResource),
+        ["Configure environment public ingress", "Records the public ingress intent of a provisioned environment; the lifecycle reconciler converges it while the environment is ready, and `publicEndpoint` shows the realized endpoint. Rejected when the provider does not offer ingress. The provider owns hostname, guest port, routing, TLS, and health; an intent its template refuses is dropped."], access: MethodAccess::Universe(UniverseAction::ConfigureResource),
     METHOD_ENVIRONMENTS_POWER_PUT => put_environment_power(EnvironmentPowerPutParams) -> EnvironmentPowerPutResponse =>
         ["Set environment power intent", "Records the desired power state (running, paused, suspended, or stopped) of a provisioned environment; the lifecycle reconciler converges the provider target asynchronously. Powered-down environments wake transparently on their next use. Rejected when the provider does not support the state."], access: MethodAccess::Universe(UniverseAction::ConfigureResource),
     METHOD_ENVIRONMENTS_IDLE_POLICY_PUT => put_environment_idle_policy(EnvironmentIdlePolicyPutParams) -> EnvironmentIdlePolicyPutResponse =>
@@ -421,7 +421,7 @@ api_methods! {
     METHOD_ENVIRONMENTS_JOBS_CREATE => create_environment_jobs(EnvironmentJobCreateParams) -> EnvironmentJobCreateResponse =>
         ["Create environment jobs", "Starts a dependency-aware job group on one environment instance, injecting the environment's configured credentials at provider start. requestId is the retry identity; jobs are owned by the instance rather than a session. A powered-down environment is woken on use: the call fails with environment_not_ready while the wake is in progress; retry with backoff."], access: MethodAccess::Universe(UniverseAction::UseResource),
     METHOD_ENVIRONMENTS_JOBS_READ => read_environment_jobs(EnvironmentJobReadParams) -> EnvironmentJobReadResponse =>
-        ["Read environment jobs", "Reads selected job handles with bounded output, optional sequence continuation, and optional artifacts; use returned status/sequence data for polling."], access: MethodAccess::Universe(UniverseAction::Read),
+        ["Read environment jobs", "Reads selected job handles with bounded output from a byte offset or the output tail; continue from each entry's outputNext and poll on the returned status."], access: MethodAccess::Universe(UniverseAction::Read),
     METHOD_ENVIRONMENTS_JOBS_CANCEL => cancel_environment_jobs(EnvironmentJobCancelParams) -> EnvironmentJobCancelResponse =>
         ["Cancel environment jobs", "Requests cancellation for selected jobs, optionally including dependents. Force is provider-specific escalation; inspect each per-job result."], access: MethodAccess::Universe(UniverseAction::UseResource),
     METHOD_ENVIRONMENTS_REGISTRATION_KEYS_CREATE => create_environment_registration_key(EnvironmentRegistrationKeyCreateParams) -> EnvironmentRegistrationKeyCreateResponse =>
diff --git a/crates/api/src/tests.rs b/crates/api/src/tests.rs
index 7aad6f5e0..f74b8695d 100644
--- a/crates/api/src/tests.rs
+++ b/crates/api/src/tests.rs
@@ -171,6 +171,22 @@ fn auth_provider_create_params_redact_credential_in_debug_output() {
     );
 }
 
+#[test]
+fn environment_provider_put_params_redact_credential_in_debug_output() {
+    let params: DeploymentEnvironmentProviderPutParams = serde_json::from_value(json!({
+        "providerId": "incus-local",
+        "controllerEndpoint": "wss://incus.example.com/control",
+        "credential": "provider-bearer-secret"
+    }))
+    .expect("deserialize environment provider put params");
+
+    let debug = format!("{params:?}");
+
+    assert!(!debug.contains("provider-bearer-secret"), "{debug}");
+    assert!(debug.contains("<redacted>"));
+    assert_eq!(params.credential.as_deref(), Some("provider-bearer-secret"));
+}
+
 #[test]
 fn request_ids_accept_number_or_string() {
     let numeric: JsonRpcRequest = serde_json::from_value(json!({
@@ -3262,6 +3278,7 @@ fn test_environment_instance() -> EnvironmentView {
         public_endpoint: None,
         metadata: BTreeMap::new(),
         last_seen_at_ms: None,
+        lifecycle_error: None,
         created_at_ms: 10,
         updated_at_ms: 10,
     }
@@ -3303,10 +3320,7 @@ fn test_external_environment() -> EnvironmentView {
         environment_id: "evi_enrolled".to_owned(),
         request_id: "request-enrolled".to_owned(),
         source: EnvironmentSourceView::External {
-            connection: EnvironmentConnectionView {
-                endpoint: "ws://envd.test:19091".to_owned(),
-                transport: EnvironmentConnectionTransportView::WebSocket,
-            },
+            endpoint: "ws://envd.test:19091".to_owned(),
         },
         display_name: Some("External".to_owned()),
         status: EnvironmentLifecycleStatusView::Ready,
@@ -3325,6 +3339,7 @@ fn test_external_environment() -> EnvironmentView {
         public_endpoint: None,
         metadata: BTreeMap::new(),
         last_seen_at_ms: None,
+        lifecycle_error: None,
         created_at_ms: 10,
         updated_at_ms: 10,
     }
@@ -3403,11 +3418,13 @@ fn test_deployment_environment_provider(provider_id: &str) -> DeploymentEnvironm
     DeploymentEnvironmentProviderView {
         provider_id: provider_id.to_owned(),
         display_name: Some("Local Incus".to_owned()),
-        controller_connection: DeploymentEnvironmentProviderConnection {
-            endpoint: "ws://127.0.0.1:19090/control".to_owned(),
-            transport: DeploymentEnvironmentProviderTransport::WebSocket,
-        },
+        controller_endpoint: "ws://127.0.0.1:19090/control".to_owned(),
         metadata: BTreeMap::new(),
+        controller_features: Some(DeploymentEnvironmentProviderFeaturesView {
+            adopt_target: true,
+            ingress: true,
+        }),
+        data_route_base: Some("ws://127.0.0.1:19090/data".to_owned()),
         created_at_ms: 10,
         updated_at_ms: 20,
     }
@@ -3572,10 +3589,7 @@ async fn deployment_environment_provider_methods_dispatch() {
             json!({
                 "providerId": "incus-local",
                 "displayName": "Local Incus",
-                "controllerConnection": {
-                    "endpoint": "ws://127.0.0.1:19090/control",
-                    "transport": { "type": "webSocket" }
-                }
+                "controllerEndpoint": "ws://127.0.0.1:19090/control"
             }),
         ),
         (METHOD_DEPLOYMENT_ENVIRONMENT_PROVIDERS_LIST, json!({})),
diff --git a/crates/cli/src/env_cli.rs b/crates/cli/src/env_cli.rs
index e27cbf9fd..600dd1f4e 100644
--- a/crates/cli/src/env_cli.rs
+++ b/crates/cli/src/env_cli.rs
@@ -556,7 +556,7 @@ struct CreateArgs {
 struct RegisterArgs {
     #[command(flatten)]
     common: ResourceArgs,
-    /// A ws:// or wss:// endpoint reachable from the runtime.
+    /// A ws://, wss:// or unix:// endpoint of envd reachable from the runtime.
     endpoint: String,
     /// Supply the same request ID when retrying registration.
     #[arg(long)]
@@ -639,20 +639,18 @@ async fn create(args: CreateArgs) -> Result<()> {
     crate::output::show(args.common.json, &response.environment)
 }
 async fn register(args: RegisterArgs) -> Result<()> {
-    let endpoint = reqwest::Url::parse(&args.endpoint)?;
     anyhow::ensure!(
-        matches!(endpoint.scheme(), "ws" | "wss"),
-        "envd endpoint must use ws:// or wss://"
+        ["ws://", "wss://", "unix://"]
+            .iter()
+            .any(|scheme| args.endpoint.starts_with(scheme)),
+        "envd endpoint must use ws://, wss:// or unix://"
     );
     let response: api::EnvironmentExternalCreateResponse = HttpAgentApi::new(args.common.api_url)
         .request(
             api::METHOD_ENVIRONMENTS_EXTERNAL_CREATE,
             api::EnvironmentExternalCreateParams {
                 request_id: args.request_id,
-                connection: api::EnvironmentConnectionView {
-                    endpoint: args.endpoint,
-                    transport: api::EnvironmentConnectionTransportView::WebSocket,
-                },
+                endpoint: args.endpoint,
                 display_name: args.display_name,
                 metadata: args.metadata.map(),
             },
diff --git a/crates/cli/tests/resource_commands.rs b/crates/cli/tests/resource_commands.rs
index 182c2f60c..8fed2de50 100644
--- a/crates/cli/tests/resource_commands.rs
+++ b/crates/cli/tests/resource_commands.rs
@@ -556,11 +556,9 @@ fn provisioning_and_template_commands_send_current_typed_requests() {
                 assert_eq!(params["metadata"], json!({"project":"audit"}));
                 json!({"type":"provisioned","providerId":"incus","bindingId":"local"})
             } else {
-                assert_eq!(
-                    params["connection"],
-                    json!({"endpoint":"wss://env.example/ws","transport":"webSocket"})
-                );
-                json!({"type":"external","connection":params["connection"]})
+                assert_eq!(params["endpoint"], "wss://env.example/ws");
+                assert!(params.get("connection").is_none(), "{params}");
+                json!({"type":"external","endpoint":params["endpoint"]})
             };
             assert_eq!(params["requestId"], "retry-1");
             json!({"environment":{"environmentId":"env1","requestId":params["requestId"],"source":source,"status":"provisioning","desiredPower":"running","incarnation":{"incarnationId":"i1","createdAtMs":0,"updatedAtMs":0},"publicIngressEnabled":false,"createdAtMs":0,"updatedAtMs":0}})
diff --git a/crates/environment-client/Cargo.toml b/crates/environment-client/Cargo.toml
index b868be79b..a1e1ddd70 100644
--- a/crates/environment-client/Cargo.toml
+++ b/crates/environment-client/Cargo.toml
@@ -3,15 +3,20 @@ name = "environment-client"
 version = "0.1.0"
 edition = "2024"
 
+[features]
+# `conformance::controller`: a suite that drives any controller endpoint
+# through `ControllerClient` and checks the controller-plane contract.
+conformance = []
+
 [dependencies]
-async-trait = "0.1"
-futures-util = "0.3"
+futures-util = { version = "0.3", features = ["sink"] }
 environment-protocol = { path = "../environment-protocol" }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 thiserror = "2"
-tokio = { version = "1", features = ["net"] }
-tokio-tungstenite = { version = "0.30", default-features = false, features = ["connect", "rustls-tls-webpki-roots"] }
+tokio = { version = "1", features = ["macros", "net", "rt", "sync", "time"] }
+tokio-tungstenite = { version = "0.30", default-features = false, features = ["connect", "handshake", "rustls-tls-webpki-roots"] }
 
 [dev-dependencies]
-tokio = { version = "1", features = ["macros", "rt", "time"] }
+environment-client = { path = ".", features = ["conformance"] }
+tokio = { version = "1", features = ["io-util", "macros", "rt", "time"] }
diff --git a/crates/environment-client/src/conformance/controller.rs b/crates/environment-client/src/conformance/controller.rs
new file mode 100644
index 000000000..ac61c60bb
--- /dev/null
+++ b/crates/environment-client/src/conformance/controller.rs
@@ -0,0 +1,631 @@
+//! Controller-plane conformance: drives any controller endpoint through
+//! [`ControllerClient`] and checks the contract every provider shares.
+//!
+//! The suite checks that:
+//!
+//! - `initialize` names the `controller` plane, refuses a wrong
+//!   `protocolVersion` with `versionMismatch` (leaving the connection open
+//!   and uninitialized), refuses requests before it with `notInitialized`,
+//!   and refuses a repeat with `invalidRequest`;
+//! - a missing or wrong bearer credential is refused with HTTP 401 before
+//!   the upgrade;
+//! - `routes.data` passes the downgrade rule for the controller URL;
+//! - `target/get` never creates and answers `notFound` for an unknown
+//!   owner or id; a foreign owner on a known `targetId` is
+//!   `failedPrecondition` (`ownerMismatch`);
+//! - `target/create` answers promptly and is idempotent per owner;
+//! - `target/close` by owner without a `targetId` closes, is idempotent,
+//!   and answers `closed` without `targetId` for an owner with nothing;
+//! - optional methods answer `capabilityUnavailable` when not advertised.
+//!
+//! The suite creates one target from the configured template and closes it
+//! again; every other check uses fresh owners that hold nothing.
+//!
+//! ```no_run
+//! # async fn example(options: environment_client::ConnectOptions,
+//! #     template_id: environment_protocol::ids::TemplateId,
+//! #     owner: std::sync::Arc<dyn Fn() -> environment_protocol::control::target::TargetOwner + Send + Sync>) {
+//! use environment_client::conformance::controller::{ControllerConformance, run};
+//!
+//! let suite = ControllerConformance::new("wss://provider.example/control", options, template_id, owner);
+//! run(&suite).await.into_result().expect("controller conforms");
+//! # }
+//! ```
+
+use std::{
+    fmt,
+    sync::Arc,
+    time::{Duration, Instant},
+};
+
+use environment_protocol::{
+    CONTROLLER_PROTOCOL_VERSION,
+    bytes::SecretString,
+    control::{
+        handshake::{ControllerInitializeParams, ControllerInitializeResponse},
+        ingress::{EnsureIngressParams, RemoveIngressParams},
+        target::{
+            AdoptTargetParams, CloseTargetParams, CreateTargetParams, GetTargetParams,
+            TargetObservation, TargetOwner, TargetPhase, TargetRef,
+        },
+    },
+    error::{Capability, ErrorData, PreconditionReason, ProtocolErrorKind},
+    handshake::Plane,
+    ids::{ProviderNativeRef, ProviderTargetId, TemplateId},
+    manifest::{ControllerInitialize, TargetGet},
+};
+use thiserror::Error;
+
+use crate::{
+    ClientError, ConnectOptions, ControllerClient, connection::Connection, controller::initialize,
+};
+
+/// What to run the suite against.
+#[derive(Clone)]
+pub struct ControllerConformance {
+    /// The controller URL, as registered for the provider.
+    pub endpoint: String,
+    /// Connect options carrying the provider credential as `bearer_token`.
+    pub options: ConnectOptions,
+    /// A template the suite may create one target from.
+    pub template_id: TemplateId,
+    /// Returns a fresh owner on every call, valid for the provider's
+    /// binding and never used before.
+    pub owner: Arc<dyn Fn() -> TargetOwner + Send + Sync>,
+    /// Bound on every answer: target methods answer promptly and continue
+    /// slow work in the background. Default 15 s.
+    pub prompt_bound: Duration,
+    /// How long the created target may take to carry a `targetId`, and its
+    /// close to reach `closed`. Default 10 min.
+    pub settle_timeout: Duration,
+    /// Pause between observations while waiting. Default 2 s.
+    pub poll_interval: Duration,
+}
+
+impl ControllerConformance {
+    pub fn new(
+        endpoint: impl Into<String>,
+        options: ConnectOptions,
+        template_id: TemplateId,
+        owner: Arc<dyn Fn() -> TargetOwner + Send + Sync>,
+    ) -> Self {
+        Self {
+            endpoint: endpoint.into(),
+            options,
+            template_id,
+            owner,
+            prompt_bound: Duration::from_secs(15),
+            settle_timeout: Duration::from_secs(600),
+            poll_interval: Duration::from_secs(2),
+        }
+    }
+}
+
+impl fmt::Debug for ControllerConformance {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("ControllerConformance")
+            .field("endpoint", &self.endpoint)
+            .field("template_id", &self.template_id)
+            .field("prompt_bound", &self.prompt_bound)
+            .field("settle_timeout", &self.settle_timeout)
+            .finish_non_exhaustive()
+    }
+}
+
+/// The outcome of one check.
+#[derive(Clone, Debug)]
+pub struct CheckResult {
+    /// Stable check name, such as `target.get.foreignOwner`.
+    pub name: &'static str,
+    /// Why the check failed.
+    pub failure: Option<String>,
+}
+
+/// Every check that ran, in order.
+#[derive(Clone, Debug, Default)]
+pub struct ConformanceReport {
+    pub checks: Vec<CheckResult>,
+}
+
+impl ConformanceReport {
+    pub fn passed(&self) -> bool {
+        self.checks.iter().all(|check| check.failure.is_none())
+    }
+
+    pub fn failures(&self) -> impl Iterator<Item = &CheckResult> {
+        self.checks.iter().filter(|check| check.failure.is_some())
+    }
+
+    /// `Ok` when every check passed.
+    pub fn into_result(self) -> Result<Self, ConformanceFailure> {
+        if self.passed() {
+            return Ok(self);
+        }
+        Err(ConformanceFailure {
+            failures: self
+                .failures()
+                .map(|check| (check.name, check.failure.clone().unwrap_or_default()))
+                .collect(),
+        })
+    }
+
+    fn record(&mut self, name: &'static str, outcome: Result<(), String>) -> bool {
+        let passed = outcome.is_ok();
+        self.checks.push(CheckResult {
+            name,
+            failure: outcome.err(),
+        });
+        passed
+    }
+}
+
+/// The failed checks of a run.
+#[derive(Clone, Debug, Error)]
+#[error("controller conformance failed: {}", describe(failures))]
+pub struct ConformanceFailure {
+    /// Check name and why it failed.
+    pub failures: Vec<(&'static str, String)>,
+}
+
+fn describe(failures: &[(&'static str, String)]) -> String {
+    failures
+        .iter()
+        .map(|(name, failure)| format!("{name}: {failure}"))
+        .collect::<Vec<_>>()
+        .join("; ")
+}
+
+type Check = Result<(), String>;
+
+/// Run every check against `suite.endpoint`. Checks that need the
+/// handshake are skipped (and reported) when it fails.
+pub async fn run(suite: &ControllerConformance) -> ConformanceReport {
+    let mut report = ConformanceReport::default();
+    let connected = ControllerClient::connect_initialized(
+        &suite.endpoint,
+        with_timeout(suite.options.clone(), suite.prompt_bound),
+    )
+    .await;
+    let (client, initialize) = match connected {
+        Ok(connected) => connected,
+        Err(error) => {
+            report.record(
+                "initialize",
+                Err(format!("connect_initialized failed: {error}")),
+            );
+            return report;
+        }
+    };
+    report.record("initialize", check_initialize(&initialize));
+    report.record(
+        "initialize.repeat",
+        check_repeat_initialize(suite, &client).await,
+    );
+    report.record("initialize.order", check_initialize_order(suite).await);
+    report.record("credential", check_credential(suite).await);
+    report.record(
+        "routes.data",
+        initialize
+            .routes
+            .data
+            .check_for_controller(&suite.endpoint)
+            .map_err(|error| error.to_string()),
+    );
+    report.record(
+        "target.get.unknown",
+        check_get_unknown(suite, &client).await,
+    );
+    report.record(
+        "target.close.nothing",
+        check_close_nothing(suite, &client).await,
+    );
+    report.record(
+        "capabilities.optional",
+        check_optional_methods(suite, &client, &initialize).await,
+    );
+
+    let owner = (suite.owner)();
+    let created = check_create(suite, &client, &owner).await;
+    let created_target = created.as_ref().ok().cloned().flatten();
+    report.record("target.create", created.map(|_| ()));
+    if let Some(target_id) = created_target {
+        report.record(
+            "target.get.foreignOwner",
+            check_foreign_owner(suite, &client, &target_id).await,
+        );
+    }
+    report.record(
+        "target.close.byOwner",
+        check_close_by_owner(suite, &client, &owner).await,
+    );
+    let _ = client.close().await;
+    report
+}
+
+fn with_timeout(mut options: ConnectOptions, bound: Duration) -> ConnectOptions {
+    options.request_timeout = Some(bound);
+    options
+}
+
+fn check_initialize(initialize: &ControllerInitializeResponse) -> Check {
+    if initialize.plane != Plane::Controller {
+        return Err(format!("plane is {}", initialize.plane));
+    }
+    if initialize.protocol_version != CONTROLLER_PROTOCOL_VERSION {
+        return Err(format!(
+            "protocolVersion is {}",
+            initialize.protocol_version
+        ));
+    }
+    Ok(())
+}
+
+async fn check_repeat_initialize(
+    suite: &ControllerConformance,
+    client: &ControllerClient,
+) -> Check {
+    let repeated = client
+        .call::<ControllerInitialize>(&ControllerInitializeParams {
+            protocol_version: CONTROLLER_PROTOCOL_VERSION,
+            client_info: suite.options.client_info.clone(),
+        })
+        .await;
+    expect_kind(repeated.map(|_| ()), ProtocolErrorKind::InvalidRequest)
+}
+
+/// `notInitialized` before `initialize`; `versionMismatch` for another
+/// version, after which the same connection still initializes.
+async fn check_initialize_order(suite: &ControllerConformance) -> Check {
+    let options = with_timeout(suite.options.clone(), suite.prompt_bound);
+    let connection = Connection::connect(&suite.endpoint, &options, Plane::Controller)
+        .await
+        .map_err(|error| format!("connect: {error}"))?;
+    let outcome = async {
+        let early = connection
+            .call::<TargetGet>(
+                &GetTargetParams {
+                    target: TargetRef {
+                        owner: (suite.owner)(),
+                        target_id: None,
+                    },
+                },
+                None,
+            )
+            .await;
+        expect_kind(early.map(|_| ()), ProtocolErrorKind::NotInitialized)
+            .map_err(|error| format!("target/get before initialize: {error}"))?;
+
+        let wrong = CONTROLLER_PROTOCOL_VERSION + 1;
+        let params = serde_json::to_value(ControllerInitializeParams {
+            protocol_version: wrong,
+            client_info: suite.options.client_info.clone(),
+        })
+        .map_err(|error| error.to_string())?;
+        let response = connection
+            .request(ControllerInitialize::NAME, params, Some(suite.prompt_bound))
+            .await
+            .map_err(|error| format!("initialize with version {wrong}: {error}"))?;
+        match response.result {
+            Err(error) => match error.data {
+                ErrorData::VersionMismatch { expected, received }
+                    if expected == CONTROLLER_PROTOCOL_VERSION && received == wrong => {}
+                data => {
+                    return Err(format!(
+                        "initialize with version {wrong} answered {data:?}, expected \
+                         versionMismatch {{expected: {CONTROLLER_PROTOCOL_VERSION}, received: {wrong}}}"
+                    ));
+                }
+            },
+            Ok(_) => return Err(format!("initialize with version {wrong} succeeded")),
+        }
+        initialize(&connection, &options)
+            .await
+            .map(|_| ())
+            .map_err(|error| format!("initialize after a mismatch: {error}"))
+    }
+    .await;
+    let _ = connection.close().await;
+    outcome
+}
+
+async fn check_credential(suite: &ControllerConformance) -> Check {
+    let mut missing = suite.options.clone();
+    missing.bearer_token = None;
+    let mut wrong = suite.options.clone();
+    wrong.bearer_token = Some(SecretString::new("lightspeed-conformance-wrong-credential"));
+    for (label, options) in [("missing", missing), ("wrong", wrong)] {
+        match ControllerClient::connect_initialized(&suite.endpoint, options).await {
+            Err(ClientError::UpgradeRejected { status: 401 }) => {}
+            Err(error) => {
+                return Err(format!(
+                    "{label} credential: expected HTTP 401, got {error}"
+                ));
+            }
+            Ok((client, _)) => {
+                let _ = client.close().await;
+                return Err(format!("{label} credential was accepted"));
+            }
+        }
+    }
+    Ok(())
+}
+
+async fn check_get_unknown(suite: &ControllerConformance, client: &ControllerClient) -> Check {
+    let owner = (suite.owner)();
+    let by_owner = get(client, &owner, None).await;
+    expect_kind(by_owner.map(|_| ()), ProtocolErrorKind::NotFound)
+        .map_err(|error| format!("target/get of an owner with nothing: {error}"))?;
+    let unknown = ProviderTargetId::new("lightspeed-conformance-unknown-target")
+        .map_err(|error| error.to_string())?;
+    let by_id = get(client, &owner, Some(unknown)).await;
+    expect_kind(by_id.map(|_| ()), ProtocolErrorKind::NotFound)
+        .map_err(|error| format!("target/get of an unknown targetId: {error}"))?;
+    let again = get(client, &owner, None).await;
+    expect_kind(again.map(|_| ()), ProtocolErrorKind::NotFound)
+        .map_err(|error| format!("target/get created a target: {error}"))
+}
+
+async fn check_close_nothing(suite: &ControllerConformance, client: &ControllerClient) -> Check {
+    let owner = (suite.owner)();
+    let observation = close(client, &owner)
+        .await
+        .map_err(|error| format!("target/close of an owner with nothing: {error}"))?;
+    if observation.state.phase != TargetPhase::Closed || observation.target_id.is_some() {
+        return Err(format!(
+            "target/close of an owner with nothing answered phase {:?} with targetId {:?}; \
+             expected closed without targetId",
+            observation.state.phase, observation.target_id
+        ));
+    }
+    check_owner_echo(&observation, &owner)
+}
+
+async fn check_optional_methods(
+    suite: &ControllerConformance,
+    client: &ControllerClient,
+    initialize: &ControllerInitializeResponse,
+) -> Check {
+    if !initialize.capabilities.adopt_target {
+        let source = ProviderNativeRef::new("lightspeed-conformance-source")
+            .map_err(|error| error.to_string())?;
+        let adopted = client
+            .adopt_target(&AdoptTargetParams {
+                owner: (suite.owner)(),
+                source_target: source,
+            })
+            .await;
+        expect_capability(adopted.map(|_| ()), Capability::AdoptTarget)
+            .map_err(|error| format!("target/adopt without adoptTarget: {error}"))?;
+    }
+    if !initialize.capabilities.ingress {
+        let target = TargetRef {
+            owner: (suite.owner)(),
+            target_id: None,
+        };
+        let ensured = client
+            .ensure_ingress(&EnsureIngressParams {
+                target: target.clone(),
+            })
+            .await;
+        expect_capability(ensured.map(|_| ()), Capability::Ingress)
+            .map_err(|error| format!("ingress/ensure without ingress: {error}"))?;
+        let removed = client.remove_ingress(&RemoveIngressParams { target }).await;
+        expect_capability(removed.map(|_| ()), Capability::Ingress)
+            .map_err(|error| format!("ingress/remove without ingress: {error}"))?;
+    }
+    Ok(())
+}
+
+/// Create twice for one owner, each answered within the prompt bound, then
+/// wait for the target's id. Returns that id.
+async fn check_create(
+    suite: &ControllerConformance,
+    client: &ControllerClient,
+    owner: &TargetOwner,
+) -> Result<Option<ProviderTargetId>, String> {
+    let params = CreateTargetParams {
+        owner: owner.clone(),
+        template_id: suite.template_id.clone(),
+    };
+    let first = timed(suite, "target/create", client.create_target(&params)).await?;
+    let second = timed(
+        suite,
+        "repeated target/create",
+        client.create_target(&params),
+    )
+    .await?;
+    check_owner_echo(&first.target, owner)?;
+    check_owner_echo(&second.target, owner)?;
+    if let (Some(first_id), Some(second_id)) = (&first.target.target_id, &second.target.target_id)
+        && first_id != second_id
+    {
+        return Err(format!(
+            "target/create is not idempotent per owner: {first_id} then {second_id}"
+        ));
+    }
+    let mut target_id = second.target.target_id.or(first.target.target_id);
+    let deadline = Instant::now() + suite.settle_timeout;
+    while target_id.is_none() {
+        if Instant::now() >= deadline {
+            return Err(format!(
+                "the target carried no targetId within {:?}",
+                suite.settle_timeout
+            ));
+        }
+        tokio::time::sleep(suite.poll_interval).await;
+        let observation = get(client, owner, None)
+            .await
+            .map_err(|error| format!("target/get of the created target: {error}"))?;
+        target_id = observation.target_id;
+    }
+    let repeated = timed(
+        suite,
+        "target/create after the id",
+        client.create_target(&params),
+    )
+    .await?;
+    if repeated.target.target_id != target_id {
+        return Err(format!(
+            "target/create after the id answered targetId {:?}, expected {:?}",
+            repeated.target.target_id, target_id
+        ));
+    }
+    Ok(target_id)
+}
+
+async fn check_foreign_owner(
+    suite: &ControllerConformance,
+    client: &ControllerClient,
+    target_id: &ProviderTargetId,
+) -> Check {
+    let foreign = (suite.owner)();
+    match get(client, &foreign, Some(target_id.clone())).await {
+        Err(ClientError::Protocol(error))
+            if matches!(
+                error.data,
+                ErrorData::FailedPrecondition {
+                    reason: PreconditionReason::OwnerMismatch
+                }
+            ) =>
+        {
+            Ok(())
+        }
+        Err(error) => Err(format!(
+            "expected failedPrecondition (ownerMismatch), got {error}"
+        )),
+        Ok(observation) => Err(format!(
+            "a foreign owner observed the target (phase {:?})",
+            observation.state.phase
+        )),
+    }
+}
+
+/// Close by owner without a `targetId` until `closed`, then once more.
+async fn check_close_by_owner(
+    suite: &ControllerConformance,
+    client: &ControllerClient,
+    owner: &TargetOwner,
+) -> Check {
+    let deadline = Instant::now() + suite.settle_timeout;
+    loop {
+        let observation = timed(suite, "target/close", async {
+            client
+                .close_target(&CloseTargetParams {
+                    target: TargetRef {
+                        owner: owner.clone(),
+                        target_id: None,
+                    },
+                })
+                .await
+        })
+        .await?
+        .target;
+        check_owner_echo(&observation, owner)?;
+        match observation.state.phase {
+            TargetPhase::Closed => break,
+            TargetPhase::Closing => {}
+            phase => return Err(format!("target/close answered phase {phase:?}")),
+        }
+        if Instant::now() >= deadline {
+            return Err(format!(
+                "the target did not reach closed within {:?}",
+                suite.settle_timeout
+            ));
+        }
+        tokio::time::sleep(suite.poll_interval).await;
+    }
+    let again = close(client, owner)
+        .await
+        .map_err(|error| format!("repeated target/close: {error}"))?;
+    if again.state.phase != TargetPhase::Closed {
+        return Err(format!(
+            "repeated target/close answered phase {:?}",
+            again.state.phase
+        ));
+    }
+    Ok(())
+}
+
+async fn get(
+    client: &ControllerClient,
+    owner: &TargetOwner,
+    target_id: Option<ProviderTargetId>,
+) -> Result<TargetObservation, ClientError> {
+    client
+        .get_target(&GetTargetParams {
+            target: TargetRef {
+                owner: owner.clone(),
+                target_id,
+            },
+        })
+        .await
+        .map(|response| response.target)
+}
+
+async fn close(
+    client: &ControllerClient,
+    owner: &TargetOwner,
+) -> Result<TargetObservation, ClientError> {
+    client
+        .close_target(&CloseTargetParams {
+            target: TargetRef {
+                owner: owner.clone(),
+                target_id: None,
+            },
+        })
+        .await
+        .map(|response| response.target)
+}
+
+/// Await `call` and require it to answer within the prompt bound.
+async fn timed<T>(
+    suite: &ControllerConformance,
+    label: &str,
+    call: impl Future<Output = Result<T, ClientError>>,
+) -> Result<T, String> {
+    let started = Instant::now();
+    let outcome = call.await.map_err(|error| format!("{label}: {error}"))?;
+    let elapsed = started.elapsed();
+    if elapsed > suite.prompt_bound {
+        return Err(format!(
+            "{label} took {elapsed:?}, over the {:?} prompt bound",
+            suite.prompt_bound
+        ));
+    }
+    Ok(outcome)
+}
+
+fn check_owner_echo(observation: &TargetObservation, owner: &TargetOwner) -> Check {
+    if &observation.owner != owner {
+        return Err(format!(
+            "the observation echoes owner {:?}, expected {:?}",
+            observation.owner, owner
+        ));
+    }
+    Ok(())
+}
+
+fn expect_kind(outcome: Result<(), ClientError>, kind: ProtocolErrorKind) -> Check {
+    match outcome {
+        Err(ClientError::Protocol(error)) if error.kind() == kind => Ok(()),
+        Err(error) => Err(format!("expected {kind}, got {error}")),
+        Ok(()) => Err(format!("expected {kind}, the call succeeded")),
+    }
+}
+
+fn expect_capability(outcome: Result<(), ClientError>, capability: Capability) -> Check {
+    match outcome {
+        Err(ClientError::Protocol(error))
+            if error.data == (ErrorData::CapabilityUnavailable { capability }) =>
+        {
+            Ok(())
+        }
+        Err(error) => Err(format!(
+            "expected capabilityUnavailable ({capability:?}), got {error}"
+        )),
+        Ok(()) => Err(format!(
+            "expected capabilityUnavailable ({capability:?}), the call succeeded"
+        )),
+    }
+}
diff --git a/crates/environment-client/src/conformance/mod.rs b/crates/environment-client/src/conformance/mod.rs
new file mode 100644
index 000000000..ec2c07fe7
--- /dev/null
+++ b/crates/environment-client/src/conformance/mod.rs
@@ -0,0 +1,8 @@
+//! Conformance suites that drive a real endpoint through this crate's
+//! clients and check the protocol contract. Enabled by the `conformance`
+//! feature.
+//!
+//! - [`controller`]: any provider controller, through
+//!   [`ControllerClient`](crate::ControllerClient).
+
+pub mod controller;
diff --git a/crates/environment-client/src/connection.rs b/crates/environment-client/src/connection.rs
new file mode 100644
index 000000000..82134b217
--- /dev/null
+++ b/crates/environment-client/src/connection.rs
@@ -0,0 +1,774 @@
+//! The multiplexed JSON-RPC connection under both clients.
+//!
+//! One writer task owns the socket's sink and one reader task its stream.
+//! A call registers a oneshot under a fresh integer id, queues its frame
+//! for the writer and waits; the reader routes each response to its call
+//! by id, in whatever order the server answers. A call that is dropped or
+//! runs past its deadline removes its entry, so a late response is
+//! discarded, and on the data plane an abortable call also sends
+//! `$/cancelRequest`. While any call is pending the writer pings every
+//! keepalive interval.
+//!
+//! The server of a data or controller connection only answers. A request
+//! or notification from it, a binary frame, a frame over the message
+//! limit or an unparseable frame ends the connection: every pending call
+//! fails with [`ClientError::InvalidMessage`] and the client closes the
+//! socket with close code 1002 (1009 for an oversized frame).
+
+use std::{
+    collections::HashMap,
+    sync::{
+        Arc, Mutex,
+        atomic::{AtomicI64, Ordering},
+    },
+    time::Duration,
+};
+
+use environment_protocol::{
+    error::ErrorData,
+    handshake::Plane,
+    jsonrpc::{
+        self, CancelRequestParams, Id, Message as RpcMessage, Notification, Request, Response,
+    },
+    limits::MAX_MESSAGE_BYTES,
+    manifest::{self, CancelRequest, RequestMethod},
+};
+use futures_util::{
+    SinkExt, StreamExt,
+    future::BoxFuture,
+    stream::{SplitSink, SplitStream},
+};
+use serde::{Serialize, de::DeserializeOwned};
+use serde_json::Value;
+use tokio::{
+    io::{AsyncRead, AsyncWrite},
+    sync::{mpsc, oneshot},
+    time::{Instant, MissedTickBehavior},
+};
+use tokio_tungstenite::{
+    WebSocketStream,
+    tungstenite::{
+        self, Message,
+        protocol::{CloseFrame, frame::coding::CloseCode},
+    },
+};
+
+use crate::{
+    dial::{self, Dialed},
+    error::ClientError,
+    options::ConnectOptions,
+};
+
+/// Serves one request of an in-process client: the request as the server
+/// would receive it, answered with the response it would send. An `Err`
+/// fails that one call with the given error, as a test's stand-in for a
+/// transport failure; the client stays usable.
+pub type InProcessHandler =
+    Arc<dyn Fn(Request) -> BoxFuture<'static, Result<Response, ClientError>> + Send + Sync>;
+
+/// How long [`Connection::close`] waits for the close frame to be written.
+const CLOSE_TIMEOUT: Duration = Duration::from_secs(5);
+
+/// How long the reader keeps reading for the server's close reply once
+/// the writer has stopped.
+const CLOSE_GRACE: Duration = Duration::from_secs(5);
+
+type Reply = Result<Response, ClientError>;
+
+/// Calls waiting for a response, and why the connection ended once it
+/// has.
+#[derive(Default)]
+struct Shared {
+    state: Mutex<State>,
+}
+
+#[derive(Default)]
+struct State {
+    pending: HashMap<i64, oneshot::Sender<Reply>>,
+    terminated: Option<ClientError>,
+}
+
+impl Shared {
+    fn state(&self) -> std::sync::MutexGuard<'_, State> {
+        self.state
+            .lock()
+            .unwrap_or_else(|poisoned| poisoned.into_inner())
+    }
+
+    fn register(&self, id: i64) -> Result<oneshot::Receiver<Reply>, ClientError> {
+        let mut state = self.state();
+        if let Some(error) = &state.terminated {
+            return Err(error.clone());
+        }
+        let (sender, receiver) = oneshot::channel();
+        state.pending.insert(id, sender);
+        Ok(receiver)
+    }
+
+    /// Hand a response to its call; a response nobody waits for any more is
+    /// discarded.
+    fn resolve(&self, id: i64, response: Response) {
+        if let Some(sender) = self.state().pending.remove(&id) {
+            let _ = sender.send(Ok(response));
+        }
+    }
+
+    /// Stop waiting for `id`. True when the call was still unanswered.
+    fn forget(&self, id: i64) -> bool {
+        self.state().pending.remove(&id).is_some()
+    }
+
+    fn has_pending(&self) -> bool {
+        !self.state().pending.is_empty()
+    }
+
+    /// End the connection with `error`: every pending call and every later
+    /// call fails with it. Only the first cause is kept.
+    fn terminate(&self, error: ClientError) {
+        let mut state = self.state();
+        if state.terminated.is_none() {
+            state.terminated = Some(error.clone());
+        }
+        for (_, sender) in state.pending.drain() {
+            let _ = sender.send(Err(error.clone()));
+        }
+    }
+
+    fn terminated(&self) -> Option<ClientError> {
+        self.state().terminated.clone()
+    }
+}
+
+enum Outgoing {
+    Text(String),
+    /// Send `frame` (if any), then stop writing. `ack` learns whether the
+    /// frame was written.
+    Close {
+        frame: Option<CloseFrame>,
+        ack: Option<oneshot::Sender<Result<(), String>>>,
+    },
+}
+
+enum Backend {
+    Socket {
+        outgoing: mpsc::UnboundedSender<Outgoing>,
+    },
+    InProcess {
+        handler: InProcessHandler,
+    },
+}
+
+/// One connection of either plane.
+pub(crate) struct Connection {
+    plane: Plane,
+    shared: Arc<Shared>,
+    backend: Backend,
+    next_id: AtomicI64,
+    request_timeout: Option<Duration>,
+}
+
+impl Connection {
+    /// Dial `endpoint` (no `initialize` yet).
+    pub(crate) async fn connect(
+        endpoint: &str,
+        options: &ConnectOptions,
+        plane: Plane,
+    ) -> Result<Self, ClientError> {
+        Ok(match dial::dial(endpoint, options).await? {
+            Dialed::Tcp(socket) => Self::over_socket(*socket, plane, options),
+            Dialed::Unix(socket) => Self::over_socket(*socket, plane, options),
+        })
+    }
+
+    /// Upgrade an already connected byte stream (no `initialize` yet).
+    pub(crate) async fn connect_over<S>(
+        stream: S,
+        options: &ConnectOptions,
+        plane: Plane,
+    ) -> Result<Self, ClientError>
+    where
+        S: AsyncRead + AsyncWrite + Unpin + Send + 'static,
+    {
+        let socket = dial::upgrade(stream, options).await?;
+        Ok(Self::over_socket(socket, plane, options))
+    }
+
+    fn over_socket<S>(socket: WebSocketStream<S>, plane: Plane, options: &ConnectOptions) -> Self
+    where
+        S: AsyncRead + AsyncWrite + Unpin + Send + 'static,
+    {
+        let (sink, stream) = socket.split();
+        let shared = Arc::new(Shared::default());
+        let (outgoing, outgoing_receiver) = mpsc::unbounded_channel();
+        let (writer_done, writer_stopped) = oneshot::channel();
+        let keepalive = options.keepalive_interval.max(Duration::from_millis(1));
+        tokio::spawn(write_loop(
+            sink,
+            outgoing_receiver,
+            shared.clone(),
+            keepalive,
+            writer_done,
+        ));
+        tokio::spawn(read_loop(
+            stream,
+            shared.clone(),
+            outgoing.downgrade(),
+            writer_stopped,
+        ));
+        Self {
+            plane,
+            shared,
+            backend: Backend::Socket { outgoing },
+            next_id: AtomicI64::new(1),
+            request_timeout: options.request_timeout,
+        }
+    }
+
+    pub(crate) fn in_process(plane: Plane, handler: InProcessHandler) -> Self {
+        Self {
+            plane,
+            shared: Arc::new(Shared::default()),
+            backend: Backend::InProcess { handler },
+            next_id: AtomicI64::new(1),
+            request_timeout: None,
+        }
+    }
+
+    pub(crate) fn is_closed(&self) -> bool {
+        self.shared.terminated().is_some()
+    }
+
+    /// Close the connection: pending calls fail with `Closed`, a close
+    /// frame is written (waiting at most a few seconds), and every later
+    /// call fails. Closing again does nothing.
+    pub(crate) async fn close(&self) -> Result<(), ClientError> {
+        self.shared.terminate(ClientError::Closed {
+            code: Some(u16::from(CloseCode::Normal)),
+            reason: None,
+        });
+        let Backend::Socket { outgoing } = &self.backend else {
+            return Ok(());
+        };
+        let (ack, written) = oneshot::channel();
+        let close = Outgoing::Close {
+            frame: Some(CloseFrame {
+                code: CloseCode::Normal,
+                reason: "".into(),
+            }),
+            ack: Some(ack),
+        };
+        if outgoing.send(close).is_err() {
+            return Ok(());
+        }
+        match tokio::time::timeout(CLOSE_TIMEOUT, written).await {
+            Ok(Ok(Err(message))) => Err(ClientError::Transport(message)),
+            _ => Ok(()),
+        }
+    }
+
+    /// A typed call of this connection's plane, with the connection's
+    /// default deadline unless `timeout` overrides it.
+    pub(crate) async fn call<M: RequestMethod>(
+        &self,
+        params: &M::Params,
+        timeout: Option<Duration>,
+    ) -> Result<M::Response, ClientError> {
+        if M::PLANE != self.plane {
+            return Err(ClientError::Encode(format!(
+                "{} is a {} method; this client serves the {} plane",
+                M::NAME,
+                M::PLANE,
+                self.plane
+            )));
+        }
+        let response = self
+            .request(
+                M::NAME,
+                params_value(params)?,
+                timeout.or(self.request_timeout),
+            )
+            .await?;
+        decode(response)
+    }
+
+    /// Run `initialize`: a `versionMismatch` answer, a response naming
+    /// another plane or another `protocolVersion` fail with the typed
+    /// handshake errors before the response is decoded strictly.
+    pub(crate) async fn initialize<P: Serialize, R: DeserializeOwned>(
+        &self,
+        method: &str,
+        params: &P,
+        local_version: u32,
+        timeout: Duration,
+    ) -> Result<R, ClientError> {
+        let response = self
+            .request(method, params_value(params)?, Some(timeout))
+            .await?;
+        let id = response.id.clone();
+        let value = match response.result {
+            Ok(value) => value,
+            Err(error) => {
+                return Err(match error.data {
+                    ErrorData::VersionMismatch { expected, .. } => ClientError::VersionMismatch {
+                        plane: self.plane,
+                        local: local_version,
+                        remote: expected,
+                    },
+                    _ => ClientError::Protocol(error),
+                });
+            }
+        };
+        if let Some(actual) = value
+            .get("plane")
+            .and_then(|plane| serde_json::from_value::<Plane>(plane.clone()).ok())
+            && actual != self.plane
+        {
+            return Err(ClientError::WrongPlane {
+                expected: self.plane,
+                actual,
+            });
+        }
+        if let Some(remote) = value.get("protocolVersion").and_then(Value::as_u64)
+            && remote != u64::from(local_version)
+        {
+            return Err(ClientError::VersionMismatch {
+                plane: self.plane,
+                local: local_version,
+                remote: u32::try_from(remote).unwrap_or(u32::MAX),
+            });
+        }
+        decode(Response {
+            id,
+            result: Ok(value),
+        })
+    }
+
+    /// Send one request and wait for its response, at most `timeout`.
+    pub(crate) async fn request(
+        &self,
+        method: &str,
+        params: Value,
+        timeout: Option<Duration>,
+    ) -> Reply {
+        let started = Instant::now();
+        if let Some(error) = self.shared.terminated() {
+            return Err(error);
+        }
+        let id = self.next_id.fetch_add(1, Ordering::Relaxed);
+        let request = Request {
+            id: Id::Number(id),
+            method: method.to_owned(),
+            params,
+        };
+        let text = request.to_text();
+        check_size(&text)?;
+        match &self.backend {
+            Backend::Socket { outgoing } => {
+                let mut receiver = self.shared.register(id)?;
+                let _pending = PendingCall {
+                    shared: &self.shared,
+                    outgoing,
+                    id,
+                    cancel: self.plane == Plane::Data
+                        && manifest::find(Plane::Data, method).is_some_and(|spec| spec.abortable),
+                };
+                if outgoing.send(Outgoing::Text(text)).is_err() {
+                    return Err(self.ended());
+                }
+                match timeout {
+                    None => receiver.await.unwrap_or_else(|_| Err(self.ended())),
+                    Some(timeout) => match tokio::time::timeout(timeout, &mut receiver).await {
+                        Ok(reply) => reply.unwrap_or_else(|_| Err(self.ended())),
+                        // A response that raced the deadline still counts.
+                        Err(_) => receiver.try_recv().unwrap_or_else(|_| {
+                            Err(ClientError::DeadlineExceeded {
+                                elapsed_ms: elapsed_ms(started),
+                            })
+                        }),
+                    },
+                }
+            }
+            Backend::InProcess { handler } => {
+                let call = handler(request);
+                let response = match timeout {
+                    None => call.await?,
+                    Some(timeout) => {
+                        tokio::time::timeout(timeout, call).await.map_err(|_| {
+                            ClientError::DeadlineExceeded {
+                                elapsed_ms: elapsed_ms(started),
+                            }
+                        })??
+                    }
+                };
+                // The response crosses the same encoding a socket would
+                // apply, the server's message limit included.
+                match jsonrpc::parse(&response.to_text()) {
+                    Ok(RpcMessage::Response(response)) if response.id == Some(Id::Number(id)) => {
+                        Ok(response)
+                    }
+                    Ok(_) | Err(_) => Err(ClientError::InvalidMessage(format!(
+                        "the in-process handler did not answer request {id}"
+                    ))),
+                }
+            }
+        }
+    }
+
+    fn ended(&self) -> ClientError {
+        self.shared.terminated().unwrap_or(ClientError::Closed {
+            code: None,
+            reason: None,
+        })
+    }
+}
+
+/// A registered call. Dropping it (the call finished, ran past its
+/// deadline, or its future was dropped) removes the entry; an entry that
+/// was still unanswered gets `$/cancelRequest` when the method is
+/// abortable.
+struct PendingCall<'a> {
+    shared: &'a Shared,
+    outgoing: &'a mpsc::UnboundedSender<Outgoing>,
+    id: i64,
+    cancel: bool,
+}
+
+impl Drop for PendingCall<'_> {
+    fn drop(&mut self) {
+        if !self.shared.forget(self.id) || !self.cancel || self.shared.terminated().is_some() {
+            return;
+        }
+        if let Ok(notification) = Notification::new(
+            CancelRequest::NAME,
+            &CancelRequestParams {
+                id: Id::Number(self.id),
+            },
+        ) {
+            let _ = self.outgoing.send(Outgoing::Text(notification.to_text()));
+        }
+    }
+}
+
+fn elapsed_ms(started: Instant) -> u64 {
+    u64::try_from(started.elapsed().as_millis()).unwrap_or(u64::MAX)
+}
+
+fn check_size(text: &str) -> Result<(), ClientError> {
+    let actual_bytes = text.len() as u64;
+    if actual_bytes > MAX_MESSAGE_BYTES {
+        return Err(ClientError::PayloadTooLarge {
+            limit_bytes: MAX_MESSAGE_BYTES,
+            actual_bytes,
+        });
+    }
+    Ok(())
+}
+
+fn params_value<P: Serialize>(params: &P) -> Result<Value, ClientError> {
+    match serde_json::to_value(params) {
+        Ok(value @ Value::Object(_)) => Ok(value),
+        Ok(_) => Err(ClientError::Encode(
+            "params must encode as a JSON object".to_owned(),
+        )),
+        Err(error) => Err(ClientError::Encode(error.to_string())),
+    }
+}
+
+fn decode<T: DeserializeOwned>(response: Response) -> Result<T, ClientError> {
+    response.decode().map_err(|error| match error {
+        jsonrpc::ResponseError::Failed(error) => ClientError::Protocol(error),
+        jsonrpc::ResponseError::Undecodable(message) => ClientError::Decode(message),
+    })
+}
+
+async fn write_loop<S>(
+    mut sink: SplitSink<WebSocketStream<S>, Message>,
+    mut outgoing: mpsc::UnboundedReceiver<Outgoing>,
+    shared: Arc<Shared>,
+    keepalive: Duration,
+    // Dropped when the writer stops, which starts the reader's close grace.
+    _done: oneshot::Sender<()>,
+) where
+    S: AsyncRead + AsyncWrite + Unpin,
+{
+    let mut ticker = tokio::time::interval_at(Instant::now() + keepalive, keepalive);
+    ticker.set_missed_tick_behavior(MissedTickBehavior::Delay);
+    loop {
+        tokio::select! {
+            command = outgoing.recv() => match command {
+                Some(Outgoing::Text(text)) => {
+                    if let Err(error) = sink.send(Message::text(text)).await {
+                        shared.terminate(ClientError::Transport(error.to_string()));
+                        return;
+                    }
+                }
+                Some(Outgoing::Close { frame, ack }) => {
+                    let written = match frame {
+                        Some(frame) => sink
+                            .send(Message::Close(Some(frame)))
+                            .await
+                            .map_err(|error| error.to_string()),
+                        None => Ok(()),
+                    };
+                    if let Some(ack) = ack {
+                        let _ = ack.send(written);
+                    }
+                    return;
+                }
+                // Every client handle is gone.
+                None => {
+                    let _ = sink
+                        .send(Message::Close(Some(CloseFrame {
+                            code: CloseCode::Normal,
+                            reason: "".into(),
+                        })))
+                        .await;
+                    return;
+                }
+            },
+            _ = ticker.tick() => {
+                if shared.has_pending()
+                    && let Err(error) = sink.send(Message::Ping(Default::default())).await
+                {
+                    shared.terminate(ClientError::Transport(error.to_string()));
+                    return;
+                }
+            }
+        }
+    }
+}
+
+async fn read_loop<S>(
+    mut stream: SplitStream<WebSocketStream<S>>,
+    shared: Arc<Shared>,
+    outgoing: mpsc::WeakUnboundedSender<Outgoing>,
+    mut writer_stopped: oneshot::Receiver<()>,
+) where
+    S: AsyncRead + AsyncWrite + Unpin,
+{
+    let mut grace_until: Option<Instant> = None;
+    let violation = loop {
+        let frame = tokio::select! {
+            frame = stream.next() => frame,
+            _ = &mut writer_stopped, if grace_until.is_none() => {
+                grace_until = Some(Instant::now() + CLOSE_GRACE);
+                continue;
+            }
+            _ = tokio::time::sleep_until(grace_until.unwrap_or_else(Instant::now)),
+                if grace_until.is_some() => break None,
+        };
+        match frame {
+            None => break None,
+            Some(Err(tungstenite::Error::ConnectionClosed | tungstenite::Error::AlreadyClosed)) => {
+                break None;
+            }
+            Some(Err(tungstenite::Error::Capacity(error))) => {
+                break Some((
+                    CloseCode::Size,
+                    format!("frame over the {MAX_MESSAGE_BYTES}-byte message limit: {error}"),
+                ));
+            }
+            Some(Err(error)) => {
+                shared.terminate(ClientError::Transport(error.to_string()));
+                break None;
+            }
+            Some(Ok(Message::Text(text))) => match jsonrpc::parse(&text) {
+                Ok(RpcMessage::Response(response)) => match &response.id {
+                    Some(Id::Number(id)) => shared.resolve(*id, response),
+                    // This client never sends string ids: nothing waits.
+                    Some(Id::String(_)) => {}
+                    None => {
+                        let error = response
+                            .result
+                            .err()
+                            .map(|error| error.to_string())
+                            .unwrap_or_default();
+                        break Some((
+                            CloseCode::Protocol,
+                            format!("the server answered with a null id: {error}"),
+                        ));
+                    }
+                },
+                Ok(RpcMessage::Request(request)) => {
+                    break Some((
+                        CloseCode::Protocol,
+                        format!("the server sent a request ({})", request.method),
+                    ));
+                }
+                Ok(RpcMessage::Notification(notification)) => {
+                    break Some((
+                        CloseCode::Protocol,
+                        format!("the server sent a notification ({})", notification.method),
+                    ));
+                }
+                Err(rejection) => {
+                    break Some((
+                        CloseCode::Protocol,
+                        format!("unacceptable frame: {}", rejection.error),
+                    ));
+                }
+            },
+            Some(Ok(Message::Binary(_))) => {
+                break Some((
+                    CloseCode::Protocol,
+                    "binary frames are not part of the protocol".to_owned(),
+                ));
+            }
+            Some(Ok(Message::Close(frame))) => {
+                // Keep reading: the next read flushes the close reply and
+                // then ends the stream.
+                shared.terminate(ClientError::Closed {
+                    code: frame.as_ref().map(|frame| u16::from(frame.code)),
+                    reason: frame
+                        .map(|frame| frame.reason.to_string())
+                        .filter(|reason| !reason.is_empty()),
+                });
+            }
+            Some(Ok(Message::Ping(_) | Message::Pong(_) | Message::Frame(_))) => {}
+        }
+    };
+    let frame = match violation {
+        Some((code, message)) => {
+            shared.terminate(ClientError::InvalidMessage(message.clone()));
+            let mut reason = message;
+            truncate_reason(&mut reason);
+            Some(CloseFrame {
+                code,
+                reason: reason.into(),
+            })
+        }
+        None => {
+            shared.terminate(ClientError::Closed {
+                code: None,
+                reason: None,
+            });
+            None
+        }
+    };
+    if let Some(outgoing) = outgoing.upgrade() {
+        let _ = outgoing.send(Outgoing::Close { frame, ack: None });
+    }
+}
+
+/// A close reason fits in a control frame: at most 123 bytes.
+fn truncate_reason(reason: &mut String) {
+    const MAX: usize = 123;
+    if reason.len() > MAX {
+        let mut end = MAX;
+        while !reason.is_char_boundary(end) {
+            end -= 1;
+        }
+        reason.truncate(end);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use environment_protocol::{
+        data::idle::{GetIdleParams, GetIdleResponse},
+        error::ProtocolError,
+        manifest::{EnvGetIdle, TargetGet},
+    };
+
+    use super::*;
+
+    fn idle_handler(response: Value) -> InProcessHandler {
+        Arc::new(move |request: Request| {
+            let response = response.clone();
+            Box::pin(async move { Ok(Response::success(request.id, &response)) })
+        })
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn in_process_calls_decode_strictly() {
+        let connection = Connection::in_process(
+            Plane::Data,
+            idle_handler(serde_json::json!({"idleForMs": 5})),
+        );
+        let idle = connection
+            .call::<EnvGetIdle>(&GetIdleParams {}, None)
+            .await
+            .unwrap();
+        assert_eq!(
+            idle,
+            GetIdleResponse {
+                idle_for_ms: 5,
+                ..GetIdleResponse::default()
+            }
+        );
+        let broken = Connection::in_process(
+            Plane::Data,
+            idle_handler(serde_json::json!({"idleForMs": "soon"})),
+        );
+        assert!(matches!(
+            broken.call::<EnvGetIdle>(&GetIdleParams {}, None).await,
+            Err(ClientError::Decode(_))
+        ));
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn server_errors_keep_their_kind() {
+        let connection = Connection::in_process(
+            Plane::Data,
+            Arc::new(|request: Request| {
+                Box::pin(async move {
+                    Ok(Response::failure(
+                        Some(request.id),
+                        ProtocolError::not_initialized(),
+                    ))
+                })
+            }),
+        );
+        let error = connection
+            .call::<EnvGetIdle>(&GetIdleParams {}, None)
+            .await
+            .unwrap_err();
+        assert_eq!(
+            error.protocol_kind(),
+            Some(environment_protocol::error::ProtocolErrorKind::NotInitialized)
+        );
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn methods_of_another_plane_are_refused_before_sending() {
+        let connection = Connection::in_process(Plane::Data, idle_handler(serde_json::json!({})));
+        let params = serde_json::from_value(serde_json::json!({
+            "target": {"owner": {
+                "universeId": "u", "bindingId": "b",
+                "environmentId": "e", "incarnationId": "i"
+            }}
+        }))
+        .unwrap();
+        assert!(matches!(
+            connection.call::<TargetGet>(&params, None).await,
+            Err(ClientError::Encode(_))
+        ));
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn closed_connections_refuse_calls() {
+        let connection = Connection::in_process(
+            Plane::Data,
+            idle_handler(serde_json::json!({"idleForMs": 0})),
+        );
+        connection.close().await.unwrap();
+        assert!(connection.is_closed());
+        assert!(matches!(
+            connection.call::<EnvGetIdle>(&GetIdleParams {}, None).await,
+            Err(ClientError::Closed {
+                code: Some(1000),
+                ..
+            })
+        ));
+    }
+
+    #[test]
+    fn oversized_requests_are_refused_with_their_size() {
+        let text = "x".repeat(MAX_MESSAGE_BYTES as usize + 1);
+        assert!(matches!(
+            check_size(&text),
+            Err(ClientError::PayloadTooLarge { limit_bytes: MAX_MESSAGE_BYTES, actual_bytes })
+                if actual_bytes == MAX_MESSAGE_BYTES + 1
+        ));
+    }
+}
diff --git a/crates/environment-client/src/control.rs b/crates/environment-client/src/control.rs
deleted file mode 100644
index 94f39013e..000000000
--- a/crates/environment-client/src/control.rs
+++ /dev/null
@@ -1,132 +0,0 @@
-//! Typed controller-plane client methods.
-
-use environment_protocol::control::{
-    handshake::{ControllerInitializeParams, ControllerInitializeResponse},
-    ingress::{EnsureIngressParams, IngressResponse, RemoveIngressParams},
-    methods::{
-        ADOPT_TARGET_METHOD, CLOSE_TARGET_METHOD, CREATE_TARGET_METHOD, ENSURE_INGRESS_METHOD,
-        GET_TARGET_METHOD, INITIALIZE_METHOD, LIST_TARGETS_METHOD, LIST_TEMPLATES_METHOD,
-        REMOVE_INGRESS_METHOD, SET_TARGET_POWER_METHOD,
-    },
-    targets::{
-        AdoptTargetParams, AdoptTargetResponse, CloseTargetParams, CloseTargetResponse,
-        CreateTargetParams, CreateTargetResponse, GetTargetParams, GetTargetResponse,
-        ListTargetsParams, ListTargetsResponse, ListTemplatesParams, ListTemplatesResponse,
-        SetTargetPowerParams, SetTargetPowerResponse,
-    },
-};
-
-use crate::{
-    error::EnvironmentClientResult,
-    rpc::{JsonRpcClient, JsonRpcTransport},
-    transport::{WebSocketConnectOptions, WebSocketTransport},
-};
-
-pub struct EnvironmentProviderClient<T> {
-    rpc: JsonRpcClient<T>,
-}
-
-impl<T> EnvironmentProviderClient<T>
-where
-    T: JsonRpcTransport,
-{
-    pub fn new(transport: T) -> Self {
-        Self {
-            rpc: JsonRpcClient::new(transport),
-        }
-    }
-
-    pub fn from_rpc(rpc: JsonRpcClient<T>) -> Self {
-        Self { rpc }
-    }
-
-    pub fn into_rpc(self) -> JsonRpcClient<T> {
-        self.rpc
-    }
-
-    /// Gracefully close the underlying transport.
-    pub async fn close(&mut self) -> EnvironmentClientResult<()> {
-        self.rpc.close().await
-    }
-
-    pub async fn initialize(
-        &mut self,
-        params: &ControllerInitializeParams,
-    ) -> EnvironmentClientResult<ControllerInitializeResponse> {
-        self.rpc.request(INITIALIZE_METHOD, params).await
-    }
-
-    pub async fn list_targets(
-        &mut self,
-        params: &ListTargetsParams,
-    ) -> EnvironmentClientResult<ListTargetsResponse> {
-        self.rpc.request(LIST_TARGETS_METHOD, params).await
-    }
-
-    pub async fn list_templates(
-        &mut self,
-        params: &ListTemplatesParams,
-    ) -> EnvironmentClientResult<ListTemplatesResponse> {
-        self.rpc.request(LIST_TEMPLATES_METHOD, params).await
-    }
-
-    pub async fn create_target(
-        &mut self,
-        params: &CreateTargetParams,
-    ) -> EnvironmentClientResult<CreateTargetResponse> {
-        self.rpc.request(CREATE_TARGET_METHOD, params).await
-    }
-
-    pub async fn adopt_target(
-        &mut self,
-        params: &AdoptTargetParams,
-    ) -> EnvironmentClientResult<AdoptTargetResponse> {
-        self.rpc.request(ADOPT_TARGET_METHOD, params).await
-    }
-
-    pub async fn get_target(
-        &mut self,
-        params: &GetTargetParams,
-    ) -> EnvironmentClientResult<GetTargetResponse> {
-        self.rpc.request(GET_TARGET_METHOD, params).await
-    }
-
-    pub async fn close_target(
-        &mut self,
-        params: &CloseTargetParams,
-    ) -> EnvironmentClientResult<CloseTargetResponse> {
-        self.rpc.request(CLOSE_TARGET_METHOD, params).await
-    }
-
-    pub async fn set_target_power(
-        &mut self,
-        params: &SetTargetPowerParams,
-    ) -> EnvironmentClientResult<SetTargetPowerResponse> {
-        self.rpc.request(SET_TARGET_POWER_METHOD, params).await
-    }
-
-    pub async fn ensure_ingress(
-        &mut self,
-        params: &EnsureIngressParams,
-    ) -> EnvironmentClientResult<IngressResponse> {
-        self.rpc.request(ENSURE_INGRESS_METHOD, params).await
-    }
-
-    pub async fn remove_ingress(
-        &mut self,
-        params: &RemoveIngressParams,
-    ) -> EnvironmentClientResult<IngressResponse> {
-        self.rpc.request(REMOVE_INGRESS_METHOD, params).await
-    }
-}
-
-impl EnvironmentProviderClient<WebSocketTransport> {
-    pub async fn connect(
-        endpoint: &str,
-        options: WebSocketConnectOptions,
-    ) -> EnvironmentClientResult<Self> {
-        Ok(Self::new(
-            WebSocketTransport::connect(endpoint, options).await?,
-        ))
-    }
-}
diff --git a/crates/environment-client/src/controller.rs b/crates/environment-client/src/controller.rs
new file mode 100644
index 000000000..4a0b577c2
--- /dev/null
+++ b/crates/environment-client/src/controller.rs
@@ -0,0 +1,169 @@
+//! The controller-plane client: the runtime's connection to one provider
+//! controller.
+
+use std::{sync::Arc, time::Duration};
+
+use environment_protocol::{
+    CONTROLLER_PROTOCOL_VERSION,
+    control::handshake::{ControllerInitializeParams, ControllerInitializeResponse},
+    handshake::Plane,
+    jsonrpc::{Request, Response},
+    manifest::{
+        ControllerInitialize, IngressEnsure, IngressRemove, RequestMethod, TargetAdopt,
+        TargetClose, TargetCreate, TargetGet, TargetSetPower, TemplateList,
+    },
+};
+use futures_util::future::BoxFuture;
+
+use crate::{
+    connection::{Connection, InProcessHandler},
+    data::typed_calls,
+    error::ClientError,
+    options::ConnectOptions,
+};
+
+/// A controller-plane connection after a successful `initialize`.
+///
+/// Same shape as [`DataClient`](crate::DataClient): cheap to clone, calls
+/// take `&self` and may run concurrently, a dropped call is abandoned. The
+/// controller plane has no `$/cancelRequest`; a mutation abandoned by its
+/// caller still runs to completion on the provider.
+#[derive(Clone)]
+pub struct ControllerClient {
+    inner: Arc<Inner>,
+}
+
+struct Inner {
+    connection: Connection,
+    initialize: ControllerInitializeResponse,
+}
+
+impl ControllerClient {
+    /// Dial the controller URL and run `initialize` with
+    /// [`CONTROLLER_PROTOCOL_VERSION`]. Pass the provider credential as
+    /// [`ConnectOptions::bearer_token`]. Fails with
+    /// [`ClientError::VersionMismatch`] or [`ClientError::WrongPlane`]
+    /// before the connection is used. The caller still checks
+    /// `routes.data` against the controller URL
+    /// (`DataRouteBase::check_for_controller`).
+    pub async fn connect_initialized(
+        endpoint: &str,
+        options: ConnectOptions,
+    ) -> Result<(Self, ControllerInitializeResponse), ClientError> {
+        let connection = Connection::connect(endpoint, &options, Plane::Controller).await?;
+        let initialized = initialize(&connection, &options).await;
+        match initialized {
+            Ok(initialize) => Ok((
+                Self {
+                    inner: Arc::new(Inner {
+                        connection,
+                        initialize: initialize.clone(),
+                    }),
+                },
+                initialize,
+            )),
+            Err(error) => {
+                let _ = connection.close().await;
+                Err(error)
+            }
+        }
+    }
+
+    /// A client whose requests `handler` answers in process, for tests that
+    /// need no socket (see [`DataClient::in_process`](crate::DataClient::in_process)).
+    pub fn in_process(
+        initialize: ControllerInitializeResponse,
+        handler: impl Fn(Request) -> BoxFuture<'static, Result<Response, ClientError>>
+        + Send
+        + Sync
+        + 'static,
+    ) -> Self {
+        let handler: InProcessHandler = Arc::new(handler);
+        Self {
+            inner: Arc::new(Inner {
+                connection: Connection::in_process(Plane::Controller, handler),
+                initialize,
+            }),
+        }
+    }
+
+    /// The controller's `initialize` response: capabilities and routes.
+    pub fn initialize_response(&self) -> &ControllerInitializeResponse {
+        &self.inner.initialize
+    }
+
+    /// Call any controller-plane method, with the connection's default
+    /// deadline ([`ConnectOptions::request_timeout`]).
+    pub async fn call<M: RequestMethod>(
+        &self,
+        params: &M::Params,
+    ) -> Result<M::Response, ClientError> {
+        self.inner.connection.call::<M>(params, None).await
+    }
+
+    /// [`call`](Self::call) with this deadline instead of the default one.
+    pub async fn call_with_timeout<M: RequestMethod>(
+        &self,
+        params: &M::Params,
+        timeout: Duration,
+    ) -> Result<M::Response, ClientError> {
+        self.inner.connection.call::<M>(params, Some(timeout)).await
+    }
+
+    /// Close the connection for every clone. Idempotent.
+    pub async fn close(&self) -> Result<(), ClientError> {
+        self.inner.connection.close().await
+    }
+
+    /// True once the connection ended, by either side.
+    pub fn is_closed(&self) -> bool {
+        self.inner.connection.is_closed()
+    }
+
+    typed_calls! {
+        /// `template/list`.
+        list_templates => TemplateList;
+        /// `target/create`.
+        create_target => TargetCreate;
+        /// `target/adopt`.
+        adopt_target => TargetAdopt;
+        /// `target/get`.
+        get_target => TargetGet;
+        /// `target/setPower`.
+        set_target_power => TargetSetPower;
+        /// `target/close`.
+        close_target => TargetClose;
+        /// `ingress/ensure`.
+        ensure_ingress => IngressEnsure;
+        /// `ingress/remove`.
+        remove_ingress => IngressRemove;
+    }
+}
+
+impl std::fmt::Debug for ControllerClient {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("ControllerClient")
+            .field("server_info", &self.inner.initialize.server_info)
+            .field("closed", &self.is_closed())
+            .finish_non_exhaustive()
+    }
+}
+
+/// Run the controller `initialize` on a dialed connection.
+pub(crate) async fn initialize(
+    connection: &Connection,
+    options: &ConnectOptions,
+) -> Result<ControllerInitializeResponse, ClientError> {
+    connection
+        .initialize(
+            ControllerInitialize::NAME,
+            &ControllerInitializeParams {
+                protocol_version: CONTROLLER_PROTOCOL_VERSION,
+                client_info: options.client_info.clone(),
+            },
+            CONTROLLER_PROTOCOL_VERSION,
+            options.initialize_timeout,
+        )
+        .await
+}
diff --git a/crates/environment-client/src/data.rs b/crates/environment-client/src/data.rs
index ffdd96a6a..f13d82286 100644
--- a/crates/environment-client/src/data.rs
+++ b/crates/environment-client/src/data.rs
@@ -1,257 +1,255 @@
-//! Typed data-plane client methods.
-
-use environment_protocol::data::methods::{FS_CAPTURE_METHOD, FS_MATERIALIZE_METHOD};
-use environment_protocol::data::transfer::*;
-use environment_protocol::data::{
-    fs::{
-        CopyParams, CopyResponse, CreateDirectoryParams, CreateDirectoryResponse,
-        GetMetadataParams, GetMetadataResponse, GlobFilesParams, GlobFilesResponse,
-        ReadDirectoryParams, ReadDirectoryResponse, ReadFileParams, ReadFileResponse, RemoveParams,
-        RemoveResponse, SearchTextParams, SearchTextResponse, WriteFileParams, WriteFileResponse,
-    },
-    handshake::{InitializeParams, InitializeResponse, InitializedParams},
-    idle::{IdleParams, IdleResponse},
-    jobs::{
-        CancelJobsParams, CancelJobsResponse, ListJobsParams, ListJobsResponse, ReadJobsParams,
-        ReadJobsResponse, StartJobsParams, StartJobsResponse,
-    },
-    methods::{
-        ENV_IDLE_METHOD, FS_COPY_METHOD, FS_CREATE_DIRECTORY_METHOD, FS_GET_METADATA_METHOD,
-        FS_GLOB_FILES_METHOD, FS_READ_DIRECTORY_METHOD, FS_READ_FILE_METHOD, FS_REMOVE_METHOD,
-        FS_SEARCH_TEXT_METHOD, FS_WRITE_FILE_METHOD, INITIALIZE_METHOD, INITIALIZED_METHOD,
-        JOB_CANCEL_METHOD, JOB_LIST_METHOD, JOB_READ_METHOD, JOB_START_METHOD, PROCESS_READ_METHOD,
-        PROCESS_RESIZE_METHOD, PROCESS_START_METHOD, PROCESS_TERMINATE_METHOD,
-        PROCESS_WRITE_METHOD,
-    },
-    process::{
-        ReadProcessParams, ReadProcessResponse, ResizeProcessParams, ResizeProcessResponse,
-        StartProcessParams, StartProcessResponse, TerminateProcessParams, TerminateProcessResponse,
-        WriteProcessParams, WriteProcessResponse,
+//! The data-plane client: the runtime's connection to one envd.
+
+use std::{sync::Arc, time::Duration};
+
+use environment_protocol::{
+    ENVD_PROTOCOL_VERSION,
+    data::handshake::{InitializeParams, InitializeResponse},
+    handshake::Plane,
+    jsonrpc::{Request, Response},
+    manifest::{
+        DataInitialize, EnvGetIdle, FsCreateDirectory, FsGetMetadata, FsGlobFiles, FsReadDirectory,
+        FsReadFile, FsRemove, FsRename, FsScan, FsSearchText, FsWriteFile, JobCancel, JobRead,
+        JobStart, ProcessRead, ProcessStart, ProcessTerminate, ProcessWrite, RequestMethod,
+        TransferAbort, TransferAdvance, TransferAppend, TransferBegin, TransferCommit,
+        TransferGetStatus, TransferListMissing, TransferRead, TransferReadInventory, TransferWrite,
     },
 };
+use futures_util::future::BoxFuture;
+use tokio::io::{AsyncRead, AsyncWrite};
 
 use crate::{
-    error::EnvironmentClientResult,
-    rpc::{JsonRpcClient, JsonRpcNotification, JsonRpcTransport},
-    transport::{WebSocketConnectOptions, WebSocketTransport},
+    connection::{Connection, InProcessHandler},
+    error::ClientError,
+    options::ConnectOptions,
 };
 
-pub struct EnvironmentDataClient<T> {
-    rpc: JsonRpcClient<T>,
+/// Typed sugar: one method per manifest entry, each a [`call`] of its
+/// marker.
+///
+/// [`call`]: DataClient::call
+macro_rules! typed_calls {
+    ($( $(#[$doc:meta])* $name:ident => $marker:ident; )+) => {
+        $(
+            $(#[$doc])*
+            pub async fn $name(
+                &self,
+                params: &<$marker as RequestMethod>::Params,
+            ) -> Result<<$marker as RequestMethod>::Response, ClientError> {
+                self.call::<$marker>(params).await
+            }
+        )+
+    };
+}
+pub(crate) use typed_calls;
+
+/// A data-plane connection after a successful `initialize`.
+///
+/// Cheap to clone; clones share one socket. Calls take `&self`, may run
+/// concurrently and are answered in any order. Dropping a call's future
+/// abandons it (an abortable one is sent `$/cancelRequest`). The socket
+/// closes when [`close`](Self::close) is called or the last clone is
+/// dropped.
+#[derive(Clone)]
+pub struct DataClient {
+    inner: Arc<Inner>,
 }
 
-impl<T> EnvironmentDataClient<T>
-where
-    T: JsonRpcTransport,
-{
-    pub fn new(transport: T) -> Self {
+struct Inner {
+    connection: Connection,
+    initialize: InitializeResponse,
+}
+
+impl DataClient {
+    /// Dial `endpoint` (`ws://`, `wss://` or `unix:///path`) and run
+    /// `initialize` with [`ENVD_PROTOCOL_VERSION`]. Fails with
+    /// [`ClientError::VersionMismatch`] or [`ClientError::WrongPlane`]
+    /// before the connection is used; sends nothing else.
+    pub async fn connect_initialized(
+        endpoint: &str,
+        options: ConnectOptions,
+    ) -> Result<(Self, InitializeResponse), ClientError> {
+        let connection = Connection::connect(endpoint, &options, Plane::Data).await?;
+        Self::initialize(connection, &options).await
+    }
+
+    /// [`connect_initialized`](Self::connect_initialized) over a byte
+    /// stream that is already connected to a data server, such as one end
+    /// of [`tokio::io::duplex`] or an accepted Unix socket. The upgrade
+    /// targets `/` with `Host: localhost`.
+    pub async fn connect_initialized_over<S>(
+        stream: S,
+        options: ConnectOptions,
+    ) -> Result<(Self, InitializeResponse), ClientError>
+    where
+        S: AsyncRead + AsyncWrite + Unpin + Send + 'static,
+    {
+        let connection = Connection::connect_over(stream, &options, Plane::Data).await?;
+        Self::initialize(connection, &options).await
+    }
+
+    /// A client whose requests `handler` answers in process, for tests that
+    /// need no socket. `initialize` is what
+    /// [`initialize_response`](Self::initialize_response) reports; the
+    /// handler sees every later request, with the id this client chose.
+    /// Requests and responses pass the same size limit and strict decoding
+    /// as on a socket; calls have no default deadline. A handler `Err` fails
+    /// that one call with the error, a stand-in for a lost response.
+    pub fn in_process(
+        initialize: InitializeResponse,
+        handler: impl Fn(Request) -> BoxFuture<'static, Result<Response, ClientError>>
+        + Send
+        + Sync
+        + 'static,
+    ) -> Self {
+        let handler: InProcessHandler = Arc::new(handler);
         Self {
-            rpc: JsonRpcClient::new(transport),
+            inner: Arc::new(Inner {
+                connection: Connection::in_process(Plane::Data, handler),
+                initialize,
+            }),
         }
     }
 
-    pub fn from_rpc(rpc: JsonRpcClient<T>) -> Self {
-        Self { rpc }
-    }
-
-    pub fn into_rpc(self) -> JsonRpcClient<T> {
-        self.rpc
-    }
-
-    /// Gracefully close the underlying transport.
-    pub async fn close(&mut self) -> EnvironmentClientResult<()> {
-        self.rpc.close().await
-    }
-
-    pub async fn initialize(
-        &mut self,
-        params: &InitializeParams,
-    ) -> EnvironmentClientResult<InitializeResponse> {
-        self.rpc.request(INITIALIZE_METHOD, params).await
-    }
-
-    pub async fn initialized(&mut self, params: &InitializedParams) -> EnvironmentClientResult<()> {
-        self.rpc.notify(INITIALIZED_METHOD, params).await
-    }
-
-    pub async fn scan(
-        &mut self,
-        params: &environment_protocol::data::inventory::ScanParams,
-    ) -> EnvironmentClientResult<environment_protocol::data::inventory::ScanResponse> {
-        self.rpc
-            .request(environment_protocol::data::methods::FS_SCAN_METHOD, params)
-            .await
-    }
-
-    pub async fn transfer(
-        &mut self,
-        params: &environment_protocol::data::transfer_session::TransferRequest,
-    ) -> EnvironmentClientResult<environment_protocol::data::transfer_session::TransferResponse>
-    {
-        self.rpc
-            .request(
-                environment_protocol::data::methods::FS_TRANSFER_METHOD,
-                params,
+    async fn initialize(
+        connection: Connection,
+        options: &ConnectOptions,
+    ) -> Result<(Self, InitializeResponse), ClientError> {
+        let params = InitializeParams {
+            protocol_version: ENVD_PROTOCOL_VERSION,
+            client_info: options.client_info.clone(),
+        };
+        let initialized = connection
+            .initialize::<_, InitializeResponse>(
+                DataInitialize::NAME,
+                &params,
+                ENVD_PROTOCOL_VERSION,
+                options.initialize_timeout,
             )
-            .await
-    }
-
-    pub async fn capture(
-        &mut self,
-        params: &CaptureParams,
-    ) -> EnvironmentClientResult<CaptureResponse> {
-        self.rpc.request(FS_CAPTURE_METHOD, params).await
-    }
-
-    pub async fn materialize(
-        &mut self,
-        params: &MaterializeParams,
-    ) -> EnvironmentClientResult<MaterializeResponse> {
-        self.rpc.request(FS_MATERIALIZE_METHOD, params).await
-    }
-
-    pub async fn read_file(
-        &mut self,
-        params: &ReadFileParams,
-    ) -> EnvironmentClientResult<ReadFileResponse> {
-        self.rpc.request(FS_READ_FILE_METHOD, params).await
-    }
-
-    pub async fn write_file(
-        &mut self,
-        params: &WriteFileParams,
-    ) -> EnvironmentClientResult<WriteFileResponse> {
-        self.rpc.request(FS_WRITE_FILE_METHOD, params).await
-    }
-
-    pub async fn create_directory(
-        &mut self,
-        params: &CreateDirectoryParams,
-    ) -> EnvironmentClientResult<CreateDirectoryResponse> {
-        self.rpc.request(FS_CREATE_DIRECTORY_METHOD, params).await
-    }
-
-    pub async fn get_metadata(
-        &mut self,
-        params: &GetMetadataParams,
-    ) -> EnvironmentClientResult<GetMetadataResponse> {
-        self.rpc.request(FS_GET_METADATA_METHOD, params).await
-    }
-
-    pub async fn read_directory(
-        &mut self,
-        params: &ReadDirectoryParams,
-    ) -> EnvironmentClientResult<ReadDirectoryResponse> {
-        self.rpc.request(FS_READ_DIRECTORY_METHOD, params).await
-    }
-
-    pub async fn remove(
-        &mut self,
-        params: &RemoveParams,
-    ) -> EnvironmentClientResult<RemoveResponse> {
-        self.rpc.request(FS_REMOVE_METHOD, params).await
-    }
-
-    pub async fn copy(&mut self, params: &CopyParams) -> EnvironmentClientResult<CopyResponse> {
-        self.rpc.request(FS_COPY_METHOD, params).await
-    }
-
-    pub async fn search_text(
-        &mut self,
-        params: &SearchTextParams,
-    ) -> EnvironmentClientResult<SearchTextResponse> {
-        self.rpc.request(FS_SEARCH_TEXT_METHOD, params).await
-    }
-
-    pub async fn glob_files(
-        &mut self,
-        params: &GlobFilesParams,
-    ) -> EnvironmentClientResult<GlobFilesResponse> {
-        self.rpc.request(FS_GLOB_FILES_METHOD, params).await
-    }
-
-    pub async fn start_process(
-        &mut self,
-        params: &StartProcessParams,
-    ) -> EnvironmentClientResult<StartProcessResponse> {
-        self.rpc.request(PROCESS_START_METHOD, params).await
-    }
-
-    pub async fn read_process(
-        &mut self,
-        params: &ReadProcessParams,
-    ) -> EnvironmentClientResult<ReadProcessResponse> {
-        self.rpc.request(PROCESS_READ_METHOD, params).await
-    }
-
-    pub async fn write_process(
-        &mut self,
-        params: &WriteProcessParams,
-    ) -> EnvironmentClientResult<WriteProcessResponse> {
-        self.rpc.request(PROCESS_WRITE_METHOD, params).await
-    }
-
-    pub async fn terminate_process(
-        &mut self,
-        params: &TerminateProcessParams,
-    ) -> EnvironmentClientResult<TerminateProcessResponse> {
-        self.rpc.request(PROCESS_TERMINATE_METHOD, params).await
-    }
-
-    pub async fn resize_process(
-        &mut self,
-        params: &ResizeProcessParams,
-    ) -> EnvironmentClientResult<ResizeProcessResponse> {
-        self.rpc.request(PROCESS_RESIZE_METHOD, params).await
-    }
-
-    pub async fn start_jobs(
-        &mut self,
-        params: &StartJobsParams,
-    ) -> EnvironmentClientResult<StartJobsResponse> {
-        self.rpc.request(JOB_START_METHOD, params).await
-    }
-
-    pub async fn list_jobs(
-        &mut self,
-        params: &ListJobsParams,
-    ) -> EnvironmentClientResult<ListJobsResponse> {
-        self.rpc.request(JOB_LIST_METHOD, params).await
-    }
-
-    pub async fn read_jobs(
-        &mut self,
-        params: &ReadJobsParams,
-    ) -> EnvironmentClientResult<ReadJobsResponse> {
-        self.rpc.request(JOB_READ_METHOD, params).await
-    }
-
-    pub async fn cancel_jobs(
-        &mut self,
-        params: &CancelJobsParams,
-    ) -> EnvironmentClientResult<CancelJobsResponse> {
-        self.rpc.request(JOB_CANCEL_METHOD, params).await
-    }
-
-    /// Daemon activity report for idle power policy. Not itself activity.
-    pub async fn idle(&mut self, params: &IdleParams) -> EnvironmentClientResult<IdleResponse> {
-        self.rpc.request(ENV_IDLE_METHOD, params).await
+            .await;
+        match initialized {
+            Ok(initialize) => Ok((
+                Self {
+                    inner: Arc::new(Inner {
+                        connection,
+                        initialize: initialize.clone(),
+                    }),
+                },
+                initialize,
+            )),
+            Err(error) => {
+                let _ = connection.close().await;
+                Err(error)
+            }
+        }
     }
 
-    pub async fn next_notification(
-        &mut self,
-    ) -> EnvironmentClientResult<Option<JsonRpcNotification>> {
-        self.rpc.next_notification().await
+    /// The daemon's `initialize` response: instance id, capabilities,
+    /// ceilings and default cwd.
+    pub fn initialize_response(&self) -> &InitializeResponse {
+        &self.inner.initialize
+    }
+
+    /// Call any data-plane method, with the connection's default deadline
+    /// ([`ConnectOptions::request_timeout`]).
+    pub async fn call<M: RequestMethod>(
+        &self,
+        params: &M::Params,
+    ) -> Result<M::Response, ClientError> {
+        self.inner.connection.call::<M>(params, None).await
+    }
+
+    /// [`call`](Self::call) with this deadline instead of the default one.
+    /// When it passes, an abortable method is sent `$/cancelRequest` and the
+    /// call fails with [`ClientError::DeadlineExceeded`].
+    pub async fn call_with_timeout<M: RequestMethod>(
+        &self,
+        params: &M::Params,
+        timeout: Duration,
+    ) -> Result<M::Response, ClientError> {
+        self.inner.connection.call::<M>(params, Some(timeout)).await
+    }
+
+    /// Close the connection for every clone: pending calls fail with
+    /// [`ClientError::Closed`]. Idempotent.
+    pub async fn close(&self) -> Result<(), ClientError> {
+        self.inner.connection.close().await
+    }
+
+    /// True once the connection ended, by either side.
+    pub fn is_closed(&self) -> bool {
+        self.inner.connection.is_closed()
+    }
+
+    typed_calls! {
+        /// `env/getIdle`.
+        get_idle => EnvGetIdle;
+        /// `fs/readFile`.
+        read_file => FsReadFile;
+        /// `fs/writeFile`.
+        write_file => FsWriteFile;
+        /// `fs/createDirectory`.
+        create_directory => FsCreateDirectory;
+        /// `fs/getMetadata`.
+        get_metadata => FsGetMetadata;
+        /// `fs/readDirectory`.
+        read_directory => FsReadDirectory;
+        /// `fs/remove`.
+        remove => FsRemove;
+        /// `fs/rename`.
+        rename => FsRename;
+        /// `fs/searchText`.
+        search_text => FsSearchText;
+        /// `fs/globFiles`.
+        glob_files => FsGlobFiles;
+        /// `fs/scan`.
+        scan => FsScan;
+        /// `transfer/begin`.
+        transfer_begin => TransferBegin;
+        /// `transfer/advance`.
+        transfer_advance => TransferAdvance;
+        /// `transfer/getStatus`.
+        transfer_get_status => TransferGetStatus;
+        /// `transfer/readInventory`.
+        transfer_read_inventory => TransferReadInventory;
+        /// `transfer/append`.
+        transfer_append => TransferAppend;
+        /// `transfer/listMissing`.
+        transfer_list_missing => TransferListMissing;
+        /// `transfer/read`.
+        transfer_read => TransferRead;
+        /// `transfer/write`.
+        transfer_write => TransferWrite;
+        /// `transfer/commit`.
+        transfer_commit => TransferCommit;
+        /// `transfer/abort`.
+        transfer_abort => TransferAbort;
+        /// `process/start`.
+        start_process => ProcessStart;
+        /// `process/read`.
+        read_process => ProcessRead;
+        /// `process/write`.
+        write_process => ProcessWrite;
+        /// `process/terminate`.
+        terminate_process => ProcessTerminate;
+        /// `job/start`.
+        start_jobs => JobStart;
+        /// `job/read`.
+        read_jobs => JobRead;
+        /// `job/cancel`.
+        cancel_jobs => JobCancel;
     }
 }
 
-impl EnvironmentDataClient<WebSocketTransport> {
-    pub async fn connect(
-        endpoint: &str,
-        options: WebSocketConnectOptions,
-    ) -> EnvironmentClientResult<Self> {
-        Ok(Self::new(
-            WebSocketTransport::connect(endpoint, options).await?,
-        ))
+impl std::fmt::Debug for DataClient {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("DataClient")
+            .field(
+                "daemon_instance_id",
+                &self.inner.initialize.daemon_instance_id,
+            )
+            .field("closed", &self.is_closed())
+            .finish_non_exhaustive()
     }
 }
diff --git a/crates/environment-client/src/dial.rs b/crates/environment-client/src/dial.rs
new file mode 100644
index 000000000..544fe68d8
--- /dev/null
+++ b/crates/environment-client/src/dial.rs
@@ -0,0 +1,244 @@
+//! Endpoint dialing: `ws://`, `wss://` and `unix:///path`, with the
+//! protocol's message limits and the caller's headers.
+
+use std::time::Duration;
+
+use environment_protocol::limits::MAX_MESSAGE_BYTES;
+use tokio::{
+    io::{AsyncRead, AsyncWrite},
+    net::UnixStream,
+};
+use tokio_tungstenite::{
+    WebSocketStream, client_async_with_config, connect_async_with_config,
+    tungstenite::{
+        self,
+        client::IntoClientRequest,
+        handshake::client::Request,
+        http::{
+            HeaderName, HeaderValue,
+            header::{AUTHORIZATION, USER_AGENT},
+        },
+        protocol::WebSocketConfig,
+    },
+};
+
+use crate::{error::ClientError, options::ConnectOptions};
+
+/// The WebSocket settings of every client socket: one explicit limit for
+/// messages and frames, the protocol's [`MAX_MESSAGE_BYTES`].
+pub(crate) fn websocket_config() -> WebSocketConfig {
+    WebSocketConfig::default()
+        .max_message_size(Some(MAX_MESSAGE_BYTES as usize))
+        .max_frame_size(Some(MAX_MESSAGE_BYTES as usize))
+}
+
+enum Target<'a> {
+    /// `ws://` or `wss://`: dialed as given.
+    Url,
+    /// `unix:///path`: the socket path; the upgrade targets `/` with
+    /// `Host: localhost`.
+    Unix(&'a str),
+}
+
+fn target(endpoint: &str) -> Result<Target<'_>, ClientError> {
+    if endpoint.starts_with("ws://") || endpoint.starts_with("wss://") {
+        return Ok(Target::Url);
+    }
+    if let Some(path) = endpoint.strip_prefix("unix://") {
+        if path.len() > 1 && path.starts_with('/') && !path.contains(['?', '#']) {
+            return Ok(Target::Unix(path));
+        }
+        return Err(configuration(
+            endpoint,
+            "a unix endpoint names an absolute socket path: unix:///path/to/socket",
+        ));
+    }
+    Err(configuration(
+        endpoint,
+        "the endpoint scheme must be ws://, wss:// or unix://",
+    ))
+}
+
+fn configuration(endpoint: &str, message: impl Into<String>) -> ClientError {
+    ClientError::Configuration {
+        endpoint: endpoint.to_owned(),
+        message: message.into(),
+    }
+}
+
+fn upgrade_request(
+    endpoint: &str,
+    url: &str,
+    options: &ConnectOptions,
+) -> Result<Request, ClientError> {
+    let mut request = url
+        .into_client_request()
+        .map_err(|error| configuration(endpoint, error.to_string()))?;
+    let headers = request.headers_mut();
+    let user_agent = HeaderValue::from_str(&options.effective_user_agent())
+        .map_err(|_| configuration(endpoint, "the user agent is not a valid header value"))?;
+    headers.insert(USER_AGENT, user_agent);
+    if let Some(token) = &options.bearer_token {
+        let mut value = HeaderValue::from_str(&format!("Bearer {}", token.expose()))
+            .map_err(|_| configuration(endpoint, "the bearer token is not a valid header value"))?;
+        value.set_sensitive(true);
+        headers.insert(AUTHORIZATION, value);
+    }
+    for (name, value) in &options.headers {
+        let header = HeaderName::from_bytes(name.as_bytes())
+            .map_err(|_| configuration(endpoint, format!("invalid header name {name:?}")))?;
+        let value = HeaderValue::from_str(value).map_err(|_| {
+            configuration(endpoint, format!("header {name:?} has an invalid value"))
+        })?;
+        headers.insert(header, value);
+    }
+    Ok(request)
+}
+
+fn dial_error(endpoint: &str, error: tungstenite::Error) -> ClientError {
+    match error {
+        tungstenite::Error::Http(response) => ClientError::UpgradeRejected {
+            status: response.status().as_u16(),
+        },
+        tungstenite::Error::Url(error) => configuration(endpoint, error.to_string()),
+        error => ClientError::Connect {
+            endpoint: endpoint.to_owned(),
+            message: error.to_string(),
+        },
+    }
+}
+
+async fn bounded<T>(
+    endpoint: &str,
+    timeout: Duration,
+    dial: impl Future<Output = Result<T, ClientError>>,
+) -> Result<T, ClientError> {
+    tokio::time::timeout(timeout, dial)
+        .await
+        .map_err(|_| ClientError::ConnectTimeout {
+            endpoint: endpoint.to_owned(),
+        })?
+}
+
+/// A dialed socket of either transport.
+pub(crate) enum Dialed {
+    Tcp(Box<WebSocketStream<tokio_tungstenite::MaybeTlsStream<tokio::net::TcpStream>>>),
+    Unix(Box<WebSocketStream<UnixStream>>),
+}
+
+/// Dial `endpoint` and complete the WebSocket upgrade within
+/// `options.connect_timeout`.
+pub(crate) async fn dial(endpoint: &str, options: &ConnectOptions) -> Result<Dialed, ClientError> {
+    match target(endpoint)? {
+        Target::Url => {
+            let request = upgrade_request(endpoint, endpoint, options)?;
+            bounded(endpoint, options.connect_timeout, async {
+                connect_async_with_config(request, Some(websocket_config()), true)
+                    .await
+                    .map(|(socket, _)| Dialed::Tcp(Box::new(socket)))
+                    .map_err(|error| dial_error(endpoint, error))
+            })
+            .await
+        }
+        Target::Unix(path) => {
+            let request = upgrade_request(endpoint, "ws://localhost/", options)?;
+            bounded(endpoint, options.connect_timeout, async {
+                let stream =
+                    UnixStream::connect(path)
+                        .await
+                        .map_err(|error| ClientError::Connect {
+                            endpoint: endpoint.to_owned(),
+                            message: error.to_string(),
+                        })?;
+                client_async_with_config(request, stream, Some(websocket_config()))
+                    .await
+                    .map(|(socket, _)| Dialed::Unix(Box::new(socket)))
+                    .map_err(|error| dial_error(endpoint, error))
+            })
+            .await
+        }
+    }
+}
+
+/// Complete the WebSocket upgrade over an already connected byte stream
+/// (request target `/`, `Host: localhost`) within
+/// `options.connect_timeout`.
+pub(crate) async fn upgrade<S>(
+    stream: S,
+    options: &ConnectOptions,
+) -> Result<WebSocketStream<S>, ClientError>
+where
+    S: AsyncRead + AsyncWrite + Unpin,
+{
+    const ENDPOINT: &str = "ws://localhost/";
+    let request = upgrade_request(ENDPOINT, ENDPOINT, options)?;
+    bounded(ENDPOINT, options.connect_timeout, async {
+        client_async_with_config(request, stream, Some(websocket_config()))
+            .await
+            .map(|(socket, _)| socket)
+            .map_err(|error| dial_error(ENDPOINT, error))
+    })
+    .await
+}
+
+#[cfg(test)]
+mod tests {
+    use environment_protocol::handshake::ImplementationInfo;
+
+    use super::*;
+
+    fn options() -> ConnectOptions {
+        ConnectOptions::new(
+            ImplementationInfo::new("lightspeed-test")
+                .and_then(|info| info.with_version("1.0.0"))
+                .unwrap(),
+        )
+    }
+
+    #[test]
+    fn endpoints_select_their_dialer() {
+        assert!(matches!(target("ws://127.0.0.1:1/x"), Ok(Target::Url)));
+        assert!(matches!(target("wss://example.test"), Ok(Target::Url)));
+        assert!(matches!(
+            target("unix:///run/envd.sock"),
+            Ok(Target::Unix("/run/envd.sock"))
+        ));
+        for bad in [
+            "http://example.test",
+            "unix://relative.sock",
+            "unix:///",
+            "unix:///run/envd.sock?x=1",
+            "stdio://",
+        ] {
+            assert!(
+                matches!(target(bad), Err(ClientError::Configuration { .. })),
+                "{bad}"
+            );
+        }
+    }
+
+    #[test]
+    fn upgrade_requests_carry_agent_credential_and_headers() {
+        let request = upgrade_request(
+            "ws://h/",
+            "ws://h/",
+            &options()
+                .with_bearer_token("secret")
+                .with_header("x-lightspeed-test", "1"),
+        )
+        .unwrap();
+        let headers = request.headers();
+        assert_eq!(headers[USER_AGENT], "lightspeed-test/1.0.0");
+        assert_eq!(headers[AUTHORIZATION], "Bearer secret");
+        assert!(headers[AUTHORIZATION].is_sensitive());
+        assert_eq!(headers["x-lightspeed-test"], "1");
+        assert!(matches!(
+            upgrade_request(
+                "ws://h/",
+                "ws://h/",
+                &options().with_header("bad name", "1")
+            ),
+            Err(ClientError::Configuration { .. })
+        ));
+    }
+}
diff --git a/crates/environment-client/src/error.rs b/crates/environment-client/src/error.rs
index 60843fc7d..3008d7c30 100644
--- a/crates/environment-client/src/error.rs
+++ b/crates/environment-client/src/error.rs
@@ -1,24 +1,223 @@
-//! Client-side environment protocol errors.
+//! Client-side errors.
 
-use environment_protocol::error::EnvironmentProtocolError;
+use environment_protocol::{
+    error::{ProtocolError, ProtocolErrorKind},
+    handshake::Plane,
+};
 use thiserror::Error;
 
-pub type EnvironmentClientResult<T> = Result<T, EnvironmentClientError>;
+/// Why a connect or call failed.
+///
+/// A server's error answer is [`ClientError::Protocol`] with the server's
+/// error kind intact; everything else is a fact about the connection or a
+/// contract breach the client detected itself. The client never
+/// synthesizes a protocol error kind.
+#[derive(Clone, Debug, Error)]
+pub enum ClientError {
+    /// The connection settings cannot be used: an endpoint that is not
+    /// `ws://`, `wss://` or `unix:///path`, or a header that is not valid
+    /// HTTP. Retrying does not help.
+    #[error("invalid connection settings for {endpoint}: {message}")]
+    Configuration { endpoint: String, message: String },
 
-#[derive(Debug, Error)]
-pub enum EnvironmentClientError {
-    #[error("failed to serialize JSON-RPC message: {0}")]
-    Serialize(#[from] serde_json::Error),
+    /// TCP or Unix connect, TLS or the WebSocket upgrade failed below HTTP.
+    #[error("connect to {endpoint}: {message}")]
+    Connect { endpoint: String, message: String },
 
-    #[error("transport closed")]
-    TransportClosed,
+    /// Connect, TLS and upgrade did not finish within
+    /// [`ConnectOptions::connect_timeout`](crate::ConnectOptions::connect_timeout).
+    #[error("connect to {endpoint} timed out")]
+    ConnectTimeout { endpoint: String },
 
-    #[error("transport error: {0}")]
-    Transport(String),
+    /// The server answered the upgrade with an HTTP status instead of
+    /// switching protocols: 401 for a missing or wrong credential, 503 for
+    /// a route that is not ready yet.
+    #[error("upgrade refused with HTTP {status}")]
+    UpgradeRejected { status: u16 },
+
+    /// The server speaks another protocol version on this plane: it
+    /// answered `initialize` with `versionMismatch`, or with a different
+    /// `protocolVersion`. `local` is this client's version.
+    #[error("{plane} protocol mismatch: this client speaks {local}, the server {remote}")]
+    VersionMismatch {
+        plane: Plane,
+        local: u32,
+        remote: u32,
+    },
+
+    /// The server's `initialize` response names another plane: the
+    /// endpoint serves something else.
+    #[error("expected the {expected} plane, the server serves {actual}")]
+    WrongPlane { expected: Plane, actual: Plane },
+
+    /// The server answered the call with this error.
+    #[error("{0}")]
+    Protocol(ProtocolError),
+
+    /// The call's deadline passed before its response arrived. On the data
+    /// plane an abortable call was also sent `$/cancelRequest`.
+    #[error("deadline exceeded after {elapsed_ms} ms")]
+    DeadlineExceeded { elapsed_ms: u64 },
+
+    /// The connection is closed: by the server (with its close code and
+    /// reason when it sent a close frame), by the transport ending, or by
+    /// [`close`](crate::DataClient::close).
+    #[error("connection closed{}", describe_close(*code, reason.as_deref()))]
+    Closed {
+        code: Option<u16>,
+        reason: Option<String>,
+    },
 
-    #[error("invalid JSON-RPC message: {0}")]
+    /// The encoded request is larger than the protocol's message limit; it
+    /// was not sent.
+    #[error("request of {actual_bytes} bytes exceeds the {limit_bytes}-byte limit")]
+    PayloadTooLarge { limit_bytes: u64, actual_bytes: u64 },
+
+    /// The request could not be encoded.
+    #[error("encode request: {0}")]
+    Encode(String),
+
+    /// The server's result does not decode as the method's response type:
+    /// the server broke the contract.
+    #[error("decode response: {0}")]
+    Decode(String),
+
+    /// The server sent something no client accepts on this plane: a
+    /// request or notification, a binary frame, a frame over the message
+    /// limit, or a frame that is not a valid response. The client closed
+    /// the connection and failed every pending call with this error.
+    #[error("invalid message from server: {0}")]
     InvalidMessage(String),
 
-    #[error("environment protocol error: {0:?}")]
-    Protocol(EnvironmentProtocolError),
+    /// The socket failed after the connection was established.
+    #[error("transport: {0}")]
+    Transport(String),
+}
+
+impl ClientError {
+    /// The server's error kind: the kind of a [`Protocol`](Self::Protocol)
+    /// error, and `versionMismatch` for
+    /// [`VersionMismatch`](Self::VersionMismatch). `None` for failures the
+    /// client observed itself.
+    pub fn protocol_kind(&self) -> Option<ProtocolErrorKind> {
+        match self {
+            Self::Protocol(error) => Some(error.kind()),
+            Self::VersionMismatch { .. } => Some(ProtocolErrorKind::VersionMismatch),
+            _ => None,
+        }
+    }
+
+    /// The server's error, for [`Protocol`](Self::Protocol).
+    pub fn protocol_error(&self) -> Option<&ProtocolError> {
+        match self {
+            Self::Protocol(error) => Some(error),
+            _ => None,
+        }
+    }
+
+    /// True when the same call may succeed later without any change: a
+    /// retryable protocol kind (`busy`, `unavailable`, `aborted`), a
+    /// connection failure, a closed connection, a deadline, or an upgrade
+    /// refused with 429 or a 5xx status. Version and plane mismatches,
+    /// contract breaches and refusals are not.
+    pub fn is_retryable(&self) -> bool {
+        match self {
+            Self::Protocol(error) => error.is_retryable(),
+            Self::Connect { .. }
+            | Self::ConnectTimeout { .. }
+            | Self::Closed { .. }
+            | Self::Transport(_)
+            | Self::DeadlineExceeded { .. } => true,
+            Self::UpgradeRejected { status } => *status == 429 || (500..600).contains(status),
+            Self::Configuration { .. }
+            | Self::VersionMismatch { .. }
+            | Self::WrongPlane { .. }
+            | Self::PayloadTooLarge { .. }
+            | Self::Encode(_)
+            | Self::Decode(_)
+            | Self::InvalidMessage(_) => false,
+        }
+    }
+}
+
+fn describe_close(code: Option<u16>, reason: Option<&str>) -> String {
+    match (code, reason) {
+        (Some(code), Some(reason)) if !reason.is_empty() => format!(" ({code}: {reason})"),
+        (Some(code), _) => format!(" ({code})"),
+        (None, _) => String::new(),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use environment_protocol::error::{AbortReason, ProtocolError};
+
+    use super::*;
+
+    #[test]
+    fn protocol_errors_keep_their_kind_and_retryability() {
+        let aborted = ClientError::Protocol(ProtocolError::aborted(
+            Some(AbortReason::Cancelled),
+            "cancelled",
+        ));
+        assert_eq!(aborted.protocol_kind(), Some(ProtocolErrorKind::Aborted));
+        assert!(aborted.is_retryable());
+        let missing = ClientError::Protocol(ProtocolError::not_found("no such process"));
+        assert_eq!(missing.protocol_kind(), Some(ProtocolErrorKind::NotFound));
+        assert!(!missing.is_retryable());
+        assert_eq!(missing.to_string(), "notFound: no such process");
+    }
+
+    #[test]
+    fn connection_failures_are_retryable_and_breaches_are_not() {
+        assert!(
+            ClientError::Closed {
+                code: None,
+                reason: None
+            }
+            .is_retryable()
+        );
+        assert!(ClientError::DeadlineExceeded { elapsed_ms: 10 }.is_retryable());
+        assert!(ClientError::UpgradeRejected { status: 503 }.is_retryable());
+        assert!(ClientError::UpgradeRejected { status: 429 }.is_retryable());
+        assert!(!ClientError::UpgradeRejected { status: 401 }.is_retryable());
+        assert!(!ClientError::Decode("x".to_owned()).is_retryable());
+        assert!(
+            !ClientError::VersionMismatch {
+                plane: Plane::Data,
+                local: 3,
+                remote: 2
+            }
+            .is_retryable()
+        );
+        assert_eq!(
+            ClientError::VersionMismatch {
+                plane: Plane::Controller,
+                local: 3,
+                remote: 4
+            }
+            .protocol_kind(),
+            Some(ProtocolErrorKind::VersionMismatch)
+        );
+    }
+
+    #[test]
+    fn close_display_names_code_and_reason() {
+        assert_eq!(
+            ClientError::Closed {
+                code: Some(1008),
+                reason: Some("route closed".to_owned())
+            }
+            .to_string(),
+            "connection closed (1008: route closed)"
+        );
+        assert_eq!(
+            ClientError::Closed {
+                code: None,
+                reason: None
+            }
+            .to_string(),
+            "connection closed"
+        );
+    }
 }
diff --git a/crates/environment-client/src/lib.rs b/crates/environment-client/src/lib.rs
index 4717b0236..8cb949316 100644
--- a/crates/environment-client/src/lib.rs
+++ b/crates/environment-client/src/lib.rs
@@ -1,16 +1,66 @@
-//! Typed client for environment protocol data-plane and controller-plane calls.
+//! Clients of the environment protocol's data and controller planes.
 //!
-//! The crate owns transport and JSON-RPC mechanics while reusing pure protocol
-//! records from `environment-protocol`.
+//! [`DataClient`] talks to one envd, [`ControllerClient`] to one provider
+//! controller. Both are opened with `connect_initialized`, which dials
+//! (`ws://`, `wss://` or `unix:///path`), runs `initialize` and fails with a
+//! typed [`ClientError::VersionMismatch`] or [`ClientError::WrongPlane`]
+//! before anything else is sent. Calls are typed by the protocol's method
+//! markers ([`environment_protocol::manifest`]):
+//!
+//! ```no_run
+//! # async fn example() -> Result<(), environment_client::ClientError> {
+//! use environment_client::{ConnectOptions, DataClient};
+//! use environment_protocol::{
+//!     data::idle::GetIdleParams, handshake::ImplementationInfo, manifest::EnvGetIdle,
+//! };
+//!
+//! let info = ImplementationInfo::new("lightspeed-runtime").expect("valid name");
+//! let (client, initialize) =
+//!     DataClient::connect_initialized("ws://127.0.0.1:7070", ConnectOptions::new(info)).await?;
+//! let idle = client.call::<EnvGetIdle>(&GetIdleParams {}).await?;
+//! # let _ = (initialize, idle);
+//! # Ok(())
+//! # }
+//! ```
+//!
+//! # Connection behaviour
+//!
+//! - **Multiplexed.** Calls take `&self`, may be issued concurrently on
+//!   one connection and are matched to responses by id. Clients are cheap
+//!   to clone.
+//! - **Cancel-safe.** A call whose future is dropped, or whose deadline
+//!   passes, is forgotten; its late response is discarded. On the data
+//!   plane an abandoned abortable call (`process/read`, `job/read`,
+//!   `fs/searchText`, `fs/globFiles`, `fs/scan`) is also sent
+//!   `$/cancelRequest`.
+//! - **Deadlines.** [`ConnectOptions`] bounds connect and `initialize`
+//!   (10 s each by default) and can set a default deadline for every call;
+//!   `call_with_timeout` overrides it per call.
+//! - **Keepalive.** While any call is pending the client sends a WebSocket
+//!   ping every [`ConnectOptions::keepalive_interval`] (20 s by default),
+//!   so relays never idle-close a long wait.
+//! - **Limits.** Messages and frames are limited to
+//!   [`MAX_MESSAGE_BYTES`](environment_protocol::limits::MAX_MESSAGE_BYTES)
+//!   in both directions; a larger request fails with
+//!   [`ClientError::PayloadTooLarge`] without being sent.
+//! - **Servers only answer.** A request or notification from the server, a
+//!   binary frame or an unparseable frame closes the connection and fails
+//!   every pending call with [`ClientError::InvalidMessage`].
+//!
+//! Tests that need no socket build clients with `in_process`.
+
+mod connection;
+mod controller;
+mod data;
+mod dial;
+mod error;
+mod options;
 
-pub mod control;
-pub mod data;
-pub mod error;
-pub mod rpc;
-pub mod transport;
+#[cfg(feature = "conformance")]
+pub mod conformance;
 
-pub use control::EnvironmentProviderClient;
-pub use data::EnvironmentDataClient;
-pub use error::{EnvironmentClientError, EnvironmentClientResult};
-pub use rpc::{JsonRpcClient, JsonRpcNotification, JsonRpcTransport};
-pub use transport::{WebSocketConnectOptions, WebSocketTransport};
+pub use connection::InProcessHandler;
+pub use controller::ControllerClient;
+pub use data::DataClient;
+pub use error::ClientError;
+pub use options::{ConnectOptions, DEFAULT_CONNECT_TIMEOUT, DEFAULT_INITIALIZE_TIMEOUT};
diff --git a/crates/environment-client/src/options.rs b/crates/environment-client/src/options.rs
new file mode 100644
index 000000000..3c482d9df
--- /dev/null
+++ b/crates/environment-client/src/options.rs
@@ -0,0 +1,112 @@
+//! Connection settings.
+
+use std::{fmt, time::Duration};
+
+use environment_protocol::{
+    bytes::SecretString, handshake::ImplementationInfo, limits::KEEPALIVE_INTERVAL_MS,
+};
+
+/// Default bound of connect, TLS and WebSocket upgrade together.
+pub const DEFAULT_CONNECT_TIMEOUT: Duration = Duration::from_secs(10);
+
+/// Default bound of the `initialize` round trip.
+pub const DEFAULT_INITIALIZE_TIMEOUT: Duration = Duration::from_secs(10);
+
+/// How to dial and greet an endpoint.
+#[derive(Clone)]
+pub struct ConnectOptions {
+    /// Sent as `clientInfo` in `initialize`, and as the default
+    /// `User-Agent` (`name/version`).
+    pub client_info: ImplementationInfo,
+    /// Sent as `Authorization: Bearer <token>` on the upgrade request.
+    pub bearer_token: Option<SecretString>,
+    /// Overrides the `User-Agent` derived from `client_info`.
+    pub user_agent: Option<String>,
+    /// Extra upgrade request headers.
+    pub headers: Vec<(String, String)>,
+    /// Bound of TCP or Unix connect, TLS and the WebSocket upgrade
+    /// together. Default [`DEFAULT_CONNECT_TIMEOUT`].
+    pub connect_timeout: Duration,
+    /// Bound of the `initialize` round trip. Default
+    /// [`DEFAULT_INITIALIZE_TIMEOUT`].
+    pub initialize_timeout: Duration,
+    /// Default deadline of every call made through the client; `None`
+    /// means calls wait as long as the caller does (tool paths rely on
+    /// their activity deadline). Background paths set one. Default `None`.
+    pub request_timeout: Option<Duration>,
+    /// Ping interval while any call is pending (the waiting peer keeps
+    /// intermediaries from idle-closing a long wait). Default
+    /// [`KEEPALIVE_INTERVAL_MS`].
+    pub keepalive_interval: Duration,
+}
+
+impl ConnectOptions {
+    pub fn new(client_info: ImplementationInfo) -> Self {
+        Self {
+            client_info,
+            bearer_token: None,
+            user_agent: None,
+            headers: Vec::new(),
+            connect_timeout: DEFAULT_CONNECT_TIMEOUT,
+            initialize_timeout: DEFAULT_INITIALIZE_TIMEOUT,
+            request_timeout: None,
+            keepalive_interval: Duration::from_millis(KEEPALIVE_INTERVAL_MS),
+        }
+    }
+
+    pub fn with_bearer_token(mut self, token: impl Into<SecretString>) -> Self {
+        self.bearer_token = Some(token.into());
+        self
+    }
+
+    pub fn with_user_agent(mut self, user_agent: impl Into<String>) -> Self {
+        self.user_agent = Some(user_agent.into());
+        self
+    }
+
+    pub fn with_header(mut self, name: impl Into<String>, value: impl Into<String>) -> Self {
+        self.headers.push((name.into(), value.into()));
+        self
+    }
+
+    pub fn with_request_timeout(mut self, timeout: Duration) -> Self {
+        self.request_timeout = Some(timeout);
+        self
+    }
+
+    /// The `User-Agent` sent on the upgrade request.
+    pub(crate) fn effective_user_agent(&self) -> String {
+        if let Some(user_agent) = &self.user_agent {
+            return user_agent.clone();
+        }
+        match self.client_info.version() {
+            Some(version) => format!("{}/{version}", self.client_info.name()),
+            None => self.client_info.name().to_owned(),
+        }
+    }
+}
+
+impl fmt::Debug for ConnectOptions {
+    /// Header values and the bearer token are left out: they may carry
+    /// credentials.
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("ConnectOptions")
+            .field("client_info", &self.client_info)
+            .field("bearer_token", &self.bearer_token)
+            .field("user_agent", &self.user_agent)
+            .field(
+                "headers",
+                &self
+                    .headers
+                    .iter()
+                    .map(|(name, _)| name.as_str())
+                    .collect::<Vec<_>>(),
+            )
+            .field("connect_timeout", &self.connect_timeout)
+            .field("initialize_timeout", &self.initialize_timeout)
+            .field("request_timeout", &self.request_timeout)
+            .field("keepalive_interval", &self.keepalive_interval)
+            .finish()
+    }
+}
diff --git a/crates/environment-client/src/rpc.rs b/crates/environment-client/src/rpc.rs
deleted file mode 100644
index 1a74572c8..000000000
--- a/crates/environment-client/src/rpc.rs
+++ /dev/null
@@ -1,169 +0,0 @@
-//! Minimal JSON-RPC 2.0 client machinery.
-
-use std::collections::VecDeque;
-
-use async_trait::async_trait;
-use environment_protocol::error::{EnvironmentProtocolError, EnvironmentProtocolErrorCode};
-use serde::{Serialize, de::DeserializeOwned};
-use serde_json::{Value, json};
-
-use crate::error::{EnvironmentClientError, EnvironmentClientResult};
-
-#[async_trait]
-pub trait JsonRpcTransport: Send {
-    async fn send(&mut self, message: Value) -> EnvironmentClientResult<()>;
-    async fn recv(&mut self) -> EnvironmentClientResult<Option<Value>>;
-
-    /// Gracefully close the transport when it has an application-level
-    /// shutdown handshake. Stateless/in-process transports need no action.
-    async fn close(&mut self) -> EnvironmentClientResult<()> {
-        Ok(())
-    }
-}
-
-#[derive(Clone, Debug, PartialEq)]
-pub struct JsonRpcNotification {
-    pub method: String,
-    pub params: Value,
-}
-
-pub struct JsonRpcClient<T> {
-    transport: T,
-    next_id: u64,
-    notifications: VecDeque<JsonRpcNotification>,
-}
-
-impl<T> JsonRpcClient<T>
-where
-    T: JsonRpcTransport,
-{
-    pub fn new(transport: T) -> Self {
-        Self {
-            transport,
-            next_id: 1,
-            notifications: VecDeque::new(),
-        }
-    }
-
-    pub fn into_inner(self) -> T {
-        self.transport
-    }
-
-    pub async fn close(&mut self) -> EnvironmentClientResult<()> {
-        self.transport.close().await
-    }
-
-    pub async fn request<P, R>(&mut self, method: &str, params: &P) -> EnvironmentClientResult<R>
-    where
-        P: Serialize + Sync,
-        R: DeserializeOwned,
-    {
-        let id = self.next_request_id();
-        self.transport
-            .send(json!({
-                "jsonrpc": "2.0",
-                "id": id,
-                "method": method,
-                "params": serde_json::to_value(params)?,
-            }))
-            .await?;
-
-        loop {
-            let message = self
-                .transport
-                .recv()
-                .await?
-                .ok_or(EnvironmentClientError::TransportClosed)?;
-            if let Some(notification) = parse_notification(&message)? {
-                self.notifications.push_back(notification);
-                continue;
-            }
-
-            let Some(response_id) = message.get("id").and_then(Value::as_u64) else {
-                return Err(EnvironmentClientError::InvalidMessage(
-                    "response missing numeric id".to_owned(),
-                ));
-            };
-            if response_id != id {
-                return Err(EnvironmentClientError::InvalidMessage(format!(
-                    "unexpected response id {response_id}, expected {id}"
-                )));
-            }
-
-            if let Some(error) = message.get("error") {
-                return Err(EnvironmentClientError::Protocol(parse_error(error)?));
-            }
-
-            let result = message.get("result").ok_or_else(|| {
-                EnvironmentClientError::InvalidMessage("response missing result".to_owned())
-            })?;
-            return serde_json::from_value(result.clone()).map_err(Into::into);
-        }
-    }
-
-    pub async fn notify<P>(&mut self, method: &str, params: &P) -> EnvironmentClientResult<()>
-    where
-        P: Serialize + Sync,
-    {
-        self.transport
-            .send(json!({
-                "jsonrpc": "2.0",
-                "method": method,
-                "params": serde_json::to_value(params)?,
-            }))
-            .await
-    }
-
-    pub async fn next_notification(
-        &mut self,
-    ) -> EnvironmentClientResult<Option<JsonRpcNotification>> {
-        if let Some(notification) = self.notifications.pop_front() {
-            return Ok(Some(notification));
-        }
-
-        loop {
-            let Some(message) = self.transport.recv().await? else {
-                return Ok(None);
-            };
-            if let Some(notification) = parse_notification(&message)? {
-                return Ok(Some(notification));
-            }
-        }
-    }
-
-    fn next_request_id(&mut self) -> u64 {
-        let id = self.next_id;
-        self.next_id += 1;
-        id
-    }
-}
-
-fn parse_notification(message: &Value) -> EnvironmentClientResult<Option<JsonRpcNotification>> {
-    if message.get("id").is_some() {
-        return Ok(None);
-    }
-
-    let Some(method) = message.get("method").and_then(Value::as_str) else {
-        return Ok(None);
-    };
-    let params = message.get("params").cloned().unwrap_or(Value::Null);
-    Ok(Some(JsonRpcNotification {
-        method: method.to_owned(),
-        params,
-    }))
-}
-
-fn parse_error(value: &Value) -> EnvironmentClientResult<EnvironmentProtocolError> {
-    if let Ok(error) = serde_json::from_value::<EnvironmentProtocolError>(value.clone()) {
-        return Ok(error);
-    }
-
-    let message = value
-        .get("message")
-        .and_then(Value::as_str)
-        .unwrap_or("JSON-RPC error");
-    Ok(EnvironmentProtocolError::new(
-        EnvironmentProtocolErrorCode::Internal,
-        message,
-    ))
-}
diff --git a/crates/environment-client/src/transport.rs b/crates/environment-client/src/transport.rs
deleted file mode 100644
index 80418bca5..000000000
--- a/crates/environment-client/src/transport.rs
+++ /dev/null
@@ -1,114 +0,0 @@
-//! Transport implementations for environment protocol clients.
-
-use async_trait::async_trait;
-use futures_util::{SinkExt, StreamExt};
-use serde_json::Value;
-use tokio::net::TcpStream;
-use tokio_tungstenite::{
-    MaybeTlsStream, WebSocketStream, connect_async,
-    tungstenite::{
-        Message,
-        client::IntoClientRequest,
-        http::{
-            HeaderName, HeaderValue,
-            header::{AUTHORIZATION, USER_AGENT},
-        },
-    },
-};
-
-use crate::{
-    error::{EnvironmentClientError, EnvironmentClientResult},
-    rpc::JsonRpcTransport,
-};
-
-pub struct WebSocketTransport {
-    stream: WebSocketStream<MaybeTlsStream<TcpStream>>,
-    closed: bool,
-}
-
-impl WebSocketTransport {
-    pub async fn connect(
-        endpoint: &str,
-        options: WebSocketConnectOptions,
-    ) -> EnvironmentClientResult<Self> {
-        let mut request = endpoint
-            .into_client_request()
-            .map_err(|error| EnvironmentClientError::Transport(error.to_string()))?;
-
-        if let Some(user_agent) = options.user_agent {
-            let value = HeaderValue::from_str(&user_agent)
-                .map_err(|error| EnvironmentClientError::Transport(error.to_string()))?;
-            request.headers_mut().insert(USER_AGENT, value);
-        }
-
-        if let Some(token) = options.bearer_token {
-            let value = HeaderValue::from_str(&format!("Bearer {token}"))
-                .map_err(|error| EnvironmentClientError::Transport(error.to_string()))?;
-            request.headers_mut().insert(AUTHORIZATION, value);
-        }
-
-        for (name, value) in options.headers {
-            let name = HeaderName::from_bytes(name.as_bytes())
-                .map_err(|error| EnvironmentClientError::Transport(error.to_string()))?;
-            let value = HeaderValue::from_str(&value)
-                .map_err(|error| EnvironmentClientError::Transport(error.to_string()))?;
-            request.headers_mut().insert(name, value);
-        }
-
-        let (stream, _) = connect_async(request)
-            .await
-            .map_err(|error| EnvironmentClientError::Transport(error.to_string()))?;
-        Ok(Self {
-            stream,
-            closed: false,
-        })
-    }
-}
-
-#[derive(Clone, Debug, Default, PartialEq, Eq)]
-pub struct WebSocketConnectOptions {
-    pub bearer_token: Option<String>,
-    pub user_agent: Option<String>,
-    pub headers: Vec<(String, String)>,
-}
-
-#[async_trait]
-impl JsonRpcTransport for WebSocketTransport {
-    async fn send(&mut self, message: Value) -> EnvironmentClientResult<()> {
-        self.stream
-            .send(Message::Text(message.to_string().into()))
-            .await
-            .map_err(|error| EnvironmentClientError::Transport(error.to_string()))
-    }
-
-    async fn recv(&mut self) -> EnvironmentClientResult<Option<Value>> {
-        loop {
-            let Some(message) = self.stream.next().await else {
-                return Ok(None);
-            };
-            let message =
-                message.map_err(|error| EnvironmentClientError::Transport(error.to_string()))?;
-            match message {
-                Message::Text(text) => {
-                    return serde_json::from_str(&text).map(Some).map_err(Into::into);
-                }
-                Message::Binary(bytes) => {
-                    return serde_json::from_slice(&bytes).map(Some).map_err(Into::into);
-                }
-                Message::Close(_) => return Ok(None),
-                Message::Ping(_) | Message::Pong(_) | Message::Frame(_) => {}
-            }
-        }
-    }
-
-    async fn close(&mut self) -> EnvironmentClientResult<()> {
-        if self.closed {
-            return Ok(());
-        }
-        self.closed = true;
-        self.stream
-            .close(None)
-            .await
-            .map_err(|error| EnvironmentClientError::Transport(error.to_string()))
-    }
-}
diff --git a/crates/environment-client/tests/client.rs b/crates/environment-client/tests/client.rs
index 0c8d27424..d03b08f77 100644
--- a/crates/environment-client/tests/client.rs
+++ b/crates/environment-client/tests/client.rs
@@ -1,395 +1,644 @@
-use std::collections::{BTreeMap, VecDeque};
+//! Socket behaviour of the data and controller clients against scripted
+//! WebSocket servers.
+
+use std::{
+    sync::{
+        Arc,
+        atomic::{AtomicUsize, Ordering},
+    },
+    time::Duration,
+};
 
-use async_trait::async_trait;
 use environment_client::{
-    EnvironmentClientError, EnvironmentClientResult, EnvironmentDataClient,
-    EnvironmentProviderClient, JsonRpcTransport, WebSocketConnectOptions,
+    ClientError, ConnectOptions, ControllerClient, DataClient,
+    conformance::controller::{ControllerConformance, run},
 };
 use environment_protocol::{
-    control::{
-        handshake::ControllerInitializeParams,
-        targets::{AdoptTargetParams, ProviderBindingContext},
-    },
+    CONTROLLER_PROTOCOL_VERSION, ENVD_PROTOCOL_VERSION,
+    bytes::ByteChunk,
+    control::{handshake::ControllerInitializeResponse, target::TargetOwner},
     data::{
-        fs::ReadFileParams,
-        jobs::{JobDependencyPolicy, JobStartSpec, ListJobsParams, StartJobsParams},
-        methods::PROCESS_OUTPUT_METHOD,
+        exec::ReturnOn,
+        fs::{WriteCondition, WriteFileParams},
+        handshake::InitializeResponse,
+        idle::{GetIdleParams, GetIdleResponse},
+        process::ReadProcessParams,
     },
-    error::EnvironmentProtocolErrorCode,
-    shared::{ByteChunk, CURRENT_PROTOCOL_VERSION, EnvironmentPath, JobId},
+    error::{ProtocolError, ProtocolErrorKind},
+    handshake::{ImplementationInfo, Plane},
+    ids::{BindingId, EnvironmentId, IncarnationId, ProcessId, TemplateId, UniverseId},
+    jsonrpc::{self, CancelRequestParams, Id, Message as RpcMessage, Request, Response},
+    limits::MAX_MESSAGE_BYTES,
+    manifest::{CancelRequest, EnvGetIdle},
+    paths::EnvironmentPath,
 };
+use futures_util::{SinkExt, StreamExt};
 use serde_json::{Value, json};
+use tokio::{
+    io::{AsyncRead, AsyncWrite},
+    net::{TcpListener, UnixListener},
+    sync::mpsc,
+};
+use tokio_tungstenite::{
+    WebSocketStream, accept_async, accept_hdr_async,
+    tungstenite::{
+        Message,
+        handshake::server::{
+            ErrorResponse, Request as UpgradeRequest, Response as UpgradeResponse,
+        },
+        http::StatusCode,
+    },
+};
 
-#[tokio::test(flavor = "current_thread")]
-async fn websocket_client_close_sends_a_close_frame() {
-    use futures_util::StreamExt as _;
-    use tokio::net::TcpListener;
-    use tokio_tungstenite::{accept_async, tungstenite::Message};
+fn fixture(path: &str) -> Value {
+    let text = match path {
+        "data" => include_str!("../../environment-protocol/fixtures/data/initialize.json"),
+        "controller" => {
+            include_str!("../../environment-protocol/fixtures/controller/initialize.json")
+        }
+        other => panic!("no fixture {other}"),
+    };
+    serde_json::from_str::<Value>(text).expect("fixture")["response"].clone()
+}
+
+fn options() -> ConnectOptions {
+    ConnectOptions::new(
+        ImplementationInfo::new("lightspeed-client-test")
+            .and_then(|info| info.with_version("0.0.0"))
+            .expect("client info"),
+    )
+}
 
+/// Serve one WebSocket connection on a fresh loopback port with `serve`.
+async fn server<F, Fut>(serve: F) -> String
+where
+    F: FnOnce(WebSocketStream<tokio::net::TcpStream>) -> Fut + Send + 'static,
+    Fut: Future<Output = ()> + Send,
+{
     let listener = TcpListener::bind("127.0.0.1:0").await.expect("listener");
-    let address = listener.local_addr().expect("listener address");
-    let server = tokio::spawn(async move {
+    let url = format!("ws://{}", listener.local_addr().expect("address"));
+    tokio::spawn(async move {
         let (stream, _) = listener.accept().await.expect("accept");
-        let mut websocket = accept_async(stream).await.expect("websocket handshake");
-        while let Some(message) = websocket.next().await {
-            if matches!(message.expect("websocket message"), Message::Close(_)) {
-                return true;
-            }
-        }
-        false
+        serve(accept_async(stream).await.expect("upgrade")).await;
     });
+    url
+}
 
-    let mut client = EnvironmentDataClient::connect(
-        &format!("ws://{address}"),
-        WebSocketConnectOptions::default(),
-    )
-    .await
-    .expect("connect client");
-    client.close().await.expect("close client");
+/// The next frame that is a request, skipping pings.
+async fn next_request<S>(socket: &mut WebSocketStream<S>) -> Option<Request>
+where
+    S: AsyncRead + AsyncWrite + Unpin,
+{
+    loop {
+        match socket.next().await?.ok()? {
+            Message::Text(text) => match jsonrpc::parse(&text).expect("valid frame") {
+                RpcMessage::Request(request) => return Some(request),
+                RpcMessage::Notification(_) | RpcMessage::Response(_) => {}
+            },
+            Message::Close(_) => return None,
+            _ => {}
+        }
+    }
+}
 
-    let saw_close = tokio::time::timeout(std::time::Duration::from_secs(2), server)
+async fn send<S>(socket: &mut WebSocketStream<S>, response: Response)
+where
+    S: AsyncRead + AsyncWrite + Unpin,
+{
+    socket
+        .send(Message::text(response.to_text()))
         .await
-        .expect("server observed close before timeout")
-        .expect("server task");
-    assert!(saw_close, "client dropped without a WebSocket close frame");
+        .expect("send response");
 }
 
-#[derive(Default)]
-struct MockTransport {
-    sent: Vec<Value>,
-    recv: VecDeque<Value>,
+/// Answer the first request, `initialize`, with `result`.
+async fn answer_initialize<S>(socket: &mut WebSocketStream<S>, result: Value)
+where
+    S: AsyncRead + AsyncWrite + Unpin,
+{
+    let request = next_request(socket).await.expect("initialize");
+    assert_eq!(request.method, "initialize");
+    assert_eq!(
+        request.params["protocolVersion"],
+        json!(ENVD_PROTOCOL_VERSION)
+    );
+    send(socket, Response::success(request.id, &result)).await;
 }
 
-impl MockTransport {
-    fn with_recv(messages: impl IntoIterator<Item = Value>) -> Self {
-        Self {
-            sent: Vec::new(),
-            recv: messages.into_iter().collect(),
-        }
+fn idle(ms: u64) -> GetIdleResponse {
+    GetIdleResponse {
+        idle_for_ms: ms,
+        ..GetIdleResponse::default()
     }
 }
 
-#[async_trait]
-impl JsonRpcTransport for MockTransport {
-    async fn send(&mut self, message: Value) -> EnvironmentClientResult<()> {
-        self.sent.push(message);
-        Ok(())
-    }
-
-    async fn recv(&mut self) -> EnvironmentClientResult<Option<Value>> {
-        Ok(self.recv.pop_front())
+fn read_params() -> ReadProcessParams {
+    ReadProcessParams {
+        process_id: ProcessId::new("p1").expect("process id"),
+        after: None,
+        tail_bytes: None,
+        ack: None,
+        max_bytes: 1024,
+        wait_ms: 60_000,
+        return_on: ReturnOn::AnyOutput,
     }
 }
 
-#[tokio::test]
-async fn data_client_sends_typed_request_and_decodes_response() {
-    let transport = MockTransport::with_recv([json!({
-        "jsonrpc": "2.0",
-        "id": 1,
-        "result": {
-            "data": "aGk="
+#[tokio::test(flavor = "current_thread")]
+async fn connect_initialized_returns_the_handshake_and_close_sends_a_close_frame() {
+    let (saw_close, mut closed) = mpsc::unbounded_channel();
+    let url = server(move |mut socket| async move {
+        answer_initialize(&mut socket, fixture("data")).await;
+        while let Some(Ok(message)) = socket.next().await {
+            if matches!(message, Message::Close(_)) {
+                let _ = saw_close.send(());
+                return;
+            }
         }
-    })]);
-    let mut client = EnvironmentDataClient::new(transport);
-
-    let response = client
-        .read_file(&ReadFileParams {
-            path: EnvironmentPath::new("README.md").expect("path"),
-            offset: None,
-            max_bytes: None,
-        })
+    })
+    .await;
+    let (client, initialize) = DataClient::connect_initialized(&url, options())
         .await
-        .expect("response");
-
-    assert_eq!(response.data, ByteChunk::from(b"hi".as_slice()));
+        .expect("connect");
+    let expected: InitializeResponse = serde_json::from_value(fixture("data")).expect("fixture");
+    assert_eq!(initialize, expected);
+    assert_eq!(client.initialize_response(), &expected);
+    client.close().await.expect("close");
+    assert!(client.is_closed());
+    tokio::time::timeout(Duration::from_secs(5), closed.recv())
+        .await
+        .expect("server saw the close frame in time")
+        .expect("close frame");
+    assert!(matches!(
+        client.get_idle(&GetIdleParams {}).await,
+        Err(ClientError::Closed { .. })
+    ));
+}
 
-    let transport = client.into_rpc().into_inner();
-    assert_eq!(
-        transport.sent,
-        vec![json!({
-            "jsonrpc": "2.0",
-            "id": 1,
-            "method": "fs/readFile",
-            "params": {
-                "path": "README.md"
+#[tokio::test(flavor = "current_thread")]
+async fn a_version_mismatch_answer_is_typed() {
+    let url = server(|mut socket| async move {
+        let request = next_request(&mut socket).await.expect("initialize");
+        let received = request.params["protocolVersion"].as_u64().unwrap() as u32;
+        send(
+            &mut socket,
+            Response::failure(
+                Some(request.id),
+                ProtocolError::version_mismatch(2, received),
+            ),
+        )
+        .await;
+        while socket.next().await.is_some() {}
+    })
+    .await;
+    let error = DataClient::connect_initialized(&url, options())
+        .await
+        .expect_err("mismatch");
+    assert!(
+        matches!(
+            error,
+            ClientError::VersionMismatch {
+                plane: Plane::Data,
+                local: ENVD_PROTOCOL_VERSION,
+                remote: 2
             }
-        })]
+        ),
+        "{error:?}"
     );
+    assert_eq!(
+        error.protocol_kind(),
+        Some(ProtocolErrorKind::VersionMismatch)
+    );
+    assert!(!error.is_retryable());
 }
 
-#[tokio::test]
-async fn data_client_sends_typed_job_start_request() {
-    let transport = MockTransport::with_recv([json!({
-        "jsonrpc": "2.0",
-        "id": 1,
-        "result": {
-            "jobs": [
-                {
-                    "createdAtMs": 1,
-                    "jobId": "job-1",
-                    "namespace": "session_1",
-                    "status": "queued"
-                }
-            ]
-        }
-    })]);
-    let mut client = EnvironmentDataClient::new(transport);
+#[tokio::test(flavor = "current_thread")]
+async fn a_response_with_another_version_is_a_mismatch() {
+    let mut response = fixture("data");
+    response["protocolVersion"] = json!(ENVD_PROTOCOL_VERSION + 1);
+    let url = server(move |mut socket| async move {
+        answer_initialize(&mut socket, response).await;
+        while socket.next().await.is_some() {}
+    })
+    .await;
+    assert!(matches!(
+        DataClient::connect_initialized(&url, options()).await,
+        Err(ClientError::VersionMismatch { remote, .. }) if remote == ENVD_PROTOCOL_VERSION + 1
+    ));
+}
 
-    let response = client
-        .start_jobs(&StartJobsParams {
-            namespace: "session_1".to_owned(),
-            request_id: "request-1".to_owned(),
-            jobs: vec![JobStartSpec {
-                job_id: JobId::new("job-1"),
-                name: None,
-                argv: vec![
-                    "/bin/sh".to_owned(),
-                    "-c".to_owned(),
-                    "printf ok".to_owned(),
-                ],
-                cwd: None,
-                env: Default::default(),
-                secret_env: BTreeMap::new(),
-                stdin: None,
-                timeout_ms: Some(1_000),
-                depends_on: Vec::new(),
-                dependency_policy: JobDependencyPolicy::AllSucceeded,
-                queue_key: None,
-            }],
+#[tokio::test(flavor = "current_thread")]
+async fn a_controller_answering_a_data_client_is_the_wrong_plane() {
+    let url = server(|mut socket| async move {
+        answer_initialize(&mut socket, fixture("controller")).await;
+        while socket.next().await.is_some() {}
+    })
+    .await;
+    assert!(matches!(
+        DataClient::connect_initialized(&url, options()).await,
+        Err(ClientError::WrongPlane {
+            expected: Plane::Data,
+            actual: Plane::Controller
         })
-        .await
-        .expect("response");
-
-    assert_eq!(response.jobs[0].job_id.as_str(), "job-1");
+    ));
+}
 
-    let transport = client.into_rpc().into_inner();
-    assert_eq!(transport.sent[0]["method"], "job/start");
-    assert_eq!(transport.sent[0]["params"]["jobs"][0]["jobId"], "job-1");
-    assert_eq!(transport.sent[0]["params"]["jobs"][0]["argv"][0], "/bin/sh");
+#[tokio::test(flavor = "current_thread")]
+async fn controller_clients_check_their_own_plane_and_version() {
+    let url = server(|mut socket| async move {
+        let request = next_request(&mut socket).await.expect("initialize");
+        assert_eq!(
+            request.params["protocolVersion"],
+            json!(CONTROLLER_PROTOCOL_VERSION)
+        );
+        send(
+            &mut socket,
+            Response::success(request.id, &fixture("controller")),
+        )
+        .await;
+        while socket.next().await.is_some() {}
+    })
+    .await;
+    let (client, initialize) = ControllerClient::connect_initialized(&url, options())
+        .await
+        .expect("connect");
+    let expected: ControllerInitializeResponse =
+        serde_json::from_value(fixture("controller")).expect("fixture");
+    assert_eq!(initialize, expected);
+    assert!(initialize.capabilities.ingress);
+    client.close().await.expect("close");
 }
 
-#[tokio::test]
-async fn data_client_sends_typed_job_list_request() {
-    let transport = MockTransport::with_recv([json!({
-        "jsonrpc": "2.0",
-        "id": 1,
-        "result": {
-            "jobs": [
-                {
-                    "createdAtMs": 2,
-                    "jobId": "job-2",
-                    "namespace": "session_1",
-                    "status": "running"
-                }
-            ]
+#[tokio::test(flavor = "current_thread")]
+async fn pipelined_calls_are_matched_by_id() {
+    let url = server(|mut socket| async move {
+        answer_initialize(&mut socket, fixture("data")).await;
+        let first = next_request(&mut socket).await.expect("first");
+        let second = next_request(&mut socket).await.expect("second");
+        // Answer in reverse order; each result names its own id.
+        for request in [second, first] {
+            let Id::Number(id) = request.id else {
+                panic!("numeric ids")
+            };
+            send(&mut socket, Response::success(request.id, &idle(id as u64))).await;
         }
-    })]);
-    let mut client = EnvironmentDataClient::new(transport);
-
-    let response = client
-        .list_jobs(&ListJobsParams {
-            namespace: "session_1".to_owned(),
-            limit: Some(5),
-        })
+        while socket.next().await.is_some() {}
+    })
+    .await;
+    let (client, _) = DataClient::connect_initialized(&url, options())
         .await
-        .expect("response");
-
-    assert_eq!(response.jobs[0].job_id.as_str(), "job-2");
-
-    let transport = client.into_rpc().into_inner();
-    assert_eq!(transport.sent[0]["method"], "job/list");
-    assert_eq!(transport.sent[0]["params"]["namespace"], "session_1");
-    assert_eq!(transport.sent[0]["params"]["limit"], 5);
+        .expect("connect");
+    let (first, second) = tokio::join!(
+        client.call::<EnvGetIdle>(&GetIdleParams {}),
+        client.get_idle(&GetIdleParams {}),
+    );
+    let (first, second) = (first.expect("first"), second.expect("second"));
+    assert_ne!(first.idle_for_ms, second.idle_for_ms);
+    assert!(
+        first.idle_for_ms < second.idle_for_ms,
+        "first sent, first id"
+    );
 }
 
-#[tokio::test]
-async fn data_client_stashes_notifications_seen_while_waiting_for_response() {
-    let transport = MockTransport::with_recv([
-        json!({
-            "jsonrpc": "2.0",
-            "method": PROCESS_OUTPUT_METHOD,
-            "params": {
-                "chunk": "b2sK",
-                "processId": "proc-1",
-                "seq": 1,
-                "stream": "stdout"
-            }
-        }),
-        json!({
-            "jsonrpc": "2.0",
-            "id": 1,
-            "result": {
-                "data": "aGk="
-            }
-        }),
-    ]);
-    let mut client = EnvironmentDataClient::new(transport);
-
-    client
-        .read_file(&ReadFileParams {
-            path: EnvironmentPath::new("README.md").expect("path"),
-            offset: None,
-            max_bytes: None,
-        })
+#[tokio::test(flavor = "current_thread")]
+async fn a_server_notification_fails_pending_calls_and_closes() {
+    let url = server(|mut socket| async move {
+        answer_initialize(&mut socket, fixture("data")).await;
+        let _ = next_request(&mut socket).await.expect("request");
+        socket
+            .send(Message::text(
+                r#"{"jsonrpc":"2.0","method":"process/output","params":{}}"#,
+            ))
+            .await
+            .expect("send notification");
+        while socket.next().await.is_some() {}
+    })
+    .await;
+    let (client, _) = DataClient::connect_initialized(&url, options())
         .await
-        .expect("response");
+        .expect("connect");
+    assert!(matches!(
+        client.get_idle(&GetIdleParams {}).await,
+        Err(ClientError::InvalidMessage(_))
+    ));
+    assert!(client.is_closed());
+    assert!(matches!(
+        client.get_idle(&GetIdleParams {}).await,
+        Err(ClientError::InvalidMessage(_))
+    ));
+}
 
-    let notification = client
-        .next_notification()
+#[tokio::test(flavor = "current_thread")]
+async fn a_binary_frame_is_a_protocol_violation() {
+    let url = server(|mut socket| async move {
+        answer_initialize(&mut socket, fixture("data")).await;
+        let _ = next_request(&mut socket).await.expect("request");
+        socket
+            .send(Message::binary(b"{}".to_vec()))
+            .await
+            .expect("send binary");
+        while socket.next().await.is_some() {}
+    })
+    .await;
+    let (client, _) = DataClient::connect_initialized(&url, options())
         .await
-        .expect("notification read")
-        .expect("notification");
-    assert_eq!(notification.method, PROCESS_OUTPUT_METHOD);
-    assert_eq!(notification.params["processId"], "proc-1");
+        .expect("connect");
+    assert!(matches!(
+        client.get_idle(&GetIdleParams {}).await,
+        Err(ClientError::InvalidMessage(_))
+    ));
 }
 
-#[tokio::test]
-async fn data_client_maps_protocol_error_payloads() {
-    let transport = MockTransport::with_recv([json!({
-        "jsonrpc": "2.0",
-        "id": 1,
-        "error": {
-            "code": "notFound",
-            "message": "missing"
+#[tokio::test(flavor = "current_thread")]
+async fn a_deadline_cancels_an_abortable_call() {
+    let (cancelled, mut cancels) = mpsc::unbounded_channel();
+    let url = server(move |mut socket| async move {
+        answer_initialize(&mut socket, fixture("data")).await;
+        let read = next_request(&mut socket).await.expect("process/read");
+        assert_eq!(read.method, "process/read");
+        while let Some(Ok(message)) = socket.next().await {
+            if let Message::Text(text) = message
+                && let Ok(RpcMessage::Notification(notification)) = jsonrpc::parse(&text)
+            {
+                assert_eq!(notification.method, CancelRequest::NAME);
+                let params: CancelRequestParams = notification.params().expect("params");
+                let _ = cancelled.send((params.id, read.id.clone()));
+                // The late answer is discarded by the client.
+                send(
+                    &mut socket,
+                    Response::failure(Some(read.id.clone()), ProtocolError::cancelled()),
+                )
+                .await;
+            }
         }
-    })]);
-    let mut client = EnvironmentDataClient::new(transport);
-
+    })
+    .await;
+    let (client, _) = DataClient::connect_initialized(&url, options())
+        .await
+        .expect("connect");
     let error = client
-        .read_file(&ReadFileParams {
-            path: EnvironmentPath::new("missing.txt").expect("path"),
-            offset: None,
-            max_bytes: None,
-        })
+        .call_with_timeout::<environment_protocol::manifest::ProcessRead>(
+            &read_params(),
+            Duration::from_millis(50),
+        )
         .await
-        .expect_err("environment protocol error");
-
-    match error {
-        EnvironmentClientError::Protocol(error) => {
-            assert_eq!(error.code, EnvironmentProtocolErrorCode::NotFound)
-        }
-        other => panic!("unexpected error {other:?}"),
-    }
+        .expect_err("deadline");
+    assert!(
+        matches!(error, ClientError::DeadlineExceeded { .. }),
+        "{error:?}"
+    );
+    let (cancelled_id, read_id) = tokio::time::timeout(Duration::from_secs(5), cancels.recv())
+        .await
+        .expect("cancel in time")
+        .expect("cancel");
+    assert_eq!(cancelled_id, read_id);
+    assert!(
+        !client.is_closed(),
+        "a deadline leaves the connection usable"
+    );
 }
 
-#[tokio::test]
-async fn controller_client_sends_typed_initialize_request() {
-    let transport = MockTransport::with_recv([json!({
-        "jsonrpc": "2.0",
-        "id": 1,
-        "result": {
-            "capabilities": {
-                "closeTarget": true,
-                "createTarget": true,
-                "getTarget": true,
-                "listTargets": true
-            },
-            "implementation": {
-                "name": "test-controller",
-                "version": "0.1.0"
-            },
-            "protocolVersion": 2
+#[tokio::test(flavor = "current_thread")]
+async fn a_dropped_abortable_call_is_cancelled() {
+    let (cancelled, mut cancels) = mpsc::unbounded_channel();
+    let url = server(move |mut socket| async move {
+        answer_initialize(&mut socket, fixture("data")).await;
+        let read = next_request(&mut socket).await.expect("process/read");
+        while let Some(Ok(message)) = socket.next().await {
+            if let Message::Text(text) = message
+                && let Ok(RpcMessage::Notification(notification)) = jsonrpc::parse(&text)
+            {
+                let params: CancelRequestParams = notification.params().expect("params");
+                let _ = cancelled.send(params.id == read.id);
+            }
         }
-    })]);
-    let mut client = EnvironmentProviderClient::new(transport);
-
-    let response = client
-        .initialize(&ControllerInitializeParams {
-            protocol_version: CURRENT_PROTOCOL_VERSION,
-            client_name: "lightspeed-test".to_owned(),
-        })
+    })
+    .await;
+    let (client, _) = DataClient::connect_initialized(&url, options())
         .await
-        .expect("response");
-
-    assert!(response.capabilities.create_target);
-    assert_eq!(response.implementation.name, "test-controller");
-
-    let transport = client.into_rpc().into_inner();
-    assert_eq!(transport.sent[0]["method"], "controller/initialize");
-    assert_eq!(transport.sent[0]["params"]["clientName"], "lightspeed-test");
+        .expect("connect");
+    let params = read_params();
+    let read = client.read_process(&params);
+    assert!(
+        tokio::time::timeout(Duration::from_millis(50), read)
+            .await
+            .is_err(),
+        "the read waits"
+    );
+    let matched = tokio::time::timeout(Duration::from_secs(5), cancels.recv())
+        .await
+        .expect("cancel in time")
+        .expect("cancel");
+    assert!(matched, "the cancel names the dropped request");
 }
 
-#[tokio::test]
-async fn controller_client_sends_typed_adoption_request() {
-    let transport = MockTransport::with_recv([json!({
-        "jsonrpc": "2.0",
-        "id": 1,
-        "result": {
-            "target": {
-                "targetId": "target-adopted",
-                "status": "starting",
-                "scope": { "type": "default" },
-                "capabilities": {}
+#[tokio::test(flavor = "current_thread")]
+async fn pending_calls_keep_the_connection_alive_with_pings() {
+    let pings = Arc::new(AtomicUsize::new(0));
+    let counted = pings.clone();
+    let url = server(move |mut socket| async move {
+        answer_initialize(&mut socket, fixture("data")).await;
+        let request = next_request(&mut socket).await.expect("request");
+        let quiet = tokio::time::sleep(Duration::from_millis(300));
+        tokio::pin!(quiet);
+        loop {
+            tokio::select! {
+                _ = &mut quiet => break,
+                message = socket.next() => match message {
+                    Some(Ok(Message::Ping(_))) => { counted.fetch_add(1, Ordering::SeqCst); }
+                    Some(Ok(_)) => {}
+                    _ => return,
+                },
             }
         }
-    })]);
-    let mut client = EnvironmentProviderClient::new(transport);
+        send(&mut socket, Response::success(request.id, &idle(0))).await;
+        while socket.next().await.is_some() {}
+    })
+    .await;
+    let mut options = options();
+    options.keepalive_interval = Duration::from_millis(40);
+    let (client, _) = DataClient::connect_initialized(&url, options)
+        .await
+        .expect("connect");
+    client.get_idle(&GetIdleParams {}).await.expect("idle");
+    assert!(
+        pings.load(Ordering::SeqCst) >= 3,
+        "pinged {} times",
+        pings.load(Ordering::SeqCst)
+    );
+}
 
-    let response = client
-        .adopt_target(&AdoptTargetParams {
-            request_id: "adopt-1".to_owned(),
-            environment_id: "environment-1".to_owned(),
-            incarnation_id: "incarnation-1".to_owned(),
-            binding: ProviderBindingContext {
-                universe_id: "universe-1".to_owned(),
-                binding_id: "primary".to_owned(),
-            },
-            source_target: "legacy/hand-built-vm".to_owned(),
+#[tokio::test(flavor = "current_thread")]
+async fn the_default_request_timeout_applies_to_every_call() {
+    let url = server(|mut socket| async move {
+        answer_initialize(&mut socket, fixture("data")).await;
+        while socket.next().await.is_some() {}
+    })
+    .await;
+    let (client, _) = DataClient::connect_initialized(
+        &url,
+        options().with_request_timeout(Duration::from_millis(50)),
+    )
+    .await
+    .expect("connect");
+    assert!(matches!(
+        client.get_idle(&GetIdleParams {}).await,
+        Err(ClientError::DeadlineExceeded { .. })
+    ));
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn oversized_requests_fail_without_being_sent() {
+    let calls = Arc::new(AtomicUsize::new(0));
+    let seen = calls.clone();
+    let client = DataClient::in_process(
+        serde_json::from_value(fixture("data")).expect("fixture"),
+        move |request: Request| {
+            seen.fetch_add(1, Ordering::SeqCst);
+            Box::pin(async move { Ok(Response::success(request.id, &json!({}))) })
+        },
+    );
+    let error = client
+        .write_file(&WriteFileParams {
+            path: EnvironmentPath::new("/workspace/big").expect("path"),
+            data: ByteChunk::new(vec![0_u8; MAX_MESSAGE_BYTES as usize]),
+            create: WriteCondition::default(),
+            if_match: None,
+            executable: false,
         })
         .await
-        .expect("response");
-    assert_eq!(response.target.target_id.as_str(), "target-adopted");
+        .expect_err("too large");
+    assert!(matches!(
+        error,
+        ClientError::PayloadTooLarge { limit_bytes: MAX_MESSAGE_BYTES, actual_bytes }
+            if actual_bytes > MAX_MESSAGE_BYTES
+    ));
+    assert_eq!(calls.load(Ordering::SeqCst), 0);
+}
 
-    let transport = client.into_rpc().into_inner();
-    assert_eq!(transport.sent[0]["method"], "controller/adoptTarget");
+#[tokio::test(flavor = "current_thread")]
+async fn in_process_clients_answer_through_the_handler() {
+    let client = DataClient::in_process(
+        serde_json::from_value(fixture("data")).expect("fixture"),
+        |request: Request| {
+            Box::pin(async move {
+                assert_eq!(request.method, "env/getIdle");
+                Ok(Response::success(request.id, &idle(7)))
+            })
+        },
+    );
     assert_eq!(
-        transport.sent[0]["params"]["sourceTarget"],
-        "legacy/hand-built-vm"
+        client.get_idle(&GetIdleParams {}).await.expect("idle"),
+        idle(7)
     );
 }
 
+#[allow(clippy::result_large_err)]
+fn refuse_upgrade(
+    _: &UpgradeRequest,
+    _: UpgradeResponse,
+) -> Result<UpgradeResponse, ErrorResponse> {
+    let mut response = ErrorResponse::new(None);
+    *response.status_mut() = StatusCode::UNAUTHORIZED;
+    Err(response)
+}
+
 #[tokio::test(flavor = "current_thread")]
-async fn data_client_transfer_methods_preserve_binary_payloads() {
-    use environment_protocol::data::transfer::*;
-    let entries = vec![TransferEntry {
-        path: "".into(),
-        content: TransferContent::File {
-            data: ByteChunk::from(vec![0, 255, 128]),
-            executable: true,
-        },
-    }];
-    let limits = TransferLimits {
-        max_entries: 1,
-        max_depth: 0,
-        max_file_bytes: 3,
-        max_total_bytes: 3,
-        max_duration_ms: 1000,
-    };
-    let transport = MockTransport::with_recv([
-        json!({"jsonrpc":"2.0", "id":1, "result": {"destination":"/file", "entries":1, "bytes":3, "retiredDirectory":null}}),
-        json!({"jsonrpc":"2.0", "id":2, "result": {"source":"/file", "entries":entries, "bytes":3}}),
-    ]);
-    let mut client = EnvironmentDataClient::new(transport);
-    let request = MaterializeParams {
-        destination: EnvironmentPath::new("/file").unwrap(),
-        entries: entries.clone(),
-        limits,
-        on_existing: TransferOnExisting::Error,
-    };
-    assert_eq!(client.materialize(&request).await.unwrap().bytes, 3);
-    let captured = client
-        .capture(&CaptureParams {
-            source: request.destination.clone(),
-            limits,
-        })
+async fn an_upgrade_refusal_reports_its_status() {
+    let listener = TcpListener::bind("127.0.0.1:0").await.expect("listener");
+    let url = format!("ws://{}", listener.local_addr().expect("address"));
+    tokio::spawn(async move {
+        let (stream, _) = listener.accept().await.expect("accept");
+        let _ = accept_hdr_async(stream, refuse_upgrade).await;
+    });
+    let error = DataClient::connect_initialized(&url, options())
         .await
-        .unwrap();
-    assert_eq!(captured.entries, entries);
-    let transport = client.into_rpc().into_inner();
-    assert_eq!(transport.sent[0]["method"], "fs/materialize");
+        .expect_err("refused");
+    assert!(
+        matches!(error, ClientError::UpgradeRejected { status: 401 }),
+        "{error:?}"
+    );
+    assert!(!error.is_retryable());
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn a_silent_server_hits_the_connect_deadline() {
+    let listener = TcpListener::bind("127.0.0.1:0").await.expect("listener");
+    let url = format!("ws://{}", listener.local_addr().expect("address"));
+    tokio::spawn(async move {
+        let (_stream, _) = listener.accept().await.expect("accept");
+        tokio::time::sleep(Duration::from_secs(30)).await;
+    });
+    let mut options = options();
+    options.connect_timeout = Duration::from_millis(100);
+    assert!(matches!(
+        DataClient::connect_initialized(&url, options).await,
+        Err(ClientError::ConnectTimeout { .. })
+    ));
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn unix_endpoints_upgrade_over_the_socket() {
+    let path = std::path::PathBuf::from(format!(
+        "/tmp/lightspeed-client-{}-{}.sock",
+        std::process::id(),
+        line!()
+    ));
+    let _ = std::fs::remove_file(&path);
+    let listener = UnixListener::bind(&path).expect("bind unix socket");
+    tokio::spawn(async move {
+        let (stream, _) = listener.accept().await.expect("accept");
+        let mut socket = accept_async(stream).await.expect("upgrade");
+        answer_initialize(&mut socket, fixture("data")).await;
+        while socket.next().await.is_some() {}
+    });
+    let endpoint = format!("unix://{}", path.display());
+    let (client, _) = DataClient::connect_initialized(&endpoint, options())
+        .await
+        .expect("connect over unix");
+    client.close().await.expect("close");
+    let _ = std::fs::remove_file(&path);
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn clients_connect_over_an_existing_byte_stream() {
+    let (client_end, server_end) = tokio::io::duplex(64 * 1024);
+    tokio::spawn(async move {
+        let mut socket = accept_async(server_end).await.expect("upgrade");
+        answer_initialize(&mut socket, fixture("data")).await;
+        let request = next_request(&mut socket).await.expect("request");
+        send(&mut socket, Response::success(request.id, &idle(3))).await;
+        while socket.next().await.is_some() {}
+    });
+    let (client, _) = DataClient::connect_initialized_over(client_end, options())
+        .await
+        .expect("connect over duplex");
     assert_eq!(
-        transport.sent[0]["params"],
-        serde_json::to_value(request).unwrap()
+        client.get_idle(&GetIdleParams {}).await.expect("idle"),
+        idle(3)
     );
-    assert_eq!(transport.sent[1]["method"], "fs/capture");
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn conformance_reports_an_unreachable_controller() {
+    let listener = TcpListener::bind("127.0.0.1:0").await.expect("listener");
+    let url = format!("ws://{}", listener.local_addr().expect("address"));
+    drop(listener);
+    let owner = Arc::new(|| TargetOwner {
+        universe_id: UniverseId::new("u1").unwrap(),
+        binding_id: BindingId::new("b1").unwrap(),
+        environment_id: EnvironmentId::new("e1").unwrap(),
+        incarnation_id: IncarnationId::new("i1").unwrap(),
+    });
+    let report = run(&ControllerConformance::new(
+        url,
+        options().with_bearer_token("credential"),
+        TemplateId::new("t1").unwrap(),
+        owner,
+    ))
+    .await;
+    assert!(!report.passed());
+    assert_eq!(report.checks.len(), 1);
+    assert_eq!(report.checks[0].name, "initialize");
+    assert!(report.into_result().is_err());
 }
diff --git a/crates/environment-daemon/Cargo.toml b/crates/environment-daemon/Cargo.toml
index c415affcf..5f35ededb 100644
--- a/crates/environment-daemon/Cargo.toml
+++ b/crates/environment-daemon/Cargo.toml
@@ -6,13 +6,12 @@ edition = "2024"
 [dependencies]
 hex = "0.4"
 anyhow = "1"
-api = { path = "../api" }
 clap = { version = "4", features = ["derive", "env"] }
 dotenvy = "0.15"
 release-info = { path = "../release-info" }
 futures-util = "0.3"
 flate2 = "1"
-glob = "0.3"
+globset = "0.4"
 grep-regex = "0.1"
 grep-searcher = "0.1"
 environment-protocol = { path = "../environment-protocol" }
@@ -25,7 +24,8 @@ sha2 = "0.11"
 tar = { version = "0.4", default-features = false }
 tempfile = "3"
 thiserror = "2"
-tokio = { version = "1", features = ["fs", "io-util", "macros", "net", "process", "rt", "signal", "sync", "time"] }
+tokio = { version = "1", features = ["fs", "io-util", "macros", "net", "process", "rt", "rt-multi-thread", "signal", "sync", "time"] }
+tokio-util = "0.7"
 tokio-tungstenite = { version = "0.30", default-features = false, features = ["connect", "handshake", "rustls-tls-webpki-roots"] }
 ed25519-dalek = { version = "3", features = ["rand_core"] }
 rand = "0.10"
@@ -40,7 +40,6 @@ rustix = { version = "1", features = ["fs", "process"] }
 libc = "0.2"
 
 [dev-dependencies]
-async-trait = "0.1"
 store-fs = { path = "../store-fs" }
 vfs = { path = "../vfs" }
 harness = { path = "../harness" }
diff --git a/crates/environment-daemon/src/config.rs b/crates/environment-daemon/src/config.rs
index cb3fd0ed9..e9abbe912 100644
--- a/crates/environment-daemon/src/config.rs
+++ b/crates/environment-daemon/src/config.rs
@@ -9,7 +9,11 @@ use std::{
 
 use anyhow::{Context, Result, bail};
 use clap::{Parser, Subcommand};
-use environment_protocol::{registration::validate_registration_metadata, shared::SecretString};
+use environment_protocol::{
+    bytes::SecretString,
+    metadata::{DisplayName, Metadata},
+    routes::{CanonicalOrigin, canonical_origin, gateway_stream_url},
+};
 
 /// Listener address when the daemon is not registering outbound.
 pub const DEFAULT_LISTEN: &str = "127.0.0.1:19091";
@@ -20,6 +24,13 @@ pub const ENV_PREFIX: &str = "LIGHTSPEED_ENVD_";
 /// Internal one-exec handoff for a registration key that configuration has
 /// already read and scrubbed. Never documented as operator configuration.
 pub(crate) const REEXEC_REGISTRATION_KEY_ENV: &str = "LIGHTSPEED_ENVD_REEXEC_REGISTRATION_KEY";
+/// Set on the re-executed replacement after an automatic upgrade: the
+/// gateway protocol version the upgrade targeted. A later challenge naming
+/// that same version is refused instead of upgrading again.
+pub(crate) const AUTO_UPGRADE_ATTEMPTED_ENV: &str = "LIGHTSPEED_ENVD_AUTO_UPGRADE_ATTEMPTED";
+/// Name of the state directory below `$XDG_STATE_HOME` (or
+/// `$HOME/.local/state`).
+pub const STATE_DIR_NAME: &str = "lightspeed-envd";
 
 #[derive(Parser, Debug)]
 #[command(
@@ -39,23 +50,25 @@ pub struct DaemonArgs {
     #[arg(long, env = "LIGHTSPEED_ENVD_LISTEN")]
     pub listen: Option<ListenAddr>,
 
-    /// Public environment-gateway connect URL to dial outbound
-    /// (`wss://host/environment-gateway/connect`).
+    /// Environment-gateway connect URL to dial outbound
+    /// (`wss://host[/prefix]/environment-gateway/connect`). Stream sockets
+    /// are dialed on the same origin and prefix.
     #[arg(long, env = "LIGHTSPEED_ENVD_GATEWAY_URL", global = true)]
     pub gateway_url: Option<String>,
 
     /// Discovery document used for manual or automatic upgrades. Defaults to
-    /// `/.well-known/lightspeed-envd` on the configured gateway host.
+    /// `/.well-known/lightspeed-envd` on the configured gateway origin.
     #[arg(long, env = "LIGHTSPEED_ENVD_DISCOVERY_URL", global = true)]
     pub discovery_url: Option<String>,
 
-    /// Upgrade automatically when an outbound gateway advertises a different
-    /// environment protocol version.
+    /// Upgrade automatically when an outbound gateway challenges with a
+    /// different environment protocol version.
     #[arg(long, env = "LIGHTSPEED_ENVD_AUTO_UPGRADE", default_value_t = false)]
     pub auto_upgrade: bool,
 
     /// Registration key admitting this daemon as a new environment. Read
-    /// once and removed from the process environment.
+    /// once, removed from the process environment, and sent only until the
+    /// first admission.
     #[arg(long, env = "LIGHTSPEED_ENVD_REGISTRATION_KEY", hide_env_values = true)]
     pub registration_key: Option<String>,
 
@@ -63,15 +76,16 @@ pub struct DaemonArgs {
     #[arg(long, env = "LIGHTSPEED_ENVD_REGISTRATION_KEY_FILE")]
     pub registration_key_file: Option<PathBuf>,
 
-    /// Display-name hint recorded on the environment at first registration.
+    /// Display name recorded on the environment at first registration.
     #[arg(long, env = "LIGHTSPEED_ENVD_REGISTRATION_NAME")]
     pub registration_name: Option<String>,
 
-    /// Bounded JSON object of string correlation metadata.
+    /// Bounded JSON object of string correlation metadata, recorded at
+    /// first registration.
     #[arg(long, env = "LIGHTSPEED_ENVD_REGISTRATION_METADATA")]
     pub registration_metadata: Option<String>,
 
-    /// Where to write the registration receipt JSON once accepted.
+    /// Where to write the registration receipt JSON once admitted.
     #[arg(long, env = "LIGHTSPEED_ENVD_REGISTRATION_RECEIPT")]
     pub registration_receipt: Option<PathBuf>,
 
@@ -85,6 +99,10 @@ pub struct DaemonArgs {
     #[arg(long, env = "LIGHTSPEED_ENVD_FS_ROOT")]
     pub fs_root: Option<PathBuf>,
 
+    /// Daemon key, job records and transfer journal. Defaults to
+    /// `$XDG_STATE_HOME/lightspeed-envd`, else
+    /// `$HOME/.local/state/lightspeed-envd`. The data plane never addresses
+    /// it, wherever it lives.
     #[arg(long, env = "LIGHTSPEED_ENVD_STATE_DIR")]
     pub state_dir: Option<PathBuf>,
 
@@ -155,6 +173,8 @@ pub struct DaemonConfig {
     pub listen: Option<ListenAddr>,
     pub cwd: PathBuf,
     pub fs_root: PathBuf,
+    /// Created `0700` when missing. Never addressable through the data
+    /// plane.
     pub state_dir: PathBuf,
     pub read_only_fs: bool,
     /// Outbound registration, when a gateway URL is configured.
@@ -167,11 +187,15 @@ pub struct DaemonConfig {
 /// it is registration-key policy, and the daemon behaves the same either way.
 #[derive(Clone)]
 pub struct RegistrationConfig {
+    /// The gateway connect URL; it must end with `CONNECT_PATH`.
     pub gateway_url: String,
-    /// Present only until the first successful registration consumes it.
+    /// Sent with `registration/register` until the first admission, then
+    /// dropped (never handed to an upgraded replacement after that).
     pub registration_key: Option<SecretString>,
-    pub display_name: Option<String>,
-    pub metadata: BTreeMap<String, String>,
+    /// Read by the gateway only at first admission.
+    pub display_name: Option<DisplayName>,
+    /// Read by the gateway only at first admission.
+    pub metadata: Metadata,
     pub receipt_path: Option<PathBuf>,
     pub ca_file: Option<PathBuf>,
     /// Absolute discovery URL reported on mismatch and used by automatic
@@ -180,6 +204,9 @@ pub struct RegistrationConfig {
     /// Present only when mismatch-triggered replacement and re-exec is opted
     /// in. The argument vector is captured before the daemon starts serving.
     pub(crate) auto_upgrade: Option<RestartInvocation>,
+    /// The gateway protocol an automatic upgrade already targeted in this
+    /// process lineage.
+    pub(crate) upgrade_attempted_for: Option<u32>,
 }
 
 #[derive(Clone)]
@@ -203,10 +230,22 @@ impl std::fmt::Debug for RegistrationConfig {
             .field("ca_file", &self.ca_file)
             .field("discovery_url", &self.discovery_url)
             .field("auto_upgrade", &self.auto_upgrade.is_some())
+            .field("upgrade_attempted_for", &self.upgrade_attempted_for)
             .finish()
     }
 }
 
+/// The URLs one gateway connect URL determines.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct GatewayUrls {
+    /// The connect URL as configured.
+    pub connect: String,
+    /// What the registration signature binds.
+    pub origin: CanonicalOrigin,
+    /// Where every reverse-dialed stream goes.
+    pub stream: String,
+}
+
 impl RegistrationConfig {
     /// Registration that never replaces the running binary: no key, name,
     /// metadata, receipt, or CA file until the caller sets them. The CLI
@@ -217,57 +256,66 @@ impl RegistrationConfig {
             gateway_url,
             registration_key: None,
             display_name: None,
-            metadata: BTreeMap::new(),
+            metadata: Metadata::default(),
             receipt_path: None,
             ca_file: None,
             discovery_url,
             auto_upgrade: None,
+            upgrade_attempted_for: None,
         }
     }
 
-    pub fn validate(&self) -> Result<()> {
-        validate_gateway_url(&self.gateway_url)?;
-        validate_registration_metadata(self.display_name.as_deref(), &self.metadata)
-            .map_err(|message| anyhow::anyhow!("registration metadata: {message}"))?;
+    pub fn validate(&self) -> Result<GatewayUrls> {
+        let urls = gateway_urls(&self.gateway_url)?;
         if let Some(key) = &self.registration_key
             && (key.is_empty() || key.expose().chars().any(char::is_whitespace))
         {
             bail!("registration key must be a single non-empty token");
         }
         crate::upgrade::validate_discovery_url(&self.discovery_url)?;
-        Ok(())
+        Ok(urls)
     }
 }
 
-/// Plain `ws://` is accepted only toward loopback; everything else must be
-/// `wss://` so the registration key never crosses a network in the clear.
-pub fn validate_gateway_url(url: &str) -> Result<()> {
-    let rest = if let Some(rest) = url.strip_prefix("wss://") {
-        rest
-    } else if let Some(rest) = url.strip_prefix("ws://") {
-        let host = rest
-            .split(['/', '?', '#'])
-            .next()
-            .unwrap_or_default()
-            .rsplit_once(':')
-            .map(|(host, _)| host)
-            .unwrap_or(rest.split(['/', '?', '#']).next().unwrap_or_default());
-        let host = host.trim_start_matches('[').trim_end_matches(']');
-        let loopback = host == "localhost"
-            || host
-                .parse::<std::net::IpAddr>()
-                .is_ok_and(|ip| ip.is_loopback());
-        if !loopback {
-            bail!("gateway URL must use wss:// except toward loopback: {url}");
+/// Validate a gateway connect URL and derive what it determines. Plain
+/// `ws://` is accepted only toward loopback; everything else must be
+/// `wss://`, so neither the registration key nor any stream crosses a
+/// network in the clear. The path must end with `CONNECT_PATH` (a prefix
+/// before it is kept), with no query or fragment.
+pub fn gateway_urls(url: &str) -> Result<GatewayUrls> {
+    let scheme = url.split_once("://").map(|(scheme, _)| scheme);
+    match scheme {
+        Some("wss") => {}
+        Some("ws") => {
+            let origin = canonical_origin(url)?;
+            let host = origin
+                .as_str()
+                .trim_start_matches("ws://")
+                .rsplit_once(':')
+                .filter(|(_, port)| port.bytes().all(|byte| byte.is_ascii_digit()))
+                .map_or(origin.as_str().trim_start_matches("ws://"), |(host, _)| {
+                    host
+                })
+                .trim_start_matches('[')
+                .trim_end_matches(']')
+                .to_owned();
+            let loopback = host == "localhost"
+                || host
+                    .parse::<std::net::IpAddr>()
+                    .is_ok_and(|ip| ip.is_loopback());
+            if !loopback {
+                bail!("gateway URL must use wss:// except toward loopback: {url}");
+            }
         }
-        rest
-    } else {
-        bail!("gateway URL must start with wss:// (or ws:// toward loopback): {url}");
-    };
-    if rest.is_empty() || rest.starts_with('/') {
-        bail!("gateway URL has no host: {url}");
+        _ => bail!("gateway URL must start with wss:// (or ws:// toward loopback): {url}"),
     }
-    Ok(())
+    let origin = canonical_origin(url).with_context(|| format!("gateway URL {url}"))?;
+    let stream = gateway_stream_url(url).with_context(|| format!("gateway URL {url}"))?;
+    Ok(GatewayUrls {
+        connect: url.to_owned(),
+        origin,
+        stream,
+    })
 }
 
 /// Names of every daemon configuration variable present in the process
@@ -293,9 +341,13 @@ impl DaemonArgs {
             install_path: started_executable().context("find the started envd executable")?,
             target: release_info::TARGET.to_owned(),
             expected_protocol: None,
+            other_than: None,
         })
     }
 
+    /// Resolve the configuration. Must run before the async runtime starts
+    /// any thread: it removes secret-bearing variables from the process
+    /// environment.
     pub fn into_config(self) -> Result<DaemonConfig> {
         let cwd = canonical_dir(
             self.cwd
@@ -313,71 +365,20 @@ impl DaemonArgs {
                 fs_root.display()
             );
         }
-        let state_dir = match self.state_dir {
-            Some(path) if path.is_absolute() => path,
-            Some(path) => cwd.join(path),
-            None => cwd.join(".lightspeed-envd"),
-        };
+        let state_dir = resolve_state_dir(self.state_dir, &cwd, |name| std::env::var_os(name))?;
         let scrubbed_env = scrubbed_env_names();
         let registration = match self.gateway_url {
-            Some(gateway_url) => {
-                let discovery_url = crate::upgrade::resolve_discovery_url(
-                    Some(&gateway_url),
-                    self.discovery_url.as_deref(),
-                )?;
-                let auto_upgrade = self
-                    .auto_upgrade
-                    .then(|| -> Result<RestartInvocation> {
-                        Ok(RestartInvocation {
-                            executable: started_executable()
-                                .context("find the started envd executable")?,
-                            arg0: std::env::args_os()
-                                .next()
-                                .ok_or_else(|| anyhow::anyhow!("process has no argv[0]"))?,
-                            args: std::env::args_os().skip(1).collect(),
-                        })
-                    })
-                    .transpose()?;
-                let reexec_registration_key = std::env::var(REEXEC_REGISTRATION_KEY_ENV).ok();
-                let registration_key = if let Some(key) = reexec_registration_key {
-                    Some(SecretString::new(key))
-                } else {
-                    match (self.registration_key, self.registration_key_file) {
-                        (Some(_), Some(_)) => {
-                            bail!("set either the registration key or the key file, not both")
-                        }
-                        (Some(key), None) => Some(SecretString::new(key.trim().to_owned())),
-                        (None, Some(path)) => Some(SecretString::new(
-                            std::fs::read_to_string(&path)
-                                .with_context(|| {
-                                    format!("read registration key file {}", path.display())
-                                })?
-                                .trim()
-                                .to_owned(),
-                        )),
-                        (None, None) => None,
-                    }
-                };
-                let metadata = match self.registration_metadata.as_deref() {
-                    Some(json) if !json.trim().is_empty() => {
-                        serde_json::from_str::<BTreeMap<String, String>>(json)
-                            .context("registration metadata must be a JSON object of strings")?
-                    }
-                    _ => BTreeMap::new(),
-                };
-                let registration = RegistrationConfig {
-                    gateway_url,
-                    registration_key,
-                    display_name: self.registration_name.filter(|name| !name.is_empty()),
-                    metadata,
-                    receipt_path: self.registration_receipt,
-                    ca_file: self.ca_file,
-                    discovery_url,
-                    auto_upgrade,
-                };
-                registration.validate()?;
-                Some(registration)
-            }
+            Some(gateway_url) => Some(registration_config(
+                gateway_url,
+                self.discovery_url,
+                self.auto_upgrade,
+                self.registration_key,
+                self.registration_key_file,
+                self.registration_name,
+                self.registration_metadata,
+                self.registration_receipt,
+                self.ca_file,
+            )?),
             None => {
                 if self.registration_key.is_some() || self.registration_key_file.is_some() {
                     bail!("a registration key needs LIGHTSPEED_ENVD_GATEWAY_URL to dial");
@@ -406,6 +407,140 @@ impl DaemonArgs {
     }
 }
 
+#[allow(clippy::too_many_arguments)]
+fn registration_config(
+    gateway_url: String,
+    discovery_url: Option<String>,
+    auto_upgrade: bool,
+    registration_key: Option<String>,
+    registration_key_file: Option<PathBuf>,
+    registration_name: Option<String>,
+    registration_metadata: Option<String>,
+    registration_receipt: Option<PathBuf>,
+    ca_file: Option<PathBuf>,
+) -> Result<RegistrationConfig> {
+    let discovery_url =
+        crate::upgrade::resolve_discovery_url(Some(&gateway_url), discovery_url.as_deref())?;
+    let auto_upgrade = auto_upgrade
+        .then(|| -> Result<RestartInvocation> {
+            Ok(RestartInvocation {
+                executable: started_executable().context("find the started envd executable")?,
+                arg0: std::env::args_os()
+                    .next()
+                    .ok_or_else(|| anyhow::anyhow!("process has no argv[0]"))?,
+                args: std::env::args_os().skip(1).collect(),
+            })
+        })
+        .transpose()?;
+    let upgrade_attempted_for = match std::env::var(AUTO_UPGRADE_ATTEMPTED_ENV) {
+        Ok(value) => Some(value.trim().parse::<u32>().with_context(|| {
+            format!("{AUTO_UPGRADE_ATTEMPTED_ENV} must be a protocol version: {value}")
+        })?),
+        Err(_) => None,
+    };
+    let reexec_registration_key = std::env::var(REEXEC_REGISTRATION_KEY_ENV).ok();
+    let registration_key = if let Some(key) = reexec_registration_key {
+        Some(SecretString::new(key))
+    } else {
+        match (registration_key, registration_key_file) {
+            (Some(_), Some(_)) => {
+                bail!("set either the registration key or the key file, not both")
+            }
+            (Some(key), None) => Some(SecretString::new(key.trim().to_owned())),
+            (None, Some(path)) => Some(SecretString::new(
+                std::fs::read_to_string(&path)
+                    .with_context(|| format!("read registration key file {}", path.display()))?
+                    .trim()
+                    .to_owned(),
+            )),
+            (None, None) => None,
+        }
+    };
+    let metadata = match registration_metadata.as_deref() {
+        Some(json) if !json.trim().is_empty() => Metadata::new(
+            serde_json::from_str::<BTreeMap<String, String>>(json)
+                .context("registration metadata must be a JSON object of strings")?,
+        )
+        .context("registration metadata")?,
+        _ => Metadata::default(),
+    };
+    let display_name = registration_name
+        .filter(|name| !name.is_empty())
+        .map(DisplayName::new)
+        .transpose()
+        .context("registration name")?;
+    let registration = RegistrationConfig {
+        gateway_url,
+        registration_key,
+        display_name,
+        metadata,
+        receipt_path: registration_receipt,
+        ca_file,
+        discovery_url,
+        auto_upgrade,
+        upgrade_attempted_for,
+    };
+    registration.validate()?;
+    Ok(registration)
+}
+
+/// The state directory, created `0700` and canonical. A defaulted
+/// directory must not lie inside `cwd`, the agent's working tree; an
+/// explicitly configured one may (confinement refuses data-plane access to
+/// it wherever it lives). A relative explicit path is taken against `cwd`.
+fn resolve_state_dir(
+    configured: Option<PathBuf>,
+    cwd: &Path,
+    env: impl Fn(&str) -> Option<OsString>,
+) -> Result<PathBuf> {
+    let (path, defaulted) = match configured {
+        Some(path) if path.is_absolute() => (path, false),
+        Some(path) => (cwd.join(path), false),
+        None => (default_state_dir(env)?, true),
+    };
+    let state_dir = prepare_state_dir(&path)?;
+    if defaulted && state_dir.starts_with(cwd) {
+        bail!(
+            "the default state directory {} lies inside cwd {}: set LIGHTSPEED_ENVD_STATE_DIR",
+            state_dir.display(),
+            cwd.display()
+        );
+    }
+    Ok(state_dir)
+}
+
+/// `$XDG_STATE_HOME/lightspeed-envd` when that variable is an absolute
+/// path, else `$HOME/.local/state/lightspeed-envd`.
+fn default_state_dir(env: impl Fn(&str) -> Option<OsString>) -> Result<PathBuf> {
+    if let Some(state_home) = env("XDG_STATE_HOME").map(PathBuf::from)
+        && state_home.is_absolute()
+    {
+        return Ok(state_home.join(STATE_DIR_NAME));
+    }
+    match env("HOME").map(PathBuf::from) {
+        Some(home) if home.is_absolute() => {
+            Ok(home.join(".local").join("state").join(STATE_DIR_NAME))
+        }
+        _ => bail!(
+            "neither XDG_STATE_HOME nor HOME names an absolute directory: set LIGHTSPEED_ENVD_STATE_DIR"
+        ),
+    }
+}
+
+/// Create the state directory when missing (`0700`; parents with default
+/// permissions), restrict it, and return its canonical path.
+pub fn prepare_state_dir(path: &Path) -> Result<PathBuf> {
+    std::fs::create_dir_all(path)
+        .with_context(|| format!("create state dir {}", path.display()))?;
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt as _;
+        std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o700))
+            .with_context(|| format!("restrict state dir {}", path.display()))?;
+    }
+    canonical_dir(path.to_path_buf(), "state dir")
+}
+
 /// Resolve argv[0] once, before serving anything, so replacement and re-exec
 /// use the path the operator or service manager launched rather than a later
 /// PATH lookup. Preserve a symlink at that path: the atomic replacement is of
@@ -434,17 +569,19 @@ fn started_executable() -> Result<PathBuf> {
     std::env::current_exe().context("fall back to the running executable path")
 }
 
-/// Drop the secret-bearing variables from this process's environment as soon
-/// as they have been read. Children additionally get every daemon variable
-/// removed at spawn; this narrows what an in-process bug could leak.
+/// Drop the secret-bearing and one-exec variables from this process's
+/// environment as soon as they have been read. Children additionally get
+/// every daemon variable removed at spawn; this narrows what an in-process
+/// bug could leak and what a later re-exec could inherit.
 fn forget_secret_env() {
     for name in [
         "LIGHTSPEED_ENVD_REGISTRATION_KEY",
         "LIGHTSPEED_ENVD_REGISTRATION_KEY_FILE",
         REEXEC_REGISTRATION_KEY_ENV,
+        AUTO_UPGRADE_ATTEMPTED_ENV,
     ] {
-        // SAFETY: called from configuration parsing on the main thread before
-        // the daemon spawns any thread that reads the environment.
+        // SAFETY: called from configuration parsing on the main thread
+        // before the async runtime or any other thread exists.
         unsafe { std::env::remove_var(name) };
     }
 }
@@ -483,7 +620,7 @@ mod tests {
             registration_metadata: None,
             registration_receipt: None,
             ca_file: None,
-            cwd: Some(temp.path().to_path_buf()),
+            cwd: Some(temp.path().join("work")),
             fs_root: Some(temp.path().to_path_buf()),
             state_dir: Some(temp.path().join("state")),
             read_only_fs: false,
@@ -491,9 +628,15 @@ mod tests {
         }
     }
 
+    fn temp() -> tempfile::TempDir {
+        let temp = tempfile::tempdir().expect("tempdir");
+        std::fs::create_dir(temp.path().join("work")).expect("work");
+        temp
+    }
+
     #[test]
     fn listener_config_needs_no_identity_or_secret() {
-        let temp = tempfile::tempdir().expect("tempdir");
+        let temp = temp();
         let config = DaemonArgs {
             listen: Some("127.0.0.1:0".parse().unwrap()),
             ..args(&temp)
@@ -531,7 +674,7 @@ mod tests {
 
     #[test]
     fn outbound_config_reads_the_key_once_and_disables_the_listener() {
-        let temp = tempfile::tempdir().expect("tempdir");
+        let temp = temp();
         let key_file = temp.path().join("key");
         std::fs::write(&key_file, "lsrk_secret\n").expect("write key");
         let config = DaemonArgs {
@@ -552,14 +695,11 @@ mod tests {
                 .map(|key| key.expose()),
             Some("lsrk_secret")
         );
-        assert_eq!(registration.display_name.as_deref(), Some("worker-1"));
         assert_eq!(
-            registration
-                .metadata
-                .get("harbor.trialId")
-                .map(String::as_str),
-            Some("t-1")
+            registration.display_name.as_ref().map(DisplayName::as_str),
+            Some("worker-1")
         );
+        assert_eq!(registration.metadata.get("harbor.trialId"), Some("t-1"));
         assert!(!format!("{registration:?}").contains("lsrk_secret"));
 
         let both = DaemonArgs {
@@ -588,14 +728,79 @@ mod tests {
     }
 
     #[test]
-    fn plain_websocket_gateway_urls_are_loopback_only() {
-        assert!(validate_gateway_url("wss://gateway.example/environment-gateway/connect").is_ok());
-        assert!(validate_gateway_url("ws://127.0.0.1:18080/environment-gateway/connect").is_ok());
-        assert!(validate_gateway_url("ws://localhost:18080/x").is_ok());
-        assert!(validate_gateway_url("ws://[::1]:18080/x").is_ok());
-        assert!(validate_gateway_url("ws://gateway.example/x").is_err());
-        assert!(validate_gateway_url("http://gateway.example/x").is_err());
-        assert!(validate_gateway_url("wss:///x").is_err());
+    fn gateway_urls_are_loopback_only_in_the_clear_and_end_with_the_connect_path() {
+        let urls = gateway_urls("wss://Gateway.example/ls/environment-gateway/connect").unwrap();
+        assert_eq!(urls.origin.as_str(), "wss://gateway.example");
+        assert_eq!(
+            urls.stream,
+            "wss://gateway.example/ls/environment-gateway/data"
+        );
+        for good in [
+            "ws://127.0.0.1:18080/environment-gateway/connect",
+            "ws://localhost:18080/environment-gateway/connect",
+            "ws://[::1]:18080/environment-gateway/connect",
+        ] {
+            assert!(gateway_urls(good).is_ok(), "{good}");
+        }
+        for bad in [
+            "ws://gateway.example/environment-gateway/connect",
+            "http://gateway.example/environment-gateway/connect",
+            "wss:///environment-gateway/connect",
+            "wss://gateway.example/x",
+            "wss://gateway.example/environment-gateway/connect?x=1",
+            "wss://user@gateway.example/environment-gateway/connect",
+        ] {
+            assert!(gateway_urls(bad).is_err(), "{bad}");
+        }
+    }
+
+    #[test]
+    fn the_default_state_dir_follows_xdg_and_stays_out_of_cwd() {
+        let env = |pairs: &'static [(&'static str, &'static str)]| {
+            move |name: &str| {
+                pairs
+                    .iter()
+                    .find(|(key, _)| *key == name)
+                    .map(|(_, value)| OsString::from(value))
+            }
+        };
+        assert_eq!(
+            default_state_dir(env(&[("XDG_STATE_HOME", "/xdg"), ("HOME", "/home/a")])).unwrap(),
+            PathBuf::from("/xdg/lightspeed-envd")
+        );
+        assert_eq!(
+            default_state_dir(env(&[("XDG_STATE_HOME", "relative"), ("HOME", "/home/a")])).unwrap(),
+            PathBuf::from("/home/a/.local/state/lightspeed-envd")
+        );
+        assert!(default_state_dir(env(&[])).is_err());
+
+        let temp = temp();
+        let cwd = temp.path().join("work").canonicalize().unwrap();
+        let home = cwd.clone();
+        let inside = resolve_state_dir(None, &cwd, |name| {
+            (name == "HOME").then(|| home.clone().into_os_string())
+        });
+        assert!(
+            inside.is_err(),
+            "a defaulted state dir inside cwd is refused"
+        );
+
+        let explicit = resolve_state_dir(Some(PathBuf::from(".envd")), &cwd, |_| None)
+            .expect("an explicit state dir inside cwd is allowed");
+        assert_eq!(explicit, cwd.join(".envd"));
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt as _;
+            let mode = std::fs::metadata(&explicit).unwrap().permissions().mode() & 0o777;
+            assert_eq!(mode, 0o700);
+        }
+
+        let outside_home = temp.path().canonicalize().unwrap().join("home");
+        let outside = resolve_state_dir(None, &cwd, |name| {
+            (name == "HOME").then(|| outside_home.clone().into_os_string())
+        })
+        .expect("a default outside cwd");
+        assert!(outside.ends_with(".local/state/lightspeed-envd"));
     }
 
     #[test]
@@ -622,11 +827,9 @@ mod tests {
 
     #[test]
     fn outbound_upgrade_configuration_derives_discovery_and_captures_restart() {
-        let temp = tempfile::tempdir().expect("tempdir");
+        let temp = temp();
         let config = DaemonArgs {
-            gateway_url: Some(
-                "wss://gateway.example/environment-gateway/connect?ignored=1".to_owned(),
-            ),
+            gateway_url: Some("wss://gateway.example/ls/environment-gateway/connect".to_owned()),
             auto_upgrade: true,
             ..args(&temp)
         }
diff --git a/crates/environment-daemon/src/dispatch.rs b/crates/environment-daemon/src/dispatch.rs
new file mode 100644
index 000000000..f9aca14bd
--- /dev/null
+++ b/crates/environment-daemon/src/dispatch.rs
@@ -0,0 +1,278 @@
+//! Data-plane request dispatch, driven by the protocol's method manifest.
+//!
+//! The connection loop ([`crate::server`]) owns the handshake and hands
+//! every request after `initialize` to [`handle_request`]. Dispatch looks
+//! the method up in [`manifest`], refuses it when its capability is absent,
+//! touches the idle clock for `use` methods, decodes the params strictly
+//! and calls the handler. Handlers receive a [`RequestContext`] whose
+//! cancellation token fires on `$/cancelRequest` and when the connection
+//! closes.
+
+use std::{future::Future, sync::Arc};
+
+use environment_protocol::{
+    error::{Capability, ProtocolError},
+    handshake::Plane,
+    jsonrpc,
+    manifest::{
+        self, Activity, DataInitialize, Direction, EnvGetIdle, FsCreateDirectory, FsGetMetadata,
+        FsGlobFiles, FsReadDirectory, FsReadFile, FsRemove, FsRename, FsScan, FsSearchText,
+        FsWriteFile, JobCancel, JobRead, JobStart, MessageKind, ProcessRead, ProcessStart,
+        ProcessTerminate, ProcessWrite, RequestMethod, TransferAbort, TransferAdvance,
+        TransferAppend, TransferBegin, TransferCommit, TransferGetStatus, TransferListMissing,
+        TransferRead, TransferReadInventory, TransferWrite,
+    },
+};
+use serde::Serialize;
+use serde_json::Value;
+use tokio_util::sync::CancellationToken;
+
+use crate::DaemonRuntime;
+
+/// One data connection.
+pub struct ConnectionInfo {
+    /// Daemon-unique, increasing; for logs and per-connection ownership.
+    pub connection_id: u64,
+    /// Cancelled when the connection's reader loop ends (peer close,
+    /// transport error, daemon shutdown).
+    pub closed: CancellationToken,
+}
+
+/// Passed to every handler.
+#[derive(Clone)]
+pub struct RequestContext {
+    pub connection: Arc<ConnectionInfo>,
+    /// Child of `connection.closed`; also cancelled by `$/cancelRequest`
+    /// naming this request. Abortable handlers select on
+    /// `cancel.cancelled()` and return `Err(ProtocolError::cancelled())`
+    /// (the reply is dropped anyway when the connection closed).
+    pub cancel: CancellationToken,
+}
+
+impl RequestContext {
+    /// A context for one request on `connection`.
+    pub fn new(connection: Arc<ConnectionInfo>) -> Self {
+        let cancel = connection.closed.child_token();
+        Self { connection, cancel }
+    }
+
+    /// A context on a connection of its own, for in-process callers and
+    /// tests.
+    pub fn detached() -> Self {
+        Self::new(Arc::new(ConnectionInfo {
+            connection_id: 0,
+            closed: CancellationToken::new(),
+        }))
+    }
+}
+
+/// Runs once, after the response frame was written to the socket.
+pub type WrittenHook = Box<dyn FnOnce() + Send + 'static>;
+
+/// A successful answer plus an optional hook the writer task runs only
+/// after the response frame was written to the socket.
+pub struct Reply<T> {
+    pub value: T,
+    pub on_written: Option<WrittenHook>,
+}
+
+impl<T> Reply<T> {
+    pub fn new(value: T) -> Self {
+        Self {
+            value,
+            on_written: None,
+        }
+    }
+
+    pub fn with_commit(value: T, commit: impl FnOnce() + Send + 'static) -> Self {
+        Self {
+            value,
+            on_written: Some(Box::new(commit)),
+        }
+    }
+
+    pub fn map<U>(self, map: impl FnOnce(T) -> U) -> Reply<U> {
+        Reply {
+            value: map(self.value),
+            on_written: self.on_written,
+        }
+    }
+}
+
+impl<T> std::fmt::Debug for Reply<T>
+where
+    T: std::fmt::Debug,
+{
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("Reply")
+            .field("value", &self.value)
+            .field("on_written", &self.on_written.is_some())
+            .finish()
+    }
+}
+
+/// Dispatch one already-initialized data request: manifest lookup
+/// (methodNotFound), capability check (capabilityUnavailable), activity
+/// touch for `Activity::Use`, strict params decode with
+/// `jsonrpc::decode_params` (invalidParams naming the field), handler call,
+/// result encode. Public for in-process tests.
+pub async fn handle_request(
+    runtime: &DaemonRuntime,
+    ctx: &RequestContext,
+    method: &str,
+    params: Value,
+) -> Result<Reply<Value>, ProtocolError> {
+    let spec = manifest::find(Plane::Data, method)
+        .filter(|spec| {
+            spec.kind == MessageKind::Request && spec.direction == Direction::ClientToServer
+        })
+        .ok_or_else(|| ProtocolError::method_not_found(method))?;
+    if let Some(capability) = spec.capability {
+        runtime.require_capability(capability)?;
+    }
+    if spec.activity == Some(Activity::Use) {
+        runtime.touch_activity();
+    }
+    let params = &params;
+    let filesystem = runtime.filesystem();
+    let processes = runtime.processes();
+    let jobs = runtime.jobs();
+    match spec.name {
+        DataInitialize::NAME => Err(ProtocolError::invalid_request(
+            "initialize was already answered on this connection",
+        )),
+        EnvGetIdle::NAME => {
+            answer::<EnvGetIdle, _, _>(params, |_| async { Ok(runtime.idle_report().await) }).await
+        }
+        FsReadFile::NAME => {
+            answer::<FsReadFile, _, _>(params, |p| filesystem.read_file(ctx, p)).await
+        }
+        FsWriteFile::NAME => {
+            answer::<FsWriteFile, _, _>(params, |p| filesystem.write_file(ctx, p)).await
+        }
+        FsCreateDirectory::NAME => {
+            answer::<FsCreateDirectory, _, _>(params, |p| filesystem.create_directory(ctx, p)).await
+        }
+        FsGetMetadata::NAME => {
+            answer::<FsGetMetadata, _, _>(params, |p| filesystem.get_metadata(ctx, p)).await
+        }
+        FsReadDirectory::NAME => {
+            answer::<FsReadDirectory, _, _>(params, |p| filesystem.read_directory(ctx, p)).await
+        }
+        FsRemove::NAME => answer::<FsRemove, _, _>(params, |p| filesystem.remove(ctx, p)).await,
+        FsRename::NAME => answer::<FsRename, _, _>(params, |p| filesystem.rename(ctx, p)).await,
+        FsSearchText::NAME => {
+            answer::<FsSearchText, _, _>(params, |p| filesystem.search_text(ctx, p)).await
+        }
+        FsGlobFiles::NAME => {
+            answer::<FsGlobFiles, _, _>(params, |p| filesystem.glob_files(ctx, p)).await
+        }
+        FsScan::NAME => answer::<FsScan, _, _>(params, |p| filesystem.scan(ctx, p)).await,
+        TransferBegin::NAME => {
+            answer::<TransferBegin, _, _>(params, |p| filesystem.transfer_begin(ctx, p)).await
+        }
+        TransferAdvance::NAME => {
+            answer::<TransferAdvance, _, _>(params, |p| filesystem.transfer_advance(ctx, p)).await
+        }
+        TransferGetStatus::NAME => {
+            answer::<TransferGetStatus, _, _>(params, |p| filesystem.transfer_get_status(ctx, p))
+                .await
+        }
+        TransferReadInventory::NAME => {
+            answer::<TransferReadInventory, _, _>(params, |p| {
+                filesystem.transfer_read_inventory(ctx, p)
+            })
+            .await
+        }
+        TransferAppend::NAME => {
+            answer::<TransferAppend, _, _>(params, |p| filesystem.transfer_append(ctx, p)).await
+        }
+        TransferListMissing::NAME => {
+            answer::<TransferListMissing, _, _>(params, |p| {
+                filesystem.transfer_list_missing(ctx, p)
+            })
+            .await
+        }
+        TransferRead::NAME => {
+            answer::<TransferRead, _, _>(params, |p| filesystem.transfer_read(ctx, p)).await
+        }
+        TransferWrite::NAME => {
+            answer::<TransferWrite, _, _>(params, |p| filesystem.transfer_write(ctx, p)).await
+        }
+        TransferCommit::NAME => {
+            answer::<TransferCommit, _, _>(params, |p| filesystem.transfer_commit(ctx, p)).await
+        }
+        TransferAbort::NAME => {
+            answer::<TransferAbort, _, _>(params, |p| filesystem.transfer_abort(ctx, p)).await
+        }
+        ProcessStart::NAME => {
+            answer::<ProcessStart, _, _>(params, |p| processes.start(ctx, p)).await
+        }
+        ProcessRead::NAME => reply::<ProcessRead, _, _>(params, |p| processes.read(ctx, p)).await,
+        ProcessWrite::NAME => {
+            answer::<ProcessWrite, _, _>(params, |p| processes.write(ctx, p)).await
+        }
+        ProcessTerminate::NAME => {
+            answer::<ProcessTerminate, _, _>(params, |p| processes.terminate(ctx, p)).await
+        }
+        JobStart::NAME => answer::<JobStart, _, _>(params, |p| jobs.start(ctx, p)).await,
+        JobRead::NAME => answer::<JobRead, _, _>(params, |p| jobs.read(ctx, p)).await,
+        JobCancel::NAME => answer::<JobCancel, _, _>(params, |p| jobs.cancel(ctx, p)).await,
+        _ => Err(ProtocolError::method_not_found(method)),
+    }
+}
+
+/// Decode, call a handler that answers a plain response, encode.
+async fn answer<M, F, Fut>(params: &Value, handler: F) -> Result<Reply<Value>, ProtocolError>
+where
+    M: RequestMethod,
+    F: FnOnce(M::Params) -> Fut,
+    Fut: Future<Output = Result<M::Response, ProtocolError>>,
+{
+    let params = jsonrpc::decode_params::<M::Params>(params)?;
+    let response = handler(params).await?;
+    Ok(Reply::new(encode(&response)?))
+}
+
+/// Decode, call a handler that answers a [`Reply`], encode.
+async fn reply<M, F, Fut>(params: &Value, handler: F) -> Result<Reply<Value>, ProtocolError>
+where
+    M: RequestMethod,
+    F: FnOnce(M::Params) -> Fut,
+    Fut: Future<Output = Result<Reply<M::Response>, ProtocolError>>,
+{
+    let params = jsonrpc::decode_params::<M::Params>(params)?;
+    let reply = handler(params).await?;
+    let value = encode(&reply.value)?;
+    Ok(Reply {
+        value,
+        on_written: reply.on_written,
+    })
+}
+
+fn encode<T: Serialize>(value: &T) -> Result<Value, ProtocolError> {
+    serde_json::to_value(value)
+        .map_err(|error| ProtocolError::internal(format!("encode result: {error}")))
+}
+
+/// Whether the daemon's capabilities include `capability`.
+pub(crate) fn has_capability(
+    capabilities: &environment_protocol::data::handshake::DataCapabilities,
+    capability: Capability,
+) -> bool {
+    match capability {
+        Capability::Filesystem => capabilities.filesystem.is_some(),
+        Capability::FilesystemWrite => capabilities
+            .filesystem
+            .as_ref()
+            .is_some_and(|filesystem| filesystem.write),
+        Capability::Process => capabilities.process.is_some(),
+        Capability::ProcessPty => capabilities
+            .process
+            .as_ref()
+            .is_some_and(|process| process.pty),
+        Capability::Job => capabilities.job.is_some(),
+        Capability::AdoptTarget | Capability::Ingress => false,
+    }
+}
diff --git a/crates/environment-daemon/src/exec.rs b/crates/environment-daemon/src/exec.rs
new file mode 100644
index 000000000..4c024f29d
--- /dev/null
+++ b/crates/environment-daemon/src/exec.rs
@@ -0,0 +1,323 @@
+//! The execution primitive processes and jobs share.
+//!
+//! One [`Execution`] is one root process spawned from a
+//! [`CommandSpec`]: it runs as the leader of its own process group, its
+//! stdout, stderr or PTY output is redacted and captured into a byte-offset
+//! [`OutputSink`], its input is fed by a writer of its own, and its exit is
+//! observed independently of its pipes. `process/*` and `job/*` differ only
+//! in what they do around it: processes keep a daemon cursor and leave
+//! leftovers running; jobs persist their output and sweep their group.
+//!
+//! Start order: validate, spawn, attach the output readers, the exit
+//! watcher and the deadline, and only then start the input writer, so no
+//! amount of input can block the start or keep a timeout from firing.
+
+mod execution;
+mod input;
+pub(crate) mod job_store;
+pub(crate) mod log;
+pub(crate) mod outcome;
+pub(crate) mod spawn_record;
+
+use std::{collections::BTreeMap, path::PathBuf, process::Stdio};
+
+use environment_protocol::{
+    bytes::SecretString,
+    data::exec::{CommandSpec, ExecInput, PtySize},
+    error::ProtocolError,
+};
+use portable_pty::{CommandBuilder, native_pty_system};
+use tokio::process::Command;
+
+use crate::{process_group, redaction::redactions_for_secret_env};
+
+pub(crate) use execution::{AfterExit, ExecOptions, Execution, OutputSink};
+use input::{Input, InputSink};
+
+/// Checks a command before anything runs. `field` is the wire path of the
+/// command, such as `command` or `jobs[2].command`.
+pub(crate) fn validate_command(spec: &CommandSpec, field: &str) -> Result<(), ProtocolError> {
+    if spec.argv.is_empty() {
+        return Err(ProtocolError::invalid_field(
+            format!("{field}.argv"),
+            "argv must name a program",
+        ));
+    }
+    if spec.argv[0].is_empty() {
+        return Err(ProtocolError::invalid_field(
+            format!("{field}.argv"),
+            "argv[0] must not be empty",
+        ));
+    }
+    if spec.argv.iter().any(|arg| arg.contains('\0')) {
+        return Err(ProtocolError::invalid_field(
+            format!("{field}.argv"),
+            "arguments must not contain NUL",
+        ));
+    }
+    for (name, value) in &spec.env {
+        validate_env_name(name, &format!("{field}.env"))?;
+        if value.contains('\0') {
+            return Err(ProtocolError::invalid_field(
+                format!("{field}.env"),
+                format!("value of {name} contains NUL"),
+            ));
+        }
+    }
+    for (name, value) in &spec.secret_env {
+        validate_env_name(name, &format!("{field}.secretEnv"))?;
+        if value.expose().contains('\0') {
+            return Err(ProtocolError::invalid_field(
+                format!("{field}.secretEnv"),
+                format!("value of {name} contains NUL"),
+            ));
+        }
+        if spec.env.contains_key(name) {
+            return Err(ProtocolError::invalid_field(
+                format!("{field}.secretEnv"),
+                format!("{name} is also set in env"),
+            ));
+        }
+    }
+    if spec.timeout_ms == Some(0) {
+        return Err(ProtocolError::invalid_field(
+            format!("{field}.timeoutMs"),
+            "timeoutMs must be positive; omit it for no deadline",
+        ));
+    }
+    Ok(())
+}
+
+fn validate_env_name(name: &str, field: &str) -> Result<(), ProtocolError> {
+    if name.is_empty() || name.contains('=') || name.contains('\0') {
+        return Err(ProtocolError::invalid_field(
+            field,
+            format!("invalid variable name {name:?}"),
+        ));
+    }
+    Ok(())
+}
+
+/// A validated command with its working directory resolved, ready to
+/// spawn.
+pub(crate) struct PreparedCommand {
+    pub argv: Vec<String>,
+    pub cwd: PathBuf,
+    pub env: BTreeMap<String, String>,
+    pub secret_env: BTreeMap<String, SecretString>,
+    /// Daemon variables no child inherits.
+    pub scrubbed_env: Vec<String>,
+    pub input: ExecInput,
+    pub pty: Option<PtySize>,
+}
+
+impl PreparedCommand {
+    pub fn new(
+        spec: CommandSpec,
+        cwd: PathBuf,
+        scrubbed_env: &[String],
+        pty: Option<PtySize>,
+    ) -> Self {
+        Self {
+            argv: spec.argv,
+            cwd,
+            env: spec.env,
+            secret_env: spec.secret_env,
+            scrubbed_env: scrubbed_env.to_vec(),
+            input: spec.input,
+            pty,
+        }
+    }
+
+    /// Spawns the root and starts capture, exit watching and the deadline.
+    /// The input writer starts with [`Execution::start_input`].
+    pub fn spawn<S: OutputSink>(
+        self,
+        sink: S,
+        options: ExecOptions,
+        input_queue_bytes: u64,
+    ) -> Result<Execution<S>, ProtocolError> {
+        let redactions = redactions_for_secret_env(&self.secret_env);
+        if let Some(size) = self.pty {
+            self.spawn_pty(size, sink, options, redactions, input_queue_bytes)
+        } else {
+            self.spawn_pipes(sink, options, redactions, input_queue_bytes)
+        }
+    }
+
+    fn spawn_pipes<S: OutputSink>(
+        self,
+        sink: S,
+        options: ExecOptions,
+        redactions: Vec<Vec<u8>>,
+        input_queue_bytes: u64,
+    ) -> Result<Execution<S>, ProtocolError> {
+        let mut command = Command::new(&self.argv[0]);
+        command
+            .args(&self.argv[1..])
+            .current_dir(&self.cwd)
+            .stdout(Stdio::piped())
+            .stderr(Stdio::piped())
+            .stdin(match self.input {
+                ExecInput::None {} => Stdio::null(),
+                ExecInput::Bytes { .. } | ExecInput::Pipe {} => Stdio::piped(),
+            });
+        for name in &self.scrubbed_env {
+            command.env_remove(name);
+        }
+        command.envs(&self.env);
+        for (name, value) in &self.secret_env {
+            command.env(name, value.expose());
+        }
+        process_group::spawn_in_own_group(&mut command);
+        let mut child = command.spawn().map_err(|error| {
+            ProtocolError::process_failed(format!("spawn {:?}: {error}", self.argv[0]))
+        })?;
+        let pid = child
+            .id()
+            .ok_or_else(|| ProtocolError::process_failed("spawned process has no pid"))?;
+        let input = match (self.input, child.stdin.take()) {
+            (ExecInput::Bytes { data }, Some(stdin)) => Input::new(
+                InputSink::Pipe(stdin),
+                Some(data.into_inner()),
+                true,
+                false,
+                0,
+            ),
+            (ExecInput::Pipe {}, Some(stdin)) => {
+                Input::new(InputSink::Pipe(stdin), None, false, true, input_queue_bytes)
+            }
+            _ => Input::none(),
+        };
+        let stdout = child.stdout.take();
+        let stderr = child.stderr.take();
+        Ok(Execution::start_pipes(
+            pid, child, stdout, stderr, input, sink, redactions, options,
+        ))
+    }
+
+    fn spawn_pty<S: OutputSink>(
+        self,
+        size: PtySize,
+        sink: S,
+        options: ExecOptions,
+        redactions: Vec<Vec<u8>>,
+        input_queue_bytes: u64,
+    ) -> Result<Execution<S>, ProtocolError> {
+        let pair = native_pty_system()
+            .openpty(portable_pty::PtySize {
+                rows: u16::try_from(size.rows).unwrap_or(u16::MAX),
+                cols: u16::try_from(size.cols).unwrap_or(u16::MAX),
+                pixel_width: 0,
+                pixel_height: 0,
+            })
+            .map_err(|error| ProtocolError::process_failed(format!("open PTY: {error}")))?;
+        let mut command = CommandBuilder::new(&self.argv[0]);
+        command.args(&self.argv[1..]);
+        command.cwd(&self.cwd);
+        for name in &self.scrubbed_env {
+            command.env_remove(name);
+        }
+        for (name, value) in &self.env {
+            command.env(name, value);
+        }
+        for (name, value) in &self.secret_env {
+            command.env(name, value.expose());
+        }
+        // Every fallible step on the master comes before the spawn, so a
+        // started child is never left unsupervised by a failed start.
+        let master = pair.master;
+        let reader = master
+            .try_clone_reader()
+            .map_err(|error| ProtocolError::process_failed(format!("PTY reader: {error}")))?;
+        let writer = master
+            .take_writer()
+            .map_err(|error| ProtocolError::process_failed(format!("PTY writer: {error}")))?;
+        let mut child = pair.slave.spawn_command(command).map_err(|error| {
+            ProtocolError::process_failed(format!("spawn {:?} on a PTY: {error}", self.argv[0]))
+        })?;
+        // The child holds the slave now; the reader sees end of file only
+        // once every holder closed it.
+        drop(pair.slave);
+        // The PTY child is a session leader, so its pid is its group id.
+        let Some(pid) = child.process_id() else {
+            let _ = child.kill();
+            let _ = child.wait();
+            return Err(ProtocolError::process_failed("spawned process has no pid"));
+        };
+        let initial = match self.input {
+            ExecInput::Bytes { data } => Some(data.into_inner()),
+            ExecInput::None {} | ExecInput::Pipe {} => None,
+        };
+        let input = Input::new(
+            InputSink::Pty(writer),
+            initial,
+            false,
+            true,
+            input_queue_bytes,
+        );
+        Ok(Execution::start_pty(
+            pid, child, master, reader, input, sink, redactions, options,
+        ))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use environment_protocol::{
+        bytes::ByteChunk,
+        error::{ErrorData, ProtocolErrorKind},
+    };
+
+    use super::*;
+
+    fn spec(argv: &[&str]) -> CommandSpec {
+        CommandSpec {
+            argv: argv.iter().map(|arg| (*arg).to_owned()).collect(),
+            cwd: None,
+            env: BTreeMap::new(),
+            secret_env: BTreeMap::new(),
+            input: ExecInput::Bytes {
+                data: ByteChunk::from(b"x".as_slice()),
+            },
+            timeout_ms: None,
+        }
+    }
+
+    fn field(error: &ProtocolError) -> Option<&str> {
+        match &error.data {
+            ErrorData::InvalidParams { field, .. } => field.as_deref(),
+            _ => None,
+        }
+    }
+
+    #[test]
+    fn commands_are_validated_with_wire_field_paths() {
+        assert!(validate_command(&spec(&["true"]), "command").is_ok());
+        let error = validate_command(&spec(&[]), "jobs[1].command").unwrap_err();
+        assert_eq!(error.kind(), ProtocolErrorKind::InvalidParams);
+        assert_eq!(field(&error), Some("jobs[1].command.argv"));
+
+        let mut collides = spec(&["true"]);
+        collides.env.insert("TOKEN".to_owned(), "plain".to_owned());
+        collides
+            .secret_env
+            .insert("TOKEN".to_owned(), SecretString::new("secret"));
+        let error = validate_command(&collides, "command").unwrap_err();
+        assert_eq!(field(&error), Some("command.secretEnv"));
+
+        let mut bad_name = spec(&["true"]);
+        bad_name.env.insert("A=B".to_owned(), "x".to_owned());
+        assert_eq!(
+            field(&validate_command(&bad_name, "command").unwrap_err()),
+            Some("command.env")
+        );
+
+        let mut zero = spec(&["true"]);
+        zero.timeout_ms = Some(0);
+        assert_eq!(
+            field(&validate_command(&zero, "command").unwrap_err()),
+            Some("command.timeoutMs")
+        );
+    }
+}
diff --git a/crates/environment-daemon/src/exec/execution.rs b/crates/environment-daemon/src/exec/execution.rs
new file mode 100644
index 000000000..164790833
--- /dev/null
+++ b/crates/environment-daemon/src/exec/execution.rs
@@ -0,0 +1,551 @@
+//! One running root process: output capture, exit, deadline and signals.
+
+use std::{
+    io::Read as _,
+    sync::{
+        Arc, Mutex, MutexGuard,
+        atomic::{AtomicBool, Ordering},
+    },
+    time::{Duration, Instant},
+};
+
+use environment_protocol::{
+    data::exec::{ExitStatus, LeftoverDisposition, LeftoverReport, OutputStream, StoppedBy},
+    error::ProtocolError,
+};
+use portable_pty::MasterPty;
+use tokio::{
+    io::{AsyncRead, AsyncReadExt as _},
+    process::{Child, ChildStderr, ChildStdout},
+    sync::watch,
+    task::JoinHandle,
+};
+
+use super::{input::Input, outcome};
+use crate::{
+    process_group::{self, Group, GroupSignal, OUTPUT_DRAIN_GRACE},
+    redaction::redact_bytes,
+};
+
+const READ_BUFFER_BYTES: usize = 8192;
+
+/// Where captured, redacted output goes.
+pub(crate) trait OutputSink: Send + 'static {
+    fn append(&mut self, stream: OutputStream, data: &[u8]);
+}
+
+/// What happens to the output readers once the root exits.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum AfterExit {
+    /// Processes: readers drain for a grace period, then stay on the pipes
+    /// discarding, so leftovers holding them never see `EPIPE`.
+    Keep,
+    /// Jobs: the owner sweeps the group first, then calls
+    /// [`Execution::settle`].
+    Manual,
+}
+
+#[derive(Clone, Copy, Debug)]
+pub(crate) struct ExecOptions {
+    /// `timeoutMs`: stop with `SIGTERM`, the grace, then `SIGKILL`.
+    pub timeout: Option<Duration>,
+    /// Grace between `SIGTERM` and `SIGKILL` for terminate and timeout.
+    pub terminate_grace: Duration,
+    pub after_exit: AfterExit,
+}
+
+/// A spawned root process. Cheap to clone.
+pub(crate) struct Execution<S> {
+    inner: Arc<Inner<S>>,
+}
+
+impl<S> Clone for Execution<S> {
+    fn clone(&self) -> Self {
+        Self {
+            inner: self.inner.clone(),
+        }
+    }
+}
+
+struct Inner<S> {
+    pid: u32,
+    /// The root's process group, which it leads.
+    group: Group,
+    /// Latched once the group was seen empty (or its id reused) after the
+    /// root exited: nothing of it is signalled or sampled again.
+    group_gone: AtomicBool,
+    state: Mutex<State<S>>,
+    /// Bumped on every change: output, exit, settlement, stop.
+    version: watch::Sender<u64>,
+    /// Pipe reader tasks, aborted by a settle that abandons them.
+    readers: Mutex<Vec<JoinHandle<()>>>,
+    /// The PTY master, for the terminal's foreground group.
+    pty: Option<Mutex<Box<dyn MasterPty + Send>>>,
+    input: Input,
+    terminate_grace: Duration,
+}
+
+/// What an execution has observed so far.
+pub(crate) struct State<S> {
+    pub sink: S,
+    redactions: Vec<Vec<u8>>,
+    readers_open: u32,
+    discarding: bool,
+    exited: bool,
+    exit: Option<ExitStatus>,
+    error: Option<ProtocolError>,
+    stopped_by: Option<StoppedBy>,
+    settled_at: Option<Instant>,
+}
+
+impl<S> State<S> {
+    /// The root process exited.
+    pub fn exited(&self) -> bool {
+        self.exited
+    }
+
+    /// The root exited and its output settled: every reader reached end of
+    /// file or was discarded, so the output's end is final.
+    pub fn settled(&self) -> bool {
+        self.settled_at.is_some()
+    }
+
+    pub fn settled_at(&self) -> Option<Instant> {
+        self.settled_at
+    }
+
+    pub fn exit(&self) -> Option<&ExitStatus> {
+        self.exit.as_ref()
+    }
+
+    /// Why output capture or the wait failed, if either did.
+    pub fn error(&self) -> Option<&ProtocolError> {
+        self.error.as_ref()
+    }
+
+    pub fn stopped_by(&self) -> Option<StoppedBy> {
+        self.stopped_by
+    }
+}
+
+impl<S: OutputSink> Execution<S> {
+    #[allow(clippy::too_many_arguments)]
+    pub(super) fn start_pipes(
+        pid: u32,
+        child: Child,
+        stdout: Option<ChildStdout>,
+        stderr: Option<ChildStderr>,
+        input: Input,
+        sink: S,
+        redactions: Vec<Vec<u8>>,
+        options: ExecOptions,
+    ) -> Self {
+        let readers_open = u32::from(stdout.is_some()) + u32::from(stderr.is_some());
+        let execution = Self::new(pid, None, input, sink, redactions, readers_open, options);
+        let inner = &execution.inner;
+        let mut readers = Vec::new();
+        if let Some(stdout) = stdout {
+            readers.push(tokio::spawn(read_pipe(
+                inner.clone(),
+                stdout,
+                OutputStream::Stdout,
+            )));
+        }
+        if let Some(stderr) = stderr {
+            readers.push(tokio::spawn(read_pipe(
+                inner.clone(),
+                stderr,
+                OutputStream::Stderr,
+            )));
+        }
+        *lock(&inner.readers) = readers;
+        let watched = execution.clone();
+        tokio::spawn(async move {
+            let status = {
+                let mut child = child;
+                child.wait().await
+            };
+            watched.observe_exit(status, options.after_exit).await;
+        });
+        execution.start_deadline(options.timeout);
+        execution
+    }
+
+    #[allow(clippy::too_many_arguments)]
+    pub(super) fn start_pty(
+        pid: u32,
+        child: Box<dyn portable_pty::Child + Send + Sync>,
+        master: Box<dyn MasterPty + Send>,
+        reader: Box<dyn std::io::Read + Send>,
+        input: Input,
+        sink: S,
+        redactions: Vec<Vec<u8>>,
+        options: ExecOptions,
+    ) -> Self {
+        let execution = Self::new(pid, Some(master), input, sink, redactions, 1, options);
+        // PTY reads and waits block. They run on threads of their own, not
+        // the runtime's blocking pool, so a PTY that leftovers keep open can
+        // never hold up the daemon's shutdown.
+        let inner = execution.inner.clone();
+        if let Err(error) = std::thread::Builder::new()
+            .name("envd-pty-reader".to_owned())
+            .spawn(move || read_pty(inner, reader))
+        {
+            execution.inner.capture_failed(OutputStream::Pty, error);
+            execution.inner.reader_closed();
+        }
+        // portable-pty's own exit status reports every signal death as
+        // code 1; the std child underneath keeps the signal.
+        let (exited, status) = tokio::sync::oneshot::channel();
+        let waiter = match child.into_any().downcast::<std::process::Child>() {
+            Ok(mut child) => std::thread::Builder::new()
+                .name("envd-pty-wait".to_owned())
+                .spawn(move || {
+                    let _ = exited.send(child.wait());
+                })
+                .map(drop),
+            Err(_) => {
+                let _ = exited.send(Err(std::io::Error::other(
+                    "the PTY child cannot be waited on",
+                )));
+                Ok(())
+            }
+        };
+        let watched = execution.clone();
+        tokio::spawn(async move {
+            let status = match waiter {
+                Ok(()) => status
+                    .await
+                    .unwrap_or_else(|_| Err(std::io::Error::other("the PTY wait thread ended"))),
+                Err(error) => Err(error),
+            };
+            watched.observe_exit(status, options.after_exit).await;
+        });
+        execution.start_deadline(options.timeout);
+        execution
+    }
+
+    fn new(
+        pid: u32,
+        pty: Option<Box<dyn MasterPty + Send>>,
+        input: Input,
+        sink: S,
+        redactions: Vec<Vec<u8>>,
+        readers_open: u32,
+        options: ExecOptions,
+    ) -> Self {
+        Self {
+            inner: Arc::new(Inner {
+                pid,
+                group: Group::capture(pid),
+                group_gone: AtomicBool::new(false),
+                state: Mutex::new(State {
+                    sink,
+                    redactions,
+                    readers_open,
+                    discarding: false,
+                    exited: false,
+                    exit: None,
+                    error: None,
+                    stopped_by: None,
+                    settled_at: None,
+                }),
+                version: watch::Sender::new(0),
+                readers: Mutex::new(Vec::new()),
+                pty: pty.map(Mutex::new),
+                input,
+                terminate_grace: options.terminate_grace,
+            }),
+        }
+    }
+
+    async fn observe_exit(
+        &self,
+        status: std::io::Result<std::process::ExitStatus>,
+        after_exit: AfterExit,
+    ) {
+        {
+            let mut state = self.state();
+            state.exited = true;
+            match status {
+                Ok(status) => state.exit = Some(outcome::exit_status(status)),
+                Err(error) => {
+                    state
+                        .error
+                        .get_or_insert(ProtocolError::process_failed(format!(
+                            "wait for process {}: {error}",
+                            self.inner.pid
+                        )));
+                }
+            }
+        }
+        self.inner.input.shut();
+        self.bump();
+        if after_exit == AfterExit::Keep {
+            self.settle(false).await;
+        }
+    }
+
+    fn start_deadline(&self, timeout: Option<Duration>) {
+        let Some(timeout) = timeout else {
+            return;
+        };
+        let execution = Arc::downgrade(&self.inner);
+        tokio::spawn(async move {
+            tokio::time::sleep(timeout).await;
+            if let Some(inner) = execution.upgrade() {
+                let execution = Execution { inner };
+                if !execution.state().exited {
+                    execution.stop(StoppedBy::Timeout);
+                }
+            }
+        });
+    }
+}
+
+impl<S> Execution<S> {
+    /// OS pid of the root, which is also its process group id.
+    pub fn pid(&self) -> u32 {
+        self.inner.pid
+    }
+
+    /// The root's process group.
+    pub fn group(&self) -> Group {
+        self.inner.group
+    }
+
+    /// The root runs, or its group still has members of its own. After the
+    /// root exited, an emptied group latches as gone, so a later group that
+    /// reuses the id is never mistaken for this one.
+    pub fn group_alive(&self) -> bool {
+        if !self.state().exited {
+            return true;
+        }
+        if self.inner.group_gone.load(Ordering::Acquire) {
+            return false;
+        }
+        let alive = self.inner.group.alive();
+        if !alive {
+            self.inner.group_gone.store(true, Ordering::Release);
+        }
+        alive
+    }
+
+    /// What is alive in the group now, as a report with `disposition`.
+    /// Absent when nothing is left or the platform cannot enumerate groups.
+    pub fn sample_leftovers(&self, disposition: LeftoverDisposition) -> Option<LeftoverReport> {
+        if !self.group_alive() {
+            return None;
+        }
+        outcome::leftover_report(process_group::group_members(self.inner.pid), disposition)
+    }
+
+    /// Runs `f` on the current state under the execution's lock.
+    pub fn with_state<R>(&self, f: impl FnOnce(&mut State<S>) -> R) -> R {
+        f(&mut self.state())
+    }
+
+    /// Notified on every change.
+    pub fn subscribe(&self) -> watch::Receiver<u64> {
+        self.inner.version.subscribe()
+    }
+
+    /// Starts the input writer: the last step of a start.
+    pub fn start_input(&self) {
+        self.inner.input.start();
+    }
+
+    /// Queues input; see [`Input::offer`].
+    pub fn offer_input(&self, data: &[u8], close: bool) -> Result<u64, ProtocolError> {
+        self.inner.input.offer(data, close)
+    }
+
+    /// Waits until `done` holds.
+    pub async fn wait_until(&self, done: impl Fn(&State<S>) -> bool) {
+        let mut changes = self.subscribe();
+        loop {
+            changes.borrow_and_update();
+            if done(&self.state()) {
+                return;
+            }
+            if changes.changed().await.is_err() {
+                return;
+            }
+        }
+    }
+
+    /// Settles the output after the root exited: waits up to the drain
+    /// grace for the readers to reach end of file, then discards what the
+    /// rest still read, and with `abort_readers` also abandons the pipes.
+    pub async fn settle(&self, abort_readers: bool) {
+        let mut changes = self.subscribe();
+        let deadline = tokio::time::Instant::now() + OUTPUT_DRAIN_GRACE;
+        loop {
+            changes.borrow_and_update();
+            if self.state().readers_open == 0 {
+                break;
+            }
+            tokio::select! {
+                changed = changes.changed() => if changed.is_err() { break },
+                _ = tokio::time::sleep_until(deadline) => break,
+            }
+        }
+        if abort_readers {
+            for reader in std::mem::take(&mut *lock(&self.inner.readers)) {
+                reader.abort();
+            }
+        }
+        {
+            let mut state = self.state();
+            if state.readers_open > 0 {
+                state.discarding = true;
+            }
+            // Nothing is captured any more, so the secret values go.
+            state.redactions = Vec::new();
+            state.settled_at.get_or_insert_with(Instant::now);
+        }
+        self.bump();
+    }
+
+    /// Stops the group: `kill` at once, `terminate` and `timeout` with
+    /// `SIGTERM`, the grace, then `SIGKILL`. Records `stoppedBy` only while
+    /// the root still runs; after its exit the signal still reaches its
+    /// leftovers. Returns whether the root was running.
+    pub fn stop(&self, reason: StoppedBy) -> bool {
+        let running = {
+            let mut state = self.state();
+            let running = !state.exited;
+            if running && (state.stopped_by.is_none() || reason == StoppedBy::Kill) {
+                state.stopped_by = Some(reason);
+            }
+            running
+        };
+        if running || self.group_alive() {
+            let group = self.inner.group;
+            match reason {
+                StoppedBy::Kill => {
+                    group.signal(GroupSignal::Kill);
+                }
+                StoppedBy::Terminate | StoppedBy::Timeout => {
+                    if group.signal(GroupSignal::Terminate) {
+                        tokio::spawn(group.kill_after_grace(self.inner.terminate_grace));
+                    }
+                }
+            }
+        }
+        self.bump();
+        running
+    }
+
+    /// `SIGINT` to the foreground group: the terminal's under a PTY,
+    /// otherwise the process group. Returns whether the root was running.
+    pub fn interrupt(&self) -> bool {
+        let running = !self.state().exited;
+        if !self.group_alive() {
+            return false;
+        }
+        let foreground = self.inner.pty.as_ref().and_then(|master| {
+            lock(master)
+                .process_group_leader()
+                .and_then(|leader| u32::try_from(leader).ok())
+        });
+        match foreground {
+            Some(foreground) => process_group::interrupt_foreground(foreground),
+            None => self.inner.group.signal(GroupSignal::Interrupt),
+        };
+        running
+    }
+
+    fn state(&self) -> MutexGuard<'_, State<S>> {
+        lock(&self.inner.state)
+    }
+
+    fn bump(&self) {
+        self.inner
+            .version
+            .send_modify(|version| *version = version.wrapping_add(1));
+    }
+}
+
+impl<S: OutputSink> Inner<S> {
+    fn push(&self, stream: OutputStream, data: &[u8]) {
+        {
+            let mut state = lock(&self.state);
+            if state.discarding {
+                return;
+            }
+            if state.redactions.is_empty() {
+                state.sink.append(stream, data);
+            } else {
+                let redacted = redact_bytes(data, &state.redactions);
+                state.sink.append(stream, &redacted);
+            }
+        }
+        self.bump();
+    }
+
+    fn capture_failed(&self, stream: OutputStream, error: std::io::Error) {
+        let mut state = lock(&self.state);
+        if !state.exited {
+            state
+                .error
+                .get_or_insert(ProtocolError::process_failed(format!(
+                    "capture {stream:?} output: {error}"
+                )));
+        }
+    }
+
+    fn reader_closed(&self) {
+        {
+            let mut state = lock(&self.state);
+            state.readers_open = state.readers_open.saturating_sub(1);
+        }
+        self.bump();
+    }
+
+    fn bump(&self) {
+        self.version
+            .send_modify(|version| *version = version.wrapping_add(1));
+    }
+}
+
+async fn read_pipe<S: OutputSink, R: AsyncRead + Unpin>(
+    inner: Arc<Inner<S>>,
+    mut reader: R,
+    stream: OutputStream,
+) {
+    let mut buffer = vec![0; READ_BUFFER_BYTES];
+    loop {
+        match reader.read(&mut buffer).await {
+            Ok(0) => break,
+            Ok(read) => inner.push(stream, &buffer[..read]),
+            Err(error) if error.kind() == std::io::ErrorKind::Interrupted => {}
+            Err(error) => {
+                inner.capture_failed(stream, error);
+                break;
+            }
+        }
+    }
+    inner.reader_closed();
+}
+
+fn read_pty<S: OutputSink>(inner: Arc<Inner<S>>, mut reader: Box<dyn std::io::Read + Send>) {
+    let mut buffer = vec![0; READ_BUFFER_BYTES];
+    loop {
+        match reader.read(&mut buffer) {
+            Ok(0) => break,
+            Ok(read) => inner.push(OutputStream::Pty, &buffer[..read]),
+            Err(error) if error.kind() == std::io::ErrorKind::Interrupted => {}
+            // Linux answers EIO once every slave descriptor is closed: the
+            // PTY's end of file.
+            Err(_) => break,
+        }
+    }
+    inner.reader_closed();
+}
+
+fn lock<T>(mutex: &Mutex<T>) -> MutexGuard<'_, T> {
+    mutex
+        .lock()
+        .unwrap_or_else(|poisoned| poisoned.into_inner())
+}
diff --git a/crates/environment-daemon/src/exec/input.rs b/crates/environment-daemon/src/exec/input.rs
new file mode 100644
index 000000000..6c9f44bb2
--- /dev/null
+++ b/crates/environment-daemon/src/exec/input.rs
@@ -0,0 +1,310 @@
+//! A command's input: a bounded queue drained by its own writer.
+//!
+//! The writer runs off the runtime thread: a Tokio task for a
+//! non-blocking pipe, a thread of its own for a PTY master, whose writes
+//! block when the child stops reading. Callers only enqueue, so a
+//! child that never reads can fill the queue but never stall the daemon,
+//! and signals still reach it while a write is pending.
+
+use std::{
+    io::Write as _,
+    sync::{
+        Arc, Mutex,
+        atomic::{AtomicBool, AtomicU64, Ordering},
+    },
+};
+
+use environment_protocol::error::{PreconditionReason, ProtocolError};
+use tokio::{io::AsyncWriteExt as _, process::ChildStdin, sync::mpsc};
+
+/// `VEOF` in the default terminal settings (Ctrl-D): end of input for a
+/// canonical-mode reader at the start of a line.
+const PTY_END_OF_INPUT: u8 = 0x04;
+
+/// Where queued input goes.
+pub(crate) enum InputSink {
+    Pipe(ChildStdin),
+    Pty(Box<dyn std::io::Write + Send>),
+}
+
+enum Message {
+    Data(Vec<u8>),
+    Close,
+}
+
+#[derive(Default)]
+struct Shared {
+    queued: AtomicU64,
+    /// The input takes no more bytes: closed by the caller, by the child
+    /// (broken pipe), or because the process exited.
+    closed: AtomicBool,
+}
+
+/// The input of one execution.
+pub(crate) struct Input {
+    /// `process/write` is served: a pipe or a PTY.
+    writable: bool,
+    capacity: u64,
+    shared: Arc<Shared>,
+    sender: Mutex<Option<mpsc::UnboundedSender<Message>>>,
+    /// The sink and the queue's receiver until the writer starts.
+    pending: Mutex<Option<(InputSink, mpsc::UnboundedReceiver<Message>)>>,
+}
+
+impl Input {
+    /// No input at all: `/dev/null`.
+    pub fn none() -> Self {
+        let shared = Arc::new(Shared::default());
+        shared.closed.store(true, Ordering::Release);
+        Self {
+            writable: false,
+            capacity: 0,
+            shared,
+            sender: Mutex::new(None),
+            pending: Mutex::new(None),
+        }
+    }
+
+    /// Input to `sink`. `initial` is queued first whatever the capacity;
+    /// `close_after_initial` then ends the input. `writable` inputs accept
+    /// `process/write` up to `capacity` queued bytes.
+    pub fn new(
+        sink: InputSink,
+        initial: Option<Vec<u8>>,
+        close_after_initial: bool,
+        writable: bool,
+        capacity: u64,
+    ) -> Self {
+        let (sender, receiver) = mpsc::unbounded_channel();
+        let shared = Arc::new(Shared::default());
+        if let Some(initial) = initial.filter(|initial| !initial.is_empty()) {
+            shared
+                .queued
+                .fetch_add(initial.len() as u64, Ordering::AcqRel);
+            let _ = sender.send(Message::Data(initial));
+        }
+        let sender = if close_after_initial {
+            let _ = sender.send(Message::Close);
+            shared.closed.store(true, Ordering::Release);
+            None
+        } else {
+            Some(sender)
+        };
+        Self {
+            writable,
+            capacity,
+            shared,
+            sender: Mutex::new(sender),
+            pending: Mutex::new(Some((sink, receiver))),
+        }
+    }
+
+    /// Starts the writer. Called once the output readers, the exit watcher
+    /// and the deadline are in place, so input can never block them.
+    pub fn start(&self) {
+        let Some((sink, receiver)) = self.pending.lock().expect("input poisoned").take() else {
+            return;
+        };
+        let shared = self.shared.clone();
+        match sink {
+            InputSink::Pipe(stdin) => {
+                tokio::spawn(write_pipe(stdin, receiver, shared));
+            }
+            InputSink::Pty(writer) => {
+                // A thread of its own, not the blocking pool: a write the
+                // child never drains must not hold up the daemon's shutdown.
+                let closed = shared.clone();
+                if std::thread::Builder::new()
+                    .name("envd-pty-writer".to_owned())
+                    .spawn(move || write_pty(writer, receiver, shared))
+                    .is_err()
+                {
+                    closed.closed.store(true, Ordering::Release);
+                }
+            }
+        }
+    }
+
+    /// Queues a prefix of `data` and answers how many bytes were accepted;
+    /// `close` ends the input once every byte was accepted.
+    pub fn offer(&self, data: &[u8], close: bool) -> Result<u64, ProtocolError> {
+        let mut sender = self.sender.lock().expect("input poisoned");
+        let open = sender
+            .as_ref()
+            .filter(|_| self.writable && !self.shared.closed.load(Ordering::Acquire));
+        let Some(open) = open else {
+            return Err(ProtocolError::failed_precondition(
+                PreconditionReason::InputClosed,
+                if self.writable {
+                    "the process input is closed"
+                } else {
+                    "the process was started without writable input"
+                },
+            ));
+        };
+        let queued = self.shared.queued.load(Ordering::Acquire);
+        let free = self.capacity.saturating_sub(queued);
+        let accepted = (data.len() as u64).min(free);
+        if accepted > 0 {
+            self.shared.queued.fetch_add(accepted, Ordering::AcqRel);
+            if open
+                .send(Message::Data(data[..accepted as usize].to_vec()))
+                .is_err()
+            {
+                self.shared.queued.fetch_sub(accepted, Ordering::AcqRel);
+                self.shared.closed.store(true, Ordering::Release);
+                return Err(ProtocolError::failed_precondition(
+                    PreconditionReason::InputClosed,
+                    "the process input is closed",
+                ));
+            }
+        }
+        if close && accepted == data.len() as u64 {
+            let _ = open.send(Message::Close);
+            self.shared.closed.store(true, Ordering::Release);
+            *sender = None;
+        }
+        Ok(accepted)
+    }
+
+    /// Ends the input without a close message, because the process exited.
+    /// A writer stuck on a full PTY stays on its blocking thread until the
+    /// write fails; nothing waits for it.
+    pub fn shut(&self) {
+        self.shared.closed.store(true, Ordering::Release);
+        self.sender.lock().expect("input poisoned").take();
+        self.pending.lock().expect("input poisoned").take();
+    }
+
+    /// Bytes queued and not yet written.
+    #[cfg(test)]
+    pub fn queued_bytes(&self) -> u64 {
+        self.shared.queued.load(Ordering::Acquire)
+    }
+}
+
+async fn write_pipe(
+    stdin: ChildStdin,
+    mut receiver: mpsc::UnboundedReceiver<Message>,
+    shared: Arc<Shared>,
+) {
+    let mut stdin = Some(stdin);
+    while let Some(message) = receiver.recv().await {
+        match message {
+            Message::Data(data) => {
+                if let Some(writer) = stdin.as_mut()
+                    && writer.write_all(&data).await.is_err()
+                {
+                    // Broken pipe: the child closed its input, which is its
+                    // right, not a failure of the command.
+                    stdin = None;
+                    shared.closed.store(true, Ordering::Release);
+                }
+                shared.queued.fetch_sub(data.len() as u64, Ordering::AcqRel);
+            }
+            Message::Close => {
+                stdin = None;
+                shared.closed.store(true, Ordering::Release);
+            }
+        }
+    }
+}
+
+fn write_pty(
+    writer: Box<dyn std::io::Write + Send>,
+    mut receiver: mpsc::UnboundedReceiver<Message>,
+    shared: Arc<Shared>,
+) {
+    let mut writer = Some(writer);
+    while let Some(message) = receiver.blocking_recv() {
+        let (data, close) = match message {
+            Message::Data(data) => (data, false),
+            Message::Close => (vec![PTY_END_OF_INPUT], true),
+        };
+        if let Some(pty) = writer.as_mut()
+            && pty.write_all(&data).and_then(|()| pty.flush()).is_err()
+        {
+            writer = None;
+            shared.closed.store(true, Ordering::Release);
+        }
+        if close {
+            shared.closed.store(true, Ordering::Release);
+        } else {
+            shared.queued.fetch_sub(data.len() as u64, Ordering::AcqRel);
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::time::Duration;
+
+    use environment_protocol::error::{ErrorData, ProtocolErrorKind};
+
+    use super::*;
+
+    fn is_input_closed(error: &ProtocolError) -> bool {
+        matches!(
+            error.data,
+            ErrorData::FailedPrecondition {
+                reason: PreconditionReason::InputClosed
+            }
+        )
+    }
+
+    /// A writer that never makes progress, like a PTY whose child stopped
+    /// reading.
+    struct Stuck(std::sync::mpsc::Receiver<()>);
+
+    impl std::io::Write for Stuck {
+        fn write(&mut self, _buf: &[u8]) -> std::io::Result<usize> {
+            let _ = self.0.recv();
+            Err(std::io::ErrorKind::BrokenPipe.into())
+        }
+
+        fn flush(&mut self) -> std::io::Result<()> {
+            Ok(())
+        }
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn a_stuck_writer_fills_the_queue_without_blocking_the_caller() {
+        let (release, wait) = std::sync::mpsc::channel();
+        let input = Input::new(
+            InputSink::Pty(Box::new(Stuck(wait))),
+            None,
+            false,
+            true,
+            1024,
+        );
+        input.start();
+        let started = std::time::Instant::now();
+        assert_eq!(input.offer(&[b'x'; 4096], false).unwrap(), 1024);
+        assert_eq!(input.offer(b"more", false).unwrap(), 0, "queue full");
+        assert!(started.elapsed() < Duration::from_secs(1));
+        // The runtime thread is free: a timer still fires.
+        tokio::time::sleep(Duration::from_millis(10)).await;
+        drop(release);
+        for _ in 0..200 {
+            if input.offer(b"x", false).is_err() {
+                break;
+            }
+            tokio::time::sleep(Duration::from_millis(5)).await;
+        }
+        let error = input.offer(b"x", false).unwrap_err();
+        assert!(is_input_closed(&error), "a broken pipe closes the input");
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn close_applies_only_when_every_byte_was_accepted() {
+        let (_release, wait) = std::sync::mpsc::channel();
+        let input = Input::new(InputSink::Pty(Box::new(Stuck(wait))), None, false, true, 4);
+        assert_eq!(input.offer(b"abcdef", true).unwrap(), 4);
+        assert_eq!(input.queued_bytes(), 4);
+        assert_eq!(input.offer(b"", false).unwrap(), 0, "still open");
+        let none = Input::none();
+        let error = none.offer(b"x", false).unwrap_err();
+        assert_eq!(error.kind(), ProtocolErrorKind::FailedPrecondition);
+        assert!(is_input_closed(&error));
+    }
+}
diff --git a/crates/environment-daemon/src/exec/job_store.rs b/crates/environment-daemon/src/exec/job_store.rs
new file mode 100644
index 000000000..1e52aabb8
--- /dev/null
+++ b/crates/environment-daemon/src/exec/job_store.rs
@@ -0,0 +1,613 @@
+//! Job records and output on disk, written by one thread of their own.
+//!
+//! Each job has a directory `<jobs>/<jobId>/` with `record.json`, its
+//! summary (rewritten only on state transitions), and its output as
+//! append-only framed logs: `output.head` holds the bytes below the head
+//! cap, `output.tail` the bytes after it. The tail log is compacted to the
+//! newest tail-cap bytes once it holds twice that, so a verbose job writes
+//! O(output) bytes in total and never more than the cap plus slack stays on
+//! disk. Writes are buffered and flushed on an interval and when the job
+//! finishes; nothing here runs on the runtime thread.
+//!
+//! Output waits for the store thread in a per-job pending buffer, not in
+//! the command queue: of the bytes past the head cap only the newest
+//! tail-cap bytes are kept there, so a job that produces faster than the
+//! disk takes it holds at most its retained output in memory, and the
+//! bytes dropped are ones the tail compaction would drop anyway.
+
+use std::{
+    collections::BTreeMap,
+    fs::{File, OpenOptions},
+    io::{BufWriter, Read as _, Write as _},
+    path::{Path, PathBuf},
+    sync::{Arc, Mutex, MutexGuard, mpsc},
+    time::{Duration, Instant},
+};
+
+use environment_protocol::{data::exec::OutputStream, ids::JobId};
+use tokio::sync::oneshot;
+
+use super::log::OutputLog;
+
+/// How often buffered output reaches the disk while a job runs.
+const FLUSH_INTERVAL: Duration = Duration::from_millis(250);
+
+const RECORD_FILE: &str = "record.json";
+const HEAD_FILE: &str = "output.head";
+const TAIL_FILE: &str = "output.tail";
+
+/// Frame header: offset (u64), stream (u8), length (u32), little endian.
+const FRAME_HEADER_BYTES: usize = 13;
+
+enum Command {
+    WriteRecord {
+        job_id: JobId,
+        record: Vec<u8>,
+        done: Option<oneshot::Sender<()>>,
+    },
+    /// The job has pending output.
+    Drain {
+        job_id: JobId,
+    },
+    /// Flushes and closes the job's output, then writes its final record.
+    Finish {
+        job_id: JobId,
+        record: Vec<u8>,
+        done: oneshot::Sender<()>,
+    },
+    Remove {
+        job_id: JobId,
+    },
+}
+
+/// A frame of output: offset, stream, bytes.
+type Frame = (u64, OutputStream, Vec<u8>);
+
+/// Output of one job not yet taken by the store thread.
+#[derive(Default)]
+struct Pending {
+    /// In offset order; a frame lies wholly below or wholly past the head
+    /// cap.
+    frames: Vec<Frame>,
+    /// Bytes of `frames` past the head cap.
+    tail_bytes: u64,
+    /// A drain command for the job is queued.
+    queued: bool,
+}
+
+type PendingOutput = Arc<Mutex<BTreeMap<JobId, Pending>>>;
+
+/// A handle to the store thread. Cheap to clone.
+#[derive(Clone)]
+pub(crate) struct JobStore {
+    root: PathBuf,
+    head_cap: u64,
+    tail_cap: u64,
+    pending: PendingOutput,
+    sender: mpsc::Sender<Command>,
+}
+
+impl JobStore {
+    /// Starts the store thread for job directories under `root`. Output at
+    /// offsets below `head_cap` goes to the head log, the rest to the tail
+    /// log, which keeps at least the newest `tail_cap` bytes.
+    pub fn start(root: PathBuf, head_cap: u64, tail_cap: u64) -> std::io::Result<Self> {
+        let (sender, receiver) = mpsc::channel();
+        let pending = PendingOutput::default();
+        let writer = Writer {
+            root: root.clone(),
+            head_cap,
+            tail_cap,
+            pending: pending.clone(),
+            open: BTreeMap::new(),
+        };
+        std::thread::Builder::new()
+            .name("envd-job-store".to_owned())
+            .spawn(move || writer.run(receiver))?;
+        Ok(Self {
+            root,
+            head_cap,
+            tail_cap,
+            pending,
+            sender,
+        })
+    }
+
+    pub fn root(&self) -> &Path {
+        &self.root
+    }
+
+    /// Queues a record write; the receiver answers once it is on disk.
+    pub fn write_record(&self, job_id: &JobId, record: Vec<u8>) -> oneshot::Receiver<()> {
+        let (done, written) = oneshot::channel();
+        self.send(Command::WriteRecord {
+            job_id: job_id.clone(),
+            record,
+            done: Some(done),
+        });
+        written
+    }
+
+    /// Queues a record write without waiting.
+    pub fn queue_record(&self, job_id: &JobId, record: Vec<u8>) {
+        self.send(Command::WriteRecord {
+            job_id: job_id.clone(),
+            record,
+            done: None,
+        });
+    }
+
+    /// Adds output at `offset` to the job's pending buffer, keeping its
+    /// head bytes and its newest tail-cap bytes past the head cap.
+    pub fn append(&self, job_id: &JobId, offset: u64, stream: OutputStream, data: &[u8]) {
+        let head_len = self.head_cap.saturating_sub(offset).min(data.len() as u64) as usize;
+        let (head, tail) = data.split_at(head_len);
+        let wake = {
+            let mut pending = lock(&self.pending);
+            let entry = pending.entry(job_id.clone()).or_default();
+            entry.push(offset, stream, head, self.head_cap);
+            entry.push(offset + head_len as u64, stream, tail, self.head_cap);
+            entry.tail_bytes += tail.len() as u64;
+            entry.trim_tail(self.head_cap, self.tail_cap);
+            !std::mem::replace(&mut entry.queued, true)
+        };
+        if wake {
+            self.send(Command::Drain {
+                job_id: job_id.clone(),
+            });
+        }
+    }
+
+    /// Flushes the job's output and writes its final record; answers once
+    /// both are on disk.
+    pub async fn finish(&self, job_id: &JobId, record: Vec<u8>) {
+        let (done, written) = oneshot::channel();
+        self.send(Command::Finish {
+            job_id: job_id.clone(),
+            record,
+            done,
+        });
+        let _ = written.await;
+    }
+
+    pub fn remove(&self, job_id: &JobId) {
+        self.send(Command::Remove {
+            job_id: job_id.clone(),
+        });
+    }
+
+    fn send(&self, command: Command) {
+        if self.sender.send(command).is_err() {
+            eprintln!("lightspeed-envd: the job store thread has stopped");
+        }
+    }
+}
+
+/// Reads a job's retained output back. `end` is the end recorded with the
+/// job's final status; a larger end found in the logs wins (a job that was
+/// interrupted before its final record).
+pub(crate) fn load_output(dir: &Path, end: u64, cap: u64) -> std::io::Result<OutputLog> {
+    let mut records = read_frames(&dir.join(HEAD_FILE))?;
+    records.extend(read_frames(&dir.join(TAIL_FILE))?);
+    records.sort_by_key(|(offset, _, _)| *offset);
+    let mut log = OutputLog::from_records(records, end);
+    log.enforce_cap(cap, 0);
+    Ok(log)
+}
+
+struct OpenOutput {
+    head: Option<BufWriter<File>>,
+    tail: Option<BufWriter<File>>,
+    tail_bytes: u64,
+}
+
+impl Pending {
+    fn push(&mut self, offset: u64, stream: OutputStream, data: &[u8], head_cap: u64) {
+        if data.is_empty() {
+            return;
+        }
+        // Contiguous output of one stream on one side of the head cap
+        // becomes one frame.
+        if let Some((last_offset, last_stream, last_data)) = self.frames.last_mut()
+            && *last_stream == stream
+            && *last_offset + last_data.len() as u64 == offset
+            && (*last_offset < head_cap) == (offset < head_cap)
+        {
+            last_data.extend_from_slice(data);
+            return;
+        }
+        self.frames.push((offset, stream, data.to_vec()));
+    }
+
+    /// Drops the oldest bytes past the head cap beyond the newest
+    /// `tail_cap`.
+    fn trim_tail(&mut self, head_cap: u64, tail_cap: u64) {
+        while self.tail_bytes > tail_cap {
+            let Some(first) = self
+                .frames
+                .iter()
+                .position(|(offset, _, _)| *offset >= head_cap)
+            else {
+                return;
+            };
+            let excess = self.tail_bytes - tail_cap;
+            let (offset, _, data) = &mut self.frames[first];
+            if data.len() as u64 <= excess {
+                self.tail_bytes -= data.len() as u64;
+                self.frames.remove(first);
+            } else {
+                data.drain(..excess as usize);
+                *offset += excess;
+                self.tail_bytes -= excess;
+            }
+        }
+    }
+}
+
+struct Writer {
+    root: PathBuf,
+    head_cap: u64,
+    tail_cap: u64,
+    pending: PendingOutput,
+    open: BTreeMap<JobId, OpenOutput>,
+}
+
+impl Writer {
+    fn run(mut self, receiver: mpsc::Receiver<Command>) {
+        let mut flushed = Instant::now();
+        loop {
+            // Flushes on the interval even while commands keep arriving.
+            let wait = FLUSH_INTERVAL.saturating_sub(flushed.elapsed());
+            match receiver.recv_timeout(wait) {
+                Ok(command) => self.handle(command),
+                Err(mpsc::RecvTimeoutError::Timeout) => {}
+                Err(mpsc::RecvTimeoutError::Disconnected) => {
+                    let jobs: Vec<JobId> = lock(&self.pending).keys().cloned().collect();
+                    for job_id in jobs {
+                        self.drain(&job_id);
+                    }
+                    self.flush_all();
+                    return;
+                }
+            }
+            if flushed.elapsed() >= FLUSH_INTERVAL {
+                self.flush_all();
+                flushed = Instant::now();
+            }
+        }
+    }
+
+    /// Writes the job's pending output.
+    fn drain(&mut self, job_id: &JobId) {
+        let frames = {
+            let mut pending = lock(&self.pending);
+            let Some(entry) = pending.get_mut(job_id) else {
+                return;
+            };
+            entry.queued = false;
+            entry.tail_bytes = 0;
+            std::mem::take(&mut entry.frames)
+        };
+        for (offset, stream, data) in frames {
+            if let Err(error) = self.append(job_id, offset, stream, &data) {
+                eprintln!("lightspeed-envd: could not store output of job {job_id}: {error}");
+                return;
+            }
+        }
+    }
+
+    fn handle(&mut self, command: Command) {
+        match command {
+            Command::WriteRecord {
+                job_id,
+                record,
+                done,
+            } => {
+                self.write_record(&job_id, &record);
+                if let Some(done) = done {
+                    let _ = done.send(());
+                }
+            }
+            Command::Drain { job_id } => self.drain(&job_id),
+            Command::Finish {
+                job_id,
+                record,
+                done,
+            } => {
+                self.drain(&job_id);
+                lock(&self.pending).remove(&job_id);
+                if let Some(mut output) = self.open.remove(&job_id) {
+                    for writer in [output.head.as_mut(), output.tail.as_mut()]
+                        .into_iter()
+                        .flatten()
+                    {
+                        if let Err(error) = writer.flush() {
+                            eprintln!(
+                                "lightspeed-envd: could not flush output of job {job_id}: {error}"
+                            );
+                        }
+                    }
+                }
+                self.write_record(&job_id, &record);
+                let _ = done.send(());
+            }
+            Command::Remove { job_id } => {
+                lock(&self.pending).remove(&job_id);
+                self.open.remove(&job_id);
+                let dir = self.root.join(job_id.as_str());
+                if let Err(error) = std::fs::remove_dir_all(&dir)
+                    && error.kind() != std::io::ErrorKind::NotFound
+                {
+                    eprintln!("lightspeed-envd: could not remove job {job_id}: {error}");
+                }
+            }
+        }
+    }
+
+    fn write_record(&self, job_id: &JobId, record: &[u8]) {
+        let dir = self.root.join(job_id.as_str());
+        let result = std::fs::create_dir_all(&dir).and_then(|()| {
+            let path = dir.join(RECORD_FILE);
+            let temp = dir.join(format!("{RECORD_FILE}.tmp"));
+            std::fs::write(&temp, record)?;
+            std::fs::rename(&temp, &path)
+        });
+        if let Err(error) = result {
+            eprintln!("lightspeed-envd: could not persist job {job_id}: {error}");
+        }
+    }
+
+    fn append(
+        &mut self,
+        job_id: &JobId,
+        offset: u64,
+        stream: OutputStream,
+        data: &[u8],
+    ) -> std::io::Result<()> {
+        let head_cap = self.head_cap;
+        let head_len = head_cap.saturating_sub(offset).min(data.len() as u64) as usize;
+        let (head, tail) = data.split_at(head_len);
+        let dir = self.root.join(job_id.as_str());
+        if !self.open.contains_key(job_id) {
+            std::fs::create_dir_all(&dir)?;
+            self.open.insert(
+                job_id.clone(),
+                OpenOutput {
+                    head: None,
+                    tail: None,
+                    tail_bytes: file_len(&dir.join(TAIL_FILE)),
+                },
+            );
+        }
+        let output = self.open.get_mut(job_id).expect("opened above");
+        if !head.is_empty() {
+            if output.head.is_none() {
+                output.head = Some(BufWriter::new(append_to(&dir.join(HEAD_FILE))?));
+            }
+            let writer = output.head.as_mut().expect("opened above");
+            write_frame(writer, offset, stream, head)?;
+        }
+        if !tail.is_empty() {
+            if output.tail.is_none() {
+                output.tail = Some(BufWriter::new(append_to(&dir.join(TAIL_FILE))?));
+            }
+            let writer = output.tail.as_mut().expect("opened above");
+            write_frame(writer, offset + head_len as u64, stream, tail)?;
+            output.tail_bytes += (FRAME_HEADER_BYTES + tail.len()) as u64;
+            if output.tail_bytes > 2 * self.tail_cap + 64 * 1024 {
+                let tail_cap = self.tail_cap;
+                compact_tail(&dir, output, tail_cap)?;
+            }
+        }
+        Ok(())
+    }
+
+    fn flush_all(&mut self) {
+        for (job_id, output) in &mut self.open {
+            for writer in [output.head.as_mut(), output.tail.as_mut()]
+                .into_iter()
+                .flatten()
+            {
+                if let Err(error) = writer.flush() {
+                    eprintln!("lightspeed-envd: could not flush output of job {job_id}: {error}");
+                }
+            }
+        }
+    }
+}
+
+/// Rewrites the tail log with only its newest `tail_cap` bytes.
+fn compact_tail(dir: &Path, output: &mut OpenOutput, tail_cap: u64) -> std::io::Result<()> {
+    if let Some(mut writer) = output.tail.take() {
+        writer.flush()?;
+    }
+    let path = dir.join(TAIL_FILE);
+    let mut records = read_frames(&path)?;
+    let mut kept = 0u64;
+    let mut first = records.len();
+    while first > 0 && kept < tail_cap {
+        first -= 1;
+        kept += records[first].2.len() as u64;
+    }
+    let mut records = records.split_off(first);
+    if let Some((offset, _, data)) = records.first_mut()
+        && kept > tail_cap
+    {
+        let excess = (kept - tail_cap) as usize;
+        data.drain(..excess);
+        *offset += excess as u64;
+    }
+    let temp = dir.join(format!("{TAIL_FILE}.tmp"));
+    {
+        let mut writer = BufWriter::new(File::create(&temp)?);
+        for (offset, stream, data) in &records {
+            write_frame(&mut writer, *offset, *stream, data)?;
+        }
+        writer.flush()?;
+    }
+    std::fs::rename(&temp, &path)?;
+    output.tail_bytes = file_len(&path);
+    output.tail = Some(BufWriter::new(append_to(&path)?));
+    Ok(())
+}
+
+fn lock<T>(mutex: &Mutex<T>) -> MutexGuard<'_, T> {
+    mutex
+        .lock()
+        .unwrap_or_else(|poisoned| poisoned.into_inner())
+}
+
+fn append_to(path: &Path) -> std::io::Result<File> {
+    OpenOptions::new().create(true).append(true).open(path)
+}
+
+fn file_len(path: &Path) -> u64 {
+    std::fs::metadata(path).map_or(0, |metadata| metadata.len())
+}
+
+fn write_frame(
+    writer: &mut impl std::io::Write,
+    offset: u64,
+    stream: OutputStream,
+    data: &[u8],
+) -> std::io::Result<()> {
+    let stream = match stream {
+        OutputStream::Stdout => 0u8,
+        OutputStream::Stderr => 1,
+        OutputStream::Pty => 2,
+    };
+    let len = u32::try_from(data.len()).map_err(std::io::Error::other)?;
+    writer.write_all(&offset.to_le_bytes())?;
+    writer.write_all(&[stream])?;
+    writer.write_all(&len.to_le_bytes())?;
+    writer.write_all(data)
+}
+
+/// Every whole frame of a log; a frame cut short by a crash ends it.
+fn read_frames(path: &Path) -> std::io::Result<Vec<(u64, OutputStream, Vec<u8>)>> {
+    let mut bytes = Vec::new();
+    match File::open(path) {
+        Ok(mut file) => {
+            file.read_to_end(&mut bytes)?;
+        }
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(Vec::new()),
+        Err(error) => return Err(error),
+    }
+    let mut frames = Vec::new();
+    let mut rest = bytes.as_slice();
+    while rest.len() >= FRAME_HEADER_BYTES {
+        let offset = u64::from_le_bytes(rest[..8].try_into().expect("8 bytes"));
+        let stream = match rest[8] {
+            0 => OutputStream::Stdout,
+            1 => OutputStream::Stderr,
+            2 => OutputStream::Pty,
+            _ => break,
+        };
+        let len = u32::from_le_bytes(rest[9..13].try_into().expect("4 bytes")) as usize;
+        let Some(data) = rest.get(FRAME_HEADER_BYTES..FRAME_HEADER_BYTES + len) else {
+            break;
+        };
+        frames.push((offset, stream, data.to_vec()));
+        rest = &rest[FRAME_HEADER_BYTES + len..];
+    }
+    Ok(frames)
+}
+
+#[cfg(test)]
+mod tests {
+    use environment_protocol::data::exec::GapReason;
+
+    use super::*;
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn output_round_trips_with_head_tail_and_bounded_disk_use() {
+        let temp = tempfile::tempdir().expect("tempdir");
+        let store = JobStore::start(temp.path().to_owned(), 1000, 1000).expect("store");
+        let job_id = JobId::new("verbose").unwrap();
+        // 200 KiB through 8 KiB appends against a 1000-byte tail.
+        let mut offset = 0u64;
+        for i in 0..25u8 {
+            let data = vec![i; 8192];
+            store.append(&job_id, offset, OutputStream::Stdout, &data);
+            offset += data.len() as u64;
+        }
+        store.finish(&job_id, b"{}".to_vec()).await;
+        let dir = temp.path().join("verbose");
+        assert!(
+            file_len(&dir.join(TAIL_FILE))
+                <= 2 * 1000 + 64 * 1024 + 8192 + 2 * FRAME_HEADER_BYTES as u64,
+            "the tail log is compacted"
+        );
+        assert_eq!(
+            file_len(&dir.join(HEAD_FILE)),
+            1000 + FRAME_HEADER_BYTES as u64
+        );
+        assert_eq!(std::fs::read(dir.join(RECORD_FILE)).unwrap(), b"{}");
+
+        let log = load_output(&dir, offset, 2000).expect("load");
+        assert_eq!(log.end(), offset);
+        let page = log.page(0, 10_000, 4096);
+        assert_eq!(page.gaps.len(), 1);
+        assert_eq!(page.gaps[0].reason, GapReason::Overflow);
+        assert_eq!(page.gaps[0].offset, 1000);
+        assert_eq!(page.gaps[0].omitted_bytes, offset - 2000);
+        assert_eq!(page.bytes, 2000);
+        assert_eq!(
+            page.chunks.last().unwrap().data.as_slice().last(),
+            Some(&24)
+        );
+
+        store.remove(&job_id);
+        let _ = store
+            .write_record(&JobId::new("other").unwrap(), b"{}".to_vec())
+            .await;
+        assert!(!dir.exists(), "commands run in order");
+    }
+
+    #[test]
+    fn pending_output_keeps_the_head_and_the_newest_tail_only() {
+        let mut pending = Pending::default();
+        let (head_cap, tail_cap) = (100u64, 300u64);
+        let mut offset = 0u64;
+        for i in 0..50u8 {
+            let data = [i; 64];
+            let head_len = head_cap.saturating_sub(offset).min(64) as usize;
+            let (head, tail) = data.split_at(head_len);
+            pending.push(offset, OutputStream::Stdout, head, head_cap);
+            pending.push(
+                offset + head_len as u64,
+                OutputStream::Stdout,
+                tail,
+                head_cap,
+            );
+            pending.tail_bytes += tail.len() as u64;
+            pending.trim_tail(head_cap, tail_cap);
+            offset += 64;
+            let held: u64 = pending
+                .frames
+                .iter()
+                .map(|(_, _, data)| data.len() as u64)
+                .sum();
+            assert!(held <= head_cap + tail_cap, "{held} bytes pending");
+        }
+        let frames = &pending.frames;
+        assert_eq!(frames.len(), 2, "contiguous output coalesces per side");
+        assert_eq!((frames[0].0, frames[0].2.len()), (0, 100));
+        assert_eq!(frames[1].0, offset - tail_cap);
+        assert_eq!(frames[1].2.len() as u64, tail_cap);
+        assert_eq!(frames[1].2.last(), Some(&49));
+    }
+
+    #[test]
+    fn a_frame_cut_short_ends_the_log() {
+        let temp = tempfile::tempdir().expect("tempdir");
+        let path = temp.path().join("log");
+        let mut bytes = Vec::new();
+        write_frame(&mut bytes, 0, OutputStream::Stderr, b"whole").unwrap();
+        write_frame(&mut bytes, 5, OutputStream::Stdout, b"cut").unwrap();
+        bytes.truncate(bytes.len() - 1);
+        std::fs::write(&path, bytes).unwrap();
+        let frames = read_frames(&path).unwrap();
+        assert_eq!(frames, vec![(0, OutputStream::Stderr, b"whole".to_vec())]);
+    }
+}
diff --git a/crates/environment-daemon/src/exec/log.rs b/crates/environment-daemon/src/exec/log.rs
new file mode 100644
index 000000000..8e711c446
--- /dev/null
+++ b/crates/environment-daemon/src/exec/log.rs
@@ -0,0 +1,422 @@
+//! Byte-offset output logs.
+//!
+//! A log holds a handle's combined output as segments addressed by byte
+//! offset. `end` counts every byte ever appended; a retention cap drops
+//! bytes but never renumbers them, so a page cut at any byte loses nothing
+//! and every range the log no longer holds is reported as a typed gap.
+
+use std::collections::VecDeque;
+
+use environment_protocol::{
+    bytes::ByteChunk,
+    data::exec::{GapReason, OutputChunk, OutputGap, OutputStream},
+};
+
+/// Consecutive appends from one stream merge into one segment up to this
+/// size, which keeps the chunk count of a page low.
+const MERGE_LIMIT_BYTES: usize = 64 * 1024;
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+struct Segment {
+    offset: u64,
+    stream: OutputStream,
+    data: Vec<u8>,
+}
+
+impl Segment {
+    fn end(&self) -> u64 {
+        self.offset + self.data.len() as u64
+    }
+}
+
+/// One page cut from a log.
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub(crate) struct Page {
+    pub chunks: Vec<OutputChunk>,
+    pub gaps: Vec<OutputGap>,
+    /// Offset after the last returned byte or gap; the start when the page
+    /// is empty.
+    pub next: u64,
+    /// Bytes of `data` returned.
+    pub bytes: u64,
+}
+
+impl Page {
+    pub fn items(&self) -> u32 {
+        u32::try_from(self.chunks.len() + self.gaps.len()).unwrap_or(u32::MAX)
+    }
+}
+
+/// Retained output of one handle.
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub(crate) struct OutputLog {
+    /// Sorted by offset, disjoint.
+    segments: VecDeque<Segment>,
+    end: u64,
+    retained: u64,
+    /// Bytes below this offset were delivered and released.
+    released_until: u64,
+    /// Ranges `[start, end)` dropped from the middle, sorted, disjoint and
+    /// never adjacent. Ranges below `released_until` are forgotten and then
+    /// read as released.
+    overflow: Vec<(u64, u64)>,
+}
+
+impl OutputLog {
+    /// A log rebuilt from persisted records, in offset order. Holes between
+    /// records, and a missing tail up to `end`, read as overflow.
+    pub fn from_records(
+        records: impl IntoIterator<Item = (u64, OutputStream, Vec<u8>)>,
+        end: u64,
+    ) -> Self {
+        let mut log = Self::default();
+        for (offset, stream, data) in records {
+            if data.is_empty() {
+                continue;
+            }
+            // Overlapping records (a tail that was compacted after a crash
+            // left a stale copy) keep the first copy of every byte.
+            let record_end = offset + data.len() as u64;
+            if record_end <= log.end {
+                continue;
+            }
+            let skip = log.end.saturating_sub(offset) as usize;
+            let offset = offset.max(log.end);
+            if offset > log.end {
+                log.add_overflow(log.end, offset);
+                log.end = offset;
+            }
+            log.append(stream, &data[skip..]);
+        }
+        if end > log.end {
+            log.add_overflow(log.end, end);
+            log.end = end;
+        }
+        log
+    }
+
+    /// Bytes produced so far.
+    pub fn end(&self) -> u64 {
+        self.end
+    }
+
+    /// Bytes held.
+    pub fn retained_bytes(&self) -> u64 {
+        self.retained
+    }
+
+    pub fn append(&mut self, stream: OutputStream, data: &[u8]) {
+        if data.is_empty() {
+            return;
+        }
+        let offset = self.end;
+        match self.segments.back_mut() {
+            Some(last)
+                if last.stream == stream
+                    && last.end() == offset
+                    && last.data.len() + data.len() <= MERGE_LIMIT_BYTES =>
+            {
+                last.data.extend_from_slice(data);
+            }
+            _ => self.segments.push_back(Segment {
+                offset,
+                stream,
+                data: data.to_vec(),
+            }),
+        }
+        self.end += data.len() as u64;
+        self.retained += data.len() as u64;
+    }
+
+    /// Keeps at most `cap` bytes. First releases delivered bytes (below
+    /// `cursor`), oldest first; if still over, drops from the middle of the
+    /// undelivered region, keeping its head (the first half of `cap` from
+    /// `cursor`) and the newest bytes. Every dropped range becomes an
+    /// overflow gap; consecutive drops extend one gap.
+    pub fn enforce_cap(&mut self, cap: u64, cursor: u64) {
+        while self.retained > cap {
+            let Some(front) = self.segments.front_mut() else {
+                break;
+            };
+            if front.offset >= cursor {
+                break;
+            }
+            let releasable = cursor.min(front.end()) - front.offset;
+            let release = releasable.min(self.retained - cap) as usize;
+            front.data.drain(..release);
+            front.offset += release as u64;
+            self.retained -= release as u64;
+            self.released_until = self.released_until.max(front.offset);
+            if front.data.is_empty() {
+                self.segments.pop_front();
+            }
+        }
+        let released_until = self.released_until;
+        self.overflow.retain(|(_, end)| *end > released_until);
+
+        if self.retained <= cap {
+            return;
+        }
+        let head_end = cursor.max(self.released_until).saturating_add(cap / 2);
+        let mut excess = self.retained - cap;
+        let mut index = self
+            .segments
+            .partition_point(|segment| segment.end() <= head_end);
+        while excess > 0 && index < self.segments.len() {
+            let segment = &mut self.segments[index];
+            if segment.offset < head_end {
+                // The segment straddles the head: keep its head part.
+                let keep = (head_end - segment.offset) as usize;
+                let rest = segment.data.split_off(keep);
+                let tail = Segment {
+                    offset: head_end,
+                    stream: segment.stream,
+                    data: rest,
+                };
+                self.segments.insert(index + 1, tail);
+                index += 1;
+                continue;
+            }
+            let drop = excess.min(segment.data.len() as u64);
+            let start = segment.offset;
+            segment.data.drain(..drop as usize);
+            segment.offset += drop;
+            let emptied = segment.data.is_empty();
+            self.retained -= drop;
+            excess -= drop;
+            self.add_overflow(start, start + drop);
+            if emptied {
+                self.segments.remove(index);
+            }
+        }
+    }
+
+    /// A page from `start`: at most `max_bytes` of data, split at exactly
+    /// that byte, and at most `max_items` chunks and gaps together. An empty
+    /// budget returns an empty page at `start`.
+    pub fn page(&self, start: u64, max_bytes: u64, max_items: u32) -> Page {
+        let mut page = Page {
+            next: start,
+            ..Page::default()
+        };
+        let mut pos = start;
+        let mut budget = max_bytes;
+        while pos < self.end && budget > 0 && page.items() < max_items {
+            if let Some(&(_, end)) = self
+                .overflow
+                .iter()
+                .find(|(range_start, end)| *range_start <= pos && pos < *end)
+            {
+                push_gap(&mut page, pos, end, GapReason::Overflow, max_items);
+                pos = end;
+            } else if pos < self.released_until {
+                let end = self
+                    .overflow
+                    .iter()
+                    .map(|(range_start, _)| *range_start)
+                    .find(|range_start| *range_start > pos)
+                    .map_or(self.released_until, |range_start| {
+                        range_start.min(self.released_until)
+                    });
+                push_gap(&mut page, pos, end, GapReason::Expired, max_items);
+                pos = end;
+            } else {
+                let index = self
+                    .segments
+                    .partition_point(|segment| segment.end() <= pos);
+                match self.segments.get(index) {
+                    Some(segment) if segment.offset <= pos => {
+                        let from = (pos - segment.offset) as usize;
+                        let take = (segment.data.len() - from).min(budget as usize);
+                        page.chunks.push(OutputChunk {
+                            offset: pos,
+                            stream: segment.stream,
+                            data: ByteChunk::from(&segment.data[from..from + take]),
+                        });
+                        pos += take as u64;
+                        budget -= take as u64;
+                        page.bytes += take as u64;
+                    }
+                    next => {
+                        // A hole no rule explains reads as overflow.
+                        let end = next.map_or(self.end, |segment| segment.offset);
+                        push_gap(&mut page, pos, end, GapReason::Overflow, max_items);
+                        pos = end;
+                    }
+                }
+            }
+            page.next = pos;
+        }
+        page
+    }
+
+    fn add_overflow(&mut self, start: u64, end: u64) {
+        if start >= end {
+            return;
+        }
+        let index = self
+            .overflow
+            .partition_point(|(_, range_end)| *range_end < start);
+        let mut merged = (start, end);
+        while let Some(&(range_start, range_end)) = self.overflow.get(index) {
+            if range_start > merged.1 {
+                break;
+            }
+            merged = (merged.0.min(range_start), merged.1.max(range_end));
+            self.overflow.remove(index);
+        }
+        self.overflow.insert(index, merged);
+    }
+}
+
+fn push_gap(page: &mut Page, start: u64, end: u64, reason: GapReason, max_items: u32) {
+    if let Some(last) = page.gaps.last_mut()
+        && last.reason == reason
+        && last.offset + last.omitted_bytes == start
+        && page
+            .chunks
+            .last()
+            .is_none_or(|chunk| chunk.offset < last.offset)
+    {
+        last.omitted_bytes += end - start;
+        return;
+    }
+    debug_assert!(page.items() < max_items);
+    page.gaps.push(OutputGap {
+        offset: start,
+        omitted_bytes: end - start,
+        reason,
+    });
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn bytes(page: &Page) -> Vec<u8> {
+        page.chunks
+            .iter()
+            .flat_map(|chunk| chunk.data.as_slice().to_vec())
+            .collect()
+    }
+
+    fn log_of(parts: &[&[u8]]) -> OutputLog {
+        let mut log = OutputLog::default();
+        for (index, part) in parts.iter().enumerate() {
+            let stream = if index % 2 == 0 {
+                OutputStream::Stdout
+            } else {
+                OutputStream::Stderr
+            };
+            log.append(stream, part);
+        }
+        log
+    }
+
+    #[test]
+    fn pages_cut_at_max_bytes_and_continue_without_loss() {
+        // Job paging used to skip the remainder of a cut chunk: every byte
+        // of 20 000 must arrive through 100-byte pages.
+        let data: Vec<u8> = (0..20_000u32).map(|i| (i % 251) as u8).collect();
+        let mut log = OutputLog::default();
+        for chunk in data.chunks(8192) {
+            log.append(OutputStream::Stdout, chunk);
+        }
+        let mut collected = Vec::new();
+        let mut next = 0;
+        while next < log.end() {
+            let page = log.page(next, 100, 4096);
+            assert!(page.bytes <= 100);
+            assert!(page.gaps.is_empty());
+            assert_eq!(page.chunks[0].offset, next);
+            collected.extend(bytes(&page));
+            next = page.next;
+        }
+        assert_eq!(collected, data);
+    }
+
+    #[test]
+    fn zero_budget_leaves_the_position_in_place() {
+        let log = log_of(&[b"abc"]);
+        let page = log.page(1, 0, 4096);
+        assert!(page.chunks.is_empty() && page.gaps.is_empty());
+        assert_eq!(page.next, 1);
+    }
+
+    #[test]
+    fn chunks_keep_stream_and_offset() {
+        let log = log_of(&[b"out", b"err"]);
+        let page = log.page(2, 100, 4096);
+        assert_eq!(page.chunks.len(), 2);
+        assert_eq!(page.chunks[0].offset, 2);
+        assert_eq!(page.chunks[0].stream, OutputStream::Stdout);
+        assert_eq!(page.chunks[1].offset, 3);
+        assert_eq!(page.chunks[1].stream, OutputStream::Stderr);
+        assert_eq!(bytes(&page), b"terr");
+        assert_eq!(page.next, 6);
+    }
+
+    #[test]
+    fn cap_drops_one_middle_range_and_keeps_head_and_newest() {
+        let mut log = OutputLog::default();
+        for i in 0..64u8 {
+            log.append(OutputStream::Stdout, &[i; 100]);
+            log.enforce_cap(1000, 0);
+        }
+        assert_eq!(log.end(), 6400);
+        assert_eq!(log.retained_bytes(), 1000);
+        let page = log.page(0, 10_000, 4096);
+        assert_eq!(page.gaps.len(), 1, "one contiguous gap: {:?}", page.gaps);
+        assert_eq!(page.gaps[0].reason, GapReason::Overflow);
+        assert_eq!(page.gaps[0].offset, 500);
+        assert_eq!(page.gaps[0].omitted_bytes, 6400 - 1000);
+        let data = bytes(&page);
+        assert_eq!(
+            &data[..500],
+            &[[0u8; 100], [1; 100], [2; 100], [3; 100], [4; 100]].concat()[..]
+        );
+        assert_eq!(data[999], 63, "the newest byte survives");
+        assert_eq!(page.next, 6400);
+    }
+
+    #[test]
+    fn delivered_bytes_are_released_first_and_read_as_expired() {
+        let mut log = log_of(&[b"0123456789"]);
+        // Everything up to 8 was delivered through the cursor.
+        log.append(OutputStream::Stdout, b"abcdef");
+        log.enforce_cap(10, 8);
+        assert_eq!(log.retained_bytes(), 10);
+        let page = log.page(0, 100, 4096);
+        assert_eq!(page.gaps[0].reason, GapReason::Expired);
+        assert_eq!(page.gaps[0].offset, 0);
+        assert_eq!(page.gaps[0].omitted_bytes, 6);
+        assert_eq!(bytes(&page), b"6789abcdef");
+    }
+
+    #[test]
+    fn page_item_limit_ends_the_page_early_without_loss() {
+        let log = log_of(&[b"a", b"b", b"c", b"d"]);
+        let page = log.page(0, 100, 2);
+        assert_eq!(bytes(&page), b"ab");
+        assert_eq!(page.next, 2);
+        let rest = log.page(page.next, 100, 2);
+        assert_eq!(bytes(&rest), b"cd");
+    }
+
+    #[test]
+    fn records_rebuild_head_tail_and_the_gap_between() {
+        let log = OutputLog::from_records(
+            [
+                (0, OutputStream::Stdout, b"head".to_vec()),
+                (100, OutputStream::Stderr, b"tail".to_vec()),
+            ],
+            110,
+        );
+        assert_eq!(log.end(), 110);
+        let page = log.page(0, 100, 4096);
+        assert_eq!(bytes(&page), b"headtail");
+        assert_eq!(page.gaps.len(), 2);
+        assert_eq!((page.gaps[0].offset, page.gaps[0].omitted_bytes), (4, 96));
+        assert_eq!((page.gaps[1].offset, page.gaps[1].omitted_bytes), (104, 6));
+    }
+}
diff --git a/crates/environment-daemon/src/exec/outcome.rs b/crates/environment-daemon/src/exec/outcome.rs
new file mode 100644
index 000000000..05d1d01a0
--- /dev/null
+++ b/crates/environment-daemon/src/exec/outcome.rs
@@ -0,0 +1,179 @@
+//! How a root process ended, and what its group left behind.
+
+use environment_protocol::{
+    data::exec::{ExitStatus, LeftoverDisposition, LeftoverProcess, LeftoverReport, SignalName},
+    limits::{MAX_LEFTOVER_COMMAND_BYTES, MAX_LEFTOVER_PROCESSES},
+};
+
+/// The wire exit of a reaped child: its status code, or the signal that
+/// killed it by name.
+pub(crate) fn exit_status(status: std::process::ExitStatus) -> ExitStatus {
+    #[cfg(unix)]
+    {
+        use std::os::unix::process::ExitStatusExt as _;
+        if let Some(signal) = status.signal() {
+            return ExitStatus::Signal {
+                signal: signal_name(signal),
+                core_dumped: status.core_dumped(),
+            };
+        }
+    }
+    ExitStatus::Code {
+        code: status.code().unwrap_or(-1),
+    }
+}
+
+/// `exit 3` or `SIGSEGV (core dumped)`, for error messages.
+pub(crate) fn describe_exit(exit: &ExitStatus) -> String {
+    match exit {
+        ExitStatus::Code { code } => format!("exited with status {code}"),
+        ExitStatus::Signal {
+            signal,
+            core_dumped: true,
+        } => format!("terminated by signal {signal} (core dumped)"),
+        ExitStatus::Signal { signal, .. } => format!("terminated by signal {signal}"),
+    }
+}
+
+/// The POSIX name of signal number `raw` on this platform. A number
+/// without a portable name is spelled `SIG<number>`.
+pub(crate) fn signal_name(raw: i32) -> SignalName {
+    #[cfg(unix)]
+    {
+        use rustix::process::Signal;
+        let known: &[(Signal, &str)] = &[
+            (Signal::HUP, "SIGHUP"),
+            (Signal::INT, "SIGINT"),
+            (Signal::QUIT, "SIGQUIT"),
+            (Signal::ILL, "SIGILL"),
+            (Signal::TRAP, "SIGTRAP"),
+            (Signal::ABORT, "SIGABRT"),
+            (Signal::BUS, "SIGBUS"),
+            (Signal::FPE, "SIGFPE"),
+            (Signal::KILL, "SIGKILL"),
+            (Signal::USR1, "SIGUSR1"),
+            (Signal::SEGV, "SIGSEGV"),
+            (Signal::USR2, "SIGUSR2"),
+            (Signal::PIPE, "SIGPIPE"),
+            (Signal::ALARM, "SIGALRM"),
+            (Signal::TERM, "SIGTERM"),
+            (Signal::CHILD, "SIGCHLD"),
+            (Signal::CONT, "SIGCONT"),
+            (Signal::STOP, "SIGSTOP"),
+            (Signal::TSTP, "SIGTSTP"),
+            (Signal::TTIN, "SIGTTIN"),
+            (Signal::TTOU, "SIGTTOU"),
+            (Signal::URG, "SIGURG"),
+            (Signal::XCPU, "SIGXCPU"),
+            (Signal::XFSZ, "SIGXFSZ"),
+            (Signal::VTALARM, "SIGVTALRM"),
+            (Signal::PROF, "SIGPROF"),
+            (Signal::WINCH, "SIGWINCH"),
+            (Signal::IO, "SIGIO"),
+            (Signal::SYS, "SIGSYS"),
+            #[cfg(target_os = "linux")]
+            (Signal::STKFLT, "SIGSTKFLT"),
+            #[cfg(target_os = "linux")]
+            (Signal::POWER, "SIGPWR"),
+            #[cfg(target_os = "macos")]
+            (Signal::EMT, "SIGEMT"),
+            #[cfg(target_os = "macos")]
+            (Signal::INFO, "SIGINFO"),
+        ];
+        if let Some((_, name)) = known.iter().find(|(signal, _)| signal.as_raw() == raw) {
+            return SignalName::new(*name).expect("known signal names are valid");
+        }
+    }
+    SignalName::new(format!("SIG{}", raw.unsigned_abs()))
+        .expect("SIG followed by at most 10 digits is a valid signal name")
+}
+
+/// A report from enumerated members, lowest pid first: at most
+/// `MAX_LEFTOVER_PROCESSES` listed, commands cut to
+/// `MAX_LEFTOVER_COMMAND_BYTES` on a character boundary.
+pub(crate) fn leftover_report(
+    mut members: Vec<(u32, Option<String>)>,
+    disposition: LeftoverDisposition,
+) -> Option<LeftoverReport> {
+    if members.is_empty() {
+        return None;
+    }
+    members.sort_by_key(|(pid, _)| *pid);
+    let listed = MAX_LEFTOVER_PROCESSES as usize;
+    let omitted_process_count =
+        u32::try_from(members.len().saturating_sub(listed)).unwrap_or(u32::MAX);
+    members.truncate(listed);
+    let processes = members
+        .into_iter()
+        .map(|(pid, command)| LeftoverProcess {
+            pid,
+            command: command
+                .map(|command| cut(command, MAX_LEFTOVER_COMMAND_BYTES as usize))
+                .filter(|command| !command.is_empty()),
+        })
+        .collect();
+    Some(LeftoverReport {
+        disposition,
+        processes,
+        omitted_process_count,
+    })
+}
+
+fn cut(mut text: String, max: usize) -> String {
+    if text.len() > max {
+        let mut end = max;
+        while !text.is_char_boundary(end) {
+            end -= 1;
+        }
+        text.truncate(end);
+    }
+    text
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[cfg(unix)]
+    #[test]
+    fn signal_deaths_are_named_and_codes_kept() {
+        use std::os::unix::process::ExitStatusExt as _;
+        // A raw wait status: low 7 bits the signal, 0x80 the core flag.
+        let segv =
+            std::process::ExitStatus::from_raw(rustix::process::Signal::SEGV.as_raw() | 0x80);
+        assert_eq!(
+            exit_status(segv),
+            ExitStatus::Signal {
+                signal: SignalName::new("SIGSEGV").unwrap(),
+                core_dumped: true,
+            }
+        );
+        let term = std::process::ExitStatus::from_raw(rustix::process::Signal::TERM.as_raw());
+        assert_eq!(
+            describe_exit(&exit_status(term)),
+            "terminated by signal SIGTERM"
+        );
+        let code = std::process::ExitStatus::from_raw(3 << 8);
+        assert_eq!(exit_status(code), ExitStatus::Code { code: 3 });
+        assert_eq!(signal_name(200).as_str(), "SIG200");
+    }
+
+    #[test]
+    fn leftover_reports_are_capped_sorted_and_cut() {
+        let members = (0..100u32)
+            .rev()
+            .map(|pid| (pid + 10, Some("é".repeat(1000))))
+            .collect();
+        let report = leftover_report(members, LeftoverDisposition::Kept).expect("report");
+        assert_eq!(report.processes.len(), MAX_LEFTOVER_PROCESSES as usize);
+        assert_eq!(report.omitted_process_count, 100 - MAX_LEFTOVER_PROCESSES);
+        assert_eq!(report.processes[0].pid, 10);
+        let command = report.processes[0].command.as_deref().unwrap();
+        assert!(command.len() <= MAX_LEFTOVER_COMMAND_BYTES as usize);
+        assert!(command.len() >= MAX_LEFTOVER_COMMAND_BYTES as usize - 1);
+        assert!(leftover_report(Vec::new(), LeftoverDisposition::Swept).is_none());
+        let unnamed = leftover_report(vec![(5, Some(String::new()))], LeftoverDisposition::Swept)
+            .expect("report");
+        assert_eq!(unnamed.processes[0].command, None);
+    }
+}
diff --git a/crates/environment-daemon/src/exec/spawn_record.rs b/crates/environment-daemon/src/exec/spawn_record.rs
new file mode 100644
index 000000000..1e3c6b4e2
--- /dev/null
+++ b/crates/environment-daemon/src/exec/spawn_record.rs
@@ -0,0 +1,101 @@
+//! Persisted spawn records: which process groups an earlier daemon
+//! instance owned.
+//!
+//! A record names a group by its id, its leader's start time and the boot
+//! it ran in. After a restart in the same boot, a group whose record still
+//! matches is the earlier instance's: jobs kill it, processes adopt it as
+//! leftovers. A group id cannot be reused while the group has members, so a
+//! live group whose leader is gone is still the recorded one; a live leader
+//! must also match its recorded start time.
+
+use std::path::Path;
+
+use environment_protocol::ids::DaemonInstanceId;
+use serde::{Deserialize, Serialize};
+
+use crate::process_group::{self, Group};
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub(crate) struct SpawnRecord {
+    pub pgid: u32,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub leader_start_time: Option<u64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub boot_id: Option<String>,
+    pub daemon_instance_id: DaemonInstanceId,
+}
+
+impl SpawnRecord {
+    /// A record of `group`, spawned by this daemon instance.
+    pub fn new(group: Group, instance_id: &DaemonInstanceId) -> Self {
+        Self {
+            pgid: group.pgid,
+            leader_start_time: group.leader_start_time,
+            boot_id: process_group::boot_id(),
+            daemon_instance_id: instance_id.clone(),
+        }
+    }
+
+    /// The recorded group.
+    pub fn group(&self) -> Group {
+        Group {
+            pgid: self.pgid,
+            leader_start_time: self.leader_start_time,
+        }
+    }
+
+    /// The record was written in `boot`, the current boot.
+    pub fn same_boot(&self, boot: Option<&str>) -> bool {
+        boot.is_some() && self.boot_id.as_deref() == boot
+    }
+
+    /// The recorded group still has members, and they are the recorded
+    /// group's. Only meaningful for a record of the current boot.
+    pub fn group_survives(&self) -> bool {
+        self.group().alive()
+    }
+}
+
+/// Writes `value` as JSON to `path` through a sibling temporary file, so a
+/// crash leaves either the old or the new content.
+pub(crate) fn write_json_atomic<T: Serialize>(path: &Path, value: &T) -> std::io::Result<()> {
+    let bytes = serde_json::to_vec(value).map_err(std::io::Error::other)?;
+    let mut temp = path.as_os_str().to_owned();
+    temp.push(".tmp");
+    std::fs::write(&temp, bytes)?;
+    std::fs::rename(&temp, path)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[cfg(any(target_os = "linux", target_os = "macos"))]
+    #[tokio::test(flavor = "current_thread")]
+    async fn a_live_group_survives_and_a_reused_leader_does_not() {
+        let mut command = tokio::process::Command::new("/bin/sh");
+        command.args(["-c", "sleep 30"]);
+        process_group::spawn_in_own_group(&mut command);
+        let mut child = command.spawn().expect("spawn");
+        let pgid = child.id().expect("pid");
+        let instance = DaemonInstanceId::new("envd_test").unwrap();
+        let record = SpawnRecord::new(Group::capture(pgid), &instance);
+        assert!(record.same_boot(process_group::boot_id().as_deref()));
+        assert!(!record.same_boot(None));
+        assert!(record.group_survives());
+
+        let reused = SpawnRecord {
+            leader_start_time: record.leader_start_time.map(|started| started + 1),
+            ..record.clone()
+        };
+        assert!(
+            !reused.group_survives(),
+            "another process with the same pid"
+        );
+
+        process_group::signal_group(pgid, process_group::GroupSignal::Kill);
+        child.wait().await.expect("wait");
+        assert!(!record.group_survives());
+    }
+}
diff --git a/crates/environment-daemon/src/filesystem.rs b/crates/environment-daemon/src/filesystem.rs
index ed49142e7..af69d711f 100644
--- a/crates/environment-daemon/src/filesystem.rs
+++ b/crates/environment-daemon/src/filesystem.rs
@@ -1,1119 +1,1407 @@
-#[cfg(any(target_os = "linux", target_os = "macos"))]
-mod backend;
-#[cfg(any(target_os = "linux", target_os = "macos"))]
+//! envd's filesystem: the `fs/*` and `transfer/*` handlers.
+//!
+//! Every path goes through one [`Confinement`]: resolved beneath the root's
+//! directory descriptor, following a symlink only while its target stays
+//! inside the root, and never addressing the daemon state directory. Every
+//! later operation names the resolved entry by its parent descriptor and
+//! name, so nothing follows a link swapped in after resolution. Handlers do
+//! their I/O on blocking threads; walks poll the request's cancellation
+//! token between entries.
+
+mod confinement;
+mod os;
 mod scan;
-use environment_protocol::data::transfer::*;
+mod search;
 mod transfer;
+mod walk;
+
 use std::{
-    io,
-    path::{Component, Path, PathBuf},
-    time::{Duration, Instant, SystemTime, UNIX_EPOCH},
+    ffi::OsString,
+    fmt::Display,
+    io::{self, Seek, SeekFrom, Write},
+    path::{Path, PathBuf},
+    sync::Arc,
 };
 
+pub use confinement::Confinement;
+use confinement::Lookup;
 use environment_protocol::{
-    data::fs::{
-        CopyParams, CopyResponse, CreateDirectoryParams, CreateDirectoryResponse,
-        GetMetadataParams, GetMetadataResponse, GlobFilesParams, GlobFilesResponse, GlobFilesStop,
-        ReadDirectoryEntry, ReadDirectoryParams, ReadDirectoryResponse, ReadFileParams,
-        ReadFileResponse, RemoveParams, RemoveResponse, SearchTextMatch, SearchTextParams,
-        SearchTextResponse, SearchTextStop, WriteFileParams, WriteFileResponse,
+    data::{
+        fs::{
+            CreateDirectoryParams, CreateDirectoryResponse, DirectoryEntry, FileKind, FileMetadata,
+            FileVersion, GetMetadataParams, GetMetadataResponse, GlobFilesParams,
+            GlobFilesResponse, ReadDirectoryParams, ReadDirectoryResponse, ReadFileParams,
+            ReadFileResponse, RemoveParams, RemoveResponse, RenameParams, RenameResponse,
+            SearchTextParams, SearchTextResponse, WriteCondition, WriteFileParams,
+            WriteFileResponse,
+        },
+        handshake::FilesystemLimits,
+        scan::{ScanParams, ScanResponse},
+        transfer::{
+            AppendTransferInventoryParams, BeginTransferParams, ListTransferMissingParams,
+            ListTransferMissingResponse, ReadTransferContentParams, ReadTransferContentResponse,
+            ReadTransferInventoryParams, ReadTransferInventoryResponse, TransferOperationParams,
+            TransferStatus, WriteTransferContentParams, WriteTransferContentResponse,
+        },
     },
-    error::{EnvironmentProtocolError, EnvironmentProtocolErrorCode},
-    shared::{ByteChunk, EnvironmentPath},
+    error::{Capability, PermissionReason, PreconditionReason, ProtocolError},
+    ids::DirectoryCursor,
+    paths::{EntryName, EnvironmentPath},
 };
-use grep_searcher::{BinaryDetection, SearcherBuilder, sinks::UTF8};
-use tokio::fs;
+use os::{Directory, EntryStat, RenameMode};
+use rustix::io::Errno;
+use sha2::{Digest, Sha256};
+
+use crate::dispatch::RequestContext;
+
+/// Prefix of `fs/writeFile` staging files next to their target.
+const WRITE_STAGE_PREFIX: &str = ".lightspeed-write-";
+
+/// What the filesystem handlers need from the daemon.
+pub struct FilesystemConfig {
+    /// The root and state directory; transfers journal in
+    /// `<state_dir>/transfers`.
+    pub confinement: Arc<Confinement>,
+    /// Canonical working directory, inside the root.
+    pub cwd: PathBuf,
+    pub writable: bool,
+    pub limits: FilesystemLimits,
+}
 
+/// The `fs/*` and `transfer/*` handlers. Cheap to clone.
 #[derive(Clone)]
 pub struct LocalFileSystem {
-    root: PathBuf,
+    inner: Arc<Inner>,
+}
+
+struct Inner {
+    confinement: Arc<Confinement>,
     cwd: PathBuf,
     writable: bool,
-    #[cfg(any(target_os = "linux", target_os = "macos"))]
-    transfers: std::sync::Arc<std::sync::Mutex<transfer::session::TransferManager>>,
+    limits: FilesystemLimits,
+    transfers: transfer::Transfers,
 }
 
 impl LocalFileSystem {
-    pub fn new(root: PathBuf, cwd: PathBuf, writable: bool) -> Self {
-        Self {
-            root: normalize_path(root),
-            cwd: normalize_path(cwd),
-            writable,
-            #[cfg(any(target_os = "linux", target_os = "macos"))]
-            transfers: Default::default(),
-        }
-    }
-
-    pub fn with_transfer_state_dir(
-        mut self,
-        path: PathBuf,
-    ) -> Result<Self, EnvironmentProtocolError> {
-        #[cfg(any(target_os = "linux", target_os = "macos"))]
-        {
-            self.transfers = std::sync::Arc::new(std::sync::Mutex::new(
-                transfer::session::TransferManager::with_journal(path)?,
-            ));
-            let weak = std::sync::Arc::downgrade(&self.transfers);
-            std::thread::Builder::new()
-                .name("transfer-expiry".into())
-                .spawn(move || {
-                    loop {
-                        std::thread::sleep(Duration::from_secs(30));
-                        let Some(manager) = weak.upgrade() else {
-                            break;
-                        };
-                        let directory =
-                            manager.lock().ok().and_then(|mut manager| manager.expire());
-                        drop(manager);
-                        if let Some(directory) = directory {
-                            transfer::session::TransferManager::cleanup_expired(&directory);
-                        }
-                    }
-                })
-                .map_err(|e| {
-                    EnvironmentProtocolError::new(
-                        EnvironmentProtocolErrorCode::Internal,
-                        e.to_string(),
-                    )
-                })?;
-        }
-        Ok(self)
-    }
-
-    pub async fn transfer(
-        &self,
-        mut request: environment_protocol::data::transfer_session::TransferRequest,
-    ) -> Result<
-        environment_protocol::data::transfer_session::TransferResponse,
-        EnvironmentProtocolError,
-    > {
-        use environment_protocol::data::transfer_session::{TransferRequest, TransferSelection};
-        if let TransferRequest::Begin { selection, .. } = &mut request {
-            let path = match selection {
-                TransferSelection::Capture { source } => source,
-                TransferSelection::Materialize { destination, .. }
-                | TransferSelection::WriteFile { destination } => {
-                    self.ensure_writable()?;
-                    destination
-                }
-            };
-            *path = EnvironmentPath::new(self.resolve_scoped_path(path)?.to_string_lossy())
-                .map_err(|e| {
-                    EnvironmentProtocolError::new(
-                        EnvironmentProtocolErrorCode::InvalidRequest,
-                        e.to_string(),
-                    )
-                })?;
-        }
-        #[cfg(any(target_os = "linux", target_os = "macos"))]
-        {
-            let transfers = self.transfers.clone();
-            let root = self.root.clone();
-            tokio::task::spawn_blocking(move || {
-                transfers
-                    .lock()
-                    .map_err(|_| {
-                        EnvironmentProtocolError::new(
-                            EnvironmentProtocolErrorCode::Internal,
-                            "transfer lock poisoned",
-                        )
-                    })?
-                    .execute(&root, request)
-            })
-            .await
-            .map_err(|e| {
-                EnvironmentProtocolError::new(EnvironmentProtocolErrorCode::Internal, e.to_string())
-            })?
-        }
-        #[cfg(not(any(target_os = "linux", target_os = "macos")))]
-        {
-            Err(EnvironmentProtocolError::new(
-                EnvironmentProtocolErrorCode::Unsupported,
-                "filesystem transfer backend unavailable",
-            ))
-        }
+    pub fn new(config: FilesystemConfig) -> Result<Self, ProtocolError> {
+        let transfers = transfer::Transfers::new(
+            config.confinement.clone(),
+            config.limits.transfer,
+            config.writable,
+        )?;
+        Ok(Self {
+            inner: Arc::new(Inner {
+                confinement: config.confinement,
+                cwd: config.cwd,
+                writable: config.writable,
+                limits: config.limits,
+                transfers,
+            }),
+        })
     }
 
-    pub async fn scan(
-        &self,
-        mut params: environment_protocol::data::inventory::ScanParams,
-    ) -> Result<environment_protocol::data::inventory::ScanResponse, EnvironmentProtocolError> {
-        for path in &mut params.roots {
-            *path = EnvironmentPath::new(self.resolve_scoped_path(path)?.to_string_lossy())
-                .map_err(|e| {
-                    EnvironmentProtocolError::new(
-                        EnvironmentProtocolErrorCode::InvalidRequest,
-                        e.to_string(),
-                    )
-                })?;
-        }
-        #[cfg(any(target_os = "linux", target_os = "macos"))]
-        {
-            let root = self.root.clone();
-            tokio::task::spawn_blocking(move || scan::scan(&root, params))
-                .await
-                .map_err(|e| {
-                    EnvironmentProtocolError::new(
-                        EnvironmentProtocolErrorCode::Internal,
-                        e.to_string(),
-                    )
-                })?
-        }
-        #[cfg(not(any(target_os = "linux", target_os = "macos")))]
-        {
-            Err(EnvironmentProtocolError::new(
-                EnvironmentProtocolErrorCode::Unsupported,
-                "filesystem scan backend unavailable",
-            ))
-        }
+    pub fn confinement(&self) -> &Arc<Confinement> {
+        &self.inner.confinement
     }
 
-    pub async fn capture(
-        &self,
-        params: CaptureParams,
-    ) -> Result<CaptureResponse, EnvironmentProtocolError> {
-        transfer::capture(self, params).await
+    pub fn cwd(&self) -> &Path {
+        &self.inner.cwd
     }
 
-    pub async fn materialize(
+    async fn blocking<T: Send + 'static>(
         &self,
-        params: MaterializeParams,
-    ) -> Result<MaterializeResponse, EnvironmentProtocolError> {
-        self.ensure_writable()?;
-        transfer::materialize(self, params).await
+        work: impl FnOnce(&Inner) -> Result<T, ProtocolError> + Send + 'static,
+    ) -> Result<T, ProtocolError> {
+        let inner = self.inner.clone();
+        tokio::task::spawn_blocking(move || work(&inner))
+            .await
+            .map_err(|error| ProtocolError::internal(format!("filesystem worker: {error}")))?
     }
 
     pub async fn read_file(
         &self,
+        _: &RequestContext,
         params: ReadFileParams,
-    ) -> Result<ReadFileResponse, EnvironmentProtocolError> {
-        let path = self.resolve(&params.path)?;
-        let metadata = fs::metadata(&path)
-            .await
-            .map_err(|error| io_error(error, &path))?;
-        if !metadata.is_file() {
-            // Preserve the exact outcome a plain read produces for non-file
-            // paths (directories fail with the authentic io error).
-            return match fs::read(&path).await {
-                Ok(data) => Ok(ReadFileResponse {
-                    file_size: Some(data.len() as u64),
-                    data: ByteChunk::from(data),
-                    truncated: false,
-                }),
-                Err(error) => Err(io_error(error, &path)),
-            };
-        }
-        let file_size = metadata.len();
-        let offset = params.offset.unwrap_or(0).min(file_size);
-        let remaining = file_size - offset;
-        let take = params.max_bytes.map_or(remaining, |max| max.min(remaining));
-
-        let data = if offset == 0 && take == file_size {
-            fs::read(&path)
-                .await
-                .map_err(|error| io_error(error, &path))?
-        } else {
-            use tokio::io::{AsyncReadExt, AsyncSeekExt};
-            let mut file = fs::File::open(&path)
-                .await
-                .map_err(|error| io_error(error, &path))?;
-            file.seek(std::io::SeekFrom::Start(offset))
-                .await
-                .map_err(|error| io_error(error, &path))?;
-            let mut data = Vec::with_capacity(take.min(64 * 1024 * 1024) as usize);
-            file.take(take)
-                .read_to_end(&mut data)
-                .await
-                .map_err(|error| io_error(error, &path))?;
-            data
-        };
-        let truncated = offset.saturating_add(data.len() as u64) < file_size;
-        Ok(ReadFileResponse {
-            data: ByteChunk::from(data),
-            file_size: Some(file_size),
-            truncated,
-        })
+    ) -> Result<ReadFileResponse, ProtocolError> {
+        self.blocking(move |inner| inner.read_file(params)).await
     }
 
     pub async fn write_file(
         &self,
+        _: &RequestContext,
         params: WriteFileParams,
-    ) -> Result<WriteFileResponse, EnvironmentProtocolError> {
-        self.ensure_writable()?;
-        let path = self.resolve(&params.path)?;
-        fs::write(&path, params.data.into_inner())
-            .await
-            .map_err(|error| io_error(error, &path))?;
-        Ok(WriteFileResponse {})
+    ) -> Result<WriteFileResponse, ProtocolError> {
+        self.blocking(move |inner| inner.write_file(params)).await
     }
 
     pub async fn create_directory(
         &self,
+        _: &RequestContext,
         params: CreateDirectoryParams,
-    ) -> Result<CreateDirectoryResponse, EnvironmentProtocolError> {
-        self.ensure_writable()?;
-        let path = self.resolve(&params.path)?;
-        if params.recursive.unwrap_or(false) {
-            fs::create_dir_all(&path)
-                .await
-                .map_err(|error| io_error(error, &path))?;
-        } else {
-            fs::create_dir(&path)
-                .await
-                .map_err(|error| io_error(error, &path))?;
-        }
-        Ok(CreateDirectoryResponse {})
+    ) -> Result<CreateDirectoryResponse, ProtocolError> {
+        self.blocking(move |inner| inner.create_directory(params))
+            .await
     }
 
     pub async fn get_metadata(
         &self,
+        _: &RequestContext,
         params: GetMetadataParams,
-    ) -> Result<GetMetadataResponse, EnvironmentProtocolError> {
-        let path = self.resolve(&params.path)?;
-        let metadata = fs::symlink_metadata(&path)
-            .await
-            .map_err(|error| io_error(error, &path))?;
-        let file_type = metadata.file_type();
-        let modified = metadata.modified().unwrap_or(UNIX_EPOCH);
-        let created = metadata.created().unwrap_or(modified);
-        Ok(GetMetadataResponse {
-            is_directory: file_type.is_dir(),
-            is_file: file_type.is_file(),
-            is_symlink: file_type.is_symlink(),
-            created_at_ms: system_time_ms(created),
-            modified_at_ms: system_time_ms(modified),
-        })
+    ) -> Result<GetMetadataResponse, ProtocolError> {
+        self.blocking(move |inner| inner.get_metadata(params)).await
     }
 
     pub async fn read_directory(
         &self,
+        _: &RequestContext,
         params: ReadDirectoryParams,
-    ) -> Result<ReadDirectoryResponse, EnvironmentProtocolError> {
-        let path = self.resolve(&params.path)?;
-        let mut directory = fs::read_dir(&path)
-            .await
-            .map_err(|error| io_error(error, &path))?;
-        let mut entries = Vec::new();
-        while let Some(entry) = directory
-            .next_entry()
+    ) -> Result<ReadDirectoryResponse, ProtocolError> {
+        self.blocking(move |inner| inner.read_directory(params))
             .await
-            .map_err(|error| io_error(error, &path))?
-        {
-            let metadata = entry
-                .metadata()
-                .await
-                .map_err(|error| io_error(error, &entry.path()))?;
-            entries.push(ReadDirectoryEntry {
-                file_name: entry.file_name().to_string_lossy().into_owned(),
-                is_directory: metadata.is_dir(),
-                is_file: metadata.is_file(),
-            });
-        }
-        entries.sort_by(|left, right| left.file_name.cmp(&right.file_name));
-        Ok(ReadDirectoryResponse { entries })
     }
 
     pub async fn remove(
         &self,
+        _: &RequestContext,
         params: RemoveParams,
-    ) -> Result<RemoveResponse, EnvironmentProtocolError> {
-        self.ensure_writable()?;
-        let path = self.resolve(&params.path)?;
-        let metadata = match fs::symlink_metadata(&path).await {
-            Ok(metadata) => metadata,
-            Err(error)
-                if params.force.unwrap_or(false) && error.kind() == io::ErrorKind::NotFound =>
-            {
-                return Ok(RemoveResponse {});
-            }
-            Err(error) => return Err(io_error(error, &path)),
-        };
-        if metadata.is_dir() {
-            if params.recursive.unwrap_or(false) {
-                fs::remove_dir_all(&path)
-                    .await
-                    .map_err(|error| io_error(error, &path))?;
-            } else {
-                fs::remove_dir(&path)
-                    .await
-                    .map_err(|error| io_error(error, &path))?;
-            }
-        } else {
-            fs::remove_file(&path)
-                .await
-                .map_err(|error| io_error(error, &path))?;
-        }
-        Ok(RemoveResponse {})
+    ) -> Result<RemoveResponse, ProtocolError> {
+        self.blocking(move |inner| inner.remove(params)).await
     }
 
-    pub async fn copy(&self, params: CopyParams) -> Result<CopyResponse, EnvironmentProtocolError> {
-        self.ensure_writable()?;
-        let source = self.resolve(&params.source_path)?;
-        let destination = self.resolve(&params.destination_path)?;
-        tokio::task::spawn_blocking(move || copy_path(&source, &destination, params.recursive))
-            .await
-            .map_err(|error| {
-                EnvironmentProtocolError::new(
-                    EnvironmentProtocolErrorCode::Internal,
-                    error.to_string(),
-                )
-            })??;
-        Ok(CopyResponse {})
+    pub async fn rename(
+        &self,
+        _: &RequestContext,
+        params: RenameParams,
+    ) -> Result<RenameResponse, ProtocolError> {
+        self.blocking(move |inner| inner.rename(params)).await
     }
 
-    /// Bounded recursive text search executed in-process with the ripgrep
-    /// engine crates. No external `rg` binary is involved, and the regex
-    /// dialect matches the caller-side generic fallback.
+    /// Bounded recursive regex search with the ripgrep engine crates.
     pub async fn search_text(
         &self,
+        context: &RequestContext,
         params: SearchTextParams,
-    ) -> Result<SearchTextResponse, EnvironmentProtocolError> {
-        let root = self.resolve(&params.root)?;
-        tokio::task::spawn_blocking(move || search_text_blocking(root, params))
+    ) -> Result<SearchTextResponse, ProtocolError> {
+        search::check_search(&params, &self.inner.limits.search)?;
+        let cancel = context.cancel.clone();
+        self.blocking(move |inner| search::search_text(&inner.confinement, params, &cancel))
             .await
-            .map_err(|error| {
-                EnvironmentProtocolError::new(
-                    EnvironmentProtocolErrorCode::Internal,
-                    error.to_string(),
-                )
-            })?
     }
 
-    /// Bounded recursive file enumeration executed locally, so a broad glob
-    /// does not become one `fs/readDirectory` round trip per directory.
+    /// Bounded recursive enumeration of entries matching `filter.include`.
     pub async fn glob_files(
         &self,
+        context: &RequestContext,
         params: GlobFilesParams,
-    ) -> Result<GlobFilesResponse, EnvironmentProtocolError> {
-        let root = self.resolve(&params.root)?;
-        tokio::task::spawn_blocking(move || glob_files_blocking(root, params))
+    ) -> Result<GlobFilesResponse, ProtocolError> {
+        search::check_glob(&params, &self.inner.limits.glob)?;
+        let cancel = context.cancel.clone();
+        self.blocking(move |inner| search::glob_files(&inner.confinement, params, &cancel))
             .await
-            .map_err(|error| {
-                EnvironmentProtocolError::new(
-                    EnvironmentProtocolErrorCode::Internal,
-                    error.to_string(),
-                )
-            })?
     }
 
-    fn resolve_scoped_path(
+    pub async fn scan(
         &self,
-        path: &EnvironmentPath,
-    ) -> Result<PathBuf, EnvironmentProtocolError> {
-        if Path::new(path.as_str()).is_absolute() {
-            return self.resolve(path);
-        }
-        // Cwd and root are administrator-owned configuration. Resolve their aliases,
-        // then retain the configured root spelling for scope checks and returned paths.
-        // User-selected components are still opened without following symlinks.
-        let root = self
-            .root
-            .canonicalize()
-            .map_err(|e| io_error(e, &self.root))?;
-        let cwd = self
-            .cwd
-            .canonicalize()
-            .map_err(|e| io_error(e, &self.cwd))?;
-        let relative = cwd.strip_prefix(&root).map_err(|_| {
-            EnvironmentProtocolError::new(
-                EnvironmentProtocolErrorCode::Forbidden,
-                "configured cwd is outside filesystem root",
-            )
-        })?;
-        let path = EnvironmentPath::new(
-            self.root
-                .join(relative)
-                .join(path.as_str())
-                .to_string_lossy(),
-        )
-        .map_err(|e| {
-            EnvironmentProtocolError::new(
-                EnvironmentProtocolErrorCode::InvalidRequest,
-                e.to_string(),
-            )
-        })?;
-        self.resolve(&path)
+        context: &RequestContext,
+        params: ScanParams,
+    ) -> Result<ScanResponse, ProtocolError> {
+        scan::check_scan(&params, &self.inner.limits.scan)?;
+        let cancel = context.cancel.clone();
+        self.blocking(move |inner| scan::scan(&inner.confinement, params, &cancel))
+            .await
     }
 
-    fn resolve(&self, path: &EnvironmentPath) -> Result<PathBuf, EnvironmentProtocolError> {
-        let candidate = if path.is_absolute() {
-            PathBuf::from(path.as_str())
-        } else if path.as_str() == "." {
-            self.cwd.clone()
-        } else {
-            self.cwd.join(path.as_str())
-        };
-        let normalized = normalize_path(candidate);
-        if !normalized.starts_with(&self.root) {
-            return Err(EnvironmentProtocolError::new(
-                EnvironmentProtocolErrorCode::Forbidden,
-                format!(
-                    "path is outside bridge fs root: {} (root {})",
-                    normalized.display(),
-                    self.root.display()
-                ),
-            ));
-        }
-        Ok(normalized)
+    pub async fn transfer_begin(
+        &self,
+        _: &RequestContext,
+        params: BeginTransferParams,
+    ) -> Result<TransferStatus, ProtocolError> {
+        self.blocking(move |inner| inner.transfers.begin(params))
+            .await
+    }
+
+    pub async fn transfer_advance(
+        &self,
+        _: &RequestContext,
+        params: TransferOperationParams,
+    ) -> Result<TransferStatus, ProtocolError> {
+        self.blocking(move |inner| inner.transfers.advance(params))
+            .await
+    }
+
+    pub async fn transfer_get_status(
+        &self,
+        _: &RequestContext,
+        params: TransferOperationParams,
+    ) -> Result<TransferStatus, ProtocolError> {
+        self.blocking(move |inner| inner.transfers.get_status(params))
+            .await
     }
 
-    fn ensure_writable(&self) -> Result<(), EnvironmentProtocolError> {
+    pub async fn transfer_read_inventory(
+        &self,
+        _: &RequestContext,
+        params: ReadTransferInventoryParams,
+    ) -> Result<ReadTransferInventoryResponse, ProtocolError> {
+        self.blocking(move |inner| inner.transfers.read_inventory(params))
+            .await
+    }
+
+    pub async fn transfer_append(
+        &self,
+        _: &RequestContext,
+        params: AppendTransferInventoryParams,
+    ) -> Result<TransferStatus, ProtocolError> {
+        self.blocking(move |inner| inner.transfers.append(params))
+            .await
+    }
+
+    pub async fn transfer_list_missing(
+        &self,
+        _: &RequestContext,
+        params: ListTransferMissingParams,
+    ) -> Result<ListTransferMissingResponse, ProtocolError> {
+        self.blocking(move |inner| inner.transfers.list_missing(params))
+            .await
+    }
+
+    pub async fn transfer_read(
+        &self,
+        _: &RequestContext,
+        params: ReadTransferContentParams,
+    ) -> Result<ReadTransferContentResponse, ProtocolError> {
+        self.blocking(move |inner| inner.transfers.read(params))
+            .await
+    }
+
+    pub async fn transfer_write(
+        &self,
+        _: &RequestContext,
+        params: WriteTransferContentParams,
+    ) -> Result<WriteTransferContentResponse, ProtocolError> {
+        self.blocking(move |inner| inner.transfers.write(params))
+            .await
+    }
+
+    pub async fn transfer_commit(
+        &self,
+        _: &RequestContext,
+        params: TransferOperationParams,
+    ) -> Result<TransferStatus, ProtocolError> {
+        self.blocking(move |inner| inner.transfers.commit(params))
+            .await
+    }
+
+    pub async fn transfer_abort(
+        &self,
+        _: &RequestContext,
+        params: TransferOperationParams,
+    ) -> Result<TransferStatus, ProtocolError> {
+        self.blocking(move |inner| inner.transfers.abort(params))
+            .await
+    }
+}
+
+impl Inner {
+    fn ensure_writable(&self) -> Result<(), ProtocolError> {
         if self.writable {
             Ok(())
         } else {
-            Err(EnvironmentProtocolError::new(
-                EnvironmentProtocolErrorCode::CapabilityUnavailable,
-                "bridge filesystem is read-only",
+            Err(ProtocolError::capability_unavailable(
+                Capability::FilesystemWrite,
+                "the filesystem is read-only",
             ))
         }
     }
-}
 
-fn search_text_blocking(
-    root: PathBuf,
-    params: SearchTextParams,
-) -> Result<SearchTextResponse, EnvironmentProtocolError> {
-    if params.pattern.is_empty() {
-        return Err(EnvironmentProtocolError::new(
-            EnvironmentProtocolErrorCode::InvalidRequest,
-            "search pattern must not be empty",
-        ));
+    /// Open non-blocking, `fstat` the descriptor and refuse anything but a
+    /// regular file before reading; read at most `maxBytes` (plus one byte
+    /// to learn whether more follow).
+    fn read_file(&self, params: ReadFileParams) -> Result<ReadFileResponse, ProtocolError> {
+        let ceiling = self.limits.max_read_file_bytes;
+        if params.max_bytes > ceiling {
+            return Err(ProtocolError::above_ceiling(
+                "maxBytes",
+                params.max_bytes,
+                ceiling,
+            ));
+        }
+        let path = &params.path;
+        let resolved = self.confinement.lookup(path, Lookup::FOLLOW)?;
+        let stat = resolved.stat.expect("a followed lookup reports its target");
+        require_regular(path, &stat)?;
+        let mut file = resolved
+            .parent
+            .open_read(&resolved.name)
+            .map_err(|error| io_error(error, path))?;
+        let opened = EntryStat::of_file(&file).map_err(|error| io_error(error, path))?;
+        require_regular(path, &opened)?;
+        if params.offset > 0 {
+            file.seek(SeekFrom::Start(params.offset))
+                .map_err(|error| io_error(error, path))?;
+        }
+        let mut data = os::read_up_to(&mut file, params.max_bytes.saturating_add(1))
+            .map_err(|error| io_error(error, path))?;
+        let read = data.len() as u64;
+        let more = read > params.max_bytes;
+        data.truncate(params.max_bytes as usize);
+        // Files such as procfs entries report size 0; their size is what
+        // could be read. Every other file's size is what `fstat` reported,
+        // also for an `offset` past its end.
+        let file_size = if opened.size == 0 && read > 0 {
+            params.offset.saturating_add(read)
+        } else {
+            opened.size
+        };
+        let truncated = more || params.offset.saturating_add(data.len() as u64) < file_size;
+        Ok(ReadFileResponse {
+            data: data.into(),
+            file_size,
+            truncated,
+            version: opened.version(),
+        })
     }
-    let limits = params.limits;
-    if limits.max_matches == 0
-        || limits.max_files == 0
-        || limits.max_bytes == 0
-        || limits.max_duration_ms == 0
-    {
-        return Err(EnvironmentProtocolError::new(
-            EnvironmentProtocolErrorCode::InvalidRequest,
-            "search limits must all be at least 1",
+
+    /// Stage next to the final target, fsync, set the mode and rename over
+    /// it.
+    fn write_file(&self, params: WriteFileParams) -> Result<WriteFileResponse, ProtocolError> {
+        self.ensure_writable()?;
+        let ceiling = self.limits.max_write_file_bytes;
+        let size = params.data.len() as u64;
+        if size > ceiling {
+            return Err(ProtocolError::above_ceiling("data", size, ceiling));
+        }
+        let path = &params.path;
+        let resolved = self
+            .confinement
+            .lookup(path, Lookup::FOLLOW.allowing_missing())?;
+        write_preconditions(
+            path,
+            resolved.stat.as_ref(),
+            params.create,
+            params.if_match.as_ref(),
+        )?;
+        let base = resolved
+            .stat
+            .map_or(os::DEFAULT_FILE_MODE, |stat| stat.mode);
+        let mode = if params.executable {
+            os::with_execute_bits(base)
+        } else {
+            base
+        };
+        let rename = if params.create == WriteCondition::IfAbsent {
+            RenameMode::NoReplace
+        } else {
+            RenameMode::Replace
+        };
+        let stage = OsString::from(format!(
+            "{WRITE_STAGE_PREFIX}{:032x}",
+            rand::random::<u128>()
         ));
+        let parent = &resolved.parent;
+        let io = |error| io_error(error, path);
+        let mut file = parent
+            .create_file(&stage, os::PRIVATE_FILE_MODE)
+            .map_err(io)?;
+        let staged = file
+            .write_all(params.data.as_slice())
+            .and_then(|()| os::set_mode(&file, mode))
+            .and_then(|()| file.sync_all())
+            .and_then(|()| parent.rename(&stage, parent, &resolved.name, rename));
+        if let Err(error) = staged {
+            let _ = parent.unlink(&stage);
+            if rename == RenameMode::NoReplace && error.kind() == io::ErrorKind::AlreadyExists {
+                return Err(create_condition(path, true));
+            }
+            return Err(io(error));
+        }
+        parent.sync().map_err(io)?;
+        let version = EntryStat::of_file(&file).map_err(io)?.version();
+        Ok(WriteFileResponse { version })
     }
-    let matcher = grep_regex::RegexMatcherBuilder::new()
-        .case_insensitive(!params.case_sensitive)
-        .build(&params.pattern)
-        .map_err(|error| {
-            EnvironmentProtocolError::new(
-                EnvironmentProtocolErrorCode::InvalidRequest,
-                format!("invalid search regex: {error}"),
-            )
-        })?;
-    let include = params
-        .include
-        .as_deref()
-        .map(glob::Pattern::new)
-        .transpose()
-        .map_err(|error| {
-            EnvironmentProtocolError::new(
-                EnvironmentProtocolErrorCode::InvalidRequest,
-                format!("invalid search include glob: {error}"),
-            )
-        })?;
-
-    let started = Instant::now();
-    let deadline = Duration::from_millis(limits.max_duration_ms);
-    let mut searcher = SearcherBuilder::new()
-        .line_number(true)
-        .binary_detection(BinaryDetection::quit(0))
-        .build();
-    let mut walker = ignore::WalkBuilder::new(&root);
-    // Mirror the generic traversal: no ignore-file or hidden filtering, no
-    // symlink following, deterministic order. The generic walker's max_depth
-    // counts directory descents below the root, so files at walker depth
-    // `max_depth + 1` are still in range.
-    walker
-        .standard_filters(false)
-        .follow_links(false)
-        .sort_by_file_path(|left, right| left.cmp(right));
-    if let Some(max_depth) = params.max_depth {
-        walker.max_depth(Some((max_depth as usize).saturating_add(1)));
+
+    fn create_directory(
+        &self,
+        params: CreateDirectoryParams,
+    ) -> Result<CreateDirectoryResponse, ProtocolError> {
+        self.ensure_writable()?;
+        let path = &params.path;
+        let lookup = if params.recursive {
+            Lookup::FOLLOW.allowing_missing().creating_parents()
+        } else {
+            Lookup::FOLLOW.allowing_missing()
+        };
+        let resolved = self.confinement.lookup(path, lookup)?;
+        match resolved.stat {
+            Some(stat) if params.recursive && stat.is_dir() => {}
+            Some(_) => {
+                return Err(ProtocolError::already_exists(format!("{path} exists")));
+            }
+            None => match resolved
+                .parent
+                .mkdir(&resolved.name, os::DEFAULT_DIRECTORY_MODE)
+            {
+                Ok(()) => resolved
+                    .parent
+                    .sync()
+                    .map_err(|error| io_error(error, path))?,
+                Err(error)
+                    if params.recursive
+                        && error.kind() == io::ErrorKind::AlreadyExists
+                        && resolved
+                            .parent
+                            .stat(&resolved.name)
+                            .is_ok_and(|stat| stat.is_dir()) => {}
+                Err(error) => return Err(io_error(error, path)),
+            },
+        }
+        Ok(CreateDirectoryResponse {})
     }
 
-    let mut matches = Vec::new();
-    let mut files_searched = 0u64;
-    let mut bytes_searched = 0u64;
-    let mut stopped = None;
+    fn get_metadata(
+        &self,
+        params: GetMetadataParams,
+    ) -> Result<GetMetadataResponse, ProtocolError> {
+        let path = &params.path;
+        let lookup = if params.follow_symlinks {
+            Lookup::FOLLOW
+        } else {
+            Lookup::NO_FOLLOW
+        };
+        let resolved = self.confinement.lookup(path, lookup)?;
+        let stat = resolved
+            .parent
+            .stat_with_birth(&resolved.name)
+            .map_err(|error| io_error(error, path))?;
+        Ok(GetMetadataResponse {
+            metadata: metadata(&resolved.parent, &resolved.name, &stat),
+        })
+    }
 
-    'walk: for entry in walker.build() {
-        // Unreadable entries are skipped rather than failing the search.
-        let Ok(entry) = entry else { continue };
-        if !entry.file_type().is_some_and(|kind| kind.is_file()) {
-            continue;
-        }
-        let path = entry.path();
-        if let Some(include) = &include
-            && !local_path_matches_include(include, path, &root)
-        {
-            continue;
+    fn read_directory(
+        &self,
+        params: ReadDirectoryParams,
+    ) -> Result<ReadDirectoryResponse, ProtocolError> {
+        let ceiling = self.limits.max_directory_entries;
+        if params.limit == 0 {
+            return Err(ProtocolError::invalid_field(
+                "limit",
+                "limit must be at least 1",
+            ));
         }
-        if started.elapsed() >= deadline {
-            stopped = Some(SearchTextStop::TimeLimit);
-            break;
+        if params.limit > ceiling {
+            return Err(ProtocolError::above_ceiling(
+                "limit",
+                params.limit.into(),
+                ceiling.into(),
+            ));
         }
-        if files_searched >= limits.max_files {
-            stopped = Some(SearchTextStop::FileLimit);
-            break;
+        let position = params.cursor.as_ref().map(cursor::decode).transpose()?;
+        let path = &params.path;
+        let resolved = self.confinement.lookup(path, Lookup::FOLLOW)?;
+        if !resolved.stat.is_some_and(|stat| stat.is_dir()) {
+            return Err(ProtocolError::failed_precondition(
+                PreconditionReason::NotDirectory,
+                format!("{path} is not a directory"),
+            ));
         }
-        let file_len = entry.metadata().map(|metadata| metadata.len()).unwrap_or(0);
-        if bytes_searched.saturating_add(file_len) > limits.max_bytes {
-            stopped = Some(SearchTextStop::ByteLimit);
-            break;
+        let directory = resolved
+            .open_directory()
+            .map_err(|error| io_error(error, path))?;
+        let mut names = directory.names().map_err(|error| io_error(error, path))?;
+        if resolved
+            .stat
+            .is_some_and(|stat| self.confinement.holds_state(&stat))
+        {
+            names.retain(|name| {
+                directory
+                    .stat(name)
+                    .map_or(true, |stat| !self.confinement.is_state(&stat))
+            });
         }
-        files_searched += 1;
-        bytes_searched = bytes_searched.saturating_add(file_len);
-
-        let match_path = response_path(&params.root, path, &root)?;
-        let mut hit_match_limit = false;
-        let sink = UTF8(|line_number, line| {
-            if matches.len() as u64 >= limits.max_matches {
-                hit_match_limit = true;
-                return Ok(false);
-            }
-            matches.push(SearchTextMatch {
-                path: match_path.clone(),
-                line_number,
-                line: line.trim_end_matches(['\r', '\n']).to_string(),
+        names.sort_by(|left, right| left.as_encoded_bytes().cmp(right.as_encoded_bytes()));
+        let start = position.map_or(0, |position| position.start(&names));
+        let end = start.saturating_add(params.limit as usize).min(names.len());
+        let page = &names[start.min(end)..end];
+        let mut response = ReadDirectoryResponse {
+            entries: Vec::with_capacity(page.len()),
+            next_cursor: (end < names.len())
+                .then(|| {
+                    page.last()
+                        .map(|name| cursor::encode(name.as_encoded_bytes()))
+                })
+                .flatten(),
+            skipped_entry_count: 0,
+        };
+        for name in page {
+            let Some(entry_name) = os::utf8_name(name).and_then(|name| EntryName::new(name).ok())
+            else {
+                response.skipped_entry_count += 1;
+                continue;
+            };
+            let stat = match directory.stat_with_birth(name) {
+                Ok(stat) => stat,
+                Err(error) if error.kind() == io::ErrorKind::NotFound => continue,
+                Err(error) => return Err(io_error(error, format!("{path}/{entry_name}"))),
+            };
+            response.entries.push(DirectoryEntry {
+                name: entry_name,
+                metadata: metadata(&directory, name, &stat),
             });
-            Ok(true)
-        });
-        // Per-file search errors (e.g. the file vanished mid-walk) skip the
-        // file rather than failing the whole search.
-        let _ = searcher.search_path(&matcher, path, sink);
-        // Like the generic fallback, the match limit reports truncation only
-        // when a match beyond the cap actually arrived.
-        if hit_match_limit {
-            stopped = Some(SearchTextStop::MatchLimit);
-            break 'walk;
         }
+        Ok(response)
     }
 
-    Ok(SearchTextResponse {
-        matches,
-        files_searched,
-        bytes_searched,
-        elapsed_ms: started.elapsed().as_millis() as u64,
-        stopped,
-    })
-}
-
-fn glob_files_blocking(
-    root: PathBuf,
-    params: GlobFilesParams,
-) -> Result<GlobFilesResponse, EnvironmentProtocolError> {
-    if params.pattern.is_empty() {
-        return Err(EnvironmentProtocolError::new(
-            EnvironmentProtocolErrorCode::InvalidRequest,
-            "glob pattern must not be empty",
-        ));
-    }
-    let limits = params.limits;
-    if limits.max_matches == 0 || limits.max_entries == 0 || limits.max_duration_ms == 0 {
-        return Err(EnvironmentProtocolError::new(
-            EnvironmentProtocolErrorCode::InvalidRequest,
-            "glob limits must all be at least 1",
-        ));
-    }
-    let pattern = glob::Pattern::new(&params.pattern).map_err(|error| {
-        EnvironmentProtocolError::new(
-            EnvironmentProtocolErrorCode::InvalidRequest,
-            format!("invalid glob pattern: {error}"),
-        )
-    })?;
-
-    let started = Instant::now();
-    let deadline = Duration::from_millis(limits.max_duration_ms);
-    let mut walker = ignore::WalkBuilder::new(&root);
-    walker
-        .standard_filters(false)
-        .follow_links(false)
-        .sort_by_file_path(|left, right| left.cmp(right));
-    if let Some(max_depth) = params.max_depth {
-        walker.max_depth(Some((max_depth as usize).saturating_add(1)));
-    }
-
-    let mut matches = Vec::new();
-    let mut entries_visited = 0u64;
-    let mut stopped = None;
-
-    for entry in walker.build() {
-        let Ok(entry) = entry else { continue };
-        if entry.depth() == 0 {
-            continue;
+    fn remove(&self, params: RemoveParams) -> Result<RemoveResponse, ProtocolError> {
+        self.ensure_writable()?;
+        let path = &params.path;
+        let resolved = match self
+            .confinement
+            .lookup(path, Lookup::NO_FOLLOW.allowing_missing())
+        {
+            Ok(resolved) => resolved,
+            Err(error)
+                if params.force
+                    && matches!(
+                        error.data,
+                        environment_protocol::error::ErrorData::NotFound { .. }
+                    ) =>
+            {
+                return Ok(RemoveResponse {});
+            }
+            Err(error) => return Err(error),
+        };
+        if resolved.is_root() {
+            return Err(filesystem_root());
         }
-        if started.elapsed() >= deadline {
-            stopped = Some(GlobFilesStop::TimeLimit);
-            break;
+        self.confinement.refuse_containing_state(&resolved, path)?;
+        let io = |error| io_error(error, path);
+        match resolved.stat {
+            None if params.force => return Ok(RemoveResponse {}),
+            None => return Err(ProtocolError::not_found(format!("{path} does not exist"))),
+            Some(stat) if stat.is_dir() => {
+                if params.recursive {
+                    resolved.parent.remove_tree(&resolved.name).map_err(io)?;
+                } else {
+                    resolved.parent.rmdir(&resolved.name).map_err(io)?;
+                }
+            }
+            Some(_) => resolved.parent.unlink(&resolved.name).map_err(io)?,
         }
-        if entries_visited >= limits.max_entries {
-            stopped = Some(GlobFilesStop::EntryLimit);
-            break;
+        resolved.parent.sync().map_err(io)?;
+        Ok(RemoveResponse {})
+    }
+
+    fn rename(&self, params: RenameParams) -> Result<RenameResponse, ProtocolError> {
+        self.ensure_writable()?;
+        let source = self.confinement.lookup(&params.source, Lookup::NO_FOLLOW)?;
+        let destination = self
+            .confinement
+            .lookup(&params.destination, Lookup::NO_FOLLOW.allowing_missing())?;
+        if source.is_root() || destination.is_root() {
+            return Err(filesystem_root());
         }
-        entries_visited += 1;
-        if !entry.file_type().is_some_and(|kind| kind.is_file()) {
-            continue;
+        self.confinement
+            .refuse_containing_state(&source, &params.source)?;
+        self.confinement
+            .refuse_containing_state(&destination, &params.destination)?;
+        let source_stat = source.stat.expect("an existing source has a stat");
+        if let Some(expected) = &params.if_match
+            && source_stat.version() != *expected
+        {
+            return Err(ProtocolError::failed_precondition(
+                PreconditionReason::IfMatchFailed,
+                format!("{} changed since that version", params.source),
+            ));
         }
-        let path = entry.path();
-        let caller_path = response_path(&params.root, path, &root)?;
-        if !glob_pattern_matches(&pattern, &params.pattern, &caller_path, path, &root) {
-            continue;
+        if destination.segments.starts_with(&source.segments)
+            && destination.segments != source.segments
+        {
+            return Err(ProtocolError::invalid_field(
+                "destination",
+                "a directory cannot move into itself",
+            ));
         }
-        // Like the generic fallback, the match limit reports truncation only
-        // when a match beyond the cap actually arrives.
-        if matches.len() as u64 >= limits.max_matches {
-            stopped = Some(GlobFilesStop::MatchLimit);
-            break;
+        if let Some(stat) = &destination.stat {
+            if stat.is_dir() {
+                return Err(ProtocolError::failed_precondition(
+                    PreconditionReason::IsDirectory,
+                    format!(
+                        "{} is a directory and is never replaced",
+                        params.destination
+                    ),
+                ));
+            }
+            if !params.overwrite {
+                return Err(ProtocolError::already_exists(format!(
+                    "{} exists",
+                    params.destination
+                )));
+            }
         }
-        matches.push(caller_path);
+        let mode = if params.overwrite {
+            RenameMode::Replace
+        } else {
+            RenameMode::NoReplace
+        };
+        source
+            .parent
+            .rename(&source.name, &destination.parent, &destination.name, mode)
+            .map_err(|error| io_error(error, &params.destination))?;
+        source
+            .parent
+            .sync()
+            .and_then(|()| destination.parent.sync())
+            .map_err(|error| io_error(error, &params.destination))?;
+        Ok(RenameResponse {})
     }
+}
 
-    Ok(GlobFilesResponse {
-        matches,
-        entries_visited,
-        elapsed_ms: started.elapsed().as_millis() as u64,
-        stopped,
-    })
+fn require_regular(path: &EnvironmentPath, stat: &EntryStat) -> Result<(), ProtocolError> {
+    match stat.kind {
+        FileKind::File => Ok(()),
+        FileKind::Directory => Err(ProtocolError::failed_precondition(
+            PreconditionReason::IsDirectory,
+            format!("{path} is a directory"),
+        )),
+        FileKind::Symlink | FileKind::Other => Err(ProtocolError::failed_precondition(
+            PreconditionReason::NotRegularFile,
+            format!("{path} is not a regular file"),
+        )),
+    }
 }
 
-/// Glob pattern semantics mirror the caller-side generic tool: an absolute
-/// pattern matches the caller-space path; otherwise the root-relative path
-/// matches, and a pattern without `/` also matches the bare file name.
-fn glob_pattern_matches(
-    pattern: &glob::Pattern,
-    pattern_text: &str,
-    caller_path: &EnvironmentPath,
-    path: &Path,
-    root: &Path,
-) -> bool {
-    if pattern_text.starts_with('/') {
-        return pattern.matches(caller_path.as_str());
+/// The checks of `fs/writeFile` and the transfer `writeFile` selection on
+/// the final target as it is now.
+pub(crate) fn write_preconditions(
+    path: &EnvironmentPath,
+    current: Option<&EntryStat>,
+    create: WriteCondition,
+    if_match: Option<&FileVersion>,
+) -> Result<(), ProtocolError> {
+    if let Some(stat) = current {
+        require_regular(path, stat)?;
     }
-    let relative = path
-        .strip_prefix(root)
-        .map(|relative| {
-            relative
-                .to_string_lossy()
-                .replace(std::path::MAIN_SEPARATOR, "/")
-        })
-        .unwrap_or_else(|_| path.to_string_lossy().into_owned());
-    pattern.matches(&relative)
-        || (!pattern_text.contains('/')
-            && path
-                .file_name()
-                .is_some_and(|file_name| pattern.matches(&file_name.to_string_lossy())))
+    match (current, create) {
+        (Some(_), WriteCondition::IfAbsent) => return Err(create_condition(path, true)),
+        (None, WriteCondition::IfPresent) => return Err(create_condition(path, false)),
+        _ => {}
+    }
+    if let Some(expected) = if_match
+        && current.is_none_or(|stat| stat.version() != *expected)
+    {
+        return Err(ProtocolError::failed_precondition(
+            PreconditionReason::IfMatchFailed,
+            format!("{path} is not at the expected version"),
+        ));
+    }
+    Ok(())
 }
 
-/// Include globs match the root-relative path or the bare file name, exactly
-/// like the caller-side generic fallback.
-fn local_path_matches_include(pattern: &glob::Pattern, path: &Path, root: &Path) -> bool {
-    let relative = path
-        .strip_prefix(root)
-        .map(|relative| {
-            relative
-                .to_string_lossy()
-                .replace(std::path::MAIN_SEPARATOR, "/")
-        })
-        .unwrap_or_else(|_| path.to_string_lossy().into_owned());
-    pattern.matches(&relative)
-        || path
-            .file_name()
-            .is_some_and(|file_name| pattern.matches(&file_name.to_string_lossy()))
+fn create_condition(path: &EnvironmentPath, exists: bool) -> ProtocolError {
+    ProtocolError::failed_precondition(
+        PreconditionReason::CreateCondition,
+        if exists {
+            format!("{path} exists")
+        } else {
+            format!("{path} does not exist")
+        },
+    )
 }
 
-/// Map a matched local path back into the caller's path space by joining its
-/// root-relative suffix onto the requested root.
-fn response_path(
-    requested_root: &EnvironmentPath,
-    path: &Path,
-    resolved_root: &Path,
-) -> Result<EnvironmentPath, EnvironmentProtocolError> {
-    let relative = path.strip_prefix(resolved_root).map_err(|_| {
-        EnvironmentProtocolError::new(
-            EnvironmentProtocolErrorCode::Internal,
-            format!("search match escaped its root: {}", path.display()),
-        )
-    })?;
-    let relative = relative
-        .to_string_lossy()
-        .replace(std::path::MAIN_SEPARATOR, "/");
-    if relative.is_empty() {
-        return Ok(requested_root.clone());
+fn filesystem_root() -> ProtocolError {
+    ProtocolError::failed_precondition(
+        PreconditionReason::FilesystemRoot,
+        "the filesystem root cannot be removed, renamed or replaced",
+    )
+}
+
+fn metadata(parent: &Directory, name: &std::ffi::OsStr, stat: &EntryStat) -> FileMetadata {
+    let symlink_target = (stat.kind == FileKind::Symlink)
+        .then(|| parent.read_link(name).ok())
+        .flatten()
+        .and_then(|target| target.into_string().ok());
+    FileMetadata {
+        kind: stat.kind,
+        size_bytes: stat.size,
+        executable: stat.kind == FileKind::File && stat.executable(),
+        modified_at_ms: stat.modified_ms(),
+        created_at_ms: stat.birth_ms,
+        symlink_target,
+        version: stat.version(),
     }
-    let joined = format!(
-        "{}/{}",
-        requested_root.as_str().trim_end_matches('/'),
-        relative
-    );
-    EnvironmentPath::new(&joined).map_err(|error| {
-        EnvironmentProtocolError::new(
-            EnvironmentProtocolErrorCode::Internal,
-            format!("search match produced an invalid environment path {joined}: {error}"),
-        )
-    })
 }
 
-fn copy_path(
-    source: &Path,
-    destination: &Path,
-    recursive: bool,
-) -> Result<(), EnvironmentProtocolError> {
-    let metadata = std::fs::symlink_metadata(source).map_err(|error| io_error(error, source))?;
-    if metadata.is_dir() {
-        if !recursive {
-            return Err(EnvironmentProtocolError::new(
-                EnvironmentProtocolErrorCode::InvalidRequest,
-                "copy requires recursive=true when source is a directory",
-            ));
+/// Bytes `value` takes as a JSON string, quotes included: `"` and `\`
+/// and the short control escapes take two bytes, every other control
+/// character six (`\u00XX`). What response budgets charge, so an answer
+/// within its budget also encodes within it.
+pub(crate) fn json_string_len(value: &str) -> u64 {
+    let escapes: u64 = value
+        .bytes()
+        .map(|byte| match byte {
+            b'"' | b'\\' | b'\n' | b'\r' | b'\t' | 0x08 | 0x0c => 1,
+            0x00..=0x1f => 5,
+            _ => 0,
+        })
+        .sum();
+    value.len() as u64 + escapes + 2
+}
+
+/// envd's one mapping of OS errors to protocol error kinds.
+pub(crate) fn io_error(error: io::Error, subject: impl Display) -> ProtocolError {
+    let message = format!("{subject}: {error}");
+    let precondition = |reason| ProtocolError::failed_precondition(reason, message.clone());
+    match Errno::from_io_error(&error) {
+        Some(Errno::LOOP) => return precondition(PreconditionReason::SymlinkLoop),
+        Some(Errno::NOTDIR) => return precondition(PreconditionReason::NotDirectory),
+        Some(Errno::ISDIR) => return precondition(PreconditionReason::IsDirectory),
+        Some(Errno::NOTEMPTY) => return precondition(PreconditionReason::NotEmpty),
+        Some(Errno::NOSPC | Errno::DQUOT) => return precondition(PreconditionReason::NoSpace),
+        Some(Errno::XDEV) => return precondition(PreconditionReason::CrossDevice),
+        Some(Errno::ROFS) => {
+            return ProtocolError::capability_unavailable(Capability::FilesystemWrite, message);
+        }
+        _ => {}
+    }
+    match error.kind() {
+        io::ErrorKind::NotFound => ProtocolError::not_found(message),
+        io::ErrorKind::AlreadyExists => ProtocolError::already_exists(message),
+        io::ErrorKind::PermissionDenied => {
+            ProtocolError::permission_denied(Some(PermissionReason::FilePermission), message)
         }
-        copy_directory(source, destination)
-    } else {
-        if let Some(parent) = destination.parent() {
-            std::fs::create_dir_all(parent).map_err(|error| io_error(error, parent))?;
+        io::ErrorKind::Interrupted | io::ErrorKind::WouldBlock | io::ErrorKind::TimedOut => {
+            ProtocolError::unavailable(message)
         }
-        std::fs::copy(source, destination)
-            .map(|_| ())
-            .map_err(|error| io_error(error, destination))
+        _ => ProtocolError::internal(message),
     }
 }
 
-fn copy_directory(source: &Path, destination: &Path) -> Result<(), EnvironmentProtocolError> {
-    std::fs::create_dir_all(destination).map_err(|error| io_error(error, destination))?;
-    for entry in std::fs::read_dir(source).map_err(|error| io_error(error, source))? {
-        let entry = entry.map_err(|error| io_error(error, source))?;
-        let source_child = entry.path();
-        let destination_child = destination.join(entry.file_name());
-        let metadata = std::fs::symlink_metadata(&source_child)
-            .map_err(|error| io_error(error, &source_child))?;
-        if metadata.is_dir() {
-            copy_directory(&source_child, &destination_child)?;
+/// `fs/readDirectory` cursors: the last name returned, as hex. Names too
+/// long for the 255-byte cursor carry a prefix and the name's SHA-256.
+mod cursor {
+    use super::*;
+
+    /// Longest name encoded in full (`x` and two hex digits per byte).
+    const MAX_EXACT_NAME_BYTES: usize = 127;
+    const PREFIX_BYTES: usize = 64;
+
+    pub(super) enum Position {
+        After(Vec<u8>),
+        AfterHashed { prefix: Vec<u8>, sha256: Vec<u8> },
+    }
+
+    pub(super) fn encode(name: &[u8]) -> DirectoryCursor {
+        let value = if name.len() <= MAX_EXACT_NAME_BYTES {
+            format!("x{}", hex::encode(name))
         } else {
-            std::fs::copy(&source_child, &destination_child)
-                .map(|_| ())
-                .map_err(|error| io_error(error, &destination_child))?;
-        }
+            format!(
+                "h{}.{}",
+                hex::encode(&name[..PREFIX_BYTES]),
+                hex::encode(Sha256::digest(name))
+            )
+        };
+        DirectoryCursor::new(value).expect("hex cursors are short and printable")
     }
-    Ok(())
-}
 
-fn normalize_path(path: PathBuf) -> PathBuf {
-    let mut normalized = PathBuf::new();
-    for component in path.components() {
-        match component {
-            Component::Prefix(prefix) => normalized.push(prefix.as_os_str()),
-            Component::RootDir => normalized.push(std::path::MAIN_SEPARATOR.to_string()),
-            Component::CurDir => {}
-            Component::ParentDir => {
-                normalized.pop();
-            }
-            Component::Normal(segment) => normalized.push(segment),
+    pub(super) fn decode(cursor: &DirectoryCursor) -> Result<Position, ProtocolError> {
+        let malformed =
+            || ProtocolError::invalid_field("cursor", "not a cursor this daemon minted");
+        let value = cursor.as_str();
+        if let Some(exact) = value.strip_prefix('x') {
+            return hex::decode(exact)
+                .map(Position::After)
+                .map_err(|_| malformed());
+        }
+        let (prefix, sha256) = value
+            .strip_prefix('h')
+            .and_then(|hashed| hashed.split_once('.'))
+            .ok_or_else(malformed)?;
+        let prefix = hex::decode(prefix).map_err(|_| malformed())?;
+        let sha256 = hex::decode(sha256).map_err(|_| malformed())?;
+        if prefix.len() != PREFIX_BYTES || sha256.len() != 32 {
+            return Err(malformed());
         }
+        Ok(Position::AfterHashed { prefix, sha256 })
     }
-    normalized
-}
 
-fn io_error(error: io::Error, path: &Path) -> EnvironmentProtocolError {
-    let code = match error.kind() {
-        io::ErrorKind::NotFound => EnvironmentProtocolErrorCode::NotFound,
-        io::ErrorKind::PermissionDenied => EnvironmentProtocolErrorCode::Forbidden,
-        io::ErrorKind::AlreadyExists => EnvironmentProtocolErrorCode::Conflict,
-        io::ErrorKind::InvalidInput | io::ErrorKind::InvalidData => {
-            EnvironmentProtocolErrorCode::InvalidRequest
+    impl Position {
+        /// Index of the first name after this position in sorted `names`.
+        pub(super) fn start(&self, names: &[OsString]) -> usize {
+            match self {
+                Self::After(last) => {
+                    names.partition_point(|name| name.as_encoded_bytes() <= last.as_slice())
+                }
+                Self::AfterHashed { prefix, sha256 } => names
+                    .iter()
+                    .position(|name| {
+                        let bytes = name.as_encoded_bytes();
+                        bytes.starts_with(prefix) && Sha256::digest(bytes).as_slice() == sha256
+                    })
+                    .map(|index| index + 1)
+                    // The last name vanished: continue after its prefix.
+                    .unwrap_or_else(|| {
+                        names.partition_point(|name| name.as_encoded_bytes() <= prefix.as_slice())
+                    }),
+            }
         }
-        _ => EnvironmentProtocolErrorCode::Internal,
-    };
-    EnvironmentProtocolError::new(code, format!("{}: {}", path.display(), error))
-}
-
-fn system_time_ms(value: SystemTime) -> i64 {
-    value
-        .duration_since(UNIX_EPOCH)
-        .map(|duration| duration.as_millis().min(i64::MAX as u128) as i64)
-        .unwrap_or_default()
+    }
 }
 
 #[cfg(test)]
 mod tests {
+    use std::os::unix::fs::{PermissionsExt, symlink};
+
+    use environment_protocol::{
+        data::handshake::{GlobCeilings, ScanCeilings, SearchCeilings, TransferCeilings},
+        error::{ErrorData, ProtocolErrorKind},
+    };
+
     use super::*;
 
-    #[tokio::test(flavor = "current_thread")]
-    async fn filesystem_reads_and_writes_under_root() {
-        let temp = tempfile::tempdir().expect("tempdir");
-        let root = temp.path().canonicalize().expect("canonical root");
-        let fs = LocalFileSystem::new(root.clone(), root.clone(), true);
-        let path = EnvironmentPath::new(root.join("file.txt").to_string_lossy())
-            .expect("environment path");
-
-        fs.write_file(WriteFileParams {
-            path: path.clone(),
-            data: ByteChunk::from(b"hello".as_slice()),
-        })
-        .await
-        .expect("write");
-        let read = fs
-            .read_file(ReadFileParams {
-                path,
-                offset: None,
-                max_bytes: None,
-            })
-            .await
-            .expect("read")
-            .data
-            .into_inner();
+    pub(crate) fn limits() -> FilesystemLimits {
+        FilesystemLimits {
+            max_read_file_bytes: 8 * 1024 * 1024,
+            max_write_file_bytes: 8 * 1024 * 1024,
+            max_directory_entries: 1000,
+            search: SearchCeilings {
+                max_matches: 10_000,
+                max_files: 100_000,
+                max_bytes: 1 << 30,
+                max_duration_ms: 60_000,
+                max_line_bytes: 4096,
+            },
+            glob: GlobCeilings {
+                max_matches: 100_000,
+                max_files: 1_000_000,
+                max_duration_ms: 60_000,
+            },
+            scan: ScanCeilings {
+                max_roots: 32,
+                max_patterns: 32,
+                max_entries: 10_000,
+                max_file_bytes: 256 * 1024,
+                max_total_bytes: 4 * 1024 * 1024,
+                max_duration_ms: 30_000,
+            },
+            transfer: TransferCeilings {
+                max_active_operations: 8,
+                max_content_chunk_bytes: 4 * 1024 * 1024,
+                max_inventory_page_entries: 1000,
+                receipt_retention_ms: 86_400_000,
+                max_entries: 100_000,
+                max_depth: 64,
+                max_file_bytes: 1 << 40,
+                max_total_bytes: 1 << 40,
+                max_manifest_bytes: 32 * 1024 * 1024,
+                max_duration_ms: 86_400_000,
+            },
+        }
+    }
 
-        assert_eq!(read, b"hello");
+    pub(crate) fn context() -> RequestContext {
+        RequestContext::detached()
     }
 
-    #[tokio::test(flavor = "current_thread")]
-    async fn filesystem_rejects_root_escape() {
-        let temp = tempfile::tempdir().expect("tempdir");
-        let root = temp.path().join("root");
-        std::fs::create_dir(&root).expect("root");
-        let root = root.canonicalize().expect("canonical root");
-        let fs = LocalFileSystem::new(root, temp.path().to_path_buf(), true);
-        let outside =
-            EnvironmentPath::new(temp.path().join("outside.txt").to_string_lossy()).unwrap();
+    /// A filesystem rooted at `root` with its state directory inside.
+    pub(crate) fn filesystem(root: &Path, writable: bool) -> LocalFileSystem {
+        let confinement =
+            Arc::new(Confinement::new(root.to_path_buf(), root.join(".state")).unwrap());
+        LocalFileSystem::new(FilesystemConfig {
+            confinement,
+            cwd: root.to_path_buf(),
+            writable,
+            limits: limits(),
+        })
+        .unwrap()
+    }
 
-        let error = fs
-            .read_file(ReadFileParams {
-                path: outside,
-                offset: None,
-                max_bytes: None,
-            })
-            .await
-            .expect_err("escape should fail");
+    fn path(root: &Path, relative: &str) -> EnvironmentPath {
+        EnvironmentPath::new(format!("{}/{relative}", root.display())).unwrap()
+    }
 
-        assert_eq!(error.code, EnvironmentProtocolErrorCode::Forbidden);
+    fn reason(error: &ProtocolError) -> Option<PreconditionReason> {
+        match error.data {
+            ErrorData::FailedPrecondition { reason } => Some(reason),
+            _ => None,
+        }
     }
 
-    fn search_fixture() -> (tempfile::TempDir, LocalFileSystem, EnvironmentPath) {
-        let temp = tempfile::tempdir().expect("tempdir");
-        let root = temp.path().canonicalize().expect("canonical root");
-        std::fs::create_dir_all(root.join("src/deep")).expect("dirs");
-        std::fs::write(
-            root.join("src/lib.rs"),
-            "pub fn target() {}\nfn other() {}\n",
-        )
-        .expect("lib");
-        std::fs::write(root.join("src/deep/nested.rs"), "target nested\n").expect("nested");
-        std::fs::write(root.join("readme.md"), "target readme\n").expect("readme");
-        std::fs::write(root.join("binary.bin"), b"tar\x00get\n").expect("binary");
-        let fs = LocalFileSystem::new(root.clone(), root.clone(), false);
-        let environment_root =
-            EnvironmentPath::new(root.to_string_lossy()).expect("environment root");
-        (temp, fs, environment_root)
+    fn read(path: EnvironmentPath, max_bytes: u64) -> ReadFileParams {
+        ReadFileParams {
+            path,
+            offset: 0,
+            max_bytes,
+        }
     }
 
-    fn limits() -> environment_protocol::data::fs::SearchTextLimits {
-        environment_protocol::data::fs::SearchTextLimits {
-            max_matches: 100,
-            max_files: 100,
-            max_bytes: 1024 * 1024,
-            max_duration_ms: 10_000,
+    fn write(path: EnvironmentPath, data: &[u8]) -> WriteFileParams {
+        WriteFileParams {
+            path,
+            data: data.into(),
+            create: WriteCondition::Always,
+            if_match: None,
+            executable: false,
         }
     }
 
-    fn search_params(root: &EnvironmentPath) -> SearchTextParams {
-        SearchTextParams {
-            root: root.clone(),
-            pattern: "target".to_owned(),
-            include: None,
-            case_sensitive: true,
-            max_depth: None,
+    #[tokio::test(flavor = "current_thread")]
+    async fn special_files_are_refused_before_any_read() {
+        let temp = tempfile::tempdir().unwrap();
+        let base = temp.path().canonicalize().unwrap();
+        // The root is `/` so a workspace link to a device stays inside it.
+        let confinement = Arc::new(Confinement::new("/".into(), base.join("state")).unwrap());
+        let fs = LocalFileSystem::new(FilesystemConfig {
+            confinement,
+            cwd: base.clone(),
+            writable: false,
             limits: limits(),
+        })
+        .unwrap();
+        symlink("/dev/zero", base.join("zero")).unwrap();
+        let status = std::process::Command::new("mkfifo")
+            .arg(base.join("fifo"))
+            .status()
+            .unwrap();
+        assert!(status.success());
+        for subject in [
+            EnvironmentPath::new("/dev/zero").unwrap(),
+            path(&base, "zero"),
+            path(&base, "fifo"),
+        ] {
+            let error = fs
+                .read_file(&context(), read(subject.clone(), 1024))
+                .await
+                .unwrap_err();
+            assert_eq!(
+                reason(&error),
+                Some(PreconditionReason::NotRegularFile),
+                "{subject}"
+            );
         }
+        let error = fs
+            .read_file(
+                &context(),
+                read(EnvironmentPath::new(base.to_str().unwrap()).unwrap(), 1),
+            )
+            .await
+            .unwrap_err();
+        assert_eq!(reason(&error), Some(PreconditionReason::IsDirectory));
+    }
+
+    #[cfg(target_os = "linux")]
+    #[tokio::test(flavor = "current_thread")]
+    async fn zero_size_proc_files_report_the_bytes_read() {
+        let temp = tempfile::tempdir().unwrap();
+        let base = temp.path().canonicalize().unwrap();
+        let confinement = Arc::new(Confinement::new("/".into(), base.join("state")).unwrap());
+        let fs = LocalFileSystem::new(FilesystemConfig {
+            confinement,
+            cwd: base,
+            writable: false,
+            limits: limits(),
+        })
+        .unwrap();
+        let response = fs
+            .read_file(
+                &context(),
+                read(EnvironmentPath::new("/proc/self/status").unwrap(), 1 << 20),
+            )
+            .await
+            .unwrap();
+        assert!(!response.data.is_empty());
+        assert_eq!(response.file_size, response.data.len() as u64);
+        assert!(!response.truncated);
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn search_finds_matches_with_include_and_depth_semantics() {
-        let (_temp, fs, root) = search_fixture();
-
-        let mut params = search_params(&root);
-        params.include = Some("*.rs".to_owned());
-        let result = fs.search_text(params).await.expect("search");
-        let mut paths = result
-            .matches
-            .iter()
-            .map(|item| item.path.as_str().to_owned())
-            .collect::<Vec<_>>();
-        paths.sort();
+    async fn ranged_reads_bound_every_read_and_report_truncation() {
+        let temp = tempfile::tempdir().unwrap();
+        let root = temp.path().canonicalize().unwrap();
+        let fs = filesystem(&root, false);
+        std::fs::write(root.join("file"), b"0123456789").unwrap();
+        let ranged = fs
+            .read_file(
+                &context(),
+                ReadFileParams {
+                    path: path(&root, "file"),
+                    offset: 2,
+                    max_bytes: 3,
+                },
+            )
+            .await
+            .unwrap();
+        assert_eq!(ranged.data.as_slice(), b"234");
+        assert_eq!(ranged.file_size, 10);
+        assert!(ranged.truncated);
+        let past_end = fs
+            .read_file(
+                &context(),
+                ReadFileParams {
+                    path: path(&root, "file"),
+                    offset: 100,
+                    max_bytes: 3,
+                },
+            )
+            .await
+            .unwrap();
+        assert!(past_end.data.as_slice().is_empty());
         assert_eq!(
-            paths,
-            vec![
-                format!("{}/src/deep/nested.rs", root.as_str()),
-                format!("{}/src/lib.rs", root.as_str()),
-            ]
-        );
-        assert_eq!(result.matches[0].line_number, 1);
-        assert!(result.stopped.is_none());
-        // NUL-containing files are treated as binary and skipped, so the
-        // binary fixture never matches.
-        assert!(
-            result
-                .matches
-                .iter()
-                .all(|item| !item.path.as_str().ends_with(".bin"))
+            past_end.file_size, 10,
+            "the size of the file, not the offset"
         );
-
-        // max_depth 0 mirrors the generic traversal: files directly under
-        // the root only.
-        let mut params = search_params(&root);
-        params.max_depth = Some(0);
-        let shallow = fs.search_text(params).await.expect("shallow search");
-        assert_eq!(shallow.matches.len(), 1);
-        assert!(shallow.matches[0].path.as_str().ends_with("readme.md"));
+        assert!(!past_end.truncated);
+        let whole = fs
+            .read_file(&context(), read(path(&root, "file"), 10))
+            .await
+            .unwrap();
+        assert!(!whole.truncated);
+        let error = fs
+            .read_file(&context(), read(path(&root, "file"), u64::MAX))
+            .await
+            .unwrap_err();
+        assert!(matches!(
+            error.data,
+            ErrorData::InvalidParams {
+                ceiling: Some(_),
+                ..
+            }
+        ));
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn search_stops_at_each_limit_with_a_typed_reason() {
-        let (_temp, fs, root) = search_fixture();
-
-        let mut params = search_params(&root);
-        params.limits.max_matches = 1;
-        let matches = fs.search_text(params).await.expect("match limit");
-        assert_eq!(matches.matches.len(), 1);
-        assert_eq!(matches.stopped, Some(SearchTextStop::MatchLimit));
-
-        let mut params = search_params(&root);
-        params.limits.max_files = 1;
-        let files = fs.search_text(params).await.expect("file limit");
-        assert_eq!(files.stopped, Some(SearchTextStop::FileLimit));
-        assert_eq!(files.files_searched, 1);
-
-        let mut params = search_params(&root);
-        params.limits.max_bytes = 1;
-        let bytes = fs.search_text(params).await.expect("byte limit");
-        assert_eq!(bytes.stopped, Some(SearchTextStop::ByteLimit));
-        assert!(bytes.matches.is_empty());
+    async fn writes_are_atomic_conditional_and_keep_links_and_modes() {
+        let temp = tempfile::tempdir().unwrap();
+        let root = temp.path().canonicalize().unwrap();
+        let fs = filesystem(&root, true);
+        std::fs::create_dir(root.join("src")).unwrap();
+        std::fs::write(root.join("src/tool.sh"), b"old").unwrap();
+        std::fs::set_permissions(
+            root.join("src/tool.sh"),
+            std::fs::Permissions::from_mode(0o700),
+        )
+        .unwrap();
+        symlink("src/tool.sh", root.join("link")).unwrap();
+
+        let current = fs
+            .read_file(&context(), read(path(&root, "link"), 16))
+            .await
+            .unwrap()
+            .version;
+        let written = fs
+            .write_file(
+                &context(),
+                WriteFileParams {
+                    if_match: Some(current.clone()),
+                    ..write(path(&root, "link"), b"new")
+                },
+            )
+            .await
+            .unwrap();
+        assert!(
+            std::fs::symlink_metadata(root.join("link"))
+                .unwrap()
+                .file_type()
+                .is_symlink()
+        );
+        assert_eq!(std::fs::read(root.join("src/tool.sh")).unwrap(), b"new");
+        let mode = std::fs::metadata(root.join("src/tool.sh"))
+            .unwrap()
+            .permissions()
+            .mode();
+        assert_eq!(mode & 0o777, 0o700);
+        assert_ne!(written.version, current);
+
+        let stale = fs
+            .write_file(
+                &context(),
+                WriteFileParams {
+                    if_match: Some(current),
+                    ..write(path(&root, "src/tool.sh"), b"lost")
+                },
+            )
+            .await
+            .unwrap_err();
+        assert_eq!(reason(&stale), Some(PreconditionReason::IfMatchFailed));
+        let exists = fs
+            .write_file(
+                &context(),
+                WriteFileParams {
+                    create: WriteCondition::IfAbsent,
+                    ..write(path(&root, "src/tool.sh"), b"x")
+                },
+            )
+            .await
+            .unwrap_err();
+        assert_eq!(reason(&exists), Some(PreconditionReason::CreateCondition));
+        let missing = fs
+            .write_file(
+                &context(),
+                WriteFileParams {
+                    create: WriteCondition::IfPresent,
+                    ..write(path(&root, "src/new"), b"x")
+                },
+            )
+            .await
+            .unwrap_err();
+        assert_eq!(reason(&missing), Some(PreconditionReason::CreateCondition));
+        fs.write_file(
+            &context(),
+            WriteFileParams {
+                executable: true,
+                ..write(path(&root, "src/run"), b"#!/bin/sh\n")
+            },
+        )
+        .await
+        .unwrap();
+        let mode = std::fs::metadata(root.join("src/run"))
+            .unwrap()
+            .permissions()
+            .mode();
+        assert_eq!(mode & 0o777, 0o755);
+        let error = fs
+            .write_file(&context(), write(path(&root, "src"), b"x"))
+            .await
+            .unwrap_err();
+        assert_eq!(reason(&error), Some(PreconditionReason::IsDirectory));
+        let error = fs
+            .write_file(&context(), write(path(&root, "absent/file"), b"x"))
+            .await
+            .unwrap_err();
+        assert_eq!(error.kind(), ProtocolErrorKind::NotFound);
+        // No staging file is left behind.
+        let leftovers: Vec<_> = std::fs::read_dir(root.join("src"))
+            .unwrap()
+            .flatten()
+            .filter(|entry| {
+                entry
+                    .file_name()
+                    .to_string_lossy()
+                    .starts_with(WRITE_STAGE_PREFIX)
+            })
+            .collect();
+        assert!(leftovers.is_empty());
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn search_rejects_invalid_requests_and_root_escape() {
-        let (temp, fs, root) = search_fixture();
-
-        let mut params = search_params(&root);
-        params.pattern = "(unclosed".to_owned();
-        let error = fs.search_text(params).await.expect_err("invalid regex");
-        assert_eq!(error.code, EnvironmentProtocolErrorCode::InvalidRequest);
-
-        let mut params = search_params(&root);
-        params.limits.max_matches = 0;
-        let error = fs.search_text(params).await.expect_err("zero limit");
-        assert_eq!(error.code, EnvironmentProtocolErrorCode::InvalidRequest);
-
-        let nested_root = temp.path().join("root");
-        std::fs::create_dir(&nested_root).expect("nested root");
-        let nested_root = nested_root.canonicalize().expect("canonical nested root");
-        let confined = LocalFileSystem::new(nested_root, temp.path().to_path_buf(), false);
-        let error = confined
-            .search_text(search_params(&root))
+    async fn rename_never_replaces_directories_or_unasked_files() {
+        let temp = tempfile::tempdir().unwrap();
+        let root = temp.path().canonicalize().unwrap();
+        let fs = filesystem(&root, true);
+        std::fs::create_dir(root.join("dir")).unwrap();
+        std::fs::write(root.join("a"), b"a").unwrap();
+        std::fs::write(root.join("b"), b"b").unwrap();
+        let rename = |source: &str, destination: &str, overwrite: bool| RenameParams {
+            source: path(&root, source),
+            destination: path(&root, destination),
+            overwrite,
+            if_match: None,
+        };
+        let error = fs
+            .rename(&context(), rename("a", "b", false))
+            .await
+            .unwrap_err();
+        assert_eq!(error.kind(), ProtocolErrorKind::AlreadyExists);
+        let error = fs
+            .rename(&context(), rename("a", "dir", true))
+            .await
+            .unwrap_err();
+        assert_eq!(reason(&error), Some(PreconditionReason::IsDirectory));
+        fs.rename(&context(), rename("a", "b", true)).await.unwrap();
+        assert_eq!(std::fs::read(root.join("b")).unwrap(), b"a");
+        fs.rename(&context(), rename("b", "dir/c", false))
+            .await
+            .unwrap();
+        assert!(root.join("dir/c").exists());
+        let error = fs
+            .rename(&context(), rename(".state", "moved", false))
             .await
-            .expect_err("escape should fail");
-        assert_eq!(error.code, EnvironmentProtocolErrorCode::Forbidden);
+            .unwrap_err();
+        assert_eq!(error.kind(), ProtocolErrorKind::PermissionDenied);
     }
 
-    fn glob_params(root: &EnvironmentPath, pattern: &str) -> GlobFilesParams {
-        GlobFilesParams {
-            root: root.clone(),
-            pattern: pattern.to_owned(),
-            max_depth: None,
-            limits: environment_protocol::data::fs::GlobFilesLimits {
-                max_matches: 100,
-                max_entries: 100,
-                max_duration_ms: 10_000,
+    #[tokio::test(flavor = "current_thread")]
+    async fn removal_refuses_the_root_and_the_state_directory() {
+        let temp = tempfile::tempdir().unwrap();
+        let root = temp.path().canonicalize().unwrap();
+        let fs = filesystem(&root, true);
+        let remove = |path: EnvironmentPath| RemoveParams {
+            path,
+            recursive: true,
+            force: false,
+        };
+        let error = fs
+            .remove(
+                &context(),
+                remove(EnvironmentPath::new(root.to_str().unwrap()).unwrap()),
+            )
+            .await
+            .unwrap_err();
+        assert_eq!(reason(&error), Some(PreconditionReason::FilesystemRoot));
+        let error = fs
+            .remove(&context(), remove(path(&root, ".state")))
+            .await
+            .unwrap_err();
+        assert!(matches!(
+            error.data,
+            ErrorData::PermissionDenied {
+                reason: Some(PermissionReason::DaemonState)
+            }
+        ));
+        fs.remove(
+            &context(),
+            RemoveParams {
+                force: true,
+                ..remove(path(&root, "missing/deeper"))
             },
-        }
+        )
+        .await
+        .unwrap();
+        let read_only = filesystem(&root, false);
+        let error = read_only
+            .remove(&context(), remove(path(&root, "anything")))
+            .await
+            .unwrap_err();
+        assert_eq!(error.kind(), ProtocolErrorKind::CapabilityUnavailable);
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn glob_enumerates_with_generic_pattern_semantics_and_limits() {
-        let (_temp, fs, root) = search_fixture();
-
-        let result = fs
-            .glob_files(glob_params(&root, "**/*.rs"))
-            .await
-            .expect("glob");
-        let mut paths = result
-            .matches
-            .iter()
-            .map(|path| path.as_str().to_owned())
-            .collect::<Vec<_>>();
-        paths.sort();
-        assert_eq!(
-            paths,
-            vec![
-                format!("{}/src/deep/nested.rs", root.as_str()),
-                format!("{}/src/lib.rs", root.as_str()),
-            ]
-        );
-        assert!(result.stopped.is_none());
-        assert!(result.entries_visited >= 4);
-
-        // A pattern without '/' also matches bare file names anywhere.
-        let by_name = fs
-            .glob_files(glob_params(&root, "*.md"))
+    async fn directories_page_by_cursor_and_hide_the_state_directory() {
+        let temp = tempfile::tempdir().unwrap();
+        let root = temp.path().canonicalize().unwrap();
+        let fs = filesystem(&root, false);
+        for name in ["c", "a", "b\\slash", "d"] {
+            std::fs::write(root.join(name), name).unwrap();
+        }
+        symlink("a", root.join("link")).unwrap();
+        let long = "n".repeat(200);
+        std::fs::write(root.join(&long), "long").unwrap();
+        let mut names = Vec::new();
+        let mut cursor = None;
+        loop {
+            let page = fs
+                .read_directory(
+                    &context(),
+                    ReadDirectoryParams {
+                        path: EnvironmentPath::new(root.to_str().unwrap()).unwrap(),
+                        limit: 2,
+                        cursor: cursor.take(),
+                    },
+                )
+                .await
+                .unwrap();
+            names.extend(
+                page.entries
+                    .iter()
+                    .map(|entry| (entry.name.as_str().to_owned(), entry.metadata.kind)),
+            );
+            match page.next_cursor {
+                Some(next) => cursor = Some(next),
+                None => break,
+            }
+        }
+        let expected: Vec<(String, FileKind)> = [
+            ("a", FileKind::File),
+            ("b\\slash", FileKind::File),
+            ("c", FileKind::File),
+            ("d", FileKind::File),
+            ("link", FileKind::Symlink),
+            (long.as_str(), FileKind::File),
+        ]
+        .into_iter()
+        .map(|(name, kind)| (name.to_owned(), kind))
+        .collect();
+        assert_eq!(names, expected);
+        let error = fs
+            .read_directory(
+                &context(),
+                ReadDirectoryParams {
+                    path: EnvironmentPath::new(root.to_str().unwrap()).unwrap(),
+                    limit: 1,
+                    cursor: Some(DirectoryCursor::new("garbage").unwrap()),
+                },
+            )
             .await
-            .expect("glob by name");
-        assert_eq!(by_name.matches.len(), 1);
-        assert!(by_name.matches[0].as_str().ends_with("readme.md"));
-
-        let mut params = glob_params(&root, "**/*");
-        params.limits.max_matches = 1;
-        let matches = fs.glob_files(params).await.expect("match limit");
-        assert_eq!(matches.matches.len(), 1);
-        assert_eq!(matches.stopped, Some(GlobFilesStop::MatchLimit));
-
-        let mut params = glob_params(&root, "**/*");
-        params.limits.max_entries = 2;
-        let entries = fs.glob_files(params).await.expect("entry limit");
-        assert_eq!(entries.stopped, Some(GlobFilesStop::EntryLimit));
-        assert_eq!(entries.entries_visited, 2);
-
-        let mut params = glob_params(&root, "**/*");
-        params.pattern = String::new();
-        let error = fs.glob_files(params).await.expect_err("empty pattern");
-        assert_eq!(error.code, EnvironmentProtocolErrorCode::InvalidRequest);
+            .unwrap_err();
+        assert_eq!(error.kind(), ProtocolErrorKind::InvalidParams);
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn ranged_read_truncates_at_the_source_and_reports_true_size() {
-        let (_temp, fs, root) = search_fixture();
-        let path = EnvironmentPath::new(format!("{}/readme.md", root.as_str())).expect("path");
-        let full = std::fs::read(std::path::Path::new(root.as_str()).join("readme.md"))
-            .expect("full contents");
-
-        let ranged = fs
-            .read_file(ReadFileParams {
-                path: path.clone(),
-                offset: Some(0),
-                max_bytes: Some(6),
-            })
+    async fn metadata_describes_links_and_follows_on_request() {
+        let temp = tempfile::tempdir().unwrap();
+        let root = temp.path().canonicalize().unwrap();
+        let fs = filesystem(&root, false);
+        std::fs::create_dir(root.join("dir")).unwrap();
+        symlink("dir", root.join("link")).unwrap();
+        let link = fs
+            .get_metadata(
+                &context(),
+                GetMetadataParams {
+                    path: path(&root, "link"),
+                    follow_symlinks: false,
+                },
+            )
             .await
-            .expect("ranged read");
-        assert_eq!(ranged.data.as_slice(), &full[..6]);
-        assert_eq!(ranged.file_size, Some(full.len() as u64));
-        assert!(ranged.truncated);
-
-        let tail = fs
-            .read_file(ReadFileParams {
-                path: path.clone(),
-                offset: Some(7),
-                max_bytes: None,
-            })
+            .unwrap()
+            .metadata;
+        assert_eq!(link.kind, FileKind::Symlink);
+        assert_eq!(link.symlink_target.as_deref(), Some("dir"));
+        let followed = fs
+            .get_metadata(
+                &context(),
+                GetMetadataParams {
+                    path: path(&root, "link"),
+                    follow_symlinks: true,
+                },
+            )
             .await
-            .expect("tail read");
-        assert_eq!(tail.data.as_slice(), &full[7..]);
-        assert!(!tail.truncated);
+            .unwrap()
+            .metadata;
+        assert_eq!(followed.kind, FileKind::Directory);
+    }
 
-        let whole = fs
-            .read_file(ReadFileParams {
-                path,
-                offset: None,
-                max_bytes: Some(u64::MAX),
-            })
-            .await
-            .expect("whole read");
-        assert_eq!(whole.data.as_slice(), full.as_slice());
-        assert!(!whole.truncated);
-        assert_eq!(whole.file_size, Some(full.len() as u64));
+    #[test]
+    fn io_errors_map_to_protocol_kinds() {
+        let error = |errno: Errno| io_error(io::Error::from(errno), "subject");
+        assert_eq!(
+            reason(&error(Errno::LOOP)),
+            Some(PreconditionReason::SymlinkLoop)
+        );
+        assert_eq!(
+            reason(&error(Errno::NOTEMPTY)),
+            Some(PreconditionReason::NotEmpty)
+        );
+        assert_eq!(
+            reason(&error(Errno::XDEV)),
+            Some(PreconditionReason::CrossDevice)
+        );
+        assert_eq!(error(Errno::NOENT).kind(), ProtocolErrorKind::NotFound);
+        assert_eq!(error(Errno::EXIST).kind(), ProtocolErrorKind::AlreadyExists);
+        assert!(matches!(
+            error(Errno::ACCESS).data,
+            ErrorData::PermissionDenied {
+                reason: Some(PermissionReason::FilePermission)
+            }
+        ));
+        assert_eq!(
+            error(Errno::ROFS).kind(),
+            ProtocolErrorKind::CapabilityUnavailable
+        );
+    }
+
+    #[test]
+    fn json_string_lengths_count_escapes() {
+        for value in [
+            "",
+            "plain",
+            "a\"b\\c",
+            "line\n\ttab",
+            "\u{1b}[31mred\u{1b}[0m",
+            "\0",
+            "ünï",
+        ] {
+            let encoded = serde_json::to_string(value).unwrap();
+            assert_eq!(json_string_len(value), encoded.len() as u64, "{value:?}");
+        }
     }
 }
diff --git a/crates/environment-daemon/src/filesystem/backend/mod.rs b/crates/environment-daemon/src/filesystem/backend/mod.rs
deleted file mode 100644
index d07fa92bc..000000000
--- a/crates/environment-daemon/src/filesystem/backend/mod.rs
+++ /dev/null
@@ -1,85 +0,0 @@
-//! OS boundary for confined traversal and atomic publication. Wire paths and inventories
-//! contain no descriptors, inode numbers, or Unix permission bits. A Windows backend can
-//! implement this interface with directory handles, reparse-point checks and native rename.
-#[cfg(any(target_os = "linux", target_os = "macos"))]
-mod unix;
-#[cfg(any(target_os = "linux", target_os = "macos"))]
-pub use unix::*;
-
-use environment_protocol::{
-    data::inventory::MAX_INVENTORY_PATH_BYTES,
-    error::{EnvironmentProtocolError as Error, EnvironmentProtocolErrorCode as Code},
-};
-use sha2::{Digest, Sha256};
-use std::path::Path;
-pub(crate) type Result<T> = std::result::Result<T, Error>;
-pub(crate) fn error(code: Code, message: impl Into<String>) -> Error {
-    Error::new(code, message)
-}
-pub(crate) fn invalid(message: &str) -> Error {
-    error(Code::InvalidRequest, message)
-}
-pub(crate) fn io(e: std::io::Error) -> Error {
-    use std::io::ErrorKind::*;
-    if is_path_violation(&e) {
-        return error(Code::Forbidden, e.to_string());
-    }
-    error(
-        match e.kind() {
-            NotFound => Code::NotFound,
-            AlreadyExists => Code::Conflict,
-            PermissionDenied => Code::Forbidden,
-            Unsupported => Code::Unsupported,
-            InvalidInput => Code::InvalidRequest,
-            _ => Code::Internal,
-        },
-        e.to_string(),
-    )
-}
-pub(crate) fn conflict() -> Error {
-    error(
-        Code::Conflict,
-        "filesystem observation changed; retry the filesystem operation",
-    )
-}
-pub(crate) fn valid_path(path: &str) -> bool {
-    path.len() <= MAX_INVENTORY_PATH_BYTES
-        && (path.is_empty()
-            || (!path.contains(['\\', '\0'])
-                && path
-                    .split('/')
-                    .all(|p| !p.is_empty() && p != "." && p != "..")))
-}
-pub(crate) fn valid_digest(value: &str) -> bool {
-    value.strip_prefix("sha256:").is_some_and(|s| {
-        s.len() == 64
-            && s.bytes()
-                .all(|b| b.is_ascii_digit() || (b'a'..=b'f').contains(&b))
-    })
-}
-pub(crate) fn digest(hash: Sha256) -> String {
-    format!("sha256:{}", hex::encode(hash.finalize()))
-}
-pub(crate) fn relative(
-    root: &Path,
-    path: &environment_protocol::shared::EnvironmentPath,
-) -> Result<String> {
-    let path = Path::new(path.as_str())
-        .strip_prefix(root)
-        .map_err(|_| error(Code::Forbidden, "selection outside filesystem root"))?;
-    let value = path
-        .components()
-        .map(|component| match component {
-            std::path::Component::Normal(name) => name
-                .to_str()
-                .map(str::to_owned)
-                .ok_or_else(|| invalid("non-UTF-8 selection")),
-            _ => Err(invalid("invalid selection component")),
-        })
-        .collect::<Result<Vec<_>>>()?
-        .join("/");
-    if !valid_path(&value) {
-        return Err(invalid("invalid selection"));
-    }
-    Ok(value)
-}
diff --git a/crates/environment-daemon/src/filesystem/backend/unix.rs b/crates/environment-daemon/src/filesystem/backend/unix.rs
deleted file mode 100644
index 7be100dd7..000000000
--- a/crates/environment-daemon/src/filesystem/backend/unix.rs
+++ /dev/null
@@ -1,504 +0,0 @@
-use std::{
-    ffi::{CStr, CString},
-    fs::{File, Metadata},
-    io,
-    os::unix::fs::{MetadataExt, PermissionsExt},
-    path::{Component, Path},
-};
-
-use rustix::fs::{self, AtFlags, FileType, Mode, OFlags};
-
-pub struct Directory(File);
-#[derive(Clone, Debug)]
-pub struct Observation(Metadata);
-impl Observation {
-    pub fn is_dir(&self) -> bool {
-        self.0.is_dir()
-    }
-    pub fn size(&self) -> u64 {
-        self.0.len()
-    }
-    pub fn executable(&self) -> bool {
-        self.0.mode() & 0o111 != 0
-    }
-    pub fn matches(&self, other: &Self) -> bool {
-        let (a, b) = (&self.0, &other.0);
-        a.dev() == b.dev()
-            && a.ino() == b.ino()
-            && a.mode() == b.mode()
-            && a.len() == b.len()
-            && a.mtime() == b.mtime()
-            && a.mtime_nsec() == b.mtime_nsec()
-            && a.ctime() == b.ctime()
-            && a.ctime_nsec() == b.ctime_nsec()
-    }
-}
-fn c(name: &str) -> io::Result<CString> {
-    CString::new(name).map_err(|_| io::Error::from(io::ErrorKind::InvalidInput))
-}
-fn check(meta: Metadata) -> io::Result<Observation> {
-    if meta.is_file() || meta.is_dir() {
-        Ok(Observation(meta))
-    } else {
-        Err(io::Error::new(
-            io::ErrorKind::Unsupported,
-            "scoped filesystem access does not support symlinks or special files",
-        ))
-    }
-}
-pub fn observe(file: &File) -> io::Result<Observation> {
-    check(file.metadata()?)
-}
-pub fn set_executable(file: &File, executable: bool) -> io::Result<()> {
-    file.set_permissions(std::fs::Permissions::from_mode(if executable {
-        0o755
-    } else {
-        0o644
-    }))
-}
-/// Streaming directory enumeration; cleanup never collects an entire retired tree.
-struct Entries(fs::Dir);
-impl Iterator for Entries {
-    type Item = io::Result<CString>;
-    fn next(&mut self) -> Option<Self::Item> {
-        self.0.find_map(|entry| match entry {
-            Ok(entry) => {
-                let name = entry.file_name();
-                if name.to_bytes() == b"." || name.to_bytes() == b".." {
-                    None
-                } else {
-                    Some(Ok(name.to_owned()))
-                }
-            }
-            Err(error) => Some(Err(error.into())),
-        })
-    }
-}
-fn entries(file: &File) -> io::Result<Entries> {
-    // Open a separate description so enumeration never shares the caller's offset.
-    let fd = fs::openat(
-        file,
-        ".",
-        OFlags::RDONLY | OFlags::DIRECTORY | OFlags::CLOEXEC,
-        Mode::empty(),
-    )?;
-    Ok(Entries(fs::Dir::new(fd)?))
-}
-
-pub fn is_path_violation(error: &io::Error) -> bool {
-    matches!(
-        rustix::io::Errno::from_io_error(error),
-        Some(rustix::io::Errno::LOOP | rustix::io::Errno::NOTDIR)
-    )
-}
-pub fn create_private_directory(path: &Path) -> io::Result<()> {
-    use std::os::unix::fs::DirBuilderExt;
-    std::fs::DirBuilder::new()
-        .recursive(true)
-        .mode(0o700)
-        .create(path)
-}
-pub fn sync_directory(path: &Path) -> io::Result<()> {
-    Directory::anchor(path)?.sync()
-}
-
-impl Directory {
-    pub fn anchor(root: &Path) -> io::Result<Self> {
-        // Configured roots may contain platform aliases (/var on macOS). Resolve this
-        // administrator-owned anchor once; user selections are always opened relative to it.
-        let root = root.canonicalize()?;
-        let mut dir = Self(
-            fs::open(
-                "/",
-                OFlags::RDONLY | OFlags::DIRECTORY | OFlags::NOFOLLOW | OFlags::CLOEXEC,
-                Mode::empty(),
-            )?
-            .into(),
-        );
-        for part in root.components() {
-            if let Component::Normal(name) = part {
-                let name = name
-                    .to_str()
-                    .ok_or_else(|| io::Error::from(io::ErrorKind::InvalidInput))?;
-                dir = dir.child(name)?;
-            }
-        }
-        Ok(dir)
-    }
-    pub fn sync(&self) -> io::Result<()> {
-        self.0.sync_all()
-    }
-    pub fn clone_dir(&self) -> io::Result<Self> {
-        Ok(Self(self.0.try_clone()?))
-    }
-    pub fn child(&self, name: &str) -> io::Result<Self> {
-        self.child_name(name)
-    }
-    fn child_name(&self, name: impl rustix::path::Arg) -> io::Result<Self> {
-        Ok(Self(
-            fs::openat(
-                &self.0,
-                name,
-                OFlags::RDONLY | OFlags::DIRECTORY | OFlags::NOFOLLOW | OFlags::CLOEXEC,
-                Mode::empty(),
-            )?
-            .into(),
-        ))
-    }
-    pub fn parent(&self, path: &str) -> io::Result<(Self, String)> {
-        self.parent_with_creation(path, false)
-    }
-    /// Prepare a destination without following symlinks in existing or raced-in parents.
-    pub fn ensure_parent(&self, path: &str) -> io::Result<(Self, String)> {
-        self.parent_with_creation(path, true)
-    }
-    fn parent_with_creation(&self, path: &str, create_missing: bool) -> io::Result<(Self, String)> {
-        let mut parts = path.split('/').collect::<Vec<_>>();
-        let name = parts.pop().unwrap_or("").to_owned();
-        let mut dir = self.clone_dir()?;
-        for part in parts {
-            dir = match dir.child(part) {
-                Ok(child) => child,
-                Err(error) if create_missing && error.kind() == io::ErrorKind::NotFound => {
-                    let child = match dir.mkdir(part, false) {
-                        Ok(child) => child,
-                        // Another creator may win the mkdir race. Reopen with the same
-                        // directory-only, no-follow checks used for existing parents.
-                        Err(error) if error.kind() == io::ErrorKind::AlreadyExists => {
-                            dir.child(part)?
-                        }
-                        Err(error) => return Err(error),
-                    };
-                    dir.sync()?;
-                    child
-                }
-                Err(error) => return Err(error),
-            };
-        }
-        Ok((dir, if name.is_empty() { ".".into() } else { name }))
-    }
-    pub fn open(&self, path: &str) -> io::Result<File> {
-        self.open_kind(path, false)
-    }
-    pub fn metadata(&self, path: &str) -> io::Result<File> {
-        self.open_kind(path, true)
-    }
-    /// Check the same existing-file write permission as a normal write, without
-    /// truncation, and without following filesystem aliases outside the scope.
-    pub fn writable_file(&self, path: &str) -> io::Result<File> {
-        let (dir, name) = self.parent(path)?;
-        let file: File = fs::openat(
-            &dir.0,
-            &name,
-            OFlags::WRONLY | OFlags::NOFOLLOW | OFlags::NONBLOCK | OFlags::CLOEXEC,
-            Mode::empty(),
-        )?
-        .into();
-        if !file.metadata()?.is_file() {
-            return Err(io::Error::new(
-                io::ErrorKind::InvalidInput,
-                "write requires a regular file",
-            ));
-        }
-        Ok(file)
-    }
-    fn open_kind(&self, path: &str, metadata_only: bool) -> io::Result<File> {
-        let (dir, name) = self.parent(path)?;
-        #[cfg(target_os = "linux")]
-        let access = if metadata_only {
-            OFlags::PATH
-        } else {
-            OFlags::RDONLY
-        };
-        #[cfg(target_os = "macos")]
-        let access = if metadata_only {
-            // Rustix does not name the macOS metadata-only flag.
-            OFlags::from_bits_retain(libc::O_EVTONLY as u32)
-        } else {
-            OFlags::RDONLY
-        };
-        let file = fs::openat(
-            &dir.0,
-            &name,
-            access | OFlags::NOFOLLOW | OFlags::NONBLOCK | OFlags::CLOEXEC,
-            Mode::empty(),
-        )?
-        .into();
-        observe(&file)?;
-        Ok(file)
-    }
-    /// Inspect replacement targets without requiring read permission on their content.
-    pub fn target_exists(&self, name: &str) -> io::Result<bool> {
-        let stat = match fs::statat(&self.0, name, AtFlags::SYMLINK_NOFOLLOW) {
-            Ok(stat) => stat,
-            Err(rustix::io::Errno::NOENT) => return Ok(false),
-            Err(error) => return Err(error.into()),
-        };
-        if !matches!(
-            FileType::from_raw_mode(stat.st_mode),
-            FileType::Directory | FileType::RegularFile
-        ) {
-            return Err(io::Error::new(
-                io::ErrorKind::PermissionDenied,
-                "target is a symlink or special file",
-            ));
-        }
-        Ok(true)
-    }
-    pub fn names(file: &File, limit: usize) -> io::Result<Vec<String>> {
-        let mut names = Vec::new();
-        for name in entries(file)? {
-            if names.len() >= limit {
-                return Err(io::Error::new(
-                    io::ErrorKind::InvalidInput,
-                    "directory entry limit exceeded",
-                ));
-            }
-            names.push(
-                name?.into_string().map_err(|_| {
-                    io::Error::new(io::ErrorKind::Unsupported, "non-UTF-8 filename")
-                })?,
-            );
-        }
-        names.sort();
-        Ok(names)
-    }
-    pub fn mkdir(&self, name: &str, private: bool) -> io::Result<Self> {
-        fs::mkdirat(
-            &self.0,
-            name,
-            Mode::from_raw_mode(if private { 0o700 } else { 0o755 }),
-        )?;
-        self.child(name)
-    }
-    pub fn create(&self, path: &str) -> io::Result<File> {
-        let (dir, name) = self.parent(path)?;
-        Ok(fs::openat(
-            &dir.0,
-            &name,
-            OFlags::RDWR | OFlags::CREATE | OFlags::EXCL | OFlags::NOFOLLOW | OFlags::CLOEXEC,
-            Mode::RUSR | Mode::WUSR,
-        )?
-        .into())
-    }
-    pub fn publish(&self, stage: &Self, target: &str, replace: bool) -> io::Result<bool> {
-        // Rustix handles flagged renames on both Linux libc variants and macOS.
-        let rename = |exchange: bool| {
-            fs::renameat_with(
-                &stage.0,
-                "tree",
-                &self.0,
-                target,
-                if exchange {
-                    fs::RenameFlags::EXCHANGE
-                } else {
-                    fs::RenameFlags::NOREPLACE
-                },
-            )
-            .map_err(io::Error::from)
-        };
-        match rename(false) {
-            Ok(()) => Ok(false),
-            Err(error) if replace && error.kind() == io::ErrorKind::AlreadyExists => {
-                rename(true)?;
-                Ok(true)
-            }
-            Err(error) => Err(error),
-        }
-    }
-
-    /// A normal rename atomically refuses to replace a directory with a file,
-    /// including a directory created after the caller's destination check.
-    pub fn publish_file(&self, stage: &Self, target: &str) -> io::Result<()> {
-        fs::renameat(&stage.0, "tree", &self.0, target).map_err(io::Error::from)
-    }
-    pub fn remove_tree(&self, name: &str) -> io::Result<()> {
-        struct Frame {
-            name: CString,
-            directory: Directory,
-            entries: Entries,
-        }
-        let name = c(name)?;
-        let unlink = |parent: &Directory, name: &CStr, flags: AtFlags| -> io::Result<()> {
-            Ok(fs::unlinkat(&parent.0, name, flags)?)
-        };
-        let directory = match self.child_name(&name) {
-            Ok(dir) => dir,
-            Err(_) => return unlink(self, &name, AtFlags::empty()),
-        };
-        let mut stack = vec![Frame {
-            name,
-            entries: entries(&directory.0)?,
-            directory,
-        }];
-        while let Some(frame) = stack.last_mut() {
-            if let Some(name) = frame.entries.next() {
-                let name = name?;
-                match frame.directory.child_name(&name) {
-                    Ok(directory) => {
-                        if stack.len() >= 256 {
-                            return Err(io::Error::new(
-                                io::ErrorKind::Unsupported,
-                                "retirement cleanup depth limit exceeded",
-                            ));
-                        }
-                        stack.push(Frame {
-                            name,
-                            entries: entries(&directory.0)?,
-                            directory,
-                        });
-                    }
-                    Err(_) => unlink(&frame.directory, &name, AtFlags::empty())?,
-                }
-            } else {
-                let frame = stack.pop().unwrap();
-                let parent = stack.last().map_or(self, |frame| &frame.directory);
-                unlink(parent, &frame.name, AtFlags::REMOVEDIR)?;
-            }
-        }
-        Ok(())
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn file_publication_cannot_replace_a_directory() {
-        let root = tempfile::tempdir().unwrap();
-        let parent = Directory::anchor(root.path()).unwrap();
-        let stage = parent.mkdir("staging", true).unwrap();
-        std::fs::write(root.path().join("staging/tree"), b"new bytes").unwrap();
-        // The file was valid when checked, but another actor replaced it by a
-        // nonempty directory before publication.
-        std::fs::write(root.path().join("target"), b"old bytes").unwrap();
-        parent.writable_file("target").unwrap();
-        std::fs::remove_file(root.path().join("target")).unwrap();
-        std::fs::create_dir(root.path().join("target")).unwrap();
-        std::fs::write(root.path().join("target/keep"), b"keep").unwrap();
-        assert!(parent.publish_file(&stage, "target").is_err());
-        assert_eq!(
-            std::fs::read(root.path().join("target/keep")).unwrap(),
-            b"keep"
-        );
-        assert_eq!(
-            std::fs::read(root.path().join("staging/tree")).unwrap(),
-            b"new bytes"
-        );
-        std::fs::remove_dir_all(root.path().join("target")).unwrap();
-        std::fs::write(root.path().join("target"), b"old bytes").unwrap();
-        parent.publish_file(&stage, "target").unwrap();
-        assert_eq!(
-            std::fs::read(root.path().join("target")).unwrap(),
-            b"new bytes"
-        );
-    }
-
-    #[test]
-    fn directory_enumerations_have_independent_offsets_and_enforce_limits() {
-        let root = tempfile::tempdir().unwrap();
-        for name in ["a", "b", "c"] {
-            std::fs::write(root.path().join(name), name).unwrap();
-        }
-        let dir = Directory::anchor(root.path()).unwrap();
-        let mut first = entries(&dir.0).unwrap();
-        let mut observed = vec![first.next().unwrap().unwrap().into_string().unwrap()];
-        assert_eq!(Directory::names(&dir.0, 3).unwrap(), ["a", "b", "c"]);
-        observed.extend(first.map(|name| name.unwrap().into_string().unwrap()));
-        observed.sort();
-        assert_eq!(observed, ["a", "b", "c"]);
-        assert_eq!(
-            Directory::names(&dir.0, 2).unwrap_err().kind(),
-            io::ErrorKind::InvalidInput
-        );
-        assert_eq!(Directory::names(&dir.0, 3).unwrap(), ["a", "b", "c"]);
-    }
-
-    #[test]
-    fn cleanup_removes_nested_trees_without_following_symlinks() {
-        use std::os::unix::fs::symlink;
-
-        let root = tempfile::tempdir().unwrap();
-        let outside = tempfile::tempdir().unwrap();
-        std::fs::write(outside.path().join("keep"), "untouched").unwrap();
-        let dir = Directory::anchor(root.path()).unwrap();
-        let retired = dir.mkdir("retired", true).unwrap();
-        retired.mkdir("nested", true).unwrap();
-        std::fs::write(root.path().join("retired/nested/file"), "content").unwrap();
-        symlink(outside.path(), root.path().join("retired/link")).unwrap();
-        symlink("missing", root.path().join("retired/dangling")).unwrap();
-        dir.remove_tree("retired").unwrap();
-        assert!(!root.path().join("retired").exists());
-        assert_eq!(
-            std::fs::read_to_string(outside.path().join("keep")).unwrap(),
-            "untouched"
-        );
-    }
-
-    // macOS filesystems reject invalid UTF-8 at creation time.
-    #[cfg(target_os = "linux")]
-    #[test]
-    fn cleanup_handles_non_utf8_names() {
-        use std::os::unix::ffi::OsStrExt;
-
-        let root = tempfile::tempdir().unwrap();
-        let dir = Directory::anchor(root.path()).unwrap();
-        dir.mkdir("retired", true).unwrap();
-        let raw_path = root
-            .path()
-            .join("retired")
-            .join(std::ffi::OsStr::from_bytes(b"raw-\xff"));
-        std::fs::create_dir(&raw_path).unwrap();
-        std::fs::write(
-            raw_path.join(std::ffi::OsStr::from_bytes(b"file-\xfe")),
-            "data",
-        )
-        .unwrap();
-        dir.remove_tree("retired").unwrap();
-        assert!(!root.path().join("retired").exists());
-    }
-
-    #[test]
-    fn publication_refuses_overwrite_and_exchanges_replaced_files_and_trees() {
-        for directory in [false, true] {
-            let root = tempfile::tempdir().unwrap();
-            let parent = Directory::anchor(root.path()).unwrap();
-            let stage = parent.mkdir("stage", true).unwrap();
-            let staged = root.path().join("stage/tree");
-            let target = root.path().join("target");
-            let write = |path: &Path, bytes: &[u8]| {
-                if directory {
-                    std::fs::create_dir(path).unwrap();
-                    std::fs::write(path.join("content"), bytes).unwrap();
-                } else {
-                    std::fs::write(path, bytes).unwrap();
-                }
-            };
-            let read = |path: &Path| {
-                std::fs::read(if directory {
-                    path.join("content")
-                } else {
-                    path.to_owned()
-                })
-                .unwrap()
-            };
-
-            write(&staged, b"original");
-            assert!(!parent.publish(&stage, "target", false).unwrap());
-            assert_eq!(read(&target), b"original");
-            assert!(!staged.exists());
-
-            write(&staged, b"replacement");
-            let error = parent.publish(&stage, "target", false).unwrap_err();
-            assert_eq!(error.kind(), io::ErrorKind::AlreadyExists);
-            assert_eq!(read(&target), b"original");
-            assert_eq!(read(&staged), b"replacement");
-
-            assert!(parent.publish(&stage, "target", true).unwrap());
-            assert_eq!(read(&target), b"replacement");
-            // Exchange retains the old target in staging for later cleanup.
-            assert_eq!(read(&staged), b"original");
-        }
-    }
-}
diff --git a/crates/environment-daemon/src/filesystem/confinement.rs b/crates/environment-daemon/src/filesystem/confinement.rs
new file mode 100644
index 000000000..b4fe081c9
--- /dev/null
+++ b/crates/environment-daemon/src/filesystem/confinement.rs
@@ -0,0 +1,721 @@
+//! The one confinement rule of every data-plane path, a command's `cwd`
+//! included.
+//!
+//! A wire path that is neither the filesystem root nor below it is
+//! `permissionDenied` (`outsideRoot`). Otherwise the root prefix is stripped
+//! and the remaining segments are resolved one at a time beneath the root's
+//! directory descriptor. A symlink is followed only while its target stays
+//! inside the root; a link that leaves it is refused the same way. A path
+//! that names the daemon state directory, or passes through or below it, is
+//! `permissionDenied` (`daemonState`).
+//!
+//! The state directory is recognized by its identity (device and inode),
+//! never by name: every entry a lookup meets is compared with it, so another
+//! spelling on a case-insensitive filesystem, a bind mount or a link cannot
+//! reach it.
+
+use std::{
+    collections::VecDeque,
+    ffi::{OsStr, OsString},
+    os::unix::ffi::OsStrExt,
+    path::{Path, PathBuf},
+};
+
+use environment_protocol::{
+    error::{PermissionReason, PreconditionReason, ProtocolError},
+    paths::EnvironmentPath,
+};
+
+use super::{
+    io_error,
+    os::{DEFAULT_DIRECTORY_MODE, Directory, EntryStat, PRIVATE_DIRECTORY_MODE, SELF},
+};
+
+/// Most symlinks one resolution follows before it is a loop.
+const MAX_SYMLINK_FOLLOWS: u32 = 40;
+
+/// The filesystem root, its directory descriptor and the daemon state
+/// directory. Built once per daemon and shared by every manager.
+#[derive(Debug)]
+pub struct Confinement {
+    root: PathBuf,
+    root_path: EnvironmentPath,
+    root_directory: Directory,
+    state_dir: PathBuf,
+    /// Device and inode of the state directory.
+    state_identity: Identity,
+    /// Device and inode of each of its ancestors, its parent first.
+    state_ancestors: Vec<Identity>,
+}
+
+/// Device and inode of an entry.
+pub(crate) type Identity = (u64, u64);
+
+/// How one lookup treats the final entry and missing entries.
+#[derive(Clone, Copy, Debug, Default)]
+pub(crate) struct Lookup {
+    /// Follow a symlink in the final position (inside the root only).
+    pub follow_final: bool,
+    /// A missing final entry resolves with `stat: None` instead of
+    /// `notFound`.
+    pub allow_missing: bool,
+    /// Create missing intermediate directories.
+    pub create_parents: bool,
+    /// Refuse every symlink, final or not: re-opening a path recorded as
+    /// canonical, where a link means the tree changed.
+    pub no_symlinks: bool,
+}
+
+impl Lookup {
+    pub const FOLLOW: Self = Self {
+        follow_final: true,
+        allow_missing: false,
+        create_parents: false,
+        no_symlinks: false,
+    };
+    pub const NO_FOLLOW: Self = Self {
+        follow_final: false,
+        allow_missing: false,
+        create_parents: false,
+        no_symlinks: false,
+    };
+
+    pub fn allowing_missing(mut self) -> Self {
+        self.allow_missing = true;
+        self
+    }
+
+    pub fn creating_parents(mut self) -> Self {
+        self.create_parents = true;
+        self
+    }
+}
+
+/// A resolved entry: the directory that holds it and its name there. Every
+/// later operation names the entry through `parent` and `name`, so a link
+/// swapped in after resolution is never followed.
+#[derive(Debug)]
+pub(crate) struct Resolved {
+    pub parent: Directory,
+    /// `.` for the filesystem root itself.
+    pub name: OsString,
+    /// Canonical segments below the root; empty for the root.
+    pub segments: Vec<OsString>,
+    /// `lstat` of the final entry; `None` when it is missing and the lookup
+    /// allowed that.
+    pub stat: Option<EntryStat>,
+    /// Canonical segments of the directories this lookup created
+    /// (`creating_parents`), outermost first.
+    pub created: Vec<Vec<OsString>>,
+}
+
+impl Resolved {
+    pub fn is_root(&self) -> bool {
+        self.segments.is_empty()
+    }
+
+    /// Open the resolved directory.
+    pub fn open_directory(&self) -> std::io::Result<Directory> {
+        if self.is_root() {
+            self.parent.try_clone()
+        } else {
+            self.parent.child(&self.name)
+        }
+    }
+}
+
+impl Confinement {
+    /// `root` is canonicalized and opened. `state_dir` is created (private)
+    /// when missing and canonicalized; it must not be the root itself.
+    pub fn new(root: PathBuf, state_dir: PathBuf) -> Result<Self, ProtocolError> {
+        let root = root
+            .canonicalize()
+            .map_err(|error| io_error(error, root.display()))?;
+        let root_path = root
+            .to_str()
+            .and_then(|root| EnvironmentPath::new(root).ok())
+            .ok_or_else(|| {
+                ProtocolError::internal(format!(
+                    "filesystem root {} is not a valid environment path",
+                    root.display()
+                ))
+            })?;
+        let root_directory =
+            Directory::open_host(&root).map_err(|error| io_error(error, root.display()))?;
+        if !state_dir.exists() {
+            use std::os::unix::fs::DirBuilderExt;
+            std::fs::DirBuilder::new()
+                .recursive(true)
+                .mode(PRIVATE_DIRECTORY_MODE)
+                .create(&state_dir)
+                .map_err(|error| io_error(error, state_dir.display()))?;
+        }
+        let state_dir = state_dir
+            .canonicalize()
+            .map_err(|error| io_error(error, state_dir.display()))?;
+        let identity_of = |path: &Path| {
+            use std::os::unix::fs::MetadataExt;
+            std::fs::metadata(path)
+                .map(|metadata| (metadata.dev(), metadata.ino()))
+                .map_err(|error| io_error(error, path.display()))
+        };
+        let state_identity = identity_of(&state_dir)?;
+        let state_ancestors = state_dir
+            .ancestors()
+            .skip(1)
+            .map(identity_of)
+            .collect::<Result<Vec<_>, _>>()?;
+        let root_identity = EntryStat::of_directory(&root_directory)
+            .map_err(|error| io_error(error, root.display()))?
+            .identity();
+        if root_identity == state_identity {
+            return Err(ProtocolError::internal(
+                "the daemon state directory must not be the filesystem root",
+            ));
+        }
+        Ok(Self {
+            root,
+            root_path,
+            root_directory,
+            state_dir,
+            state_identity,
+            state_ancestors,
+        })
+    }
+
+    pub fn root(&self) -> &Path {
+        &self.root
+    }
+
+    pub fn state_dir(&self) -> &Path {
+        &self.state_dir
+    }
+
+    /// The root as a wire path.
+    pub fn root_path(&self) -> &EnvironmentPath {
+        &self.root_path
+    }
+
+    /// The confinement rule: the resolved host path of the final target,
+    /// following in-root symlinks. Missing entries are `notFound`.
+    pub fn resolve(&self, path: &EnvironmentPath) -> Result<PathBuf, ProtocolError> {
+        let resolved = self.lookup(path, Lookup::FOLLOW)?;
+        Ok(self.host_path(&resolved.segments))
+    }
+
+    /// [`Self::resolve`], then require a directory
+    /// (`failedPrecondition` `notDirectory` otherwise).
+    pub fn resolve_directory(&self, path: &EnvironmentPath) -> Result<PathBuf, ProtocolError> {
+        let resolved = self.lookup(path, Lookup::FOLLOW)?;
+        if !resolved.stat.is_some_and(|stat| stat.is_dir()) {
+            return Err(ProtocolError::failed_precondition(
+                PreconditionReason::NotDirectory,
+                format!("{path} is not a directory"),
+            ));
+        }
+        Ok(self.host_path(&resolved.segments))
+    }
+
+    /// Resolve a wire path under the rule.
+    pub(crate) fn lookup(
+        &self,
+        path: &EnvironmentPath,
+        lookup: Lookup,
+    ) -> Result<Resolved, ProtocolError> {
+        let Some(relative) = path.relative_to(&self.root_path) else {
+            return Err(outside_root(path));
+        };
+        let components = relative.segments().map(OsString::from).collect();
+        self.walk(components, lookup, path)
+    }
+
+    /// Resolve canonical segments below the root plus a trailing name,
+    /// following a symlink in final position: how a walker follows a link
+    /// it met at `segments/name`.
+    pub(crate) fn lookup_link(
+        &self,
+        segments: &[OsString],
+        name: &OsStr,
+        subject: &dyn std::fmt::Display,
+    ) -> Result<Resolved, ProtocolError> {
+        let mut components = segments.to_vec();
+        components.push(name.to_owned());
+        self.walk(components.into(), Lookup::FOLLOW, subject)
+    }
+
+    /// Re-open canonical segments recorded earlier. Any symlink on the way
+    /// means the tree changed: it fails with `ELOOP`'s mapping.
+    pub(crate) fn reopen(
+        &self,
+        segments: &[OsString],
+        subject: &dyn std::fmt::Display,
+    ) -> Result<Resolved, ProtocolError> {
+        let lookup = Lookup {
+            no_symlinks: true,
+            ..Lookup::NO_FOLLOW
+        };
+        self.walk(segments.iter().cloned().collect(), lookup, subject)
+    }
+
+    /// The host path of canonical segments.
+    pub(crate) fn host_path(&self, segments: &[OsString]) -> PathBuf {
+        let mut path = self.root.clone();
+        path.extend(segments);
+        path
+    }
+
+    /// The wire path of canonical segments, when they are UTF-8.
+    pub(crate) fn wire_path(&self, segments: &[OsString]) -> Option<EnvironmentPath> {
+        let mut path = self.root_path.as_str().trim_end_matches('/').to_owned();
+        for segment in segments {
+            path.push('/');
+            path.push_str(segment.to_str()?);
+        }
+        if path.is_empty() {
+            path.push('/');
+        }
+        EnvironmentPath::new(path).ok()
+    }
+
+    /// The entry is the state directory.
+    pub(crate) fn is_state(&self, stat: &EntryStat) -> bool {
+        stat.identity() == self.state_identity
+    }
+
+    /// The entry is the state directory or one of its ancestors: removing,
+    /// replacing or capturing it would address the state directory.
+    pub(crate) fn contains_state(&self, stat: &EntryStat) -> bool {
+        self.is_state(stat) || self.state_ancestors.contains(&stat.identity())
+    }
+
+    /// The directory is the state directory's parent, so one of its
+    /// entries may be the state directory.
+    pub(crate) fn holds_state(&self, directory: &EntryStat) -> bool {
+        self.state_ancestors.first() == Some(&directory.identity())
+    }
+
+    /// Refuse an operation whose subject contains the state directory.
+    pub(crate) fn refuse_containing_state(
+        &self,
+        resolved: &Resolved,
+        subject: &dyn std::fmt::Display,
+    ) -> Result<(), ProtocolError> {
+        if resolved.stat.is_some_and(|stat| self.contains_state(&stat)) {
+            return Err(daemon_state(subject));
+        }
+        Ok(())
+    }
+
+    /// Remove directories a lookup created (see [`Resolved::created`])
+    /// that are still empty, innermost first. Best effort.
+    pub(crate) fn remove_created(&self, created: &[Vec<OsString>]) {
+        for segments in created.iter().rev() {
+            let Some((name, parent)) = segments.split_last() else {
+                continue;
+            };
+            let Ok(resolved) = self.reopen(parent, &"created directory") else {
+                return;
+            };
+            let Ok(directory) = resolved.open_directory() else {
+                return;
+            };
+            if directory.rmdir(name).is_err() {
+                return;
+            }
+        }
+    }
+
+    fn walk(
+        &self,
+        mut pending: VecDeque<OsString>,
+        lookup: Lookup,
+        subject: &dyn std::fmt::Display,
+    ) -> Result<Resolved, ProtocolError> {
+        let io = |error| io_error(error, subject);
+        let mut stack = vec![self.root_directory.try_clone().map_err(io)?];
+        let mut segments: Vec<OsString> = Vec::new();
+        let mut created = Vec::new();
+        let mut follows = 0;
+        while let Some(name) = pending.pop_front() {
+            if name.is_empty() || name == SELF {
+                continue;
+            }
+            if name == ".." {
+                if segments.pop().is_none() {
+                    return Err(outside_root(subject));
+                }
+                stack.pop();
+                continue;
+            }
+            let last = pending.is_empty();
+            let mut candidate = segments.clone();
+            candidate.push(name.clone());
+            let directory = stack.last().expect("the root stays on the stack");
+            let stat = match directory.stat(&name) {
+                Ok(stat) => stat,
+                Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
+                    if last && lookup.allow_missing {
+                        return Ok(Resolved {
+                            parent: directory.try_clone().map_err(io)?,
+                            name,
+                            segments: candidate,
+                            stat: None,
+                            created,
+                        });
+                    }
+                    if !last && lookup.create_parents {
+                        match directory.mkdir(&name, DEFAULT_DIRECTORY_MODE) {
+                            Ok(()) => created.push(candidate),
+                            Err(error) if error.kind() == std::io::ErrorKind::AlreadyExists => {}
+                            Err(error) => return Err(io(error)),
+                        }
+                        directory.sync().map_err(io)?;
+                        pending.push_front(name);
+                        continue;
+                    }
+                    return Err(io(error));
+                }
+                Err(error) => return Err(io(error)),
+            };
+            if self.is_state(&stat) {
+                return Err(daemon_state(subject));
+            }
+            if stat.kind == environment_protocol::data::fs::FileKind::Symlink
+                && (!last || lookup.follow_final)
+            {
+                if lookup.no_symlinks {
+                    return Err(ProtocolError::failed_precondition(
+                        PreconditionReason::SymlinkLoop,
+                        format!("{subject}: a symlink replaced a recorded entry"),
+                    ));
+                }
+                follows += 1;
+                if follows > MAX_SYMLINK_FOLLOWS {
+                    return Err(ProtocolError::failed_precondition(
+                        PreconditionReason::SymlinkLoop,
+                        format!("{subject}: too many levels of symbolic links"),
+                    ));
+                }
+                let target = directory.read_link(&name).map_err(io)?;
+                let target = Path::new(&target);
+                let components: Vec<OsString> = if target.is_absolute() {
+                    let Ok(rest) = target.strip_prefix(&self.root) else {
+                        return Err(outside_root(subject));
+                    };
+                    stack.truncate(1);
+                    segments.clear();
+                    raw_components(rest)
+                } else {
+                    raw_components(target)
+                };
+                for component in components.into_iter().rev() {
+                    pending.push_front(component);
+                }
+                continue;
+            }
+            if last {
+                return Ok(Resolved {
+                    parent: directory.try_clone().map_err(io)?,
+                    name,
+                    segments: candidate,
+                    stat: Some(stat),
+                    created,
+                });
+            }
+            if !stat.is_dir() {
+                return Err(ProtocolError::failed_precondition(
+                    PreconditionReason::NotDirectory,
+                    format!("{subject}: a path component is not a directory"),
+                ));
+            }
+            let child = directory.child(&name).map_err(io)?;
+            stack.push(child);
+            segments.push(name);
+        }
+        // The path ended on a directory already open: the root, or a
+        // directory reached through `..` or a link ending in one.
+        let current = stack.pop().expect("the root stays on the stack");
+        let stat = EntryStat::of_directory(&current).map_err(io)?;
+        if self.is_state(&stat) {
+            return Err(daemon_state(subject));
+        }
+        match (stack.pop(), segments.last()) {
+            (Some(parent), Some(name)) => Ok(Resolved {
+                parent,
+                name: name.clone(),
+                segments,
+                stat: Some(stat),
+                created,
+            }),
+            _ => Ok(Resolved {
+                parent: current,
+                name: OsString::from(SELF),
+                segments,
+                stat: Some(stat),
+                created,
+            }),
+        }
+    }
+}
+
+/// Components of a link target, keeping `.` and `..` for the walk to apply
+/// against the open directories.
+fn raw_components(path: &Path) -> Vec<OsString> {
+    path.as_os_str()
+        .as_bytes()
+        .split(|byte| *byte == b'/')
+        .filter(|segment| !segment.is_empty())
+        .map(|segment| OsStr::from_bytes(segment).to_owned())
+        .collect()
+}
+
+pub(crate) fn outside_root(subject: &dyn std::fmt::Display) -> ProtocolError {
+    ProtocolError::permission_denied(
+        Some(PermissionReason::OutsideRoot),
+        format!("{subject} is outside the filesystem root"),
+    )
+}
+
+pub(crate) fn daemon_state(subject: &dyn std::fmt::Display) -> ProtocolError {
+    ProtocolError::permission_denied(
+        Some(PermissionReason::DaemonState),
+        format!("{subject} addresses the daemon state directory"),
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use std::os::unix::fs::symlink;
+
+    use environment_protocol::error::{ErrorData, ProtocolErrorKind};
+
+    use super::*;
+
+    struct Fixture {
+        _temp: tempfile::TempDir,
+        outside: PathBuf,
+        root: PathBuf,
+        confinement: Confinement,
+    }
+
+    fn fixture() -> Fixture {
+        let temp = tempfile::tempdir().unwrap();
+        let base = temp.path().canonicalize().unwrap();
+        let root = base.join("root");
+        let outside = base.join("outside");
+        std::fs::create_dir_all(root.join("src/deep")).unwrap();
+        std::fs::create_dir_all(&outside).unwrap();
+        std::fs::write(root.join("src/lib.rs"), "lib").unwrap();
+        std::fs::write(outside.join("secret"), "secret").unwrap();
+        let confinement = Confinement::new(root.clone(), root.join(".state")).unwrap();
+        Fixture {
+            _temp: temp,
+            outside,
+            root,
+            confinement,
+        }
+    }
+
+    fn path(root: &Path, relative: &str) -> EnvironmentPath {
+        EnvironmentPath::new(format!("{}/{relative}", root.display())).unwrap()
+    }
+
+    fn permission_reason(error: &ProtocolError) -> Option<PermissionReason> {
+        match error.data {
+            ErrorData::PermissionDenied { reason } => reason,
+            _ => None,
+        }
+    }
+
+    #[test]
+    fn paths_outside_the_root_are_refused_before_any_lookup() {
+        let fixture = fixture();
+        let error = fixture
+            .confinement
+            .resolve(
+                &EnvironmentPath::new(fixture.outside.join("secret").to_str().unwrap()).unwrap(),
+            )
+            .unwrap_err();
+        assert_eq!(
+            permission_reason(&error),
+            Some(PermissionReason::OutsideRoot)
+        );
+    }
+
+    #[test]
+    fn in_root_links_are_followed_and_escaping_links_refused() {
+        let fixture = fixture();
+        symlink("src", fixture.root.join("inside")).unwrap();
+        // Relative to the link's directory: up to the root, then back down.
+        symlink("../../src/lib.rs", fixture.root.join("src/deep/up")).unwrap();
+        symlink(&fixture.outside, fixture.root.join("absolute-escape")).unwrap();
+        symlink("../outside/secret", fixture.root.join("relative-escape")).unwrap();
+        symlink(
+            fixture.root.join("src"),
+            fixture.root.join("absolute-inside"),
+        )
+        .unwrap();
+
+        assert_eq!(
+            fixture
+                .confinement
+                .resolve(&path(&fixture.root, "inside/lib.rs"))
+                .unwrap(),
+            fixture.root.join("src/lib.rs")
+        );
+        assert_eq!(
+            fixture
+                .confinement
+                .resolve(&path(&fixture.root, "src/deep/up"))
+                .unwrap(),
+            fixture.root.join("src/lib.rs")
+        );
+        assert_eq!(
+            fixture
+                .confinement
+                .resolve_directory(&path(&fixture.root, "absolute-inside"))
+                .unwrap(),
+            fixture.root.join("src")
+        );
+        for escape in [
+            "absolute-escape/secret",
+            "relative-escape",
+            "absolute-escape",
+        ] {
+            let error = fixture
+                .confinement
+                .resolve(&path(&fixture.root, escape))
+                .unwrap_err();
+            assert_eq!(
+                permission_reason(&error),
+                Some(PermissionReason::OutsideRoot),
+                "{escape}"
+            );
+        }
+    }
+
+    #[test]
+    fn the_state_directory_is_never_addressed() {
+        let fixture = fixture();
+        std::fs::write(fixture.root.join(".state/daemon-key"), "key").unwrap();
+        symlink(".state", fixture.root.join("state-link")).unwrap();
+        for subject in [".state", ".state/daemon-key", "state-link/daemon-key"] {
+            let error = fixture
+                .confinement
+                .resolve(&path(&fixture.root, subject))
+                .unwrap_err();
+            assert_eq!(
+                permission_reason(&error),
+                Some(PermissionReason::DaemonState),
+                "{subject}"
+            );
+        }
+        let root = fixture
+            .confinement
+            .lookup(fixture.confinement.root_path(), Lookup::NO_FOLLOW)
+            .unwrap();
+        assert!(root.is_root());
+        assert!(fixture.confinement.contains_state(&root.stat.unwrap()));
+        let src = fixture
+            .confinement
+            .lookup(&path(&fixture.root, "src"), Lookup::NO_FOLLOW)
+            .unwrap();
+        assert!(!fixture.confinement.contains_state(&src.stat.unwrap()));
+    }
+
+    #[test]
+    fn the_state_directory_is_recognized_by_identity_not_by_name() {
+        let temp = tempfile::tempdir().unwrap();
+        let root = temp.path().canonicalize().unwrap().join("root");
+        std::fs::create_dir_all(root.join("local/state")).unwrap();
+        let confinement = Confinement::new(root.clone(), root.join("local/state/envd")).unwrap();
+        std::fs::write(root.join("local/state/envd/daemon-key"), "key").unwrap();
+        // Another name for the same directories: no recorded spelling of
+        // the state directory matches it any more.
+        std::fs::rename(root.join("local"), root.join("moved")).unwrap();
+        // Where the filesystem folds case (APFS), other spellings reach the
+        // same entries; elsewhere they are missing.
+        for subject in [
+            "moved/state/envd/daemon-key",
+            "moved/state/envd",
+            "MOVED/STATE/ENVD/daemon-key",
+        ] {
+            match confinement.resolve(&path(&root, subject)) {
+                Err(error) if error.kind() == ProtocolErrorKind::NotFound => {
+                    assert!(subject.starts_with("MOVED"), "{subject}");
+                }
+                Err(error) => assert_eq!(
+                    permission_reason(&error),
+                    Some(PermissionReason::DaemonState),
+                    "{subject}"
+                ),
+                Ok(resolved) => panic!("{subject} resolved to {}", resolved.display()),
+            }
+        }
+        for ancestor in ["moved", "moved/state"] {
+            let resolved = confinement
+                .lookup(&path(&root, ancestor), Lookup::NO_FOLLOW)
+                .unwrap();
+            assert!(
+                confinement
+                    .refuse_containing_state(&resolved, &ancestor)
+                    .is_err(),
+                "{ancestor}"
+            );
+            assert_eq!(
+                confinement.holds_state(&resolved.stat.unwrap()),
+                ancestor == "moved/state"
+            );
+        }
+    }
+
+    #[test]
+    fn loops_and_missing_entries_are_typed() {
+        let fixture = fixture();
+        symlink("b", fixture.root.join("a")).unwrap();
+        symlink("a", fixture.root.join("b")).unwrap();
+        let error = fixture
+            .confinement
+            .resolve(&path(&fixture.root, "a"))
+            .unwrap_err();
+        assert!(matches!(
+            error.data,
+            ErrorData::FailedPrecondition {
+                reason: PreconditionReason::SymlinkLoop
+            }
+        ));
+        let error = fixture
+            .confinement
+            .resolve(&path(&fixture.root, "missing"))
+            .unwrap_err();
+        assert_eq!(error.kind(), ProtocolErrorKind::NotFound);
+        let error = fixture
+            .confinement
+            .resolve_directory(&path(&fixture.root, "src/lib.rs"))
+            .unwrap_err();
+        assert!(matches!(
+            error.data,
+            ErrorData::FailedPrecondition {
+                reason: PreconditionReason::NotDirectory
+            }
+        ));
+    }
+
+    #[test]
+    fn dangling_in_root_links_resolve_to_their_missing_target() {
+        let fixture = fixture();
+        symlink("src/new.rs", fixture.root.join("dangling")).unwrap();
+        let resolved = fixture
+            .confinement
+            .lookup(
+                &path(&fixture.root, "dangling"),
+                Lookup::FOLLOW.allowing_missing(),
+            )
+            .unwrap();
+        assert!(resolved.stat.is_none());
+        assert_eq!(
+            fixture.confinement.host_path(&resolved.segments),
+            fixture.root.join("src/new.rs")
+        );
+    }
+}
diff --git a/crates/environment-daemon/src/filesystem/os.rs b/crates/environment-daemon/src/filesystem/os.rs
new file mode 100644
index 000000000..f0bf7f017
--- /dev/null
+++ b/crates/environment-daemon/src/filesystem/os.rs
@@ -0,0 +1,487 @@
+//! Descriptor-relative filesystem primitives. Every operation names an entry
+//! by a directory descriptor and one name, never by a host path, so nothing
+//! here follows a symlink implicitly. Wire paths, inventories and receipts
+//! never contain descriptors or inode numbers; only [`FileVersion`] tokens
+//! are derived from them.
+
+use std::{
+    ffi::{OsStr, OsString},
+    fs::File,
+    io::{self, Read},
+    os::{
+        fd::OwnedFd,
+        unix::ffi::{OsStrExt, OsStringExt},
+    },
+    path::Path,
+};
+
+use environment_protocol::data::fs::{FileKind, FileVersion};
+use rustix::fs::{self as rfs, AtFlags, FileType, Mode, OFlags, RenameFlags};
+
+/// An open directory. Children are opened beneath it without following
+/// symlinks.
+#[derive(Debug)]
+pub(crate) struct Directory(OwnedFd);
+
+/// The entry a directory descriptor itself names.
+pub(crate) const SELF: &str = ".";
+
+impl Directory {
+    /// Open an administrator-configured directory by its host path. Only the
+    /// filesystem root and the transfer journal are opened this way; every
+    /// wire path is resolved beneath the root's descriptor.
+    pub fn open_host(path: &Path) -> io::Result<Self> {
+        Ok(Self(rfs::open(
+            path,
+            OFlags::RDONLY | OFlags::DIRECTORY | OFlags::CLOEXEC,
+            Mode::empty(),
+        )?))
+    }
+
+    pub fn try_clone(&self) -> io::Result<Self> {
+        Ok(Self(self.0.try_clone()?))
+    }
+
+    /// Open the child directory `name`; a symlink or non-directory fails
+    /// (`ELOOP` or `ENOTDIR`).
+    pub fn child(&self, name: &OsStr) -> io::Result<Self> {
+        Ok(Self(rfs::openat(
+            &self.0,
+            name,
+            OFlags::RDONLY | OFlags::DIRECTORY | OFlags::NOFOLLOW | OFlags::CLOEXEC,
+            Mode::empty(),
+        )?))
+    }
+
+    /// `lstat` of `name` (`.` for the directory itself).
+    pub fn stat(&self, name: &OsStr) -> io::Result<EntryStat> {
+        Ok(EntryStat::from_stat(&rfs::statat(
+            &self.0,
+            name,
+            AtFlags::SYMLINK_NOFOLLOW,
+        )?))
+    }
+
+    /// `lstat` plus the birth time where the filesystem records one.
+    pub fn stat_with_birth(&self, name: &OsStr) -> io::Result<EntryStat> {
+        let stat = rfs::statat(&self.0, name, AtFlags::SYMLINK_NOFOLLOW)?;
+        let mut entry = EntryStat::from_stat(&stat);
+        entry.birth_ms = birth_ms(&self.0, name, &stat);
+        Ok(entry)
+    }
+
+    pub fn read_link(&self, name: &OsStr) -> io::Result<OsString> {
+        let target = rfs::readlinkat(&self.0, name, Vec::new())?;
+        Ok(OsString::from_vec(target.into_bytes()))
+    }
+
+    /// Open `name` for reading without following a symlink and without
+    /// blocking on a FIFO or device; callers `fstat` before reading.
+    pub fn open_read(&self, name: &OsStr) -> io::Result<File> {
+        Ok(rfs::openat(
+            &self.0,
+            name,
+            OFlags::RDONLY | OFlags::NONBLOCK | OFlags::NOFOLLOW | OFlags::CLOEXEC,
+            Mode::empty(),
+        )?
+        .into())
+    }
+
+    /// Create `name` exclusively, never following a symlink.
+    pub fn create_file(&self, name: &OsStr, mode: u32) -> io::Result<File> {
+        Ok(rfs::openat(
+            &self.0,
+            name,
+            OFlags::RDWR | OFlags::CREATE | OFlags::EXCL | OFlags::NOFOLLOW | OFlags::CLOEXEC,
+            Mode::from_raw_mode(mode as _),
+        )?
+        .into())
+    }
+
+    pub fn mkdir(&self, name: &OsStr, mode: u32) -> io::Result<()> {
+        Ok(rfs::mkdirat(&self.0, name, Mode::from_raw_mode(mode as _))?)
+    }
+
+    pub fn unlink(&self, name: &OsStr) -> io::Result<()> {
+        Ok(rfs::unlinkat(&self.0, name, AtFlags::empty())?)
+    }
+
+    pub fn rmdir(&self, name: &OsStr) -> io::Result<()> {
+        Ok(rfs::unlinkat(&self.0, name, AtFlags::REMOVEDIR)?)
+    }
+
+    /// Rename `from` in `self` to `to` in `destination`.
+    pub fn rename(
+        &self,
+        from: &OsStr,
+        destination: &Directory,
+        to: &OsStr,
+        mode: RenameMode,
+    ) -> io::Result<()> {
+        match mode {
+            RenameMode::Replace => rfs::renameat(&self.0, from, &destination.0, to)?,
+            RenameMode::NoReplace => {
+                rfs::renameat_with(&self.0, from, &destination.0, to, RenameFlags::NOREPLACE)?
+            }
+            RenameMode::Exchange => {
+                rfs::renameat_with(&self.0, from, &destination.0, to, RenameFlags::EXCHANGE)?
+            }
+        }
+        Ok(())
+    }
+
+    /// Every name except `.` and `..`, unsorted. A separate open file
+    /// description is used, so enumerations never share an offset.
+    pub fn names(&self) -> io::Result<Vec<OsString>> {
+        let mut names = Vec::new();
+        for entry in self.entries()? {
+            names.push(entry?);
+        }
+        Ok(names)
+    }
+
+    fn entries(&self) -> io::Result<Entries> {
+        let fd = rfs::openat(
+            &self.0,
+            SELF,
+            OFlags::RDONLY | OFlags::DIRECTORY | OFlags::CLOEXEC,
+            Mode::empty(),
+        )?;
+        Ok(Entries(rfs::Dir::new(fd)?))
+    }
+
+    pub fn sync(&self) -> io::Result<()> {
+        Ok(rfs::fsync(&self.0)?)
+    }
+
+    /// Remove `name` and everything below it without following symlinks.
+    /// Streams each directory, so a large tree is never collected at once.
+    pub fn remove_tree(&self, name: &OsStr) -> io::Result<()> {
+        struct Frame {
+            name: OsString,
+            directory: Directory,
+            entries: Entries,
+        }
+        let directory = match self.child(name) {
+            Ok(directory) => directory,
+            Err(error) if is_not_directory(&error) => return self.unlink(name),
+            Err(error) => return Err(error),
+        };
+        let mut stack = vec![Frame {
+            name: name.to_owned(),
+            entries: directory.entries()?,
+            directory,
+        }];
+        while let Some(frame) = stack.last_mut() {
+            if let Some(child) = frame.entries.next() {
+                let child = child?;
+                match frame.directory.child(&child) {
+                    Ok(directory) => {
+                        if stack.len() >= MAX_REMOVE_DEPTH {
+                            return Err(io::Error::other("directory tree is too deep to remove"));
+                        }
+                        stack.push(Frame {
+                            name: child,
+                            entries: directory.entries()?,
+                            directory,
+                        });
+                    }
+                    Err(error) if is_not_directory(&error) => frame.directory.unlink(&child)?,
+                    Err(error) if error.kind() == io::ErrorKind::NotFound => {}
+                    Err(error) => return Err(error),
+                }
+            } else {
+                let frame = stack.pop().expect("frame exists");
+                let parent = stack.last().map_or(self, |frame| &frame.directory);
+                match parent.rmdir(&frame.name) {
+                    Err(error) if error.kind() == io::ErrorKind::NotFound => {}
+                    result => result?,
+                }
+            }
+        }
+        Ok(())
+    }
+}
+
+const MAX_REMOVE_DEPTH: usize = 4096;
+
+/// How [`Directory::rename`] treats an existing destination.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum RenameMode {
+    /// Replace a file (`rename(2)`).
+    Replace,
+    /// Fail with `EEXIST` when the destination exists.
+    NoReplace,
+    /// Swap source and destination atomically.
+    Exchange,
+}
+
+/// `ELOOP` (a symlink met with `O_NOFOLLOW`) or `ENOTDIR`.
+pub(crate) fn is_not_directory(error: &io::Error) -> bool {
+    matches!(
+        rustix::io::Errno::from_io_error(error),
+        Some(rustix::io::Errno::LOOP | rustix::io::Errno::NOTDIR)
+    )
+}
+
+struct Entries(rfs::Dir);
+
+impl Iterator for Entries {
+    type Item = io::Result<OsString>;
+
+    fn next(&mut self) -> Option<Self::Item> {
+        self.0.find_map(|entry| match entry {
+            Ok(entry) => {
+                let name = entry.file_name().to_bytes();
+                (name != b"." && name != b"..").then(|| Ok(OsString::from_vec(name.to_vec())))
+            }
+            Err(error) => Some(Err(error.into())),
+        })
+    }
+}
+
+/// What `lstat` or `fstat` reported about one entry.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) struct EntryStat {
+    pub kind: FileKind,
+    pub mode: u32,
+    pub size: u64,
+    pub dev: u64,
+    pub ino: u64,
+    pub modified: (i64, i64),
+    pub changed: (i64, i64),
+    pub birth_ms: Option<i64>,
+}
+
+impl EntryStat {
+    #[allow(clippy::unnecessary_cast)]
+    pub fn from_stat(stat: &rfs::Stat) -> Self {
+        let kind = match FileType::from_raw_mode(stat.st_mode as _) {
+            FileType::RegularFile => FileKind::File,
+            FileType::Directory => FileKind::Directory,
+            FileType::Symlink => FileKind::Symlink,
+            _ => FileKind::Other,
+        };
+        Self {
+            kind,
+            mode: stat.st_mode as u32 & 0o7777,
+            size: stat.st_size as u64,
+            dev: stat.st_dev as u64,
+            ino: stat.st_ino as u64,
+            modified: (stat.st_mtime as i64, stat.st_mtime_nsec as i64),
+            changed: (stat.st_ctime as i64, stat.st_ctime_nsec as i64),
+            birth_ms: None,
+        }
+    }
+
+    pub fn of_file(file: &File) -> io::Result<Self> {
+        Ok(Self::from_stat(&rfs::fstat(file)?))
+    }
+
+    pub fn of_directory(directory: &Directory) -> io::Result<Self> {
+        Ok(Self::from_stat(&rfs::fstat(&directory.0)?))
+    }
+
+    pub fn is_dir(&self) -> bool {
+        self.kind == FileKind::Directory
+    }
+
+    pub fn is_file(&self) -> bool {
+        self.kind == FileKind::File
+    }
+
+    pub fn executable(&self) -> bool {
+        self.mode & 0o111 != 0
+    }
+
+    pub fn modified_ms(&self) -> i64 {
+        to_ms(self.modified)
+    }
+
+    /// Device and inode.
+    pub fn identity(&self) -> (u64, u64) {
+        (self.dev, self.ino)
+    }
+
+    /// Same inode with the same size, modification and change times: the
+    /// content observed earlier is still the content.
+    pub fn unchanged(&self, other: &Self) -> bool {
+        self.dev == other.dev
+            && self.ino == other.ino
+            && self.size == other.size
+            && self.modified == other.modified
+            && self.changed == other.changed
+    }
+
+    /// The opaque `version` token: identity, size and both timestamps.
+    pub fn version(&self) -> FileVersion {
+        FileVersion::new(format!(
+            "v1-{:x}-{:x}-{:x}-{:x}.{:x}-{:x}.{:x}",
+            self.dev,
+            self.ino,
+            self.size,
+            self.modified.0 as u64,
+            self.modified.1 as u64,
+            self.changed.0 as u64,
+            self.changed.1 as u64,
+        ))
+        .expect("version tokens are short and printable")
+    }
+}
+
+fn to_ms((seconds, nanoseconds): (i64, i64)) -> i64 {
+    seconds
+        .saturating_mul(1000)
+        .saturating_add(nanoseconds / 1_000_000)
+}
+
+#[cfg(target_os = "linux")]
+fn birth_ms(directory: &OwnedFd, name: &OsStr, _: &rfs::Stat) -> Option<i64> {
+    let statx = rfs::statx(
+        directory,
+        name,
+        AtFlags::SYMLINK_NOFOLLOW,
+        rfs::StatxFlags::BTIME,
+    )
+    .ok()?;
+    statx
+        .stx_mask
+        .contains(rfs::StatxFlags::BTIME)
+        .then(|| to_ms((statx.stx_btime.tv_sec, statx.stx_btime.tv_nsec as i64)))
+}
+
+#[cfg(any(target_os = "macos", target_os = "ios", target_os = "freebsd"))]
+#[allow(clippy::unnecessary_cast)]
+fn birth_ms(_: &OwnedFd, _: &OsStr, stat: &rfs::Stat) -> Option<i64> {
+    // Filesystems without birth times report zero or a negative value.
+    (stat.st_birthtime > 0)
+        .then(|| to_ms((stat.st_birthtime as i64, stat.st_birthtime_nsec as i64)))
+}
+
+#[cfg(not(any(
+    target_os = "linux",
+    target_os = "macos",
+    target_os = "ios",
+    target_os = "freebsd"
+)))]
+fn birth_ms(_: &OwnedFd, _: &OsStr, _: &rfs::Stat) -> Option<i64> {
+    None
+}
+
+/// Read at most `max` bytes from the current position.
+pub(crate) fn read_up_to(file: &mut File, max: u64) -> io::Result<Vec<u8>> {
+    let mut data = Vec::with_capacity(max.min(1024 * 1024) as usize);
+    file.take(max).read_to_end(&mut data)?;
+    Ok(data)
+}
+
+/// A name as UTF-8, or `None` when it is not representable on the wire.
+pub(crate) fn utf8_name(name: &OsStr) -> Option<&str> {
+    std::str::from_utf8(name.as_bytes()).ok()
+}
+
+/// Set the permission bits of an open file.
+pub(crate) fn set_mode(file: &File, mode: u32) -> io::Result<()> {
+    Ok(rfs::fchmod(file, Mode::from_raw_mode(mode as _))?)
+}
+
+/// The mode with an execute bit added wherever a read bit is set.
+pub(crate) fn with_execute_bits(mode: u32) -> u32 {
+    mode | ((mode & 0o444) >> 2)
+}
+
+/// Mode of a file the daemon creates.
+pub(crate) const DEFAULT_FILE_MODE: u32 = 0o644;
+/// Mode of a directory the daemon creates.
+pub(crate) const DEFAULT_DIRECTORY_MODE: u32 = 0o755;
+/// Mode of the daemon's own staging directories.
+pub(crate) const PRIVATE_DIRECTORY_MODE: u32 = 0o700;
+/// Mode of a staged file before its final mode is set.
+pub(crate) const PRIVATE_FILE_MODE: u32 = 0o600;
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn removal_streams_nested_trees_without_following_symlinks() {
+        use std::os::unix::fs::symlink;
+
+        let root = tempfile::tempdir().unwrap();
+        let outside = tempfile::tempdir().unwrap();
+        std::fs::write(outside.path().join("keep"), "untouched").unwrap();
+        std::fs::create_dir_all(root.path().join("retired/nested")).unwrap();
+        std::fs::write(root.path().join("retired/nested/file"), "content").unwrap();
+        symlink(outside.path(), root.path().join("retired/link")).unwrap();
+        symlink("missing", root.path().join("retired/dangling")).unwrap();
+        let directory = Directory::open_host(root.path()).unwrap();
+        directory.remove_tree(OsStr::new("retired")).unwrap();
+        assert!(!root.path().join("retired").exists());
+        assert_eq!(
+            std::fs::read_to_string(outside.path().join("keep")).unwrap(),
+            "untouched"
+        );
+    }
+
+    #[test]
+    fn enumerations_have_independent_offsets() {
+        let root = tempfile::tempdir().unwrap();
+        for name in ["a", "b", "c"] {
+            std::fs::write(root.path().join(name), name).unwrap();
+        }
+        let directory = Directory::open_host(root.path()).unwrap();
+        let mut first = directory.entries().unwrap();
+        let mut seen = vec![first.next().unwrap().unwrap()];
+        let mut all = directory.names().unwrap();
+        all.sort();
+        assert_eq!(all, ["a", "b", "c"]);
+        seen.extend(first.map(Result::unwrap));
+        seen.sort();
+        assert_eq!(seen, ["a", "b", "c"]);
+    }
+
+    #[test]
+    fn rename_modes_refuse_replace_and_exchange() {
+        let root = tempfile::tempdir().unwrap();
+        let directory = Directory::open_host(root.path()).unwrap();
+        std::fs::write(root.path().join("a"), "a").unwrap();
+        std::fs::write(root.path().join("b"), "b").unwrap();
+        let error = directory
+            .rename(
+                OsStr::new("a"),
+                &directory,
+                OsStr::new("b"),
+                RenameMode::NoReplace,
+            )
+            .unwrap_err();
+        assert_eq!(error.kind(), io::ErrorKind::AlreadyExists);
+        directory
+            .rename(
+                OsStr::new("a"),
+                &directory,
+                OsStr::new("b"),
+                RenameMode::Exchange,
+            )
+            .unwrap();
+        assert_eq!(std::fs::read(root.path().join("a")).unwrap(), b"b");
+        assert_eq!(std::fs::read(root.path().join("b")).unwrap(), b"a");
+    }
+
+    #[test]
+    fn versions_change_with_content_identity() {
+        let root = tempfile::tempdir().unwrap();
+        let directory = Directory::open_host(root.path()).unwrap();
+        std::fs::write(root.path().join("file"), "one").unwrap();
+        let before = directory.stat(OsStr::new("file")).unwrap();
+        assert_eq!(
+            before.version(),
+            directory.stat(OsStr::new("file")).unwrap().version()
+        );
+        std::fs::write(root.path().join("staged"), "two!").unwrap();
+        std::fs::rename(root.path().join("staged"), root.path().join("file")).unwrap();
+        assert_ne!(
+            before.version(),
+            directory.stat(OsStr::new("file")).unwrap().version()
+        );
+    }
+}
diff --git a/crates/environment-daemon/src/filesystem/scan.rs b/crates/environment-daemon/src/filesystem/scan.rs
index 7d060f256..48eecb872 100644
--- a/crates/environment-daemon/src/filesystem/scan.rs
+++ b/crates/environment-daemon/src/filesystem/scan.rs
@@ -1,312 +1,546 @@
-//! Bounded endpoint-local observations through the shared scoped filesystem backend.
-use super::backend::{
-    self, Directory, Result, conflict, digest, error, invalid, io, relative, valid_path,
+//! `fs/scan`: a bounded observation of several roots, each reported on its
+//! own. A skipped entry never fails its root, and a failed root never hides
+//! the others.
+
+use std::{
+    sync::Arc,
+    time::{Duration, Instant},
 };
-use environment_protocol::shared::EnvironmentPath;
+
 use environment_protocol::{
-    data::inventory::*, error::EnvironmentProtocolErrorCode as Code, shared::ByteChunk,
+    bytes::ByteChunk,
+    data::{
+        fs::TreeContent,
+        handshake::ScanCeilings,
+        scan::{
+            ScanEntry, ScanFingerprint, ScanParams, ScanResponse, ScanRoot, ScanRootResult,
+            ScanSkip, ScanSkipReason,
+        },
+    },
+    error::{ErrorData, PreconditionReason, ProtocolError},
+    limits::{MAX_LISTED_SKIPS, MAX_RESULT_BYTES},
+    paths::{ContentDigest, TreePath},
 };
 use sha2::{Digest, Sha256};
-use std::{collections::BTreeSet, path::PathBuf};
-use std::{
-    io::Read,
-    path::Path,
-    time::{Duration, Instant},
+use tokio_util::sync::CancellationToken;
+
+use super::{
+    confinement::{Confinement, Lookup},
+    json_string_len,
+    os::{self, EntryStat},
+    search::check_quota,
+    walk::{CompiledFilter, Event, LinkMode, Skip, Walker},
 };
 
-pub fn scan(root: &Path, params: ScanParams) -> Result<ScanResponse> {
-    let ceiling = InventoryLimits::default();
-    let limits = params.limits;
-    if limits.max_entries == 0
-        || limits.max_entries > ceiling.max_entries
-        || limits.max_depth > ceiling.max_depth
-        || limits.max_file_bytes > ceiling.max_file_bytes
-        || limits.max_total_bytes > ceiling.max_total_bytes
-        || limits.max_manifest_bytes > ceiling.max_manifest_bytes
-        || limits.max_duration_ms == 0
-        || limits.max_duration_ms > ceiling.max_duration_ms
-        || params.roots.len() > 32
-        || params.include_patterns.len() > 32
-        || params
-            .include_patterns
-            .iter()
-            .any(|p| p.len() > MAX_INVENTORY_PATH_BYTES)
-    {
-        return Err(invalid("scan quotas exceed daemon ceilings"));
+/// Encoded overhead of one entry or skip besides its path and content.
+const ENTRY_OVERHEAD: u64 = 96;
+
+pub(crate) fn check_scan(
+    params: &ScanParams,
+    ceilings: &ScanCeilings,
+) -> Result<(), ProtocolError> {
+    let roots = params.roots.len() as u64;
+    if roots == 0 {
+        return Err(ProtocolError::invalid_field(
+            "roots",
+            "scan needs at least one root",
+        ));
     }
-    let patterns = params
-        .include_patterns
-        .iter()
-        .map(|p| glob::Pattern::new(p).map_err(|e| invalid(&e.to_string())))
-        .collect::<Result<Vec<_>>>()?;
-    // Filename-only patterns select direct children, so unrelated subtrees do
-    // not consume scan budgets or cause failures for a nonrecursive query.
-    let direct_only = !params.include_patterns.is_empty()
-        && params
-            .include_patterns
-            .iter()
-            .all(|pattern| !pattern.contains('/') && !pattern.contains("**"));
-    let canonical_root = root.canonicalize().map_err(io)?;
-    let anchor = Directory::anchor(&canonical_root).map_err(io)?;
-    let mut response = ScanResponse {
-        fingerprint: None,
-        unchanged: false,
-        complete: true,
-        entries: vec![],
-        diagnostics: vec![],
+    if roots > u64::from(ceilings.max_roots) {
+        return Err(ProtocolError::above_ceiling(
+            "roots",
+            roots,
+            ceilings.max_roots.into(),
+        ));
+    }
+    let patterns = (params.filter.include.len() + params.filter.exclude.len()) as u64;
+    if patterns > u64::from(ceilings.max_patterns) {
+        return Err(ProtocolError::above_ceiling(
+            "filter",
+            patterns,
+            ceilings.max_patterns.into(),
+        ));
+    }
+    let limits = &params.limits;
+    check_quota(
+        "limits.maxEntries",
+        limits.max_entries.into(),
+        ceilings.max_entries.into(),
+    )?;
+    if limits.max_file_bytes > ceilings.max_file_bytes {
+        return Err(ProtocolError::above_ceiling(
+            "limits.maxFileBytes",
+            limits.max_file_bytes,
+            ceilings.max_file_bytes,
+        ));
+    }
+    if limits.max_total_bytes > ceilings.max_total_bytes {
+        return Err(ProtocolError::above_ceiling(
+            "limits.maxTotalBytes",
+            limits.max_total_bytes,
+            ceilings.max_total_bytes,
+        ));
+    }
+    check_quota(
+        "limits.maxDurationMs",
+        limits.max_duration_ms,
+        ceilings.max_duration_ms,
+    )
+}
+
+/// Budgets shared by every root of one scan.
+struct Totals {
+    content_bytes: u64,
+    result_bytes: u64,
+}
+
+pub(crate) fn scan(
+    confinement: &Arc<Confinement>,
+    params: ScanParams,
+    cancel: &CancellationToken,
+) -> Result<ScanResponse, ProtocolError> {
+    let filter = CompiledFilter::compile(&params.filter, "filter")?;
+    let mut totals = Totals {
+        content_bytes: 0,
+        result_bytes: 0,
     };
-    let start = Instant::now();
-    let mut visited = 0u32;
-    let mut inspected = 0u64;
-    let mut response_bytes = 0u64;
-    let mut observations = Vec::new();
-    let mut observation_bytes = 0u64;
-    for selected in &params.roots {
-        let result = (|| -> Result<()> {
-            let selected_relative = relative(root, selected)?;
-            let selected_path = canonical_root.join(selected_relative);
-            // A missing configured root is a complete empty observation. A dangling
-            // link or a permission error is an incomplete observation.
-            match std::fs::symlink_metadata(&selected_path) {
-                Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
-                    let mut ancestor = selected_path.parent();
-                    while let Some(path) = ancestor {
-                        match std::fs::symlink_metadata(path) {
-                            Ok(_) => {
-                                let resolved = path.canonicalize().map_err(io)?;
-                                if !resolved.starts_with(&canonical_root) {
-                                    return Err(error(
-                                        Code::Forbidden,
-                                        "root outside access scope",
-                                    ));
-                                }
-                                break;
-                            }
-                            Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
-                                ancestor = path.parent()
-                            }
-                            Err(e) => return Err(io(e)),
-                        }
-                    }
-                    return Ok(());
-                }
-                Err(e) => return Err(io(e)),
-                Ok(_) => {}
+    let mut roots = Vec::with_capacity(params.roots.len());
+    for root in &params.roots {
+        let result = match scan_root(confinement, &params, root, &filter, &mut totals, cancel) {
+            Ok(result) => result,
+            Err(RootError::Cancelled) => return Err(ProtocolError::cancelled()),
+            Err(RootError::Failed(error)) => ScanRootResult::Failed {
+                path: root.path.clone(),
+                error,
+            },
+        };
+        roots.push(result);
+    }
+    Ok(ScanResponse { roots })
+}
+
+enum RootError {
+    Cancelled,
+    Failed(ProtocolError),
+}
+
+impl From<ProtocolError> for RootError {
+    fn from(error: ProtocolError) -> Self {
+        Self::Failed(error)
+    }
+}
+
+fn scan_root(
+    confinement: &Arc<Confinement>,
+    params: &ScanParams,
+    root: &ScanRoot,
+    filter: &CompiledFilter,
+    totals: &mut Totals,
+    cancel: &CancellationToken,
+) -> Result<ScanRootResult, RootError> {
+    let started = Instant::now();
+    let deadline = Duration::from_millis(params.limits.max_duration_ms);
+    let resolved = match confinement.lookup(&root.path, Lookup::FOLLOW) {
+        Ok(resolved) => resolved,
+        Err(error) if matches!(error.data, ErrorData::NotFound { .. }) => {
+            return Ok(ScanRootResult::Missing {
+                path: root.path.clone(),
+            });
+        }
+        Err(error) => return Err(error.into()),
+    };
+    if !resolved.stat.is_some_and(|stat| stat.is_dir()) {
+        return Err(ProtocolError::failed_precondition(
+            PreconditionReason::NotDirectory,
+            format!("{} is not a directory", root.path),
+        )
+        .into());
+    }
+    let canonical_path = confinement
+        .wire_path(&resolved.segments)
+        .filter(|canonical| canonical != &root.path);
+    let links = if params.follow_symlinks {
+        LinkMode::Follow
+    } else {
+        LinkMode::Report
+    };
+    let mut walker = Walker::new(
+        confinement.clone(),
+        &resolved,
+        filter.clone(),
+        links,
+        root.max_depth,
+        &root.path,
+    )?;
+    let limits = params.limits;
+    let read_files = params.read_content || params.include_digests;
+    let mut entries = Vec::new();
+    let mut skipped = Vec::new();
+    let mut skipped_entry_count = 0u32;
+    let mut content_bytes = 0u64;
+    let mut result_bytes = 0u64;
+    let mut fingerprint = Sha256::new();
+    fingerprint.update([
+        u8::from(params.read_content),
+        u8::from(params.include_digests),
+    ]);
+    let mut skip = |path: Option<TreePath>, reason: ScanSkipReason, result_bytes: &mut u64| {
+        skipped_entry_count = skipped_entry_count.saturating_add(1);
+        if (skipped.len() as u32) < MAX_LISTED_SKIPS {
+            *result_bytes += path
+                .as_ref()
+                .map_or(0, |path| json_string_len(path.as_str()))
+                + ENTRY_OVERHEAD;
+            skipped.push(ScanSkip { path, reason });
+        }
+    };
+    while let Some(event) = walker.next_event() {
+        if cancel.is_cancelled() {
+            return Err(RootError::Cancelled);
+        }
+        if started.elapsed() >= deadline {
+            return Err(ProtocolError::deadline_exceeded(format!(
+                "scanning {} took longer than {} ms",
+                root.path, limits.max_duration_ms
+            ))
+            .into());
+        }
+        let entry = match event {
+            Event::Yield
+            | Event::Skip {
+                selected: false, ..
+            } => continue,
+            Event::Skip { path, reason, .. } => {
+                let reason = match reason {
+                    Skip::NonUtf8Name => ScanSkipReason::NonUtf8Name,
+                    Skip::Unreadable(_) | Skip::DanglingLink => ScanSkipReason::Unreadable,
+                    Skip::LinkOutsideRoot(_) => ScanSkipReason::SymlinkOutsideRoot,
+                };
+                skip(path, reason, &mut result_bytes);
+                continue;
             }
-            let mut pending = vec![(selected_path, String::new(), BTreeSet::<PathBuf>::new())];
-            while let Some((requested, path, mut ancestors)) = pending.pop() {
-                visited += 1;
-                if visited > limits.max_entries {
-                    return Err(invalid("scan visited entry limit exceeded"));
-                }
-                if start.elapsed() > Duration::from_millis(limits.max_duration_ms.min(30_000)) {
-                    return Err(error(Code::Timeout, "scan deadline exceeded"));
-                }
-                if !valid_path(&path)
-                    || (!path.is_empty() && path.split('/').count() > limits.max_depth as usize)
-                {
-                    return Err(invalid("scan depth/path limit exceeded"));
-                }
-                let canonical = requested.canonicalize().map_err(io)?;
-                let scoped = canonical
-                    .strip_prefix(&canonical_root)
-                    .map_err(|_| error(Code::Forbidden, "symlink target outside access scope"))?;
-                if !params.follow_symlinks && requested != canonical {
-                    return Err(error(Code::Forbidden, "scan symlink following disabled"));
-                }
-                let scoped = scoped.to_str().ok_or_else(|| invalid("non-UTF-8 path"))?;
-                // The canonical spelling is still opened beneath an anchored directory
-                // without following symlinks, preventing a retarget race from escaping.
-                let mut file = if !params.read_content && params.digest_algorithm.is_none() {
-                    anchor.metadata(scoped)
-                } else {
-                    anchor.open(scoped)
+            Event::Entry(entry) => entry,
+        };
+        if !entry.selected {
+            continue;
+        }
+        let (content, data) = match entry.stat.kind {
+            environment_protocol::data::fs::FileKind::Directory => {
+                (TreeContent::Directory {}, None)
+            }
+            environment_protocol::data::fs::FileKind::Symlink => {
+                skip(Some(entry.path), ScanSkipReason::Symlink, &mut result_bytes);
+                continue;
+            }
+            environment_protocol::data::fs::FileKind::Other => {
+                skip(
+                    Some(entry.path),
+                    ScanSkipReason::SpecialFile,
+                    &mut result_bytes,
+                );
+                continue;
+            }
+            environment_protocol::data::fs::FileKind::File => {
+                if entry.stat.size > limits.max_file_bytes {
+                    skip(
+                        Some(entry.path),
+                        ScanSkipReason::FileTooLarge,
+                        &mut result_bytes,
+                    );
+                    continue;
                 }
-                .map_err(io)?;
-                let observed = backend::observe(&file).map_err(io)?;
-                let matches = patterns.is_empty() || patterns.iter().any(|p| p.matches(&path));
-                let mut data = None;
-                let content = if observed.is_dir() {
-                    if direct_only && !path.is_empty() {
-                        continue;
-                    }
-                    if !ancestors.insert(canonical.clone()) {
-                        return Err(error(Code::Conflict, "scan symlink loop"));
-                    }
-                    let names = Directory::names(&file, limits.max_entries as usize).map_err(io)?;
-                    if visited as usize + pending.len() + names.len() > limits.max_entries as usize
-                    {
-                        return Err(invalid("scan traversal limit exceeded"));
-                    }
-                    let pending_bytes: usize = pending
-                        .iter()
-                        .map(|(requested, path, ancestors)| {
-                            requested.as_os_str().len()
-                                + path.len()
-                                + ancestors.iter().map(|p| p.as_os_str().len()).sum::<usize>()
-                        })
-                        .sum();
-                    let added_bytes: usize = names
-                        .iter()
-                        .map(|name| {
-                            requested.as_os_str().len()
-                                + path.len()
-                                + name.len() * 2
-                                + ancestors.iter().map(|p| p.as_os_str().len()).sum::<usize>()
-                        })
-                        .sum();
-                    if (pending_bytes + added_bytes) as u64 > limits.max_manifest_bytes {
-                        return Err(invalid("scan traversal byte limit exceeded"));
-                    }
-                    for name in names.into_iter().rev() {
-                        if !valid_path(&name) {
-                            return Err(invalid("unsupported filename"));
-                        }
-                        let child = if path.is_empty() {
-                            name.clone()
-                        } else {
-                            format!("{path}/{name}")
-                        };
-                        pending.push((requested.join(name), child, ancestors.clone()));
-                    }
-                    ScanContent::Directory
+                if !read_files {
+                    (
+                        TreeContent::File {
+                            size_bytes: entry.stat.size,
+                            executable: entry.stat.executable(),
+                            digest: None,
+                        },
+                        None,
+                    )
                 } else {
-                    let digest =
-                        if matches && (params.read_content || params.digest_algorithm.is_some()) {
-                            if observed.size() > limits.max_file_bytes {
-                                return Err(invalid("scan per-file byte limit exceeded"));
-                            }
-                            inspected = inspected
-                                .checked_add(observed.size())
-                                .ok_or_else(|| invalid("byte overflow"))?;
-                            if inspected > limits.max_total_bytes {
-                                return Err(invalid("scan total byte limit exceeded"));
-                            }
-                            if params.read_content && observed.size() > MAX_CONTENT_CHUNK as u64 {
-                                return Err(invalid("scan response file limit exceeded"));
-                            }
-                            let mut hash = Sha256::new();
-                            let mut bytes = Vec::new();
-                            let mut read = 0u64;
-                            let mut buffer = [0u8; 65536];
-                            loop {
-                                let count = file.read(&mut buffer).map_err(io)?;
-                                if count == 0 {
-                                    break;
-                                }
-                                read += count as u64;
-                                if read > observed.size() {
-                                    return Err(conflict());
-                                }
-                                if start.elapsed()
-                                    > Duration::from_millis(limits.max_duration_ms.min(30_000))
-                                {
-                                    return Err(error(Code::Timeout, "scan deadline exceeded"));
+                    match read_file(
+                        &entry.parent,
+                        &entry.name,
+                        &entry.stat,
+                        limits.max_file_bytes,
+                    ) {
+                        Ok(Some(bytes)) => {
+                            let digest = ContentDigest::from_sha256(Sha256::digest(&bytes).into());
+                            fingerprint.update(digest.sha256());
+                            let data = if params.read_content {
+                                content_bytes += bytes.len() as u64;
+                                if totals.content_bytes + content_bytes > limits.max_total_bytes {
+                                    return Err(ProtocolError::payload_too_large(
+                                        limits.max_total_bytes,
+                                        format!(
+                                            "the content of {} exceeds the scan's remaining maxTotalBytes",
+                                            root.path
+                                        ),
+                                    )
+                                    .into());
                                 }
-                                hash.update(&buffer[..count]);
-                                if params.read_content {
-                                    bytes.extend_from_slice(&buffer[..count]);
-                                }
-                            }
-                            if read != observed.size()
-                                || !observed.matches(&backend::observe(&file).map_err(io)?)
-                            {
-                                return Err(conflict());
-                            }
-                            if params.read_content {
-                                data = Some(ByteChunk::from(bytes));
-                            }
-                            params.digest_algorithm.map(|_| digest(hash))
-                        } else {
-                            None
-                        };
-                    ScanContent::File {
-                        size_bytes: observed.size(),
-                        executable: observed.executable(),
-                        digest,
-                    }
-                };
-                observation_bytes +=
-                    (requested.as_os_str().len() + canonical.as_os_str().len() + 128) as u64;
-                if observation_bytes > limits.max_manifest_bytes {
-                    return Err(invalid("scan observation memory limit exceeded"));
-                }
-                observations.push((requested, canonical.clone(), observed));
-                if matches {
-                    let row = ScanEntry {
-                        root: selected.clone(),
-                        path,
-                        canonical_path: EnvironmentPath::new(canonical.to_string_lossy())
-                            .map_err(|e| invalid(&e.to_string()))?,
-                        content,
-                        data,
-                    };
-                    response_bytes += serde_json::to_vec(&row)
-                        .map_err(|e| invalid(&e.to_string()))?
-                        .len() as u64;
-                    if response_bytes > limits.max_manifest_bytes.min(4 * 1024 * 1024)
-                        || response.entries.len() >= 10_000
-                    {
-                        return Err(invalid("scan response byte limit exceeded"));
+                                Some(ByteChunk::from(bytes))
+                            } else {
+                                None
+                            };
+                            (
+                                TreeContent::File {
+                                    size_bytes: entry.stat.size,
+                                    executable: entry.stat.executable(),
+                                    digest: params.include_digests.then_some(digest),
+                                },
+                                data,
+                            )
+                        }
+                        Ok(None) => {
+                            skip(
+                                Some(entry.path),
+                                ScanSkipReason::FileTooLarge,
+                                &mut result_bytes,
+                            );
+                            continue;
+                        }
+                        Err(()) => {
+                            skip(
+                                Some(entry.path),
+                                ScanSkipReason::Unreadable,
+                                &mut result_bytes,
+                            );
+                            continue;
+                        }
                     }
-                    response.entries.push(row);
                 }
             }
-            Ok(())
-        })();
-        if let Err(error) = result {
-            response.complete = false;
-            response.diagnostics.push(ScanDiagnostic {
-                root: selected.clone(),
-                error,
-            });
+        };
+        if entries.len() as u32 >= limits.max_entries {
+            return Err(ProtocolError::too_many_entries(
+                limits.max_entries,
+                format!(
+                    "{} selects more than {} entries",
+                    root.path, limits.max_entries
+                ),
+            )
+            .into());
         }
-    }
-    // Validate identities and observations again, including nonmatching directories.
-    for (requested, canonical, observed) in observations {
-        let result = (|| -> Result<()> {
-            if start.elapsed() > Duration::from_millis(limits.max_duration_ms.min(30_000)) {
-                return Err(error(Code::Timeout, "scan deadline exceeded"));
-            }
-            if requested.canonicalize().map_err(io)? != canonical {
-                return Err(conflict());
-            }
-            let path = canonical
-                .strip_prefix(&canonical_root)
-                .unwrap()
-                .to_str()
-                .ok_or_else(|| invalid("non-UTF-8 path"))?;
-            if !observed
-                .matches(&backend::observe(&anchor.metadata(path).map_err(io)?).map_err(io)?)
-            {
-                return Err(conflict());
+        fingerprint.update(entry.path.as_str().as_bytes());
+        fingerprint.update([0]);
+        match &content {
+            TreeContent::Directory {} => fingerprint.update(b"d"),
+            TreeContent::File {
+                size_bytes,
+                executable,
+                ..
+            } => {
+                fingerprint.update([b'f', u8::from(*executable)]);
+                fingerprint.update(size_bytes.to_le_bytes());
             }
-            Ok(())
-        })();
-        if let Err(error) = result {
-            response.complete = false;
-            response.diagnostics.push(ScanDiagnostic {
-                root: EnvironmentPath::new(requested.to_string_lossy())
-                    .map_err(|e| invalid(&e.to_string()))?,
-                error,
+        }
+        result_bytes += json_string_len(entry.path.as_str())
+            + ENTRY_OVERHEAD
+            + data.as_ref().map_or(0, |data: &ByteChunk| {
+                (data.as_slice().len() as u64).div_ceil(3) * 4
             });
+        if totals.result_bytes + result_bytes > MAX_RESULT_BYTES {
+            return Err(ProtocolError::payload_too_large(
+                MAX_RESULT_BYTES,
+                format!(
+                    "the result of {} exceeds the scan's response budget",
+                    root.path
+                ),
+            )
+            .into());
         }
+        entries.push(ScanEntry {
+            path: entry.path,
+            content,
+            data,
+        });
     }
-    if response.complete {
-        response
-            .entries
-            .sort_by(|a, b| (a.root.as_str(), &a.path).cmp(&(b.root.as_str(), &b.path)));
-        let mut query = params.clone();
-        query.if_none_match = None;
-        let fingerprint = digest(Sha256::new_with_prefix(
-            serde_json::to_vec(&(&canonical_root, query, &response.entries))
-                .map_err(|e| invalid(&e.to_string()))?,
-        ));
-        response.unchanged = params.if_none_match.as_ref() == Some(&fingerprint);
-        response.fingerprint = Some(fingerprint);
-        if response.unchanged {
-            response.entries.clear();
+    let fingerprint = ScanFingerprint::new(format!(
+        "{}{}",
+        ScanFingerprint::PREFIX,
+        hex::encode(fingerprint.finalize())
+    ))
+    .expect("a hex digest is a valid fingerprint");
+    if root.if_none_match.as_ref() == Some(&fingerprint) {
+        return Ok(ScanRootResult::Unchanged {
+            path: root.path.clone(),
+            fingerprint,
+        });
+    }
+    totals.content_bytes += content_bytes;
+    totals.result_bytes += result_bytes;
+    Ok(ScanRootResult::Complete {
+        path: root.path.clone(),
+        canonical_path,
+        fingerprint,
+        entries,
+        skipped,
+        skipped_entry_count,
+    })
+}
+
+/// Read a selected file whole: `Ok(None)` when it grew past `max`, `Err`
+/// when it vanished, changed or could not be read.
+fn read_file(
+    parent: &os::Directory,
+    name: &std::ffi::OsStr,
+    observed: &EntryStat,
+    max: u64,
+) -> Result<Option<Vec<u8>>, ()> {
+    let mut file = parent.open_read(name).map_err(drop)?;
+    let opened = EntryStat::of_file(&file).map_err(drop)?;
+    if !opened.is_file() || !opened.unchanged(observed) {
+        return Err(());
+    }
+    let bytes = os::read_up_to(&mut file, max + 1).map_err(drop)?;
+    if bytes.len() as u64 > max {
+        return Ok(None);
+    }
+    Ok(Some(bytes))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use environment_protocol::{
+        data::{fs::TreeFilter, scan::ScanLimits},
+        error::ProtocolErrorKind,
+        paths::EnvironmentPath,
+    };
+
+    fn limits() -> ScanLimits {
+        ScanLimits {
+            max_entries: 100,
+            max_file_bytes: 1024,
+            max_total_bytes: 4096,
+            max_duration_ms: 10_000,
         }
     }
-    Ok(response)
+
+    fn root(path: &std::path::Path) -> ScanRoot {
+        ScanRoot {
+            path: EnvironmentPath::new(path.to_str().unwrap()).unwrap(),
+            if_none_match: None,
+            max_depth: None,
+        }
+    }
+
+    fn fixture() -> (tempfile::TempDir, std::path::PathBuf, Arc<Confinement>) {
+        let temp = tempfile::tempdir().unwrap();
+        let host = temp.path().canonicalize().unwrap();
+        let confinement = Arc::new(Confinement::new(host.clone(), host.join(".state")).unwrap());
+        (temp, host, confinement)
+    }
+
+    #[test]
+    fn one_bad_entry_is_skipped_and_one_bad_root_fails_alone() {
+        let (_temp, host, confinement) = fixture();
+        std::fs::create_dir_all(host.join("skills/a")).unwrap();
+        std::fs::create_dir_all(host.join("skills/b")).unwrap();
+        std::fs::write(host.join("skills/a/SKILL.md"), "a").unwrap();
+        std::fs::write(host.join("skills/b/SKILL.md"), vec![b'b'; 2048]).unwrap();
+        std::fs::write(host.join("file"), "not a directory").unwrap();
+        let params = ScanParams {
+            roots: vec![
+                root(&host.join("skills")),
+                root(&host.join("missing")),
+                root(&host.join("file")),
+                root(&host.join(".state")),
+            ],
+            filter: TreeFilter {
+                include: vec!["**/SKILL.md".into()],
+                ..TreeFilter::default()
+            },
+            read_content: true,
+            include_digests: false,
+            follow_symlinks: false,
+            limits: limits(),
+        };
+        let response = scan(&confinement, params, &CancellationToken::new()).unwrap();
+        let ScanRootResult::Complete {
+            entries,
+            skipped,
+            skipped_entry_count,
+            ..
+        } = &response.roots[0]
+        else {
+            panic!("{:?}", response.roots[0]);
+        };
+        assert_eq!(entries.len(), 1);
+        assert_eq!(entries[0].path.as_str(), "a/SKILL.md");
+        assert_eq!(entries[0].data.as_ref().unwrap().as_slice(), b"a");
+        assert_eq!(
+            skipped,
+            &[ScanSkip {
+                path: Some(TreePath::new("b/SKILL.md").unwrap()),
+                reason: ScanSkipReason::FileTooLarge,
+            }]
+        );
+        assert_eq!(*skipped_entry_count, 1);
+        assert!(matches!(response.roots[1], ScanRootResult::Missing { .. }));
+        let ScanRootResult::Failed { error, .. } = &response.roots[2] else {
+            panic!("{:?}", response.roots[2]);
+        };
+        assert!(matches!(
+            error.data,
+            ErrorData::FailedPrecondition {
+                reason: PreconditionReason::NotDirectory
+            }
+        ));
+        let ScanRootResult::Failed { error, .. } = &response.roots[3] else {
+            panic!("{:?}", response.roots[3]);
+        };
+        assert_eq!(error.kind(), ProtocolErrorKind::PermissionDenied);
+    }
+
+    #[test]
+    fn depth_zero_probes_a_directory_and_fingerprints_detect_changes() {
+        let (_temp, host, confinement) = fixture();
+        std::fs::create_dir_all(host.join("work")).unwrap();
+        std::fs::write(host.join("work/a"), "one").unwrap();
+        let probe = ScanRoot {
+            max_depth: Some(0),
+            ..root(&host.join("work"))
+        };
+        let params = |roots: Vec<ScanRoot>| ScanParams {
+            roots,
+            filter: TreeFilter::default(),
+            read_content: false,
+            include_digests: true,
+            follow_symlinks: false,
+            limits: limits(),
+        };
+        let response = scan(
+            &confinement,
+            params(vec![probe, root(&host.join("work"))]),
+            &CancellationToken::new(),
+        )
+        .unwrap();
+        let ScanRootResult::Complete { entries, .. } = &response.roots[0] else {
+            panic!("{:?}", response.roots[0]);
+        };
+        assert!(entries.is_empty());
+        let ScanRootResult::Complete { fingerprint, .. } = &response.roots[1] else {
+            panic!("{:?}", response.roots[1]);
+        };
+        let again = ScanRoot {
+            if_none_match: Some(fingerprint.clone()),
+            ..root(&host.join("work"))
+        };
+        let response = scan(
+            &confinement,
+            params(vec![again.clone()]),
+            &CancellationToken::new(),
+        )
+        .unwrap();
+        assert!(matches!(
+            response.roots[0],
+            ScanRootResult::Unchanged { .. }
+        ));
+        std::fs::write(host.join("work/a"), "two").unwrap();
+        let response = scan(&confinement, params(vec![again]), &CancellationToken::new()).unwrap();
+        assert!(matches!(response.roots[0], ScanRootResult::Complete { .. }));
+    }
 }
diff --git a/crates/environment-daemon/src/filesystem/search.rs b/crates/environment-daemon/src/filesystem/search.rs
new file mode 100644
index 000000000..49729fddc
--- /dev/null
+++ b/crates/environment-daemon/src/filesystem/search.rs
@@ -0,0 +1,546 @@
+//! `fs/searchText` and `fs/globFiles`: bounded walks run on a blocking
+//! thread that stop at their duration ceiling, on `$/cancelRequest` and
+//! when their connection closes.
+
+use std::{
+    io::{self, Read},
+    sync::Arc,
+    time::{Duration, Instant},
+};
+
+use environment_protocol::{
+    data::{
+        fs::{
+            FileKind, GlobFilesParams, GlobFilesResponse, GlobFilesStop, SearchTextMatch,
+            SearchTextParams, SearchTextResponse, SearchTextStop,
+        },
+        handshake::{GlobCeilings, SearchCeilings},
+    },
+    error::{PreconditionReason, ProtocolError},
+    limits::MAX_RESULT_BYTES,
+    paths::EnvironmentPath,
+};
+use grep_searcher::{BinaryDetection, Searcher, SearcherBuilder, Sink, SinkMatch};
+use tokio_util::sync::CancellationToken;
+
+use super::{
+    confinement::{Confinement, Lookup},
+    json_string_len,
+    os::EntryStat,
+    walk::{CompiledFilter, Event, LinkMode, Walker},
+};
+
+/// Encoded overhead of one search match besides its encoded path and line.
+const SEARCH_MATCH_OVERHEAD: u64 = 64;
+/// Encoded overhead of one glob match besides its encoded path.
+const GLOB_MATCH_OVERHEAD: u64 = 16;
+/// Longest line the searcher buffers; a file with a longer line is skipped.
+const MAX_SEARCH_LINE_BUFFER: usize = 16 * 1024 * 1024;
+
+pub(crate) fn check_search(
+    params: &SearchTextParams,
+    ceilings: &SearchCeilings,
+) -> Result<(), ProtocolError> {
+    if params.pattern.is_empty() {
+        return Err(ProtocolError::invalid_field(
+            "pattern",
+            "search pattern must not be empty",
+        ));
+    }
+    let limits = &params.limits;
+    check_quota(
+        "limits.maxMatches",
+        limits.max_matches.into(),
+        ceilings.max_matches.into(),
+    )?;
+    check_quota(
+        "limits.maxFiles",
+        limits.max_files.into(),
+        ceilings.max_files.into(),
+    )?;
+    check_quota("limits.maxBytes", limits.max_bytes, ceilings.max_bytes)?;
+    check_quota(
+        "limits.maxDurationMs",
+        limits.max_duration_ms,
+        ceilings.max_duration_ms,
+    )?;
+    check_quota(
+        "limits.maxLineBytes",
+        limits.max_line_bytes.into(),
+        ceilings.max_line_bytes.into(),
+    )
+}
+
+pub(crate) fn check_glob(
+    params: &GlobFilesParams,
+    ceilings: &GlobCeilings,
+) -> Result<(), ProtocolError> {
+    if params.filter.include.is_empty() {
+        return Err(ProtocolError::invalid_field(
+            "filter.include",
+            "globFiles needs at least one include pattern",
+        ));
+    }
+    let limits = &params.limits;
+    check_quota(
+        "limits.maxMatches",
+        limits.max_matches.into(),
+        ceilings.max_matches.into(),
+    )?;
+    check_quota(
+        "limits.maxFiles",
+        limits.max_files.into(),
+        ceilings.max_files.into(),
+    )?;
+    check_quota(
+        "limits.maxDurationMs",
+        limits.max_duration_ms,
+        ceilings.max_duration_ms,
+    )
+}
+
+/// A caller quota: at least 1 and at most its ceiling.
+pub(crate) fn check_quota(field: &str, value: u64, ceiling: u64) -> Result<(), ProtocolError> {
+    if value == 0 {
+        return Err(ProtocolError::invalid_field(
+            field,
+            format!("{field} must be at least 1"),
+        ));
+    }
+    if value > ceiling {
+        return Err(ProtocolError::above_ceiling(field, value, ceiling));
+    }
+    Ok(())
+}
+
+/// Resolve a walk root: an existing directory under the confinement rule.
+fn walker(
+    confinement: &Arc<Confinement>,
+    root: &EnvironmentPath,
+    filter: CompiledFilter,
+    links: LinkMode,
+) -> Result<Walker, ProtocolError> {
+    let resolved = confinement.lookup(root, Lookup::FOLLOW)?;
+    if !resolved.stat.is_some_and(|stat| stat.is_dir()) {
+        return Err(ProtocolError::failed_precondition(
+            PreconditionReason::NotDirectory,
+            format!("{root} is not a directory"),
+        ));
+    }
+    Walker::new(confinement.clone(), &resolved, filter, links, None, root)
+}
+
+pub(crate) fn search_text(
+    confinement: &Arc<Confinement>,
+    params: SearchTextParams,
+    cancel: &CancellationToken,
+) -> Result<SearchTextResponse, ProtocolError> {
+    let started = Instant::now();
+    let limits = params.limits;
+    let matcher = grep_regex::RegexMatcherBuilder::new()
+        .case_insensitive(params.pattern_ignore_case)
+        .build(&params.pattern)
+        .map_err(|error| {
+            ProtocolError::invalid_field("pattern", format!("invalid search regex: {error}"))
+        })?;
+    let filter = CompiledFilter::compile(&params.filter, "filter")?;
+    let mut walker = walker(confinement, &params.root, filter, LinkMode::Report)?;
+    let deadline = Duration::from_millis(limits.max_duration_ms);
+    let mut searcher = SearcherBuilder::new()
+        .line_number(true)
+        .binary_detection(BinaryDetection::quit(0))
+        .heap_limit(Some(MAX_SEARCH_LINE_BUFFER))
+        .build();
+    let mut response = SearchTextResponse {
+        matches: Vec::new(),
+        searched_file_count: 0,
+        searched_bytes: 0,
+        skipped_file_count: 0,
+        skipped_entry_count: 0,
+        elapsed_ms: 0,
+        stopped: None,
+    };
+    let mut result_bytes = 0u64;
+    while let Some(event) = walker.next_event() {
+        if cancel.is_cancelled() {
+            return Err(ProtocolError::cancelled());
+        }
+        if started.elapsed() >= deadline {
+            response.stopped = Some(SearchTextStop::TimeLimit);
+            break;
+        }
+        let entry = match event {
+            Event::Yield => continue,
+            Event::Skip { .. } => {
+                response.skipped_entry_count = response.skipped_entry_count.saturating_add(1);
+                continue;
+            }
+            Event::Entry(entry) => entry,
+        };
+        if entry.stat.kind != FileKind::File || !entry.selected {
+            continue;
+        }
+        let remaining = limits.max_bytes - response.searched_bytes;
+        if remaining == 0 {
+            response.stopped = Some(SearchTextStop::ByteLimit);
+            break;
+        }
+        if response.searched_file_count >= limits.max_files {
+            response.stopped = Some(SearchTextStop::FileLimit);
+            break;
+        }
+        if entry.stat.size > remaining {
+            response.skipped_file_count = response.skipped_file_count.saturating_add(1);
+            continue;
+        }
+        let Ok(file) = entry.parent.open_read(&entry.name) else {
+            response.skipped_file_count = response.skipped_file_count.saturating_add(1);
+            continue;
+        };
+        if !EntryStat::of_file(&file).is_ok_and(|stat| stat.is_file()) {
+            response.skipped_file_count = response.skipped_file_count.saturating_add(1);
+            continue;
+        }
+        let path = params
+            .root
+            .join(&entry.path)
+            .map_err(|error| ProtocolError::internal(error.to_string()))?;
+        let mut sink = MatchSink {
+            path,
+            matches: &mut response.matches,
+            max_matches: limits.max_matches,
+            max_line_bytes: limits.max_line_bytes as usize,
+            result_bytes: &mut result_bytes,
+            stopped: None,
+            binary: false,
+        };
+        let mut reader = Counting {
+            inner: file.take(remaining),
+            read: 0,
+            deadline: started + deadline,
+            cancel,
+            interrupted: None,
+        };
+        let outcome = searcher.search_reader(&matcher, &mut reader, &mut sink);
+        let (stopped, binary) = (sink.stopped, sink.binary);
+        response.searched_bytes += reader.read;
+        match reader.interrupted {
+            Some(Interrupted::Cancelled) => return Err(ProtocolError::cancelled()),
+            Some(Interrupted::Deadline) => {
+                response.stopped = Some(SearchTextStop::TimeLimit);
+                break;
+            }
+            None => {}
+        }
+        if outcome.is_err() || binary {
+            response.skipped_file_count = response.skipped_file_count.saturating_add(1);
+        } else {
+            response.searched_file_count += 1;
+        }
+        if stopped.is_some() {
+            response.stopped = stopped;
+            break;
+        }
+    }
+    response.elapsed_ms = started.elapsed().as_millis() as u64;
+    Ok(response)
+}
+
+/// Why a file's search stopped before its end.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum Interrupted {
+    Cancelled,
+    Deadline,
+}
+
+/// Counts the bytes read and ends the read once the walk's deadline passed
+/// or its request was cancelled, so one large file cannot outlast either.
+struct Counting<'a, R> {
+    inner: R,
+    read: u64,
+    deadline: Instant,
+    cancel: &'a CancellationToken,
+    interrupted: Option<Interrupted>,
+}
+
+impl<R: Read> Read for Counting<'_, R> {
+    fn read(&mut self, buffer: &mut [u8]) -> io::Result<usize> {
+        if self.cancel.is_cancelled() {
+            self.interrupted = Some(Interrupted::Cancelled);
+        } else if Instant::now() >= self.deadline {
+            self.interrupted = Some(Interrupted::Deadline);
+        }
+        if self.interrupted.is_some() {
+            // Not `Interrupted`: readers retry that kind.
+            return Err(io::Error::other("the search was stopped"));
+        }
+        let read = self.inner.read(buffer)?;
+        self.read += read as u64;
+        Ok(read)
+    }
+}
+
+struct MatchSink<'a> {
+    path: EnvironmentPath,
+    matches: &'a mut Vec<SearchTextMatch>,
+    max_matches: u32,
+    max_line_bytes: usize,
+    result_bytes: &'a mut u64,
+    stopped: Option<SearchTextStop>,
+    binary: bool,
+}
+
+impl Sink for MatchSink<'_> {
+    type Error = io::Error;
+
+    fn matched(&mut self, _: &Searcher, found: &SinkMatch<'_>) -> Result<bool, io::Error> {
+        if self.matches.len() as u64 >= u64::from(self.max_matches) {
+            self.stopped = Some(SearchTextStop::MatchLimit);
+            return Ok(false);
+        }
+        let line = String::from_utf8_lossy(found.bytes());
+        let line = line.trim_end_matches(['\r', '\n']);
+        let (line, line_truncated) = cut(line, self.max_line_bytes);
+        let size =
+            json_string_len(self.path.as_str()) + json_string_len(line) + SEARCH_MATCH_OVERHEAD;
+        if *self.result_bytes + size > MAX_RESULT_BYTES {
+            self.stopped = Some(SearchTextStop::ResponseLimit);
+            return Ok(false);
+        }
+        *self.result_bytes += size;
+        let line_number = found
+            .line_number()
+            .map_or(0, |number| u32::try_from(number).unwrap_or(u32::MAX));
+        self.matches.push(SearchTextMatch {
+            path: self.path.clone(),
+            line_number,
+            line: line.to_owned(),
+            line_truncated,
+        });
+        Ok(true)
+    }
+
+    fn binary_data(&mut self, _: &Searcher, _: u64) -> Result<bool, io::Error> {
+        self.binary = true;
+        Ok(false)
+    }
+}
+
+/// Cut `line` to at most `max` bytes on a character boundary.
+fn cut(line: &str, max: usize) -> (&str, bool) {
+    if line.len() <= max {
+        return (line, false);
+    }
+    let mut end = max;
+    while !line.is_char_boundary(end) {
+        end -= 1;
+    }
+    (&line[..end], true)
+}
+
+pub(crate) fn glob_files(
+    confinement: &Arc<Confinement>,
+    params: GlobFilesParams,
+    cancel: &CancellationToken,
+) -> Result<GlobFilesResponse, ProtocolError> {
+    let started = Instant::now();
+    let limits = params.limits;
+    let filter = CompiledFilter::compile(&params.filter, "filter")?;
+    let mut walker = walker(confinement, &params.root, filter, LinkMode::Report)?;
+    let deadline = Duration::from_millis(limits.max_duration_ms);
+    let mut response = GlobFilesResponse {
+        matches: Vec::new(),
+        visited_file_count: 0,
+        skipped_entry_count: 0,
+        elapsed_ms: 0,
+        stopped: None,
+    };
+    let mut result_bytes = 0u64;
+    while let Some(event) = walker.next_event() {
+        if cancel.is_cancelled() {
+            return Err(ProtocolError::cancelled());
+        }
+        if started.elapsed() >= deadline {
+            response.stopped = Some(GlobFilesStop::TimeLimit);
+            break;
+        }
+        let entry = match event {
+            Event::Yield => continue,
+            Event::Skip { .. } => {
+                response.skipped_entry_count = response.skipped_entry_count.saturating_add(1);
+                continue;
+            }
+            Event::Entry(entry) => entry,
+        };
+        if entry.stat.is_dir() {
+            continue;
+        }
+        if response.visited_file_count >= limits.max_files {
+            response.stopped = Some(GlobFilesStop::FileLimit);
+            break;
+        }
+        response.visited_file_count += 1;
+        if !entry.selected {
+            continue;
+        }
+        if response.matches.len() as u64 >= u64::from(limits.max_matches) {
+            response.stopped = Some(GlobFilesStop::MatchLimit);
+            break;
+        }
+        let path = params
+            .root
+            .join(&entry.path)
+            .map_err(|error| ProtocolError::internal(error.to_string()))?;
+        let size = json_string_len(path.as_str()) + GLOB_MATCH_OVERHEAD;
+        if result_bytes + size > MAX_RESULT_BYTES {
+            response.stopped = Some(GlobFilesStop::ResponseLimit);
+            break;
+        }
+        result_bytes += size;
+        response.matches.push(path);
+    }
+    response.elapsed_ms = started.elapsed().as_millis() as u64;
+    Ok(response)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use environment_protocol::data::fs::{GlobFilesLimits, SearchTextLimits, TreeFilter};
+
+    struct Fixture {
+        _temp: tempfile::TempDir,
+        root: EnvironmentPath,
+        host: std::path::PathBuf,
+        confinement: Arc<Confinement>,
+    }
+
+    fn fixture() -> Fixture {
+        let temp = tempfile::tempdir().unwrap();
+        let host = temp.path().canonicalize().unwrap();
+        std::fs::create_dir_all(host.join("src/deep")).unwrap();
+        std::fs::create_dir_all(host.join(".git/objects")).unwrap();
+        std::fs::write(
+            host.join("src/lib.rs"),
+            "pub fn target() {}\nfn other() {}\n",
+        )
+        .unwrap();
+        std::fs::write(host.join("src/deep/nested.rs"), "target nested\n").unwrap();
+        std::fs::write(host.join("readme.md"), "target readme\n").unwrap();
+        std::fs::write(host.join("binary.bin"), b"tar\x00get\n").unwrap();
+        // A pack file larger than any test budget; VCS metadata is pruned
+        // before the budget is charged.
+        std::fs::write(host.join(".git/objects/pack"), vec![b't'; 64 * 1024]).unwrap();
+        let confinement = Arc::new(Confinement::new(host.clone(), host.join(".state")).unwrap());
+        Fixture {
+            _temp: temp,
+            root: EnvironmentPath::new(host.to_str().unwrap()).unwrap(),
+            host,
+            confinement,
+        }
+    }
+
+    fn search(root: &EnvironmentPath) -> SearchTextParams {
+        SearchTextParams {
+            root: root.clone(),
+            pattern: "target".into(),
+            pattern_ignore_case: false,
+            filter: TreeFilter::default(),
+            limits: SearchTextLimits {
+                max_matches: 100,
+                max_files: 100,
+                max_bytes: 1024,
+                max_duration_ms: 10_000,
+                max_line_bytes: 4096,
+            },
+        }
+    }
+
+    #[test]
+    fn search_skips_vcs_metadata_and_oversized_files_without_stopping() {
+        let fixture = fixture();
+        std::fs::write(fixture.host.join("big.txt"), vec![b'x'; 2048]).unwrap();
+        let response = search_text(
+            &fixture.confinement,
+            search(&fixture.root),
+            &CancellationToken::new(),
+        )
+        .unwrap();
+        let paths: Vec<_> = response
+            .matches
+            .iter()
+            .map(|found| {
+                found
+                    .path
+                    .as_str()
+                    .trim_start_matches(fixture.root.as_str())
+            })
+            .collect();
+        assert_eq!(paths, ["/readme.md", "/src/deep/nested.rs", "/src/lib.rs"]);
+        assert_eq!(response.stopped, None);
+        // big.txt exceeds the remaining budget and binary.bin is binary:
+        // both are skipped and counted, and the walk continues.
+        assert_eq!(response.skipped_file_count, 2);
+        assert!(response.searched_bytes < 1024);
+    }
+
+    #[test]
+    fn search_stops_on_limits_and_cancellation() {
+        let fixture = fixture();
+        let mut params = search(&fixture.root);
+        params.limits.max_matches = 1;
+        let response =
+            search_text(&fixture.confinement, params, &CancellationToken::new()).unwrap();
+        assert_eq!(response.matches.len(), 1);
+        assert_eq!(response.stopped, Some(SearchTextStop::MatchLimit));
+
+        let mut params = search(&fixture.root);
+        params.limits.max_line_bytes = 3;
+        let response =
+            search_text(&fixture.confinement, params, &CancellationToken::new()).unwrap();
+        assert!(response.matches.iter().all(|found| found.line_truncated));
+
+        let cancel = CancellationToken::new();
+        cancel.cancel();
+        let error = search_text(&fixture.confinement, search(&fixture.root), &cancel).unwrap_err();
+        assert_eq!(error, ProtocolError::cancelled());
+    }
+
+    #[test]
+    fn glob_uses_the_tree_grammar_and_counts_only_files() {
+        let fixture = fixture();
+        let params = |patterns: &[&str]| GlobFilesParams {
+            root: fixture.root.clone(),
+            filter: TreeFilter {
+                include: patterns.iter().map(|p| (*p).to_owned()).collect(),
+                ..TreeFilter::default()
+            },
+            limits: GlobFilesLimits {
+                max_matches: 100,
+                max_files: 100,
+                max_duration_ms: 10_000,
+            },
+        };
+        let token = CancellationToken::new();
+        let response = glob_files(&fixture.confinement, params(&["src/*.rs"]), &token).unwrap();
+        assert_eq!(response.matches.len(), 1);
+        assert!(response.matches[0].as_str().ends_with("/src/lib.rs"));
+        let response = glob_files(&fixture.confinement, params(&["*.rs"]), &token).unwrap();
+        assert_eq!(response.matches.len(), 2);
+        // Directories are free; the four visible files are counted.
+        assert_eq!(response.visited_file_count, 4);
+        let error = check_glob(
+            &params(&[]),
+            &GlobCeilings {
+                max_matches: 10,
+                max_files: 10,
+                max_duration_ms: 10,
+            },
+        )
+        .unwrap_err();
+        assert!(matches!(
+            error.data,
+            environment_protocol::error::ErrorData::InvalidParams { .. }
+        ));
+    }
+}
diff --git a/crates/environment-daemon/src/filesystem/transfer/capture.rs b/crates/environment-daemon/src/filesystem/transfer/capture.rs
new file mode 100644
index 000000000..b7474a22d
--- /dev/null
+++ b/crates/environment-daemon/src/filesystem/transfer/capture.rs
@@ -0,0 +1,416 @@
+//! Capture: walk a source under the shared traversal, hash every selected
+//! file in bounded steps, and serve the sealed inventory's content by
+//! digest. A file that changes between hashing and reading fails the
+//! operation (`aborted`, `sourceChanged`).
+
+use std::{
+    collections::BTreeMap,
+    ffi::OsString,
+    fs::File,
+    io::{Read, Seek, SeekFrom},
+    sync::Arc,
+};
+
+use environment_protocol::{
+    data::{
+        fs::{FileKind, TreeContent, TreeFilter},
+        transfer::{
+            InventoryEntry, SpecialFilePolicy, SymlinkPolicy, TransferLimits, TransferSkip,
+            TransferSkipReason,
+        },
+    },
+    error::{AbortReason, PreconditionReason, ProtocolError},
+    limits::MAX_LISTED_SKIPS,
+    paths::{ContentDigest, EnvironmentPath, TreePath},
+};
+use sha2::{Digest, Sha256};
+
+use crate::filesystem::{
+    confinement::{Confinement, Lookup},
+    io_error,
+    os::{self, EntryStat},
+    walk::{CompiledFilter, Event, LinkMode, Skip, Walker},
+};
+
+use super::{STEP_BYTES, STEP_ENTRIES, check_entry_quota, entry_bytes};
+
+/// Where a captured digest's bytes live.
+#[derive(Clone, Debug)]
+pub(super) struct Source {
+    pub canonical: Vec<OsString>,
+    pub stat: EntryStat,
+}
+
+struct Hashing {
+    path: TreePath,
+    source: Source,
+    file: File,
+    hash: Sha256,
+    read: u64,
+}
+
+pub(super) struct Capture {
+    /// Canonical segments of the source; expanded links must stay inside.
+    selection: Vec<OsString>,
+    walker: Option<Walker>,
+    hashing: Option<Hashing>,
+    symlinks: SymlinkPolicy,
+    special_files: SpecialFilePolicy,
+    limits: TransferLimits,
+    pub entries: Vec<InventoryEntry>,
+    pub sources: BTreeMap<ContentDigest, Source>,
+    pub total_bytes: u64,
+    manifest_bytes: u64,
+    pub skipped: Vec<TransferSkip>,
+    pub skipped_count: u32,
+}
+
+impl Capture {
+    pub fn begin(
+        confinement: Arc<Confinement>,
+        source: &EnvironmentPath,
+        filter: &TreeFilter,
+        symlinks: SymlinkPolicy,
+        special_files: SpecialFilePolicy,
+        limits: TransferLimits,
+    ) -> Result<Self, ProtocolError> {
+        let compiled = CompiledFilter::compile(filter, "selection.filter")?;
+        let resolved = confinement.lookup(source, Lookup::FOLLOW)?;
+        confinement.refuse_containing_state(&resolved, source)?;
+        let stat = resolved.stat.expect("a followed lookup reports its target");
+        let mut capture = Self {
+            selection: resolved.segments.clone(),
+            walker: None,
+            hashing: None,
+            symlinks,
+            special_files,
+            limits,
+            entries: Vec::new(),
+            sources: BTreeMap::new(),
+            total_bytes: 0,
+            manifest_bytes: 0,
+            skipped: Vec::new(),
+            skipped_count: 0,
+        };
+        match stat.kind {
+            FileKind::Directory => {
+                capture.record(InventoryEntry {
+                    path: TreePath::root(),
+                    content: TreeContent::Directory {},
+                })?;
+                let links = if symlinks == SymlinkPolicy::ExpandInside {
+                    LinkMode::Follow
+                } else {
+                    LinkMode::Report
+                };
+                capture.walker = Some(Walker::new(
+                    confinement,
+                    &resolved,
+                    compiled,
+                    links,
+                    None,
+                    source,
+                )?);
+            }
+            FileKind::File => {
+                let file = resolved
+                    .parent
+                    .open_read(&resolved.name)
+                    .map_err(|error| io_error(error, source))?;
+                capture.start_hashing(
+                    TreePath::root(),
+                    Source {
+                        canonical: resolved.segments,
+                        stat,
+                    },
+                    file,
+                )?;
+            }
+            FileKind::Symlink | FileKind::Other => {
+                return Err(ProtocolError::failed_precondition(
+                    PreconditionReason::NotRegularFile,
+                    format!("{source} is not a regular file or directory"),
+                ));
+            }
+        }
+        Ok(capture)
+    }
+
+    /// One bounded step; `true` once the inventory is sealed.
+    pub fn advance(&mut self) -> Result<bool, ProtocolError> {
+        let mut allowance = STEP_BYTES;
+        for _ in 0..STEP_ENTRIES {
+            if self.hashing.is_some() {
+                if !self.hash_step(&mut allowance)? {
+                    return Ok(false);
+                }
+                continue;
+            }
+            let Some(walker) = self.walker.as_mut() else {
+                return Ok(true);
+            };
+            let Some(event) = walker.next_event() else {
+                self.walker = None;
+                return Ok(true);
+            };
+            self.visit(event)?;
+        }
+        Ok(self.walker.is_none() && self.hashing.is_none())
+    }
+
+    /// Selection comes first: an entry or skip the filter does not select
+    /// is left out silently, before any policy, depth or readability check
+    /// could fail the capture. Directories are always walked.
+    fn visit(&mut self, event: Event) -> Result<(), ProtocolError> {
+        let entry = match event {
+            Event::Yield
+            | Event::Skip {
+                selected: false, ..
+            } => return Ok(()),
+            Event::Skip {
+                path,
+                reason: Skip::NonUtf8Name,
+                ..
+            } => {
+                self.skip(path, TransferSkipReason::NonUtf8Name);
+                return Ok(());
+            }
+            Event::Skip {
+                path,
+                reason: Skip::DanglingLink,
+                ..
+            } => {
+                self.skip(path, TransferSkipReason::Symlink);
+                return Ok(());
+            }
+            Event::Skip {
+                reason: Skip::Unreadable(error),
+                ..
+            } => return Err(error),
+            Event::Skip {
+                path,
+                reason: Skip::LinkOutsideRoot(error),
+                ..
+            } => {
+                return Err(symlink_rejected(
+                    path.as_ref().map_or(".", TreePath::as_str),
+                    &error.message,
+                ));
+            }
+            Event::Entry(entry) => entry,
+        };
+        if !entry.selected && !entry.stat.is_dir() {
+            return Ok(());
+        }
+        if entry.via_link && !entry.canonical.starts_with(&self.selection) {
+            return Err(symlink_rejected(
+                entry.path.as_str(),
+                "the link leaves the captured selection",
+            ));
+        }
+        if entry.depth > self.limits.max_depth {
+            return Err(ProtocolError::invalid_field(
+                "limits.maxDepth",
+                format!("{} is deeper than limits.maxDepth", entry.path),
+            ));
+        }
+        match entry.stat.kind {
+            FileKind::Directory => self.record(InventoryEntry {
+                path: entry.path,
+                content: TreeContent::Directory {},
+            }),
+            FileKind::Symlink => match self.symlinks {
+                SymlinkPolicy::Skip => {
+                    self.skip(Some(entry.path), TransferSkipReason::Symlink);
+                    Ok(())
+                }
+                SymlinkPolicy::Reject | SymlinkPolicy::ExpandInside => Err(symlink_rejected(
+                    entry.path.as_str(),
+                    "the capture refuses symlinks",
+                )),
+            },
+            FileKind::Other => match self.special_files {
+                SpecialFilePolicy::Skip => {
+                    self.skip(Some(entry.path), TransferSkipReason::SpecialFile);
+                    Ok(())
+                }
+                SpecialFilePolicy::Reject => Err(ProtocolError::failed_precondition(
+                    PreconditionReason::NotRegularFile,
+                    format!("{} is a special file", entry.path),
+                )),
+            },
+            FileKind::File => {
+                let file = entry
+                    .parent
+                    .open_read(&entry.name)
+                    .map_err(|error| io_error(error, &entry.path))?;
+                self.start_hashing(
+                    entry.path,
+                    Source {
+                        canonical: entry.canonical,
+                        stat: entry.stat,
+                    },
+                    file,
+                )
+            }
+        }
+    }
+
+    fn start_hashing(
+        &mut self,
+        path: TreePath,
+        source: Source,
+        file: File,
+    ) -> Result<(), ProtocolError> {
+        let opened = EntryStat::of_file(&file).map_err(|error| io_error(error, &path))?;
+        if !opened.is_file() || !opened.unchanged(&source.stat) {
+            return Err(source_changed(&path));
+        }
+        if source.stat.size > self.limits.max_file_bytes {
+            return Err(ProtocolError::payload_too_large(
+                self.limits.max_file_bytes,
+                format!("{path} is larger than limits.maxFileBytes"),
+            ));
+        }
+        self.total_bytes = self.total_bytes.saturating_add(source.stat.size);
+        if self.total_bytes > self.limits.max_total_bytes {
+            return Err(ProtocolError::payload_too_large(
+                self.limits.max_total_bytes,
+                "the capture exceeds limits.maxTotalBytes",
+            ));
+        }
+        self.hashing = Some(Hashing {
+            path,
+            source,
+            file,
+            hash: Sha256::new(),
+            read: 0,
+        });
+        Ok(())
+    }
+
+    /// Hash within `allowance`; `true` when the file is done.
+    fn hash_step(&mut self, allowance: &mut u64) -> Result<bool, ProtocolError> {
+        let task = self.hashing.as_mut().expect("caller checked");
+        let mut buffer = vec![0u8; 64 * 1024];
+        loop {
+            if *allowance == 0 {
+                return Ok(false);
+            }
+            let limit = (buffer.len() as u64).min(*allowance) as usize;
+            let read = task
+                .file
+                .read(&mut buffer[..limit])
+                .map_err(|error| io_error(error, &task.path))?;
+            if read == 0 {
+                break;
+            }
+            task.read += read as u64;
+            if task.read > task.source.stat.size {
+                return Err(source_changed(&task.path));
+            }
+            task.hash.update(&buffer[..read]);
+            *allowance -= read as u64;
+        }
+        let task = self.hashing.take().expect("hashing above");
+        let now = EntryStat::of_file(&task.file).map_err(|error| io_error(error, &task.path))?;
+        if task.read != task.source.stat.size || !now.unchanged(&task.source.stat) {
+            return Err(source_changed(&task.path));
+        }
+        let digest = ContentDigest::from_sha256(task.hash.finalize().into());
+        let executable = task.source.stat.executable();
+        let size_bytes = task.source.stat.size;
+        self.sources.entry(digest).or_insert(task.source);
+        self.record(InventoryEntry {
+            path: task.path,
+            content: TreeContent::File {
+                size_bytes,
+                executable,
+                digest: Some(digest),
+            },
+        })?;
+        Ok(true)
+    }
+
+    fn record(&mut self, entry: InventoryEntry) -> Result<(), ProtocolError> {
+        check_entry_quota(self.entries.len() + 1, &self.limits)?;
+        self.manifest_bytes += entry_bytes(&entry);
+        if self.manifest_bytes > self.limits.max_manifest_bytes {
+            return Err(ProtocolError::payload_too_large(
+                self.limits.max_manifest_bytes,
+                "the inventory exceeds limits.maxManifestBytes",
+            ));
+        }
+        self.entries.push(entry);
+        Ok(())
+    }
+
+    fn skip(&mut self, path: Option<TreePath>, reason: TransferSkipReason) {
+        self.skipped_count = self.skipped_count.saturating_add(1);
+        if (self.skipped.len() as u32) < MAX_LISTED_SKIPS {
+            self.skipped.push(TransferSkip { path, reason });
+        }
+    }
+}
+
+/// Why reading captured content failed.
+pub(super) enum ReadFailure {
+    /// The bytes are not the bytes that were hashed.
+    Changed(ProtocolError),
+    Io(ProtocolError),
+}
+
+/// Read `max` bytes of a captured source from `offset`: `(data, truncated)`.
+pub(super) fn read_content(
+    confinement: &Confinement,
+    source: &Source,
+    offset: u64,
+    max: u64,
+) -> Result<(Vec<u8>, bool), ReadFailure> {
+    let subject = format!("captured {}", source_label(source));
+    let resolved = confinement
+        .reopen(&source.canonical, &subject)
+        .map_err(|_| ReadFailure::Changed(source_changed(&subject)))?;
+    let mut file = resolved
+        .parent
+        .open_read(&resolved.name)
+        .map_err(|error| ReadFailure::Io(io_error(error, &subject)))?;
+    let unchanged = |file: &File| {
+        EntryStat::of_file(file).is_ok_and(|stat| stat.is_file() && stat.unchanged(&source.stat))
+    };
+    if !unchanged(&file) {
+        return Err(ReadFailure::Changed(source_changed(&subject)));
+    }
+    file.seek(SeekFrom::Start(offset))
+        .map_err(|error| ReadFailure::Io(io_error(error, &subject)))?;
+    let take = max.min(source.stat.size - offset);
+    let data = os::read_up_to(&mut file, take)
+        .map_err(|error| ReadFailure::Io(io_error(error, &subject)))?;
+    if data.len() as u64 != take || !unchanged(&file) {
+        return Err(ReadFailure::Changed(source_changed(&subject)));
+    }
+    let truncated = offset + take < source.stat.size;
+    Ok((data, truncated))
+}
+
+fn source_label(source: &Source) -> String {
+    source
+        .canonical
+        .last()
+        .map(|name| name.to_string_lossy().into_owned())
+        .unwrap_or_else(|| ".".into())
+}
+
+pub(super) fn source_changed(subject: &dyn std::fmt::Display) -> ProtocolError {
+    ProtocolError::aborted(
+        Some(AbortReason::SourceChanged),
+        format!("{subject} changed during the transfer"),
+    )
+}
+
+fn symlink_rejected(path: &str, why: &str) -> ProtocolError {
+    ProtocolError::failed_precondition(
+        PreconditionReason::SymlinkRejected,
+        format!("{path}: {why}"),
+    )
+}
diff --git a/crates/environment-daemon/src/filesystem/transfer/journal.rs b/crates/environment-daemon/src/filesystem/transfer/journal.rs
index 20d958f83..5dcb66c89 100644
--- a/crates/environment-daemon/src/filesystem/transfer/journal.rs
+++ b/crates/environment-daemon/src/filesystem/transfer/journal.rs
@@ -1,39 +1,247 @@
-//! Durable publication receipts. Interrupted in-flight operations fail closed after
-//! restart; they are never silently re-executed against a possibly edited target.
-use super::*;
+//! Durable transfer records under `<state>/transfers`.
+//!
+//! An operation is recorded at begin, before its staging directory exists,
+//! so a restart can discard its staging directory and spool; when its commit
+//! starts; and when it finishes, as its receipt. A receipt keeps the staging
+//! and spool records until a sweep confirmed their removal. A completed
+//! capture also keeps its sealed inventory beside its receipt, one entry
+//! per line, so a retried capture can page it again. The
+//! record is this daemon's own file: it is never read by another version,
+//! and an undecodable record is renamed aside instead of failing startup.
+
+use std::{
+    ffi::OsString,
+    fs::File,
+    io::{BufRead, BufReader, BufWriter, Read, Write},
+    os::unix::ffi::{OsStrExt, OsStringExt},
+    path::{Path, PathBuf},
+};
+
+use environment_protocol::{
+    data::transfer::{BeginTransferParams, InventoryEntry, TransferStatus},
+    error::ProtocolError,
+    ids::TransferOperationId,
+};
 use serde::{Deserialize, Serialize};
-use std::path::PathBuf;
-#[derive(Serialize, Deserialize)]
-pub struct Record {
-    pub root: PathBuf,
-    pub request: TransferRequest,
+
+use crate::filesystem::io_error;
+
+/// Largest record read back; records hold no inventories.
+const MAX_RECORD_BYTES: u64 = 1024 * 1024;
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub(super) struct Record {
+    pub params: BeginTransferParams,
     pub status: TransferStatus,
-    pub expires_at_ms: u64,
-    pub stage_name: Option<String>,
-    #[serde(default)]
-    pub spool_directory: Option<PathBuf>,
+    /// The staging directory of an active publish.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub stage: Option<StageRecord>,
+    /// The upload spool of an active publish.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub spool: Option<PathBuf>,
+    /// A publish's commit started: after a restart, whether it published
+    /// is unknown.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub committing: bool,
 }
-pub fn now_ms() -> u64 {
+
+/// Where a staging directory lives: the canonical segments of its parent
+/// below the filesystem root (raw bytes, names need not be UTF-8) and its
+/// name.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub(super) struct StageRecord {
+    pub parent: Vec<Vec<u8>>,
+    pub name: String,
+}
+
+impl StageRecord {
+    pub fn new(parent: &[OsString], name: &str) -> Self {
+        Self {
+            parent: parent
+                .iter()
+                .map(|segment| segment.as_bytes().to_vec())
+                .collect(),
+            name: name.to_owned(),
+        }
+    }
+
+    pub fn parent_segments(&self) -> Vec<OsString> {
+        self.parent
+            .iter()
+            .map(|segment| OsString::from_vec(segment.clone()))
+            .collect()
+    }
+}
+
+pub(super) fn now_ms() -> i64 {
     std::time::SystemTime::now()
         .duration_since(std::time::UNIX_EPOCH)
+        .map(|elapsed| elapsed.as_millis().min(i64::MAX as u128) as i64)
         .unwrap_or_default()
-        .as_millis() as u64
 }
-pub fn write(directory: &Path, id: &str, record: &Record) -> Result<()> {
+
+fn record_path(directory: &Path, id: &TransferOperationId) -> PathBuf {
+    directory.join(format!("{}.json", id.as_str()))
+}
+
+const INVENTORY_EXTENSION: &str = "inventory";
+
+fn inventory_path(directory: &Path, id: &TransferOperationId) -> PathBuf {
+    directory.join(format!("{}.{INVENTORY_EXTENSION}", id.as_str()))
+}
+
+/// Write a completed capture's inventory atomically and durably, before
+/// its receipt.
+pub(super) fn write_inventory(
+    directory: &Path,
+    id: &TransferOperationId,
+    entries: &[InventoryEntry],
+) -> Result<(), ProtocolError> {
+    let io = |error| io_error(error, format!("transfer journal {}", directory.display()));
+    let temporary = tempfile::NamedTempFile::new_in(directory).map_err(io)?;
+    let mut writer = BufWriter::new(temporary);
+    for entry in entries {
+        serde_json::to_writer(&mut writer, entry).map_err(|error| {
+            ProtocolError::internal(format!("encode transfer inventory: {error}"))
+        })?;
+        writer.write_all(b"\n").map_err(io)?;
+    }
+    let temporary = writer
+        .into_inner()
+        .map_err(|error| io(error.into_error()))?;
+    temporary.as_file().sync_all().map_err(io)?;
+    temporary
+        .persist(inventory_path(directory, id))
+        .map_err(|error| io(error.error))?;
+    File::open(directory)
+        .and_then(|file| file.sync_all())
+        .map_err(io)
+}
+
+/// Up to `limit` entries of a retained inventory from `index`, and whether
+/// more follow; `Ok(None)` when none is retained.
+pub(super) fn read_inventory(
+    directory: &Path,
+    id: &TransferOperationId,
+    index: usize,
+    limit: usize,
+) -> Result<Option<(Vec<InventoryEntry>, bool)>, ProtocolError> {
+    let path = inventory_path(directory, id);
+    let file = match File::open(&path) {
+        Ok(file) => file,
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(None),
+        Err(error) => return Err(io_error(error, path.display())),
+    };
+    let mut lines = BufReader::new(file).lines().skip(index);
+    let mut entries = Vec::new();
+    for line in lines.by_ref().take(limit) {
+        let line = line.map_err(|error| io_error(error, path.display()))?;
+        entries.push(serde_json::from_str(&line).map_err(|error| {
+            ProtocolError::internal(format!("decode transfer inventory: {error}"))
+        })?);
+    }
+    Ok(Some((entries, lines.next().is_some())))
+}
+
+/// Write a record atomically and durably.
+pub(super) fn write(
+    directory: &Path,
+    id: &TransferOperationId,
+    record: &Record,
+) -> Result<(), ProtocolError> {
+    let io = |error| io_error(error, format!("transfer journal {}", directory.display()));
     let mut temporary = tempfile::NamedTempFile::new_in(directory).map_err(io)?;
-    serde_json::to_writer(&mut temporary, record).map_err(|e| invalid(&e.to_string()))?;
+    serde_json::to_writer(&mut temporary, record)
+        .map_err(|error| ProtocolError::internal(format!("encode transfer record: {error}")))?;
     temporary.as_file().sync_all().map_err(io)?;
     temporary
-        .persist(directory.join(format!("{id}.json")))
-        .map_err(|e| io(e.error))?;
-    backend::sync_directory(directory).map_err(io)
-}
-pub fn read(directory: &Path, id: &str) -> Result<Option<Record>> {
-    match File::open(directory.join(format!("{id}.json"))) {
-        Ok(file) => Ok(Some(
-            serde_json::from_reader(file.take(64 * 1024)).map_err(|e| invalid(&e.to_string()))?,
-        )),
-        Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(None),
-        Err(e) => Err(io(e)),
+        .persist(record_path(directory, id))
+        .map_err(|error| io(error.error))?;
+    File::open(directory)
+        .and_then(|file| file.sync_all())
+        .map_err(io)
+}
+
+/// Read a record; `Ok(None)` when there is none or it was quarantined.
+pub(super) fn read(
+    directory: &Path,
+    id: &TransferOperationId,
+) -> Result<Option<Record>, ProtocolError> {
+    read_path(&record_path(directory, id))
+}
+
+fn read_path(path: &Path) -> Result<Option<Record>, ProtocolError> {
+    let file = match File::open(path) {
+        Ok(file) => file,
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(None),
+        Err(error) => return Err(io_error(error, path.display())),
+    };
+    match serde_json::from_reader(file.take(MAX_RECORD_BYTES)) {
+        Ok(record) => Ok(Some(record)),
+        Err(error) => {
+            quarantine(path, &error.to_string());
+            Ok(None)
+        }
+    }
+}
+
+/// Remove a record and any inventory retained with it.
+pub(super) fn remove(directory: &Path, id: &TransferOperationId) {
+    let _ = std::fs::remove_file(record_path(directory, id));
+    let _ = std::fs::remove_file(inventory_path(directory, id));
+}
+
+/// Retained inventories whose record is gone (a crash between writing the
+/// inventory and its receipt, or between removing the two).
+pub(super) fn remove_orphan_inventories(directory: &Path) {
+    let Ok(entries) = std::fs::read_dir(directory) else {
+        return;
+    };
+    for entry in entries.flatten() {
+        let path = entry.path();
+        if path
+            .extension()
+            .is_some_and(|extension| extension == INVENTORY_EXTENSION)
+            && !path.with_extension("json").exists()
+        {
+            let _ = std::fs::remove_file(path);
+        }
+    }
+}
+
+fn quarantine(path: &Path, reason: &str) {
+    let aside = path.with_extension("quarantined");
+    eprintln!(
+        "lightspeed-envd: unreadable transfer record {} moved to {}: {reason}",
+        path.display(),
+        aside.display()
+    );
+    let _ = std::fs::rename(path, aside);
+}
+
+/// Every readable record with its id, in no particular order.
+pub(super) fn all(directory: &Path) -> Vec<(TransferOperationId, Record)> {
+    let Ok(entries) = std::fs::read_dir(directory) else {
+        return Vec::new();
+    };
+    let mut records = Vec::new();
+    for entry in entries.flatten() {
+        let path = entry.path();
+        if path.extension().is_none_or(|extension| extension != "json") {
+            continue;
+        }
+        let Some(id) = path
+            .file_stem()
+            .and_then(|stem| stem.to_str())
+            .and_then(|stem| TransferOperationId::new(stem).ok())
+        else {
+            continue;
+        };
+        if let Ok(Some(record)) = read_path(&path) {
+            records.push((id, record));
+        }
     }
+    records
 }
diff --git a/crates/environment-daemon/src/filesystem/transfer/mod.rs b/crates/environment-daemon/src/filesystem/transfer/mod.rs
index 712cf9f78..7bfb321c4 100644
--- a/crates/environment-daemon/src/filesystem/transfer/mod.rs
+++ b/crates/environment-daemon/src/filesystem/transfer/mod.rs
@@ -1,252 +1,1177 @@
-//! Compatibility adapters for small inline copies. All confinement, hashing and
-//! publication use the same backend as paged transfers on Linux and macOS.
-#[cfg(any(target_os = "linux", target_os = "macos"))]
-pub(super) mod session;
-use super::*;
-use environment_protocol::data::{inventory::*, transfer_session::*};
-use sha2::{Digest, Sha256};
-fn invalid(message: &str) -> EnvironmentProtocolError {
-    EnvironmentProtocolError::new(EnvironmentProtocolErrorCode::InvalidRequest, message)
-}
-fn limits(value: TransferLimits) -> Result<InventoryLimits, EnvironmentProtocolError> {
-    if value.max_entries == 0
-        || value.max_entries > MAX_TRANSFER_ENTRIES
-        || value.max_depth > MAX_TRANSFER_DEPTH
-        || value.max_file_bytes > MAX_TRANSFER_BYTES
-        || value.max_total_bytes > MAX_TRANSFER_BYTES
-        || value.max_duration_ms == 0
-        || value.max_duration_ms > MAX_TRANSFER_DURATION_MS
-    {
-        return Err(invalid("inline transfer limits exceed protocol ceilings"));
-    }
-    Ok(InventoryLimits {
-        max_entries: value.max_entries,
-        max_depth: value.max_depth,
-        max_file_bytes: value.max_file_bytes,
-        max_total_bytes: value.max_total_bytes,
-        max_duration_ms: value.max_duration_ms,
-        ..Default::default()
-    })
-}
-async fn advance(
-    fs: &LocalFileSystem,
-    id: &str,
-    phase: TransferPhase,
-) -> Result<(), EnvironmentProtocolError> {
-    loop {
-        if let TransferResponse::Status(status) = fs
-            .transfer(TransferRequest::Advance {
-                operation_id: id.into(),
-            })
-            .await?
-            && status.phase == phase
+//! `transfer/*`: one logical capture, materialize or file write as many
+//! bounded calls.
+//!
+//! Each operation has its own lock; uploads and captured reads of
+//! different digests proceed concurrently. Only active operations are held
+//! in memory and count against `maxActiveOperations`: a finished operation
+//! (complete, aborted or failed) is journaled as its receipt, evicted, and
+//! answered from the journal for `receiptRetentionMs` after it finished.
+//! A completed capture's sealed inventory is retained with its receipt and
+//! stays pageable, so a caller retrying a capture whose answer it lost
+//! gets the tree it first captured without revisiting the live source.
+//!
+//! Errors of the operation's own work (walking, hashing, staging,
+//! publishing, a source that changed, a digest mismatch, the duration
+//! running out) move it to `failed`; every later call except
+//! `transfer/getStatus` and `transfer/abort` then answers that error. A
+//! request the daemon refuses without acting on it (invalid params, a call
+//! in the wrong phase, an unexpected offset, an unknown digest) leaves the
+//! operation as it was.
+
+mod capture;
+mod journal;
+mod publish;
+#[cfg(test)]
+mod tests;
+
+use std::{
+    collections::BTreeMap,
+    path::PathBuf,
+    sync::{
+        Arc, Mutex, MutexGuard, Weak,
+        atomic::{AtomicBool, Ordering},
+    },
+    time::Duration,
+};
+
+use environment_protocol::{
+    bytes::ByteChunk,
+    data::{
+        handshake::TransferCeilings,
+        transfer::{
+            AppendTransferInventoryParams, BeginTransferParams, InventoryEntry,
+            ListTransferMissingParams, ListTransferMissingResponse, ReadTransferContentParams,
+            ReadTransferContentResponse, ReadTransferInventoryParams,
+            ReadTransferInventoryResponse, TransferLimits, TransferOperationParams, TransferPhase,
+            TransferSelection, TransferStatus, WriteTransferContentParams,
+            WriteTransferContentResponse,
+        },
+    },
+    error::{BusyReason, Capability, NotFoundReason, PreconditionReason, ProtocolError},
+    ids::TransferOperationId,
+};
+
+use super::{confinement::Confinement, io_error, search::check_quota};
+use capture::{Capture, ReadFailure};
+use journal::Record;
+use publish::{ChunkFailure, Kind, Publish};
+
+/// Content hashed or copied by one `transfer/advance`.
+const STEP_BYTES: u64 = 4 * 1024 * 1024;
+/// Entries visited by one `transfer/advance`.
+const STEP_ENTRIES: usize = 1024;
+/// How often finished receipts and overdue operations are swept.
+const SWEEP_INTERVAL: Duration = Duration::from_secs(30);
+
+fn check_entry_quota(count: usize, limits: &TransferLimits) -> Result<(), ProtocolError> {
+    if count as u64 > u64::from(limits.max_entries) {
+        return Err(ProtocolError::too_many_entries(
+            limits.max_entries,
+            "the inventory exceeds limits.maxEntries",
+        ));
+    }
+    Ok(())
+}
+
+fn entry_bytes(entry: &InventoryEntry) -> u64 {
+    serde_json::to_vec(entry).map_or(0, |encoded| encoded.len() as u64)
+}
+
+/// The daemon's transfer operations.
+#[derive(Clone)]
+pub(crate) struct Transfers {
+    shared: Arc<Shared>,
+}
+
+struct Shared {
+    confinement: Arc<Confinement>,
+    journal: PathBuf,
+    ceilings: TransferCeilings,
+    writable: bool,
+    active: Mutex<BTreeMap<TransferOperationId, Arc<Operation>>>,
+}
+
+struct Operation {
+    id: TransferOperationId,
+    params: BeginTransferParams,
+    /// Canonical destination of a publish, for overlap checks.
+    destination: Option<Vec<std::ffi::OsString>>,
+    /// Set (under `state`) once the operation finished; read without it.
+    finished: AtomicBool,
+    state: Mutex<State>,
+}
+
+struct State {
+    status: TransferStatus,
+    deadline_ms: i64,
+    work: Work,
+    /// The receipt of a finished operation whose journal write failed. The
+    /// operation stays in memory, answering from here, until a retry
+    /// persists it.
+    unpersisted: Option<Record>,
+}
+
+enum Work {
+    Capture(Box<Capture>),
+    Publish(Box<Publish>),
+    Finished,
+}
+
+/// How a finished operation answers each call.
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum Call {
+    Begin,
+    Abort,
+    Commit,
+    ReadInventory,
+    Other,
+}
+
+enum Found {
+    Active(Arc<Operation>),
+    Finished(TransferStatus),
+}
+
+impl Transfers {
+    /// Journal under `<state_dir>/transfers`. Operations a restart
+    /// interrupted are recorded as failed (`aborted`) and their staging is
+    /// discarded.
+    pub fn new(
+        confinement: Arc<Confinement>,
+        ceilings: TransferCeilings,
+        writable: bool,
+    ) -> Result<Self, ProtocolError> {
+        let journal = confinement.state_dir().join("transfers");
         {
-            return Ok(());
+            use std::os::unix::fs::DirBuilderExt;
+            std::fs::DirBuilder::new()
+                .recursive(true)
+                .mode(super::os::PRIVATE_DIRECTORY_MODE)
+                .create(&journal)
+                .map_err(|error| io_error(error, journal.display()))?;
+        }
+        let shared = Arc::new(Shared {
+            confinement,
+            journal,
+            ceilings,
+            writable,
+            active: Mutex::new(BTreeMap::new()),
+        });
+        shared.recover();
+        let weak = Arc::downgrade(&shared);
+        std::thread::Builder::new()
+            .name("transfer-sweep".into())
+            .spawn(move || sweep_loop(weak))
+            .map_err(|error| ProtocolError::internal(format!("start transfer sweep: {error}")))?;
+        Ok(Self { shared })
+    }
+
+    pub fn begin(&self, params: BeginTransferParams) -> Result<TransferStatus, ProtocolError> {
+        self.shared.begin(params)
+    }
+
+    pub fn advance(
+        &self,
+        params: TransferOperationParams,
+    ) -> Result<TransferStatus, ProtocolError> {
+        self.shared.advance(&params.operation_id)
+    }
+
+    pub fn get_status(
+        &self,
+        params: TransferOperationParams,
+    ) -> Result<TransferStatus, ProtocolError> {
+        match self.shared.find(&params.operation_id)? {
+            Found::Finished(status) => Ok(status),
+            Found::Active(operation) => Ok(operation.lock().status.clone()),
         }
     }
+
+    pub fn read_inventory(
+        &self,
+        params: ReadTransferInventoryParams,
+    ) -> Result<ReadTransferInventoryResponse, ProtocolError> {
+        self.shared.read_inventory(params)
+    }
+
+    pub fn append(
+        &self,
+        params: AppendTransferInventoryParams,
+    ) -> Result<TransferStatus, ProtocolError> {
+        self.shared.append(params)
+    }
+
+    pub fn list_missing(
+        &self,
+        params: ListTransferMissingParams,
+    ) -> Result<ListTransferMissingResponse, ProtocolError> {
+        self.shared.list_missing(params)
+    }
+
+    pub fn read(
+        &self,
+        params: ReadTransferContentParams,
+    ) -> Result<ReadTransferContentResponse, ProtocolError> {
+        self.shared.read(params)
+    }
+
+    pub fn write(
+        &self,
+        params: WriteTransferContentParams,
+    ) -> Result<WriteTransferContentResponse, ProtocolError> {
+        self.shared.write(params)
+    }
+
+    pub fn commit(&self, params: TransferOperationParams) -> Result<TransferStatus, ProtocolError> {
+        self.shared.commit(&params.operation_id)
+    }
+
+    pub fn abort(&self, params: TransferOperationParams) -> Result<TransferStatus, ProtocolError> {
+        self.shared.abort(&params.operation_id)
+    }
+}
+
+impl Operation {
+    fn lock(&self) -> MutexGuard<'_, State> {
+        self.state
+            .lock()
+            .unwrap_or_else(|poisoned| poisoned.into_inner())
+    }
 }
-pub(super) async fn capture(
-    fs: &LocalFileSystem,
-    params: CaptureParams,
-) -> Result<CaptureResponse, EnvironmentProtocolError> {
-    let id = format!("inline-{:032x}", rand::random::<u128>());
-    let result = async {
-        fs.transfer(TransferRequest::Begin {
+
+impl Shared {
+    fn retention_ms(&self) -> i64 {
+        i64::try_from(self.ceilings.receipt_retention_ms).unwrap_or(i64::MAX)
+    }
+
+    fn find(&self, id: &TransferOperationId) -> Result<Found, ProtocolError> {
+        if let Some(operation) = self.active_map().get(id).cloned() {
+            return Ok(Found::Active(operation));
+        }
+        let Some(record) = journal::read(&self.journal, id)? else {
+            return Err(ProtocolError::not_found(format!("unknown transfer {id}")));
+        };
+        if !record.status.phase.is_finished() {
+            // Only a record left by an earlier daemon instance can be
+            // active without being in memory; recovery normally converts
+            // it already.
+            return Ok(Found::Finished(self.interrupted(id, record)));
+        }
+        if record
+            .status
+            .receipt_expires_at_ms
+            .is_some_and(|expires| expires <= journal::now_ms())
+        {
+            return Err(ProtocolError::not_found_because(
+                NotFoundReason::Expired,
+                format!("the receipt of transfer {id} expired"),
+            ));
+        }
+        Ok(Found::Finished(record.status))
+    }
+
+    fn active_map(&self) -> MutexGuard<'_, BTreeMap<TransferOperationId, Arc<Operation>>> {
+        self.active
+            .lock()
+            .unwrap_or_else(|poisoned| poisoned.into_inner())
+    }
+
+    /// Drop a finished operation from memory once its receipt is on disk;
+    /// retries a receipt write that failed.
+    fn evict(&self, operation: &Arc<Operation>) {
+        if !operation.finished.load(Ordering::Acquire) {
+            return;
+        }
+        {
+            let mut state = operation.lock();
+            if let Some(record) = &state.unpersisted {
+                if let Err(error) = journal::write(&self.journal, &operation.id, record) {
+                    eprintln!(
+                        "lightspeed-envd: journaling the receipt of transfer {}: {error}",
+                        operation.id
+                    );
+                    return;
+                }
+                state.unpersisted = None;
+            }
+        }
+        let mut active = self.active_map();
+        if active
+            .get(&operation.id)
+            .is_some_and(|current| Arc::ptr_eq(current, operation))
+        {
+            active.remove(&operation.id);
+        }
+    }
+
+    /// Run `body` on an active operation, answering finished ones per
+    /// `call`, failing an overdue one, and evicting it once finished.
+    fn with_active<T>(
+        &self,
+        id: &TransferOperationId,
+        call: Call,
+        body: impl FnOnce(&Self, &Arc<Operation>, &mut State) -> Result<T, ProtocolError>,
+        finished: impl FnOnce(TransferStatus) -> Result<T, ProtocolError>,
+    ) -> Result<T, ProtocolError> {
+        let operation = match self.find(id)? {
+            Found::Finished(status) => return answer_finished(status, call).and_then(finished),
+            Found::Active(operation) => operation,
+        };
+        let result = {
+            let mut state = operation.lock();
+            if state.status.phase.is_finished() {
+                answer_finished(state.status.clone(), call).and_then(finished)
+            } else if call != Call::Abort && journal::now_ms() >= state.deadline_ms {
+                let error = ProtocolError::deadline_exceeded(format!(
+                    "transfer {id} ran past its maxDurationMs"
+                ));
+                Err(self.fail(&operation, &mut state, error))
+            } else {
+                body(self, &operation, &mut state)
+            }
+        };
+        self.evict(&operation);
+        result
+    }
+
+    /// Record `phase` (complete, aborted, failed), release the work and
+    /// journal the receipt.
+    fn finish(
+        &self,
+        operation: &Operation,
+        state: &mut State,
+        phase: TransferPhase,
+        error: Option<ProtocolError>,
+    ) {
+        state.status.phase = phase;
+        state.status.error = error;
+        state.status.deadline_at_ms = None;
+        state.status.receipt_expires_at_ms =
+            Some(journal::now_ms().saturating_add(self.retention_ms()));
+        // The staging directory and spool are removed in the background;
+        // the receipt names them until a sweep confirms they are gone.
+        let (stage, spool) = match &state.work {
+            Work::Publish(publish) => (publish.created_stage_record(), publish.spool_path()),
+            Work::Capture(_) | Work::Finished => (None, None),
+        };
+        state.work = Work::Finished;
+        let record = Record {
+            params: operation.params.clone(),
+            status: state.status.clone(),
+            stage,
+            spool,
+            committing: false,
+        };
+        if let Err(error) = journal::write(&self.journal, &operation.id, &record) {
+            eprintln!(
+                "lightspeed-envd: journaling the receipt of transfer {}: {error}",
+                operation.id
+            );
+            state.unpersisted = Some(record);
+        }
+        operation.finished.store(true, Ordering::Release);
+    }
+
+    fn fail(
+        &self,
+        operation: &Operation,
+        state: &mut State,
+        error: ProtocolError,
+    ) -> ProtocolError {
+        self.finish(operation, state, TransferPhase::Failed, Some(error.clone()));
+        error
+    }
+
+    fn begin(&self, params: BeginTransferParams) -> Result<TransferStatus, ProtocolError> {
+        self.check_limits(&params.limits)?;
+        let publishes = !matches!(params.selection, TransferSelection::Capture { .. });
+        if publishes && !self.writable {
+            return Err(ProtocolError::capability_unavailable(
+                Capability::FilesystemWrite,
+                "the filesystem is read-only",
+            ));
+        }
+        let id = params.operation_id.clone();
+        if let Some(existing) = self.existing(&params)? {
+            return Ok(existing);
+        }
+        // Checked again at insert; this avoids staging work that would be
+        // refused anyway.
+        self.check_capacity(&self.active_map())?;
+        let (mut work, destination) = self.start(&params)?;
+        let now = journal::now_ms();
+        let deadline_ms =
+            now.saturating_add(i64::try_from(params.limits.max_duration_ms).unwrap_or(i64::MAX));
+        let (phase, stage, spool) = match &work {
+            Work::Capture(_) => (TransferPhase::Scanning, None, None),
+            Work::Publish(publish) => (
+                TransferPhase::Inventory,
+                Some(publish.stage_record()),
+                publish.spool_path(),
+            ),
+            Work::Finished => unreachable!("start returns work"),
+        };
+        let status = TransferStatus {
             operation_id: id.clone(),
-            selection: TransferSelection::Capture {
-                source: params.source.clone(),
-            },
-            limits: limits(params.limits)?,
-        })
-        .await?;
-        advance(fs, &id, TransferPhase::Ready).await?;
-        let mut entries = Vec::new();
-        let mut offset = 0;
-        let mut bytes = 0;
-        loop {
-            let TransferResponse::Inventory {
-                entries: page,
-                next_offset,
-            } = fs
-                .transfer(TransferRequest::Inventory {
-                    operation_id: id.clone(),
-                    offset,
+            phase,
+            entry_count: 0,
+            total_bytes: 0,
+            transferred_bytes: 0,
+            reused_bytes: 0,
+            skipped: Vec::new(),
+            skipped_entry_count: 0,
+            error: None,
+            deadline_at_ms: Some(deadline_ms),
+            receipt_expires_at_ms: None,
+        };
+        let mut active = self.active_map();
+        if active.contains_key(&id) {
+            drop(active);
+            discard(work);
+            return self.existing(&params)?.ok_or_else(|| {
+                ProtocolError::internal(format!("transfer {id} vanished during begin"))
+            });
+        }
+        let admitted = self.check_capacity(&active).and_then(|()| {
+            let overlaps = destination.as_ref().is_some_and(|destination| {
+                active.values().any(|other| {
+                    !other.finished.load(Ordering::Acquire)
+                        && other.destination.as_ref().is_some_and(|other| {
+                            other.starts_with(destination) || destination.starts_with(other)
+                        })
                 })
-                .await?
-            else {
-                return Err(invalid("unexpected inventory"));
+            });
+            if overlaps {
+                return Err(ProtocolError::busy(
+                    Some(BusyReason::TransferCapacity),
+                    None,
+                    "the destination overlaps an active transfer",
+                ));
+            }
+            Ok(())
+        });
+        // The record names the staging directory before it exists, so an
+        // exit at any later point leaves nothing a restart cannot find.
+        let recorded = admitted.and_then(|()| {
+            journal::write(
+                &self.journal,
+                &id,
+                &Record {
+                    params: params.clone(),
+                    status: status.clone(),
+                    stage,
+                    spool,
+                    committing: false,
+                },
+            )
+        });
+        if let Err(error) = recorded {
+            drop(active);
+            discard(work);
+            return Err(error);
+        }
+        if let Work::Publish(publish) = &mut work
+            && let Err(error) = publish.create_stage()
+        {
+            journal::remove(&self.journal, &id);
+            drop(active);
+            discard(work);
+            return Err(error);
+        }
+        active.insert(
+            id.clone(),
+            Arc::new(Operation {
+                id,
+                params,
+                destination,
+                finished: AtomicBool::new(false),
+                state: Mutex::new(State {
+                    status: status.clone(),
+                    deadline_ms,
+                    work,
+                    unpersisted: None,
+                }),
+            }),
+        );
+        Ok(status)
+    }
+
+    fn check_capacity(
+        &self,
+        active: &BTreeMap<TransferOperationId, Arc<Operation>>,
+    ) -> Result<(), ProtocolError> {
+        let running = active
+            .values()
+            .filter(|operation| !operation.finished.load(Ordering::Acquire))
+            .count();
+        if running >= self.ceilings.max_active_operations as usize {
+            return Err(ProtocolError::busy(
+                Some(BusyReason::TransferCapacity),
+                None,
+                format!(
+                    "{running} transfers are active; the ceiling is {}",
+                    self.ceilings.max_active_operations
+                ),
+            ));
+        }
+        Ok(())
+    }
+
+    /// The answer to a repeated begin, or `None` for a new id.
+    fn existing(
+        &self,
+        params: &BeginTransferParams,
+    ) -> Result<Option<TransferStatus>, ProtocolError> {
+        let id = &params.operation_id;
+        let in_use = || {
+            ProtocolError::failed_precondition(
+                PreconditionReason::OperationIdInUse,
+                format!("transfer {id} was begun with different input"),
+            )
+        };
+        let active = self.active_map().get(id).cloned();
+        if let Some(operation) = active {
+            if operation.params != *params {
+                return Err(in_use());
+            }
+            let status = operation.lock().status.clone();
+            return answer_finished_or_active(status, Call::Begin).map(Some);
+        }
+        match journal::read(&self.journal, id)? {
+            None => Ok(None),
+            Some(record) if record.params != *params => Err(in_use()),
+            Some(_) => match self.find(id)? {
+                Found::Finished(status) => answer_finished(status, Call::Begin).map(Some),
+                Found::Active(operation) => {
+                    let status = operation.lock().status.clone();
+                    answer_finished_or_active(status, Call::Begin).map(Some)
+                }
+            },
+        }
+    }
+
+    fn check_limits(&self, limits: &TransferLimits) -> Result<(), ProtocolError> {
+        let ceilings = &self.ceilings;
+        check_quota(
+            "limits.maxEntries",
+            limits.max_entries.into(),
+            ceilings.max_entries.into(),
+        )?;
+        let above = |field: &str, value: u64, ceiling: u64| {
+            if value > ceiling {
+                Err(ProtocolError::above_ceiling(field, value, ceiling))
+            } else {
+                Ok(())
+            }
+        };
+        above(
+            "limits.maxDepth",
+            limits.max_depth.into(),
+            ceilings.max_depth.into(),
+        )?;
+        above(
+            "limits.maxFileBytes",
+            limits.max_file_bytes,
+            ceilings.max_file_bytes,
+        )?;
+        above(
+            "limits.maxTotalBytes",
+            limits.max_total_bytes,
+            ceilings.max_total_bytes,
+        )?;
+        check_quota(
+            "limits.maxManifestBytes",
+            limits.max_manifest_bytes,
+            ceilings.max_manifest_bytes,
+        )?;
+        check_quota(
+            "limits.maxDurationMs",
+            limits.max_duration_ms,
+            ceilings.max_duration_ms,
+        )
+    }
+
+    fn start(
+        &self,
+        params: &BeginTransferParams,
+    ) -> Result<(Work, Option<Vec<std::ffi::OsString>>), ProtocolError> {
+        let confinement = self.confinement.clone();
+        let limits = params.limits;
+        let (destination, kind) = match &params.selection {
+            TransferSelection::Capture {
+                source,
+                filter,
+                symlinks,
+                special_files,
+            } => {
+                let capture = Capture::begin(
+                    confinement,
+                    source,
+                    filter,
+                    *symlinks,
+                    *special_files,
+                    limits,
+                )?;
+                return Ok((Work::Capture(Box::new(capture)), None));
+            }
+            TransferSelection::Materialize {
+                destination,
+                on_existing,
+            } => (
+                destination,
+                Kind::Materialize {
+                    on_existing: *on_existing,
+                },
+            ),
+            TransferSelection::WriteFile {
+                destination,
+                create,
+                if_match,
+                executable,
+            } => (
+                destination,
+                Kind::WriteFile {
+                    create: *create,
+                    if_match: if_match.clone(),
+                    executable: *executable,
+                },
+            ),
+        };
+        let spool = tempfile::Builder::new()
+            .prefix(&format!("{}.spool-", params.operation_id))
+            .tempdir_in(&self.journal)
+            .map_err(|error| io_error(error, self.journal.display()))?;
+        let publish = Publish::begin(confinement, destination, kind, limits, spool)?;
+        let segments = publish.destination_segments.clone();
+        Ok((Work::Publish(Box::new(publish)), Some(segments)))
+    }
+
+    fn advance(&self, id: &TransferOperationId) -> Result<TransferStatus, ProtocolError> {
+        self.with_active(
+            id,
+            Call::Other,
+            |shared, operation, state| {
+                let step = match &mut state.work {
+                    Work::Capture(capture) => advance_capture(capture, &mut state.status),
+                    Work::Publish(publish) => advance_publish(publish, &mut state.status),
+                    Work::Finished => Ok(()),
+                };
+                match step {
+                    Ok(()) => Ok(state.status.clone()),
+                    Err(error) => Err(shared.fail(operation, state, error)),
+                }
+            },
+            Ok,
+        )
+    }
+
+    fn read_inventory(
+        &self,
+        params: ReadTransferInventoryParams,
+    ) -> Result<ReadTransferInventoryResponse, ProtocolError> {
+        check_quota(
+            "limit",
+            params.limit.into(),
+            self.ceilings.max_inventory_page_entries.into(),
+        )?;
+        let retained = |status: TransferStatus| {
+            let index = params.index as usize;
+            let page = journal::read_inventory(
+                &self.journal,
+                &params.operation_id,
+                index,
+                params.limit as usize,
+            )?;
+            let Some((entries, more)) = page else {
+                return Err(phase_error("the transfer is finished"));
             };
-            for entry in page {
-                let content = match entry.content {
-                    InventoryContent::Directory => TransferContent::Directory,
-                    InventoryContent::File {
-                        digest,
-                        size_bytes,
-                        executable,
-                    } => {
-                        let mut data = Vec::with_capacity(size_bytes as usize);
-                        loop {
-                            let TransferResponse::Chunk { data: chunk, eof } = fs
-                                .transfer(TransferRequest::Read {
-                                    operation_id: id.clone(),
-                                    digest: digest.clone(),
-                                    offset: data.len() as u64,
-                                })
-                                .await?
-                            else {
-                                return Err(invalid("unexpected chunk"));
-                            };
-                            data.extend(chunk.into_inner());
-                            if eof {
-                                break;
-                            }
-                        }
-                        bytes += size_bytes;
-                        TransferContent::File {
-                            data: ByteChunk::from(data),
-                            executable,
-                        }
+            if entries.is_empty() && index > status.entry_count as usize {
+                return Err(ProtocolError::invalid_field(
+                    "index",
+                    format!("the inventory has {} entries", status.entry_count),
+                ));
+            }
+            let next_index = more.then_some(params.index + entries.len() as u32);
+            Ok(ReadTransferInventoryResponse {
+                entries,
+                next_index,
+            })
+        };
+        self.with_active(
+            &params.operation_id,
+            Call::ReadInventory,
+            |_, _, state| {
+                let Work::Capture(capture) = &state.work else {
+                    return Err(phase_error("only a capture has an inventory to read"));
+                };
+                if state.status.phase != TransferPhase::Inventory {
+                    return Err(phase_error("the capture's inventory is not sealed yet"));
+                }
+                let count = capture.entries.len();
+                let start = params.index as usize;
+                if start > count {
+                    return Err(ProtocolError::invalid_field(
+                        "index",
+                        format!("the inventory has {count} entries"),
+                    ));
+                }
+                let end = (start + params.limit as usize).min(count);
+                Ok(ReadTransferInventoryResponse {
+                    entries: capture.entries[start..end].to_vec(),
+                    next_index: (end < count).then_some(end as u32),
+                })
+            },
+            retained,
+        )
+    }
+
+    fn append(
+        &self,
+        params: AppendTransferInventoryParams,
+    ) -> Result<TransferStatus, ProtocolError> {
+        let page = self.ceilings.max_inventory_page_entries;
+        if params.entries.len() as u64 > u64::from(page) {
+            return Err(ProtocolError::above_ceiling(
+                "entries",
+                params.entries.len() as u64,
+                page.into(),
+            ));
+        }
+        self.with_active(
+            &params.operation_id,
+            Call::Other,
+            |shared, operation, state| {
+                let Work::Publish(publish) = &mut state.work else {
+                    return Err(phase_error("a capture takes no inventory"));
+                };
+                // A retried page, the sealing one included, answers the
+                // current status in any phase.
+                if publish.is_repeat(params.index, &params.entries, params.last) {
+                    return Ok(state.status.clone());
+                }
+                if state.status.phase != TransferPhase::Inventory {
+                    return Err(phase_error("the inventory is already sealed"));
+                }
+                let sealed = publish.append(params.index, params.entries, params.last)?;
+                state.status.entry_count = publish.entries.len() as u32;
+                state.status.total_bytes = publish.total_bytes;
+                if sealed {
+                    if let Err(error) = publish.start_scan() {
+                        return Err(shared.fail(operation, state, error));
                     }
+                    state.status.phase = TransferPhase::Scanning;
+                }
+                Ok(state.status.clone())
+            },
+            |_| Err(phase_error("the transfer is finished")),
+        )
+    }
+
+    fn list_missing(
+        &self,
+        params: ListTransferMissingParams,
+    ) -> Result<ListTransferMissingResponse, ProtocolError> {
+        check_quota(
+            "limit",
+            params.limit.into(),
+            self.ceilings.max_inventory_page_entries.into(),
+        )?;
+        self.with_active(
+            &params.operation_id,
+            Call::Other,
+            |_, _, state| {
+                let Work::Publish(publish) = &state.work else {
+                    return Err(phase_error("a capture needs no content"));
                 };
-                entries.push(TransferEntry {
-                    path: entry.path,
-                    content,
-                });
+                if !matches!(
+                    state.status.phase,
+                    TransferPhase::Content | TransferPhase::Staging | TransferPhase::Ready
+                ) {
+                    return Err(phase_error("the destination scan has not finished"));
+                }
+                let missing = publish.missing_digests();
+                let limit = params.limit as usize;
+                Ok(ListTransferMissingResponse {
+                    remaining_count: missing.len().saturating_sub(limit) as u32,
+                    digests: missing.into_iter().take(limit).collect(),
+                })
+            },
+            |_| Err(phase_error("the transfer is finished")),
+        )
+    }
+
+    fn read(
+        &self,
+        params: ReadTransferContentParams,
+    ) -> Result<ReadTransferContentResponse, ProtocolError> {
+        check_quota(
+            "maxBytes",
+            params.max_bytes,
+            self.ceilings.max_content_chunk_bytes,
+        )?;
+        let id = params.operation_id.clone();
+        let (operation, source) = self.with_active(
+            &id,
+            Call::Other,
+            |_, operation, state| {
+                let Work::Capture(capture) = &state.work else {
+                    return Err(phase_error("only a capture serves content"));
+                };
+                if state.status.phase != TransferPhase::Inventory {
+                    return Err(phase_error("the capture's inventory is not sealed yet"));
+                }
+                let source = capture
+                    .sources
+                    .get(&params.digest)
+                    .cloned()
+                    .ok_or_else(|| {
+                        ProtocolError::not_found(format!("{} is not in the capture", params.digest))
+                    })?;
+                if params.offset > source.stat.size {
+                    return Err(ProtocolError::invalid_field(
+                        "offset",
+                        format!("the content has {} bytes", source.stat.size),
+                    ));
+                }
+                Ok((operation.clone(), source))
+            },
+            |_| Err(phase_error("the transfer is finished")),
+        )?;
+        let read =
+            capture::read_content(&self.confinement, &source, params.offset, params.max_bytes);
+        let mut state = operation.lock();
+        let result = match read {
+            Ok((data, truncated)) => {
+                if state.status.phase == TransferPhase::Inventory {
+                    state.status.transferred_bytes += data.len() as u64;
+                }
+                Ok(ReadTransferContentResponse {
+                    data: ByteChunk::from(data),
+                    truncated,
+                })
             }
-            if let Some(next) = next_offset {
-                offset = next;
-            } else {
-                break;
+            Err(ReadFailure::Changed(error) | ReadFailure::Io(error)) => {
+                if state.status.phase.is_finished() {
+                    Err(error)
+                } else {
+                    Err(self.fail(&operation, &mut state, error))
+                }
             }
+        };
+        drop(state);
+        self.evict(&operation);
+        result
+    }
+
+    fn write(
+        &self,
+        params: WriteTransferContentParams,
+    ) -> Result<WriteTransferContentResponse, ProtocolError> {
+        let chunk = self.ceilings.max_content_chunk_bytes;
+        if params.data.len() as u64 > chunk {
+            return Err(ProtocolError::above_ceiling(
+                "data",
+                params.data.len() as u64,
+                chunk,
+            ));
         }
-        fs.transfer(TransferRequest::Commit {
-            operation_id: id.clone(),
-        })
-        .await?;
-        Ok(CaptureResponse {
-            source: params.source,
-            entries,
-            bytes,
-        })
-    }
-    .await;
-    if result.is_err() {
-        let _ = fs
-            .transfer(TransferRequest::Abort { operation_id: id })
-            .await;
-    }
-    result
-}
-pub(super) async fn materialize(
-    fs: &LocalFileSystem,
-    params: MaterializeParams,
-) -> Result<MaterializeResponse, EnvironmentProtocolError> {
-    let quota = limits(params.limits)?;
-    if params.entries.len() > quota.max_entries as usize {
-        return Err(invalid("inline entry quota exceeded"));
-    }
-    let id = format!("inline-{:032x}", rand::random::<u128>());
-    let result = async {
-        let mut content = std::collections::BTreeMap::new();
-        let mut entries = Vec::new();
-        let mut bytes = 0u64;
-        for entry in &params.entries {
-            let kind = match &entry.content {
-                TransferContent::Directory => InventoryContent::Directory,
-                TransferContent::File { data, executable } => {
-                    bytes += data.as_slice().len() as u64;
-                    if bytes > quota.max_total_bytes {
-                        return Err(invalid("inline byte quota exceeded"));
+        let id = params.operation_id.clone();
+        let (operation, upload) = self.with_active(
+            &id,
+            Call::Other,
+            |shared, operation, state| {
+                let Work::Publish(publish) = &mut state.work else {
+                    return Err(phase_error("a capture takes no content"));
+                };
+                if state.status.phase != TransferPhase::Content {
+                    return Err(phase_error("the operation is not collecting content"));
+                }
+                let upload = match publish.upload(&params.digest) {
+                    Ok(Some(upload)) => upload,
+                    Ok(None) => {
+                        return Err(ProtocolError::not_found(format!(
+                            "{} is not in the inventory",
+                            params.digest
+                        )));
+                    }
+                    Err(error) => return Err(shared.fail(operation, state, error)),
+                };
+                Ok((operation.clone(), upload))
+            },
+            |_| Err(phase_error("the transfer is finished")),
+        )?;
+        let written = {
+            let mut upload = upload
+                .lock()
+                .unwrap_or_else(|poisoned| poisoned.into_inner());
+            let before = upload.length();
+            upload
+                .write(&params.digest, params.offset, params.data.as_slice())
+                .map(|next| (next, next.saturating_sub(before)))
+        };
+        let mut state = operation.lock();
+        let result = match written {
+            Ok((next_offset, added)) => {
+                state.status.transferred_bytes += added;
+                Ok(WriteTransferContentResponse { next_offset })
+            }
+            Err(ChunkFailure::Offset(error)) => Err(error),
+            Err(ChunkFailure::Mismatch(error) | ChunkFailure::Io(error)) => {
+                if state.status.phase.is_finished() {
+                    Err(error)
+                } else {
+                    Err(self.fail(&operation, &mut state, error))
+                }
+            }
+        };
+        drop(state);
+        self.evict(&operation);
+        result
+    }
+
+    fn commit(&self, id: &TransferOperationId) -> Result<TransferStatus, ProtocolError> {
+        self.with_active(
+            id,
+            Call::Commit,
+            |shared, operation, state| {
+                let outcome = match &mut state.work {
+                    // The inventory is retained before the receipt that
+                    // answers for it.
+                    Work::Capture(capture) if state.status.phase == TransferPhase::Inventory => {
+                        journal::write_inventory(&shared.journal, &operation.id, &capture.entries)
                     }
-                    let digest = format!("sha256:{}", hex::encode(Sha256::digest(data.as_slice())));
-                    content.insert(digest.clone(), data.as_slice());
-                    InventoryContent::File {
-                        digest,
-                        size_bytes: data.as_slice().len() as u64,
-                        executable: *executable,
+                    Work::Publish(publish) if state.status.phase == TransferPhase::Ready => {
+                        // Recorded first: a restart during the commit must
+                        // not claim that nothing was published.
+                        journal::write(
+                            &shared.journal,
+                            &operation.id,
+                            &Record {
+                                params: operation.params.clone(),
+                                status: state.status.clone(),
+                                stage: publish.created_stage_record(),
+                                spool: publish.spool_path(),
+                                committing: true,
+                            },
+                        )?;
+                        publish.commit()
                     }
+                    _ => return Err(phase_error("the operation is not ready to commit")),
+                };
+                match outcome {
+                    Ok(()) => {
+                        shared.finish(operation, state, TransferPhase::Complete, None);
+                        Ok(state.status.clone())
+                    }
+                    Err(error) => Err(shared.fail(operation, state, error)),
                 }
-            };
-            entries.push(InventoryEntry {
-                path: entry.path.clone(),
-                content: kind,
-            });
+            },
+            Ok,
+        )
+    }
+
+    fn abort(&self, id: &TransferOperationId) -> Result<TransferStatus, ProtocolError> {
+        self.with_active(
+            id,
+            Call::Abort,
+            |shared, operation, state| {
+                shared.finish(operation, state, TransferPhase::Aborted, None);
+                Ok(state.status.clone())
+            },
+            Ok,
+        )
+    }
+
+    /// Convert operations left active by an earlier daemon instance and
+    /// drop expired receipts.
+    fn recover(&self) {
+        for (id, record) in journal::all(&self.journal) {
+            if !record.status.phase.is_finished() {
+                self.interrupted(&id, record);
+            } else {
+                self.settle_receipt(&id, record, journal::now_ms());
+            }
         }
-        if entries.is_empty() {
-            return Err(invalid("empty inventory"));
+        journal::remove_orphan_inventories(&self.journal);
+        // Spools of operations without a record (a crash between creating
+        // the spool and the first journal write).
+        if let Ok(entries) = std::fs::read_dir(&self.journal) {
+            for entry in entries.flatten() {
+                let name = entry.file_name();
+                let name = name.to_string_lossy();
+                if let Some((id, _)) = name.split_once(".spool-")
+                    && let Ok(id) = TransferOperationId::new(id)
+                    && journal::read(&self.journal, &id).ok().flatten().is_none()
+                {
+                    let _ = std::fs::remove_dir_all(entry.path());
+                }
+            }
         }
-        fs.transfer(TransferRequest::Begin {
-            operation_id: id.clone(),
-            selection: TransferSelection::Materialize {
-                destination: params.destination.clone(),
-                on_existing: params.on_existing,
+    }
+
+    /// Remove the staging directory and spool a record names.
+    fn release(&self, record: &mut Record) {
+        if let Some(stage) = record.stage.take() {
+            publish::discard_stage(&self.confinement, &stage);
+        }
+        if let Some(spool) = record.spool.take()
+            && spool.parent() == Some(self.journal.as_path())
+        {
+            let _ = std::fs::remove_dir_all(spool);
+        }
+    }
+
+    /// A journaled receipt: removed once expired; otherwise its staging
+    /// and spool, which the finishing instance removes in the background,
+    /// are made sure of and dropped from the record.
+    fn settle_receipt(&self, id: &TransferOperationId, mut record: Record, now: i64) {
+        let expired = record
+            .status
+            .receipt_expires_at_ms
+            .is_none_or(|expires| expires <= now);
+        if expired {
+            self.release(&mut record);
+            journal::remove(&self.journal, id);
+        } else if record.stage.is_some() || record.spool.is_some() {
+            self.release(&mut record);
+            if let Err(error) = journal::write(&self.journal, id, &record) {
+                eprintln!("lightspeed-envd: settling the receipt of transfer {id}: {error}");
+            }
+        }
+    }
+
+    /// Record an operation a restart interrupted as failed (`aborted`) and
+    /// discard its staging and spool.
+    fn interrupted(&self, id: &TransferOperationId, mut record: Record) -> TransferStatus {
+        self.release(&mut record);
+        record.status.phase = TransferPhase::Failed;
+        record.status.error = Some(ProtocolError::aborted(
+            None,
+            if record.committing {
+                "the daemon restarted while the transfer was committing; the destination may \
+                 hold the published tree"
+            } else {
+                "the daemon restarted while the transfer was active; nothing was committed"
             },
-            limits: quota,
-        })
-        .await?;
-        advance(fs, &id, TransferPhase::Inventory).await?;
-        for (index, page) in entries.chunks(MAX_INVENTORY_PAGE).enumerate() {
-            fs.transfer(TransferRequest::Append {
-                operation_id: id.clone(),
-                offset: (index * MAX_INVENTORY_PAGE) as u32,
-                entries: page.to_vec(),
-                last: (index + 1) * MAX_INVENTORY_PAGE >= entries.len(),
-            })
-            .await?;
+        ));
+        record.committing = false;
+        record.status.deadline_at_ms = None;
+        record.status.receipt_expires_at_ms =
+            Some(journal::now_ms().saturating_add(self.retention_ms()));
+        if let Err(error) = journal::write(&self.journal, id, &record) {
+            eprintln!("lightspeed-envd: recording interrupted transfer {id}: {error}");
         }
-        loop {
-            let TransferResponse::Missing { digests, .. } = fs
-                .transfer(TransferRequest::Missing {
-                    operation_id: id.clone(),
-                    offset: 0,
-                })
-                .await?
-            else {
-                return Err(invalid("unexpected missing response"));
-            };
-            if digests.is_empty() {
-                break;
-            }
-            for digest in digests {
-                let data = content[&digest];
-                if data.is_empty() {
-                    fs.transfer(TransferRequest::Write {
-                        operation_id: id.clone(),
-                        digest,
-                        offset: 0,
-                        data: ByteChunk::from(vec![]),
-                    })
-                    .await?;
-                } else {
-                    for (index, chunk) in data.chunks(MAX_CONTENT_CHUNK).enumerate() {
-                        fs.transfer(TransferRequest::Write {
-                            operation_id: id.clone(),
-                            digest: digest.clone(),
-                            offset: (index * MAX_CONTENT_CHUNK) as u64,
-                            data: ByteChunk::from(chunk),
-                        })
-                        .await?;
-                    }
+        record.status
+    }
+
+    /// Fail overdue operations and remove expired receipts.
+    fn sweep(&self) {
+        let operations: Vec<_> = self.active_map().values().cloned().collect();
+        for operation in operations {
+            {
+                let mut state = operation.lock();
+                if !state.status.phase.is_finished() && journal::now_ms() >= state.deadline_ms {
+                    let error = ProtocolError::deadline_exceeded(format!(
+                        "transfer {} ran past its maxDurationMs",
+                        operation.id
+                    ));
+                    self.fail(&operation, &mut state, error);
                 }
             }
+            self.evict(&operation);
         }
-        advance(fs, &id, TransferPhase::Ready).await?;
-        fs.transfer(TransferRequest::Commit {
-            operation_id: id.clone(),
-        })
-        .await?;
-        Ok(MaterializeResponse {
-            destination: params.destination,
-            entries: entries.len() as u32,
-            bytes,
-            retired_directory: None,
-        })
-    }
-    .await;
-    if result.is_err() {
-        let _ = fs
-            .transfer(TransferRequest::Abort { operation_id: id })
-            .await;
-    }
-    result
+        let now = journal::now_ms();
+        // Receipts that finished at least a sweep ago: the background
+        // removal of their staging had its time.
+        let finished_before = now.saturating_sub(SWEEP_INTERVAL.as_millis() as i64);
+        let retention = self.retention_ms();
+        for (id, record) in journal::all(&self.journal) {
+            let due = record.status.receipt_expires_at_ms.is_none_or(|expires| {
+                expires <= now || expires.saturating_sub(retention) <= finished_before
+            });
+            if record.status.phase.is_finished() && due && !self.active_map().contains_key(&id) {
+                self.settle_receipt(&id, record, now);
+            }
+        }
+    }
+}
+
+fn sweep_loop(shared: Weak<Shared>) {
+    loop {
+        std::thread::sleep(SWEEP_INTERVAL);
+        let Some(shared) = shared.upgrade() else {
+            return;
+        };
+        shared.sweep();
+    }
+}
+
+/// Undo a begin refused before its operation was recorded.
+fn discard(work: Work) {
+    if let Work::Publish(publish) = work {
+        publish.discard();
+    }
+}
+
+fn phase_error(message: &str) -> ProtocolError {
+    ProtocolError::failed_precondition(PreconditionReason::TransferPhase, message)
+}
+
+/// A finished operation's answer: its status for abort, an identical begin
+/// and (when complete) commit and inventory reads; its error when it failed; otherwise a phase
+/// error. `transfer/getStatus` always answers the status.
+fn answer_finished(status: TransferStatus, call: Call) -> Result<TransferStatus, ProtocolError> {
+    match (call, status.phase) {
+        (Call::Abort, _) => Ok(status),
+        (_, TransferPhase::Failed) => Err(status
+            .error
+            .clone()
+            .unwrap_or_else(|| ProtocolError::internal("the transfer failed"))),
+        (Call::Begin, _) | (Call::Commit | Call::ReadInventory, TransferPhase::Complete) => {
+            Ok(status)
+        }
+        _ => Err(phase_error("the transfer is finished")),
+    }
+}
+
+fn answer_finished_or_active(
+    status: TransferStatus,
+    call: Call,
+) -> Result<TransferStatus, ProtocolError> {
+    if status.phase.is_finished() {
+        answer_finished(status, call)
+    } else {
+        Ok(status)
+    }
+}
+
+fn advance_capture(
+    capture: &mut Capture,
+    status: &mut TransferStatus,
+) -> Result<(), ProtocolError> {
+    if status.phase == TransferPhase::Scanning && capture.advance()? {
+        status.phase = TransferPhase::Inventory;
+    }
+    status.entry_count = capture.entries.len() as u32;
+    status.total_bytes = capture.total_bytes;
+    status.skipped = capture.skipped.clone();
+    status.skipped_entry_count = capture.skipped_count;
+    Ok(())
+}
+
+fn advance_publish(
+    publish: &mut Publish,
+    status: &mut TransferStatus,
+) -> Result<(), ProtocolError> {
+    if status.phase == TransferPhase::Scanning && publish.scan_step()? {
+        status.phase = TransferPhase::Content;
+    }
+    if status.phase == TransferPhase::Content && publish.missing_digests().is_empty() {
+        status.phase = TransferPhase::Staging;
+    }
+    if status.phase == TransferPhase::Staging && publish.stage_step()? {
+        status.phase = TransferPhase::Ready;
+    }
+    status.reused_bytes = publish.reused_bytes;
+    Ok(())
 }
diff --git a/crates/environment-daemon/src/filesystem/transfer/publish.rs b/crates/environment-daemon/src/filesystem/transfer/publish.rs
new file mode 100644
index 000000000..1435f6bbe
--- /dev/null
+++ b/crates/environment-daemon/src/filesystem/transfer/publish.rs
@@ -0,0 +1,970 @@
+//! Materialize and writeFile: append the incoming inventory, scan the
+//! destination (hashing only files whose size matches an incoming file),
+//! collect missing content, stage the tree next to the destination and
+//! publish it with one rename at commit.
+
+use std::{
+    collections::{BTreeMap, HashMap, HashSet},
+    ffi::{OsStr, OsString},
+    fs::File,
+    io::{Read, Seek, SeekFrom, Write},
+    path::PathBuf,
+    sync::{Arc, Mutex},
+};
+
+use environment_protocol::{
+    data::{
+        fs::{FileKind, FileVersion, TreeContent, WriteCondition},
+        transfer::{InventoryEntry, TransferLimits, TransferOnExisting},
+    },
+    error::{PreconditionReason, ProtocolError},
+    paths::{ContentDigest, EnvironmentPath, TreePath},
+};
+use sha2::{Digest, Sha256};
+
+use crate::filesystem::{
+    confinement::{Confinement, Lookup, Resolved},
+    io_error,
+    os::{self, DEFAULT_DIRECTORY_MODE, DEFAULT_FILE_MODE, Directory, EntryStat, RenameMode},
+    walk::{CompiledFilter, Event, LinkMode, Walker},
+    write_preconditions,
+};
+
+use super::{
+    STEP_BYTES, STEP_ENTRIES,
+    capture::{Source, source_changed},
+    check_entry_quota, entry_bytes,
+    journal::StageRecord,
+};
+
+/// Prefix of staging directories next to a destination.
+pub(super) const STAGE_PREFIX: &str = ".lightspeed-transfer-";
+/// The staged tree inside a staging directory.
+const STAGED_TREE: &str = "tree";
+
+/// What a publish writes.
+#[derive(Clone, Debug)]
+pub(super) enum Kind {
+    Materialize {
+        on_existing: TransferOnExisting,
+    },
+    WriteFile {
+        create: WriteCondition,
+        if_match: Option<FileVersion>,
+        executable: bool,
+    },
+}
+
+struct Stage {
+    parent: Arc<Directory>,
+    name: OsString,
+    directory: Directory,
+}
+
+/// Content uploaded for one digest, spooled under the journal directory.
+pub(super) struct Upload {
+    file: File,
+    path: PathBuf,
+    hash: Sha256,
+    length: u64,
+    size: u64,
+    complete: bool,
+}
+
+/// Why one uploaded chunk was refused.
+pub(super) enum ChunkFailure {
+    /// The offset is not the digest's next offset and the chunk is not an
+    /// identical repeat; nothing changed.
+    Offset(ProtocolError),
+    /// The completed content does not hash to its digest.
+    Mismatch(ProtocolError),
+    Io(ProtocolError),
+}
+
+impl Upload {
+    pub fn is_complete(&self) -> bool {
+        self.complete
+    }
+
+    /// Bytes written so far: the next expected offset.
+    pub fn length(&self) -> u64 {
+        self.length
+    }
+
+    /// Append a chunk at `offset`; returns the next expected offset.
+    pub fn write(
+        &mut self,
+        digest: &ContentDigest,
+        offset: u64,
+        data: &[u8],
+    ) -> Result<u64, ChunkFailure> {
+        let io = |error| ChunkFailure::Io(io_error(error, digest));
+        let end = offset.saturating_add(data.len() as u64);
+        if offset < self.length {
+            // An identical repeat of bytes already written is accepted.
+            if end > self.length {
+                return Err(ChunkFailure::Offset(offset_error(digest, self.length)));
+            }
+            let mut existing = vec![0; data.len()];
+            self.file.seek(SeekFrom::Start(offset)).map_err(io)?;
+            self.file.read_exact(&mut existing).map_err(io)?;
+            if existing != data {
+                return Err(ChunkFailure::Offset(offset_error(digest, self.length)));
+            }
+            return Ok(self.length);
+        }
+        if offset != self.length || self.complete || end > self.size {
+            return Err(ChunkFailure::Offset(offset_error(digest, self.length)));
+        }
+        self.file.seek(SeekFrom::Start(offset)).map_err(io)?;
+        self.file.write_all(data).map_err(io)?;
+        self.hash.update(data);
+        self.length = end;
+        if self.length == self.size {
+            let actual = ContentDigest::from_sha256(self.hash.clone().finalize().into());
+            if actual != *digest {
+                return Err(ChunkFailure::Mismatch(ProtocolError::failed_precondition(
+                    PreconditionReason::DigestMismatch,
+                    format!("uploaded content hashes to {actual}, not {digest}"),
+                )));
+            }
+            self.file.sync_all().map_err(io)?;
+            self.complete = true;
+        }
+        Ok(self.length)
+    }
+}
+
+fn offset_error(digest: &ContentDigest, next: u64) -> ProtocolError {
+    ProtocolError::failed_precondition(
+        PreconditionReason::TransferOffset,
+        format!("the next offset of {digest} is {next}"),
+    )
+}
+
+struct Copying {
+    source: File,
+    destination: File,
+    hash: Sha256,
+    expected: ContentDigest,
+    copied: u64,
+    size: u64,
+    mode: u32,
+    changed: Option<Source>,
+}
+
+struct DestinationScan {
+    walker: Option<Walker>,
+    single: Option<Source>,
+    hashing: Option<(Source, File, Sha256, u64)>,
+}
+
+pub(super) struct Publish {
+    confinement: Arc<Confinement>,
+    pub kind: Kind,
+    destination: EnvironmentPath,
+    /// The destination's parent directory and its name there.
+    parent: Arc<Directory>,
+    name: OsString,
+    parent_segments: Vec<OsString>,
+    pub destination_segments: Vec<OsString>,
+    /// Directories `begin` created for the destination; removed again
+    /// unless a commit published into them.
+    created_parents: Vec<Vec<OsString>>,
+    /// Name of the staging directory, chosen at begin and created by
+    /// [`Publish::create_stage`] once it is journaled.
+    stage_name: OsString,
+    stage: Option<Stage>,
+    limits: TransferLimits,
+    pub entries: Vec<InventoryEntry>,
+    pages: BTreeMap<u32, (Vec<InventoryEntry>, bool)>,
+    paths: HashMap<TreePath, bool>,
+    sizes: BTreeMap<ContentDigest, u64>,
+    pub total_bytes: u64,
+    manifest_bytes: u64,
+    scan: Option<DestinationScan>,
+    reusable: BTreeMap<ContentDigest, Source>,
+    pub uploads: BTreeMap<ContentDigest, Arc<Mutex<Upload>>>,
+    spool: Option<tempfile::TempDir>,
+    staging_index: usize,
+    copying: Option<Copying>,
+    pub reused_bytes: u64,
+}
+
+impl Publish {
+    pub fn begin(
+        confinement: Arc<Confinement>,
+        destination: &EnvironmentPath,
+        kind: Kind,
+        limits: TransferLimits,
+        spool: tempfile::TempDir,
+    ) -> Result<Self, ProtocolError> {
+        let resolved = match &kind {
+            Kind::Materialize { on_existing } => {
+                let resolved = confinement.lookup(
+                    destination,
+                    Lookup::NO_FOLLOW.allowing_missing().creating_parents(),
+                )?;
+                if let Some(stat) = &resolved.stat {
+                    if stat.kind == FileKind::Symlink {
+                        return Err(ProtocolError::failed_precondition(
+                            PreconditionReason::SymlinkRejected,
+                            format!("{destination} is a symlink"),
+                        ));
+                    }
+                    if stat.kind == FileKind::Other {
+                        return Err(ProtocolError::failed_precondition(
+                            PreconditionReason::NotRegularFile,
+                            format!("{destination} is a special file"),
+                        ));
+                    }
+                    if *on_existing == TransferOnExisting::Error {
+                        return Err(ProtocolError::already_exists(format!(
+                            "{destination} exists"
+                        )));
+                    }
+                }
+                resolved
+            }
+            Kind::WriteFile {
+                create, if_match, ..
+            } => {
+                let resolved =
+                    confinement.lookup(destination, Lookup::FOLLOW.allowing_missing())?;
+                write_preconditions(
+                    destination,
+                    resolved.stat.as_ref(),
+                    *create,
+                    if_match.as_ref(),
+                )?;
+                resolved
+            }
+        };
+        if resolved.is_root() {
+            return Err(ProtocolError::failed_precondition(
+                PreconditionReason::FilesystemRoot,
+                "the filesystem root cannot be replaced",
+            ));
+        }
+        if let Err(error) = confinement.refuse_containing_state(&resolved, destination) {
+            confinement.remove_created(&resolved.created);
+            return Err(error);
+        }
+        let Resolved {
+            parent,
+            name,
+            segments,
+            created,
+            ..
+        } = resolved;
+        Ok(Self {
+            confinement,
+            kind,
+            destination: destination.clone(),
+            parent_segments: segments[..segments.len() - 1].to_vec(),
+            destination_segments: segments,
+            created_parents: created,
+            parent: Arc::new(parent),
+            name,
+            stage_name: OsString::from(format!("{STAGE_PREFIX}{:032x}", rand::random::<u128>())),
+            stage: None,
+            limits,
+            entries: Vec::new(),
+            pages: BTreeMap::new(),
+            paths: HashMap::new(),
+            sizes: BTreeMap::new(),
+            total_bytes: 0,
+            manifest_bytes: 0,
+            scan: None,
+            reusable: BTreeMap::new(),
+            uploads: BTreeMap::new(),
+            spool: Some(spool),
+            staging_index: 0,
+            copying: None,
+            reused_bytes: 0,
+        })
+    }
+
+    /// Create the staging directory next to the destination. Called once
+    /// its record is journaled, so a restart always finds and removes it.
+    pub fn create_stage(&mut self) -> Result<(), ProtocolError> {
+        let io = |error| io_error(error, &self.destination);
+        self.parent
+            .mkdir(&self.stage_name, os::PRIVATE_DIRECTORY_MODE)
+            .map_err(io)?;
+        let directory = self.parent.child(&self.stage_name).map_err(io)?;
+        self.stage = Some(Stage {
+            parent: self.parent.clone(),
+            name: self.stage_name.clone(),
+            directory,
+        });
+        Ok(())
+    }
+
+    /// Remove everything `begin` created, at once: a begin refused before
+    /// the operation was recorded leaves nothing behind.
+    pub fn discard(mut self) {
+        if let Some(stage) = self.stage.take() {
+            remove_stage(stage);
+        }
+        self.confinement
+            .remove_created(&std::mem::take(&mut self.created_parents));
+        drop(self.spool.take());
+    }
+
+    /// Where the staging directory is (or is about to be) created.
+    pub fn stage_record(&self) -> StageRecord {
+        StageRecord::new(
+            &self.parent_segments,
+            self.stage_name.to_str().expect("stage names are ASCII"),
+        )
+    }
+
+    /// [`Self::stage_record`] once the staging directory exists.
+    pub fn created_stage_record(&self) -> Option<StageRecord> {
+        self.stage.as_ref().map(|_| self.stage_record())
+    }
+
+    /// The page at `index` was already appended with these entries.
+    pub fn is_repeat(&self, index: u32, entries: &[InventoryEntry], last: bool) -> bool {
+        self.pages
+            .get(&index)
+            .is_some_and(|(previous, sealed)| previous == entries && *sealed == last)
+    }
+
+    pub fn spool_path(&self) -> Option<PathBuf> {
+        self.spool.as_ref().map(|spool| spool.path().to_owned())
+    }
+
+    /// Validate and add one inventory page; `Ok(true)` when it sealed the
+    /// inventory. A repeat of an identical page changes nothing.
+    pub fn append(
+        &mut self,
+        index: u32,
+        entries: Vec<InventoryEntry>,
+        last: bool,
+    ) -> Result<bool, ProtocolError> {
+        if let Some((previous, sealed)) = self.pages.get(&index) {
+            if *previous == entries && *sealed == last {
+                return Ok(false);
+            }
+            return Err(ProtocolError::failed_precondition(
+                PreconditionReason::TransferOffset,
+                format!("page {index} was appended with different entries"),
+            ));
+        }
+        if index as usize != self.entries.len() {
+            return Err(ProtocolError::failed_precondition(
+                PreconditionReason::TransferOffset,
+                format!("the next inventory index is {}", self.entries.len()),
+            ));
+        }
+        if entries.is_empty() && !(last && !self.entries.is_empty()) {
+            return Err(ProtocolError::invalid_field(
+                "entries",
+                "an inventory page needs at least one entry",
+            ));
+        }
+        let single_file = matches!(self.kind, Kind::WriteFile { .. });
+        let mut paths = HashMap::new();
+        let mut sizes = BTreeMap::new();
+        let mut total = self.total_bytes;
+        let mut manifest = self.manifest_bytes;
+        for (offset, entry) in entries.iter().enumerate() {
+            let position = self.entries.len() + offset;
+            let field = |member: &str| format!("entries[{offset}]{member}");
+            if entry.path.depth() > self.limits.max_depth {
+                return Err(ProtocolError::invalid_field(
+                    field(".path"),
+                    "deeper than limits.maxDepth",
+                ));
+            }
+            if position == 0 {
+                if !entry.path.is_root() {
+                    return Err(ProtocolError::invalid_field(
+                        field(".path"),
+                        "the inventory starts with the root entry `.`",
+                    ));
+                }
+            } else {
+                if single_file {
+                    return Err(ProtocolError::invalid_field(
+                        "entries",
+                        "a writeFile inventory holds exactly one file",
+                    ));
+                }
+                if self.paths.contains_key(&entry.path) || paths.contains_key(&entry.path) {
+                    return Err(ProtocolError::invalid_field(
+                        field(".path"),
+                        "duplicate path",
+                    ));
+                }
+                let parent = parent_of(&entry.path);
+                let parent_is_directory = self
+                    .paths
+                    .get(&parent)
+                    .or_else(|| paths.get(&parent))
+                    .copied()
+                    .unwrap_or(false);
+                if !parent_is_directory {
+                    return Err(ProtocolError::invalid_field(
+                        field(".path"),
+                        "a parent directory must precede its children",
+                    ));
+                }
+            }
+            let is_directory = matches!(entry.content, TreeContent::Directory {});
+            if single_file && is_directory {
+                return Err(ProtocolError::invalid_field(
+                    field(".content"),
+                    "a writeFile inventory holds one file",
+                ));
+            }
+            paths.insert(entry.path.clone(), is_directory);
+            if let TreeContent::File {
+                size_bytes, digest, ..
+            } = &entry.content
+            {
+                let Some(digest) = digest else {
+                    return Err(ProtocolError::invalid_field(
+                        field(".content.digest"),
+                        "inventory files carry their digest",
+                    ));
+                };
+                if *size_bytes > self.limits.max_file_bytes {
+                    return Err(ProtocolError::invalid_field(
+                        field(".content.sizeBytes"),
+                        "larger than limits.maxFileBytes",
+                    ));
+                }
+                let known = self.sizes.get(digest).or_else(|| sizes.get(digest));
+                if known.is_some_and(|known| known != size_bytes) {
+                    return Err(ProtocolError::invalid_field(
+                        field(".content.sizeBytes"),
+                        "one digest with two sizes",
+                    ));
+                }
+                sizes.insert(*digest, *size_bytes);
+                total = total.saturating_add(*size_bytes);
+            }
+            manifest += entry_bytes(entry);
+        }
+        check_entry_quota(self.entries.len() + entries.len(), &self.limits)?;
+        if total > self.limits.max_total_bytes {
+            return Err(ProtocolError::invalid_field(
+                "entries",
+                "the inventory exceeds limits.maxTotalBytes",
+            ));
+        }
+        if manifest > self.limits.max_manifest_bytes {
+            return Err(ProtocolError::invalid_field(
+                "entries",
+                "the inventory exceeds limits.maxManifestBytes",
+            ));
+        }
+        if single_file && !last {
+            return Err(ProtocolError::invalid_field(
+                "last",
+                "a writeFile inventory is one page",
+            ));
+        }
+        self.pages.insert(index, (entries.clone(), last));
+        self.paths.extend(paths);
+        self.sizes.extend(sizes);
+        self.entries.extend(entries);
+        self.total_bytes = total;
+        self.manifest_bytes = manifest;
+        Ok(last)
+    }
+
+    /// Start the destination scan after the inventory was sealed.
+    pub fn start_scan(&mut self) -> Result<(), ProtocolError> {
+        let current = self.parent.stat(&self.name);
+        let stat = match current {
+            Ok(stat) => Some(stat),
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => None,
+            Err(error) => return Err(io_error(error, &self.destination)),
+        };
+        let mut scan = DestinationScan {
+            walker: None,
+            single: None,
+            hashing: None,
+        };
+        match stat {
+            Some(stat) if stat.is_dir() && matches!(self.kind, Kind::Materialize { .. }) => {
+                let resolved = self
+                    .confinement
+                    .reopen(&self.destination_segments, &self.destination)?;
+                scan.walker = Some(Walker::new(
+                    self.confinement.clone(),
+                    &resolved,
+                    CompiledFilter::everything(),
+                    LinkMode::Report,
+                    None,
+                    &self.destination,
+                )?);
+            }
+            Some(stat) if stat.is_file() => {
+                scan.single = Some(Source {
+                    canonical: self.destination_segments.clone(),
+                    stat,
+                });
+            }
+            _ => {}
+        }
+        self.scan = Some(scan);
+        Ok(())
+    }
+
+    /// One bounded step of the destination scan; `true` when it is done.
+    /// Reuse is an optimisation: unreadable destination entries are left
+    /// out, never fatal.
+    pub fn scan_step(&mut self) -> Result<bool, ProtocolError> {
+        let wanted: HashSet<u64> = self
+            .missing_digests()
+            .iter()
+            .map(|digest| self.sizes[digest])
+            .collect();
+        let mut allowance = STEP_BYTES;
+        let Some(scan) = self.scan.as_mut() else {
+            return Ok(true);
+        };
+        for _ in 0..STEP_ENTRIES {
+            if let Some((_, file, hash, read)) = scan.hashing.as_mut() {
+                let mut buffer = vec![0u8; 64 * 1024];
+                let mut finished = false;
+                while allowance > 0 {
+                    let limit = (buffer.len() as u64).min(allowance) as usize;
+                    match file.read(&mut buffer[..limit]) {
+                        Ok(0) => {
+                            finished = true;
+                            break;
+                        }
+                        Ok(count) => {
+                            hash.update(&buffer[..count]);
+                            *read += count as u64;
+                            allowance -= count as u64;
+                        }
+                        Err(_) => {
+                            scan.hashing = None;
+                            break;
+                        }
+                    }
+                }
+                if !finished {
+                    if scan.hashing.is_some() {
+                        return Ok(false);
+                    }
+                    continue;
+                }
+                let (source, file, hash, read) = scan.hashing.take().expect("hashing above");
+                let digest = ContentDigest::from_sha256(hash.finalize().into());
+                let unchanged = EntryStat::of_file(&file)
+                    .is_ok_and(|stat| read == source.stat.size && stat.unchanged(&source.stat));
+                if unchanged && self.sizes.contains_key(&digest) {
+                    self.reusable.entry(digest).or_insert(source);
+                }
+                continue;
+            }
+            let candidate = if let Some(single) = scan.single.take() {
+                Some((
+                    single.clone(),
+                    self.confinement
+                        .reopen(&single.canonical, &self.destination),
+                ))
+            } else if let Some(walker) = scan.walker.as_mut() {
+                match walker.next_event() {
+                    Some(Event::Entry(entry))
+                        if entry.stat.is_file() && wanted.contains(&entry.stat.size) =>
+                    {
+                        let source = Source {
+                            canonical: entry.canonical.clone(),
+                            stat: entry.stat,
+                        };
+                        let file = entry.parent.open_read(&entry.name);
+                        if let Ok(file) = file {
+                            scan.hashing = Some((source, file, Sha256::new(), 0));
+                        }
+                        continue;
+                    }
+                    Some(_) => continue,
+                    None => {
+                        scan.walker = None;
+                        None
+                    }
+                }
+            } else {
+                None
+            };
+            match candidate {
+                Some((source, Ok(resolved))) if wanted.contains(&source.stat.size) => {
+                    if let Ok(file) = resolved.parent.open_read(&resolved.name) {
+                        scan.hashing = Some((source, file, Sha256::new(), 0));
+                    }
+                }
+                Some(_) => {}
+                None => {
+                    self.scan = None;
+                    return Ok(true);
+                }
+            }
+        }
+        Ok(false)
+    }
+
+    /// Digests whose content is neither empty, reusable nor uploaded.
+    pub fn missing_digests(&self) -> Vec<ContentDigest> {
+        self.sizes
+            .iter()
+            .filter(|(digest, size)| {
+                **size > 0
+                    && !self.reusable.contains_key(*digest)
+                    && !self.uploads.get(*digest).is_some_and(|upload| {
+                        upload.lock().is_ok_and(|upload| upload.is_complete())
+                    })
+            })
+            .map(|(digest, _)| *digest)
+            .collect()
+    }
+
+    /// The upload of `digest`, created on first use. `None` when the digest
+    /// is not in the inventory.
+    pub fn upload(
+        &mut self,
+        digest: &ContentDigest,
+    ) -> Result<Option<Arc<Mutex<Upload>>>, ProtocolError> {
+        let Some(size) = self.sizes.get(digest).copied() else {
+            return Ok(None);
+        };
+        if let Some(upload) = self.uploads.get(digest) {
+            return Ok(Some(upload.clone()));
+        }
+        let spool = self
+            .spool
+            .as_ref()
+            .ok_or_else(|| ProtocolError::internal("the upload spool is gone"))?;
+        let path = spool.path().join(digest.hex());
+        let file = std::fs::OpenOptions::new()
+            .read(true)
+            .write(true)
+            .create_new(true)
+            .open(&path)
+            .map_err(|error| io_error(error, "the upload spool"))?;
+        let upload = Arc::new(Mutex::new(Upload {
+            file,
+            path,
+            hash: Sha256::new(),
+            length: 0,
+            size,
+            complete: false,
+        }));
+        self.uploads.insert(*digest, upload.clone());
+        Ok(Some(upload))
+    }
+
+    /// One bounded staging step; `true` when the tree is staged.
+    pub fn stage_step(&mut self) -> Result<bool, ProtocolError> {
+        let mut allowance = STEP_BYTES;
+        for _ in 0..STEP_ENTRIES {
+            if self.copying.is_some() {
+                if !self.copy_step(&mut allowance)? {
+                    return Ok(false);
+                }
+                continue;
+            }
+            let Some(entry) = self.entries.get(self.staging_index).cloned() else {
+                return Ok(true);
+            };
+            let stage = self.stage.as_ref().expect("staging before commit");
+            let (directory, name) = staged_parent(&stage.directory, &entry.path)
+                .map_err(|error| io_error(error, &entry.path))?;
+            match entry.content {
+                TreeContent::Directory {} => {
+                    directory
+                        .mkdir(&name, DEFAULT_DIRECTORY_MODE)
+                        .map_err(|error| io_error(error, &entry.path))?;
+                    directory
+                        .sync()
+                        .map_err(|error| io_error(error, &entry.path))?;
+                    self.staging_index += 1;
+                }
+                TreeContent::File {
+                    size_bytes,
+                    executable,
+                    digest,
+                } => {
+                    let digest = digest.expect("appended files carry digests");
+                    let mode = if executable {
+                        os::with_execute_bits(DEFAULT_FILE_MODE)
+                    } else {
+                        DEFAULT_FILE_MODE
+                    };
+                    let destination = directory
+                        .create_file(&name, os::PRIVATE_FILE_MODE)
+                        .map_err(|error| io_error(error, &entry.path))?;
+                    let (source, changed) = self.content_source(&digest, size_bytes)?;
+                    self.copying = Some(Copying {
+                        source,
+                        destination,
+                        hash: Sha256::new(),
+                        expected: digest,
+                        copied: 0,
+                        size: size_bytes,
+                        mode,
+                        changed,
+                    });
+                }
+            }
+        }
+        Ok(false)
+    }
+
+    /// The bytes of `digest`: an upload, a reusable destination file or
+    /// nothing for empty content (an empty spool file stands in).
+    fn content_source(
+        &mut self,
+        digest: &ContentDigest,
+        size: u64,
+    ) -> Result<(File, Option<Source>), ProtocolError> {
+        if let Some(upload) = self.uploads.get(digest) {
+            let upload = upload
+                .lock()
+                .map_err(|_| ProtocolError::internal("upload lock poisoned"))?;
+            if upload.complete {
+                let file = File::open(&upload.path)
+                    .map_err(|error| io_error(error, "the upload spool"))?;
+                return Ok((file, None));
+            }
+        }
+        if let Some(source) = self.reusable.get(digest).cloned() {
+            let resolved = self
+                .confinement
+                .reopen(&source.canonical, &self.destination)
+                .map_err(|_| source_changed(&self.destination))?;
+            let file = resolved
+                .parent
+                .open_read(&resolved.name)
+                .map_err(|error| io_error(error, &self.destination))?;
+            if !EntryStat::of_file(&file).is_ok_and(|stat| stat.unchanged(&source.stat)) {
+                return Err(source_changed(&self.destination));
+            }
+            self.reused_bytes += size;
+            return Ok((file, Some(source)));
+        }
+        if size == 0 {
+            let spool = self
+                .spool
+                .as_ref()
+                .ok_or_else(|| ProtocolError::internal("the upload spool is gone"))?;
+            let path = spool.path().join("empty");
+            let file = std::fs::OpenOptions::new()
+                .read(true)
+                .write(true)
+                .create(true)
+                .truncate(true)
+                .open(path)
+                .map_err(|error| io_error(error, "the upload spool"))?;
+            return Ok((file, None));
+        }
+        Err(ProtocolError::internal(format!(
+            "content of {digest} is missing at staging"
+        )))
+    }
+
+    fn copy_step(&mut self, allowance: &mut u64) -> Result<bool, ProtocolError> {
+        let copy = self.copying.as_mut().expect("caller checked");
+        let mut buffer = vec![0u8; 64 * 1024];
+        loop {
+            if *allowance == 0 {
+                return Ok(false);
+            }
+            let limit = (buffer.len() as u64).min(*allowance) as usize;
+            let read = copy
+                .source
+                .read(&mut buffer[..limit])
+                .map_err(|error| io_error(error, &self.destination))?;
+            if read == 0 {
+                break;
+            }
+            copy.copied += read as u64;
+            if copy.copied > copy.size {
+                return Err(copy_mismatch(copy, &self.destination));
+            }
+            copy.hash.update(&buffer[..read]);
+            copy.destination
+                .write_all(&buffer[..read])
+                .map_err(|error| io_error(error, &self.destination))?;
+            *allowance -= read as u64;
+        }
+        let copy = self.copying.take().expect("copying above");
+        let digest = ContentDigest::from_sha256(copy.hash.clone().finalize().into());
+        if copy.copied != copy.size || digest != copy.expected {
+            return Err(copy_mismatch(&copy, &self.destination));
+        }
+        os::set_mode(&copy.destination, copy.mode)
+            .and_then(|()| copy.destination.sync_all())
+            .map_err(|error| io_error(error, &self.destination))?;
+        self.staging_index += 1;
+        Ok(true)
+    }
+
+    /// Publish the staged tree with one rename.
+    pub fn commit(&mut self) -> Result<(), ProtocolError> {
+        let stage = self.stage.as_ref().expect("commit before release");
+        let staged = OsStr::new(STAGED_TREE);
+        let io = |error| io_error(error, &self.destination);
+        match &self.kind {
+            Kind::Materialize { on_existing } => {
+                let published =
+                    stage
+                        .directory
+                        .rename(staged, &self.parent, &self.name, RenameMode::NoReplace);
+                match published {
+                    Ok(()) => {}
+                    Err(error)
+                        if error.kind() == std::io::ErrorKind::AlreadyExists
+                            && *on_existing == TransferOnExisting::Replace =>
+                    {
+                        // The previous tree lands in the staging directory,
+                        // which is removed with the operation.
+                        stage
+                            .directory
+                            .rename(staged, &self.parent, &self.name, RenameMode::Exchange)
+                            .map_err(io)?;
+                    }
+                    Err(error) => return Err(io(error)),
+                }
+            }
+            Kind::WriteFile {
+                create,
+                if_match,
+                executable,
+            } => {
+                let current = match self.parent.stat(&self.name) {
+                    Ok(stat) => Some(stat),
+                    Err(error) if error.kind() == std::io::ErrorKind::NotFound => None,
+                    Err(error) => return Err(io(error)),
+                };
+                write_preconditions(
+                    &self.destination,
+                    current.as_ref(),
+                    *create,
+                    if_match.as_ref(),
+                )?;
+                let base = current.map_or(DEFAULT_FILE_MODE, |stat| stat.mode);
+                let mode = if *executable {
+                    os::with_execute_bits(base)
+                } else {
+                    base
+                };
+                let file = stage.directory.open_read(staged).map_err(io)?;
+                os::set_mode(&file, mode)
+                    .and_then(|()| file.sync_all())
+                    .map_err(io)?;
+                let rename = if *create == WriteCondition::IfAbsent {
+                    RenameMode::NoReplace
+                } else {
+                    RenameMode::Replace
+                };
+                stage
+                    .directory
+                    .rename(staged, &self.parent, &self.name, rename)
+                    .map_err(io)?;
+            }
+        }
+        self.parent.sync().map_err(io)?;
+        // The published tree lives in the directories begin created.
+        self.created_parents.clear();
+        Ok(())
+    }
+}
+
+impl Drop for Publish {
+    fn drop(&mut self) {
+        let stage = self.stage.take();
+        let created = std::mem::take(&mut self.created_parents);
+        if stage.is_some() || !created.is_empty() {
+            // A replaced tree may be large; removal never delays a receipt.
+            // The receipt keeps the stage's record until a sweep confirms
+            // it is gone, so an exit before this thread finishes leaks
+            // nothing.
+            let confinement = self.confinement.clone();
+            let _ = std::thread::Builder::new()
+                .name("transfer-stage-cleanup".into())
+                .spawn(move || {
+                    if let Some(stage) = stage {
+                        remove_stage(stage);
+                    }
+                    confinement.remove_created(&created);
+                });
+        }
+        if let Some(spool) = self.spool.take() {
+            let _ = std::thread::Builder::new()
+                .name("transfer-spool-cleanup".into())
+                .spawn(move || drop(spool));
+        }
+    }
+}
+
+fn remove_stage(stage: Stage) {
+    drop(stage.directory);
+    if let Err(error) = stage.parent.remove_tree(&stage.name)
+        && error.kind() != std::io::ErrorKind::NotFound
+    {
+        eprintln!(
+            "lightspeed-envd: removing transfer staging {}: {error}",
+            stage.name.to_string_lossy()
+        );
+    }
+}
+
+fn copy_mismatch(copy: &Copying, destination: &EnvironmentPath) -> ProtocolError {
+    match &copy.changed {
+        Some(_) => source_changed(destination),
+        None => ProtocolError::failed_precondition(
+            PreconditionReason::DigestMismatch,
+            format!(
+                "staged content of {} does not match its digest",
+                copy.expected
+            ),
+        ),
+    }
+}
+
+fn parent_of(path: &TreePath) -> TreePath {
+    match path.as_str().rsplit_once('/') {
+        Some((parent, _)) => TreePath::new(parent).expect("a parent of a tree path is one"),
+        None => TreePath::root(),
+    }
+}
+
+/// The directory that holds `path` in the staged tree, and its name there.
+fn staged_parent(stage: &Directory, path: &TreePath) -> std::io::Result<(Directory, OsString)> {
+    if path.is_root() {
+        return Ok((stage.try_clone()?, OsString::from(STAGED_TREE)));
+    }
+    let mut directory = stage.child(OsStr::new(STAGED_TREE))?;
+    let segments: Vec<&str> = path.segments().collect();
+    let (name, parents) = segments
+        .split_last()
+        .expect("a non-root path has a segment");
+    for segment in parents {
+        directory = directory.child(OsStr::new(segment))?;
+    }
+    Ok((directory, OsString::from(name)))
+}
+
+/// Remove a staging directory recorded by an operation a restart
+/// interrupted.
+pub(super) fn discard_stage(confinement: &Confinement, record: &StageRecord) {
+    if !record.name.starts_with(STAGE_PREFIX) || record.name.contains('/') {
+        return;
+    }
+    let segments = record.parent_segments();
+    let Ok(resolved) = confinement.reopen(&segments, &"transfer staging") else {
+        return;
+    };
+    if let Ok(parent) = resolved.open_directory() {
+        let _ = parent.remove_tree(OsStr::new(&record.name));
+    }
+}
diff --git a/crates/environment-daemon/src/filesystem/transfer/session.rs b/crates/environment-daemon/src/filesystem/transfer/session.rs
deleted file mode 100644
index e09db6002..000000000
--- a/crates/environment-daemon/src/filesystem/transfer/session.rs
+++ /dev/null
@@ -1,1531 +0,0 @@
-//! Bounded transfer sessions retain inventories and publish through the filesystem backend.
-use crate::filesystem::backend::{
-    self, Result, conflict, digest, error, invalid, io, relative, valid_digest, valid_path,
-};
-use environment_protocol::{
-    data::{inventory::*, transfer::TransferOnExisting, transfer_session::*},
-    error::EnvironmentProtocolErrorCode as Code,
-    shared::ByteChunk,
-};
-use sha2::{Digest, Sha256};
-use std::{
-    collections::BTreeMap,
-    fs::File,
-    io::{Read, Seek, SeekFrom, Write},
-    path::Path,
-    time::{Duration, Instant},
-};
-#[path = "journal.rs"]
-mod journal;
-use backend::{Directory, Observation};
-#[derive(Clone)]
-struct Source {
-    path: String,
-    observed: Observation,
-}
-struct Hashing {
-    source: Source,
-    file: File,
-    hash: Sha256,
-    read: u64,
-}
-struct Scanner {
-    anchor: Option<Directory>,
-    pending: Vec<String>,
-    pending_bytes: usize,
-    hashing: Option<Hashing>,
-    entries: Vec<InventoryEntry>,
-    files: BTreeMap<String, Source>,
-    observed: Vec<Source>,
-    limits: InventoryLimits,
-    bytes: u64,
-    manifest_bytes: u64,
-    selected: String,
-    ignore_errors: bool,
-    patterns: Vec<glob::Pattern>,
-    visited: u32,
-    metadata_only: bool,
-    skipped: bool,
-}
-impl Scanner {
-    fn new(
-        anchor: Directory,
-        selected: String,
-        limits: InventoryLimits,
-        ignore_errors: bool,
-    ) -> Self {
-        Self {
-            anchor: Some(anchor),
-            pending_bytes: selected.len(),
-            pending: vec![selected.clone()],
-            hashing: None,
-            entries: vec![],
-            files: BTreeMap::new(),
-            observed: vec![],
-            limits,
-            bytes: 0,
-            manifest_bytes: 0,
-            selected,
-            ignore_errors,
-            patterns: vec![],
-            visited: 0,
-            metadata_only: false,
-            skipped: false,
-        }
-    }
-    fn record(&mut self, source: Source, content: InventoryContent) -> Result<()> {
-        let relative = source
-            .path
-            .strip_prefix(&self.selected)
-            .unwrap()
-            .trim_start_matches('/')
-            .to_owned();
-        if !valid_path(&relative) {
-            return Err(invalid("invalid inventory path"));
-        }
-        let entry = InventoryEntry {
-            path: relative,
-            content,
-        };
-        self.manifest_bytes += serde_json::to_vec(&entry)
-            .map_err(|e| invalid(&e.to_string()))?
-            .len() as u64;
-        if self.manifest_bytes > self.limits.max_manifest_bytes {
-            return Err(invalid("manifest memory quota exceeded"));
-        }
-        self.entries.push(entry);
-        self.observed.push(source);
-        Ok(())
-    }
-    /// At most 4 MiB of hashing and 128 visited nodes per exchange. Directory
-    /// enumeration is additionally bounded by the inventory entry/manifest quotas.
-    fn advance(&mut self) -> Result<bool> {
-        let mut allowance = 4 * 1024 * 1024;
-        for _ in 0..MAX_INVENTORY_PAGE {
-            if let Some(mut task) = self.hashing.take() {
-                let mut buffer = [0u8; 64 * 1024];
-                while allowance > 0 {
-                    let limit = buffer.len().min(allowance);
-                    let read = task.file.read(&mut buffer[..limit]).map_err(io)?;
-                    if read == 0 {
-                        if task.read != task.source.observed.size()
-                            || !task
-                                .source
-                                .observed
-                                .matches(&backend::observe(&task.file).map_err(io)?)
-                        {
-                            return Err(conflict());
-                        }
-                        let hash = digest(task.hash);
-                        self.files
-                            .entry(hash.clone())
-                            .or_insert_with(|| task.source.clone());
-                        let content = InventoryContent::File {
-                            size_bytes: task.read,
-                            executable: task.source.observed.executable(),
-                            digest: hash,
-                        };
-                        self.record(task.source, content)?;
-                        break;
-                    }
-                    task.read += read as u64;
-                    if task.read > task.source.observed.size() {
-                        return Err(conflict());
-                    }
-                    task.hash.update(&buffer[..read]);
-                    allowance -= read;
-                    if allowance == 0 {
-                        self.hashing = Some(task);
-                        return Ok(false);
-                    }
-                }
-                continue;
-            }
-            let Some(path) = self.pending.pop() else {
-                return Ok(true);
-            };
-            self.pending_bytes -= path.len();
-            let anchor = self.anchor.as_ref().unwrap();
-            let file = match if self.metadata_only {
-                anchor.metadata(&path)
-            } else {
-                anchor.open(&path)
-            } {
-                Ok(file) => file,
-                Err(_) if self.ignore_errors => {
-                    self.skipped = true;
-                    continue;
-                }
-                Err(e) => return Err(io(e)),
-            };
-            let observed = backend::observe(&file).map_err(io)?;
-            self.visited += 1;
-            if self.visited > self.limits.max_entries {
-                return Err(invalid("entry quota exceeded"));
-            }
-            let rel = path
-                .strip_prefix(&self.selected)
-                .unwrap()
-                .trim_start_matches('/');
-            if !valid_path(rel)
-                || (!rel.is_empty() && rel.split('/').count() > self.limits.max_depth as usize)
-            {
-                return Err(invalid("path/depth quota exceeded"));
-            }
-            let source = Source {
-                path: path.clone(),
-                observed,
-            };
-            if source.observed.is_dir() {
-                let names =
-                    Directory::names(&file, self.limits.max_entries as usize).map_err(io)?;
-                if self.pending.len() + self.entries.len() + names.len()
-                    > self.limits.max_entries as usize
-                {
-                    return Err(invalid("entry quota exceeded"));
-                }
-                // Bound the pending traversal too, before any names enter the queue.
-                let pending_bytes = self.pending_bytes;
-                let added_bytes: usize = names
-                    .iter()
-                    .map(|n| path.len() + usize::from(!path.is_empty()) + n.len())
-                    .sum();
-                if (pending_bytes + added_bytes) as u64 > self.limits.max_manifest_bytes {
-                    return Err(invalid("traversal memory quota exceeded"));
-                }
-                self.pending_bytes += added_bytes;
-                for name in names.into_iter().rev() {
-                    if !valid_path(&name) {
-                        return Err(invalid("unsupported filename"));
-                    }
-                    self.pending.push(if path.is_empty() {
-                        name
-                    } else {
-                        format!("{path}/{name}")
-                    });
-                }
-                self.record(source, InventoryContent::Directory)?;
-            } else {
-                if !self.patterns.is_empty() && !self.patterns.iter().any(|p| p.matches(rel)) {
-                    continue;
-                }
-                self.bytes = self
-                    .bytes
-                    .checked_add(source.observed.size())
-                    .ok_or_else(|| invalid("size overflow"))?;
-                if source.observed.size() > self.limits.max_file_bytes
-                    || self.bytes > self.limits.max_total_bytes
-                {
-                    return Err(invalid("content quota exceeded"));
-                }
-                if self.metadata_only {
-                    let content = InventoryContent::File {
-                        size_bytes: source.observed.size(),
-                        executable: source.observed.executable(),
-                        digest: String::new(),
-                    };
-                    self.record(source, content)?;
-                    continue;
-                }
-                self.hashing = Some(Hashing {
-                    source,
-                    file,
-                    hash: Sha256::new(),
-                    read: 0,
-                });
-            }
-        }
-        Ok(false)
-    }
-    fn verify(&self) -> Result<()> {
-        for source in &self.observed {
-            let file = self
-                .anchor
-                .as_ref()
-                .unwrap()
-                .open(&source.path)
-                .map_err(io)?;
-            if !source
-                .observed
-                .matches(&backend::observe(&file).map_err(io)?)
-            {
-                return Err(conflict());
-            }
-        }
-        Ok(())
-    }
-}
-struct Stage {
-    parent: Directory,
-    directory: Directory,
-    name: String,
-    target: String,
-}
-impl Drop for Stage {
-    fn drop(&mut self) {
-        if let Ok(parent) = self.parent.clone_dir() {
-            let name = self.name.clone();
-            // Retired trees may be large. Cleanup cannot delay the publication receipt.
-            let _ = std::thread::Builder::new()
-                .name("transfer-cleanup".into())
-                .spawn(move || {
-                    if let Err(error) = parent.remove_tree(&name)
-                        && error.kind() != std::io::ErrorKind::NotFound
-                    {
-                        eprintln!("lightspeed-envd retirement cleanup {name}: {error}");
-                    }
-                });
-        }
-    }
-}
-struct Upload {
-    path: std::path::PathBuf,
-    hash: Sha256,
-    length: u64,
-    complete: bool,
-}
-struct Copying {
-    source: File,
-    destination: File,
-    hash: Sha256,
-    expected: String,
-    bytes: u64,
-    size: u64,
-    executable: bool,
-}
-struct Operation {
-    request: TransferRequest,
-    status: TransferStatus,
-    started: Instant,
-    limits: InventoryLimits,
-    scanner: Scanner,
-    stage: Option<Stage>,
-    entries: Vec<InventoryEntry>,
-    manifest_bytes: u64,
-    paths: BTreeMap<String, bool>,
-    sizes: BTreeMap<String, u64>,
-    pages: BTreeMap<u32, (Vec<InventoryEntry>, bool)>,
-    uploads: BTreeMap<String, Upload>,
-    spool: Option<tempfile::TempDir>,
-    retained_inventory: Option<tempfile::TempPath>,
-    staging_index: usize,
-    copying: Option<Copying>,
-    unchanged: bool,
-    staging_name: Option<String>,
-}
-#[derive(Default)]
-pub struct TransferManager {
-    operations: BTreeMap<String, Operation>,
-    journal: Option<std::path::PathBuf>,
-}
-impl TransferManager {
-    pub fn with_journal(directory: std::path::PathBuf) -> Result<Self> {
-        backend::create_private_directory(&directory).map_err(io)?;
-        Ok(Self {
-            operations: BTreeMap::new(),
-            journal: Some(directory),
-        })
-    }
-    pub fn expire(&mut self) -> Option<std::path::PathBuf> {
-        self.operations.retain(|_, op| {
-            op.started.elapsed() < Duration::from_millis(op.limits.max_duration_ms)
-        });
-        self.journal.clone()
-    }
-    pub fn cleanup_expired(directory: &Path) {
-        if let Ok(entries) = std::fs::read_dir(directory) {
-            for entry in entries.flatten().take(8192) {
-                if entry.path().extension().is_some_and(|s| s == "json") {
-                    let id = entry
-                        .file_name()
-                        .to_string_lossy()
-                        .trim_end_matches(".json")
-                        .to_owned();
-                    if let Ok(Some(record)) = journal::read(directory, &id)
-                        && record.expires_at_ms < journal::now_ms()
-                    {
-                        if let (
-                            Some(name),
-                            TransferRequest::Begin {
-                                selection:
-                                    TransferSelection::Materialize { destination, .. }
-                                    | TransferSelection::WriteFile { destination },
-                                ..
-                            },
-                        ) = (&record.stage_name, &record.request)
-                            && name.starts_with(".env-transfer-")
-                            && valid_path(name)
-                            && !name.contains('/')
-                            && let Ok(anchor) = Directory::anchor(&record.root)
-                            && let Ok(relative) = relative(&record.root, destination)
-                            && let Ok((parent, _)) = anchor.parent(&relative)
-                            && let Err(error) = parent.remove_tree(name)
-                            && error.kind() != std::io::ErrorKind::NotFound
-                        {
-                            continue;
-                        }
-                        if let Some(spool) = &record.spool_directory
-                            && spool.parent() == Some(directory)
-                            && spool.file_name().is_some_and(|name| {
-                                name.to_string_lossy()
-                                    .starts_with(&format!("{id}.content-"))
-                            })
-                        {
-                            let _ = std::fs::remove_dir_all(spool);
-                        }
-                        let _ = std::fs::remove_file(directory.join(format!("{id}.inventory")));
-                        let _ = std::fs::remove_file(entry.path());
-                    }
-                }
-            }
-        }
-    }
-    fn save(&self, root: &Path, id: &str) -> Result<()> {
-        let Some(directory) = &self.journal else {
-            return Ok(());
-        };
-        let op = &self.operations[id];
-        if let Some(path) = &op.retained_inventory {
-            let mut copy = tempfile::NamedTempFile::new_in(directory).map_err(io)?;
-            std::io::copy(&mut File::open(path).map_err(io)?, &mut copy).map_err(io)?;
-            copy.as_file().sync_all().map_err(io)?;
-            copy.persist(directory.join(format!("{id}.inventory")))
-                .map_err(|e| io(e.error))?;
-        }
-        journal::write(
-            directory,
-            id,
-            &journal::Record {
-                root: root.to_path_buf(),
-                request: op.request.clone(),
-                status: op.status.clone(),
-                expires_at_ms: journal::now_ms()
-                    + op.limits
-                        .max_duration_ms
-                        .saturating_sub(op.started.elapsed().as_millis() as u64),
-                stage_name: op.staging_name.clone(),
-                spool_directory: op.spool.as_ref().map(|s| s.path().to_path_buf()),
-            },
-        )
-    }
-    pub fn execute(&mut self, root: &Path, request: TransferRequest) -> Result<TransferResponse> {
-        let id = request.operation_id().to_owned();
-        if id.is_empty()
-            || id.len() > 128
-            || !id
-                .bytes()
-                .all(|b| b.is_ascii_alphanumeric() || b"-_".contains(&b))
-        {
-            return Err(invalid("invalid operation id"));
-        }
-        if !self.operations.contains_key(&id)
-            && let Some(directory) = &self.journal
-            && let Some(record) = journal::read(directory, &id)?
-        {
-            if record.root != root {
-                return Err(error(
-                    Code::Forbidden,
-                    "receipt belongs to a different filesystem scope",
-                ));
-            }
-            if record.expires_at_ms < journal::now_ms() {
-                return Err(error(Code::Timeout, "transfer receipt expired"));
-            }
-            if matches!(&request, TransferRequest::Begin { .. }) && request != record.request {
-                return Err(error(
-                    Code::Conflict,
-                    "operation id already used for different input",
-                ));
-            }
-            if matches!(
-                request,
-                TransferRequest::Begin { .. }
-                    | TransferRequest::Status { .. }
-                    | TransferRequest::Commit { .. }
-                    | TransferRequest::Abort { .. }
-            ) && record.status.phase == TransferPhase::Complete
-            {
-                return Ok(TransferResponse::Status(record.status));
-            }
-            if let TransferRequest::Inventory { offset, .. } = &request
-                && record.status.phase == TransferPhase::Complete
-            {
-                return retained_page(
-                    &directory.join(format!("{id}.inventory")),
-                    record.status.entries,
-                    *offset,
-                );
-            }
-            if matches!(request, TransferRequest::Abort { .. }) {
-                if let (
-                    Some(name),
-                    TransferRequest::Begin {
-                        selection:
-                            TransferSelection::Materialize { destination, .. }
-                            | TransferSelection::WriteFile { destination },
-                        ..
-                    },
-                ) = (&record.stage_name, &record.request)
-                    && name.starts_with(".env-transfer-")
-                    && valid_path(name)
-                    && !name.contains('/')
-                {
-                    let anchor = Directory::anchor(root).map_err(io)?;
-                    let (parent, _) = anchor.parent(&relative(root, destination)?).map_err(io)?;
-                    let _ = parent.remove_tree(name);
-                }
-                let mut record = record;
-                record.status.phase = TransferPhase::Aborted;
-                record.stage_name = None;
-                if let Some(spool) = record.spool_directory.take()
-                    && spool.parent() == Some(directory.as_path())
-                    && spool.file_name().is_some_and(|name| {
-                        name.to_string_lossy()
-                            .starts_with(&format!("{id}.content-"))
-                    })
-                {
-                    let _ = std::fs::remove_dir_all(spool);
-                }
-                journal::write(directory, &id, &record)?;
-                return Ok(TransferResponse::Status(record.status));
-            }
-            return Err(error(
-                Code::Conflict,
-                "daemon restarted during transfer; inspect the destination and abort the old operation before starting a new one",
-            ));
-        }
-        if let Some(op) = self.operations.get(&id)
-            && op.started.elapsed() >= Duration::from_millis(op.limits.max_duration_ms)
-        {
-            return Err(error(Code::Timeout, "transfer expired"));
-        }
-        if let TransferRequest::Begin {
-            selection, limits, ..
-        } = &request
-        {
-            if let Some(op) = self.operations.get(&id) {
-                return if op.request == request {
-                    Ok(TransferResponse::Status(op.status.clone()))
-                } else {
-                    Err(error(
-                        Code::Conflict,
-                        "operation id already used for different input",
-                    ))
-                };
-            }
-            self.operations.retain(|_, op| {
-                op.started.elapsed() < Duration::from_millis(op.limits.max_duration_ms)
-            });
-            if self.operations.len() >= 4096
-                || self
-                    .operations
-                    .values()
-                    .filter(|op| {
-                        !matches!(
-                            op.status.phase,
-                            TransferPhase::Complete | TransferPhase::Aborted
-                        )
-                    })
-                    .count()
-                    >= 8
-            {
-                return Err(error(Code::Conflict, "transfer capacity reached"));
-            }
-            let ceiling = InventoryLimits::default();
-            if limits.max_entries == 0
-                || limits.max_entries > ceiling.max_entries
-                || limits.max_depth > ceiling.max_depth
-                || limits.max_file_bytes > ceiling.max_file_bytes
-                || limits.max_total_bytes > ceiling.max_total_bytes
-                || limits.max_manifest_bytes > ceiling.max_manifest_bytes
-                || limits.max_duration_ms == 0
-                || limits.max_duration_ms > ceiling.max_duration_ms
-            {
-                return Err(invalid("operation quotas exceed daemon ceilings"));
-            }
-            let anchor = Directory::anchor(root).map_err(io)?;
-            let (selected, stage, ignore_errors) = match selection {
-                TransferSelection::Capture { source } => (relative(root, source)?, None, false),
-                TransferSelection::Materialize { destination, .. }
-                | TransferSelection::WriteFile { destination } => {
-                    let path = relative(root, destination)?;
-                    if path.is_empty() {
-                        return Err(invalid("cannot replace the filesystem root"));
-                    }
-                    for operation in self.operations.values().filter(|op| op.stage.is_some()) {
-                        let other = &operation.scanner.selected;
-                        if path == *other
-                            || path
-                                .strip_prefix(other)
-                                .is_some_and(|tail| tail.starts_with('/'))
-                            || other
-                                .strip_prefix(&path)
-                                .is_some_and(|tail| tail.starts_with('/'))
-                        {
-                            return Err(error(
-                                Code::Conflict,
-                                "destination overlaps an active materialization",
-                            ));
-                        }
-                    }
-                    let (parent, target) = anchor.ensure_parent(&path).map_err(io)?;
-                    if parent.target_exists(&target).map_err(io)? {
-                        if matches!(
-                            selection,
-                            TransferSelection::Materialize {
-                                on_existing: TransferOnExisting::Error,
-                                ..
-                            }
-                        ) {
-                            return Err(error(Code::Conflict, "destination exists"));
-                        }
-                        if matches!(selection, TransferSelection::WriteFile { .. }) {
-                            parent.writable_file(&target).map_err(io)?;
-                        }
-                    }
-                    let name = format!(".env-transfer-{:032x}", rand::random::<u128>());
-                    let directory = parent.mkdir(&name, true).map_err(io)?;
-                    (
-                        path,
-                        Some(Stage {
-                            parent,
-                            directory,
-                            name,
-                            target,
-                        }),
-                        true,
-                    )
-                }
-            };
-            let op = Operation {
-                request: request.clone(),
-                status: TransferStatus {
-                    operation_id: id.clone(),
-                    phase: TransferPhase::Scanning,
-                    entries: 0,
-                    bytes: 0,
-                    transferred_bytes: 0,
-                    reused_bytes: 0,
-                },
-                started: Instant::now(),
-                limits: *limits,
-                scanner: Scanner::new(anchor, selected, *limits, ignore_errors),
-                staging_name: stage.as_ref().map(|stage| stage.name.clone()),
-                stage,
-                entries: vec![],
-                manifest_bytes: 0,
-                paths: BTreeMap::new(),
-                sizes: BTreeMap::new(),
-                pages: BTreeMap::new(),
-                uploads: BTreeMap::new(),
-                spool: Some(if let Some(directory) = &self.journal {
-                    tempfile::Builder::new()
-                        .prefix(&format!("{id}.content-"))
-                        .tempdir_in(directory)
-                        .map_err(io)?
-                } else {
-                    tempfile::tempdir().map_err(io)?
-                }),
-                retained_inventory: None,
-                staging_index: 0,
-                copying: None,
-                unchanged: false,
-            };
-            let response = TransferResponse::Status(op.status.clone());
-            self.operations.insert(id.clone(), op);
-            if let Err(error) = self.save(root, &id) {
-                self.operations.remove(&id);
-                return Err(error);
-            }
-            return Ok(response);
-        }
-        let op = self.operations.get_mut(&id).ok_or_else(|| {
-            error(
-                Code::NotFound,
-                "unknown transfer; operation receipts may have expired",
-            )
-        })?;
-        if matches!(request, TransferRequest::Status { .. }) {
-            return Ok(TransferResponse::Status(op.status.clone()));
-        }
-        if matches!(request, TransferRequest::Abort { .. }) {
-            if op.status.phase != TransferPhase::Complete {
-                op.status.phase = TransferPhase::Aborted;
-                op.release();
-            }
-            let response = TransferResponse::Status(op.status.clone());
-            self.save(root, &id)?;
-            return Ok(response);
-        }
-        if op.started.elapsed() >= Duration::from_millis(op.limits.max_duration_ms) {
-            return Err(error(Code::Timeout, "transfer expired"));
-        }
-        if op.status.phase == TransferPhase::Aborted {
-            return Err(error(Code::Conflict, "transfer aborted"));
-        }
-        let terminal = matches!(request, TransferRequest::Commit { .. });
-        let response = op.execute(request)?;
-        if terminal {
-            self.save(root, &id)?;
-        }
-        Ok(response)
-    }
-}
-impl Drop for Operation {
-    fn drop(&mut self) {
-        self.release();
-    }
-}
-impl Operation {
-    fn retain_inventory(&mut self) -> Result<()> {
-        let mut spool = tempfile::NamedTempFile::new().map_err(io)?;
-        let count = self.entries.len();
-        spool
-            .seek(SeekFrom::Start((8 * (count + 1)) as u64))
-            .map_err(io)?;
-        let mut positions = Vec::with_capacity(count + 1);
-        for entry in &self.entries {
-            positions.push(spool.stream_position().map_err(io)?);
-            serde_json::to_writer(&mut spool, entry).map_err(|e| invalid(&e.to_string()))?;
-        }
-        positions.push(spool.stream_position().map_err(io)?);
-        spool.seek(SeekFrom::Start(0)).map_err(io)?;
-        for position in positions {
-            spool.write_all(&position.to_le_bytes()).map_err(io)?;
-        }
-        self.retained_inventory = Some(spool.into_temp_path());
-        Ok(())
-    }
-    fn retained_page(&self, offset: u32) -> Result<TransferResponse> {
-        let path = self.retained_inventory.as_ref().ok_or_else(|| {
-            error(
-                Code::Conflict,
-                "completed materialization retains only its receipt",
-            )
-        })?;
-        retained_page(path, self.status.entries, offset)
-    }
-    fn release(&mut self) {
-        self.stage.take();
-        self.uploads.clear();
-        self.copying.take();
-        if let Some(spool) = self.spool.take() {
-            let _ = std::thread::Builder::new()
-                .name("transfer-spool-cleanup".into())
-                .spawn(move || drop(spool));
-        }
-        self.scanner.anchor.take();
-        self.scanner.pending = Vec::new();
-        self.scanner.hashing.take();
-        self.scanner.files.clear();
-        self.scanner.observed = Vec::new();
-        self.scanner.entries = Vec::new();
-        self.paths.clear();
-        self.sizes.clear();
-        self.pages.clear();
-        self.entries = Vec::new();
-    }
-    fn status(&self) -> TransferResponse {
-        TransferResponse::Status(self.status.clone())
-    }
-    fn execute(&mut self, request: TransferRequest) -> Result<TransferResponse> {
-        match request {
-            TransferRequest::Advance { .. } => {
-                if self.status.phase == TransferPhase::Scanning
-                    && match self.scanner.advance() {
-                        Ok(done) => done,
-                        Err(_) if self.stage.is_some() => {
-                            self.scanner.skipped = true;
-                            self.scanner.pending.clear();
-                            self.scanner.hashing.take();
-                            true
-                        }
-                        Err(error) => return Err(error),
-                    }
-                {
-                    if self.stage.is_some() {
-                        self.status.phase = TransferPhase::Inventory;
-                    } else {
-                        self.scanner.verify()?;
-                        self.entries = self.scanner.entries.clone();
-                        self.status.entries = self.entries.len() as u32;
-                        self.status.bytes = self.scanner.bytes;
-                        self.status.phase = TransferPhase::Ready;
-                    }
-                }
-                if self.status.phase == TransferPhase::Content && self.missing().is_empty() {
-                    if !self.scanner.skipped && self.entries == self.scanner.entries {
-                        self.scanner.verify()?;
-                        self.unchanged = true;
-                        self.status.reused_bytes = self.status.bytes;
-                        self.status.phase = TransferPhase::Ready;
-                    } else {
-                        self.status.phase = TransferPhase::Staging;
-                    }
-                }
-                if self.status.phase == TransferPhase::Staging {
-                    self.advance_staging()?;
-                }
-                Ok(self.status())
-            }
-            TransferRequest::Inventory { offset, .. } => {
-                if self.status.phase == TransferPhase::Complete {
-                    return self.retained_page(offset);
-                }
-                if matches!(
-                    self.status.phase,
-                    TransferPhase::Scanning | TransferPhase::Inventory
-                ) {
-                    return Err(error(Code::Conflict, "inventory not complete"));
-                }
-                let offset = offset as usize;
-                if offset > self.entries.len() {
-                    return Err(invalid("inventory offset"));
-                }
-                let end = (offset + MAX_INVENTORY_PAGE).min(self.entries.len());
-                Ok(TransferResponse::Inventory {
-                    entries: self.entries[offset..end].to_vec(),
-                    next_offset: (end < self.entries.len()).then_some(end as u32),
-                })
-            }
-            TransferRequest::Append {
-                offset,
-                entries,
-                last,
-                ..
-            } => {
-                if self.stage.is_none() || entries.len() > MAX_INVENTORY_PAGE {
-                    return Err(invalid("invalid inventory page"));
-                }
-                if let Some((previous, sealed)) = self.pages.get(&offset) {
-                    if previous != &entries || *sealed != last {
-                        return Err(error(Code::Conflict, "inventory retry differs"));
-                    }
-                    return Ok(self.status());
-                }
-                let offset = offset as usize;
-                if self.status.phase != TransferPhase::Inventory || offset != self.entries.len() {
-                    return Err(error(Code::Conflict, "inventory offset/phase mismatch"));
-                }
-                if entries.is_empty() {
-                    return Err(invalid("empty inventory page"));
-                }
-                if self.is_file_write()
-                    && (offset != 0
-                        || !last
-                        || !matches!(entries.as_slice(), [InventoryEntry { path, content: InventoryContent::File { .. } }] if path.is_empty()))
-                {
-                    return Err(invalid("file write requires exactly one file"));
-                }
-                // Validate the complete page before mutating the operation.
-                let mut total = self.status.bytes;
-                let mut meta = self.manifest_bytes;
-                let mut paths = BTreeMap::new();
-                let mut sizes = BTreeMap::new();
-                for (index, entry) in entries.iter().enumerate() {
-                    if !valid_path(&entry.path)
-                        || (!entry.path.is_empty()
-                            && entry.path.split('/').count() > self.limits.max_depth as usize)
-                    {
-                        return Err(invalid("invalid inventory path"));
-                    }
-                    if offset + index == 0 {
-                        if !entry.path.is_empty() {
-                            return Err(invalid("inventory must start with root"));
-                        }
-                    } else {
-                        let parent = entry.path.rsplit_once('/').map_or("", |(p, _)| p);
-                        if self.paths.contains_key(&entry.path) || paths.contains_key(&entry.path) {
-                            return Err(invalid("duplicate inventory path"));
-                        }
-                        if !self
-                            .paths
-                            .get(parent)
-                            .or_else(|| paths.get(parent))
-                            .copied()
-                            .unwrap_or(false)
-                        {
-                            return Err(invalid("parent must precede child"));
-                        }
-                    }
-                    paths.insert(
-                        entry.path.clone(),
-                        entry.content == InventoryContent::Directory,
-                    );
-                    if let InventoryContent::File {
-                        size_bytes, digest, ..
-                    } = &entry.content
-                    {
-                        if !valid_digest(digest) || *size_bytes > self.limits.max_file_bytes {
-                            return Err(invalid("invalid file identity/size"));
-                        }
-                        if self
-                            .sizes
-                            .get(digest)
-                            .or_else(|| sizes.get(digest))
-                            .is_some_and(|s| s != size_bytes)
-                            || self
-                                .scanner
-                                .files
-                                .get(digest)
-                                .is_some_and(|f| f.observed.size() != *size_bytes)
-                        {
-                            return Err(invalid("same digest has different sizes"));
-                        }
-                        sizes.insert(digest.clone(), *size_bytes);
-                        total = total
-                            .checked_add(*size_bytes)
-                            .ok_or_else(|| invalid("size overflow"))?;
-                    }
-                    meta += serde_json::to_vec(entry)
-                        .map_err(|e| invalid(&e.to_string()))?
-                        .len() as u64;
-                }
-                if self.entries.len() + entries.len() > self.limits.max_entries as usize
-                    || total > self.limits.max_total_bytes
-                    || meta > self.limits.max_manifest_bytes
-                {
-                    return Err(invalid("inventory quota exceeded"));
-                }
-                self.pages.insert(offset as u32, (entries.clone(), last));
-                self.paths.extend(paths);
-                self.sizes.extend(sizes);
-                self.entries.extend(entries);
-                self.status.entries = self.entries.len() as u32;
-                self.status.bytes = total;
-                self.manifest_bytes = meta;
-                if last {
-                    if self.entries.is_empty() {
-                        return Err(invalid("empty inventory"));
-                    }
-                    self.status.phase = TransferPhase::Content;
-                }
-                Ok(self.status())
-            }
-            TransferRequest::Missing { offset, .. } => {
-                if !matches!(
-                    self.status.phase,
-                    TransferPhase::Content
-                        | TransferPhase::Staging
-                        | TransferPhase::Ready
-                        | TransferPhase::Complete
-                ) {
-                    return Err(error(Code::Conflict, "inventory not sealed"));
-                }
-                let missing = self.missing();
-                let offset = offset as usize;
-                if offset > missing.len() {
-                    return Err(invalid("missing offset"));
-                }
-                let end = (offset + MAX_INVENTORY_PAGE).min(missing.len());
-                Ok(TransferResponse::Missing {
-                    digests: missing[offset..end].to_vec(),
-                    next_offset: (end < missing.len()).then_some(end as u32),
-                })
-            }
-            TransferRequest::Read { digest, offset, .. } => {
-                if self.stage.is_some() || self.status.phase != TransferPhase::Ready {
-                    return Err(error(Code::Conflict, "capture is not ready"));
-                }
-                let source = self
-                    .scanner
-                    .files
-                    .get(&digest)
-                    .ok_or_else(|| invalid("digest outside capture"))?;
-                let mut file = self
-                    .scanner
-                    .anchor
-                    .as_ref()
-                    .unwrap()
-                    .open(&source.path)
-                    .map_err(io)?;
-                if !source
-                    .observed
-                    .matches(&backend::observe(&file).map_err(io)?)
-                    || offset > source.observed.size()
-                {
-                    return Err(conflict());
-                }
-                file.seek(SeekFrom::Start(offset)).map_err(io)?;
-                let mut data = vec![
-                    0;
-                    (source.observed.size() - offset).min(MAX_CONTENT_CHUNK as u64)
-                        as usize
-                ];
-                file.read_exact(&mut data).map_err(io)?;
-                if !source
-                    .observed
-                    .matches(&backend::observe(&file).map_err(io)?)
-                {
-                    return Err(conflict());
-                }
-                self.status.transferred_bytes += data.len() as u64;
-                Ok(TransferResponse::Chunk {
-                    eof: offset + data.len() as u64 == source.observed.size(),
-                    data: ByteChunk::from(data),
-                })
-            }
-            TransferRequest::Write {
-                digest: expected,
-                offset,
-                data,
-                ..
-            } => {
-                if self.status.phase != TransferPhase::Content
-                    || data.as_slice().len() > MAX_CONTENT_CHUNK
-                {
-                    return Err(invalid("invalid upload chunk/phase"));
-                }
-                let size = self
-                    .file_size(&expected)
-                    .ok_or_else(|| invalid("digest outside inventory"))?;
-                if !self.uploads.contains_key(&expected) {
-                    if offset != 0 {
-                        return Err(error(Code::Conflict, "upload starts at offset zero"));
-                    }
-                    let path = self.spool.as_ref().unwrap().path().join(&expected[7..]);
-                    let file = std::fs::OpenOptions::new()
-                        .read(true)
-                        .write(true)
-                        .create_new(true)
-                        .open(&path)
-                        .map_err(io)?;
-                    drop(file);
-                    self.uploads.insert(
-                        expected.clone(),
-                        Upload {
-                            path,
-                            hash: Sha256::new(),
-                            length: 0,
-                            complete: false,
-                        },
-                    );
-                }
-                let upload = self.uploads.get_mut(&expected).unwrap();
-                let mut file = std::fs::OpenOptions::new()
-                    .read(true)
-                    .write(true)
-                    .open(&upload.path)
-                    .map_err(io)?;
-                let bytes = data.as_slice();
-                let end = offset
-                    .checked_add(bytes.len() as u64)
-                    .ok_or_else(|| invalid("chunk offset overflow"))?;
-                if offset < upload.length || upload.complete {
-                    if end > upload.length {
-                        return Err(error(Code::Conflict, "overlapping chunk"));
-                    }
-                    file.seek(SeekFrom::Start(offset)).map_err(io)?;
-                    let mut existing = vec![0; bytes.len()];
-                    file.read_exact(&mut existing).map_err(io)?;
-                    if existing != bytes {
-                        return Err(error(Code::Conflict, "chunk retry differs"));
-                    }
-                    return Ok(TransferResponse::Written {
-                        next_offset: upload.length,
-                    });
-                }
-                if offset != upload.length || end > size || (bytes.is_empty() && size != 0) {
-                    return Err(invalid("chunk offset/size mismatch"));
-                }
-                file.seek(SeekFrom::Start(offset)).map_err(io)?;
-                file.write_all(bytes).map_err(io)?;
-                upload.hash.update(bytes);
-                upload.length += bytes.len() as u64;
-                self.status.transferred_bytes += bytes.len() as u64;
-                if upload.length == size {
-                    if digest(upload.hash.clone()) != expected {
-                        self.uploads.remove(&expected);
-                        let _ = std::fs::remove_file(
-                            self.spool.as_ref().unwrap().path().join(&expected[7..]),
-                        );
-                        return Err(error(Code::Conflict, "file digest mismatch"));
-                    }
-                    file.sync_all().map_err(io)?;
-                    upload.complete = true;
-                }
-                Ok(TransferResponse::Written { next_offset: end })
-            }
-            TransferRequest::Commit { .. } => {
-                if self.status.phase == TransferPhase::Complete {
-                    return Ok(self.status());
-                }
-                if self.status.phase != TransferPhase::Ready {
-                    return Err(error(Code::Conflict, "transfer is not ready to commit"));
-                }
-                if self.stage.is_none() {
-                    self.retain_inventory()?;
-                }
-                if self.unchanged {
-                    self.scanner.verify()?;
-                } else if let Some(stage) = &self.stage {
-                    let replace = matches!(
-                        &self.request,
-                        TransferRequest::Begin {
-                            selection: TransferSelection::Materialize {
-                                on_existing: TransferOnExisting::Replace,
-                                ..
-                            },
-                            ..
-                        }
-                    );
-                    stage.parent.target_exists(&stage.target).map_err(io)?;
-                    if self.is_file_write() {
-                        match stage.parent.writable_file(&stage.target) {
-                            Ok(target) => {
-                                let permissions = target.metadata().map_err(io)?.permissions();
-                                let staged = stage.directory.open("tree").map_err(io)?;
-                                staged.set_permissions(permissions).map_err(io)?;
-                                staged.sync_all().map_err(io)?;
-                            }
-                            Err(error) if error.kind() == std::io::ErrorKind::NotFound => (),
-                            Err(error) => return Err(io(error)),
-                        }
-                    }
-                    if self.is_file_write() {
-                        stage
-                            .parent
-                            .publish_file(&stage.directory, &stage.target)
-                            .map_err(io)?;
-                    } else {
-                        stage
-                            .parent
-                            .publish(&stage.directory, &stage.target, replace)
-                            .map_err(io)?;
-                    }
-                    // Rename has succeeded. A later durability error must never cause
-                    // a second swap on retry.
-                    self.status.phase = TransferPhase::Complete;
-                    stage.parent.sync().map_err(io)?;
-                    stage.directory.sync().map_err(io)?;
-                } else {
-                    self.scanner.verify()?;
-                }
-                self.status.phase = TransferPhase::Complete;
-                self.release();
-                Ok(self.status())
-            }
-            _ => Err(invalid("unexpected transfer action")),
-        }
-    }
-    fn file_size(&self, digest: &str) -> Option<u64> {
-        self.sizes.get(digest).copied()
-    }
-
-    fn is_file_write(&self) -> bool {
-        matches!(
-            &self.request,
-            TransferRequest::Begin {
-                selection: TransferSelection::WriteFile { .. },
-                ..
-            }
-        )
-    }
-    fn missing(&self) -> Vec<String> {
-        let mut missing = std::collections::BTreeSet::new();
-        for digest in self.sizes.keys() {
-            if !self.scanner.files.contains_key(digest)
-                && !self.uploads.get(digest).is_some_and(|u| u.complete)
-            {
-                missing.insert(digest.clone());
-            }
-        }
-        missing.into_iter().collect()
-    }
-    fn advance_staging(&mut self) -> Result<()> {
-        let mut allowance = 4 * 1024 * 1024;
-        for _ in 0..MAX_INVENTORY_PAGE {
-            if let Some(mut copy) = self.copying.take() {
-                let mut buffer = [0u8; 64 * 1024];
-                while allowance > 0 {
-                    let limit = buffer.len().min(allowance);
-                    let read = copy.source.read(&mut buffer[..limit]).map_err(io)?;
-                    if read == 0 {
-                        if copy.bytes != copy.size || digest(copy.hash) != copy.expected {
-                            return Err(conflict());
-                        }
-                        backend::set_executable(&copy.destination, copy.executable).map_err(io)?;
-                        copy.destination.sync_all().map_err(io)?;
-                        let entry = &self.entries[self.staging_index];
-                        let path = if entry.path.is_empty() {
-                            "tree".into()
-                        } else {
-                            format!("tree/{}", entry.path)
-                        };
-                        self.stage
-                            .as_ref()
-                            .unwrap()
-                            .directory
-                            .parent(&path)
-                            .map_err(io)?
-                            .0
-                            .sync()
-                            .map_err(io)?;
-                        self.staging_index += 1;
-                        break;
-                    }
-                    copy.bytes += read as u64;
-                    if copy.bytes > copy.size {
-                        return Err(conflict());
-                    }
-                    copy.hash.update(&buffer[..read]);
-                    copy.destination.write_all(&buffer[..read]).map_err(io)?;
-                    allowance -= read;
-                    if allowance == 0 {
-                        self.copying = Some(copy);
-                        return Ok(());
-                    }
-                }
-                continue;
-            }
-            let Some(entry) = self.entries.get(self.staging_index) else {
-                self.status.phase = TransferPhase::Ready;
-                return Ok(());
-            };
-            let stage = &self.stage.as_ref().unwrap().directory;
-            let path = if entry.path.is_empty() {
-                "tree".into()
-            } else {
-                format!("tree/{}", entry.path)
-            };
-            match &entry.content {
-                InventoryContent::Directory => {
-                    let (parent, name) = stage.parent(&path).map_err(io)?;
-                    parent.mkdir(&name, false).map_err(io)?.sync().map_err(io)?;
-                    parent.sync().map_err(io)?;
-                    self.staging_index += 1;
-                }
-                InventoryContent::File {
-                    digest,
-                    size_bytes,
-                    executable,
-                } => {
-                    let source =
-                        if let Some(upload) = self.uploads.get(digest).filter(|u| u.complete) {
-                            let mut f = File::open(&upload.path).map_err(io)?;
-                            f.seek(SeekFrom::Start(0)).map_err(io)?;
-                            f
-                        } else {
-                            let source = self
-                                .scanner
-                                .files
-                                .get(digest)
-                                .ok_or_else(|| invalid("missing content"))?;
-                            let file = self
-                                .scanner
-                                .anchor
-                                .as_ref()
-                                .unwrap()
-                                .open(&source.path)
-                                .map_err(io)?;
-                            if !source
-                                .observed
-                                .matches(&backend::observe(&file).map_err(io)?)
-                            {
-                                return Err(conflict());
-                            }
-                            self.status.reused_bytes += *size_bytes;
-                            file
-                        };
-                    self.copying = Some(Copying {
-                        source,
-                        destination: stage.create(&path).map_err(io)?,
-                        hash: Sha256::new(),
-                        expected: digest.clone(),
-                        bytes: 0,
-                        size: *size_bytes,
-                        executable: *executable,
-                    });
-                }
-            }
-        }
-        Ok(())
-    }
-}
-
-fn retained_page(path: &Path, count: u32, offset: u32) -> Result<TransferResponse> {
-    if offset > count {
-        return Err(invalid("inventory offset"));
-    }
-    let end = (offset + MAX_INVENTORY_PAGE as u32).min(count);
-    let mut file = File::open(path).map_err(io)?;
-    file.seek(SeekFrom::Start(offset as u64 * 8)).map_err(io)?;
-    let mut positions = Vec::new();
-    for _ in offset..=end {
-        let mut bytes = [0; 8];
-        file.read_exact(&mut bytes).map_err(io)?;
-        positions.push(u64::from_le_bytes(bytes));
-    }
-    let mut entries = Vec::new();
-    for pair in positions.windows(2) {
-        let size = pair[1] - pair[0];
-        if size > MAX_INVENTORY_PATH_BYTES as u64 + 1024 {
-            return Err(invalid("corrupt retained inventory"));
-        }
-        file.seek(SeekFrom::Start(pair[0])).map_err(io)?;
-        let mut bytes = vec![0; size as usize];
-        file.read_exact(&mut bytes).map_err(io)?;
-        entries.push(serde_json::from_slice(&bytes).map_err(|e| invalid(&e.to_string()))?);
-    }
-    Ok(TransferResponse::Inventory {
-        entries,
-        next_offset: (end < count).then_some(end),
-    })
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use environment_protocol::shared::EnvironmentPath;
-
-    #[test]
-    fn expired_transfer_rejects_progress_and_publication() {
-        let temp = tempfile::tempdir().unwrap();
-        let root = temp.path().canonicalize().unwrap();
-        std::fs::write(root.join("destination"), b"keep").unwrap();
-        let mut manager = TransferManager::default();
-        manager
-            .execute(
-                &root,
-                TransferRequest::Begin {
-                    operation_id: "expired".into(),
-                    selection: TransferSelection::Materialize {
-                        destination: EnvironmentPath::new(
-                            root.join("destination").to_str().unwrap(),
-                        )
-                        .unwrap(),
-                        on_existing: TransferOnExisting::Replace,
-                    },
-                    limits: InventoryLimits {
-                        max_duration_ms: 1000,
-                        ..Default::default()
-                    },
-                },
-            )
-            .unwrap();
-        // Exercise expiry without waiting for wall-clock time or depending on
-        // filesystem throughput and test-runner scheduling.
-        manager.operations.get_mut("expired").unwrap().started =
-            Instant::now() - Duration::from_secs(2);
-        for request in [
-            TransferRequest::Advance {
-                operation_id: "expired".into(),
-            },
-            TransferRequest::Commit {
-                operation_id: "expired".into(),
-            },
-        ] {
-            assert_eq!(
-                manager.execute(&root, request).unwrap_err().code,
-                Code::Timeout
-            );
-        }
-        assert_eq!(std::fs::read(root.join("destination")).unwrap(), b"keep");
-    }
-
-    #[test]
-    fn scan_respects_remaining_budget_when_a_large_file_follows_a_small_file() {
-        let root = tempfile::tempdir().unwrap();
-        std::fs::create_dir(root.path().join("source")).unwrap();
-        std::fs::write(root.path().join("source/small"), [1; 17]).unwrap();
-        std::fs::write(
-            root.path().join("source/large"),
-            vec![2; 4 * 1024 * 1024 + 13],
-        )
-        .unwrap();
-        let mut scanner = Scanner::new(
-            Directory::anchor(root.path()).unwrap(),
-            "source".into(),
-            InventoryLimits::default(),
-            false,
-        );
-        // Make traversal order explicit: pending nodes are popped from the end.
-        scanner.pending = vec!["source/large".into(), "source/small".into()];
-        scanner.pending_bytes = scanner.pending.iter().map(String::len).sum();
-        let progress = |scanner: &Scanner| {
-            scanner
-                .entries
-                .iter()
-                .map(|entry| match entry.content {
-                    InventoryContent::File { size_bytes, .. } => size_bytes,
-                    InventoryContent::Directory => 0,
-                })
-                .sum::<u64>()
-                + scanner.hashing.as_ref().map_or(0, |task| task.read)
-        };
-        assert!(!scanner.advance().unwrap());
-        assert_eq!(progress(&scanner), 4 * 1024 * 1024);
-        assert!(scanner.advance().unwrap());
-        assert_eq!(progress(&scanner), 4 * 1024 * 1024 + 30);
-        scanner.verify().unwrap();
-    }
-
-    #[test]
-    fn staging_respects_remaining_budget_when_a_large_file_follows_a_small_file() {
-        let temp = tempfile::tempdir().unwrap();
-        let root = temp.path().canonicalize().unwrap();
-        std::fs::create_dir(root.join("target")).unwrap();
-        let small = vec![1; 17];
-        let large = vec![2; 4 * 1024 * 1024 + 13];
-        std::fs::write(root.join("target/small"), &small).unwrap();
-        std::fs::write(root.join("target/large"), &large).unwrap();
-        let mut manager = TransferManager::default();
-        manager
-            .execute(
-                &root,
-                TransferRequest::Begin {
-                    operation_id: "bounded".into(),
-                    selection: TransferSelection::Materialize {
-                        destination: EnvironmentPath::new(root.join("target").to_str().unwrap())
-                            .unwrap(),
-                        on_existing: TransferOnExisting::Replace,
-                    },
-                    limits: InventoryLimits::default(),
-                },
-            )
-            .unwrap();
-        while manager.operations["bounded"].status.phase == TransferPhase::Scanning {
-            manager
-                .execute(
-                    &root,
-                    TransferRequest::Advance {
-                        operation_id: "bounded".into(),
-                    },
-                )
-                .unwrap();
-        }
-        let mut entries = vec![InventoryEntry {
-            path: String::new(),
-            content: InventoryContent::Directory,
-        }];
-        for (name, bytes) in [("renamed-small", &small), ("renamed-large", &large)] {
-            entries.push(InventoryEntry {
-                path: name.into(),
-                content: InventoryContent::File {
-                    size_bytes: bytes.len() as u64,
-                    executable: false,
-                    digest: harness::BlobRef::from_bytes(bytes).to_string(),
-                },
-            });
-        }
-        manager
-            .execute(
-                &root,
-                TransferRequest::Append {
-                    operation_id: "bounded".into(),
-                    offset: 0,
-                    entries,
-                    last: true,
-                },
-            )
-            .unwrap();
-        manager
-            .execute(
-                &root,
-                TransferRequest::Advance {
-                    operation_id: "bounded".into(),
-                },
-            )
-            .unwrap();
-        let op = &manager.operations["bounded"];
-        assert_eq!(op.status.phase, TransferPhase::Staging);
-        let copied: u64 = op.entries[..op.staging_index]
-            .iter()
-            .map(|entry| match entry.content {
-                InventoryContent::File { size_bytes, .. } => size_bytes,
-                InventoryContent::Directory => 0,
-            })
-            .sum::<u64>()
-            + op.copying.as_ref().map_or(0, |copy| copy.bytes);
-        assert_eq!(copied, 4 * 1024 * 1024);
-        manager
-            .execute(
-                &root,
-                TransferRequest::Advance {
-                    operation_id: "bounded".into(),
-                },
-            )
-            .unwrap();
-        assert_eq!(
-            manager.operations["bounded"].status.phase,
-            TransferPhase::Ready
-        );
-        manager
-            .execute(
-                &root,
-                TransferRequest::Commit {
-                    operation_id: "bounded".into(),
-                },
-            )
-            .unwrap();
-        assert_eq!(
-            std::fs::read(root.join("target/renamed-small")).unwrap(),
-            small
-        );
-        assert_eq!(
-            std::fs::read(root.join("target/renamed-large")).unwrap(),
-            large
-        );
-    }
-
-    #[test]
-    fn expiry_sweep_reclaims_abandoned_state_and_preserves_live_work() {
-        let root = tempfile::tempdir().unwrap();
-        let state = root.path().join("state");
-        std::fs::create_dir(&state).unwrap();
-        std::fs::write(root.path().join("destination"), b"keep").unwrap();
-        for (id, expires_at_ms) in [
-            ("expired", journal::now_ms() - 1),
-            ("live", journal::now_ms() + 60_000),
-        ] {
-            let stage = format!(".env-transfer-{id}");
-            std::fs::create_dir_all(root.path().join(&stage).join("nested")).unwrap();
-            std::fs::write(root.path().join(&stage).join("nested/file"), b"staged").unwrap();
-            let spool = state.join(format!("{id}.content-private"));
-            std::fs::create_dir(&spool).unwrap();
-            std::fs::write(spool.join("file"), b"uploaded").unwrap();
-            std::fs::write(state.join(format!("{id}.inventory")), b"inventory").unwrap();
-            journal::write(
-                &state,
-                id,
-                &journal::Record {
-                    root: root.path().into(),
-                    request: TransferRequest::Begin {
-                        operation_id: id.into(),
-                        selection: TransferSelection::Materialize {
-                            destination: EnvironmentPath::new(
-                                root.path().join("destination").to_str().unwrap(),
-                            )
-                            .unwrap(),
-                            on_existing: TransferOnExisting::Replace,
-                        },
-                        limits: Default::default(),
-                    },
-                    status: TransferStatus {
-                        operation_id: id.into(),
-                        phase: TransferPhase::Scanning,
-                        entries: 0,
-                        bytes: 0,
-                        transferred_bytes: 0,
-                        reused_bytes: 0,
-                    },
-                    expires_at_ms,
-                    stage_name: Some(stage),
-                    spool_directory: Some(spool),
-                },
-            )
-            .unwrap();
-        }
-        TransferManager::cleanup_expired(&state);
-        for suffix in ["json", "inventory", "content-private"] {
-            assert!(!state.join(format!("expired.{suffix}")).exists());
-            assert!(state.join(format!("live.{suffix}")).exists());
-        }
-        assert!(!root.path().join(".env-transfer-expired").exists());
-        assert!(root.path().join(".env-transfer-live/nested/file").exists());
-        assert_eq!(
-            std::fs::read(root.path().join("destination")).unwrap(),
-            b"keep"
-        );
-    }
-}
diff --git a/crates/environment-daemon/src/filesystem/transfer/tests.rs b/crates/environment-daemon/src/filesystem/transfer/tests.rs
index e6c6603d7..fc7813aa6 100644
--- a/crates/environment-daemon/src/filesystem/transfer/tests.rs
+++ b/crates/environment-daemon/src/filesystem/transfer/tests.rs
@@ -1,1331 +1,964 @@
-use super::*;
-use async_trait::async_trait;
-use environment_client::{EnvironmentClientResult, EnvironmentDataClient, JsonRpcTransport};
+//! Transfer state machine tests against the handlers, without sockets.
+
+use std::{os::unix::fs::symlink, path::Path};
+
 use environment_protocol::{
-    data::{inventory::*, transfer_session::*},
-    shared::EnvironmentPath,
-};
-use harness::{
-    BlobRef,
-    storage::{BlobSource, BlobStore, BlobStoreError},
-};
-use serde_json::json;
-use std::path::Path;
-use std::{
-    os::unix::fs::{PermissionsExt, symlink},
-    sync::{
-        Arc,
-        atomic::{AtomicBool, AtomicUsize, Ordering},
+    data::{
+        fs::{TreeContent, TreeFilter, WriteCondition},
+        transfer::{
+            AppendTransferInventoryParams, BeginTransferParams, InventoryEntry,
+            ListTransferMissingParams, ReadTransferContentParams, ReadTransferInventoryParams,
+            SpecialFilePolicy, SymlinkPolicy, TransferLimits, TransferOnExisting,
+            TransferOperationParams, TransferPhase, TransferSelection, TransferSkipReason,
+            TransferStatus, WriteTransferContentParams,
+        },
+    },
+    error::{
+        AbortReason, BusyReason, ErrorData, PreconditionReason, ProtocolError, ProtocolErrorKind,
     },
+    ids::TransferOperationId,
+    paths::{ContentDigest, EnvironmentPath, TreePath},
 };
-use tools::{
-    environment_protocol::RemoteEnvironmentConnection,
-    transfer::{self},
+use sha2::{Digest, Sha256};
+
+use crate::filesystem::{
+    LocalFileSystem,
+    tests::{context, filesystem},
 };
 
-struct Transport {
-    runtime: DaemonRuntime,
-    pending: Option<Value>,
-    largest: Arc<AtomicUsize>,
-    lose_commit: Arc<AtomicBool>,
+fn id(value: &str) -> TransferOperationId {
+    TransferOperationId::new(value).unwrap()
 }
-#[async_trait]
-impl JsonRpcTransport for Transport {
-    async fn send(&mut self, message: Value) -> EnvironmentClientResult<()> {
-        let wire = serde_json::to_vec(&message)?;
-        self.largest.fetch_max(wire.len(), Ordering::Relaxed);
-        let message: Value = serde_json::from_slice(&wire)?;
-        let result = handle_data(
-            &self.runtime,
-            message["method"].as_str().unwrap(),
-            message["params"].clone(),
-        )
-        .await;
-        if message["params"]["action"] == "commit"
-            && self.lose_commit.swap(false, Ordering::Relaxed)
-        {
-            return Err(environment_client::EnvironmentClientError::TransportClosed);
-        }
-        self.pending = Some(match result {
-            Ok(result) => success_response(message["id"].clone(), result),
-            Err(error) => error_response(Some(message["id"].clone()), error),
-        });
-        Ok(())
-    }
-    async fn recv(&mut self) -> EnvironmentClientResult<Option<Value>> {
-        let Some(response) = self.pending.take() else {
-            return Ok(None);
-        };
-        let wire = serde_json::to_vec(&response)?;
-        self.largest.fetch_max(wire.len(), Ordering::Relaxed);
-        Ok(Some(serde_json::from_slice(&wire)?))
+
+fn path(root: &Path, relative: &str) -> EnvironmentPath {
+    EnvironmentPath::new(format!("{}/{relative}", root.display())).unwrap()
+}
+
+fn limits() -> TransferLimits {
+    TransferLimits {
+        max_entries: 1000,
+        max_depth: 16,
+        max_file_bytes: 64 * 1024 * 1024,
+        max_total_bytes: 256 * 1024 * 1024,
+        max_manifest_bytes: 1024 * 1024,
+        max_duration_ms: 600_000,
     }
 }
-fn runtime(root: &Path, read_only: bool) -> DaemonRuntime {
-    DaemonRuntime::new(crate::config::DaemonConfig {
-        listen: None,
-        cwd: root.into(),
-        fs_root: root.into(),
-        state_dir: root.join("state"),
-        read_only_fs: read_only,
-        registration: None,
-        scrubbed_env: vec![],
-    })
-    .unwrap()
+
+fn digest(bytes: &[u8]) -> ContentDigest {
+    ContentDigest::from_sha256(Sha256::digest(bytes).into())
 }
-fn path(value: &str) -> EnvironmentPath {
-    EnvironmentPath::new(value).unwrap()
+
+fn operation(value: &str) -> TransferOperationParams {
+    TransferOperationParams {
+        operation_id: id(value),
+    }
 }
-fn remote(
-    runtime: DaemonRuntime,
-) -> (
-    RemoteEnvironmentConnection<Transport>,
-    Arc<AtomicUsize>,
-    Arc<AtomicBool>,
-) {
-    let largest = Arc::new(AtomicUsize::new(0));
-    let lose_commit = Arc::new(AtomicBool::new(false));
-    let caps = runtime.capabilities();
-    (
-        RemoteEnvironmentConnection::new(
-            EnvironmentDataClient::new(Transport {
-                runtime,
-                pending: None,
-                largest: largest.clone(),
-                lose_commit: lose_commit.clone(),
-            }),
-            caps,
-        ),
-        largest,
-        lose_commit,
+
+fn capture(source: EnvironmentPath, filter: TreeFilter) -> TransferSelection {
+    TransferSelection::Capture {
+        source,
+        filter,
+        symlinks: SymlinkPolicy::ExpandInside,
+        special_files: SpecialFilePolicy::Reject,
+    }
+}
+
+async fn begin(
+    fs: &LocalFileSystem,
+    operation_id: &str,
+    selection: TransferSelection,
+) -> Result<TransferStatus, ProtocolError> {
+    fs.transfer_begin(
+        &context(),
+        BeginTransferParams {
+            operation_id: id(operation_id),
+            selection,
+            limits: limits(),
+        },
     )
+    .await
 }
-struct Repeated {
-    remaining: u64,
+
+async fn advance_until(
+    fs: &LocalFileSystem,
+    operation_id: &str,
+    phase: TransferPhase,
+) -> Result<TransferStatus, ProtocolError> {
+    for _ in 0..10_000 {
+        let status = fs
+            .transfer_advance(&context(), operation(operation_id))
+            .await?;
+        if status.phase == phase {
+            return Ok(status);
+        }
+    }
+    panic!("{operation_id} never reached {phase:?}");
 }
-#[async_trait]
-impl BlobSource for Repeated {
-    async fn read_chunk(&mut self, max_bytes: usize) -> Result<Vec<u8>, BlobStoreError> {
-        let size = self.remaining.min(max_bytes as u64) as usize;
-        self.remaining -= size as u64;
-        Ok(vec![0x83; size])
+
+async fn inventory(fs: &LocalFileSystem, operation_id: &str) -> Vec<InventoryEntry> {
+    let mut entries = Vec::new();
+    let mut index = 0;
+    loop {
+        let page = fs
+            .transfer_read_inventory(
+                &context(),
+                ReadTransferInventoryParams {
+                    operation_id: id(operation_id),
+                    index,
+                    limit: 2,
+                },
+            )
+            .await
+            .unwrap();
+        entries.extend(page.entries);
+        match page.next_index {
+            Some(next) => index = next,
+            None => return entries,
+        }
     }
 }
-fn repeated_ref(size: u64) -> BlobRef {
-    use sha2::{Digest, Sha256};
-    let mut hash = Sha256::new();
-    let chunk = [0x83; 65536];
-    let mut remaining = size;
-    while remaining > 0 {
-        let n = remaining.min(chunk.len() as u64) as usize;
-        hash.update(&chunk[..n]);
-        remaining -= n as u64;
+
+fn reason(error: &ProtocolError) -> Option<PreconditionReason> {
+    match error.data {
+        ErrorData::FailedPrecondition { reason } => Some(reason),
+        _ => None,
     }
-    BlobRef::parse(format!("sha256:{}", hex::encode(hash.finalize()))).unwrap()
 }
 
 #[tokio::test(flavor = "current_thread")]
-async fn blob_file_tools_stream_without_vfs_and_keep_receipts_across_retries() {
-    use tools::builtin::{
-        BuiltinTool, BuiltinToolContext, BuiltinToolOperation as Op, BuiltinToolSurface as Surface,
+async fn captures_expand_inside_links_skip_ignored_trees_and_serve_ranged_content() {
+    let temp = tempfile::tempdir().unwrap();
+    let root = temp.path().canonicalize().unwrap();
+    let fs = filesystem(&root, false);
+    std::fs::create_dir_all(root.join("project/src")).unwrap();
+    std::fs::create_dir_all(root.join("project/node_modules/.bin")).unwrap();
+    std::fs::create_dir_all(root.join("project/.git")).unwrap();
+    std::fs::write(root.join("project/.gitignore"), "node_modules/\n").unwrap();
+    std::fs::write(root.join("project/src/lib.rs"), b"0123456789").unwrap();
+    std::fs::write(root.join("project/.git/HEAD"), b"ref").unwrap();
+    symlink("src/lib.rs", root.join("project/alias.rs")).unwrap();
+    symlink(
+        "../src/missing",
+        root.join("project/node_modules/.bin/tool"),
+    )
+    .unwrap();
+
+    let filter = TreeFilter {
+        include_hidden: true,
+        ..TreeFilter::default()
     };
-    for surface in [
-        Surface::Canonical,
-        Surface::CodexLike,
-        Surface::ClaudeCodeLike,
-    ] {
-        let environment = tempfile::tempdir().unwrap();
-        let cas = tempfile::tempdir().unwrap();
-        let store = Arc::new(store_fs::FsBlobStore::open(cas.path()).await.unwrap());
-        let size = 9 * 1024 * 1024 + 7;
-        let content = repeated_ref(size);
-        store
-            .put_stream(&content, size, &mut Repeated { remaining: size })
-            .await
-            .unwrap();
-        let (connection, largest, lose_commit) = remote(runtime(environment.path(), false));
-        let (_, context) = connection
-            .with_cwd(tools::fs::FsPath::new(environment.path().to_str().unwrap()).unwrap())
-            .into_contexts(store.clone());
-        let context = context.with_environment_id("test-env");
-        let key = if surface == Surface::ClaudeCodeLike {
-            "file_path"
-        } else {
-            "path"
-        };
-        let write = BuiltinTool::environment(Op::WriteFile, surface);
-        let capture = BuiltinTool::environment(Op::Reference, surface);
-        let writer = context.clone().with_operation_id("write-binary");
-        let output = write
-            .invoke_json(
-                BuiltinToolContext::Environment(&writer),
-                json!({key:"nested/source.bin","content_ref":content}),
-            )
-            .await
-            .unwrap();
-        assert_eq!(output.output_json["bytes_written"], size);
-        assert_eq!(output.output_json["receipt"]["phase"], "complete");
-        assert_eq!(
-            std::fs::metadata(environment.path().join("nested/source.bin"))
-                .unwrap()
-                .len(),
-            size
-        );
-        let capture_cas = tempfile::tempdir().unwrap();
-        let capture_store = Arc::new(
-            store_fs::FsBlobStore::open(capture_cas.path())
-                .await
-                .unwrap(),
-        );
-        let mut capture_context = context.clone().with_operation_id("capture-binary");
-        capture_context.blobs = capture_store.clone();
-        let captured = capture
-            .invoke_json(
-                BuiltinToolContext::Environment(&capture_context),
-                json!({"path":"nested/source.bin"}),
-            )
-            .await
-            .unwrap();
-        assert_eq!(captured.output_json["content_ref"], content.to_string());
-        assert_eq!(captured.output_json["byte_len"], size);
-        assert_eq!(captured.attachments.len(), 1);
-        assert_eq!(captured.output_json["source"]["id"], "test-env");
-        assert_eq!(
-            capture_store.stat_blob(&content).await.unwrap().byte_len,
-            size
-        );
-        assert_eq!(
-            capture_store
-                .read_blob_range(&content, size - 7, 7)
-                .await
-                .unwrap(),
-            vec![0x83; 7]
-        );
-        std::fs::write(
-            environment.path().join("nested/source.bin"),
-            b"changed live file",
+    begin(&fs, "capture", capture(path(&root, "project"), filter))
+        .await
+        .unwrap();
+    let status = advance_until(&fs, "capture", TransferPhase::Inventory)
+        .await
+        .unwrap();
+    let entries = inventory(&fs, "capture").await;
+    let paths: Vec<_> = entries.iter().map(|entry| entry.path.as_str()).collect();
+    // The .git directory is always pruned and node_modules is ignored.
+    assert_eq!(paths, [".", ".gitignore", "alias.rs", "src", "src/lib.rs"]);
+    assert_eq!(status.entry_count, 5);
+    let content = digest(b"0123456789");
+    assert!(entries.iter().any(|entry| matches!(
+        entry.content,
+        TreeContent::File { digest: Some(found), .. } if found == content
+    )));
+    let first = fs
+        .transfer_read(
+            &context(),
+            ReadTransferContentParams {
+                operation_id: id("capture"),
+                digest: content,
+                offset: 0,
+                max_bytes: 4,
+            },
         )
+        .await
         .unwrap();
-        let changed_source_retry = capture
-            .invoke_json(
-                BuiltinToolContext::Environment(&capture_context),
-                json!({"path":"nested/source.bin"}),
-            )
-            .await
-            .unwrap();
-        assert_eq!(
-            changed_source_retry.output_json, captured.output_json,
-            "same-operation capture retry must keep the original immutable version"
-        );
-        std::fs::remove_file(environment.path().join("nested/source.bin")).unwrap();
-        let retry = capture
-            .invoke_json(
-                BuiltinToolContext::Environment(&capture_context),
-                json!({"path":"nested/source.bin"}),
-            )
-            .await
-            .unwrap();
-        assert_eq!(
-            retry.output_json, captured.output_json,
-            "completed capture must not revisit the deleted live path"
-        );
-
-        // Materialization's receipt must make a lost commit response unambiguous.
-        std::fs::write(environment.path().join("result.bin"), b"original").unwrap();
-        std::fs::set_permissions(
-            environment.path().join("result.bin"),
-            std::fs::Permissions::from_mode(0o751),
+    assert_eq!(first.data.as_slice(), b"0123");
+    assert!(first.truncated);
+    let rest = fs
+        .transfer_read(
+            &context(),
+            ReadTransferContentParams {
+                operation_id: id("capture"),
+                digest: content,
+                offset: 4,
+                max_bytes: 100,
+            },
         )
+        .await
         .unwrap();
-        let writer = context.clone().with_operation_id("lost-write-receipt");
-        lose_commit.store(true, Ordering::Relaxed);
-        assert!(
-            write
-                .invoke_json(
-                    BuiltinToolContext::Environment(&writer),
-                    json!({key:"result.bin","content_ref":content})
-                )
-                .await
-                .is_err()
-        );
-        assert_eq!(
-            std::fs::metadata(environment.path().join("result.bin"))
-                .unwrap()
-                .permissions()
-                .mode()
-                & 0o777,
-            0o751
-        );
-        std::fs::write(environment.path().join("result.bin"), b"later local edit").unwrap();
-        let retry = write
-            .invoke_json(
-                BuiltinToolContext::Environment(&writer),
-                json!({key:"result.bin","content_ref":content}),
-            )
-            .await
-            .unwrap();
-        assert_eq!(retry.output_json["receipt"]["phase"], "complete");
-        assert_eq!(
-            std::fs::read(environment.path().join("result.bin")).unwrap(),
-            b"later local edit"
-        );
-
-        std::fs::create_dir(environment.path().join("directory")).unwrap();
-        std::fs::write(environment.path().join("directory/keep"), b"keep").unwrap();
-        let writer = context.clone().with_operation_id("reject-directory-write");
-        assert!(
-            write
-                .invoke_json(
-                    BuiltinToolContext::Environment(&writer),
-                    json!({key:"directory","content_ref":content})
-                )
-                .await
-                .is_err()
-        );
-        assert_eq!(
-            std::fs::read(environment.path().join("directory/keep")).unwrap(),
-            b"keep"
-        );
-        let reader = context
-            .clone()
-            .with_operation_id("reject-directory-capture");
-        assert!(
-            capture
-                .invoke_json(
-                    BuiltinToolContext::Environment(&reader),
-                    json!({"path":"directory"})
-                )
-                .await
-                .is_err()
-        );
-        assert!(
-            largest.load(Ordering::Relaxed) < 400_000,
-            "large binary transfers must use bounded chunks"
-        );
-    }
-}
-
-#[tokio::test(flavor = "current_thread")]
-async fn rpc_vfs_roundtrip_streams_large_files_reuses_bytes_and_preserves_retry_receipt() {
-    let environment = tempfile::tempdir().unwrap();
-    let cas = tempfile::tempdir().unwrap();
-    let store = store_fs::FsBlobStore::open(cas.path()).await.unwrap();
-    let size = 10 * 1024 * 1024 + 7;
-    let blob = repeated_ref(size);
-    store
-        .put_stream(&blob, size, &mut Repeated { remaining: size })
+    assert_eq!(rest.data.as_slice(), b"456789");
+    assert!(!rest.truncated);
+    let committed = fs
+        .transfer_commit(&context(), operation("capture"))
         .await
         .unwrap();
-    let mut directory = vfs::VfsDirectory::default();
-    directory.entries.insert(
-        "run".into(),
-        vfs::VfsEntry::File(vfs::VfsFile {
-            blob_ref: blob.clone(),
-            size_bytes: size,
-            executable: true,
-            media_type: None,
-        }),
-    );
-    directory.entries.insert(
-        "empty".into(),
-        vfs::VfsEntry::Directory(vfs::VfsDirectory::default()),
-    );
-    let selection = vfs::VfsEntry::Directory(directory.clone());
-    let (remote, largest, lose) = remote(runtime(environment.path(), false));
-    let first = transfer::materialize(
-        &remote,
-        &store,
-        "first",
-        &selection,
-        path("selected"),
-        TransferOnExisting::Replace,
-    )
-    .await
-    .unwrap();
-    assert_eq!(first.bytes, size);
-    assert_eq!(first.transferred_bytes, size);
-    assert_eq!(first.reused_bytes, 0);
-    assert!(environment.path().join("selected/empty").is_dir());
+    assert_eq!(committed.phase, TransferPhase::Complete);
+    assert!(committed.receipt_expires_at_ms.is_some());
+    assert!(committed.deadline_at_ms.is_none());
+    // The receipt answers a retried commit and begin from the journal.
     assert_eq!(
-        std::fs::metadata(environment.path().join("selected/run"))
+        fs.transfer_commit(&context(), operation("capture"))
+            .await
             .unwrap()
-            .permissions()
-            .mode()
-            & 0o111,
-        0o111
+            .phase,
+        TransferPhase::Complete
     );
-    use std::os::unix::fs::MetadataExt;
-    let inode = std::fs::metadata(environment.path().join("selected/run"))
-        .unwrap()
-        .ino();
-    let unchanged = transfer::materialize(
-        &remote,
-        &store,
-        "unchanged",
-        &selection,
-        path("selected"),
-        TransferOnExisting::Replace,
+    let error = begin(
+        &fs,
+        "capture",
+        capture(path(&root, "other"), TreeFilter::default()),
     )
     .await
-    .unwrap();
-    assert_eq!(unchanged.transferred_bytes, 0);
-    assert_eq!(unchanged.reused_bytes, size);
-    assert_eq!(
-        std::fs::metadata(environment.path().join("selected/run"))
-            .unwrap()
-            .ino(),
-        inode,
-        "identical complete trees need no restaging"
-    );
-    // Rename, mode-only edit and deletion reuse raw bytes while replacing the whole boundary.
-    let vfs::VfsEntry::File(mut file) = directory.entries.remove("run").unwrap() else {
-        unreachable!()
-    };
-    file.executable = false;
-    directory.entries.remove("empty");
-    directory
-        .entries
-        .insert("renamed".into(), vfs::VfsEntry::File(file));
-    let selection = vfs::VfsEntry::Directory(directory);
-    std::fs::write(environment.path().join("sibling"), b"preserved").unwrap();
-    lose.store(true, Ordering::Relaxed);
-    assert!(
-        transfer::materialize(
-            &remote,
-            &store,
-            "replace",
-            &selection,
-            path("selected"),
-            TransferOnExisting::Replace
+    .unwrap_err();
+    assert_eq!(reason(&error), Some(PreconditionReason::OperationIdInUse));
+
+    // The completed capture's inventory stays pageable with its receipt,
+    // after the source changed and across a restart; its content does not.
+    std::fs::remove_file(root.join("project/src/lib.rs")).unwrap();
+    assert_eq!(inventory(&fs, "capture").await, entries);
+    drop(fs);
+    let fs = filesystem(&root, false);
+    assert_eq!(inventory(&fs, "capture").await, entries);
+    let error = fs
+        .transfer_read(
+            &context(),
+            ReadTransferContentParams {
+                operation_id: id("capture"),
+                digest: content,
+                offset: 0,
+                max_bytes: 4,
+            },
         )
         .await
-        .is_err()
-    );
-    assert!(!environment.path().join("selected/run").exists());
-    assert!(!environment.path().join("selected/empty").exists());
-    std::fs::write(
-        environment.path().join("selected/local-edit"),
-        b"keep on retry",
-    )
-    .unwrap();
-    let retry = transfer::materialize(
-        &remote,
-        &store,
-        "replace",
-        &selection,
-        path("selected"),
-        TransferOnExisting::Replace,
+        .unwrap_err();
+    assert_eq!(reason(&error), Some(PreconditionReason::TransferPhase));
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn a_failed_capture_answers_its_first_error_and_never_commits() {
+    let temp = tempfile::tempdir().unwrap();
+    let base = temp.path().canonicalize().unwrap();
+    let root = base.join("root");
+    std::fs::create_dir_all(root.join("tree/a")).unwrap();
+    std::fs::create_dir_all(base.join("outside")).unwrap();
+    std::fs::write(root.join("tree/a/file"), b"a").unwrap();
+    symlink(base.join("outside"), root.join("tree/escape")).unwrap();
+    std::fs::write(root.join("tree/z"), b"z").unwrap();
+    let fs = filesystem(&root, false);
+
+    begin(
+        &fs,
+        "escape",
+        capture(path(&root, "tree"), TreeFilter::default()),
     )
     .await
     .unwrap();
-    assert_eq!(retry.phase, TransferPhase::Complete);
-    assert_eq!(retry.transferred_bytes, 0);
-    assert_eq!(retry.reused_bytes, size);
-    assert!(environment.path().join("selected/local-edit").exists());
-    std::fs::remove_file(environment.path().join("selected/local-edit")).unwrap();
-    let captured = transfer::capture(&remote, &store, None, "capture-existing", path("selected"))
+    let first = advance_until(&fs, "escape", TransferPhase::Inventory)
+        .await
+        .unwrap_err();
+    assert_eq!(reason(&first), Some(PreconditionReason::SymlinkRejected));
+    // Retries never continue the walk past the failure.
+    for _ in 0..3 {
+        let again = fs
+            .transfer_advance(&context(), operation("escape"))
+            .await
+            .unwrap_err();
+        assert_eq!(again, first);
+    }
+    let error = fs
+        .transfer_commit(&context(), operation("escape"))
+        .await
+        .unwrap_err();
+    assert_eq!(error, first);
+    let status = fs
+        .transfer_get_status(&context(), operation("escape"))
         .await
         .unwrap();
-    assert_eq!(captured.entry, selection);
-    assert_eq!(captured.status.transferred_bytes, 0);
-    let empty_cas = tempfile::tempdir().unwrap();
-    let empty_store = store_fs::FsBlobStore::open(empty_cas.path()).await.unwrap();
-    let captured = transfer::capture(
-        &remote,
-        &empty_store,
-        None,
-        "capture-missing",
-        path("selected"),
+    assert_eq!(status.phase, TransferPhase::Failed);
+    assert_eq!(status.error.as_ref(), Some(&first));
+    let aborted = fs
+        .transfer_abort(&context(), operation("escape"))
+        .await
+        .unwrap();
+    assert_eq!(aborted.phase, TransferPhase::Failed);
+
+    // A source that changes after hashing fails the operation at read time.
+    std::fs::remove_file(root.join("tree/escape")).unwrap();
+    begin(
+        &fs,
+        "changed",
+        capture(path(&root, "tree"), TreeFilter::default()),
     )
     .await
     .unwrap();
-    assert_eq!(captured.entry, selection);
-    assert_eq!(captured.status.transferred_bytes, size);
-    assert!(empty_store.has_blob(&blob).await.unwrap());
+    advance_until(&fs, "changed", TransferPhase::Inventory)
+        .await
+        .unwrap();
+    std::fs::write(root.join("tree/z"), b"zz").unwrap();
+    let error = fs
+        .transfer_read(
+            &context(),
+            ReadTransferContentParams {
+                operation_id: id("changed"),
+                digest: digest(b"z"),
+                offset: 0,
+                max_bytes: 10,
+            },
+        )
+        .await
+        .unwrap_err();
+    assert!(matches!(
+        error.data,
+        ErrorData::Aborted {
+            reason: Some(AbortReason::SourceChanged)
+        }
+    ));
+    let error = fs
+        .transfer_commit(&context(), operation("changed"))
+        .await
+        .unwrap_err();
+    assert_eq!(error.kind(), ProtocolErrorKind::Aborted);
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn entries_outside_the_selection_never_fail_a_capture() {
+    let temp = tempfile::tempdir().unwrap();
+    let base = temp.path().canonicalize().unwrap();
+    let root = base.join("root");
+    std::fs::create_dir_all(root.join("tree/src")).unwrap();
+    std::fs::create_dir_all(root.join("tree/tmp")).unwrap();
+    std::fs::create_dir_all(base.join("outside")).unwrap();
+    std::fs::write(root.join("tree/src/lib.rs"), b"lib").unwrap();
+    let _socket = std::os::unix::net::UnixListener::bind(root.join("tree/tmp/sock")).unwrap();
+    symlink(base.join("outside"), root.join("tree/tmp/escape")).unwrap();
+    symlink("missing", root.join("tree/tmp/dangling")).unwrap();
+    let fs = filesystem(&root, false);
+
+    let filter = TreeFilter {
+        include: vec!["src/**".to_owned()],
+        ..TreeFilter::default()
+    };
+    begin(&fs, "selected", capture(path(&root, "tree"), filter))
+        .await
+        .unwrap();
+    let status = advance_until(&fs, "selected", TransferPhase::Inventory)
+        .await
+        .unwrap();
+    assert_eq!(status.skipped_entry_count, 0, "{:?}", status.skipped);
+    let entries = inventory(&fs, "selected").await;
     assert!(
-        largest.load(Ordering::Relaxed) < 512 * 1024,
-        "every JSON message remains bounded"
+        entries
+            .iter()
+            .any(|entry| entry.path.as_str() == "src/lib.rs")
     );
-    assert_eq!(
-        std::fs::read(environment.path().join("sibling")).unwrap(),
-        b"preserved"
+    assert!(
+        !entries
+            .iter()
+            .any(|entry| entry.path.as_str().starts_with("tmp/"))
     );
+
+    // The same entries fail a capture that selects them.
+    begin(
+        &fs,
+        "everything",
+        capture(path(&root, "tree"), TreeFilter::default()),
+    )
+    .await
+    .unwrap();
+    let error = advance_until(&fs, "everything", TransferPhase::Inventory)
+        .await
+        .unwrap_err();
+    assert!(matches!(
+        reason(&error),
+        Some(PreconditionReason::SymlinkRejected | PreconditionReason::NotRegularFile)
+    ));
 }
+
 #[tokio::test(flavor = "current_thread")]
-async fn inventories_are_paged_and_twenty_gib_files_do_not_block_begin_or_one_advance() {
+async fn skip_policies_report_what_a_capture_left_out() {
     let temp = tempfile::tempdir().unwrap();
-    std::fs::create_dir(temp.path().join("many")).unwrap();
-    for index in 0..300 {
-        std::fs::write(temp.path().join(format!("many/{index:04}")), b"same").unwrap();
-    }
-    let runtime = runtime(temp.path(), false);
-    let fs = runtime.filesystem();
-    fs.transfer(TransferRequest::Begin {
-        operation_id: "pages".into(),
-        selection: TransferSelection::Capture {
-            source: path("many"),
+    let root = temp.path().canonicalize().unwrap();
+    std::fs::create_dir_all(root.join("tree")).unwrap();
+    std::fs::write(root.join("tree/file"), b"f").unwrap();
+    symlink("file", root.join("tree/link")).unwrap();
+    let fs = filesystem(&root, false);
+    begin(
+        &fs,
+        "skips",
+        TransferSelection::Capture {
+            source: path(&root, "tree"),
+            filter: TreeFilter::default(),
+            symlinks: SymlinkPolicy::Skip,
+            special_files: SpecialFilePolicy::Skip,
         },
-        limits: Default::default(),
-    })
+    )
     .await
     .unwrap();
-    loop {
-        if let TransferResponse::Status(status) = fs
-            .transfer(TransferRequest::Advance {
-                operation_id: "pages".into(),
-            })
-            .await
-            .unwrap()
-            && status.phase == TransferPhase::Ready
-        {
-            break;
-        }
-    }
-    let mut offset = 0;
-    let mut count = 0;
-    loop {
-        let TransferResponse::Inventory {
-            entries,
-            next_offset,
-        } = fs
-            .transfer(TransferRequest::Inventory {
-                operation_id: "pages".into(),
-                offset,
-            })
-            .await
-            .unwrap()
-        else {
-            panic!()
-        };
-        assert!(entries.len() <= MAX_INVENTORY_PAGE);
-        count += entries.len();
-        if let Some(next) = next_offset {
-            offset = next;
-        } else {
-            break;
-        }
-    }
-    assert_eq!(count, 301);
-    let file = std::fs::File::create(temp.path().join("twenty-gib")).unwrap();
-    file.set_len(20 * 1024 * 1024 * 1024).unwrap();
-    let TransferResponse::Status(start) = fs
-        .transfer(TransferRequest::Begin {
-            operation_id: "large".into(),
-            selection: TransferSelection::Capture {
-                source: path("twenty-gib"),
-            },
-            limits: Default::default(),
-        })
+    let status = advance_until(&fs, "skips", TransferPhase::Inventory)
         .await
-        .unwrap()
-    else {
-        panic!()
-    };
-    assert_eq!(start.phase, TransferPhase::Scanning);
-    let TransferResponse::Status(step) = fs
-        .transfer(TransferRequest::Advance {
-            operation_id: "large".into(),
-        })
-        .await
-        .unwrap()
-    else {
-        panic!()
-    };
-    assert_eq!(step.phase, TransferPhase::Scanning);
-    fs.transfer(TransferRequest::Abort {
-        operation_id: "large".into(),
-    })
-    .await
-    .unwrap();
-    assert_eq!(file.metadata().unwrap().len(), 20 * 1024 * 1024 * 1024);
+        .unwrap();
+    assert_eq!(status.skipped_entry_count, 1);
+    assert_eq!(status.skipped[0].reason, TransferSkipReason::Symlink);
+    assert_eq!(
+        status.skipped[0].path.as_ref().map(TreePath::as_str),
+        Some("link")
+    );
 }
+
 #[tokio::test(flavor = "current_thread")]
-async fn scan_fingerprints_content_and_filters_large_unrelated_files() {
+async fn finished_operations_free_capacity_and_receipts_expire_from_completion() {
     let temp = tempfile::tempdir().unwrap();
-    std::fs::create_dir(temp.path().join("skills")).unwrap();
-    std::fs::write(temp.path().join("skills/SKILL.md"), b"first").unwrap();
-    std::fs::File::create(temp.path().join("skills/large"))
-        .unwrap()
-        .set_len(20 * 1024 * 1024 * 1024)
+    let root = temp.path().canonicalize().unwrap();
+    std::fs::write(root.join("file"), b"x").unwrap();
+    let fs = filesystem(&root, false);
+    // Twice the active ceiling of eight, each finished before the next.
+    for index in 0..16 {
+        let name = format!("done-{index}");
+        begin(
+            &fs,
+            &name,
+            capture(path(&root, "file"), TreeFilter::default()),
+        )
+        .await
         .unwrap();
-    let runtime = runtime(temp.path(), true);
-    let fs = runtime.filesystem();
-    let mut query = ScanParams {
-        follow_symlinks: false,
-        roots: vec![path("skills")],
-        include_patterns: vec!["**/SKILL.md".into(), "SKILL.md".into()],
-        read_content: true,
-        digest_algorithm: None,
-        limits: Default::default(),
-        if_none_match: None,
-    };
-    let first = fs.scan(query.clone()).await.unwrap();
-    assert!(first.complete);
-    assert_eq!(first.entries.len(), 1);
-    query.if_none_match = first.fingerprint;
-    assert!(fs.scan(query.clone()).await.unwrap().unchanged);
-    std::fs::write(temp.path().join("skills/SKILL.md"), b"other").unwrap();
-    assert!(!fs.scan(query.clone()).await.unwrap().unchanged);
-    query.roots.push(path("missing"));
-    let absent = fs.scan(query).await.unwrap();
-    assert!(absent.complete);
-    assert!(!absent.unchanged);
-    assert!(absent.diagnostics.is_empty());
-    let metadata = fs
-        .scan(ScanParams {
-            follow_symlinks: false,
-            roots: vec![path("skills/large")],
-            include_patterns: vec![],
-            read_content: false,
-            digest_algorithm: None,
-            limits: Default::default(),
-            if_none_match: None,
-        })
+        advance_until(&fs, &name, TransferPhase::Inventory)
+            .await
+            .unwrap();
+        fs.transfer_commit(&context(), operation(&name))
+            .await
+            .unwrap();
+    }
+    for index in 0..8 {
+        begin(
+            &fs,
+            &format!("active-{index}"),
+            capture(path(&root, "file"), TreeFilter::default()),
+        )
         .await
         .unwrap();
-    assert!(metadata.complete);
+    }
+    let error = begin(
+        &fs,
+        "one-more",
+        capture(path(&root, "file"), TreeFilter::default()),
+    )
+    .await
+    .unwrap_err();
     assert!(matches!(
-        metadata.entries[0].content,
-        ScanContent::File {
-            digest: None,
-            size_bytes: 21_474_836_480,
+        error.data,
+        ErrorData::Busy {
+            reason: Some(BusyReason::TransferCapacity),
             ..
         }
     ));
-    let hashed = fs
-        .scan(ScanParams {
-            follow_symlinks: false,
-            roots: vec![path("skills/SKILL.md")],
-            include_patterns: vec![],
-            read_content: false,
-            digest_algorithm: Some(ScanDigestAlgorithm::Sha256),
-            limits: Default::default(),
-            if_none_match: None,
-        })
+    fs.transfer_abort(&context(), operation("active-0"))
         .await
         .unwrap();
-    assert!(hashed.complete);
-    assert!(
-        matches!(&hashed.entries[0].content,ScanContent::File {digest:Some(digest),..} if digest==BlobRef::from_bytes(b"other").as_str())
-    );
+    begin(
+        &fs,
+        "one-more",
+        capture(path(&root, "file"), TreeFilter::default()),
+    )
+    .await
+    .unwrap();
 }
-#[tokio::test(flavor = "current_thread")]
-async fn rpc_materialize_creates_missing_parents_for_files_and_trees() {
-    let environment = tempfile::tempdir().unwrap();
-    std::fs::write(environment.path().join("sibling"), b"preserved").unwrap();
-    let (remote, _, _) = remote(runtime(environment.path(), false));
-    let store = harness::storage::InMemoryBlobStore::new();
-    let entry = vfs::VfsEntry::File(vfs::VfsFile {
-        blob_ref: store.put_bytes(b"content".to_vec()).await.unwrap(),
-        size_bytes: 7,
-        executable: true,
-        media_type: None,
-    });
-    let mut directory = vfs::VfsDirectory::default();
-    directory.entries.insert("file".into(), entry.clone());
-    for (id, entry, on_existing) in [
-        ("file", entry, TransferOnExisting::Error),
-        (
-            "tree",
-            vfs::VfsEntry::Directory(directory),
-            TransferOnExisting::Replace,
-        ),
-    ] {
-        let destination = path(&format!("created/{id}/nested/selected"));
-        let status = transfer::materialize(
-            &remote,
-            &store,
-            id,
-            &entry,
-            destination.clone(),
-            on_existing,
+
+async fn append_all(fs: &LocalFileSystem, operation_id: &str, entries: Vec<InventoryEntry>) {
+    let status = fs
+        .transfer_append(
+            &context(),
+            AppendTransferInventoryParams {
+                operation_id: id(operation_id),
+                index: 0,
+                entries,
+                last: true,
+            },
         )
         .await
         .unwrap();
-        assert_eq!(status.phase, TransferPhase::Complete);
-        let captured =
-            transfer::capture(&remote, &store, None, &format!("capture-{id}"), destination)
-                .await
-                .unwrap();
-        assert_eq!(captured.entry, entry);
+    assert_eq!(status.phase, TransferPhase::Scanning);
+}
+
+fn file_entry(path: &str, bytes: &[u8], executable: bool) -> InventoryEntry {
+    InventoryEntry {
+        path: TreePath::new(path).unwrap(),
+        content: TreeContent::File {
+            size_bytes: bytes.len() as u64,
+            executable,
+            digest: Some(digest(bytes)),
+        },
+    }
+}
+
+fn directory_entry(path: &str) -> InventoryEntry {
+    InventoryEntry {
+        path: TreePath::new(path).unwrap(),
+        content: TreeContent::Directory {},
     }
-    assert_eq!(
-        std::fs::read(environment.path().join("sibling")).unwrap(),
-        b"preserved"
-    );
 }
 
 #[tokio::test(flavor = "current_thread")]
-async fn secure_replacement_rejects_links_and_uses_private_staging_without_reading_write_only_targets()
- {
+async fn materialize_reuses_matching_destination_files_and_publishes_atomically() {
     let temp = tempfile::tempdir().unwrap();
-    let outside = tempfile::tempdir().unwrap();
-    std::fs::write(outside.path().join("secret"), b"untouched").unwrap();
-    symlink(outside.path(), temp.path().join("escape")).unwrap();
-    symlink("absent", temp.path().join("dangling")).unwrap();
-    std::fs::write(temp.path().join("blocked"), b"not a directory").unwrap();
-    let read_only = runtime(temp.path(), true);
-    let runtime = runtime(temp.path(), false);
-    let fs = runtime.filesystem();
-    for (index, destination) in [
-        "escape/secret",
-        "escape/missing/secret",
-        "dangling/missing/secret",
-        "blocked/missing/secret",
-    ]
-    .into_iter()
-    .enumerate()
-    {
-        assert_eq!(
-            fs.transfer(TransferRequest::Begin {
-                operation_id: format!("invalid-parent-{index}"),
-                selection: TransferSelection::Materialize {
-                    destination: path(destination),
-                    on_existing: TransferOnExisting::Replace
-                },
-                limits: Default::default()
-            })
-            .await
-            .unwrap_err()
-            .code,
-            EnvironmentProtocolErrorCode::Forbidden
-        );
-    }
-    assert!(!outside.path().join("missing").exists());
-    assert!(!temp.path().join("absent").exists());
-    assert_eq!(
-        std::fs::read(outside.path().join("secret")).unwrap(),
-        b"untouched"
-    );
-    assert_eq!(
-        std::fs::read(temp.path().join("blocked")).unwrap(),
-        b"not a directory"
-    );
-    assert_eq!(
-        read_only
-            .filesystem()
-            .transfer(TransferRequest::Begin {
-                operation_id: "read-only-parents".into(),
-                selection: TransferSelection::Materialize {
-                    destination: path("read-only/missing/target"),
-                    on_existing: TransferOnExisting::Replace
-                },
-                limits: Default::default()
-            })
-            .await
-            .unwrap_err()
-            .code,
-        EnvironmentProtocolErrorCode::CapabilityUnavailable
-    );
-    assert!(!temp.path().join("read-only").exists());
-    std::fs::write(temp.path().join("target"), b"old").unwrap();
-    std::fs::set_permissions(
-        temp.path().join("target"),
-        std::fs::Permissions::from_mode(0o200),
+    let root = temp.path().canonicalize().unwrap();
+    std::fs::create_dir_all(root.join("target/old")).unwrap();
+    std::fs::write(root.join("target/old/kept"), b"reused bytes").unwrap();
+    std::fs::write(root.join("target/unrelated"), vec![7u8; 100_000]).unwrap();
+    let fs = filesystem(&root, true);
+
+    let error = begin(
+        &fs,
+        "refused",
+        TransferSelection::Materialize {
+            destination: path(&root, "target"),
+            on_existing: TransferOnExisting::Error,
+        },
     )
-    .unwrap();
-    fs.transfer(TransferRequest::Begin {
-        operation_id: "private".into(),
-        selection: TransferSelection::Materialize {
-            destination: path("target"),
+    .await
+    .unwrap_err();
+    assert_eq!(error.kind(), ProtocolErrorKind::AlreadyExists);
+
+    begin(
+        &fs,
+        "tree",
+        TransferSelection::Materialize {
+            destination: path(&root, "target"),
             on_existing: TransferOnExisting::Replace,
         },
-        limits: Default::default(),
-    })
+    )
     .await
     .unwrap();
-    for entry in std::fs::read_dir(temp.path()).unwrap() {
-        let entry = entry.unwrap();
-        if entry
-            .file_name()
-            .to_string_lossy()
-            .starts_with(".env-transfer-")
-        {
-            assert_eq!(
-                entry.metadata().unwrap().permissions().mode() & 0o777,
-                0o700
-            );
-        }
-    }
-    assert_eq!(
-        fs.transfer(TransferRequest::Begin {
-            operation_id: "overlap".into(),
-            selection: TransferSelection::Materialize {
-                destination: path("target/nested"),
-                on_existing: TransferOnExisting::Replace
+    // A file entry without its digest is refused and changes nothing.
+    let error = fs
+        .transfer_append(
+            &context(),
+            AppendTransferInventoryParams {
+                operation_id: id("tree"),
+                index: 0,
+                entries: vec![
+                    directory_entry("."),
+                    InventoryEntry {
+                        path: TreePath::new("bad").unwrap(),
+                        content: TreeContent::File {
+                            size_bytes: 1,
+                            executable: false,
+                            digest: None,
+                        },
+                    },
+                ],
+                last: true,
             },
-            limits: Default::default()
-        })
+        )
         .await
-        .unwrap_err()
-        .code,
-        EnvironmentProtocolErrorCode::Conflict
-    );
-    fs.transfer(TransferRequest::Abort {
-        operation_id: "private".into(),
-    })
-    .await
-    .unwrap();
-    let (remote, _, _) = remote(runtime.clone());
-    let store = harness::storage::InMemoryBlobStore::new();
-    let blob = store.put_bytes(b"new".to_vec()).await.unwrap();
-    let entry = vfs::VfsEntry::File(vfs::VfsFile {
-        blob_ref: blob,
-        size_bytes: 3,
-        executable: false,
-        media_type: None,
-    });
-    transfer::materialize(
-        &remote,
-        &store,
-        "write-only",
-        &entry,
-        path("target"),
-        TransferOnExisting::Replace,
+        .unwrap_err();
+    assert!(matches!(
+        &error.data,
+        ErrorData::InvalidParams { field: Some(field), .. } if field == "entries[1].content.digest"
+    ));
+    let uploaded = b"uploaded content".to_vec();
+    append_all(
+        &fs,
+        "tree",
+        vec![
+            directory_entry("."),
+            directory_entry("bin"),
+            file_entry("bin/run", &uploaded, true),
+            file_entry("copy", b"reused bytes", false),
+            file_entry("empty", b"", false),
+        ],
     )
-    .await
-    .unwrap();
-    assert_eq!(std::fs::read(temp.path().join("target")).unwrap(), b"new");
+    .await;
+    advance_until(&fs, "tree", TransferPhase::Content)
+        .await
+        .unwrap();
+    let missing = fs
+        .transfer_list_missing(
+            &context(),
+            ListTransferMissingParams {
+                operation_id: id("tree"),
+                limit: 10,
+            },
+        )
+        .await
+        .unwrap();
+    assert_eq!(missing.digests, [digest(&uploaded)]);
+    assert_eq!(missing.remaining_count, 0);
+    let write = |offset: u64, data: &[u8]| WriteTransferContentParams {
+        operation_id: id("tree"),
+        digest: digest(&uploaded),
+        offset,
+        data: data.into(),
+    };
+    let next = fs
+        .transfer_write(&context(), write(0, &uploaded[..8]))
+        .await
+        .unwrap()
+        .next_offset;
+    assert_eq!(next, 8);
+    // An identical repeat is accepted; a gap is refused without failing.
     assert_eq!(
-        std::fs::read(outside.path().join("secret")).unwrap(),
-        b"untouched"
+        fs.transfer_write(&context(), write(0, &uploaded[..8]))
+            .await
+            .unwrap()
+            .next_offset,
+        8
     );
-    transfer::materialize(
-        &remote,
-        &store,
-        "to-directory",
-        &vfs::VfsEntry::Directory(vfs::VfsDirectory::default()),
-        path("target"),
-        TransferOnExisting::Replace,
-    )
-    .await
-    .unwrap();
-    assert!(temp.path().join("target").is_dir());
-    transfer::materialize(
-        &remote,
-        &store,
-        "back-to-file",
-        &entry,
-        path("target"),
-        TransferOnExisting::Replace,
+    let error = fs
+        .transfer_write(&context(), write(10, &uploaded[10..]))
+        .await
+        .unwrap_err();
+    assert_eq!(reason(&error), Some(PreconditionReason::TransferOffset));
+    fs.transfer_write(&context(), write(8, &uploaded[8..]))
+        .await
+        .unwrap();
+    let ready = advance_until(&fs, "tree", TransferPhase::Ready)
+        .await
+        .unwrap();
+    assert_eq!(ready.reused_bytes, b"reused bytes".len() as u64);
+    fs.transfer_commit(&context(), operation("tree"))
+        .await
+        .unwrap();
+    assert_eq!(
+        std::fs::read(root.join("target/bin/run")).unwrap(),
+        uploaded
+    );
+    assert_eq!(
+        std::fs::read(root.join("target/copy")).unwrap(),
+        b"reused bytes"
+    );
+    assert!(root.join("target/empty").exists());
+    assert!(!root.join("target/unrelated").exists());
+    use std::os::unix::fs::PermissionsExt;
+    let mode = std::fs::metadata(root.join("target/bin/run"))
+        .unwrap()
+        .permissions()
+        .mode();
+    assert_eq!(mode & 0o111, 0o111);
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn a_digest_mismatch_fails_the_operation() {
+    let temp = tempfile::tempdir().unwrap();
+    let root = temp.path().canonicalize().unwrap();
+    let fs = filesystem(&root, true);
+    begin(
+        &fs,
+        "mismatch",
+        TransferSelection::Materialize {
+            destination: path(&root, "out"),
+            on_existing: TransferOnExisting::Replace,
+        },
     )
     .await
     .unwrap();
-
-    let capture = fs
-        .transfer(TransferRequest::Begin {
-            operation_id: "observe".into(),
-            selection: TransferSelection::Capture {
-                source: path("target"),
-            },
-            limits: Default::default(),
-        })
+    append_all(&fs, "mismatch", vec![file_entry(".", b"expected", false)]).await;
+    advance_until(&fs, "mismatch", TransferPhase::Content)
         .await
         .unwrap();
-    assert!(matches!(capture, TransferResponse::Status(_)));
-    loop {
-        if let TransferResponse::Status(status) = fs
-            .transfer(TransferRequest::Advance {
-                operation_id: "observe".into(),
-            })
-            .await
-            .unwrap()
-            && status.phase == TransferPhase::Ready
-        {
-            break;
-        }
-    }
-    std::fs::write(temp.path().join("target"), b"changed").unwrap();
-    assert_eq!(
-        fs.transfer(TransferRequest::Commit {
-            operation_id: "observe".into()
-        })
+    let error = fs
+        .transfer_write(
+            &context(),
+            WriteTransferContentParams {
+                operation_id: id("mismatch"),
+                digest: digest(b"expected"),
+                offset: 0,
+                data: b"tampered".as_slice().into(),
+            },
+        )
         .await
-        .unwrap_err()
-        .code,
-        EnvironmentProtocolErrorCode::Conflict
-    );
+        .unwrap_err();
+    assert_eq!(reason(&error), Some(PreconditionReason::DigestMismatch));
+    let status = fs
+        .transfer_get_status(&context(), operation("mismatch"))
+        .await
+        .unwrap();
+    assert_eq!(status.phase, TransferPhase::Failed);
+    assert!(!root.join("out").exists());
 }
 
 #[tokio::test(flavor = "current_thread")]
-async fn persisted_receipts_survive_restart_and_interrupted_operations_fail_closed() {
+async fn transfer_write_file_follows_fs_write_file_semantics() {
     let temp = tempfile::tempdir().unwrap();
-    let cas = tempfile::tempdir().unwrap();
-    let store = store_fs::FsBlobStore::open(cas.path()).await.unwrap();
-    let blob = store.put_bytes(b"content".to_vec()).await.unwrap();
-    let entry = vfs::VfsEntry::File(vfs::VfsFile {
-        blob_ref: blob,
-        size_bytes: 7,
+    let root = temp.path().canonicalize().unwrap();
+    std::fs::write(root.join("target"), b"old").unwrap();
+    symlink("target", root.join("link")).unwrap();
+    let fs = filesystem(&root, true);
+    let selection = |create: WriteCondition| TransferSelection::WriteFile {
+        destination: path(&root, "link"),
+        create,
+        if_match: None,
         executable: false,
-        media_type: None,
-    });
-    {
-        let (remote, _, _) = remote(runtime(temp.path(), false));
-        transfer::materialize(
-            &remote,
-            &store,
-            "completed",
-            &entry,
-            path("target"),
-            TransferOnExisting::Replace,
-        )
+    };
+    let error = begin(&fs, "absent", selection(WriteCondition::IfAbsent))
+        .await
+        .unwrap_err();
+    assert_eq!(reason(&error), Some(PreconditionReason::CreateCondition));
+    begin(&fs, "write", selection(WriteCondition::IfPresent))
         .await
         .unwrap();
-        transfer::capture(&remote, &store, None, "captured", path("target"))
-            .await
-            .unwrap();
-        use tools::transfer::EnvironmentTransfer;
-        remote
-            .request(TransferRequest::Begin {
-                operation_id: "interrupted".into(),
-                selection: TransferSelection::Materialize {
-                    destination: path("target"),
-                    on_existing: TransferOnExisting::Replace,
-                },
-                limits: Default::default(),
-            })
-            .await
-            .unwrap();
-    }
-    std::fs::write(temp.path().join("target"), b"later edit").unwrap();
-    let (remote, _, _) = remote(runtime(temp.path(), false));
-    let receipt = transfer::materialize(
-        &remote,
-        &store,
-        "completed",
-        &entry,
-        path("target"),
-        TransferOnExisting::Replace,
+    append_all(&fs, "write", vec![file_entry(".", b"new content", false)]).await;
+    advance_until(&fs, "write", TransferPhase::Content)
+        .await
+        .unwrap();
+    fs.transfer_write(
+        &context(),
+        WriteTransferContentParams {
+            operation_id: id("write"),
+            digest: digest(b"new content"),
+            offset: 0,
+            data: b"new content".as_slice().into(),
+        },
     )
     .await
     .unwrap();
-    assert_eq!(receipt.phase, TransferPhase::Complete);
-    assert_eq!(
-        std::fs::read(temp.path().join("target")).unwrap(),
-        b"later edit"
-    );
-    let capture = transfer::capture(&remote, &store, None, "captured", path("target"))
+    advance_until(&fs, "write", TransferPhase::Ready)
         .await
         .unwrap();
-    assert_eq!(capture.entry, entry);
-    assert!(
-        transfer::materialize(
-            &remote,
-            &store,
-            "interrupted",
-            &entry,
-            path("target"),
-            TransferOnExisting::Replace
-        )
+    fs.transfer_commit(&context(), operation("write"))
         .await
-        .is_err()
-    );
-    assert_eq!(
-        std::fs::read(temp.path().join("target")).unwrap(),
-        b"later edit"
+        .unwrap();
+    assert_eq!(std::fs::read(root.join("target")).unwrap(), b"new content");
+    assert!(
+        std::fs::symlink_metadata(root.join("link"))
+            .unwrap()
+            .file_type()
+            .is_symlink()
     );
 }
+
 #[tokio::test(flavor = "current_thread")]
-async fn bad_chunks_invalid_manifests_and_read_only_requests_never_publish() {
+async fn read_only_daemons_refuse_publishes() {
     let temp = tempfile::tempdir().unwrap();
-    std::fs::write(temp.path().join("old"), b"keep").unwrap();
-    let runtime = runtime(temp.path(), false);
-    let fs = runtime.filesystem();
-    fs.transfer(TransferRequest::Begin {
-        operation_id: "invalid".into(),
-        selection: TransferSelection::Materialize {
-            destination: path("old"),
+    let root = temp.path().canonicalize().unwrap();
+    let fs = filesystem(&root, false);
+    let error = begin(
+        &fs,
+        "denied",
+        TransferSelection::Materialize {
+            destination: path(&root, "out"),
             on_existing: TransferOnExisting::Replace,
         },
-        limits: Default::default(),
-    })
+    )
     .await
-    .unwrap();
-    loop {
-        if let TransferResponse::Status(status) = fs
-            .transfer(TransferRequest::Advance {
-                operation_id: "invalid".into(),
-            })
-            .await
-            .unwrap()
-            && status.phase == TransferPhase::Inventory
-        {
-            break;
-        }
-    }
-    let digest = BlobRef::from_bytes(b"new").to_string();
-    let file = |path: &str| InventoryEntry {
-        path: path.into(),
-        content: InventoryContent::File {
-            size_bytes: 3,
-            executable: false,
-            digest: digest.clone(),
-        },
+    .unwrap_err();
+    assert_eq!(error.kind(), ProtocolErrorKind::CapabilityUnavailable);
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn a_restart_fails_active_operations_and_discards_their_staging() {
+    let temp = tempfile::tempdir().unwrap();
+    let root = temp.path().canonicalize().unwrap();
+    let selection = TransferSelection::Materialize {
+        destination: path(&root, "out"),
+        on_existing: TransferOnExisting::Replace,
     };
-    for bad in ["../escape", "/absolute", "a//b", "a/../b", "a\\b"] {
-        assert_eq!(
-            fs.transfer(TransferRequest::Append {
-                operation_id: "invalid".into(),
-                offset: 0,
-                entries: vec![file(bad)],
-                last: true
-            })
-            .await
-            .unwrap_err()
-            .code,
-            EnvironmentProtocolErrorCode::InvalidRequest
-        );
+    {
+        let fs = filesystem(&root, true);
+        begin(&fs, "interrupted", selection.clone()).await.unwrap();
+        let staged = std::fs::read_dir(&root).unwrap().flatten().any(|entry| {
+            entry
+                .file_name()
+                .to_string_lossy()
+                .starts_with(".lightspeed-transfer-")
+        });
+        assert!(staged);
     }
-    let page = TransferRequest::Append {
-        operation_id: "invalid".into(),
-        offset: 0,
-        entries: vec![file("")],
-        last: true,
-    };
-    fs.transfer(page.clone()).await.unwrap();
-    fs.transfer(page).await.unwrap();
-    assert_eq!(
-        fs.transfer(TransferRequest::Write {
-            operation_id: "invalid".into(),
-            digest: digest.clone(),
-            offset: 0,
-            data: vec![0; MAX_CONTENT_CHUNK + 1].into()
-        })
+    let fs = filesystem(&root, true);
+    let status = fs
+        .transfer_get_status(&context(), operation("interrupted"))
         .await
-        .unwrap_err()
-        .code,
-        EnvironmentProtocolErrorCode::InvalidRequest
-    );
+        .unwrap();
+    assert_eq!(status.phase, TransferPhase::Failed);
     assert_eq!(
-        fs.transfer(TransferRequest::Write {
-            operation_id: "invalid".into(),
-            digest: digest.clone(),
-            offset: 0,
-            data: b"bad".as_slice().into()
-        })
-        .await
-        .unwrap_err()
-        .code,
-        EnvironmentProtocolErrorCode::Conflict
-    );
-    assert_eq!(std::fs::read(temp.path().join("old")).unwrap(), b"keep");
-    let chunk = TransferRequest::Write {
-        operation_id: "invalid".into(),
-        digest,
-        offset: 0,
-        data: b"new".as_slice().into(),
-    };
-    fs.transfer(chunk.clone()).await.unwrap();
-    fs.transfer(chunk).await.unwrap();
-    fs.transfer(TransferRequest::Abort {
-        operation_id: "invalid".into(),
-    })
+        status.error.as_ref().map(ProtocolError::kind),
+        Some(ProtocolErrorKind::Aborted)
+    );
+    let error = begin(&fs, "interrupted", selection).await.unwrap_err();
+    assert_eq!(error.kind(), ProtocolErrorKind::Aborted);
+    // Staging cleanup of the dropped instance and recovery both remove it.
+    for _ in 0..100 {
+        let staged = std::fs::read_dir(&root).unwrap().flatten().any(|entry| {
+            entry
+                .file_name()
+                .to_string_lossy()
+                .starts_with(".lightspeed-transfer-")
+        });
+        if !staged {
+            return;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(10));
+    }
+    panic!("staging survived the restart");
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn operations_fail_when_their_duration_runs_out() {
+    let temp = tempfile::tempdir().unwrap();
+    let root = temp.path().canonicalize().unwrap();
+    std::fs::write(root.join("file"), b"x").unwrap();
+    let fs = filesystem(&root, false);
+    fs.transfer_begin(
+        &context(),
+        BeginTransferParams {
+            operation_id: id("short"),
+            selection: capture(path(&root, "file"), TreeFilter::default()),
+            limits: TransferLimits {
+                max_duration_ms: 1,
+                ..limits()
+            },
+        },
+    )
     .await
     .unwrap();
-    assert_eq!(
-        fs.transfer(TransferRequest::Commit {
-            operation_id: "invalid".into()
-        })
+    std::thread::sleep(std::time::Duration::from_millis(5));
+    let error = fs
+        .transfer_advance(&context(), operation("short"))
         .await
-        .unwrap_err()
-        .code,
-        EnvironmentProtocolErrorCode::Conflict
-    );
-    let read_only = crate::server::streaming_transfer_tests::runtime(temp.path(), true);
-    assert_eq!(
-        read_only
-            .filesystem()
-            .transfer(TransferRequest::Begin {
-                operation_id: "denied".into(),
-                selection: TransferSelection::Materialize {
-                    destination: path("old"),
-                    on_existing: TransferOnExisting::Replace
-                },
-                limits: Default::default()
-            })
-            .await
-            .unwrap_err()
-            .code,
-        EnvironmentProtocolErrorCode::CapabilityUnavailable
-    );
-    assert_eq!(std::fs::read(temp.path().join("old")).unwrap(), b"keep");
+        .unwrap_err();
+    assert_eq!(error.kind(), ProtocolErrorKind::DeadlineExceeded);
+    let status = fs
+        .transfer_get_status(&context(), operation("short"))
+        .await
+        .unwrap();
+    assert_eq!(status.phase, TransferPhase::Failed);
 }
 
 #[tokio::test(flavor = "current_thread")]
-async fn configured_cwd_aliases_work_under_the_host_root() {
+async fn a_retried_sealing_append_answers_the_status() {
     let temp = tempfile::tempdir().unwrap();
-    let alias = temp.path().join("cwd-alias");
-    let actual = temp.path().join("actual");
-    std::fs::create_dir(&actual).unwrap();
-    symlink(&actual, &alias).unwrap();
-    std::fs::write(actual.join("file"), b"bytes").unwrap();
-    let fs = crate::filesystem::LocalFileSystem::new(Path::new("/").into(), alias, true);
-    let result = fs
-        .scan(ScanParams {
-            follow_symlinks: false,
-            roots: vec![path("file")],
-            include_patterns: vec![],
-            read_content: true,
-            digest_algorithm: None,
-            limits: Default::default(),
-            if_none_match: None,
-        })
+    let root = temp.path().canonicalize().unwrap();
+    let fs = filesystem(&root, true);
+    begin(
+        &fs,
+        "sealed",
+        TransferSelection::Materialize {
+            destination: path(&root, "out"),
+            on_existing: TransferOnExisting::Replace,
+        },
+    )
+    .await
+    .unwrap();
+    let entries = vec![directory_entry("."), file_entry("file", b"bytes", false)];
+    append_all(&fs, "sealed", entries.clone()).await;
+    // The response to the sealing page was lost; the client sends it again.
+    let retried = fs
+        .transfer_append(
+            &context(),
+            AppendTransferInventoryParams {
+                operation_id: id("sealed"),
+                index: 0,
+                entries,
+                last: true,
+            },
+        )
         .await
         .unwrap();
-    assert!(result.complete, "{:?}", result.diagnostics);
-    assert_eq!(
-        result.entries[0].data.as_ref().unwrap().as_slice(),
-        b"bytes"
-    );
-    symlink(&actual, actual.join("user-link")).unwrap();
-    let result = fs
-        .scan(ScanParams {
-            follow_symlinks: false,
-            roots: vec![path("user-link/file")],
-            include_patterns: vec![],
-            read_content: true,
-            digest_algorithm: None,
-            limits: Default::default(),
-            if_none_match: None,
-        })
+    assert_ne!(retried.phase, TransferPhase::Inventory);
+    assert_eq!(retried.entry_count, 2);
+    let error = fs
+        .transfer_append(
+            &context(),
+            AppendTransferInventoryParams {
+                operation_id: id("sealed"),
+                index: 0,
+                entries: vec![directory_entry(".")],
+                last: true,
+            },
+        )
         .await
-        .unwrap();
-    assert!(!result.complete, "user-selected symlinks remain rejected");
+        .unwrap_err();
+    assert_eq!(reason(&error), Some(PreconditionReason::TransferPhase));
 }
 
 #[tokio::test(flavor = "current_thread")]
-async fn scan_installer_layouts_aliases_collisions_and_semantic_publication() {
-    use tools::skills::environment::*;
+async fn a_refused_begin_and_an_abort_leave_no_created_directories() {
     let temp = tempfile::tempdir().unwrap();
     let root = temp.path().canonicalize().unwrap();
-    let home = root.join("home");
-    let cwd = root.join("project/subdir");
-    let canonical = root.join("installed/review");
-    for directory in [
-        &home,
-        &cwd,
-        &canonical,
-        &root.join("project/.agents/skills"),
-        &home.join(".codex/skills/copy"),
-    ] {
-        std::fs::create_dir_all(directory).unwrap();
-    }
-    let doc = "---\nname: review\ndescription: >-\n  Review code\n  carefully.\nmetadata:\n  hooks: [ignored]\n---\nbody one";
-    std::fs::write(canonical.join("SKILL.md"), doc).unwrap();
-    std::fs::write(home.join(".codex/skills/copy/SKILL.md"), doc).unwrap();
-    symlink(&canonical, root.join("project/.agents/skills/review")).unwrap();
-    symlink(&canonical, root.join("project/.agents/skills/alias")).unwrap();
-    let config = harness::EnvironmentSkillsConfig {
-        roots: Some(vec![
-            root.join("project/.agents/skills")
-                .to_string_lossy()
-                .into_owned(),
-            home.join(".codex/skills").to_string_lossy().into_owned(),
-        ]),
+    let fs = filesystem(&root, true);
+    let materialize = |destination: &str| TransferSelection::Materialize {
+        destination: path(&root, destination),
+        on_existing: TransferOnExisting::Replace,
     };
-    let runtime = runtime(&root, true);
-    let mut query = environment_skill_scan_query(&config, cwd.to_str(), home.to_str()).unwrap();
-    let first = runtime.filesystem().scan(query.clone()).await.unwrap();
-    assert!(first.complete, "{:?}", first.diagnostics);
-    let catalog = environment_skill_catalog("machine-a", &first).unwrap();
-    assert_eq!(
-        catalog.skills.len(),
-        2,
-        "aliases collapse but independent copies remain"
-    );
-    assert!(
-        catalog
-            .skills
-            .iter()
-            .all(|skill| skill.description == "Review code carefully.")
-    );
-    assert_ne!(catalog.skills[0].skill_id, catalog.skills[1].skill_id);
-    let other = environment_skill_catalog("machine-b", &first).unwrap();
-    assert_ne!(catalog.skills[0].skill_id, other.skills[0].skill_id);
-    query.if_none_match = first.fingerprint;
-    assert!(
-        runtime
-            .filesystem()
-            .scan(query.clone())
-            .await
-            .unwrap()
-            .unchanged
-    );
-    std::fs::write(canonical.join("SKILL.md"), doc.replace("one", "two")).unwrap();
-    let body_edit = runtime.filesystem().scan(query.clone()).await.unwrap();
-    assert!(!body_edit.unchanged);
-    assert_eq!(
-        catalog,
-        environment_skill_catalog("machine-a", &body_edit).unwrap()
-    );
-    assert!(
-        String::from_utf8(std::fs::read(canonical.join("SKILL.md")).unwrap())
-            .unwrap()
-            .ends_with("body two")
-    );
-    let blobs = harness::storage::InMemoryBlobStore::new();
-    let Some(harness::CoreAgentCommand::UpsertContext { entry, .. }) =
-        publish_environment_skill_catalog(&blobs, None, &catalog)
-            .await
-            .unwrap()
-    else {
-        panic!("publication");
-    };
-    assert!(
-        publish_environment_skill_catalog(
-            &blobs,
-            Some(&entry),
-            &environment_skill_catalog("machine-a", &body_edit).unwrap()
-        )
+    begin(&fs, "outer", materialize("a/b")).await.unwrap();
+    assert!(root.join("a").is_dir(), "begin creates missing parents");
+    let error = begin(&fs, "inner", materialize("a/b/c/d"))
         .await
-        .unwrap()
-        .is_none()
-    );
-    let prefix = blobs.read_bytes(&entry.content.content_ref).await.unwrap();
-    std::fs::write(
-        canonical.join("SKILL.md"),
-        doc.replace("carefully", "thoroughly"),
-    )
-    .unwrap();
-    let edited = runtime.filesystem().scan(query.clone()).await.unwrap();
+        .unwrap_err();
+    assert!(matches!(
+        error.data,
+        ErrorData::Busy {
+            reason: Some(BusyReason::TransferCapacity),
+            ..
+        }
+    ));
     assert!(
-        publish_environment_skill_catalog(
-            &blobs,
-            Some(&entry),
-            &environment_skill_catalog("machine-a", &edited).unwrap()
-        )
-        .await
-        .unwrap()
-        .is_some()
-    );
-    assert_eq!(
-        blobs.read_bytes(&entry.content.content_ref).await.unwrap(),
-        prefix
-    );
-    std::fs::remove_file(canonical.join("SKILL.md")).unwrap();
-    let removed = runtime.filesystem().scan(query.clone()).await.unwrap();
-    assert_eq!(
-        environment_skill_catalog("machine-a", &removed)
-            .unwrap()
-            .skills
-            .len(),
-        1
+        !root.join("a/b").exists(),
+        "a refused begin changes nothing"
     );
-    std::fs::write(
-        canonical.join("SKILL.md"),
-        "---\nname: broken\ndescription: [invalid]\n---",
-    )
-    .unwrap();
-    let invalid = environment_skill_catalog(
-        "machine-a",
-        &runtime.filesystem().scan(query).await.unwrap(),
-    )
-    .unwrap();
-    assert_eq!(invalid.skills.len(), 1);
-    assert_eq!(invalid.warnings.len(), 1);
+
+    fs.transfer_abort(&context(), operation("outer"))
+        .await
+        .unwrap();
+    for _ in 0..100 {
+        if !root.join("a").exists() {
+            return;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(10));
+    }
+    panic!("the aborted begin's parent directory survived");
 }
 
 #[tokio::test(flavor = "current_thread")]
-async fn scan_retarget_scope_loops_and_aggregate_limits_are_explicit() {
+async fn a_receipt_names_its_staging_until_removal_is_confirmed() {
+    use super::journal::{self, Record, StageRecord};
+
     let temp = tempfile::tempdir().unwrap();
-    let outside = tempfile::tempdir().unwrap();
-    for name in ["one", "two"] {
-        std::fs::create_dir(temp.path().join(name)).unwrap();
-        std::fs::write(temp.path().join(name).join("SKILL.md"), "same").unwrap();
-    }
-    symlink(temp.path().join("one"), temp.path().join("alias")).unwrap();
-    let runtime = runtime(temp.path(), true);
-    let mut query = ScanParams {
-        roots: vec![path("alias")],
-        include_patterns: vec!["**/SKILL.md".into(), "SKILL.md".into()],
-        read_content: true,
-        follow_symlinks: true,
-        digest_algorithm: Some(ScanDigestAlgorithm::Sha256),
-        limits: InventoryLimits::default(),
-        if_none_match: None,
+    let root = temp.path().canonicalize().unwrap();
+    let selection = TransferSelection::Materialize {
+        destination: path(&root, "out"),
+        on_existing: TransferOnExisting::Replace,
     };
-    let first = runtime.filesystem().scan(query.clone()).await.unwrap();
-    assert!(first.complete);
-    query.if_none_match = first.fingerprint;
-    let parent_scope = environment_daemon_scope_for_test(temp.path());
-    assert!(
-        !parent_scope.scan(query.clone()).await.unwrap().unchanged,
-        "changed access scope cannot authorize reuse"
-    );
-    let mut shallow = query.clone();
-    shallow.limits.max_depth = 0;
-    let truncated = runtime.filesystem().scan(shallow).await.unwrap();
-    assert!(!truncated.complete && !truncated.unchanged);
-    let mut directories = query.clone();
-    directories.include_patterns.clear();
-    directories.read_content = false;
-    directories.digest_algorithm = None;
-    assert!(
-        runtime
-            .filesystem()
-            .scan(directories)
-            .await
-            .unwrap()
-            .entries
-            .iter()
-            .any(|entry| matches!(entry.content, ScanContent::Directory))
-    );
-    std::fs::remove_file(temp.path().join("alias")).unwrap();
-    symlink(temp.path().join("two"), temp.path().join("alias")).unwrap();
-    let retargeted = runtime.filesystem().scan(query.clone()).await.unwrap();
-    assert!(retargeted.complete && !retargeted.unchanged);
-    assert_ne!(
-        first.entries[0].canonical_path,
-        retargeted.entries[0].canonical_path
-    );
-    assert!(
-        matches!(&retargeted.entries[0].content, ScanContent::File { digest: Some(digest), .. } if digest == BlobRef::from_bytes(b"same").as_str())
-    );
-    query.if_none_match = retargeted.fingerprint;
-    query.read_content = false;
-    assert!(
-        !runtime
-            .filesystem()
-            .scan(query.clone())
-            .await
-            .unwrap()
-            .unchanged
-    );
-    query.roots = vec![path("one"), path("two")];
-    query.limits.max_total_bytes = 7;
-    let limited = runtime.filesystem().scan(query.clone()).await.unwrap();
-    assert!(!limited.complete && !limited.unchanged && limited.fingerprint.is_none());
-    assert!(!limited.diagnostics.is_empty());
-    query.limits = InventoryLimits::default();
-    query.roots = vec![path("alias")];
-    symlink(temp.path().join("two"), temp.path().join("two/loop")).unwrap();
-    assert!(
-        !runtime
-            .filesystem()
-            .scan(query.clone())
+    let status = {
+        let fs = filesystem(&root, true);
+        begin(&fs, "done", selection.clone()).await.unwrap();
+        fs.transfer_abort(&context(), operation("done"))
             .await
             .unwrap()
-            .complete
-    );
-    std::fs::remove_file(temp.path().join("two/loop")).unwrap();
-    std::fs::remove_file(temp.path().join("alias")).unwrap();
-    symlink(outside.path(), temp.path().join("alias")).unwrap();
-    let escaped = runtime.filesystem().scan(query.clone()).await.unwrap();
-    assert!(!escaped.complete);
-    assert_eq!(
-        escaped.diagnostics[0].error.code,
-        EnvironmentProtocolErrorCode::Forbidden
-    );
-    std::fs::remove_file(temp.path().join("alias")).unwrap();
-    symlink(temp.path().join("missing"), temp.path().join("alias")).unwrap();
-    let dangling = runtime.filesystem().scan(query).await.unwrap();
-    assert!(!dangling.complete && !dangling.unchanged);
-}
-
-fn environment_daemon_scope_for_test(cwd: &std::path::Path) -> crate::filesystem::LocalFileSystem {
-    crate::filesystem::LocalFileSystem::new(
-        cwd.parent().unwrap().to_path_buf(),
-        cwd.to_path_buf(),
-        false,
+    };
+    assert_eq!(status.phase, TransferPhase::Aborted);
+    // An exit before the background removal finished: the stage is still
+    // there and the receipt names it.
+    let stage = ".lightspeed-transfer-0123456789abcdef0123456789abcdef";
+    std::fs::create_dir_all(root.join(stage).join("tree/replaced")).unwrap();
+    let journal = root.join(".state/transfers");
+    journal::write(
+        &journal,
+        &id("done"),
+        &Record {
+            params: BeginTransferParams {
+                operation_id: id("done"),
+                selection,
+                limits: limits(),
+            },
+            status: status.clone(),
+            stage: Some(StageRecord::new(&[], stage)),
+            spool: None,
+            committing: false,
+        },
     )
+    .unwrap();
+
+    let fs = filesystem(&root, true);
+    assert!(!root.join(stage).exists(), "recovery removes the stage");
+    let record = journal::read(&journal, &id("done")).unwrap().unwrap();
+    assert!(record.stage.is_none());
+    let answered = fs
+        .transfer_get_status(&context(), operation("done"))
+        .await
+        .unwrap();
+    assert_eq!(answered.phase, TransferPhase::Aborted);
 }
diff --git a/crates/environment-daemon/src/filesystem/walk.rs b/crates/environment-daemon/src/filesystem/walk.rs
new file mode 100644
index 000000000..a56bf5871
--- /dev/null
+++ b/crates/environment-daemon/src/filesystem/walk.rs
@@ -0,0 +1,754 @@
+//! One traversal for `fs/searchText`, `fs/globFiles`, `fs/scan` and transfer
+//! captures: the [`TreeFilter`] pattern grammar and a resumable walk beneath
+//! the root descriptor.
+//!
+//! Patterns match paths relative to the walk's root, gitignore-style: `*`
+//! and `?` within one segment, `**` across segments, `[...]` and `{a,b}`. A
+//! pattern without `/` matches the entry's name at any depth, a `/` anywhere
+//! but at the end anchors it to the root, and a trailing `/` matches
+//! directories only. The backslash is an ordinary character, as in names.
+//!
+//! The walk visits children in byte order of their names, depth first, so
+//! results are sorted by path. It always prunes VCS metadata directories and
+//! the daemon state directory; by default it respects `.gitignore`,
+//! `.ignore` and `.git/info/exclude` (in that ascending precedence, each
+//! level overriding its ancestors) and skips names starting with `.`.
+
+use std::{
+    collections::HashSet,
+    ffi::{OsStr, OsString},
+    os::unix::ffi::OsStrExt,
+    path::PathBuf,
+    sync::Arc,
+};
+
+use environment_protocol::{
+    data::fs::{FileKind, TreeFilter},
+    error::{PermissionReason, PreconditionReason, ProtocolError},
+    paths::TreePath,
+};
+use globset::{GlobBuilder, GlobSet, GlobSetBuilder};
+use ignore::gitignore::{Gitignore, GitignoreBuilder};
+
+use super::{
+    confinement::{Confinement, Resolved},
+    io_error,
+    os::{self, Directory, EntryStat},
+};
+
+/// Directories every walk prunes, whatever the filter says.
+const VCS_DIRECTORIES: [&str; 4] = [".git", ".hg", ".svn", ".jj"];
+/// Steps (pruned entries, listings) a walk takes without an event before it
+/// yields, so its caller can check its deadline and cancellation.
+const STEPS_PER_YIELD: u32 = 1024;
+/// Largest ignore file read; longer files are cut.
+const MAX_IGNORE_FILE_BYTES: u64 = 1024 * 1024;
+
+/// A compiled pattern list.
+#[derive(Clone, Debug, Default)]
+pub(crate) struct PatternSet {
+    any: Option<GlobSet>,
+    directories: Option<GlobSet>,
+    count: usize,
+}
+
+impl PatternSet {
+    /// Compile `patterns`; `field` names the list in errors
+    /// (`filter.include`).
+    pub fn compile(
+        patterns: &[String],
+        ignore_case: bool,
+        field: &str,
+    ) -> Result<Self, ProtocolError> {
+        let mut any = GlobSetBuilder::new();
+        let mut directories = GlobSetBuilder::new();
+        let (mut any_count, mut directory_count) = (0, 0);
+        for (index, pattern) in patterns.iter().enumerate() {
+            let field = format!("{field}[{index}]");
+            let (glob, directory_only) = translate(pattern)
+                .ok_or_else(|| ProtocolError::invalid_field(&field, "empty pattern"))?;
+            let glob = GlobBuilder::new(&glob)
+                .literal_separator(true)
+                .backslash_escape(false)
+                .case_insensitive(ignore_case)
+                .build()
+                .map_err(|error| {
+                    ProtocolError::invalid_field(&field, format!("invalid pattern: {error}"))
+                })?;
+            if directory_only {
+                directories.add(glob);
+                directory_count += 1;
+            } else {
+                any.add(glob);
+                any_count += 1;
+            }
+        }
+        let build = |builder: GlobSetBuilder, count: usize| -> Result<_, ProtocolError> {
+            if count == 0 {
+                return Ok(None);
+            }
+            builder
+                .build()
+                .map(Some)
+                .map_err(|error| ProtocolError::invalid_field(field, error.to_string()))
+        };
+        Ok(Self {
+            any: build(any, any_count)?,
+            directories: build(directories, directory_count)?,
+            count: patterns.len(),
+        })
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.count == 0
+    }
+
+    pub fn matches(&self, path: &TreePath, is_dir: bool) -> bool {
+        let path = path.as_str();
+        self.any.as_ref().is_some_and(|set| set.is_match(path))
+            || (is_dir
+                && self
+                    .directories
+                    .as_ref()
+                    .is_some_and(|set| set.is_match(path)))
+    }
+}
+
+/// Gitignore-style anchoring into a globset pattern: `(glob, directory
+/// only)`, or `None` for an empty pattern.
+fn translate(pattern: &str) -> Option<(String, bool)> {
+    let (body, directory_only) = match pattern.strip_suffix('/') {
+        Some(body) if !body.is_empty() => (body, true),
+        _ => (pattern, false),
+    };
+    if body.is_empty() || body == "/" {
+        return None;
+    }
+    let glob = if let Some(anchored) = body.strip_prefix('/') {
+        anchored.to_owned()
+    } else if body.contains('/') {
+        body.to_owned()
+    } else {
+        format!("**/{body}")
+    };
+    Some((glob, directory_only))
+}
+
+/// A [`TreeFilter`] ready to walk.
+#[derive(Clone, Debug)]
+pub(crate) struct CompiledFilter {
+    pub include: PatternSet,
+    pub exclude: PatternSet,
+    pub include_hidden: bool,
+    pub include_ignored: bool,
+    pub max_depth: Option<u32>,
+}
+
+impl CompiledFilter {
+    /// `prefix` is the wire field holding the filter (`filter`).
+    pub fn compile(filter: &TreeFilter, prefix: &str) -> Result<Self, ProtocolError> {
+        Ok(Self {
+            include: PatternSet::compile(
+                &filter.include,
+                filter.ignore_case,
+                &format!("{prefix}.include"),
+            )?,
+            exclude: PatternSet::compile(
+                &filter.exclude,
+                filter.ignore_case,
+                &format!("{prefix}.exclude"),
+            )?,
+            include_hidden: filter.include_hidden,
+            include_ignored: filter.include_ignored,
+            max_depth: filter.max_depth,
+        })
+    }
+
+    /// Visit everything: no patterns, hidden and ignored entries included.
+    pub fn everything() -> Self {
+        Self {
+            include: PatternSet::default(),
+            exclude: PatternSet::default(),
+            include_hidden: true,
+            include_ignored: true,
+            max_depth: None,
+        }
+    }
+
+    pub fn selects(&self, path: &TreePath, is_dir: bool) -> bool {
+        self.include.is_empty() || self.include.matches(path, is_dir)
+    }
+}
+
+/// What a walk does with a symlink it meets below its root.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum LinkMode {
+    /// Report the link itself as an entry of kind symlink.
+    Report,
+    /// Follow it when its target stays inside the filesystem root; report
+    /// it as skipped otherwise.
+    Follow,
+}
+
+/// One step of a walk.
+#[derive(Debug)]
+pub(crate) enum Event {
+    Entry(Entry),
+    /// Nothing to report yet: the walk pruned or listed for a while. The
+    /// caller checks its bounds and steps again.
+    Yield,
+    Skip {
+        /// Absent when the name is not UTF-8.
+        path: Option<TreePath>,
+        reason: Skip,
+        /// The skipped entry matters to the filter: its path, taken as a
+        /// non-directory, matches `include` (always without includes), or
+        /// it is a directory the walk had to descend. Always true without a
+        /// path.
+        selected: bool,
+    },
+}
+
+/// Why a walk left an entry out.
+#[derive(Debug)]
+pub(crate) enum Skip {
+    NonUtf8Name,
+    /// The entry vanished, could not be read, or (a directory) could not be
+    /// listed.
+    Unreadable(ProtocolError),
+    /// A followed link left the root, addressed the state directory, looped
+    /// or closed a directory cycle.
+    LinkOutsideRoot(ProtocolError),
+    /// A followed link whose target does not exist.
+    DanglingLink,
+}
+
+/// An entry the walk visited.
+#[derive(Debug)]
+pub(crate) struct Entry {
+    /// Relative to the walk's root, as walked.
+    pub path: TreePath,
+    pub depth: u32,
+    /// The directory holding the entry: for a followed link, its target.
+    pub parent: Arc<Directory>,
+    pub name: OsString,
+    /// Canonical segments below the filesystem root.
+    pub canonical: Vec<OsString>,
+    /// `lstat` of the entry, or of the link's target when it was followed.
+    pub stat: EntryStat,
+    /// Reached through a followed symlink.
+    pub via_link: bool,
+    /// Matches the filter's `include` (always true without includes).
+    pub selected: bool,
+}
+
+struct Frame {
+    directory: Arc<Directory>,
+    canonical: Vec<OsString>,
+    path: TreePath,
+    depth: u32,
+    identity: (u64, u64),
+    /// Children left to visit, in reverse order; `None` until listed.
+    names: Option<Vec<OsString>>,
+    /// Ignore levels pushed when this frame was listed.
+    ignore_levels: usize,
+}
+
+struct IgnoreLevel {
+    matcher: Gitignore,
+}
+
+/// A depth-first walk beneath a resolved directory. Resumable: callers step
+/// it with [`Walker::next_event`] and may stop at any time.
+pub(crate) struct Walker {
+    confinement: Arc<Confinement>,
+    filter: CompiledFilter,
+    links: LinkMode,
+    max_depth: Option<u32>,
+    /// Coordinates of ignore matching: the walk root's canonical segments.
+    base: PathBuf,
+    stack: Vec<Frame>,
+    ignores: Vec<IgnoreLevel>,
+    identities: HashSet<(u64, u64)>,
+}
+
+impl Walker {
+    /// Walk below `root`, which must be a resolved directory. `max_depth`
+    /// overrides the filter's.
+    pub fn new(
+        confinement: Arc<Confinement>,
+        root: &Resolved,
+        filter: CompiledFilter,
+        links: LinkMode,
+        max_depth: Option<u32>,
+        subject: &dyn std::fmt::Display,
+    ) -> Result<Self, ProtocolError> {
+        let directory = root
+            .open_directory()
+            .map_err(|error| io_error(error, subject))?;
+        let stat = EntryStat::of_directory(&directory).map_err(|error| io_error(error, subject))?;
+        let base = segments_path(&root.segments);
+        let mut walker = Self {
+            confinement,
+            max_depth: max_depth.or(filter.max_depth),
+            filter,
+            links,
+            base,
+            stack: Vec::new(),
+            ignores: Vec::new(),
+            identities: HashSet::new(),
+        };
+        if !walker.filter.include_ignored {
+            walker.load_ancestor_ignores(&root.segments);
+        }
+        walker.identities.insert((stat.dev, stat.ino));
+        walker.stack.push(Frame {
+            directory: Arc::new(directory),
+            canonical: root.segments.clone(),
+            path: TreePath::root(),
+            depth: 0,
+            identity: (stat.dev, stat.ino),
+            names: None,
+            ignore_levels: 0,
+        });
+        Ok(walker)
+    }
+
+    /// The next entry or skip, [`Event::Yield`] after a stretch without
+    /// one, or `None` when the walk is done.
+    pub fn next_event(&mut self) -> Option<Event> {
+        for _ in 0..STEPS_PER_YIELD {
+            let frame = self.stack.last_mut()?;
+            if frame.names.is_none() {
+                if let Some(event) = self.list_top() {
+                    return Some(event);
+                }
+                continue;
+            }
+            let frame = self.stack.last_mut().expect("frame listed above");
+            let Some(name) = frame.names.as_mut().and_then(Vec::pop) else {
+                self.pop_frame();
+                continue;
+            };
+            if let Some(event) = self.visit(name) {
+                return Some(event);
+            }
+        }
+        Some(Event::Yield)
+    }
+
+    /// List the top frame; an unlistable directory is skipped and popped.
+    fn list_top(&mut self) -> Option<Event> {
+        let frame = self.stack.last_mut().expect("caller checked");
+        if self.max_depth.is_some_and(|max| frame.depth >= max) {
+            frame.names = Some(Vec::new());
+            return None;
+        }
+        match frame.directory.names() {
+            Ok(mut names) => {
+                names.sort_by(|left, right| right.as_bytes().cmp(left.as_bytes()));
+                frame.names = Some(names);
+                if !self.filter.include_ignored {
+                    let directory = frame.directory.clone();
+                    let at = self.base.join(segments_path_tree(&frame.path));
+                    let pushed = self.load_ignores(&directory, at);
+                    self.stack.last_mut().expect("frame").ignore_levels = pushed;
+                }
+                None
+            }
+            Err(error) => {
+                let path = frame.path.clone();
+                let error = io_error(error, &path);
+                self.pop_frame();
+                Some(Event::Skip {
+                    path: (!path.is_root()).then_some(path),
+                    reason: Skip::Unreadable(error),
+                    selected: true,
+                })
+            }
+        }
+    }
+
+    fn pop_frame(&mut self) {
+        if let Some(frame) = self.stack.pop() {
+            self.ignores
+                .truncate(self.ignores.len().saturating_sub(frame.ignore_levels));
+            self.identities.remove(&frame.identity);
+        }
+    }
+
+    fn visit(&mut self, name: OsString) -> Option<Event> {
+        let frame = self.stack.last().expect("visiting a listed frame");
+        let depth = frame.depth + 1;
+        let Some(utf8) = os::utf8_name(&name) else {
+            return Some(Event::Skip {
+                path: None,
+                reason: Skip::NonUtf8Name,
+                selected: true,
+            });
+        };
+        if VCS_DIRECTORIES.contains(&utf8) {
+            return None;
+        }
+        let mut canonical = frame.canonical.clone();
+        canonical.push(name.clone());
+        if !self.filter.include_hidden && utf8.starts_with('.') {
+            return None;
+        }
+        let path = frame
+            .path
+            .join(utf8)
+            .expect("a UTF-8 name without '/' joins");
+        let parent = frame.directory.clone();
+        let parent_canonical = frame.canonical.clone();
+        let stat = match parent.stat(&name) {
+            Ok(stat) => stat,
+            Err(error) => {
+                let error = io_error(error, &path);
+                return self.skip_entry(path, Skip::Unreadable(error));
+            }
+        };
+        if self.confinement.is_state(&stat) {
+            return None;
+        }
+        let mut entry = Entry {
+            path,
+            depth,
+            parent,
+            name,
+            canonical,
+            stat,
+            via_link: false,
+            selected: false,
+        };
+        if stat.kind == FileKind::Symlink
+            && self.links == LinkMode::Follow
+            && let Err(skip) = self.follow(&parent_canonical, &mut entry)
+        {
+            return self.skip_entry(entry.path, skip);
+        }
+        let is_dir = entry.stat.is_dir();
+        if self.ignored(&entry.path, is_dir) || self.filter.exclude.matches(&entry.path, is_dir) {
+            return None;
+        }
+        entry.selected = self.filter.selects(&entry.path, is_dir);
+        if is_dir {
+            if entry.via_link && self.identities.contains(&(entry.stat.dev, entry.stat.ino)) {
+                return Some(Event::Skip {
+                    reason: Skip::LinkOutsideRoot(ProtocolError::failed_precondition(
+                        PreconditionReason::SymlinkLoop,
+                        format!("{}: the link closes a directory cycle", entry.path),
+                    )),
+                    path: Some(entry.path),
+                    selected: true,
+                });
+            }
+            match entry.parent.child(&entry.name) {
+                Ok(directory) => {
+                    let identity = (entry.stat.dev, entry.stat.ino);
+                    self.identities.insert(identity);
+                    self.stack.push(Frame {
+                        directory: Arc::new(directory),
+                        canonical: entry.canonical.clone(),
+                        path: entry.path.clone(),
+                        depth,
+                        identity,
+                        names: None,
+                        ignore_levels: 0,
+                    });
+                }
+                Err(error) => {
+                    return Some(Event::Skip {
+                        reason: Skip::Unreadable(io_error(error, &entry.path)),
+                        path: Some(entry.path),
+                        selected: true,
+                    });
+                }
+            }
+        }
+        Some(Event::Entry(entry))
+    }
+
+    /// A skip of an entry whose kind is unknown (it vanished, or a link
+    /// that could not be followed), taken as a non-directory: pruned like
+    /// one when ignored or excluded, selected like one otherwise.
+    fn skip_entry(&self, path: TreePath, reason: Skip) -> Option<Event> {
+        if self.ignored(&path, false) || self.filter.exclude.matches(&path, false) {
+            return None;
+        }
+        Some(Event::Skip {
+            selected: self.filter.selects(&path, false),
+            path: Some(path),
+            reason,
+        })
+    }
+
+    /// Replace a link entry by its in-root target.
+    fn follow(&self, parent: &[OsString], entry: &mut Entry) -> Result<(), Skip> {
+        let resolved = self
+            .confinement
+            .lookup_link(parent, &entry.name, &entry.path)
+            .map_err(|error| match &error.data {
+                environment_protocol::error::ErrorData::PermissionDenied {
+                    reason: Some(PermissionReason::OutsideRoot | PermissionReason::DaemonState),
+                }
+                | environment_protocol::error::ErrorData::FailedPrecondition {
+                    reason: PreconditionReason::SymlinkLoop,
+                } => Skip::LinkOutsideRoot(error),
+                environment_protocol::error::ErrorData::NotFound { .. } => Skip::DanglingLink,
+                _ => Skip::Unreadable(error),
+            })?;
+        let stat = resolved.stat.expect("a followed lookup reports its target");
+        entry.parent = Arc::new(resolved.parent);
+        entry.name = resolved.name;
+        entry.canonical = resolved.segments;
+        entry.stat = stat;
+        entry.via_link = true;
+        Ok(())
+    }
+
+    fn ignored(&self, path: &TreePath, is_dir: bool) -> bool {
+        if self.filter.include_ignored {
+            return false;
+        }
+        let candidate = self.base.join(segments_path_tree(path));
+        for level in self.ignores.iter().rev() {
+            let matched = level.matcher.matched(&candidate, is_dir);
+            if matched.is_ignore() {
+                return true;
+            }
+            if matched.is_whitelist() {
+                return false;
+            }
+        }
+        false
+    }
+
+    fn load_ancestor_ignores(&mut self, root: &[OsString]) {
+        for depth in 0..root.len() {
+            let segments = &root[..depth];
+            let Ok(resolved) = self.confinement.reopen(segments, &"ignore file ancestor") else {
+                continue;
+            };
+            let Ok(directory) = resolved.open_directory() else {
+                continue;
+            };
+            self.load_ignores(&directory, segments_path(segments));
+        }
+    }
+
+    /// Push the ignore level of one directory; returns how many levels were
+    /// pushed (0 or 1).
+    fn load_ignores(&mut self, directory: &Directory, at: PathBuf) -> usize {
+        let mut builder = GitignoreBuilder::new(&at);
+        let mut lines = 0usize;
+        let mut add = |content: Vec<u8>| {
+            for line in String::from_utf8_lossy(&content).lines() {
+                if builder.add_line(None, line).is_ok() {
+                    lines += 1;
+                }
+            }
+        };
+        if let Ok(git) = directory.child(OsStr::new(".git"))
+            && let Ok(info) = git.child(OsStr::new("info"))
+            && let Some(content) = read_small(&info, "exclude")
+        {
+            add(content);
+        }
+        for name in [".gitignore", ".ignore"] {
+            if let Some(content) = read_small(directory, name) {
+                add(content);
+            }
+        }
+        if lines == 0 {
+            return 0;
+        }
+        match builder.build() {
+            Ok(matcher) => {
+                self.ignores.push(IgnoreLevel { matcher });
+                1
+            }
+            Err(_) => 0,
+        }
+    }
+}
+
+fn read_small(directory: &Directory, name: &str) -> Option<Vec<u8>> {
+    let mut file = directory.open_read(OsStr::new(name)).ok()?;
+    if !EntryStat::of_file(&file).ok()?.is_file() {
+        return None;
+    }
+    os::read_up_to(&mut file, MAX_IGNORE_FILE_BYTES).ok()
+}
+
+/// `/` joined with segments: the coordinate space of ignore matching.
+fn segments_path(segments: &[OsString]) -> PathBuf {
+    let mut path = PathBuf::from("/");
+    path.extend(segments);
+    path
+}
+
+fn segments_path_tree(path: &TreePath) -> PathBuf {
+    path.segments().collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::filesystem::confinement::Lookup;
+    use environment_protocol::paths::EnvironmentPath;
+
+    fn set(patterns: &[&str]) -> PatternSet {
+        PatternSet::compile(
+            &patterns.iter().map(|p| (*p).to_owned()).collect::<Vec<_>>(),
+            false,
+            "filter.include",
+        )
+        .unwrap()
+    }
+
+    fn tree(path: &str) -> TreePath {
+        TreePath::new(path).unwrap()
+    }
+
+    #[test]
+    fn patterns_follow_gitignore_anchoring() {
+        let star = set(&["src/*.rs"]);
+        assert!(star.matches(&tree("src/lib.rs"), false));
+        assert!(!star.matches(&tree("src/deep/nested.rs"), false));
+
+        let name = set(&["*.md"]);
+        assert!(name.matches(&tree("readme.md"), false));
+        assert!(name.matches(&tree("docs/deep/guide.md"), false));
+
+        let anchored = set(&["/build"]);
+        assert!(anchored.matches(&tree("build"), true));
+        assert!(!anchored.matches(&tree("sub/build"), true));
+
+        let spanning = set(&["**/SKILL.md"]);
+        assert!(spanning.matches(&tree("SKILL.md"), false));
+        assert!(spanning.matches(&tree("a/b/SKILL.md"), false));
+
+        let directories = set(&["target/"]);
+        assert!(directories.matches(&tree("crates/target"), true));
+        assert!(!directories.matches(&tree("crates/target"), false));
+
+        let alternation = set(&["*.{rs,toml}"]);
+        assert!(alternation.matches(&tree("Cargo.toml"), false));
+
+        assert!(PatternSet::compile(&["".into()], false, "filter.include").is_err());
+        assert!(PatternSet::compile(&["[".into()], false, "filter.include").is_err());
+    }
+
+    fn walk(root: &std::path::Path, filter: TreeFilter, links: LinkMode) -> Vec<String> {
+        let confinement = Arc::new(Confinement::new(root.into(), root.join(".state")).unwrap());
+        let resolved = confinement
+            .lookup(
+                &EnvironmentPath::new(root.to_str().unwrap()).unwrap(),
+                Lookup::FOLLOW,
+            )
+            .unwrap();
+        let mut walker = Walker::new(
+            confinement,
+            &resolved,
+            CompiledFilter::compile(&filter, "filter").unwrap(),
+            links,
+            None,
+            &"root",
+        )
+        .unwrap();
+        let mut seen = Vec::new();
+        while let Some(event) = walker.next_event() {
+            match event {
+                Event::Entry(entry) if entry.selected => seen.push(entry.path.to_string()),
+                Event::Entry(_) | Event::Yield => {}
+                Event::Skip { path, .. } => seen.push(format!(
+                    "skip:{}",
+                    path.map(|path| path.to_string()).unwrap_or_default()
+                )),
+            }
+        }
+        seen
+    }
+
+    #[test]
+    fn walks_prune_vcs_state_hidden_and_ignored_entries_by_default() {
+        let temp = tempfile::tempdir().unwrap();
+        let root = temp.path().canonicalize().unwrap();
+        for directory in [
+            ".git/objects",
+            "src",
+            "node_modules/pkg",
+            ".hidden",
+            ".state",
+        ] {
+            std::fs::create_dir_all(root.join(directory)).unwrap();
+        }
+        std::fs::write(root.join(".git/objects/pack"), "pack").unwrap();
+        std::fs::write(root.join(".gitignore"), "node_modules/\n*.log\n!keep.log\n").unwrap();
+        std::fs::write(root.join("src/lib.rs"), "lib").unwrap();
+        std::fs::write(root.join("src/debug.log"), "log").unwrap();
+        std::fs::write(root.join("src/keep.log"), "log").unwrap();
+        std::fs::write(root.join("node_modules/pkg/index.js"), "js").unwrap();
+        std::fs::write(root.join(".hidden/file"), "hidden").unwrap();
+        std::fs::write(root.join(".state/daemon-key"), "key").unwrap();
+
+        assert_eq!(
+            walk(&root, TreeFilter::default(), LinkMode::Report),
+            ["src", "src/keep.log", "src/lib.rs"]
+        );
+        let everything = TreeFilter {
+            include_hidden: true,
+            include_ignored: true,
+            ..TreeFilter::default()
+        };
+        // VCS metadata and the state directory stay pruned.
+        assert_eq!(
+            walk(&root, everything, LinkMode::Report),
+            [
+                ".gitignore",
+                ".hidden",
+                ".hidden/file",
+                "node_modules",
+                "node_modules/pkg",
+                "node_modules/pkg/index.js",
+                "src",
+                "src/debug.log",
+                "src/keep.log",
+                "src/lib.rs",
+            ]
+        );
+    }
+
+    #[test]
+    fn followed_links_stay_inside_the_root_and_cycles_are_skipped() {
+        use std::os::unix::fs::symlink;
+
+        let temp = tempfile::tempdir().unwrap();
+        let base = temp.path().canonicalize().unwrap();
+        let root = base.join("root");
+        std::fs::create_dir_all(root.join("real")).unwrap();
+        std::fs::create_dir_all(base.join("outside")).unwrap();
+        std::fs::write(root.join("real/file"), "x").unwrap();
+        symlink("real", root.join("alias")).unwrap();
+        symlink("..", root.join("real/up")).unwrap();
+        symlink(base.join("outside"), root.join("escape")).unwrap();
+
+        let filter = TreeFilter {
+            include_hidden: true,
+            ..TreeFilter::default()
+        };
+        assert_eq!(
+            walk(&root, filter, LinkMode::Follow),
+            [
+                "alias",
+                "alias/file",
+                "skip:alias/up",
+                "skip:escape",
+                "real",
+                "real/file",
+                "skip:real/up",
+            ]
+        );
+    }
+}
diff --git a/crates/environment-daemon/src/identity.rs b/crates/environment-daemon/src/identity.rs
index bfe1ed4e5..8fa9d2d1c 100644
--- a/crates/environment-daemon/src/identity.rs
+++ b/crates/environment-daemon/src/identity.rs
@@ -10,7 +10,13 @@ use std::path::{Path, PathBuf};
 
 use anyhow::{Context as _, Result, bail};
 use ed25519_dalek::{Signer as _, SigningKey, VerifyingKey};
-use environment_protocol::registration::{decode_hex, encode_hex, signed_registration_message};
+use environment_protocol::{
+    bytes::{decode_hex_array, encode_hex},
+    registration::{
+        ChallengeNonce, DaemonPublicKey, Ed25519Signature, signed_registration_message,
+    },
+    routes::CanonicalOrigin,
+};
 
 /// Name of the key file inside the daemon state directory.
 pub const DAEMON_KEY_FILE: &str = "daemon-key";
@@ -24,7 +30,7 @@ pub struct DaemonIdentity {
 impl std::fmt::Debug for DaemonIdentity {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         f.debug_struct("DaemonIdentity")
-            .field("public_key", &self.public_key_hex())
+            .field("public_key", &self.public_key())
             .field("path", &self.path)
             .finish()
     }
@@ -32,60 +38,73 @@ impl std::fmt::Debug for DaemonIdentity {
 
 impl DaemonIdentity {
     /// Load the key from `<state_dir>/daemon-key`, or generate one there.
-    /// The directory is created `0700` and the file `0600`; generation is
-    /// atomic so a crash cannot leave a half-written key behind.
+    /// The file is created `0600` and installed without ever replacing an
+    /// existing key: when two first starts race, the key installed first
+    /// wins and both processes load it.
     pub fn load_or_create(state_dir: &Path) -> Result<Self> {
         let path = state_dir.join(DAEMON_KEY_FILE);
-        if path.exists() {
-            let contents = std::fs::read_to_string(&path)
-                .with_context(|| format!("read daemon key {}", path.display()))?;
-            let seed = decode_hex(contents.trim())
-                .filter(|seed| seed.len() == 32)
-                .with_context(|| {
-                    format!("daemon key {} is not a 32-byte hex seed", path.display())
-                })?;
-            let seed: [u8; 32] = seed.try_into().expect("length checked");
-            return Ok(Self {
-                signing_key: SigningKey::from_bytes(&seed),
-                path,
-            });
+        if let Some(identity) = Self::load(&path)? {
+            return Ok(identity);
         }
-        std::fs::create_dir_all(state_dir)
-            .with_context(|| format!("create state dir {}", state_dir.display()))?;
-        restrict_dir(state_dir)?;
         let mut seed = [0u8; 32];
         rand::TryRng::try_fill_bytes(&mut rand::rngs::SysRng, &mut seed)
             .context("generate daemon identity seed")?;
         let signing_key = SigningKey::from_bytes(&seed);
-        let temp = state_dir.join(format!(".{DAEMON_KEY_FILE}.{}", std::process::id()));
+        let mut suffix = [0u8; 8];
+        rand::TryRng::try_fill_bytes(&mut rand::rngs::SysRng, &mut suffix)
+            .context("generate temporary key name")?;
+        let temp = state_dir.join(format!(".{DAEMON_KEY_FILE}.{}", encode_hex(&suffix)));
         write_private(&temp, &encode_hex(&signing_key.to_bytes()))?;
-        if let Err(error) = std::fs::rename(&temp, &path) {
-            let _ = std::fs::remove_file(&temp);
-            if path.exists() {
-                // Lost a race with a concurrent start of the same daemon:
-                // the other key wins so both processes share one identity.
-                return Self::load_or_create(state_dir);
+        // A hard link fails when the destination exists, unlike rename,
+        // which would silently replace a key a concurrent start installed.
+        let installed = std::fs::hard_link(&temp, &path);
+        let _ = std::fs::remove_file(&temp);
+        match installed {
+            Ok(()) => {
+                sync_dir(state_dir);
+                Ok(Self { signing_key, path })
             }
-            bail!("install daemon key {}: {error}", path.display());
+            Err(error) if error.kind() == std::io::ErrorKind::AlreadyExists => Self::load(&path)?
+                .with_context(|| format!("daemon key {} vanished during install", path.display())),
+            Err(error) => bail!("install daemon key {}: {error}", path.display()),
         }
-        Ok(Self { signing_key, path })
     }
 
-    /// Lowercase hex of the raw 32-byte public key.
-    pub fn public_key_hex(&self) -> String {
-        encode_hex(self.signing_key.verifying_key().as_bytes())
+    fn load(path: &Path) -> Result<Option<Self>> {
+        let contents = match std::fs::read_to_string(path) {
+            Ok(contents) => contents,
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(None),
+            Err(error) => {
+                return Err(error).with_context(|| format!("read daemon key {}", path.display()));
+            }
+        };
+        let seed = decode_hex_array::<32>(contents.trim())
+            .with_context(|| format!("daemon key {} is not a 32-byte hex seed", path.display()))?;
+        Ok(Some(Self {
+            signing_key: SigningKey::from_bytes(&seed),
+            path: path.to_path_buf(),
+        }))
+    }
+
+    /// `daemonPublicKey`.
+    pub fn public_key(&self) -> DaemonPublicKey {
+        DaemonPublicKey::from_bytes(self.signing_key.verifying_key().to_bytes())
     }
 
     pub fn verifying_key(&self) -> VerifyingKey {
         self.signing_key.verifying_key()
     }
 
-    /// Hex signature over the domain-separated challenge.
-    pub fn sign_challenge(&self, nonce: &[u8]) -> String {
-        encode_hex(
-            &self
-                .signing_key
-                .sign(&signed_registration_message(nonce))
+    /// `signature` over the challenge nonce bound to the canonical origin of
+    /// the gateway URL this daemon dialed.
+    pub fn sign_challenge(
+        &self,
+        nonce: &ChallengeNonce,
+        origin: &CanonicalOrigin,
+    ) -> Ed25519Signature {
+        Ed25519Signature::from_bytes(
+            self.signing_key
+                .sign(&signed_registration_message(nonce, origin))
                 .to_bytes(),
         )
     }
@@ -113,30 +132,27 @@ fn write_private(path: &Path, contents: &str) -> Result<()> {
     Ok(())
 }
 
-fn restrict_dir(path: &Path) -> Result<()> {
-    #[cfg(unix)]
-    {
-        use std::os::unix::fs::PermissionsExt as _;
-        std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o700))
-            .with_context(|| format!("restrict state dir {}", path.display()))?;
+/// Make the new directory entry durable; best effort.
+fn sync_dir(path: &Path) {
+    if let Ok(directory) = std::fs::File::open(path) {
+        let _ = directory.sync_all();
     }
-    Ok(())
 }
 
 #[cfg(test)]
 mod tests {
     use ed25519_dalek::Verifier as _;
+    use environment_protocol::routes::canonical_origin;
 
     use super::*;
 
     #[test]
     fn identity_is_generated_once_and_reloaded_from_the_state_dir() {
         let temp = tempfile::tempdir().expect("tempdir");
-        let state = temp.path().join("state");
-        let first = DaemonIdentity::load_or_create(&state).expect("create");
-        let second = DaemonIdentity::load_or_create(&state).expect("reload");
-        assert_eq!(first.public_key_hex(), second.public_key_hex());
-        assert_eq!(first.public_key_hex().len(), 64);
+        let state = temp.path();
+        let first = DaemonIdentity::load_or_create(state).expect("create");
+        let second = DaemonIdentity::load_or_create(state).expect("reload");
+        assert_eq!(first.public_key(), second.public_key());
         #[cfg(unix)]
         {
             use std::os::unix::fs::PermissionsExt as _;
@@ -146,37 +162,66 @@ mod tests {
                 .mode()
                 & 0o777;
             assert_eq!(mode, 0o600);
-            let dir_mode = std::fs::metadata(&state)
-                .expect("meta")
-                .permissions()
-                .mode()
-                & 0o777;
-            assert_eq!(dir_mode, 0o700);
         }
+        assert_eq!(
+            std::fs::read_dir(state).unwrap().count(),
+            1,
+            "no temporary file is left behind"
+        );
         std::fs::remove_file(first.path()).expect("reset identity");
-        let reset = DaemonIdentity::load_or_create(&state).expect("regenerate");
-        assert_ne!(reset.public_key_hex(), first.public_key_hex());
+        let reset = DaemonIdentity::load_or_create(state).expect("regenerate");
+        assert_ne!(reset.public_key(), first.public_key());
+    }
+
+    #[test]
+    fn concurrent_first_starts_share_the_key_installed_first() {
+        let temp = tempfile::tempdir().expect("tempdir");
+        let state = temp.path().to_path_buf();
+        let handles: Vec<_> = (0..8)
+            .map(|_| {
+                let state = state.clone();
+                std::thread::spawn(move || DaemonIdentity::load_or_create(&state).unwrap())
+            })
+            .collect();
+        let keys: std::collections::BTreeSet<String> = handles
+            .into_iter()
+            .map(|handle| handle.join().unwrap().public_key().to_hex())
+            .collect();
+        assert_eq!(keys.len(), 1, "every racing start holds the installed key");
+        let on_disk = DaemonIdentity::load_or_create(&state).unwrap();
+        assert_eq!(
+            keys.into_iter().next().unwrap(),
+            on_disk.public_key().to_hex()
+        );
     }
 
     #[test]
-    fn challenge_signatures_verify_against_the_public_key_and_domain() {
+    fn challenge_signatures_bind_the_nonce_and_the_dialed_origin() {
         let temp = tempfile::tempdir().expect("tempdir");
         let identity = DaemonIdentity::load_or_create(temp.path()).expect("create");
-        let nonce = [7u8; 32];
-        let signature = decode_hex(&identity.sign_challenge(&nonce)).expect("hex");
-        let signature = ed25519_dalek::Signature::from_slice(&signature).expect("signature");
-        identity
-            .verifying_key()
-            .verify(&signed_registration_message(&nonce), &signature)
+        let nonce = ChallengeNonce::from_bytes([7u8; 32]);
+        let origin = canonical_origin("wss://gateway.example/environment-gateway/connect").unwrap();
+        let signature = identity.sign_challenge(&nonce, &origin);
+        let signature = ed25519_dalek::Signature::from_bytes(signature.as_bytes());
+        let verifying = identity.verifying_key();
+        verifying
+            .verify_strict(&signed_registration_message(&nonce, &origin), &signature)
             .expect("verifies");
+        assert!(verifying.verify(nonce.as_bytes(), &signature).is_err());
+        let elsewhere = canonical_origin("wss://other.example").unwrap();
         assert!(
-            identity.verifying_key().verify(&nonce, &signature).is_err(),
-            "signature must not verify without the domain separator"
+            verifying
+                .verify(&signed_registration_message(&nonce, &elsewhere), &signature)
+                .is_err(),
+            "a signature for one gateway does not verify at another"
         );
+        let other_nonce = ChallengeNonce::from_bytes([8u8; 32]);
         assert!(
-            identity
-                .verifying_key()
-                .verify(&signed_registration_message(&[8u8; 32]), &signature)
+            verifying
+                .verify(
+                    &signed_registration_message(&other_nonce, &origin),
+                    &signature
+                )
                 .is_err()
         );
     }
@@ -184,7 +229,9 @@ mod tests {
     #[test]
     fn corrupt_key_files_are_rejected_rather_than_replaced() {
         let temp = tempfile::tempdir().expect("tempdir");
-        std::fs::write(temp.path().join(DAEMON_KEY_FILE), "not-hex").expect("write");
+        let path = temp.path().join(DAEMON_KEY_FILE);
+        std::fs::write(&path, "not-hex").expect("write");
         assert!(DaemonIdentity::load_or_create(temp.path()).is_err());
+        assert_eq!(std::fs::read_to_string(&path).unwrap(), "not-hex");
     }
 }
diff --git a/crates/environment-daemon/src/jobs.rs b/crates/environment-daemon/src/jobs.rs
index 19fdd3553..b34b1d28e 100644
--- a/crates/environment-daemon/src/jobs.rs
+++ b/crates/environment-daemon/src/jobs.rs
@@ -1,2051 +1,2082 @@
+//! `job/*`: durable batch commands with dependencies and queues, on the
+//! shared execution primitive.
+//!
+//! A job is identified by its `jobId` together with the `requestId` of the
+//! `job/start` that created it and a hash of its spec: an identical retry
+//! replays the job, any other reuse of the id is `jobIdInUse`. A job runs
+//! once its dependencies satisfy its policy and its queue key is free. When
+//! its root exits the daemon sweeps its process group (`SIGTERM`, the
+//! cancel grace, `SIGKILL`) and reports what it swept.
+//!
+//! Records and output persist under `<state>/jobs/` through the job store,
+//! off the runtime thread; output keeps a head and a tail with the middle
+//! as an overflow gap. Startup loads summaries only, quarantines unreadable
+//! records instead of failing, marks unfinished jobs `interrupted` and kills
+//! the groups an earlier instance left running in this boot.
+
 use std::{
-    collections::{BTreeMap, BTreeSet},
-    path::{Component, PathBuf},
-    process::Stdio,
-    sync::{
-        Arc,
-        atomic::{AtomicBool, Ordering},
-    },
-    time::{Duration, SystemTime, UNIX_EPOCH},
+    collections::{BTreeMap, BTreeSet, VecDeque},
+    path::{Path, PathBuf},
+    sync::{Arc, Mutex, MutexGuard},
+    time::{Duration, Instant, SystemTime, UNIX_EPOCH},
 };
 
 use environment_protocol::{
-    data::jobs::{
-        CancelJobsParams, CancelJobsResponse, JobCancelScope, JobDependencyPolicy, JobOutputChunk,
-        JobOutputStream, JobReadResult, JobStartSpec, JobStatus, JobSummary, ListJobsParams,
-        ListJobsResponse, ReadJobsParams, ReadJobsResponse, StartJobsParams, StartJobsResponse,
+    bytes::encode_hex,
+    data::{
+        exec::{
+            CommandSpec, ExecInput, ExitStatus, LeftoverDisposition, LeftoverReport, OutputPage,
+            OutputStream, ReturnOn, StoppedBy,
+        },
+        handshake::JobLimits,
+        job::{
+            CancelJobsParams, CancelJobsResponse, JobCancelScope, JobDependency,
+            JobDependencyPolicy, JobReadEntry, JobReadRequest, JobStatus, JobSummary,
+            JobSummaryEntry, ReadJobsParams, ReadJobsResponse, StartJobsParams, StartJobsResponse,
+        },
     },
-    error::{EnvironmentProtocolError, EnvironmentProtocolErrorCode},
-    shared::{ByteChunk, EnvironmentPath, JobId, SecretString},
+    error::{PreconditionReason, ProtocolError},
+    ids::{DaemonInstanceId, JobId, JobName, JobRequestId, QueueKey},
+    limits::MAX_PAGE_CHUNKS,
+    paths::EnvironmentPath,
 };
 use serde::{Deserialize, Serialize};
-use tokio::{
-    io::{AsyncRead, AsyncReadExt, AsyncWriteExt},
-    process::Command,
-    sync::{Mutex, Notify},
-    task::JoinHandle,
-};
+use sha2::{Digest as _, Sha256};
+use tokio::sync::watch;
 
 use crate::{
+    dispatch::RequestContext,
+    exec::{
+        AfterExit, ExecOptions, Execution, OutputSink, PreparedCommand,
+        job_store::{JobStore, load_output},
+        log::OutputLog,
+        outcome::describe_exit,
+        spawn_record::{SpawnRecord, write_json_atomic},
+        validate_command,
+    },
+    filesystem::Confinement,
     process_group,
-    redaction::{redact_bytes, redactions_for_secret_env},
 };
 
+/// Version of the persisted job record; a record of another version is
+/// quarantined.
+const JOB_RECORD_FORMAT: u32 = 1;
+
+/// Terminal jobs whose output stays in memory after completion or a load.
+const MAX_CACHED_OUTPUTS: usize = 16;
+
+/// Everything a [`JobManager`] needs from the daemon.
+pub struct JobConfig {
+    /// Canonical default `cwd`.
+    pub cwd: PathBuf,
+    /// Resolves every `cwd` when the job starts running.
+    pub confinement: Arc<Confinement>,
+    /// Records and output live in `<state_dir>/jobs`.
+    pub state_dir: PathBuf,
+    /// Daemon variables no child inherits.
+    pub scrubbed_env: Vec<String>,
+    pub instance_id: DaemonInstanceId,
+    pub limits: JobLimits,
+    /// `limits.maxWaitMs`, the `waitMs` ceiling.
+    pub max_wait_ms: u64,
+}
+
+/// The daemon's jobs. Cheap to clone.
 #[derive(Clone)]
 pub struct JobManager {
-    cwd: PathBuf,
-    fs_root: PathBuf,
-    jobs_root: PathBuf,
-    state: Arc<Mutex<JobManagerState>>,
-    notify: Arc<Notify>,
-    /// Daemon configuration variables no job may inherit.
-    scrubbed_env: Arc<Vec<String>>,
+    inner: Arc<JobsInner>,
+}
+
+struct JobsInner {
+    config: JobConfig,
+    store: JobStore,
+    state: Mutex<JobsState>,
+    /// Bumped on every status change and every output append.
+    changed: watch::Sender<u64>,
 }
 
 #[derive(Default)]
-struct JobManagerState {
-    accepting: bool,
-    jobs: BTreeMap<JobKey, JobRecord>,
-    running: BTreeMap<JobKey, Arc<RunningJob>>,
-    secret_envs: BTreeMap<JobKey, BTreeMap<String, SecretString>>,
-    next_accept_seq: u64,
+struct JobsState {
+    jobs: BTreeMap<JobId, JobEntry>,
+    next_seq: u64,
+    /// Terminal jobs holding their output in memory, oldest first.
+    cached: VecDeque<JobId>,
 }
 
-type JobKey = (String, JobId);
+struct JobEntry {
+    record: StoredJob,
+    /// The command of a queued job, secrets included. Memory only.
+    pending: Option<CommandSpec>,
+    run: Option<Run>,
+    /// The output of a terminal job, while cached.
+    output: Option<Arc<OutputLog>>,
+}
 
-struct RunningJob {
-    cancel: Notify,
-    interrupted: AtomicBool,
+struct Run {
+    execution: Execution<JobOutput>,
+    started: Instant,
 }
 
-#[derive(Clone, Debug, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-struct JobRecord {
-    namespace: String,
+/// A running job's output: retained head and tail in memory, every byte
+/// forwarded to the store.
+struct JobOutput {
     job_id: JobId,
-    name: Option<String>,
-    argv: Vec<String>,
-    cwd: Option<EnvironmentPath>,
-    env: BTreeMap<String, String>,
-    #[serde(default)]
-    secret_env_names: Vec<String>,
-    stdin: Option<ByteChunk>,
-    timeout_ms: Option<u64>,
-    dependency_policy: JobDependencyPolicy,
-    dependencies: Vec<JobId>,
-    queue_key: Option<String>,
+    log: OutputLog,
+    cap: u64,
+    store: JobStore,
+    changed: watch::Sender<u64>,
+}
+
+impl OutputSink for JobOutput {
+    fn append(&mut self, stream: OutputStream, data: &[u8]) {
+        self.store
+            .append(&self.job_id, self.log.end(), stream, data);
+        self.log.append(stream, data);
+        self.log.enforce_cap(self.cap, 0);
+        self.changed
+            .send_modify(|version| *version = version.wrapping_add(1));
+    }
+}
+
+/// The persisted record of one job.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct StoredJob {
+    format: u32,
+    job_id: JobId,
+    request_id: JobRequestId,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    name: Option<JobName>,
     spec_hash: String,
-    #[serde(default)]
-    accept_seq: u64,
+    seq: u64,
     status: JobStatus,
-    created_at_ms: u64,
-    queued_at_ms: Option<u64>,
-    started_at_ms: Option<u64>,
-    finished_at_ms: Option<u64>,
-    exit_code: Option<i32>,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    depends_on: Vec<JobId>,
+    dependency_policy: JobDependencyPolicy,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    queue_key: Option<QueueKey>,
+    created_at_ms: i64,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    queued_at_ms: Option<i64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    started_at_ms: Option<i64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    finished_at_ms: Option<i64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    cancel_requested_at_ms: Option<i64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    duration_ms: Option<u64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    exit: Option<ExitStatus>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    stopped_by: Option<StoppedBy>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    leftovers: Option<LeftoverReport>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    error: Option<ProtocolError>,
+    /// The running job's process group, for restart reconciliation.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    spawn: Option<SpawnRecord>,
+    /// Output bytes produced, final once the job is terminal.
     #[serde(default)]
-    orphaned_descendants: bool,
-    failure: Option<String>,
-    output_chunks: Vec<JobOutputChunk>,
-    output_next_seq: u64,
+    output_end_bytes: u64,
 }
 
-#[derive(Clone)]
-struct ResolvedJob {
-    spec: JobStartSpec,
-    dependencies: Vec<JobId>,
-    secret_env: BTreeMap<String, SecretString>,
-    spec_hash: String,
-}
+impl StoredJob {
+    fn summary(&self) -> JobSummary {
+        JobSummary {
+            job_id: self.job_id.clone(),
+            request_id: self.request_id.clone(),
+            name: self.name.clone(),
+            status: self.status,
+            depends_on: self.depends_on.clone(),
+            queue_key: self.queue_key.clone(),
+            created_at_ms: self.created_at_ms,
+            queued_at_ms: self.queued_at_ms,
+            started_at_ms: self.started_at_ms,
+            finished_at_ms: self.finished_at_ms,
+            cancel_requested_at_ms: self.cancel_requested_at_ms,
+            duration_ms: self.duration_ms,
+            exit: self.exit.clone(),
+            stopped_by: self.stopped_by,
+            leftovers: self.leftovers.clone(),
+            error: self.error.clone(),
+        }
+    }
 
-#[derive(Clone, Copy)]
-enum FinishKind {
-    Exit,
-    Cancelled,
-    Interrupted,
-    TimedOut,
+    fn encode(&self) -> Vec<u8> {
+        serde_json::to_vec(self).expect("job records encode")
+    }
 }
 
-struct SpawnOutcome {
-    finish: FinishKind,
-    exit_code: Option<i32>,
-    orphaned_descendants: bool,
+/// A validated `job/start` entry with its dependencies resolved.
+struct ResolvedJob {
+    job_id: JobId,
+    name: Option<JobName>,
+    command: CommandSpec,
+    depends_on: Vec<JobId>,
+    dependency_policy: JobDependencyPolicy,
+    queue_key: Option<QueueKey>,
+    spec_hash: String,
 }
 
 impl JobManager {
-    pub fn new(cwd: PathBuf, fs_root: PathBuf, state_dir: PathBuf) -> anyhow::Result<Self> {
-        let cwd = normalize_path(cwd);
-        let fs_root = normalize_path(fs_root);
-        let jobs_root = normalize_path(state_dir).join("jobs");
-        std::fs::create_dir_all(&jobs_root)?;
-        let mut state = JobManagerState {
-            accepting: true,
-            ..JobManagerState::default()
-        };
+    /// Loads job summaries and reconciles what an earlier instance left.
+    /// Never fails on a record: unreadable ones are quarantined.
+    pub fn new(config: JobConfig) -> anyhow::Result<Self> {
+        let jobs_dir = config.state_dir.join("jobs");
+        std::fs::create_dir_all(&jobs_dir)?;
+        let quarantine_dir = config.state_dir.join("jobs-quarantine");
+        let boot = process_group::boot_id();
         let now = now_ms();
-
-        for entry in std::fs::read_dir(&jobs_root)? {
-            let entry = entry?;
-            let path = entry.path();
-            if path.extension().and_then(|extension| extension.to_str()) != Some("json") {
-                continue;
-            }
-            let bytes = std::fs::read(&path)?;
-            let mut record: JobRecord = serde_json::from_slice(&bytes)?;
+        let mut state = JobsState::default();
+        for entry in std::fs::read_dir(&jobs_dir)? {
+            let path = entry?.path();
+            let mut record = match load_record(&path) {
+                Ok(record) => record,
+                Err(reason) => {
+                    quarantine(&path, &quarantine_dir, &reason);
+                    continue;
+                }
+            };
             if !record.status.is_terminal() {
+                if record.status == JobStatus::Running
+                    && let Some(spawn) = &record.spawn
+                    && spawn.same_boot(boot.as_deref())
+                {
+                    spawn.group().signal(process_group::GroupSignal::Kill);
+                }
+                record.error = Some(ProtocolError::aborted(
+                    None,
+                    format!(
+                        "the daemon stopped while the job was {}",
+                        status_name(record.status)
+                    ),
+                ));
                 record.status = JobStatus::Interrupted;
                 record.finished_at_ms = Some(now);
-                record.failure =
-                    Some("lightspeed-envd restarted before this job could be recovered".to_owned());
-                persist_record_at(&jobs_root, &record)?;
+                // The last record predates the output the job produced.
+                let cap = config.limits.max_retained_output_bytes;
+                if let Ok(log) = load_output(&path, record.output_end_bytes, cap) {
+                    record.output_end_bytes = log.end();
+                }
+                if let Err(error) = write_json_atomic(&path.join("record.json"), &record) {
+                    eprintln!(
+                        "lightspeed-envd: could not persist interrupted job {}: {error}",
+                        record.job_id
+                    );
+                }
             }
-            state.next_accept_seq = state
-                .next_accept_seq
-                .max(record.accept_seq.saturating_add(1));
-            state
-                .jobs
-                .insert(job_key(&record.namespace, &record.job_id), record);
+            state.next_seq = state.next_seq.max(record.seq.saturating_add(1));
+            state.jobs.insert(
+                record.job_id.clone(),
+                JobEntry {
+                    record,
+                    pending: None,
+                    run: None,
+                    output: None,
+                },
+            );
         }
-
+        let cap = config.limits.max_retained_output_bytes;
+        let store = JobStore::start(jobs_dir, cap / 2, cap - cap / 2)?;
         Ok(Self {
-            cwd,
-            fs_root,
-            jobs_root,
-            state: Arc::new(Mutex::new(state)),
-            notify: Arc::new(Notify::new()),
-            scrubbed_env: Arc::new(Vec::new()),
+            inner: Arc::new(JobsInner {
+                config,
+                store,
+                state: Mutex::new(state),
+                changed: watch::Sender::new(0),
+            }),
         })
     }
 
-    pub fn with_scrubbed_env(mut self, names: Vec<String>) -> Self {
-        self.scrubbed_env = Arc::new(names);
-        self
-    }
-
-    /// Jobs currently executing (running or cancelling).
+    /// Jobs that are `running`.
     pub async fn running_count(&self) -> u32 {
-        u32::try_from(self.state.lock().await.running.len()).unwrap_or(u32::MAX)
+        self.maintain();
+        let running = self
+            .state()
+            .jobs
+            .values()
+            .filter(|entry| entry.record.status == JobStatus::Running)
+            .count();
+        u32::try_from(running).unwrap_or(u32::MAX)
     }
 
-    pub async fn start_jobs(
+    pub async fn start(
         &self,
+        _ctx: &RequestContext,
         params: StartJobsParams,
-    ) -> Result<StartJobsResponse, EnvironmentProtocolError> {
-        let now = now_ms();
-        let resolved = {
-            let state = self.state.lock().await;
-            require_accepting(&state)?;
-            validate_and_resolve_start(&state, &params)?
-        };
-        let mut accepted = Vec::new();
-        {
-            let mut state = self.state.lock().await;
-            require_accepting(&state)?;
-            for job in &resolved {
-                let key = job_key(&params.namespace, &job.spec.job_id);
-                if state.jobs.contains_key(&key) {
-                    state
-                        .secret_envs
-                        .entry(key.clone())
-                        .or_insert_with(|| job.secret_env.clone());
-                    accepted.push(key);
-                    continue;
+    ) -> Result<StartJobsResponse, ProtocolError> {
+        let resolved = self.resolve_start(&params)?;
+        self.maintain();
+        let records = {
+            let mut state = self.state();
+            if let Some(replay) = replay_or_conflict(&state, &params.request_id, &resolved)? {
+                return Ok(StartJobsResponse { jobs: replay });
+            }
+            for (index, job) in resolved.iter().enumerate() {
+                for dependency in &job.depends_on {
+                    let known = state.jobs.contains_key(dependency)
+                        || resolved.iter().any(|other| &other.job_id == dependency);
+                    if !known {
+                        return Err(ProtocolError::invalid_field(
+                            format!("jobs[{index}].dependsOn"),
+                            format!("unknown job id {dependency}"),
+                        ));
+                    }
                 }
-                let accept_seq = state.next_accept_seq;
-                state.next_accept_seq = state.next_accept_seq.saturating_add(1);
-
-                let record = JobRecord {
-                    namespace: params.namespace.clone(),
-                    job_id: job.spec.job_id.clone(),
-                    name: job.spec.name.clone(),
-                    argv: job.spec.argv.clone(),
-                    cwd: job.spec.cwd.clone(),
-                    env: job.spec.env.clone(),
-                    secret_env_names: job.secret_env.keys().cloned().collect(),
-                    stdin: job.spec.stdin.clone(),
-                    timeout_ms: job.spec.timeout_ms,
-                    dependency_policy: job.spec.dependency_policy,
-                    dependencies: job.dependencies.clone(),
-                    queue_key: job.spec.queue_key.clone(),
-                    spec_hash: job.spec_hash.clone(),
-                    accept_seq,
+            }
+            let now = now_ms();
+            let mut started = Vec::new();
+            let mut written = Vec::new();
+            for job in resolved {
+                let seq = state.next_seq;
+                state.next_seq += 1;
+                let record = StoredJob {
+                    format: JOB_RECORD_FORMAT,
+                    job_id: job.job_id.clone(),
+                    request_id: params.request_id.clone(),
+                    name: job.name,
+                    spec_hash: job.spec_hash,
+                    seq,
                     status: JobStatus::Queued,
+                    depends_on: job.depends_on,
+                    dependency_policy: job.dependency_policy,
+                    queue_key: job.queue_key,
                     created_at_ms: now,
-                    queued_at_ms: Some(now),
+                    queued_at_ms: None,
                     started_at_ms: None,
                     finished_at_ms: None,
-                    exit_code: None,
-                    orphaned_descendants: false,
-                    failure: None,
-                    output_chunks: Vec::new(),
-                    output_next_seq: 0,
+                    cancel_requested_at_ms: None,
+                    duration_ms: None,
+                    exit: None,
+                    stopped_by: None,
+                    leftovers: None,
+                    error: None,
+                    spawn: None,
+                    output_end_bytes: 0,
                 };
-                self.persist_record(&record)?;
-                accepted.push(key.clone());
-                state
-                    .secret_envs
-                    .insert(key.clone(), job.secret_env.clone());
-                state.jobs.insert(key, record);
+                written.push(self.inner.store.write_record(&job.job_id, record.encode()));
+                started.push(job.job_id.clone());
+                state.jobs.insert(
+                    job.job_id,
+                    JobEntry {
+                        record,
+                        pending: Some(job.command),
+                        run: None,
+                        output: None,
+                    },
+                );
             }
+            (started, written)
+        };
+        // The writes were queued under the lock, so the scheduler's later
+        // writes land behind them; the start is answered once they are on
+        // disk.
+        let (started, written) = records;
+        for written in written {
+            let _ = written.await;
         }
-
-        self.schedule_ready_jobs().await;
-
-        let state = self.state.lock().await;
+        self.schedule();
+        let state = self.state();
         Ok(StartJobsResponse {
-            jobs: accepted
-                .into_iter()
-                .map(|key| {
-                    state
-                        .jobs
-                        .get(&key)
-                        .map(JobRecord::summary)
-                        .unwrap_or_else(|| lost_summary(&key.0, &key.1))
-                })
+            jobs: started
+                .iter()
+                .filter_map(|job_id| state.jobs.get(job_id))
+                .map(|entry| entry.record.summary())
                 .collect(),
         })
     }
 
-    pub async fn read_jobs(
+    pub async fn read(
         &self,
+        ctx: &RequestContext,
         params: ReadJobsParams,
-    ) -> Result<ReadJobsResponse, EnvironmentProtocolError> {
-        validate_id_component("namespace", &params.namespace)?;
-        if params.jobs.is_empty() {
-            return Err(EnvironmentProtocolError::new(
-                EnvironmentProtocolErrorCode::InvalidRequest,
-                "job/read requires at least one job id",
+    ) -> Result<ReadJobsResponse, ProtocolError> {
+        let limits = &self.inner.config.limits;
+        check_job_count("jobs", params.jobs.len(), limits.max_request_jobs)?;
+        if params.max_bytes > limits.max_read_bytes {
+            return Err(ProtocolError::above_ceiling(
+                "maxBytes",
+                params.max_bytes,
+                limits.max_read_bytes,
             ));
         }
+        if params.wait_ms > self.inner.config.max_wait_ms {
+            return Err(ProtocolError::above_ceiling(
+                "waitMs",
+                params.wait_ms,
+                self.inner.config.max_wait_ms,
+            ));
+        }
+        for (index, entry) in params.jobs.iter().enumerate() {
+            if entry.after.is_some() && entry.tail_bytes.is_some() {
+                return Err(ProtocolError::invalid_field(
+                    format!("jobs[{index}].tailBytes"),
+                    "after and tailBytes exclude each other",
+                ));
+            }
+            if let Some(max_bytes) = entry.max_bytes
+                && max_bytes > params.max_bytes
+            {
+                return Err(ProtocolError::above_ceiling(
+                    format!("jobs[{index}].maxBytes"),
+                    max_bytes,
+                    params.max_bytes,
+                ));
+            }
+        }
+        self.maintain();
+        // The read pages from its own handles on terminal jobs' output: the
+        // shared cache may evict a log between loading and paging.
+        let mut logs: BTreeMap<JobId, Arc<OutputLog>> = BTreeMap::new();
+        for entry in params
+            .jobs
+            .iter()
+            .filter(|entry| needs_output(&params, entry))
+        {
+            if !logs.contains_key(&entry.job_id)
+                && let Some(log) = self.ensure_output(&entry.job_id).await
+            {
+                logs.insert(entry.job_id.clone(), log);
+            }
+        }
 
-        let deadline = params
-            .wait_ms
-            .map(|wait_ms| tokio::time::Instant::now() + Duration::from_millis(wait_ms));
+        let (starts, initial) = {
+            let state = self.state();
+            let mut starts = Vec::new();
+            let mut initial = Vec::new();
+            for (index, entry) in params.jobs.iter().enumerate() {
+                let job = state.jobs.get(&entry.job_id);
+                let end = job.map_or(0, output_end);
+                let start = match (entry.after, entry.tail_bytes) {
+                    (Some(after), _) => after,
+                    (None, Some(tail)) => end.saturating_sub(tail),
+                    (None, None) => 0,
+                };
+                if job.is_some() && start > end {
+                    return Err(ProtocolError::invalid_field(
+                        format!("jobs[{index}].after"),
+                        format!("after {start} is past the end of the output ({end})"),
+                    ));
+                }
+                starts.push(start);
+                initial.push(job.map(|job| job.record.status));
+            }
+            (starts, initial)
+        };
 
+        let deadline = tokio::time::Instant::now() + Duration::from_millis(params.wait_ms);
+        let mut changes = self.inner.changed.subscribe();
         loop {
-            let response = {
-                let state = self.state.lock().await;
-                let response = build_read_response(&state, &params);
-                let all_terminal = response
-                    .jobs
-                    .iter()
-                    .all(|result| result.summary.status.is_terminal());
-                let should_wait = params.wait_ms.is_some()
-                    && !all_terminal
-                    && deadline.is_some_and(|deadline| tokio::time::Instant::now() < deadline);
-                if should_wait { None } else { Some(response) }
-            };
-            if let Some(response) = response {
-                return Ok(response);
+            changes.borrow_and_update();
+            if self.read_ready(&params, &starts, &initial) {
+                break;
             }
-
-            let Some(deadline) = deadline else {
-                continue;
-            };
             tokio::select! {
-                _ = self.notify.notified() => {}
-                _ = tokio::time::sleep_until(deadline) => {}
+                () = ctx.cancel.cancelled() => return Err(ProtocolError::cancelled()),
+                () = tokio::time::sleep_until(deadline) => break,
+                changed = changes.changed() => if changed.is_err() { break },
             }
         }
-    }
 
-    pub async fn list_jobs(
-        &self,
-        params: ListJobsParams,
-    ) -> Result<ListJobsResponse, EnvironmentProtocolError> {
-        validate_id_component("namespace", &params.namespace)?;
-        if matches!(params.limit, Some(0)) {
-            return Err(EnvironmentProtocolError::new(
-                EnvironmentProtocolErrorCode::InvalidRequest,
-                "job/list limit must be greater than zero",
-            ));
-        }
-        let state = self.state.lock().await;
-        let mut jobs = state
-            .jobs
-            .values()
-            .filter(|record| record.namespace == params.namespace)
-            .map(JobRecord::summary)
-            .collect::<Vec<_>>();
-        jobs.sort_by(|left, right| {
-            right
-                .created_at_ms
-                .cmp(&left.created_at_ms)
-                .then_with(|| left.job_id.cmp(&right.job_id))
-        });
-        if let Some(limit) = params.limit {
-            jobs.truncate(limit);
+        // Jobs that finished during the wait: take their logs under the
+        // lock that pages them, loading any the cache no longer holds.
+        let mut attempted = BTreeSet::new();
+        let state = loop {
+            let missing = match self.take_logs(&params, &mut logs, &mut attempted) {
+                Ok(state) => break state,
+                Err(missing) => missing,
+            };
+            for job_id in missing {
+                if let Some(log) = self.ensure_output(&job_id).await {
+                    logs.insert(job_id, log);
+                }
+            }
+        };
+        let mut budget = params.max_bytes;
+        let mut items = MAX_PAGE_CHUNKS;
+        let mut jobs = Vec::with_capacity(params.jobs.len());
+        for (entry, start) in params.jobs.iter().zip(starts) {
+            let Some(job) = state.jobs.get(&entry.job_id) else {
+                jobs.push(JobReadEntry::Error {
+                    job_id: entry.job_id.clone(),
+                    error: unknown_job(&entry.job_id),
+                });
+                continue;
+            };
+            let entry_budget = entry.max_bytes.map_or(budget, |max| max.min(budget));
+            let page = |log: &OutputLog| (log.page(start, entry_budget, items), log.end());
+            let output = match &job.run {
+                Some(_) => with_log(job, page),
+                None => logs.get(&entry.job_id).map(|log| page(log)),
+            };
+            let output = match output {
+                Some((page, end)) => {
+                    budget -= page.bytes;
+                    items = items.saturating_sub(page.items());
+                    OutputPage {
+                        chunks: page.chunks,
+                        next: page.next,
+                        end,
+                        gaps: page.gaps,
+                    }
+                }
+                None => OutputPage {
+                    next: start,
+                    end: output_end(job),
+                    ..OutputPage::default()
+                },
+            };
+            jobs.push(JobReadEntry::Job {
+                summary: Box::new(job.record.summary()),
+                output,
+            });
         }
-        Ok(ListJobsResponse { jobs })
+        Ok(ReadJobsResponse { jobs })
     }
 
-    pub async fn cancel_jobs(
+    pub async fn cancel(
         &self,
+        _ctx: &RequestContext,
         params: CancelJobsParams,
-    ) -> Result<CancelJobsResponse, EnvironmentProtocolError> {
-        validate_id_component("namespace", &params.namespace)?;
-        if params.jobs.is_empty() {
-            return Err(EnvironmentProtocolError::new(
-                EnvironmentProtocolErrorCode::InvalidRequest,
-                "job/cancel requires at least one job id",
-            ));
-        }
-
-        let now = now_ms();
-        let mut cancel_handles = Vec::new();
-        let target_ids = {
-            let state = self.state.lock().await;
-            resolve_cancel_scope(&state, &params)
-        };
-
-        {
-            let mut state = self.state.lock().await;
-            for key in &target_ids {
-                let Some(status) = state.jobs.get(key).map(|record| record.status) else {
-                    continue;
-                };
-                if status.is_terminal() {
-                    continue;
+    ) -> Result<CancelJobsResponse, ProtocolError> {
+        let limits = &self.inner.config.limits;
+        check_job_count("jobIds", params.job_ids.len(), limits.max_request_jobs)?;
+        self.maintain();
+        let response = {
+            let mut state = self.state();
+            let mut named = Vec::new();
+            for job_id in &params.job_ids {
+                if !named.contains(job_id) {
+                    named.push(job_id.clone());
                 }
-                let running = state.running.get(key).cloned();
-                let Some(record) = state.jobs.get_mut(key) else {
-                    continue;
-                };
-                match status {
-                    JobStatus::Running | JobStatus::CancelRequested => {
-                        record.status = JobStatus::CancelRequested;
-                        record.failure = Some(if params.force {
-                            "job force cancellation requested".to_owned()
-                        } else {
-                            "job cancellation requested".to_owned()
-                        });
-                        if let Some(running) = running {
-                            cancel_handles.push(running);
-                        }
+            }
+            let mut dependents = Vec::new();
+            if params.scope == JobCancelScope::Dependents {
+                let mut affected: BTreeSet<JobId> = named.iter().cloned().collect();
+                loop {
+                    let next: Vec<JobId> = state
+                        .jobs
+                        .values()
+                        .filter(|entry| {
+                            !entry.record.status.is_terminal()
+                                && !affected.contains(&entry.record.job_id)
+                                && entry
+                                    .record
+                                    .depends_on
+                                    .iter()
+                                    .any(|dependency| affected.contains(dependency))
+                        })
+                        .map(|entry| entry.record.job_id.clone())
+                        .collect();
+                    if next.is_empty() {
+                        break;
                     }
-                    _ => {
-                        record.status = JobStatus::Cancelled;
-                        record.finished_at_ms = Some(now);
-                        record.failure = Some("job cancelled before start".to_owned());
+                    for job_id in next {
+                        affected.insert(job_id.clone());
+                        dependents.push(job_id);
                     }
                 }
-                self.persist_record(record)?;
             }
-        }
-
-        for running in cancel_handles {
-            running.cancel.notify_one();
-        }
-        self.notify.notify_waiters();
-        self.schedule_ready_jobs().await;
-
-        let state = self.state.lock().await;
-        Ok(CancelJobsResponse {
-            jobs: target_ids
+            let now = now_ms();
+            for job_id in named.iter().chain(&dependents) {
+                if let Some(entry) = state.jobs.get_mut(job_id) {
+                    self.cancel_entry(entry, params.force, now);
+                }
+            }
+            let max_entries = limits.max_request_jobs as usize;
+            let mut jobs: Vec<JobSummaryEntry> = named
                 .iter()
-                .map(|key| {
-                    state
-                        .jobs
-                        .get(key)
-                        .map(JobRecord::summary)
-                        .unwrap_or_else(|| lost_summary(&key.0, &key.1))
+                .map(|job_id| match state.jobs.get(job_id) {
+                    Some(entry) => JobSummaryEntry::Job {
+                        summary: Box::new(entry.record.summary()),
+                    },
+                    None => JobSummaryEntry::Error {
+                        job_id: job_id.clone(),
+                        error: unknown_job(job_id),
+                    },
                 })
-                .collect(),
-        })
+                .collect();
+            let room = max_entries.saturating_sub(jobs.len());
+            let unlisted = dependents.len().saturating_sub(room);
+            jobs.extend(dependents.iter().take(room).filter_map(|job_id| {
+                state.jobs.get(job_id).map(|entry| JobSummaryEntry::Job {
+                    summary: Box::new(entry.record.summary()),
+                })
+            }));
+            CancelJobsResponse {
+                jobs,
+                unlisted_job_count: u32::try_from(unlisted).unwrap_or(u32::MAX),
+            }
+        };
+        self.bump();
+        self.schedule();
+        Ok(response)
+    }
+
+    /// Cancels one job: a queued job ends at once; a running one is
+    /// signalled and ends `cancelled` when its root exits.
+    fn cancel_entry(&self, entry: &mut JobEntry, force: bool, now: i64) {
+        match entry.record.status {
+            JobStatus::Queued => {
+                entry.pending = None;
+                entry.record.status = JobStatus::Cancelled;
+                entry.record.finished_at_ms = Some(now);
+                self.inner
+                    .store
+                    .queue_record(&entry.record.job_id, entry.record.encode());
+            }
+            JobStatus::Running => {
+                if entry.record.cancel_requested_at_ms.is_none() {
+                    entry.record.cancel_requested_at_ms = Some(now);
+                    self.inner
+                        .store
+                        .queue_record(&entry.record.job_id, entry.record.encode());
+                }
+                if let Some(run) = &entry.run {
+                    run.execution.stop(if force {
+                        StoppedBy::Kill
+                    } else {
+                        StoppedBy::Terminate
+                    });
+                }
+            }
+            _ => {}
+        }
     }
 
-    pub async fn interrupt_all(&self) -> Result<(), EnvironmentProtocolError> {
-        let now = now_ms();
-        let mut running = Vec::new();
-        {
-            let mut state = self.state.lock().await;
-            state.accepting = false;
-            let keys = state
-                .jobs
-                .iter()
-                .filter(|(_, record)| !record.status.is_terminal())
-                .map(|(key, _)| key.clone())
-                .collect::<Vec<_>>();
-            for key in keys {
-                let active = state.running.get(&key).cloned();
-                let Some(record) = state.jobs.get_mut(&key) else {
-                    continue;
+    /// Validates a start and resolves its dependencies within the request.
+    fn resolve_start(&self, params: &StartJobsParams) -> Result<Vec<ResolvedJob>, ProtocolError> {
+        let limits = &self.inner.config.limits;
+        check_job_count("jobs", params.jobs.len(), limits.max_request_jobs)?;
+        let mut ids = BTreeSet::new();
+        let mut names = BTreeMap::new();
+        for (index, job) in params.jobs.iter().enumerate() {
+            let field = format!("jobs[{index}].command");
+            validate_command(&job.command, &field)?;
+            if matches!(job.command.input, ExecInput::Pipe {}) {
+                return Err(ProtocolError::invalid_field(
+                    format!("{field}.input"),
+                    "jobs take no pipe input; use bytes",
+                ));
+            }
+            if !ids.insert(job.job_id.clone()) {
+                return Err(ProtocolError::invalid_field(
+                    format!("jobs[{index}].jobId"),
+                    format!("job id {} appears twice", job.job_id),
+                ));
+            }
+            if let Some(name) = &job.name
+                && names.insert(name.clone(), job.job_id.clone()).is_some()
+            {
+                return Err(ProtocolError::invalid_field(
+                    format!("jobs[{index}].name"),
+                    format!("job name {name} appears twice"),
+                ));
+            }
+        }
+        let mut resolved = Vec::new();
+        for (index, job) in params.jobs.iter().enumerate() {
+            let mut depends_on = Vec::new();
+            for dependency in &job.depends_on {
+                let job_id = match dependency {
+                    JobDependency::JobId { job_id } => job_id.clone(),
+                    JobDependency::Name { name } => names.get(name).cloned().ok_or_else(|| {
+                        ProtocolError::invalid_field(
+                            format!("jobs[{index}].dependsOn"),
+                            format!("no job of this request is named {name}"),
+                        )
+                    })?,
                 };
-                if let Some(active) = active {
-                    active.interrupted.store(true, Ordering::Release);
-                    record.status = JobStatus::CancelRequested;
-                    record.failure =
-                        Some("environment close requested job interruption".to_owned());
-                    running.push(active);
-                } else {
-                    record.status = JobStatus::Interrupted;
-                    record.finished_at_ms = Some(now);
-                    record.failure = Some("environment closed before job started".to_owned());
+                if !depends_on.contains(&job_id) {
+                    depends_on.push(job_id);
                 }
-                self.persist_record(record)?;
             }
+            let spec_hash = spec_hash(
+                job.name.as_ref(),
+                &job.command,
+                &depends_on,
+                job.dependency_policy,
+                job.queue_key.as_ref(),
+            );
+            resolved.push(ResolvedJob {
+                job_id: job.job_id.clone(),
+                name: job.name.clone(),
+                command: job.command.clone(),
+                depends_on,
+                dependency_policy: job.dependency_policy,
+                queue_key: job.queue_key.clone(),
+                spec_hash,
+            });
         }
-        for active in running {
-            active.cancel.notify_one();
-        }
-        self.notify.notify_waiters();
-        Ok(())
+        reject_cycles(&resolved)?;
+        Ok(resolved)
     }
 
-    async fn schedule_ready_jobs(&self) {
+    /// Fails jobs whose dependencies can no longer succeed and starts every
+    /// runnable job whose queue is free, in start order.
+    fn schedule(&self) {
+        let mut state = self.state();
+        let mut changed = false;
         loop {
-            let ready = {
-                let mut state = self.state.lock().await;
-                if let Err(error) = self.mark_dependency_failures(&mut state) {
-                    eprintln!("lightspeed-envd job dependency update failed: {error:?}");
+            let now = now_ms();
+            let mut progressed = false;
+            let doomed: Vec<JobId> = state
+                .jobs
+                .values()
+                .filter(|entry| {
+                    entry.record.status == JobStatus::Queued
+                        && entry.record.dependency_policy == JobDependencyPolicy::AllSucceeded
+                        && entry.record.depends_on.iter().any(|dependency| {
+                            state.jobs.get(dependency).is_none_or(|dependency| {
+                                dependency.record.status.is_terminal()
+                                    && dependency.record.status != JobStatus::Succeeded
+                            })
+                        })
+                })
+                .map(|entry| entry.record.job_id.clone())
+                .collect();
+            for job_id in doomed {
+                if let Some(entry) = state.jobs.get_mut(&job_id) {
+                    entry.pending = None;
+                    entry.record.status = JobStatus::DependencyFailed;
+                    entry.record.finished_at_ms = Some(now);
+                    self.inner
+                        .store
+                        .queue_record(&job_id, entry.record.encode());
+                    progressed = true;
                 }
+            }
 
-                let mut busy_queues = state
-                    .running
-                    .keys()
-                    .filter_map(|key| state.jobs.get(key))
-                    .filter_map(|record| {
-                        record
-                            .queue_key
-                            .as_ref()
-                            .map(|queue_key| (record.namespace.clone(), queue_key.clone()))
-                    })
-                    .collect::<BTreeSet<_>>();
-                let mut candidates = state
-                    .jobs
-                    .iter()
-                    .filter_map(|(key, record)| {
-                        if !matches!(record.status, JobStatus::Accepted | JobStatus::Queued)
-                            || state.running.contains_key(key)
-                            || !dependencies_satisfied(&state, record)
-                        {
-                            return None;
-                        }
-                        Some((
-                            key.clone(),
-                            record.accept_seq,
-                            record.queued_at_ms.unwrap_or(record.created_at_ms),
-                            record.created_at_ms,
-                            record.job_id.clone(),
-                        ))
-                    })
-                    .collect::<Vec<_>>();
-                candidates.sort_by(|left, right| {
-                    left.1
-                        .cmp(&right.1)
-                        .then_with(|| left.2.cmp(&right.2))
-                        .then_with(|| left.3.cmp(&right.3))
-                        .then_with(|| left.4.cmp(&right.4))
-                });
-
-                let mut ready_ids = Vec::new();
-                for (key, _, _, _, _) in candidates {
-                    let Some(record) = state.jobs.get(&key) else {
-                        continue;
-                    };
-                    if let Some(queue_key) = record.queue_key.as_ref()
-                        && !busy_queues.insert((record.namespace.clone(), queue_key.clone()))
-                    {
-                        continue;
-                    }
-                    ready_ids.push(key.clone());
+            let mut busy: BTreeSet<QueueKey> = state
+                .jobs
+                .values()
+                .filter(|entry| entry.record.status == JobStatus::Running)
+                .filter_map(|entry| entry.record.queue_key.clone())
+                .collect();
+            let mut runnable: Vec<(u64, JobId)> = state
+                .jobs
+                .values()
+                .filter(|entry| {
+                    entry.record.status == JobStatus::Queued
+                        && entry.record.depends_on.iter().all(|dependency| {
+                            state.jobs.get(dependency).is_none_or(|dependency| {
+                                match entry.record.dependency_policy {
+                                    JobDependencyPolicy::AllSucceeded => {
+                                        dependency.record.status == JobStatus::Succeeded
+                                    }
+                                    JobDependencyPolicy::AllTerminal => {
+                                        dependency.record.status.is_terminal()
+                                    }
+                                }
+                            })
+                        })
+                })
+                .map(|entry| (entry.record.seq, entry.record.job_id.clone()))
+                .collect();
+            runnable.sort();
+            for (_, job_id) in runnable {
+                let entry = state.jobs.get_mut(&job_id).expect("runnable job exists");
+                let newly_runnable = entry.record.queued_at_ms.is_none();
+                if newly_runnable {
+                    entry.record.queued_at_ms = Some(now);
                 }
-                let now = now_ms();
-                let mut ready = Vec::new();
-                for key in ready_ids {
-                    let mut ready_record = None;
-                    if let Some(record) = state.jobs.get_mut(&key) {
-                        record.status = JobStatus::Running;
-                        record.started_at_ms = Some(now);
-                        record.failure = None;
-                        if let Err(error) = self.persist_record(record) {
-                            eprintln!(
-                                "lightspeed-envd failed to persist running job {}: {error:?}",
-                                job_key_id(&key)
-                            );
-                        }
-                        ready_record = Some(record.clone());
-                    }
-                    if let Some(record) = ready_record {
-                        let secret_env = state.secret_envs.get(&key).cloned().unwrap_or_default();
-                        let running = Arc::new(RunningJob {
-                            cancel: Notify::new(),
-                            interrupted: AtomicBool::new(false),
-                        });
-                        state.running.insert(key, running.clone());
-                        ready.push((record.clone(), running, secret_env));
+                if let Some(key) = &entry.record.queue_key
+                    && !busy.insert(key.clone())
+                {
+                    if newly_runnable {
+                        self.inner
+                            .store
+                            .queue_record(&job_id, entry.record.encode());
                     }
+                    continue;
                 }
-                ready
-            };
-
-            if ready.is_empty() {
-                break;
+                self.start_entry(entry, now);
+                progressed = true;
             }
-            for (record, running, secret_env) in ready {
-                let manager = self.clone();
-                tokio::spawn(async move {
-                    manager.run_job(record, running, secret_env).await;
-                });
+            changed |= progressed;
+            if !progressed {
+                break;
             }
         }
+        drop(state);
+        if changed {
+            self.bump();
+        }
     }
 
-    fn mark_dependency_failures(
-        &self,
-        state: &mut JobManagerState,
-    ) -> Result<(), EnvironmentProtocolError> {
-        loop {
-            let mut changed = false;
-            let failed = state
-                .jobs
-                .iter()
-                .filter(|(_, record)| {
-                    matches!(record.status, JobStatus::Accepted | JobStatus::Queued)
-                        && record.dependency_policy == JobDependencyPolicy::AllSucceeded
-                        && record.dependencies.iter().any(|dependency| {
-                            state
-                                .jobs
-                                .get(&job_key(&record.namespace, dependency))
-                                .map(|dependency| {
-                                    dependency.status.is_terminal()
-                                        && dependency.status != JobStatus::Succeeded
-                                })
-                                .unwrap_or(true)
-                        })
-                })
-                .map(|(job_id, _)| job_id.clone())
-                .collect::<Vec<_>>();
-            if failed.is_empty() {
-                return Ok(());
-            }
-            let now = now_ms();
-            for job_id in failed {
-                let Some(record) = state.jobs.get_mut(&job_id) else {
-                    continue;
-                };
-                if record.status.is_terminal() {
-                    continue;
-                }
-                record.status = JobStatus::DependencyFailed;
-                record.finished_at_ms = Some(now);
-                record.failure = Some("one or more dependencies did not succeed".to_owned());
-                self.persist_record(record)?;
-                changed = true;
+    /// Starts one runnable job, or fails it when its `cwd` or spawn fails.
+    fn start_entry(&self, entry: &mut JobEntry, now: i64) {
+        let config = &self.inner.config;
+        let job_id = entry.record.job_id.clone();
+        let Some(command) = entry.pending.take() else {
+            entry.record.status = JobStatus::Failed;
+            entry.record.finished_at_ms = Some(now);
+            entry.record.error = Some(ProtocolError::internal("the job's command was lost"));
+            self.inner
+                .store
+                .queue_record(&job_id, entry.record.encode());
+            return;
+        };
+        let options = ExecOptions {
+            timeout: command.timeout_ms.map(Duration::from_millis),
+            terminate_grace: Duration::from_millis(config.limits.cancel_grace_ms),
+            after_exit: AfterExit::Manual,
+        };
+        let spawned = resolve_cwd(config, command.cwd.as_ref()).and_then(|cwd| {
+            let sink = JobOutput {
+                job_id: job_id.clone(),
+                log: OutputLog::default(),
+                cap: config.limits.max_retained_output_bytes,
+                store: self.inner.store.clone(),
+                changed: self.inner.changed.clone(),
+            };
+            PreparedCommand::new(command, cwd, &config.scrubbed_env, None).spawn(sink, options, 0)
+        });
+        match spawned {
+            Ok(execution) => {
+                entry.record.status = JobStatus::Running;
+                entry.record.started_at_ms = Some(now);
+                entry.record.spawn = Some(SpawnRecord::new(execution.group(), &config.instance_id));
+                self.inner
+                    .store
+                    .queue_record(&job_id, entry.record.encode());
+                execution.start_input();
+                entry.run = Some(Run {
+                    execution: execution.clone(),
+                    started: Instant::now(),
+                });
+                let manager = self.clone();
+                tokio::spawn(async move { manager.supervise(job_id, execution).await });
             }
-            if !changed {
-                return Ok(());
+            Err(error) => {
+                entry.record.status = JobStatus::Failed;
+                entry.record.finished_at_ms = Some(now);
+                entry.record.error = Some(error);
+                self.inner
+                    .store
+                    .queue_record(&job_id, entry.record.encode());
             }
-            self.notify.notify_waiters();
         }
     }
 
-    async fn run_job(
-        &self,
-        record: JobRecord,
-        running: Arc<RunningJob>,
-        secret_env: BTreeMap<String, SecretString>,
-    ) {
-        let result = self
-            .spawn_and_wait(record.clone(), running.clone(), secret_env)
-            .await;
-        let (status, exit_code, orphaned_descendants, failure) = match result {
-            Ok(outcome) => {
-                let (status, failure) = match outcome.finish {
-                    FinishKind::Exit => {
-                        if outcome.exit_code == Some(0) {
-                            (JobStatus::Succeeded, None)
-                        } else {
-                            (
-                                JobStatus::Failed,
-                                Some(match outcome.exit_code {
-                                    Some(code) => format!("job exited with status {code}"),
-                                    None => "job exited without a status code".to_owned(),
-                                }),
-                            )
-                        }
-                    }
-                    FinishKind::Cancelled => {
-                        (JobStatus::Cancelled, Some("job cancelled".to_owned()))
-                    }
-                    FinishKind::Interrupted => (
-                        JobStatus::Interrupted,
-                        Some("job interrupted because the environment closed".to_owned()),
-                    ),
-                    FinishKind::TimedOut => (JobStatus::TimedOut, Some("job timed out".to_owned())),
-                };
-                (
-                    status,
-                    outcome.exit_code,
-                    outcome.orphaned_descendants,
-                    failure,
-                )
-            }
-            Err(error) => (JobStatus::Failed, None, false, Some(error.message)),
+    /// Follows a running job to its end: root exit, sweep, settled output,
+    /// final record, then the scheduler.
+    async fn supervise(self, job_id: JobId, execution: Execution<JobOutput>) {
+        execution.wait_until(|state| state.exited()).await;
+        let leftovers = execution.sample_leftovers(LeftoverDisposition::Swept);
+        if leftovers.is_some() || execution.group_alive() {
+            execution
+                .group()
+                .terminate(Duration::from_millis(
+                    self.inner.config.limits.cancel_grace_ms,
+                ))
+                .await;
+        }
+        execution.settle(true).await;
+        let (exit, stopped_by, error, log) = execution.with_state(|state| {
+            (
+                state.exit().cloned(),
+                state.stopped_by(),
+                state.error().cloned(),
+                Arc::new(state.sink.log.clone()),
+            )
+        });
+        let status = match (&exit, stopped_by) {
+            (_, Some(StoppedBy::Timeout)) => JobStatus::TimedOut,
+            (_, Some(StoppedBy::Terminate | StoppedBy::Kill)) => JobStatus::Cancelled,
+            (Some(ExitStatus::Code { code: 0 }), None) if error.is_none() => JobStatus::Succeeded,
+            _ => JobStatus::Failed,
         };
+        let error = error.or_else(|| match (&exit, status) {
+            (Some(exit), JobStatus::Failed) if !matches!(exit, ExitStatus::Code { .. }) => {
+                Some(ProtocolError::process_failed(describe_exit(exit)))
+            }
+            _ => None,
+        });
 
+        let final_record = {
+            let state = self.state();
+            let Some(entry) = state.jobs.get(&job_id) else {
+                return;
+            };
+            let mut record = entry.record.clone();
+            record.status = status;
+            record.exit = exit;
+            record.stopped_by = stopped_by;
+            record.leftovers = leftovers;
+            record.error = error;
+            record.finished_at_ms = Some(now_ms());
+            record.duration_ms = entry
+                .run
+                .as_ref()
+                .map(|run| u64::try_from(run.started.elapsed().as_millis()).unwrap_or(u64::MAX));
+            record.output_end_bytes = log.end();
+            record
+        };
+        // The output and the record are on disk before anyone sees the job
+        // terminal, so a later load from disk finds everything.
+        self.inner
+            .store
+            .finish(&job_id, final_record.encode())
+            .await;
         {
-            let mut state = self.state.lock().await;
-            let key = job_key(&record.namespace, &record.job_id);
-            state.running.remove(&key);
-            state.secret_envs.remove(&key);
-            if let Some(record) = state.jobs.get_mut(&key) {
-                record.status = status;
-                record.exit_code = exit_code;
-                record.orphaned_descendants = orphaned_descendants;
-                record.failure = failure;
-                record.finished_at_ms = Some(now_ms());
-                if let Err(error) = self.persist_record(record) {
-                    eprintln!(
-                        "lightspeed-envd failed to persist finished job {}: {error:?}",
-                        record.job_id
-                    );
+            let mut state = self.state();
+            let JobsState { jobs, cached, .. } = &mut *state;
+            if let Some(entry) = jobs.get_mut(&job_id) {
+                let cancel_requested_at_ms = entry.record.cancel_requested_at_ms;
+                entry.record = final_record;
+                if entry.record.cancel_requested_at_ms != cancel_requested_at_ms {
+                    entry.record.cancel_requested_at_ms = cancel_requested_at_ms;
+                    self.inner
+                        .store
+                        .queue_record(&job_id, entry.record.encode());
                 }
+                entry.run = None;
+                entry.output = Some(log);
+                cache_output(jobs, cached, &job_id);
             }
         }
-        self.notify.notify_waiters();
-        self.kick_scheduler();
-    }
-
-    fn kick_scheduler(&self) {
-        let manager = self.clone();
-        tokio::spawn(async move {
-            manager.schedule_ready_jobs().await;
-        });
-    }
-
-    async fn spawn_and_wait(
-        &self,
-        record: JobRecord,
-        running: Arc<RunningJob>,
-        secret_env: BTreeMap<String, SecretString>,
-    ) -> Result<SpawnOutcome, EnvironmentProtocolError> {
-        if record.argv.is_empty() {
-            return Err(EnvironmentProtocolError::new(
-                EnvironmentProtocolErrorCode::InvalidRequest,
-                "job argv must not be empty",
-            ));
-        }
-        let cwd = record
-            .cwd
-            .as_ref()
-            .map(|path| self.resolve_cwd(path))
-            .transpose()?
-            .unwrap_or_else(|| self.cwd.clone());
-
-        let mut command = Command::new(&record.argv[0]);
-        for name in secret_env.keys() {
-            if record.env.contains_key(name) {
-                return Err(EnvironmentProtocolError::new(
-                    EnvironmentProtocolErrorCode::InvalidRequest,
-                    format!("job env collides with secret env: {name}"),
-                ));
-            }
-        }
-        for name in self.scrubbed_env.iter() {
-            command.env_remove(name);
-        }
-        command
-            .args(&record.argv[1..])
-            .current_dir(cwd)
-            .envs(record.env.iter())
-            .stdin(if record.stdin.is_some() {
-                Stdio::piped()
-            } else {
-                Stdio::null()
-            })
-            .stdout(Stdio::piped())
-            .stderr(Stdio::piped());
-        for (name, value) in &secret_env {
-            command.env(name, value.expose());
-        }
-        process_group::spawn_in_own_group(&mut command);
-
-        let mut child = command.spawn().map_err(|error| {
-            EnvironmentProtocolError::new(
-                EnvironmentProtocolErrorCode::ProcessFailed,
-                format!("spawn job {:?}: {error}", record.argv),
-            )
-        })?;
-        let pgid = child.id();
-        let stdout = child.stdout.take();
-        let stderr = child.stderr.take();
-        if let Some(input) = record.stdin.as_ref() {
-            let Some(stdin) = child.stdin.as_mut() else {
-                return Err(EnvironmentProtocolError::new(
-                    EnvironmentProtocolErrorCode::ProcessFailed,
-                    "job stdin was not available",
-                ));
-            };
-            stdin.write_all(input.as_slice()).await.map_err(|error| {
-                EnvironmentProtocolError::new(
-                    EnvironmentProtocolErrorCode::ProcessFailed,
-                    error.to_string(),
-                )
-            })?;
-            child.stdin.take();
-        }
-
-        let stdout_task = stdout.map(|stdout| {
-            tokio::spawn(read_job_stream(
-                self.clone(),
-                record.namespace.clone(),
-                record.job_id.clone(),
-                stdout,
-                JobOutputStream::Stdout,
-                redactions_for_secret_env(&secret_env),
-            ))
-        });
-        let stderr_task = stderr.map(|stderr| {
-            tokio::spawn(read_job_stream(
-                self.clone(),
-                record.namespace.clone(),
-                record.job_id.clone(),
-                stderr,
-                JobOutputStream::Stderr,
-                redactions_for_secret_env(&secret_env),
-            ))
-        });
-
-        let kill_job_group = || {
-            if let Some(pgid) = pgid {
-                process_group::kill_group(pgid);
-            }
-        };
-        let (finish, status) = if let Some(timeout_ms) = record.timeout_ms {
-            tokio::select! {
-                status = child.wait() => {
-                    (FinishKind::Exit, status)
-                }
-                _ = running.cancel.notified() => {
-                    kill_job_group();
-                    let _ = child.start_kill();
-                    let finish = if running.interrupted.load(Ordering::Acquire) {
-                        FinishKind::Interrupted
-                    } else {
-                        FinishKind::Cancelled
-                    };
-                    (finish, child.wait().await)
-                }
-                _ = tokio::time::sleep(Duration::from_millis(timeout_ms)) => {
-                    kill_job_group();
-                    let _ = child.start_kill();
-                    (FinishKind::TimedOut, child.wait().await)
-                }
-            }
-        } else {
-            tokio::select! {
-                status = child.wait() => {
-                    (FinishKind::Exit, status)
-                }
-                _ = running.cancel.notified() => {
-                    kill_job_group();
-                    let _ = child.start_kill();
-                    let finish = if running.interrupted.load(Ordering::Acquire) {
-                        FinishKind::Interrupted
-                    } else {
-                        FinishKind::Cancelled
-                    };
-                    (finish, child.wait().await)
-                }
+        self.bump();
+        self.schedule();
+    }
+
+    /// A terminal job's output: the cached log, or the log loaded from disk
+    /// (and cached). `None` for an unknown or running job.
+    async fn ensure_output(&self, job_id: &JobId) -> Option<Arc<OutputLog>> {
+        let (dir, end) = {
+            let mut state = self.state();
+            let JobsState { jobs, cached, .. } = &mut *state;
+            let entry = jobs.get(job_id)?;
+            if entry.run.is_some() || !entry.record.status.is_terminal() {
+                return None;
             }
-        };
-
-        // The root process's exit is ground truth for the job outcome.
-        // Descendants may still hold the output pipes open, so drain them for
-        // a bounded grace period, sweep whatever the script left running, and
-        // abandon the pipes rather than letting completion depend on EOF.
-        let mut stream_tasks = [stdout_task, stderr_task];
-        // Probe for survivors only on a natural exit; on cancel/timeout the
-        // group was killed deliberately and not-yet-reaped children would
-        // read as false positives.
-        let mut orphaned_descendants =
-            matches!(finish, FinishKind::Exit) && pgid.is_some_and(process_group::group_alive);
-        let drained =
-            drain_stream_tasks(&mut stream_tasks, process_group::OUTPUT_DRAIN_GRACE).await;
-        orphaned_descendants |= !drained;
-        if orphaned_descendants && let Some(pgid) = pgid {
-            process_group::sweep_group(pgid).await;
-        }
-        if !drained
-            && !drain_stream_tasks(&mut stream_tasks, process_group::OUTPUT_DRAIN_GRACE).await
-        {
-            for task in stream_tasks.iter().flatten() {
-                task.abort();
+            if let Some(log) = entry.output.clone() {
+                cache_output(jobs, cached, job_id);
+                return Some(log);
             }
-        }
-
-        let status = status.map_err(|error| {
-            EnvironmentProtocolError::new(
-                EnvironmentProtocolErrorCode::ProcessFailed,
-                error.to_string(),
-            )
-        })?;
-        Ok(SpawnOutcome {
-            finish,
-            exit_code: status.code(),
-            orphaned_descendants,
-        })
-    }
-
-    fn resolve_cwd(&self, path: &EnvironmentPath) -> Result<PathBuf, EnvironmentProtocolError> {
-        let candidate = if path.is_absolute() {
-            PathBuf::from(path.as_str())
-        } else if path.as_str() == "." {
-            self.cwd.clone()
-        } else {
-            self.cwd.join(path.as_str())
-        };
-        let normalized = normalize_path(candidate);
-        if !normalized.starts_with(&self.fs_root) {
-            return Err(EnvironmentProtocolError::new(
-                EnvironmentProtocolErrorCode::Forbidden,
-                format!(
-                    "job cwd is outside bridge fs root: {} (root {})",
-                    normalized.display(),
-                    self.fs_root.display()
-                ),
-            ));
-        }
-        Ok(normalized)
-    }
-
-    fn persist_record(&self, record: &JobRecord) -> Result<(), EnvironmentProtocolError> {
-        persist_record_at(&self.jobs_root, record).map_err(|error| {
-            EnvironmentProtocolError::new(
-                EnvironmentProtocolErrorCode::Internal,
-                format!("persist job {}: {error}", record.job_id),
+            (
+                self.inner.store.root().join(job_id.as_str()),
+                entry.record.output_end_bytes,
             )
-        })
-    }
-}
-
-/// Joins the output-reader tasks against one shared deadline. Returns true
-/// when every reader finished; unfinished readers stay in their slot.
-async fn drain_stream_tasks(tasks: &mut [Option<JoinHandle<()>>; 2], grace: Duration) -> bool {
-    let deadline = tokio::time::Instant::now() + grace;
-    let mut drained = true;
-    for slot in tasks.iter_mut() {
-        let Some(task) = slot.as_mut() else {
-            continue;
         };
-        if tokio::time::timeout_at(deadline, task).await.is_ok() {
-            *slot = None;
-        } else {
-            drained = false;
-        }
-    }
-    drained
-}
-
-fn require_accepting(state: &JobManagerState) -> Result<(), EnvironmentProtocolError> {
-    if state.accepting {
-        Ok(())
-    } else {
-        Err(EnvironmentProtocolError::new(
-            EnvironmentProtocolErrorCode::Conflict,
-            "environment target is closed and no longer accepts jobs",
-        ))
-    }
-}
-
-async fn read_job_stream<R>(
-    manager: JobManager,
-    namespace: String,
-    job_id: JobId,
-    mut reader: R,
-    stream: JobOutputStream,
-    redactions: Vec<Vec<u8>>,
-) where
-    R: AsyncRead + Unpin,
-{
-    let mut buffer = vec![0; 8192];
-    loop {
-        let read = match reader.read(&mut buffer).await {
-            Ok(0) => {
-                manager.notify.notify_waiters();
-                return;
+        let cap = self.inner.config.limits.max_retained_output_bytes;
+        let loaded = tokio::task::spawn_blocking(move || load_output(&dir, end, cap)).await;
+        let log = match loaded {
+            Ok(Ok(log)) => log,
+            Ok(Err(error)) => {
+                eprintln!("lightspeed-envd: could not load output of job {job_id}: {error}");
+                OutputLog::from_records([], end)
             }
-            Ok(read) => read,
             Err(error) => {
-                let mut state = manager.state.lock().await;
-                if let Some(record) = state.jobs.get_mut(&job_key(&namespace, &job_id))
-                    && !record.status.is_terminal()
-                {
-                    record.failure = Some(error.to_string());
-                    if let Err(error) = manager.persist_record(record) {
-                        eprintln!(
-                            "lightspeed-envd failed to persist stream failure for {job_id}: {error:?}"
-                        );
-                    }
-                }
-                manager.notify.notify_waiters();
-                return;
+                eprintln!("lightspeed-envd: could not load output of job {job_id}: {error}");
+                OutputLog::from_records([], end)
             }
         };
-        let mut state = manager.state.lock().await;
-        if let Some(record) = state.jobs.get_mut(&job_key(&namespace, &job_id)) {
-            if record.status.is_terminal() {
-                // The job completed without waiting for pipe EOF; late output
-                // from orphaned descendants must not mutate the terminal
-                // record.
-                return;
-            }
-            let seq = record.output_next_seq;
-            record.output_next_seq += 1;
-            record.output_chunks.push(JobOutputChunk {
-                seq,
-                stream,
-                chunk: ByteChunk::from(redact_bytes(&buffer[..read], &redactions)),
-            });
-            if let Err(error) = manager.persist_record(record) {
-                eprintln!("lightspeed-envd failed to persist output for {job_id}: {error:?}");
+        let mut state = self.state();
+        let JobsState { jobs, cached, .. } = &mut *state;
+        let entry = jobs.get_mut(job_id)?;
+        let log = match &entry.output {
+            Some(log) => log.clone(),
+            None => {
+                entry.record.output_end_bytes = entry.record.output_end_bytes.max(log.end());
+                let log = Arc::new(log);
+                entry.output = Some(log.clone());
+                log
             }
-        }
-        manager.notify.notify_waiters();
+        };
+        cache_output(jobs, cached, job_id);
+        Some(log)
     }
-}
 
-fn validate_and_resolve_start(
-    state: &JobManagerState,
-    params: &StartJobsParams,
-) -> Result<Vec<ResolvedJob>, EnvironmentProtocolError> {
-    if params.jobs.is_empty() {
-        return Err(invalid_request("job/start requires at least one job"));
-    }
-    validate_id_component("namespace", &params.namespace)?;
-    validate_id_component("request_id", &params.request_id)?;
-
-    let mut seen_job_ids = BTreeSet::new();
-    let mut seen_names = BTreeMap::new();
-    for spec in &params.jobs {
-        validate_id_component("job id", spec.job_id.as_str())?;
-        if spec.argv.is_empty() {
-            return Err(invalid_request(format!(
-                "job {} argv must not be empty",
-                spec.job_id
-            )));
-        }
-        for name in spec.secret_env.keys() {
-            validate_nonempty("secret env name", name)?;
-            if spec.env.contains_key(name) {
-                return Err(invalid_request(format!(
-                    "job {} env collides with secret env: {name}",
-                    spec.job_id
-                )));
+    /// Adds to `logs` the cached output of every terminal job the read
+    /// pages, and answers the locked state to page from. When a terminal
+    /// job's output is in neither the cache nor `logs` (and was not
+    /// `attempted`), answers those jobs instead: load them and call again.
+    fn take_logs(
+        &self,
+        params: &ReadJobsParams,
+        logs: &mut BTreeMap<JobId, Arc<OutputLog>>,
+        attempted: &mut BTreeSet<JobId>,
+    ) -> Result<MutexGuard<'_, JobsState>, Vec<JobId>> {
+        let state = self.state();
+        let mut missing = Vec::new();
+        for entry in params
+            .jobs
+            .iter()
+            .filter(|entry| needs_output(params, entry))
+        {
+            let Some(job) = state.jobs.get(&entry.job_id) else {
+                continue;
+            };
+            if job.run.is_some() || logs.contains_key(&entry.job_id) {
+                continue;
             }
-        }
-        if !seen_job_ids.insert(spec.job_id.as_str().to_owned()) {
-            return Err(invalid_request(format!(
-                "duplicate job id in start request: {}",
-                spec.job_id
-            )));
-        }
-        if let Some(name) = spec.name.as_deref() {
-            validate_nonempty("job name", name)?;
-            if seen_names
-                .insert(name.to_owned(), spec.job_id.clone())
-                .is_some()
-            {
-                return Err(invalid_request(format!("duplicate job name: {name}")));
+            if let Some(log) = &job.output {
+                logs.insert(entry.job_id.clone(), log.clone());
+            } else if job.record.status.is_terminal() && attempted.insert(entry.job_id.clone()) {
+                missing.push(entry.job_id.clone());
             }
         }
-        validate_optional_id_component("queue_key", spec.queue_key.as_deref())?;
+        if missing.is_empty() {
+            Ok(state)
+        } else {
+            Err(missing)
+        }
     }
 
-    let request_job_ids = params
-        .jobs
-        .iter()
-        .map(|spec| spec.job_id.as_str().to_owned())
-        .collect::<BTreeSet<_>>();
-
-    let mut resolved = Vec::new();
-    for spec in &params.jobs {
-        let dependencies = resolve_explicit_dependencies(&seen_names, spec)?;
-        for dependency in &dependencies {
-            if !request_job_ids.contains(dependency.as_str())
-                && !state
-                    .jobs
-                    .contains_key(&job_key(&params.namespace, dependency))
-            {
-                return Err(invalid_request(format!(
-                    "job {} depends on unknown job id {}",
-                    spec.job_id, dependency
-                )));
-            }
+    fn read_ready(
+        &self,
+        params: &ReadJobsParams,
+        starts: &[u64],
+        initial: &[Option<JobStatus>],
+    ) -> bool {
+        let state = self.state();
+        let entries = params.jobs.iter().zip(starts).zip(initial);
+        let all_terminal = params.jobs.iter().all(|entry| {
+            state
+                .jobs
+                .get(&entry.job_id)
+                .is_none_or(|job| job.record.status.is_terminal())
+        });
+        if all_terminal {
+            return true;
         }
-
-        let spec_hash = job_spec_hash(params, spec, &dependencies)?;
-        let key = job_key(&params.namespace, &spec.job_id);
-        if let Some(existing) = state.jobs.get(&key)
-            && existing.spec_hash != spec_hash
-        {
-            return Err(EnvironmentProtocolError::new(
-                EnvironmentProtocolErrorCode::Conflict,
-                format!(
-                    "job id already exists with different input in namespace {}: {}",
-                    params.namespace, spec.job_id
-                ),
-            ));
+        match params.return_on {
+            ReturnOn::Exit => false,
+            ReturnOn::AnyOutput => entries.into_iter().any(|((entry, start), initial)| {
+                let job = state.jobs.get(&entry.job_id);
+                job.map(|job| job.record.status) != *initial
+                    || job.is_some_and(|job| output_end(job) > *start)
+            }),
+            ReturnOn::Window => entries.into_iter().any(|((entry, start), _)| {
+                let budget = entry.max_bytes.unwrap_or(params.max_bytes);
+                state
+                    .jobs
+                    .get(&entry.job_id)
+                    .is_some_and(|job| output_end(job).saturating_sub(*start) >= budget)
+            }),
         }
-
-        resolved.push(ResolvedJob {
-            spec: spec.clone(),
-            dependencies,
-            secret_env: spec.secret_env.clone(),
-            spec_hash,
-        });
     }
 
-    reject_cycles(&resolved)?;
-    Ok(resolved)
-}
-
-fn resolve_explicit_dependencies(
-    names: &BTreeMap<String, JobId>,
-    spec: &JobStartSpec,
-) -> Result<Vec<JobId>, EnvironmentProtocolError> {
-    let mut dependencies = Vec::new();
-    for dependency in &spec.depends_on {
-        match (&dependency.job_id, &dependency.name) {
-            (Some(job_id), None) => push_unique_job_id(&mut dependencies, job_id.clone()),
-            (None, Some(name)) => {
-                validate_nonempty("dependency name", name)?;
-                let Some(job_id) = names.get(name) else {
-                    return Err(invalid_request(format!(
-                        "job {} depends on unknown local name {name}",
-                        spec.job_id
-                    )));
-                };
-                push_unique_job_id(&mut dependencies, job_id.clone());
-            }
-            (Some(_), Some(_)) => {
-                return Err(invalid_request(format!(
-                    "job {} dependency must use either jobId or name, not both",
-                    spec.job_id
-                )));
-            }
-            (None, None) => {
-                return Err(invalid_request(format!(
-                    "job {} dependency must include jobId or name",
-                    spec.job_id
-                )));
-            }
-        }
-    }
-    for dependency in &dependencies {
-        if dependency == &spec.job_id {
-            return Err(invalid_request(format!(
-                "job {} cannot depend on itself",
-                spec.job_id
-            )));
+    /// Garbage-collects terminal jobs past the record retention.
+    fn maintain(&self) {
+        let retention =
+            i64::try_from(self.inner.config.limits.record_retention_ms).unwrap_or(i64::MAX);
+        let now = now_ms();
+        let mut state = self.state();
+        let expired: Vec<JobId> = state
+            .jobs
+            .values()
+            .filter(|entry| {
+                entry.record.status.is_terminal()
+                    && entry
+                        .record
+                        .finished_at_ms
+                        .is_some_and(|finished| now.saturating_sub(finished) >= retention)
+            })
+            .map(|entry| entry.record.job_id.clone())
+            .collect();
+        for job_id in expired {
+            state.jobs.remove(&job_id);
+            state.cached.retain(|cached| cached != &job_id);
+            self.inner.store.remove(&job_id);
         }
     }
-    Ok(dependencies)
-}
 
-fn reject_cycles(resolved: &[ResolvedJob]) -> Result<(), EnvironmentProtocolError> {
-    let graph = resolved
-        .iter()
-        .map(|job| {
-            (
-                job.spec.job_id.as_str().to_owned(),
-                job.dependencies
-                    .iter()
-                    .filter(|dependency| {
-                        resolved
-                            .iter()
-                            .any(|job| job.spec.job_id.as_str() == dependency.as_str())
-                    })
-                    .map(|dependency| dependency.as_str().to_owned())
-                    .collect::<Vec<_>>(),
-            )
-        })
-        .collect::<BTreeMap<_, _>>();
-    let mut visiting = BTreeSet::new();
-    let mut visited = BTreeSet::new();
-    for job_id in graph.keys() {
-        visit_job(job_id, &graph, &mut visiting, &mut visited)?;
+    fn state(&self) -> MutexGuard<'_, JobsState> {
+        self.inner
+            .state
+            .lock()
+            .unwrap_or_else(|poisoned| poisoned.into_inner())
     }
-    Ok(())
-}
 
-fn visit_job(
-    job_id: &str,
-    graph: &BTreeMap<String, Vec<String>>,
-    visiting: &mut BTreeSet<String>,
-    visited: &mut BTreeSet<String>,
-) -> Result<(), EnvironmentProtocolError> {
-    if visited.contains(job_id) {
-        return Ok(());
-    }
-    if !visiting.insert(job_id.to_owned()) {
-        return Err(invalid_request(format!(
-            "job dependency cycle includes {job_id}"
-        )));
-    }
-    for dependency in graph.get(job_id).into_iter().flatten() {
-        visit_job(dependency, graph, visiting, visited)?;
+    fn bump(&self) {
+        self.inner
+            .changed
+            .send_modify(|version| *version = version.wrapping_add(1));
     }
-    visiting.remove(job_id);
-    visited.insert(job_id.to_owned());
-    Ok(())
 }
 
-fn push_unique_job_id(dependencies: &mut Vec<JobId>, job_id: JobId) {
-    if !dependencies
+/// An identical retry replays every job; any other overlap with existing
+/// jobs is `jobIdInUse`. `None` when every job is new.
+fn replay_or_conflict(
+    state: &JobsState,
+    request_id: &JobRequestId,
+    resolved: &[ResolvedJob],
+) -> Result<Option<Vec<JobSummary>>, ProtocolError> {
+    let existing = resolved
         .iter()
-        .any(|existing| existing.as_str() == job_id.as_str())
-    {
-        dependencies.push(job_id);
-    }
-}
-
-fn dependencies_satisfied(state: &JobManagerState, record: &JobRecord) -> bool {
-    record.dependencies.iter().all(|dependency| {
-        let Some(dependency) = state.jobs.get(&job_key(&record.namespace, dependency)) else {
-            return false;
+        .filter(|job| state.jobs.contains_key(&job.job_id))
+        .count();
+    if existing == 0 {
+        return Ok(None);
+    }
+    let mut summaries = Vec::new();
+    for job in resolved {
+        let in_use = |detail: &str| {
+            ProtocolError::failed_precondition(
+                PreconditionReason::JobIdInUse,
+                format!(
+                    "job id {} {detail}; choose a new job id for a new run",
+                    job.job_id
+                ),
+            )
         };
-        match record.dependency_policy {
-            JobDependencyPolicy::AllSucceeded => dependency.status == JobStatus::Succeeded,
-            JobDependencyPolicy::AllTerminal => dependency.status.is_terminal(),
+        let Some(entry) = state.jobs.get(&job.job_id) else {
+            return Err(in_use(
+                "is new while other jobs of this request already exist",
+            ));
+        };
+        if &entry.record.request_id != request_id {
+            return Err(in_use("was started by another request"));
         }
-    })
-}
-
-fn build_read_response(state: &JobManagerState, params: &ReadJobsParams) -> ReadJobsResponse {
-    ReadJobsResponse {
-        jobs: params
-            .jobs
-            .iter()
-            .map(
-                |job_id| match state.jobs.get(&job_key(&params.namespace, job_id)) {
-                    Some(record) => {
-                        let (output_chunks, output_next_seq) =
-                            select_output_chunks(record, params.after_seq, params.max_bytes);
-                        JobReadResult {
-                            summary: record.summary(),
-                            output_chunks,
-                            output_next_seq,
-                            artifacts: Vec::new(),
-                        }
-                    }
-                    None => JobReadResult {
-                        summary: lost_summary(&params.namespace, job_id),
-                        output_chunks: Vec::new(),
-                        output_next_seq: 0,
-                        artifacts: Vec::new(),
-                    },
-                },
-            )
-            .collect(),
+        if entry.record.spec_hash != job.spec_hash {
+            return Err(in_use("was started with a different spec"));
+        }
+        summaries.push(entry.record.summary());
     }
+    Ok(Some(summaries))
 }
 
-fn select_output_chunks(
-    record: &JobRecord,
-    after_seq: Option<u64>,
-    max_bytes: Option<usize>,
-) -> (Vec<JobOutputChunk>, u64) {
-    let after_seq = after_seq.unwrap_or(0);
-    let mut chunks = Vec::new();
-    let mut bytes = 0usize;
-    let mut next_seq = after_seq;
-
-    for chunk in record
-        .output_chunks
+fn reject_cycles(resolved: &[ResolvedJob]) -> Result<(), ProtocolError> {
+    let index: BTreeMap<&JobId, usize> = resolved
         .iter()
-        .filter(|chunk| chunk.seq >= after_seq)
-    {
-        let chunk_bytes = chunk.chunk.as_slice();
-        if let Some(max_bytes) = max_bytes {
-            if bytes >= max_bytes {
-                break;
-            }
-            let remaining = max_bytes - bytes;
-            if chunk_bytes.len() > remaining {
-                chunks.push(JobOutputChunk {
-                    seq: chunk.seq,
-                    stream: chunk.stream,
-                    chunk: ByteChunk::from(chunk_bytes[..remaining].to_vec()),
-                });
-                next_seq = chunk.seq + 1;
-                break;
+        .enumerate()
+        .map(|(position, job)| (&job.job_id, position))
+        .collect();
+    // 0 unvisited, 1 on the stack, 2 done.
+    let mut marks = vec![0u8; resolved.len()];
+    fn visit(
+        position: usize,
+        resolved: &[ResolvedJob],
+        index: &BTreeMap<&JobId, usize>,
+        marks: &mut [u8],
+    ) -> Result<(), usize> {
+        match marks[position] {
+            2 => return Ok(()),
+            1 => return Err(position),
+            _ => {}
+        }
+        marks[position] = 1;
+        for dependency in &resolved[position].depends_on {
+            if let Some(&next) = index.get(dependency) {
+                visit(next, resolved, index, marks)?;
             }
         }
-        bytes += chunk_bytes.len();
-        next_seq = chunk.seq + 1;
-        chunks.push(chunk.clone());
-    }
-
-    if chunks.is_empty() && next_seq < record.output_next_seq {
-        next_seq = record.output_next_seq;
+        marks[position] = 2;
+        Ok(())
     }
-
-    (chunks, next_seq)
-}
-
-fn resolve_cancel_scope(state: &JobManagerState, params: &CancelJobsParams) -> Vec<JobKey> {
-    let mut target_ids = params
-        .jobs
-        .iter()
-        .map(|job_id| job_key(&params.namespace, job_id))
-        .collect::<BTreeSet<_>>();
-    match params.scope {
-        JobCancelScope::Job => {}
-        JobCancelScope::Dependents => {
-            let mut changed = true;
-            while changed {
-                changed = false;
-                for (key, record) in &state.jobs {
-                    if record.namespace != params.namespace
-                        || record.status.is_terminal()
-                        || target_ids.contains(key)
-                    {
-                        continue;
-                    }
-                    if record.dependencies.iter().any(|dependency| {
-                        target_ids.contains(&job_key(&params.namespace, dependency))
-                    }) {
-                        changed |= target_ids.insert(key.clone());
-                    }
-                }
-            }
+    for position in 0..resolved.len() {
+        if let Err(cycle) = visit(position, resolved, &index, &mut marks) {
+            return Err(ProtocolError::invalid_field(
+                format!("jobs[{cycle}].dependsOn"),
+                format!(
+                    "job {} depends on itself through a cycle",
+                    resolved[cycle].job_id
+                ),
+            ));
         }
     }
-
-    target_ids.into_iter().collect()
+    Ok(())
 }
 
-fn job_spec_hash(
-    params: &StartJobsParams,
-    spec: &JobStartSpec,
-    dependencies: &[JobId],
-) -> Result<String, EnvironmentProtocolError> {
-    #[derive(Serialize)]
-    #[serde(rename_all = "camelCase")]
-    struct JobHashMaterial<'a> {
-        namespace: &'a str,
-        job: JobHashSpec<'a>,
-    }
-
+/// The identity hash of a job's spec. Secret values and input bytes enter
+/// only as their own digests.
+fn spec_hash(
+    name: Option<&JobName>,
+    command: &CommandSpec,
+    depends_on: &[JobId],
+    dependency_policy: JobDependencyPolicy,
+    queue_key: Option<&QueueKey>,
+) -> String {
     #[derive(Serialize)]
     #[serde(rename_all = "camelCase")]
-    struct JobHashSpec<'a> {
-        job_id: &'a JobId,
-        name: &'a Option<String>,
+    struct Material<'a> {
+        name: Option<&'a JobName>,
         argv: &'a [String],
-        cwd: &'a Option<EnvironmentPath>,
+        cwd: Option<&'a EnvironmentPath>,
         env: &'a BTreeMap<String, String>,
-        secret_env_names: Vec<&'a String>,
-        stdin: &'a Option<ByteChunk>,
+        secret_env: BTreeMap<&'a str, String>,
+        input: String,
         timeout_ms: Option<u64>,
-        dependencies: &'a [JobId],
+        depends_on: &'a [JobId],
         dependency_policy: JobDependencyPolicy,
-        queue_key: &'a Option<String>,
-    }
-
-    let material = JobHashMaterial {
-        namespace: params.namespace.as_str(),
-        job: JobHashSpec {
-            job_id: &spec.job_id,
-            name: &spec.name,
-            argv: &spec.argv,
-            cwd: &spec.cwd,
-            env: &spec.env,
-            secret_env_names: spec.secret_env.keys().collect(),
-            stdin: &spec.stdin,
-            timeout_ms: spec.timeout_ms,
-            dependencies,
-            dependency_policy: spec.dependency_policy,
-            queue_key: &spec.queue_key,
+        queue_key: Option<&'a QueueKey>,
+    }
+    let digest = |bytes: &[u8]| encode_hex(&Sha256::digest(bytes));
+    let material = Material {
+        name,
+        argv: &command.argv,
+        cwd: command.cwd.as_ref(),
+        env: &command.env,
+        secret_env: command
+            .secret_env
+            .iter()
+            .map(|(name, value)| (name.as_str(), digest(value.expose().as_bytes())))
+            .collect(),
+        input: match &command.input {
+            ExecInput::None {} => "none".to_owned(),
+            ExecInput::Bytes { data } => format!("bytes:{}", digest(data.as_slice())),
+            ExecInput::Pipe {} => "pipe".to_owned(),
         },
+        timeout_ms: command.timeout_ms,
+        depends_on,
+        dependency_policy,
+        queue_key,
     };
-    let bytes = serde_json::to_vec(&material).map_err(|error| {
-        EnvironmentProtocolError::new(
-            EnvironmentProtocolErrorCode::Internal,
-            format!("encode job idempotency hash: {error}"),
-        )
-    })?;
-    Ok(format!("{:016x}", fnv1a64(&bytes)))
+    digest(&serde_json::to_vec(&material).expect("hash material encodes"))
 }
 
-fn fnv1a64(bytes: &[u8]) -> u64 {
-    let mut hash = 0xcbf29ce484222325u64;
-    for byte in bytes {
-        hash ^= u64::from(*byte);
-        hash = hash.wrapping_mul(0x100000001b3);
+fn resolve_cwd(
+    config: &JobConfig,
+    cwd: Option<&EnvironmentPath>,
+) -> Result<PathBuf, ProtocolError> {
+    match cwd {
+        Some(path) => config.confinement.resolve_directory(path),
+        None => Ok(config.cwd.clone()),
     }
-    hash
 }
 
-impl JobRecord {
-    fn summary(&self) -> JobSummary {
-        JobSummary {
-            namespace: self.namespace.clone(),
-            job_id: self.job_id.clone(),
-            name: self.name.clone(),
-            status: self.status,
-            dependencies: self.dependencies.clone(),
-            created_at_ms: self.created_at_ms,
-            queued_at_ms: self.queued_at_ms,
-            started_at_ms: self.started_at_ms,
-            finished_at_ms: self.finished_at_ms,
-            exit_code: self.exit_code,
-            orphaned_descendants: self.orphaned_descendants,
-            failure: self.failure.clone(),
-            queue_key: self.queue_key.clone(),
-        }
-    }
+/// Whether a `job/read` entry pages output (rather than only a summary).
+fn needs_output(params: &ReadJobsParams, entry: &JobReadRequest) -> bool {
+    params.max_bytes > 0 || entry.after.is_some() || entry.tail_bytes.is_some()
 }
 
-fn lost_summary(namespace: &str, job_id: &JobId) -> JobSummary {
-    JobSummary {
-        namespace: namespace.to_owned(),
-        job_id: job_id.clone(),
-        name: None,
-        status: JobStatus::Lost,
-        dependencies: Vec::new(),
-        created_at_ms: 0,
-        queued_at_ms: None,
-        started_at_ms: None,
-        finished_at_ms: Some(now_ms()),
-        exit_code: None,
-        orphaned_descendants: false,
-        failure: Some("unknown job id".to_owned()),
-        queue_key: None,
+/// Runs `f` on the job's retained output: the live log while it runs, the
+/// cached log once terminal. `None` when neither is in memory.
+fn with_log<R>(entry: &JobEntry, f: impl FnOnce(&OutputLog) -> R) -> Option<R> {
+    if let Some(run) = &entry.run {
+        return Some(run.execution.with_state(|state| f(&state.sink.log)));
     }
+    entry.output.as_deref().map(f)
 }
 
-fn persist_record_at(jobs_root: &PathBuf, record: &JobRecord) -> anyhow::Result<()> {
-    std::fs::create_dir_all(jobs_root)?;
-    let stem = record_file_stem(&record.namespace, &record.job_id);
-    let path = jobs_root.join(format!("{stem}.json"));
-    let temp_path = jobs_root.join(format!("{stem}.json.tmp"));
-    let bytes = serde_json::to_vec_pretty(record)?;
-    std::fs::write(&temp_path, bytes)?;
-    std::fs::rename(temp_path, path)?;
-    Ok(())
-}
-
-fn job_key(namespace: &str, job_id: &JobId) -> JobKey {
-    (namespace.to_owned(), job_id.clone())
-}
-
-fn job_key_id(key: &JobKey) -> String {
-    format!("{}/{}", key.0, key.1)
+fn output_end(entry: &JobEntry) -> u64 {
+    with_log(entry, OutputLog::end).unwrap_or(entry.record.output_end_bytes)
 }
 
-fn record_file_stem(namespace: &str, job_id: &JobId) -> String {
-    format!("{namespace}--{}", job_id.as_str())
+fn cache_output(
+    jobs: &mut BTreeMap<JobId, JobEntry>,
+    cached: &mut VecDeque<JobId>,
+    job_id: &JobId,
+) {
+    cached.retain(|cached| cached != job_id);
+    cached.push_back(job_id.clone());
+    while cached.len() > MAX_CACHED_OUTPUTS {
+        if let Some(evicted) = cached.pop_front()
+            && let Some(entry) = jobs.get_mut(&evicted)
+        {
+            entry.output = None;
+        }
+    }
 }
 
-fn normalize_path(path: PathBuf) -> PathBuf {
-    let mut normalized = PathBuf::new();
-    for component in path.components() {
-        match component {
-            Component::Prefix(prefix) => normalized.push(prefix.as_os_str()),
-            Component::RootDir => normalized.push(std::path::MAIN_SEPARATOR.to_string()),
-            Component::CurDir => {}
-            Component::ParentDir => {
-                normalized.pop();
-            }
-            Component::Normal(segment) => normalized.push(segment),
-        }
+fn check_job_count(field: &str, count: usize, max: u32) -> Result<(), ProtocolError> {
+    if count == 0 {
+        return Err(ProtocolError::invalid_field(field, "name at least one job"));
     }
-    normalized
+    if count > max as usize {
+        return Err(ProtocolError::above_ceiling(
+            field,
+            count as u64,
+            u64::from(max),
+        ));
+    }
+    Ok(())
 }
 
-fn now_ms() -> u64 {
-    SystemTime::now()
-        .duration_since(UNIX_EPOCH)
-        .map(|duration| duration.as_millis().min(u128::from(u64::MAX)) as u64)
-        .unwrap_or_default()
+fn unknown_job(job_id: &JobId) -> ProtocolError {
+    ProtocolError::not_found(format!("unknown job id: {job_id}"))
 }
 
-fn validate_optional_id_component(
-    label: &str,
-    value: Option<&str>,
-) -> Result<(), EnvironmentProtocolError> {
-    if let Some(value) = value {
-        validate_id_component(label, value)?;
+fn status_name(status: JobStatus) -> &'static str {
+    match status {
+        JobStatus::Queued => "queued",
+        JobStatus::Running => "running",
+        JobStatus::Succeeded => "succeeded",
+        JobStatus::Failed => "failed",
+        JobStatus::TimedOut => "timedOut",
+        JobStatus::Cancelled => "cancelled",
+        JobStatus::DependencyFailed => "dependencyFailed",
+        JobStatus::Interrupted => "interrupted",
     }
-    Ok(())
 }
 
-fn validate_id_component(label: &str, value: &str) -> Result<(), EnvironmentProtocolError> {
-    validate_nonempty(label, value)?;
-    if value.len() > 128 {
-        return Err(invalid_request(format!(
-            "{label} must be at most 128 bytes"
-        )));
+/// Reads one job directory's record.
+fn load_record(dir: &Path) -> Result<StoredJob, String> {
+    if !dir.is_dir() {
+        return Err("not a job directory".to_owned());
     }
-    let mut chars = value.chars();
-    let Some(first) = chars.next() else {
-        return Err(invalid_request(format!("{label} must not be empty")));
-    };
-    if !first.is_ascii_alphanumeric() {
-        return Err(invalid_request(format!(
-            "{label} must start with an ASCII alphanumeric character"
-        )));
+    let bytes = std::fs::read(dir.join("record.json")).map_err(|error| error.to_string())?;
+    let record: StoredJob = serde_json::from_slice(&bytes).map_err(|error| error.to_string())?;
+    if record.format != JOB_RECORD_FORMAT {
+        return Err(format!(
+            "record format {} is not {JOB_RECORD_FORMAT}",
+            record.format
+        ));
     }
-    if !chars.all(|ch| ch.is_ascii_alphanumeric() || matches!(ch, '_' | '.' | ':' | '-')) {
-        return Err(invalid_request(format!(
-            "{label} may contain only ASCII alphanumeric characters, '_', '.', ':', or '-'"
-        )));
+    if dir.file_name().and_then(|name| name.to_str()) != Some(record.job_id.as_str()) {
+        return Err("the directory does not match the job id".to_owned());
     }
-    Ok(())
+    Ok(record)
 }
 
-fn validate_nonempty(label: &str, value: &str) -> Result<(), EnvironmentProtocolError> {
-    if value.trim().is_empty() {
-        return Err(invalid_request(format!("{label} must not be empty")));
+/// Moves an unreadable job aside so it never blocks startup again.
+fn quarantine(path: &Path, quarantine_dir: &Path, reason: &str) {
+    let name = path
+        .file_name()
+        .map_or_else(|| "job".into(), |name| name.to_string_lossy().into_owned());
+    let target = quarantine_dir.join(format!("{name}.{}", now_ms()));
+    let moved =
+        std::fs::create_dir_all(quarantine_dir).and_then(|()| std::fs::rename(path, &target));
+    match moved {
+        Ok(()) => eprintln!(
+            "lightspeed-envd: quarantined unreadable job record {} ({reason}) at {}",
+            path.display(),
+            target.display()
+        ),
+        Err(error) => eprintln!(
+            "lightspeed-envd: could not quarantine unreadable job record {} ({reason}): {error}",
+            path.display()
+        ),
     }
-    Ok(())
 }
 
-fn invalid_request(message: impl Into<String>) -> EnvironmentProtocolError {
-    EnvironmentProtocolError::new(EnvironmentProtocolErrorCode::InvalidRequest, message)
+fn now_ms() -> i64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map_or(0, |duration| {
+            i64::try_from(duration.as_millis()).unwrap_or(i64::MAX)
+        })
 }
 
 #[cfg(test)]
 mod tests {
-    use std::{collections::BTreeMap, time::Duration};
-
     use environment_protocol::{
-        data::jobs::{
-            JobCancelScope, JobDependency, JobDependencyPolicy, JobStatus, ListJobsParams,
-            ReadJobsParams, StartJobsParams,
-        },
-        shared::{JobId, SecretString},
+        bytes::ByteChunk,
+        data::{exec::GapReason, job::JobSpec},
+        error::{ErrorData, ProtocolErrorKind},
     };
 
     use super::*;
 
-    const TEST_NAMESPACE: &str = "session_1";
+    fn limits() -> JobLimits {
+        JobLimits {
+            max_read_bytes: 4 * 1024 * 1024,
+            max_request_jobs: 64,
+            max_retained_output_bytes: 2 * 1024 * 1024,
+            record_retention_ms: 7 * 24 * 60 * 60 * 1000,
+            cancel_grace_ms: 200,
+        }
+    }
 
-    #[tokio::test(flavor = "current_thread")]
-    async fn job_manager_runs_parallel_jobs_and_retains_output() {
+    struct Fixture {
+        _temp: tempfile::TempDir,
+        root: PathBuf,
+        state_dir: PathBuf,
+        manager: JobManager,
+    }
+
+    fn fixture_with(limits: JobLimits) -> Fixture {
         let temp = tempfile::tempdir().expect("tempdir");
         let root = temp.path().canonicalize().expect("canonical root");
-        let manager =
-            JobManager::new(root.clone(), root.clone(), root.join(".lightspeed")).expect("manager");
+        let state_dir = root.join("state");
+        let manager = manager_at(&root, &state_dir, limits);
+        Fixture {
+            _temp: temp,
+            root,
+            state_dir,
+            manager,
+        }
+    }
 
-        let response = manager
-            .start_jobs(StartJobsParams {
-                namespace: TEST_NAMESPACE.to_owned(),
-                request_id: "parallel".to_owned(),
-                jobs: vec![job("job-a", "printf a"), job("job-b", "printf b")],
-            })
-            .await
-            .expect("start");
+    fn fixture() -> Fixture {
+        fixture_with(limits())
+    }
 
-        assert_eq!(response.jobs.len(), 2);
-        let read = wait_for_jobs(&manager, ["job-a", "job-b"]).await;
-        assert!(
-            read.jobs
-                .iter()
-                .all(|job| job.summary.status == JobStatus::Succeeded)
-        );
-        assert!(
-            read.jobs
-                .iter()
-                .all(|job| !job.summary.orphaned_descendants)
-        );
-        let output = read
-            .jobs
-            .iter()
-            .flat_map(|job| {
-                job.output_chunks
-                    .iter()
-                    .flat_map(|chunk| chunk.chunk.as_slice().to_vec())
-            })
-            .collect::<Vec<_>>();
-        assert!(output.contains(&b'a'));
-        assert!(output.contains(&b'b'));
+    fn manager_at(root: &Path, state_dir: &Path, limits: JobLimits) -> JobManager {
+        let confinement =
+            Confinement::new(root.to_owned(), state_dir.to_owned()).expect("confinement");
+        JobManager::new(JobConfig {
+            cwd: root.to_owned(),
+            confinement: Arc::new(confinement),
+            state_dir: state_dir.to_owned(),
+            scrubbed_env: Vec::new(),
+            instance_id: DaemonInstanceId::new("envd_test").unwrap(),
+            limits,
+            max_wait_ms: 60_000,
+        })
+        .expect("manager")
     }
 
-    #[tokio::test(flavor = "current_thread")]
-    async fn job_manager_injects_secret_env_without_persisting_values() {
-        let temp = tempfile::tempdir().expect("tempdir");
-        let root = temp.path().canonicalize().expect("canonical root");
-        let manager =
-            JobManager::new(root.clone(), root.clone(), root.join(".lightspeed")).expect("manager");
-        let mut spec = job("secret-job", "printf \"$SECRET_TOKEN\"");
-        spec.secret_env.insert(
-            "SECRET_TOKEN".to_owned(),
-            SecretString::new("super-secret-token"),
-        );
+    fn ctx() -> RequestContext {
+        RequestContext::detached()
+    }
 
-        manager
-            .start_jobs(StartJobsParams {
-                namespace: TEST_NAMESPACE.to_owned(),
-                request_id: "secret".to_owned(),
-                jobs: vec![spec],
-            })
-            .await
-            .expect("start");
+    fn id(value: &str) -> JobId {
+        JobId::new(value).unwrap()
+    }
 
-        let read = wait_for_jobs(&manager, ["secret-job"]).await;
-        let result = result(&read, "secret-job");
-        assert_eq!(result.summary.status, JobStatus::Succeeded);
-        let output = result
-            .output_chunks
-            .iter()
-            .flat_map(|chunk| chunk.chunk.as_slice().to_vec())
-            .collect::<Vec<_>>();
-        assert_eq!(output, b"<redacted>");
-
-        let record_path = root
-            .join(".lightspeed")
-            .join("jobs")
-            .join("session_1--secret-job.json");
-        let persisted = std::fs::read_to_string(record_path).expect("persisted job record");
-        assert!(!persisted.contains("super-secret-token"));
-        assert!(persisted.contains("SECRET_TOKEN"));
+    fn request(value: &str) -> JobRequestId {
+        JobRequestId::new(value).unwrap()
     }
 
-    #[tokio::test(flavor = "current_thread")]
-    async fn job_manager_honors_queue_key_order() {
-        let temp = tempfile::tempdir().expect("tempdir");
-        let root = temp.path().canonicalize().expect("canonical root");
-        let marker = root.join("order.txt");
-        let manager =
-            JobManager::new(root.clone(), root.clone(), root.join(".lightspeed")).expect("manager");
-
-        let mut first = job("queued-z", "printf 1 >> order.txt");
-        let mut second = job("queued-a", "printf 2 >> order.txt");
-        let mut third = job("queued-m", "printf 3 >> order.txt");
-        first.queue_key = Some("repo".to_owned());
-        second.queue_key = Some("repo".to_owned());
-        third.queue_key = Some("repo".to_owned());
-
-        manager
-            .start_jobs(StartJobsParams {
-                namespace: TEST_NAMESPACE.to_owned(),
-                request_id: "queue".to_owned(),
-                jobs: vec![first, second, third],
-            })
+    fn job(job_id: &str, script: &str) -> JobSpec {
+        JobSpec {
+            job_id: id(job_id),
+            name: None,
+            command: CommandSpec {
+                argv: vec!["/bin/sh".to_owned(), "-c".to_owned(), script.to_owned()],
+                cwd: None,
+                env: BTreeMap::new(),
+                secret_env: BTreeMap::new(),
+                input: ExecInput::None {},
+                timeout_ms: None,
+            },
+            depends_on: Vec::new(),
+            dependency_policy: JobDependencyPolicy::AllSucceeded,
+            queue_key: None,
+        }
+    }
+
+    fn start(request_id: &str, jobs: Vec<JobSpec>) -> StartJobsParams {
+        StartJobsParams {
+            request_id: request(request_id),
+            jobs,
+        }
+    }
+
+    fn entry(job_id: &str) -> JobReadRequest {
+        JobReadRequest {
+            job_id: id(job_id),
+            after: None,
+            tail_bytes: None,
+            max_bytes: None,
+        }
+    }
+
+    /// Waits until every job is terminal and reads their output heads.
+    async fn finished(manager: &JobManager, job_ids: &[&str]) -> Vec<(JobSummary, OutputPage)> {
+        let response = manager
+            .read(
+                &ctx(),
+                ReadJobsParams {
+                    jobs: job_ids.iter().map(|job_id| entry(job_id)).collect(),
+                    max_bytes: 4 * 1024 * 1024,
+                    wait_ms: 30_000,
+                    return_on: ReturnOn::Exit,
+                },
+            )
             .await
-            .expect("start");
+            .expect("read");
+        response
+            .jobs
+            .into_iter()
+            .map(|entry| match entry {
+                JobReadEntry::Job { summary, output } => {
+                    assert!(summary.status.is_terminal(), "{summary:?}");
+                    (*summary, output)
+                }
+                JobReadEntry::Error { job_id, error } => panic!("{job_id}: {error}"),
+            })
+            .collect()
+    }
 
-        let read = wait_for_jobs(&manager, ["queued-z", "queued-a", "queued-m"]).await;
-        assert!(
-            read.jobs
+    fn text(page: &OutputPage) -> String {
+        String::from_utf8(
+            page.chunks
                 .iter()
-                .all(|job| job.summary.status == JobStatus::Succeeded)
-        );
-        assert_eq!(std::fs::read_to_string(marker).expect("marker"), "123");
+                .flat_map(|chunk| chunk.data.as_slice().to_vec())
+                .collect(),
+        )
+        .unwrap()
+    }
+
+    fn precondition(error: &ProtocolError) -> Option<PreconditionReason> {
+        match &error.data {
+            ErrorData::FailedPrecondition { reason } => Some(*reason),
+            _ => None,
+        }
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn job_manager_honors_explicit_dependencies_and_dependency_failure() {
-        let temp = tempfile::tempdir().expect("tempdir");
-        let root = temp.path().canonicalize().expect("canonical root");
-        let manager =
-            JobManager::new(root.clone(), root.clone(), root.join(".lightspeed")).expect("manager");
-
-        let mut dependent = job("dependent", "printf should-not-run");
-        dependent.depends_on = vec![JobDependency::name("setup")];
-        manager
-            .start_jobs(StartJobsParams {
-                namespace: TEST_NAMESPACE.to_owned(),
-                request_id: "deps".to_owned(),
-                jobs: vec![named_job("setup", "setup", "exit 7"), dependent],
-            })
+    async fn jobs_run_and_report_exits() {
+        let fixture = fixture();
+        let response = fixture
+            .manager
+            .start(
+                &ctx(),
+                start("r1", vec![job("ok", "printf done"), job("bad", "exit 4")]),
+            )
             .await
             .expect("start");
-
-        let read = wait_for_jobs(&manager, ["setup", "dependent"]).await;
-        let setup = result(&read, "setup");
-        let dependent = result(&read, "dependent");
-        assert_eq!(setup.summary.status, JobStatus::Failed);
-        assert_eq!(dependent.summary.status, JobStatus::DependencyFailed);
+        assert_eq!(response.jobs.len(), 2);
+        let jobs = finished(&fixture.manager, &["ok", "bad"]).await;
+        assert_eq!(jobs[0].0.status, JobStatus::Succeeded);
+        assert_eq!(text(&jobs[0].1), "done");
+        assert_eq!(jobs[0].1.end, 4);
+        assert!(jobs[0].0.duration_ms.is_some());
+        assert_eq!(jobs[1].0.status, JobStatus::Failed);
+        assert_eq!(jobs[1].0.exit, Some(ExitStatus::Code { code: 4 }));
+        assert_eq!(fixture.manager.running_count().await, 0);
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn job_manager_all_terminal_dependencies_run_after_failed_dependency() {
-        let temp = tempfile::tempdir().expect("tempdir");
-        let root = temp.path().canonicalize().expect("canonical root");
-        let manager =
-            JobManager::new(root.clone(), root.clone(), root.join(".lightspeed")).expect("manager");
-
-        let mut cleanup = job("cleanup", "printf cleanup");
-        cleanup.depends_on = vec![JobDependency::job_id("fails")];
-        cleanup.dependency_policy = JobDependencyPolicy::AllTerminal;
-        manager
-            .start_jobs(StartJobsParams {
-                namespace: TEST_NAMESPACE.to_owned(),
-                request_id: "cleanup".to_owned(),
-                jobs: vec![job("fails", "exit 2"), cleanup],
-            })
+    async fn a_resubmitted_job_id_is_refused_and_an_identical_retry_replays() {
+        let fixture = fixture();
+        let script = "echo run >> runs.txt";
+        fixture
+            .manager
+            .start(&ctx(), start("first", vec![job("build", script)]))
             .await
             .expect("start");
+        finished(&fixture.manager, &["build"]).await;
 
-        let read = wait_for_jobs(&manager, ["fails", "cleanup"]).await;
-        assert_eq!(result(&read, "fails").summary.status, JobStatus::Failed);
-        assert_eq!(
-            result(&read, "cleanup").summary.status,
-            JobStatus::Succeeded
-        );
+        let replay = fixture
+            .manager
+            .start(&ctx(), start("first", vec![job("build", script)]))
+            .await
+            .expect("replay");
+        assert_eq!(replay.jobs[0].status, JobStatus::Succeeded);
+
+        let error = fixture
+            .manager
+            .start(&ctx(), start("second", vec![job("build", script)]))
+            .await
+            .unwrap_err();
+        assert_eq!(precondition(&error), Some(PreconditionReason::JobIdInUse));
+        let error = fixture
+            .manager
+            .start(&ctx(), start("first", vec![job("build", "echo changed")]))
+            .await
+            .unwrap_err();
+        assert_eq!(precondition(&error), Some(PreconditionReason::JobIdInUse));
+        let error = fixture
+            .manager
+            .start(
+                &ctx(),
+                start("first", vec![job("build", script), job("new", "true")]),
+            )
+            .await
+            .unwrap_err();
+        assert_eq!(precondition(&error), Some(PreconditionReason::JobIdInUse));
+
+        let runs = std::fs::read_to_string(fixture.root.join("runs.txt")).unwrap();
+        assert_eq!(runs, "run\n", "nothing ran twice");
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn job_manager_cancels_running_jobs_and_queued_dependents() {
-        let temp = tempfile::tempdir().expect("tempdir");
-        let root = temp.path().canonicalize().expect("canonical root");
-        let manager =
-            JobManager::new(root.clone(), root.clone(), root.join(".lightspeed")).expect("manager");
-
-        let mut dependent = job("after", "printf after");
-        dependent.depends_on = vec![JobDependency::job_id("sleep")];
-        manager
-            .start_jobs(StartJobsParams {
-                namespace: TEST_NAMESPACE.to_owned(),
-                request_id: "cancel".to_owned(),
-                jobs: vec![job("sleep", "sleep 5"), dependent],
-            })
+    async fn large_input_never_keeps_a_timeout_from_firing() {
+        // The child never reads its input, so the timeout must be armed
+        // before the input is written or the job runs forever.
+        let fixture = fixture();
+        let mut stuck = job("stuck", "sleep 30");
+        stuck.command.input = ExecInput::Bytes {
+            data: ByteChunk::from(vec![b'x'; 1024 * 1024]),
+        };
+        stuck.command.timeout_ms = Some(300);
+        let mut echo = job("echo", "cat");
+        let input: Vec<u8> = (0..512 * 1024u32).map(|i| b'a' + (i % 26) as u8).collect();
+        echo.command.input = ExecInput::Bytes {
+            data: ByteChunk::from(input.clone()),
+        };
+        fixture
+            .manager
+            .start(&ctx(), start("r", vec![stuck, echo]))
             .await
             .expect("start");
-
-        tokio::time::sleep(Duration::from_millis(50)).await;
-        manager
-            .cancel_jobs(CancelJobsParams {
-                namespace: TEST_NAMESPACE.to_owned(),
-                jobs: vec![JobId::new("sleep")],
-                scope: JobCancelScope::Dependents,
-                force: false,
-            })
-            .await
-            .expect("cancel");
-        let read = wait_for_jobs(&manager, ["sleep", "after"]).await;
-        assert_eq!(result(&read, "sleep").summary.status, JobStatus::Cancelled);
-        assert_eq!(result(&read, "after").summary.status, JobStatus::Cancelled);
+        let jobs = finished(&fixture.manager, &["stuck", "echo"]).await;
+        assert_eq!(jobs[0].0.status, JobStatus::TimedOut);
+        assert_eq!(jobs[0].0.stopped_by, Some(StoppedBy::Timeout));
+        assert_eq!(jobs[1].0.status, JobStatus::Succeeded);
+        assert_eq!(text(&jobs[1].1).as_bytes(), input.as_slice());
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn job_manager_interrupts_jobs_and_rejects_starts_after_close() {
-        let temp = tempfile::tempdir().expect("tempdir");
-        let root = temp.path().canonicalize().expect("canonical root");
-        let manager =
-            JobManager::new(root.clone(), root.clone(), root.join(".lightspeed")).expect("manager");
-
-        let mut dependent = job("after-close", "printf should-not-run");
-        dependent.depends_on = vec![JobDependency::job_id("active-at-close")];
-        manager
-            .start_jobs(StartJobsParams {
-                namespace: TEST_NAMESPACE.to_owned(),
-                request_id: "close-active".to_owned(),
-                jobs: vec![job("active-at-close", "sleep 5"), dependent],
-            })
+    async fn verbose_output_keeps_head_and_tail_and_reads_back_after_a_restart() {
+        let cap = 64 * 1024;
+        let fixture = fixture_with(JobLimits {
+            max_retained_output_bytes: cap,
+            ..limits()
+        });
+        fixture
+            .manager
+            .start(
+                &ctx(),
+                start(
+                    "r",
+                    vec![job(
+                        "verbose",
+                        "i=0; while [ $i -lt 30000 ]; do echo line-$i; i=$((i+1)); done; echo 'FAILED: 3 tests'",
+                    )],
+                ),
+            )
             .await
             .expect("start");
-
-        tokio::time::sleep(Duration::from_millis(50)).await;
-        manager.interrupt_all().await.expect("interrupt all");
-        let read = wait_for_jobs(&manager, ["active-at-close", "after-close"]).await;
-        assert_eq!(
-            result(&read, "active-at-close").summary.status,
-            JobStatus::Interrupted
-        );
-        assert_eq!(
-            result(&read, "after-close").summary.status,
-            JobStatus::Interrupted
-        );
-
-        let error = manager
-            .start_jobs(StartJobsParams {
-                namespace: TEST_NAMESPACE.to_owned(),
-                request_id: "after-close".to_owned(),
-                jobs: vec![job("rejected", "printf should-not-run")],
-            })
+        let jobs = finished(&fixture.manager, &["verbose"]).await;
+        let (summary, page) = &jobs[0];
+        assert_eq!(summary.status, JobStatus::Succeeded);
+        assert_eq!(page.gaps.len(), 1);
+        assert_eq!(page.gaps[0].reason, GapReason::Overflow);
+        assert_eq!(page.gaps[0].offset, cap / 2);
+        let shown = text(page);
+        assert!(shown.starts_with("line-0\n"));
+        assert!(shown.ends_with("FAILED: 3 tests\n"));
+        assert_eq!(shown.len() as u64 + page.gaps[0].omitted_bytes, page.end);
+
+        // Head and tail in one read, as the job service asks for them.
+        let response = fixture
+            .manager
+            .read(
+                &ctx(),
+                ReadJobsParams {
+                    jobs: vec![
+                        JobReadRequest {
+                            max_bytes: Some(10),
+                            ..entry("verbose")
+                        },
+                        JobReadRequest {
+                            tail_bytes: Some(16),
+                            ..entry("verbose")
+                        },
+                    ],
+                    max_bytes: 26,
+                    wait_ms: 0,
+                    return_on: ReturnOn::Exit,
+                },
+            )
             .await
-            .expect_err("closed manager must reject starts");
-        assert_eq!(error.code, EnvironmentProtocolErrorCode::Conflict);
+            .expect("head and tail");
+        let pages: Vec<OutputPage> = response
+            .jobs
+            .into_iter()
+            .map(|entry| match entry {
+                JobReadEntry::Job { output, .. } => output,
+                JobReadEntry::Error { error, .. } => panic!("{error}"),
+            })
+            .collect();
+        assert_eq!(text(&pages[0]), "line-0\nlin");
+        assert_eq!(text(&pages[1]), "FAILED: 3 tests\n");
+
+        let restarted = manager_at(
+            &fixture.root,
+            &fixture.state_dir,
+            JobLimits {
+                max_retained_output_bytes: cap,
+                ..limits()
+            },
+        );
+        let reloaded = finished(&restarted, &["verbose"]).await;
+        assert_eq!(reloaded[0].0.status, JobStatus::Succeeded);
+        let reread = &reloaded[0].1;
+        assert_eq!(text(reread), shown, "the output reads back from disk");
+        assert_eq!(reread.gaps, page.gaps);
+        assert_eq!(reread.end, page.end);
     }
 
-    #[cfg(unix)]
-    async fn wait_for_process_gone(pid: i32) {
-        let deadline = std::time::Instant::now() + Duration::from_secs(5);
-        loop {
-            if rustix::process::test_kill_process(
-                rustix::process::Pid::from_raw(pid).expect("valid child pid"),
+    #[tokio::test(flavor = "current_thread")]
+    async fn pages_continue_exactly_where_they_stopped() {
+        let fixture = fixture();
+        fixture
+            .manager
+            .start(
+                &ctx(),
+                start(
+                    "r",
+                    vec![job(
+                        "page",
+                        "i=0; while [ $i -lt 2000 ]; do printf '%09d\\n' $i; i=$((i+1)); done",
+                    )],
+                ),
             )
-            .is_err()
-            {
-                return;
+            .await
+            .expect("start");
+        finished(&fixture.manager, &["page"]).await;
+        let mut after = 0;
+        let mut collected = String::new();
+        loop {
+            let response = fixture
+                .manager
+                .read(
+                    &ctx(),
+                    ReadJobsParams {
+                        jobs: vec![JobReadRequest {
+                            after: Some(after),
+                            ..entry("page")
+                        }],
+                        max_bytes: 100,
+                        wait_ms: 0,
+                        return_on: ReturnOn::Exit,
+                    },
+                )
+                .await
+                .expect("page");
+            let JobReadEntry::Job { output, .. } = &response.jobs[0] else {
+                panic!("job read failed");
+            };
+            collected.push_str(&text(output));
+            if output.next == output.end {
+                break;
             }
-            assert!(
-                std::time::Instant::now() < deadline,
-                "orphaned descendant {pid} was not terminated"
-            );
-            tokio::time::sleep(Duration::from_millis(20)).await;
+            assert!(output.next > after);
+            after = output.next;
         }
+        assert_eq!(collected.len(), 20_000, "no byte of 20 000 was skipped");
+        assert!(collected.ends_with("000001999\n"));
     }
 
-    #[cfg(unix)]
-    fn read_pid_file(path: &std::path::Path) -> i32 {
-        std::fs::read_to_string(path)
-            .expect("orphan pid file")
-            .trim()
-            .parse()
-            .expect("orphan pid")
-    }
-
-    #[cfg(unix)]
     #[tokio::test(flavor = "current_thread")]
-    async fn job_manager_completes_when_orphaned_descendants_hold_pipes() {
-        let temp = tempfile::tempdir().expect("tempdir");
-        let root = temp.path().canonicalize().expect("canonical root");
-        let manager =
-            JobManager::new(root.clone(), root.clone(), root.join(".lightspeed")).expect("manager");
-
-        manager
-            .start_jobs(StartJobsParams {
-                namespace: TEST_NAMESPACE.to_owned(),
-                request_id: "orphan".to_owned(),
-                jobs: vec![job(
-                    "orphan",
-                    "sleep 30 & echo $! > orphan.pid; printf started; exit 3",
-                )],
-            })
+    async fn a_read_of_more_jobs_than_the_cache_holds_returns_every_output() {
+        let fixture = fixture();
+        let count = MAX_CACHED_OUTPUTS + 4;
+        let names: Vec<String> = (0..count).map(|index| format!("job-{index}")).collect();
+        fixture
+            .manager
+            .start(
+                &ctx(),
+                start(
+                    "r",
+                    names
+                        .iter()
+                        .map(|name| job(name, &format!("printf {name}")))
+                        .collect(),
+                ),
+            )
             .await
             .expect("start");
-
-        let read = wait_for_jobs(&manager, ["orphan"]).await;
-        let result = result(&read, "orphan");
-        assert_eq!(result.summary.status, JobStatus::Failed);
-        assert_eq!(result.summary.exit_code, Some(3));
-        assert!(result.summary.orphaned_descendants);
-        let output = result
-            .output_chunks
-            .iter()
-            .flat_map(|chunk| chunk.chunk.as_slice().to_vec())
-            .collect::<Vec<_>>();
-        assert_eq!(output, b"started");
-
-        wait_for_process_gone(read_pid_file(&root.join("orphan.pid"))).await;
+        let ids: Vec<&str> = names.iter().map(String::as_str).collect();
+        finished(&fixture.manager, &ids).await;
+
+        // A restarted daemon holds no output in memory, so every log is
+        // loaded from disk during this one read.
+        let restarted = manager_at(&fixture.root, &fixture.state_dir, limits());
+        for manager in [&fixture.manager, &restarted] {
+            let jobs = finished(manager, &ids).await;
+            for (name, (_, page)) in names.iter().zip(&jobs) {
+                assert_eq!(&text(page), name);
+                assert_eq!(page.next, page.end);
+            }
+        }
     }
 
-    #[cfg(unix)]
     #[tokio::test(flavor = "current_thread")]
-    async fn job_manager_completes_when_escaped_descendants_hold_pipes() {
-        let temp = tempfile::tempdir().expect("tempdir");
-        let root = temp.path().canonicalize().expect("canonical root");
-        let manager =
-            JobManager::new(root.clone(), root.clone(), root.join(".lightspeed")).expect("manager");
-
-        // `set -m` puts the background child in its own process group, so the
-        // group sweep cannot reach it and completion must abandon the pipes.
-        manager
-            .start_jobs(StartJobsParams {
-                namespace: TEST_NAMESPACE.to_owned(),
-                request_id: "escapee".to_owned(),
-                jobs: vec![job(
-                    "escapee",
-                    "set -m; sleep 30 & echo $! > escapee.pid; printf started; exit 7",
-                )],
-            })
+    async fn unknown_jobs_are_per_entry_not_found() {
+        let fixture = fixture();
+        let response = fixture
+            .manager
+            .read(
+                &ctx(),
+                ReadJobsParams {
+                    jobs: vec![entry("missing")],
+                    max_bytes: 0,
+                    wait_ms: 1_000,
+                    return_on: ReturnOn::Exit,
+                },
+            )
             .await
-            .expect("start");
-
-        let read = wait_for_jobs(&manager, ["escapee"]).await;
-        let result = result(&read, "escapee");
-        assert_eq!(result.summary.status, JobStatus::Failed);
-        assert_eq!(result.summary.exit_code, Some(7));
-        assert!(result.summary.orphaned_descendants);
-
-        // The escapee is outside the job's process group; clean it up so it
-        // does not outlive the test.
-        let pid = read_pid_file(&root.join("escapee.pid"));
-        let _ = rustix::process::kill_process(
-            rustix::process::Pid::from_raw(pid).expect("valid child pid"),
-            rustix::process::Signal::KILL,
-        );
+            .expect("read");
+        match &response.jobs[0] {
+            JobReadEntry::Error { job_id, error } => {
+                assert_eq!(job_id, &id("missing"));
+                assert_eq!(error.kind(), ProtocolErrorKind::NotFound);
+            }
+            JobReadEntry::Job { .. } => panic!("no summary is invented"),
+        }
     }
 
+    #[cfg(unix)]
     #[tokio::test(flavor = "current_thread")]
-    async fn job_manager_cancel_terminates_process_group() {
-        let temp = tempfile::tempdir().expect("tempdir");
-        let root = temp.path().canonicalize().expect("canonical root");
-        let manager =
-            JobManager::new(root.clone(), root.clone(), root.join(".lightspeed")).expect("manager");
-
-        manager
-            .start_jobs(StartJobsParams {
-                namespace: TEST_NAMESPACE.to_owned(),
-                request_id: "cancel-group".to_owned(),
-                jobs: vec![job("group", "sleep 30 & sleep 30")],
-            })
+    async fn cancel_is_graceful_unless_forced() {
+        let fixture = fixture();
+        fixture
+            .manager
+            .start(
+                &ctx(),
+                start(
+                    "r",
+                    vec![
+                        job(
+                            "graceful",
+                            "trap 'echo trapped; exit 0' TERM; sleep 30 & wait",
+                        ),
+                        job(
+                            "forced",
+                            "trap 'echo trapped; exit 0' TERM; sleep 30 & wait",
+                        ),
+                        job("queued", "true"),
+                    ]
+                    .into_iter()
+                    .enumerate()
+                    .map(|(index, mut spec)| {
+                        if index == 2 {
+                            spec.depends_on = vec![JobDependency::JobId {
+                                job_id: id("forced"),
+                            }];
+                        }
+                        spec
+                    })
+                    .collect(),
+                ),
+            )
             .await
             .expect("start");
-
-        tokio::time::sleep(Duration::from_millis(50)).await;
-        manager
-            .cancel_jobs(CancelJobsParams {
-                namespace: TEST_NAMESPACE.to_owned(),
-                jobs: vec![JobId::new("group")],
-                scope: JobCancelScope::Job,
-                force: false,
-            })
+        tokio::time::sleep(Duration::from_millis(200)).await;
+        fixture
+            .manager
+            .cancel(
+                &ctx(),
+                CancelJobsParams {
+                    job_ids: vec![id("graceful")],
+                    scope: JobCancelScope::Job,
+                    force: false,
+                },
+            )
             .await
             .expect("cancel");
-
-        // The backgrounded child holds the job's pipes; without group
-        // termination the drain would wedge until the read wait expires.
-        let read = wait_for_jobs(&manager, ["group"]).await;
-        let result = result(&read, "group");
-        assert_eq!(result.summary.status, JobStatus::Cancelled);
-        assert!(!result.summary.orphaned_descendants);
-    }
-
-    #[tokio::test(flavor = "current_thread")]
-    async fn job_manager_timeout_terminates_process_group() {
-        let temp = tempfile::tempdir().expect("tempdir");
-        let root = temp.path().canonicalize().expect("canonical root");
-        let manager =
-            JobManager::new(root.clone(), root.clone(), root.join(".lightspeed")).expect("manager");
-        let mut spec = job("timeout-group", "sleep 30 & sleep 30");
-        spec.timeout_ms = Some(50);
-
-        manager
-            .start_jobs(StartJobsParams {
-                namespace: TEST_NAMESPACE.to_owned(),
-                request_id: "timeout-group".to_owned(),
-                jobs: vec![spec],
-            })
+        let cancelled = fixture
+            .manager
+            .cancel(
+                &ctx(),
+                CancelJobsParams {
+                    job_ids: vec![id("forced"), id("missing")],
+                    scope: JobCancelScope::Dependents,
+                    force: true,
+                },
+            )
             .await
-            .expect("start");
-
-        let read = wait_for_jobs(&manager, ["timeout-group"]).await;
+            .expect("force cancel");
+        assert_eq!(cancelled.jobs.len(), 3, "named jobs, then the dependent");
+        assert!(
+            matches!(&cancelled.jobs[1], JobSummaryEntry::Error { error, .. } if error.kind() == ProtocolErrorKind::NotFound)
+        );
+        let jobs = finished(&fixture.manager, &["graceful", "forced", "queued"]).await;
+        assert_eq!(jobs[0].0.status, JobStatus::Cancelled);
+        assert_eq!(jobs[0].0.stopped_by, Some(StoppedBy::Terminate));
+        assert!(jobs[0].0.cancel_requested_at_ms.is_some());
         assert_eq!(
-            result(&read, "timeout-group").summary.status,
-            JobStatus::TimedOut
+            text(&jobs[0].1),
+            "trapped\n",
+            "SIGTERM let the job clean up"
         );
+        assert_eq!(jobs[1].0.status, JobStatus::Cancelled);
+        assert_eq!(jobs[1].0.stopped_by, Some(StoppedBy::Kill));
+        assert_eq!(text(&jobs[1].1), "", "a forced cancel kills at once");
+        assert_eq!(jobs[2].0.status, JobStatus::Cancelled);
+        assert_eq!(jobs[2].0.started_at_ms, None);
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn job_manager_times_out_jobs() {
-        let temp = tempfile::tempdir().expect("tempdir");
-        let root = temp.path().canonicalize().expect("canonical root");
-        let manager =
-            JobManager::new(root.clone(), root.clone(), root.join(".lightspeed")).expect("manager");
-        let mut spec = job("timeout", "sleep 5");
-        spec.timeout_ms = Some(50);
-
-        manager
-            .start_jobs(StartJobsParams {
-                namespace: TEST_NAMESPACE.to_owned(),
-                request_id: "timeout".to_owned(),
-                jobs: vec![spec],
-            })
+    async fn dependencies_and_queues_order_jobs() {
+        let fixture = fixture();
+        let mut first = job("first", "sleep 0.2; echo first >> order.txt");
+        first.name = Some(JobName::new("first job").unwrap());
+        first.queue_key = Some(QueueKey::new("q").unwrap());
+        let mut second = job("second", "echo second >> order.txt");
+        second.queue_key = Some(QueueKey::new("q").unwrap());
+        let mut after = job("after", "echo after >> order.txt; exit 1");
+        after.depends_on = vec![JobDependency::Name {
+            name: JobName::new("first job").unwrap(),
+        }];
+        let mut doomed = job("doomed", "echo doomed >> order.txt");
+        doomed.depends_on = vec![JobDependency::JobId {
+            job_id: id("after"),
+        }];
+        let mut tolerant = job("tolerant", "echo tolerant >> order.txt");
+        tolerant.depends_on = vec![JobDependency::JobId {
+            job_id: id("after"),
+        }];
+        tolerant.dependency_policy = JobDependencyPolicy::AllTerminal;
+        fixture
+            .manager
+            .start(
+                &ctx(),
+                start("r", vec![first, second, after, doomed, tolerant]),
+            )
             .await
             .expect("start");
-
-        let read = wait_for_jobs(&manager, ["timeout"]).await;
-        assert_eq!(result(&read, "timeout").summary.status, JobStatus::TimedOut);
-    }
-
-    #[tokio::test(flavor = "current_thread")]
-    async fn job_manager_retries_same_start_idempotently_and_rejects_conflict() {
-        let temp = tempfile::tempdir().expect("tempdir");
-        let root = temp.path().canonicalize().expect("canonical root");
-        let manager =
-            JobManager::new(root.clone(), root.clone(), root.join(".lightspeed")).expect("manager");
-        let params = StartJobsParams {
-            namespace: TEST_NAMESPACE.to_owned(),
-            request_id: "retry".to_owned(),
-            jobs: vec![job("retry", "printf once")],
-        };
-
-        manager.start_jobs(params.clone()).await.expect("first");
-        manager.start_jobs(params).await.expect("retry");
-        let conflict = manager
-            .start_jobs(StartJobsParams {
-                namespace: TEST_NAMESPACE.to_owned(),
-                request_id: "retry-conflict".to_owned(),
-                jobs: vec![job("retry", "printf different")],
-            })
+        let jobs = finished(
+            &fixture.manager,
+            &["first", "second", "after", "doomed", "tolerant"],
+        )
+        .await;
+        assert_eq!(jobs[3].0.status, JobStatus::DependencyFailed);
+        assert_eq!(jobs[3].0.started_at_ms, None);
+        assert_eq!(jobs[4].0.status, JobStatus::Succeeded);
+        assert_eq!(jobs[2].0.depends_on, vec![id("first")]);
+        let order = std::fs::read_to_string(fixture.root.join("order.txt")).unwrap();
+        let lines: Vec<&str> = order.lines().collect();
+        assert_eq!(lines[0], "first", "one job per queue key, in start order");
+        assert!(lines.iter().position(|line| *line == "second") > Some(0));
+        assert!(!lines.contains(&"doomed"));
+
+        let mut cyclic = job("a", "true");
+        cyclic.depends_on = vec![JobDependency::JobId { job_id: id("b") }];
+        let mut back = job("b", "true");
+        back.depends_on = vec![JobDependency::JobId { job_id: id("a") }];
+        let error = fixture
+            .manager
+            .start(&ctx(), start("cycle", vec![cyclic, back]))
             .await
-            .expect_err("conflict");
-        assert_eq!(conflict.code, EnvironmentProtocolErrorCode::Conflict);
+            .unwrap_err();
+        assert_eq!(error.kind(), ProtocolErrorKind::InvalidParams);
+        let mut piped = job("piped", "cat");
+        piped.command.input = ExecInput::Pipe {};
+        let error = fixture
+            .manager
+            .start(&ctx(), start("pipe", vec![piped]))
+            .await
+            .unwrap_err();
+        assert_eq!(error.kind(), ProtocolErrorKind::InvalidParams);
     }
 
+    #[cfg(unix)]
     #[tokio::test(flavor = "current_thread")]
-    async fn job_manager_lists_latest_jobs_with_limit() {
-        let temp = tempfile::tempdir().expect("tempdir");
-        let root = temp.path().canonicalize().expect("canonical root");
-        let manager =
-            JobManager::new(root.clone(), root.clone(), root.join(".lightspeed")).expect("manager");
-
-        manager
-            .start_jobs(StartJobsParams {
-                namespace: TEST_NAMESPACE.to_owned(),
-                request_id: "list-1".to_owned(),
-                jobs: vec![job("job-old", "printf old")],
-            })
-            .await
-            .expect("start old");
-        tokio::time::sleep(Duration::from_millis(2)).await;
-        manager
-            .start_jobs(StartJobsParams {
-                namespace: TEST_NAMESPACE.to_owned(),
-                request_id: "list-2".to_owned(),
-                jobs: vec![job("job-new", "printf new")],
-            })
-            .await
-            .expect("start new");
-
-        let listed = manager
-            .list_jobs(ListJobsParams {
-                namespace: TEST_NAMESPACE.to_owned(),
-                limit: Some(1),
-            })
+    async fn leftovers_are_swept_and_reported() {
+        let fixture = fixture();
+        fixture
+            .manager
+            .start(
+                &ctx(),
+                start(
+                    "r",
+                    vec![job("leaky", "sleep 30 & echo $! > orphan.pid; exit 0")],
+                ),
+            )
             .await
-            .expect("list jobs");
-
-        assert_eq!(listed.jobs.len(), 1);
-        assert_eq!(listed.jobs[0].job_id.as_str(), "job-new");
+            .expect("start");
+        let jobs = finished(&fixture.manager, &["leaky"]).await;
+        assert_eq!(jobs[0].0.status, JobStatus::Succeeded);
+        let leftovers = jobs[0]
+            .0
+            .leftovers
+            .as_ref()
+            .expect("swept leftovers reported");
+        assert_eq!(leftovers.disposition, LeftoverDisposition::Swept);
+        let orphan: i32 = std::fs::read_to_string(fixture.root.join("orphan.pid"))
+            .unwrap()
+            .trim()
+            .parse()
+            .unwrap();
+        let alive = rustix::process::Pid::from_raw(orphan)
+            .is_some_and(|pid| rustix::process::test_kill_process(pid).is_ok());
+        assert!(!alive, "the group was swept");
     }
 
+    #[cfg(any(target_os = "linux", target_os = "macos"))]
     #[tokio::test(flavor = "current_thread")]
-    async fn job_manager_marks_unfinished_persisted_jobs_interrupted_on_startup() {
-        let temp = tempfile::tempdir().expect("tempdir");
-        let root = temp.path().canonicalize().expect("canonical root");
-        let jobs_root = root.join(".lightspeed").join("jobs");
-        std::fs::create_dir_all(&jobs_root).expect("jobs root");
-        persist_record_at(
-            &jobs_root,
-            &JobRecord {
-                namespace: TEST_NAMESPACE.to_owned(),
-                job_id: JobId::new("recover"),
-                name: None,
-                argv: vec!["sleep".to_owned(), "5".to_owned()],
-                cwd: None,
-                env: BTreeMap::new(),
-                secret_env_names: Vec::new(),
-                stdin: None,
-                timeout_ms: None,
-                dependency_policy: JobDependencyPolicy::AllSucceeded,
-                dependencies: Vec::new(),
-                queue_key: None,
-                spec_hash: "seed".to_owned(),
-                accept_seq: 0,
-                status: JobStatus::Running,
-                created_at_ms: now_ms(),
-                queued_at_ms: Some(now_ms()),
-                started_at_ms: Some(now_ms()),
-                finished_at_ms: None,
-                exit_code: None,
-                orphaned_descendants: false,
-                failure: None,
-                output_chunks: Vec::new(),
-                output_next_seq: 0,
-            },
-        )
-        .expect("persist seed");
-
-        let recovered = JobManager::new(root.clone(), root.clone(), root.join(".lightspeed"))
-            .expect("recovered manager");
-        let read = recovered
-            .read_jobs(ReadJobsParams {
-                namespace: TEST_NAMESPACE.to_owned(),
-                jobs: vec![JobId::new("recover")],
-                after_seq: None,
-                max_bytes: None,
-                include_artifacts: false,
-                wait_ms: None,
-            })
+    async fn a_restart_interrupts_unfinished_jobs_and_kills_their_groups() {
+        let fixture = fixture();
+        fixture
+            .manager
+            .start(
+                &ctx(),
+                start("r", vec![job("long", "echo $$ > root.pid; sleep 30")]),
+            )
             .await
-            .expect("read");
+            .expect("start");
+        let pid_file = fixture.root.join("root.pid");
+        for _ in 0..250 {
+            if std::fs::read_to_string(&pid_file).is_ok_and(|pid| !pid.trim().is_empty()) {
+                break;
+            }
+            tokio::time::sleep(Duration::from_millis(20)).await;
+        }
+        let root: i32 = std::fs::read_to_string(&pid_file)
+            .unwrap()
+            .trim()
+            .parse()
+            .unwrap();
+        // The running record reaches the disk through the store thread.
+        tokio::time::sleep(Duration::from_millis(100)).await;
+        let restarted = manager_at(&fixture.root, &fixture.state_dir, limits());
+        let jobs = finished(&restarted, &["long"]).await;
+        assert_eq!(jobs[0].0.status, JobStatus::Interrupted);
         assert_eq!(
-            result(&read, "recover").summary.status,
-            JobStatus::Interrupted
+            jobs[0].0.error.as_ref().map(ProtocolError::kind),
+            Some(ProtocolErrorKind::Aborted)
         );
-    }
-
-    fn job(job_id: &str, shell: &str) -> JobStartSpec {
-        named_job(job_id, job_id, shell)
-    }
-
-    fn named_job(job_id: &str, name: &str, shell: &str) -> JobStartSpec {
-        JobStartSpec {
-            job_id: JobId::new(job_id),
-            name: Some(name.to_owned()),
-            argv: vec!["/bin/sh".to_owned(), "-c".to_owned(), shell.to_owned()],
-            cwd: None,
-            env: BTreeMap::new(),
-            secret_env: BTreeMap::new(),
-            stdin: None,
-            timeout_ms: Some(5_000),
-            depends_on: Vec::new(),
-            dependency_policy: JobDependencyPolicy::AllSucceeded,
-            queue_key: None,
+        for _ in 0..100 {
+            let alive = rustix::process::Pid::from_raw(root)
+                .is_some_and(|pid| rustix::process::test_kill_process(pid).is_ok());
+            if !alive {
+                return;
+            }
+            tokio::time::sleep(Duration::from_millis(20)).await;
         }
+        panic!("the earlier instance's job group survived the restart");
     }
 
-    async fn wait_for_jobs<const N: usize>(
-        manager: &JobManager,
-        job_ids: [&str; N],
-    ) -> ReadJobsResponse {
-        manager
-            .read_jobs(ReadJobsParams {
-                namespace: TEST_NAMESPACE.to_owned(),
-                jobs: job_ids.iter().map(|job_id| JobId::new(*job_id)).collect(),
-                after_seq: None,
-                max_bytes: None,
-                include_artifacts: false,
-                wait_ms: Some(5_000),
-            })
-            .await
-            .expect("read jobs")
+    #[tokio::test(flavor = "current_thread")]
+    async fn unreadable_records_are_quarantined_instead_of_failing_startup() {
+        let fixture = fixture();
+        let bad = fixture.state_dir.join("jobs").join("broken");
+        std::fs::create_dir_all(&bad).unwrap();
+        std::fs::write(bad.join("record.json"), b"{not json").unwrap();
+        std::fs::write(fixture.state_dir.join("jobs").join("stray.json"), b"{}").unwrap();
+        let restarted = manager_at(&fixture.root, &fixture.state_dir, limits());
+        assert_eq!(restarted.running_count().await, 0);
+        assert!(!bad.exists());
+        let quarantined = std::fs::read_dir(fixture.state_dir.join("jobs-quarantine"))
+            .unwrap()
+            .count();
+        assert_eq!(quarantined, 2);
     }
 
-    fn result<'a>(response: &'a ReadJobsResponse, job_id: &str) -> &'a JobReadResult {
-        response
-            .jobs
-            .iter()
-            .find(|result| result.summary.job_id.as_str() == job_id)
-            .expect("job result")
+    #[tokio::test(flavor = "current_thread")]
+    async fn request_bounds_are_ceilings_not_clamps() {
+        let fixture = fixture_with(JobLimits {
+            max_request_jobs: 2,
+            ..limits()
+        });
+        let error = fixture
+            .manager
+            .start(
+                &ctx(),
+                start(
+                    "r",
+                    vec![job("a", "true"), job("b", "true"), job("c", "true")],
+                ),
+            )
+            .await
+            .unwrap_err();
+        assert!(matches!(
+            error.data,
+            ErrorData::InvalidParams {
+                ceiling: Some(2),
+                ..
+            }
+        ));
+        let error = fixture
+            .manager
+            .read(
+                &ctx(),
+                ReadJobsParams {
+                    jobs: vec![JobReadRequest {
+                        max_bytes: Some(20),
+                        ..entry("a")
+                    }],
+                    max_bytes: 10,
+                    wait_ms: 0,
+                    return_on: ReturnOn::Exit,
+                },
+            )
+            .await
+            .unwrap_err();
+        assert_eq!(error.kind(), ProtocolErrorKind::InvalidParams);
+        let error = fixture
+            .manager
+            .cancel(
+                &ctx(),
+                CancelJobsParams {
+                    job_ids: Vec::new(),
+                    scope: JobCancelScope::Job,
+                    force: false,
+                },
+            )
+            .await
+            .unwrap_err();
+        assert_eq!(error.kind(), ProtocolErrorKind::InvalidParams);
     }
 }
diff --git a/crates/environment-daemon/src/lib.rs b/crates/environment-daemon/src/lib.rs
index 717fc7c14..0ce58c8f3 100644
--- a/crates/environment-daemon/src/lib.rs
+++ b/crates/environment-daemon/src/lib.rs
@@ -1,4 +1,6 @@
 pub mod config;
+pub mod dispatch;
+mod exec;
 pub mod filesystem;
 pub mod identity;
 pub mod jobs;
@@ -6,7 +8,6 @@ pub mod process;
 mod process_group;
 mod redaction;
 pub mod registration;
-pub mod rpc;
 pub mod server;
 pub mod upgrade;
 
@@ -18,27 +19,59 @@ use std::{
     time::Instant,
 };
 
+use anyhow::Context as _;
 use environment_protocol::{
-    data::idle::IdleResponse,
-    shared::{
-        CURRENT_PROTOCOL_VERSION, EnvironmentCapabilities, EnvironmentConnectionId,
-        ImplementationInfo,
+    ENVD_PROTOCOL_VERSION,
+    bootstrap::BuildFacts,
+    bytes::encode_hex,
+    data::{
+        handshake::{
+            DataCapabilities, DataLimits, FilesystemCapabilities, FilesystemLimits, GlobCeilings,
+            InitializeResponse, JobCapabilities, JobLimits, ProcessCapabilities, ProcessLimits,
+            ScanCeilings, SearchCeilings, TransferCeilings,
+        },
+        idle::GetIdleResponse,
     },
+    error::{Capability, ProtocolError},
+    handshake::{ImplementationInfo, Plane},
+    ids::DaemonInstanceId,
+    paths::EnvironmentPath,
 };
+use tokio_util::sync::CancellationToken;
 
 use crate::{
-    config::DaemonConfig, filesystem::LocalFileSystem, jobs::JobManager, process::ProcessManager,
+    config::DaemonConfig,
+    filesystem::{Confinement, FilesystemConfig, LocalFileSystem},
+    jobs::{JobConfig, JobManager},
+    process::{ProcessConfig, ProcessManager},
 };
 
+/// Product name in `serverInfo`, the registration `implementation` and
+/// `--print-build`.
+pub const DAEMON_NAME: &str = "lightspeed-envd";
+
+/// Everything one daemon serves. Cheap to clone; every clone shares the
+/// same managers, activity clock and shutdown token.
 #[derive(Clone)]
 pub struct DaemonRuntime {
-    config: Arc<DaemonConfig>,
-    capabilities: EnvironmentCapabilities,
+    inner: Arc<RuntimeInner>,
+}
+
+struct RuntimeInner {
+    config: DaemonConfig,
+    instance_id: DaemonInstanceId,
+    server_info: ImplementationInfo,
+    capabilities: DataCapabilities,
+    limits: DataLimits,
+    default_cwd: EnvironmentPath,
+    home_directory: Option<EnvironmentPath>,
+    confinement: Arc<Confinement>,
     filesystem: LocalFileSystem,
     processes: ProcessManager,
     jobs: JobManager,
-    next_connection_id: Arc<AtomicU64>,
-    activity: Arc<ActivityClock>,
+    next_connection_id: AtomicU64,
+    activity: ActivityClock,
+    shutdown: CancellationToken,
 }
 
 /// Monotonic record of the last data-plane activity. Deliberately not a
@@ -56,11 +89,17 @@ impl ActivityClock {
     }
 
     pub fn touch(&self) {
-        *self.last.lock().expect("activity clock poisoned") = Instant::now();
+        *self
+            .last
+            .lock()
+            .unwrap_or_else(|poison| poison.into_inner()) = Instant::now();
     }
 
     pub fn idle_for(&self) -> std::time::Duration {
-        self.last.lock().expect("activity clock poisoned").elapsed()
+        self.last
+            .lock()
+            .unwrap_or_else(|poison| poison.into_inner())
+            .elapsed()
     }
 }
 
@@ -80,304 +119,502 @@ pub fn install_crypto_provider() {
 }
 
 impl DaemonRuntime {
-    pub fn new(config: DaemonConfig) -> anyhow::Result<Self> {
+    /// Build the managers over one shared [`Confinement`]. A missing state
+    /// directory is created `0700`.
+    pub fn new(mut config: DaemonConfig) -> anyhow::Result<Self> {
         install_crypto_provider();
-        let capabilities = environment_capabilities(&config);
-        let filesystem = LocalFileSystem::new(
-            config.fs_root.clone(),
-            config.cwd.clone(),
-            !config.read_only_fs,
-        )
-        .with_transfer_state_dir(config.state_dir.join("transfers"))
-        .map_err(|e| anyhow::anyhow!("transfer state: {e:?}"))?;
-        let processes = ProcessManager::new(config.cwd.clone(), config.fs_root.clone())
-            .with_scrubbed_env(config.scrubbed_env.clone());
-        let jobs = JobManager::new(
-            config.cwd.clone(),
-            config.fs_root.clone(),
-            config.state_dir.clone(),
-        )?
-        .with_scrubbed_env(config.scrubbed_env.clone());
+        config.state_dir = config::prepare_state_dir(&config.state_dir)?;
+        let default_cwd = environment_path(&config.cwd).context("cwd")?;
+        let home_directory = home_directory(&config);
+        let instance_id = mint_instance_id()?;
+        let capabilities = data_capabilities(&config);
+        let limits = data_limits();
+        let confinement = Arc::new(
+            Confinement::new(config.fs_root.clone(), config.state_dir.clone())
+                .map_err(|error| anyhow::anyhow!("filesystem confinement: {error}"))?,
+        );
+        let filesystem = LocalFileSystem::new(FilesystemConfig {
+            confinement: confinement.clone(),
+            cwd: config.cwd.clone(),
+            writable: !config.read_only_fs,
+            limits: limits.filesystem.clone(),
+        })
+        .map_err(|error| anyhow::anyhow!("filesystem: {error}"))?;
+        let processes = ProcessManager::new(ProcessConfig {
+            cwd: config.cwd.clone(),
+            confinement: confinement.clone(),
+            state_dir: config.state_dir.clone(),
+            scrubbed_env: config.scrubbed_env.clone(),
+            instance_id: instance_id.clone(),
+            limits: limits.process.clone(),
+            max_wait_ms: limits.max_wait_ms,
+            pty_supported: PTY_SUPPORTED,
+        })
+        .context("process manager")?;
+        let jobs = JobManager::new(JobConfig {
+            cwd: config.cwd.clone(),
+            confinement: confinement.clone(),
+            state_dir: config.state_dir.clone(),
+            scrubbed_env: config.scrubbed_env.clone(),
+            instance_id: instance_id.clone(),
+            limits: limits.job.clone(),
+            max_wait_ms: limits.max_wait_ms,
+        })
+        .context("job manager")?;
         Ok(Self {
-            config: Arc::new(config),
-            capabilities,
-            filesystem,
-            processes,
-            jobs,
-            next_connection_id: Arc::new(AtomicU64::new(1)),
-            activity: Arc::new(ActivityClock::new()),
+            inner: Arc::new(RuntimeInner {
+                config,
+                instance_id,
+                server_info: server_info(),
+                capabilities,
+                limits,
+                default_cwd,
+                home_directory,
+                confinement,
+                filesystem,
+                processes,
+                jobs,
+                next_connection_id: AtomicU64::new(1),
+                activity: ActivityClock::new(),
+                shutdown: CancellationToken::new(),
+            }),
         })
     }
 
     /// Record one unit of data-plane activity.
     pub fn touch_activity(&self) {
-        self.activity.touch();
+        self.inner.activity.touch();
     }
 
-    /// Idle report for the power reaper: zero idle time while any process or
-    /// job is still executing, otherwise the time since the last request.
-    /// Live work keeps the clock fresh so a long-running job that finishes
+    /// `env/getIdle`: zero idle time while any process or job is still
+    /// executing, otherwise the time since the last `use` request. Live
+    /// work keeps the clock fresh so a long-running job that finishes
     /// starts the idle countdown from its end, not its start. Leftover
     /// process groups are counted but are not work: a server waiting for
     /// requests must not keep the environment awake.
-    pub async fn idle_report(&self) -> IdleResponse {
-        let running_processes = self.processes.running_count().await;
-        let running_jobs = self.jobs.running_count().await;
-        let leftover_process_groups = self.processes.leftover_group_count();
-        if running_processes > 0 || running_jobs > 0 {
-            self.activity.touch();
-            return IdleResponse {
-                idle_for_ms: 0,
-                running_processes,
-                running_jobs,
-                leftover_process_groups,
-            };
+    pub async fn idle_report(&self) -> GetIdleResponse {
+        let running_process_count = self.inner.processes.running_count().await;
+        let running_job_count = self.inner.jobs.running_count().await;
+        let leftover_process_group_count = self.inner.processes.leftover_group_count();
+        if running_process_count > 0 || running_job_count > 0 {
+            self.inner.activity.touch();
         }
-        IdleResponse {
-            idle_for_ms: u64::try_from(self.activity.idle_for().as_millis()).unwrap_or(u64::MAX),
-            running_processes,
-            running_jobs,
-            leftover_process_groups,
+        let idle_for_ms = if running_process_count > 0 || running_job_count > 0 {
+            0
+        } else {
+            u64::try_from(self.inner.activity.idle_for().as_millis()).unwrap_or(u64::MAX)
+        };
+        GetIdleResponse {
+            idle_for_ms,
+            running_process_count,
+            running_job_count,
+            leftover_process_group_count,
+        }
+    }
+
+    /// The data-plane `initialize` response; identical on every connection
+    /// of this daemon instance.
+    pub fn initialize_response(&self) -> InitializeResponse {
+        InitializeResponse {
+            protocol_version: ENVD_PROTOCOL_VERSION,
+            plane: Plane::Data,
+            daemon_instance_id: self.inner.instance_id.clone(),
+            server_info: self.inner.server_info.clone(),
+            capabilities: self.inner.capabilities.clone(),
+            limits: self.inner.limits.clone(),
+            default_cwd: self.inner.default_cwd.clone(),
+            home_directory: self.inner.home_directory.clone(),
         }
     }
 
+    /// `capabilityUnavailable` unless this daemon serves `capability`.
+    pub fn require_capability(&self, capability: Capability) -> Result<(), ProtocolError> {
+        if dispatch::has_capability(&self.inner.capabilities, capability) {
+            return Ok(());
+        }
+        Err(ProtocolError::capability_unavailable(
+            capability,
+            format!("this daemon does not serve {}", capability_name(capability)),
+        ))
+    }
+
     pub fn config(&self) -> &DaemonConfig {
-        &self.config
+        &self.inner.config
+    }
+
+    pub fn instance_id(&self) -> &DaemonInstanceId {
+        &self.inner.instance_id
+    }
+
+    pub fn server_info(&self) -> &ImplementationInfo {
+        &self.inner.server_info
+    }
+
+    pub fn capabilities(&self) -> &DataCapabilities {
+        &self.inner.capabilities
+    }
+
+    pub fn limits(&self) -> &DataLimits {
+        &self.inner.limits
     }
 
-    pub fn implementation(&self) -> ImplementationInfo {
-        build_info().into()
+    pub fn confinement(&self) -> &Arc<Confinement> {
+        &self.inner.confinement
     }
 
-    pub fn capabilities(&self) -> EnvironmentCapabilities {
-        self.capabilities.clone()
+    /// Daemon-unique, increasing connection number.
+    pub fn next_connection_id(&self) -> u64 {
+        self.inner
+            .next_connection_id
+            .fetch_add(1, Ordering::Relaxed)
     }
 
-    pub fn next_connection_id(&self) -> EnvironmentConnectionId {
-        let id = self.next_connection_id.fetch_add(1, Ordering::Relaxed);
-        EnvironmentConnectionId::new(format!("envd-{id}"))
+    /// Cancelled when the daemon begins a deliberate shutdown: listeners stop
+    /// accepting, data connections end and the registration channel says
+    /// goodbye.
+    pub fn shutdown(&self) -> &CancellationToken {
+        &self.inner.shutdown
     }
 
     pub fn filesystem(&self) -> &LocalFileSystem {
-        &self.filesystem
+        &self.inner.filesystem
     }
 
     pub fn processes(&self) -> &ProcessManager {
-        &self.processes
+        &self.inner.processes
     }
 
     pub fn jobs(&self) -> &JobManager {
-        &self.jobs
+        &self.inner.jobs
     }
 }
 
-fn environment_capabilities(config: &DaemonConfig) -> EnvironmentCapabilities {
-    EnvironmentCapabilities {
-        filesystem_read: true,
-        filesystem_write: !config.read_only_fs,
-        filesystem_search: true,
-        filesystem_glob: true,
-        filesystem_ranged_read: true,
-        filesystem_transfer: cfg!(any(target_os = "linux", target_os = "macos")),
-        filesystem_scan: cfg!(any(target_os = "linux", target_os = "macos")),
-        filesystem_capture: cfg!(any(target_os = "linux", target_os = "macos")),
-        filesystem_materialize: cfg!(any(target_os = "linux", target_os = "macos"))
-            && !config.read_only_fs,
-        process_start: true,
-        process_stdin: true,
-        process_terminate: true,
-        process_output_polling: true,
-        process_output_notifications: false,
-        process_pty: true,
-        job_start: true,
-        job_list: true,
-        job_read: true,
-        job_cancel: true,
-        job_wait_hint: false,
-        job_dependencies: true,
-        job_queue_keys: true,
-        network: true,
+/// PTYs are served wherever `portable-pty` has a Unix backend.
+const PTY_SUPPORTED: bool = cfg!(unix);
+
+fn data_capabilities(config: &DaemonConfig) -> DataCapabilities {
+    DataCapabilities {
+        filesystem: Some(FilesystemCapabilities {
+            write: !config.read_only_fs,
+        }),
+        process: Some(ProcessCapabilities { pty: PTY_SUPPORTED }),
+        job: Some(JobCapabilities {}),
     }
 }
 
-pub fn protocol_version() -> u32 {
-    CURRENT_PROTOCOL_VERSION
+const KIB: u64 = 1024;
+const MIB: u64 = 1024 * KIB;
+const GIB: u64 = 1024 * MIB;
+const TIB: u64 = 1024 * GIB;
+
+/// The ceilings envd enforces and advertises. Every response they allow
+/// fits below `MAX_MESSAGE_BYTES` after base64.
+pub fn data_limits() -> DataLimits {
+    DataLimits {
+        max_concurrent_requests: 32,
+        max_wait_ms: 1_800_000,
+        process: ProcessLimits {
+            max_read_bytes: 4 * MIB,
+            max_retained_output_bytes: MIB,
+            retention_after_exit_ms: 60_000,
+            unread_retention_ms: 7_200_000,
+            max_exited_retained_bytes: 64 * MIB,
+            terminate_grace_ms: 5_000,
+            max_input_queue_bytes: MIB,
+        },
+        job: JobLimits {
+            max_read_bytes: 4 * MIB,
+            max_request_jobs: 64,
+            max_retained_output_bytes: 2 * MIB,
+            record_retention_ms: 604_800_000,
+            cancel_grace_ms: 5_000,
+        },
+        filesystem: FilesystemLimits {
+            max_read_file_bytes: 8 * MIB,
+            max_write_file_bytes: 8 * MIB,
+            max_directory_entries: 1_000,
+            search: SearchCeilings {
+                max_matches: 10_000,
+                max_files: 100_000,
+                max_bytes: GIB,
+                max_duration_ms: 60_000,
+                max_line_bytes: 4_096,
+            },
+            glob: GlobCeilings {
+                max_matches: 100_000,
+                max_files: 1_000_000,
+                max_duration_ms: 60_000,
+            },
+            scan: ScanCeilings {
+                max_roots: 32,
+                max_patterns: 32,
+                max_entries: 10_000,
+                max_file_bytes: 256 * KIB,
+                max_total_bytes: 4 * MIB,
+                max_duration_ms: 30_000,
+            },
+            transfer: TransferCeilings {
+                max_active_operations: 8,
+                max_content_chunk_bytes: 4 * MIB,
+                max_inventory_page_entries: 1_000,
+                receipt_retention_ms: 86_400_000,
+                max_entries: 100_000,
+                max_depth: 64,
+                max_file_bytes: TIB,
+                max_total_bytes: TIB,
+                max_manifest_bytes: 32 * MIB,
+                max_duration_ms: 86_400_000,
+            },
+        },
+    }
 }
 
-/// The facts this binary reports about itself: to the gateway in every
-/// handshake, and to an operator through `--print-build`. The protocol
-/// version is the one that decides whether a gateway admits the daemon; the
-/// rest is provenance.
-#[derive(Clone, Debug, PartialEq, Eq, serde::Serialize)]
-#[serde(rename_all = "camelCase")]
-pub struct BuildInfo {
-    pub name: &'static str,
-    pub version: &'static str,
-    pub git_sha: &'static str,
-    pub target: &'static str,
-    pub protocol_version: u32,
+fn capability_name(capability: Capability) -> &'static str {
+    match capability {
+        Capability::Filesystem => "the filesystem family",
+        Capability::FilesystemWrite => "filesystem writes",
+        Capability::Process => "the process family",
+        Capability::ProcessPty => "process PTYs",
+        Capability::Job => "the job family",
+        Capability::AdoptTarget => "target adoption",
+        Capability::Ingress => "ingress",
+    }
 }
 
-pub fn build_info() -> BuildInfo {
-    BuildInfo {
-        name: "lightspeed-envd",
-        version: release_info::VERSION,
-        git_sha: release_info::GIT_SHA,
-        target: release_info::TARGET,
-        protocol_version: CURRENT_PROTOCOL_VERSION,
-    }
+/// `daemonInstanceId`: `envd_` and 32 random hex digits, minted per start.
+fn mint_instance_id() -> anyhow::Result<DaemonInstanceId> {
+    let mut bytes = [0u8; 16];
+    rand::TryRng::try_fill_bytes(&mut rand::rngs::SysRng, &mut bytes)
+        .context("generate daemon instance id")?;
+    Ok(DaemonInstanceId::new(format!(
+        "envd_{}",
+        encode_hex(&bytes)
+    ))?)
 }
 
-impl From<BuildInfo> for ImplementationInfo {
-    fn from(build: BuildInfo) -> Self {
-        ImplementationInfo {
-            name: build.name.to_owned(),
-            version: Some(build.version.to_owned()),
-            git_sha: Some(build.git_sha.to_owned()),
-            target: Some(build.target.to_owned()),
-        }
-    }
+fn environment_path(path: &std::path::Path) -> anyhow::Result<EnvironmentPath> {
+    let text = path
+        .to_str()
+        .with_context(|| format!("{} is not UTF-8", path.display()))?;
+    Ok(EnvironmentPath::new(text)?)
 }
 
-#[cfg(test)]
-mod tests {
-    use std::collections::BTreeMap;
+/// `$HOME` when it is a valid path inside the filesystem root.
+fn home_directory(config: &DaemonConfig) -> Option<EnvironmentPath> {
+    let home = std::env::var_os("HOME")?;
+    let home = std::path::PathBuf::from(home);
+    if !home.starts_with(&config.fs_root) {
+        return None;
+    }
+    environment_path(&home).ok()
+}
 
-    use environment_protocol::{
-        data::process::{
-            ProcessSignal, ReadProcessParams, StartProcessParams, TerminateProcessParams,
-        },
-        shared::ProcessId,
+/// `serverInfo` and the registration `implementation`: this build's facts,
+/// leaving out any the build left empty.
+pub fn server_info() -> ImplementationInfo {
+    let info = ImplementationInfo::new(DAEMON_NAME).expect("the daemon name is a valid field");
+    let info = match info.clone().with_version(release_info::VERSION) {
+        Ok(with) => with,
+        Err(_) => info,
+    };
+    let info = match info.clone().with_git_sha(release_info::GIT_SHA) {
+        Ok(with) => with,
+        Err(_) => info,
     };
+    match info.clone().with_target(release_info::TARGET) {
+        Ok(with) => with,
+        Err(_) => info,
+    }
+}
 
+/// What `--print-build` prints: the facts an orchestrator checks a
+/// downloaded daemon against the deployment's discovery document with.
+pub fn build_facts() -> BuildFacts {
+    BuildFacts {
+        name: DAEMON_NAME.to_owned(),
+        version: release_info::VERSION.to_owned(),
+        git_sha: release_info::GIT_SHA.to_owned(),
+        target: release_info::TARGET.to_owned(),
+        protocol_version: ENVD_PROTOCOL_VERSION,
+    }
+}
+
+#[cfg(test)]
+pub(crate) mod test_support {
     use super::*;
 
-    fn runtime() -> (tempfile::TempDir, DaemonRuntime) {
+    /// A runtime rooted in a fresh temporary directory, its state dir
+    /// beside the root rather than inside it.
+    pub(crate) fn runtime() -> (tempfile::TempDir, DaemonRuntime) {
+        runtime_with(|_| {})
+    }
+
+    pub(crate) fn runtime_with(
+        adjust: impl FnOnce(&mut DaemonConfig),
+    ) -> (tempfile::TempDir, DaemonRuntime) {
         let temp = tempfile::tempdir().expect("tempdir");
-        let root = temp.path().canonicalize().expect("canonical root");
-        let runtime = DaemonRuntime::new(DaemonConfig {
-            listen: Some("127.0.0.1:0".parse().expect("listen")),
+        let base = temp.path().canonicalize().expect("canonical temp");
+        let root = base.join("root");
+        let state = base.join("state");
+        std::fs::create_dir_all(&root).expect("root");
+        std::fs::create_dir_all(&state).expect("state");
+        let mut config = DaemonConfig {
+            listen: None,
             cwd: root.clone(),
-            fs_root: root.clone(),
-            state_dir: root.join("state"),
+            fs_root: root,
+            state_dir: state,
             read_only_fs: false,
             registration: None,
             scrubbed_env: vec!["LIGHTSPEED_ENVD_REGISTRATION_KEY".to_owned()],
-        })
-        .expect("runtime");
+        };
+        adjust(&mut config);
+        let runtime = DaemonRuntime::new(config).expect("runtime");
         (temp, runtime)
     }
+}
+
+#[cfg(test)]
+mod tests {
+    use environment_protocol::{
+        data::handshake::DataLimits,
+        error::ProtocolErrorKind,
+        limits::{MAX_MESSAGE_BYTES, MIN_CONCURRENT_REQUESTS},
+        manifest::{EnvGetIdle, ProcessStart, ProcessTerminate},
+    };
+    use serde_json::json;
+
+    use super::{test_support::runtime, *};
+    use crate::dispatch::{RequestContext, handle_request};
+
+    async fn call(
+        runtime: &DaemonRuntime,
+        method: &str,
+        params: serde_json::Value,
+    ) -> serde_json::Value {
+        handle_request(runtime, &RequestContext::detached(), method, params)
+            .await
+            .unwrap_or_else(|error| panic!("{method}: {error}"))
+            .value
+    }
+
+    #[test]
+    fn instance_ids_are_random_per_start_and_use_the_general_grammar() {
+        let first = mint_instance_id().unwrap();
+        let second = mint_instance_id().unwrap();
+        assert_ne!(first, second);
+        assert!(first.as_str().starts_with("envd_"));
+        assert_eq!(first.as_str().len(), "envd_".len() + 32);
+    }
+
+    /// Every advertised ceiling keeps its worst-case response, base64
+    /// included, below the message limit.
+    #[test]
+    fn advertised_payload_ceilings_fit_the_message_limit() {
+        let limits: DataLimits = data_limits();
+        let base64 = |bytes: u64| bytes.div_ceil(3) * 4;
+        for (name, bytes) in [
+            ("fs.readFile", limits.filesystem.max_read_file_bytes),
+            ("fs.writeFile", limits.filesystem.max_write_file_bytes),
+            (
+                "transfer.chunk",
+                limits.filesystem.transfer.max_content_chunk_bytes,
+            ),
+            ("process.read", limits.process.max_read_bytes),
+            ("job.read", limits.job.max_read_bytes),
+        ] {
+            assert!(base64(bytes) < MAX_MESSAGE_BYTES * 3 / 4, "{name}");
+        }
+        assert!(limits.max_concurrent_requests >= MIN_CONCURRENT_REQUESTS);
+    }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn idle_report_counts_running_work_and_resets_on_activity() {
+    async fn initialize_reports_the_instance_cwd_and_capability_families() {
         let (_temp, runtime) = runtime();
-        tokio::time::sleep(std::time::Duration::from_millis(30)).await;
-        let quiet = runtime.idle_report().await;
-        assert!(quiet.is_quiescent());
-        assert!(quiet.idle_for_ms >= 30, "idle_for_ms={}", quiet.idle_for_ms);
-
-        runtime.touch_activity();
-        let touched = runtime.idle_report().await;
-        assert!(
-            touched.idle_for_ms < 30,
-            "idle_for_ms={}",
-            touched.idle_for_ms
+        let response = runtime.initialize_response();
+        assert_eq!(response.protocol_version, ENVD_PROTOCOL_VERSION);
+        assert_eq!(response.plane, Plane::Data);
+        assert_eq!(&response.daemon_instance_id, runtime.instance_id());
+        assert_eq!(
+            response.default_cwd.as_str(),
+            runtime.config().cwd.to_str().unwrap()
         );
+        let filesystem = response.capabilities.filesystem.expect("filesystem");
+        assert!(filesystem.write);
+        assert!(response.capabilities.process.is_some());
+        assert!(response.capabilities.job.is_some());
+        assert_eq!(response.limits.job.max_request_jobs, 64);
+    }
 
-        let process_id = ProcessId::new("sleeper");
-        runtime
-            .processes()
-            .start_process(StartProcessParams {
-                process_id: process_id.clone(),
-                argv: vec!["/bin/sh".to_owned(), "-c".to_owned(), "sleep 30".to_owned()],
-                cwd: None,
-                env: BTreeMap::new(),
-                secret_env: BTreeMap::new(),
-                stdin: None,
-                timeout_ms: Some(60_000),
-                tty: false,
-            })
-            .await
-            .expect("start");
+    #[tokio::test(flavor = "current_thread")]
+    async fn a_read_only_daemon_refuses_writes_before_any_side_effect() {
+        let (_temp, runtime) = super::test_support::runtime_with(|config| {
+            config.read_only_fs = true;
+        });
+        let path = runtime.config().cwd.join("written");
+        let error = handle_request(
+            &runtime,
+            &RequestContext::detached(),
+            "fs/writeFile",
+            json!({"path": path.to_str().unwrap(), "data": "aGk="}),
+        )
+        .await
+        .unwrap_err();
+        assert_eq!(error.kind(), ProtocolErrorKind::CapabilityUnavailable);
+        assert!(!path.exists());
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn idle_report_holds_zero_while_a_process_runs_and_resets_on_use() {
+        let (_temp, runtime) = runtime();
+        tokio::time::sleep(std::time::Duration::from_millis(30)).await;
+        let quiet: GetIdleResponse =
+            serde_json::from_value(call(&runtime, EnvGetIdle::NAME, json!({})).await).unwrap();
+        assert!(quiet.idle_for_ms >= 30, "idle_for_ms={}", quiet.idle_for_ms);
+        assert_eq!(quiet.running_process_count, 0);
+
+        call(
+            &runtime,
+            ProcessStart::NAME,
+            json!({
+                "processId": "sleeper",
+                "command": {"argv": ["/bin/sh", "-c", "sleep 30"], "timeoutMs": 60000},
+            }),
+        )
+        .await;
         let busy = runtime.idle_report().await;
-        assert_eq!(busy.running_processes, 1);
+        assert_eq!(busy.running_process_count, 1);
         assert_eq!(busy.idle_for_ms, 0);
-        assert!(!busy.is_quiescent());
-
-        runtime
-            .processes()
-            .terminate_process(TerminateProcessParams {
-                process_id,
-                signal: ProcessSignal::Kill,
-            })
-            .await
-            .expect("terminate");
+
+        call(
+            &runtime,
+            ProcessTerminate::NAME,
+            json!({"processId": "sleeper", "signal": "kill"}),
+        )
+        .await;
         for _ in 0..100 {
-            if runtime.idle_report().await.running_processes == 0 {
+            if runtime.idle_report().await.running_process_count == 0 {
                 break;
             }
             tokio::time::sleep(std::time::Duration::from_millis(20)).await;
         }
         let after = runtime.idle_report().await;
-        assert_eq!(after.running_processes, 0);
+        assert_eq!(after.running_process_count, 0);
         assert!(after.idle_for_ms < 5_000);
     }
 
-    #[cfg(unix)]
     #[tokio::test(flavor = "current_thread")]
-    async fn idle_report_counts_leftover_groups_without_treating_them_as_busy() {
+    async fn observation_methods_leave_the_idle_clock_alone() {
         let (_temp, runtime) = runtime();
-        let process_id = ProcessId::new("service");
-        runtime
-            .processes()
-            .start_process(StartProcessParams {
-                process_id: process_id.clone(),
-                argv: vec![
-                    "/bin/sh".to_owned(),
-                    "-c".to_owned(),
-                    "nohup sleep 30 >/dev/null 2>&1 & exit 0".to_owned(),
-                ],
-                cwd: None,
-                env: BTreeMap::new(),
-                secret_env: BTreeMap::new(),
-                stdin: None,
-                timeout_ms: Some(60_000),
-                tty: false,
-            })
-            .await
-            .expect("start");
-        let output = runtime
-            .processes()
-            .read_process(ReadProcessParams {
-                process_id: process_id.clone(),
-                after_seq: None,
-                max_bytes: None,
-                wait_ms: None,
-            })
-            .await
-            .expect("read");
-        assert!(output.exited);
-        assert_eq!(output.leftover_processes.len(), 1);
-
-        let report = runtime.idle_report().await;
-        assert_eq!(report.running_processes, 0);
-        assert_eq!(report.leftover_process_groups, 1);
-        assert!(report.is_quiescent(), "leftovers are not running work");
-
-        runtime
-            .processes()
-            .terminate_process(TerminateProcessParams {
-                process_id,
-                signal: ProcessSignal::Kill,
-            })
-            .await
-            .expect("kill leftovers");
-        for _ in 0..100 {
-            if runtime.idle_report().await.leftover_process_groups == 0 {
-                break;
-            }
-            tokio::time::sleep(std::time::Duration::from_millis(20)).await;
-        }
-        assert_eq!(runtime.idle_report().await.leftover_process_groups, 0);
+        tokio::time::sleep(std::time::Duration::from_millis(40)).await;
+        call(&runtime, EnvGetIdle::NAME, json!({})).await;
+        let cwd = runtime.config().cwd.to_str().unwrap().to_owned();
+        let _ = handle_request(
+            &runtime,
+            &RequestContext::detached(),
+            "fs/scan",
+            json!({"roots": [{"path": cwd, "maxDepth": 0}]}),
+        )
+        .await;
+        assert!(runtime.idle_report().await.idle_for_ms >= 40);
     }
 }
diff --git a/crates/environment-daemon/src/main.rs b/crates/environment-daemon/src/main.rs
index 1cb0146a7..d38e4a4d0 100644
--- a/crates/environment-daemon/src/main.rs
+++ b/crates/environment-daemon/src/main.rs
@@ -1,33 +1,102 @@
+use std::process::ExitCode;
+
 use clap::Parser as _;
 use environment_daemon::{
     DaemonRuntime,
     config::{DaemonArgs, DaemonCommand},
-    server, upgrade,
+    server::{self, DaemonExit},
+    upgrade,
 };
 
-#[tokio::main(flavor = "current_thread")]
-async fn main() -> anyhow::Result<()> {
+/// Worker threads of the async runtime. Blocking work runs on the blocking
+/// pool; the workers keep connections, heartbeats and idle reports moving
+/// even if one of them is held up.
+const WORKER_THREADS: usize = 2;
+
+fn main() -> ExitCode {
+    // Configuration is read, and secret-bearing variables are removed from
+    // the process environment, before the async runtime starts any thread.
     let _ = dotenvy::dotenv();
     let args = DaemonArgs::parse();
     if args.print_build {
-        println!(
-            "{}",
-            serde_json::to_string(&environment_daemon::build_info())?
-        );
-        return Ok(());
+        return match serde_json::to_string(&environment_daemon::build_facts()) {
+            Ok(json) => {
+                println!("{json}");
+                ExitCode::SUCCESS
+            }
+            Err(error) => {
+                eprintln!("lightspeed-envd: {error}");
+                ExitCode::FAILURE
+            }
+        };
     }
     if args.command == Some(DaemonCommand::Upgrade) {
-        let installed = upgrade::install(args.upgrade_request()?).await?;
-        println!(
-            "installed lightspeed-envd {} ({}, protocol {}) at {}",
-            installed.version,
-            installed.git_sha,
-            installed.protocol_version,
-            installed.path.display()
-        );
-        return Ok(());
+        return upgrade_command(&args);
+    }
+    let exit = match args.into_config() {
+        Ok(config) => serve(config),
+        Err(error) => DaemonExit::Configuration(error),
+    };
+    if !matches!(exit, DaemonExit::Shutdown) {
+        eprintln!("lightspeed-envd {exit}");
+    }
+    ExitCode::from(exit.status())
+}
+
+fn serve(config: environment_daemon::config::DaemonConfig) -> DaemonExit {
+    let runtime = match async_runtime() {
+        Ok(runtime) => runtime,
+        Err(error) => return DaemonExit::Failed(error.into()),
+    };
+    runtime.block_on(async move {
+        let daemon = match DaemonRuntime::new(config) {
+            Ok(daemon) => daemon,
+            Err(error) => return DaemonExit::Configuration(error),
+        };
+        if let Err(error) = server::spawn_signal_listener(&daemon) {
+            return DaemonExit::Failed(error);
+        }
+        server::run(daemon).await
+    })
+}
+
+fn upgrade_command(args: &DaemonArgs) -> ExitCode {
+    let request = match args.upgrade_request() {
+        Ok(request) => request,
+        Err(error) => {
+            eprintln!("lightspeed-envd upgrade: {error:#}");
+            return ExitCode::from(2);
+        }
+    };
+    let installed = match async_runtime() {
+        Ok(runtime) => runtime.block_on(upgrade::install(request)),
+        Err(error) => {
+            eprintln!("lightspeed-envd upgrade: {error}");
+            return ExitCode::FAILURE;
+        }
+    };
+    match installed {
+        Ok(installed) => {
+            println!(
+                "installed lightspeed-envd {} ({}, protocol {}) at {}",
+                installed.version,
+                installed.git_sha,
+                installed.protocol_version,
+                installed.path.display()
+            );
+            ExitCode::SUCCESS
+        }
+        Err(error) => {
+            eprintln!("lightspeed-envd upgrade: {error}");
+            ExitCode::FAILURE
+        }
     }
-    let config = args.into_config()?;
-    let runtime = DaemonRuntime::new(config)?;
-    server::run(runtime).await
+}
+
+fn async_runtime() -> std::io::Result<tokio::runtime::Runtime> {
+    tokio::runtime::Builder::new_multi_thread()
+        .worker_threads(WORKER_THREADS)
+        .thread_name("lightspeed-envd")
+        .enable_all()
+        .build()
 }
diff --git a/crates/environment-daemon/src/process.rs b/crates/environment-daemon/src/process.rs
index f1f8aa307..f17d29805 100644
--- a/crates/environment-daemon/src/process.rs
+++ b/crates/environment-daemon/src/process.rs
@@ -1,1970 +1,1332 @@
-//! Interactive process execution.
+//! `process/*`: interactive processes on the shared execution primitive.
 //!
 //! Every command starts as the leader of its own process group. Its natural
 //! exit never sweeps the group: whatever the command left running keeps the
-//! environment's lifetime, is sampled once at exit and reported to the
-//! caller, and keeps somewhere to write because the output readers stay on
-//! the pipes until end of file. Only a timeout, an explicit kill, or the
-//! daemon's own cancellation paths kill the group.
+//! environment's lifetime and is reported as leftovers, sampled when a read
+//! returns the settled exit. Only a timeout or an explicit terminate or kill
+//! signals the group.
 //!
-//! Output is delivered through a daemon-owned cursor so a handle used from a
-//! later connection continues where the previous read stopped, and unread
-//! output is retained as a bounded head-and-tail buffer.
+//! Output is one byte stream per process, read through a daemon-owned
+//! cursor that advances only after a response was written, or at explicit
+//! offsets that never consume. Retention is bounded per process, per exited
+//! process and across exited processes; an evicted handle leaves a
+//! tombstone that answers `notFound {expired}`. Spawn records let a
+//! restarted daemon adopt the groups an earlier instance left running and
+//! answer their handles with `notFound {daemonRestarted}`.
 
 use std::{
-    collections::{BTreeMap, BTreeSet, VecDeque},
-    io::{Read as _, Write as _},
-    path::{Component, PathBuf},
-    process::Stdio,
-    sync::{Arc, Mutex as StdMutex},
-    time::Duration,
+    collections::{BTreeMap, VecDeque},
+    fmt::Write as _,
+    path::PathBuf,
+    sync::{Arc, Mutex, MutexGuard},
+    time::{Duration, Instant},
 };
 
 use environment_protocol::{
-    data::process::{
-        LeftoverProcess, ProcessOutputChunk, ProcessOutputStream, ProcessSignal,
-        ProcessTermination, ReadProcessParams, ReadProcessResponse, ResizeProcessParams,
-        ResizeProcessResponse, StartProcessParams, StartProcessResponse, TerminateProcessParams,
-        TerminateProcessResponse, WriteProcessParams, WriteProcessResponse, WriteProcessStatus,
+    data::{
+        exec::{
+            ExecInput, ExecState, LeftoverDisposition, OutputPage, OutputStream, PtySize, ReturnOn,
+            StoppedBy,
+        },
+        handshake::ProcessLimits,
+        process::{
+            ProcessSignal, ReadProcessParams, ReadProcessResponse, StartProcessParams,
+            StartProcessResponse, TerminateProcessParams, TerminateProcessResponse,
+            WriteProcessParams, WriteProcessResponse,
+        },
     },
-    error::{EnvironmentProtocolError, EnvironmentProtocolErrorCode},
-    shared::{ByteChunk, EnvironmentPath, ProcessId},
-};
-use portable_pty::{CommandBuilder, MasterPty, PtySize, native_pty_system};
-use tokio::{
-    io::{AsyncRead, AsyncReadExt, AsyncWriteExt},
-    process::{Child, Command},
-    sync::{Mutex, Notify},
-    task::JoinHandle,
-    time::Instant,
+    error::{Capability, NotFoundReason, ProtocolError},
+    ids::{DaemonInstanceId, ProcessId},
+    limits::MAX_PAGE_CHUNKS,
 };
+use serde::{Deserialize, Serialize};
 
 use crate::{
-    process_group,
-    redaction::{redact_bytes, redactions_for_secret_env},
+    dispatch::{Reply, RequestContext},
+    exec::{
+        AfterExit, ExecOptions, Execution, OutputSink, PreparedCommand,
+        log::OutputLog,
+        outcome::describe_exit,
+        spawn_record::{SpawnRecord, write_json_atomic},
+        validate_command,
+    },
+    filesystem::Confinement,
+    process_group::{self, Group},
 };
 
-/// How long a finished process entry stays readable after the first read
-/// that observed its exit.
-#[cfg(not(test))]
-pub(crate) const TERMINAL_PROCESS_RETENTION: Duration = Duration::from_secs(60);
-#[cfg(test)]
-pub(crate) const TERMINAL_PROCESS_RETENTION: Duration = Duration::from_millis(10);
-
-/// How often the exit watcher polls a running child. Readers only notify on
-/// pipe events, and leftovers holding the pipes can suppress EOF, so exit
-/// observation must not depend on them.
-#[cfg(not(test))]
-const EXIT_POLL_INTERVAL: Duration = Duration::from_millis(100);
-#[cfg(test)]
-const EXIT_POLL_INTERVAL: Duration = Duration::from_millis(10);
-
-/// Unread output retained per process. Beyond it the middle is dropped and
-/// the next read reports how many bytes went missing; the oldest half and
-/// the newest chunks are kept.
-#[cfg(not(test))]
-const RETAINED_OUTPUT_CAP: usize = 1024 * 1024;
-#[cfg(test)]
-const RETAINED_OUTPUT_CAP: usize = 16 * 1024;
-
-const READ_BUFFER_BYTES: usize = 8192;
+/// How long a tombstone answers `notFound {expired}`.
+const TOMBSTONE_RETENTION: Duration = Duration::from_secs(24 * 60 * 60);
+
+/// Most tombstones kept; the oldest go first.
+const MAX_TOMBSTONES: usize = 4096;
+
+/// Everything a [`ProcessManager`] needs from the daemon.
+pub struct ProcessConfig {
+    /// Canonical default `cwd`.
+    pub cwd: PathBuf,
+    /// Resolves every `cwd`.
+    pub confinement: Arc<Confinement>,
+    /// Spawn records live in `<state_dir>/processes`.
+    pub state_dir: PathBuf,
+    /// Daemon variables no child inherits.
+    pub scrubbed_env: Vec<String>,
+    pub instance_id: DaemonInstanceId,
+    pub limits: ProcessLimits,
+    /// `limits.maxWaitMs`, the `waitMs` ceiling.
+    pub max_wait_ms: u64,
+    /// `capabilities.process.pty`.
+    pub pty_supported: bool,
+}
 
+/// The daemon's processes. Cheap to clone.
 #[derive(Clone)]
 pub struct ProcessManager {
-    cwd: PathBuf,
-    fs_root: PathBuf,
-    processes: Arc<Mutex<BTreeMap<String, Arc<ProcessEntry>>>>,
-    /// Daemon configuration variables no child may inherit.
-    scrubbed_env: Arc<Vec<String>>,
-    /// Process groups whose root exited while members were still alive.
-    /// Pruned lazily once the group is empty.
-    leftover_groups: Arc<StdMutex<BTreeSet<u32>>>,
-}
-
-struct ProcessEntry {
-    state: Mutex<ProcessState>,
-    notify: Notify,
-    readers: Mutex<Vec<JoinHandle<()>>>,
+    inner: Arc<ManagerInner>,
 }
 
-struct ProcessState {
-    child: ProcessChild,
-    pid: Option<u32>,
-    pgid: Option<u32>,
-    stdin: Option<ProcessInput>,
-    pty_master: Option<Box<dyn MasterPty + Send>>,
-    redactions: Vec<Vec<u8>>,
-    output: OutputBuffer,
-    /// Output readers still attached to a pipe or PTY.
-    readers_open: u32,
-    exited: bool,
-    exit_observed_at: Option<Instant>,
-    exit_code: Option<i32>,
-    termination: Option<ProcessTermination>,
-    leftover_processes: Vec<LeftoverProcess>,
-    failure: Option<String>,
-    cleanup_scheduled: bool,
-    /// The root exited and the drain grace passed while leftovers still held
-    /// the pipes: readers keep reading so nothing blocks the leftovers, but
-    /// the bytes are dropped.
-    discarding: bool,
+struct ManagerInner {
+    config: ProcessConfig,
+    records_dir: PathBuf,
+    table: Mutex<Table>,
+    /// Groups no live entry owns any more that still had members when last
+    /// looked at: groups of evicted entries and groups adopted from an
+    /// earlier daemon instance. Each remembers its spawn record, deleted
+    /// once the group is empty.
+    leftover_groups: Mutex<BTreeMap<u32, (Group, PathBuf)>>,
 }
 
-enum ProcessChild {
-    Pipe(Child),
-    Pty(Box<dyn portable_pty::Child + Send + Sync>),
+#[derive(Default)]
+struct Table {
+    slots: BTreeMap<ProcessId, Slot>,
+    /// Tombstoned ids in eviction order.
+    tombstones: VecDeque<(ProcessId, Instant)>,
 }
 
-enum ProcessInput {
-    Pty(Box<dyn std::io::Write + Send>),
+enum Slot {
+    /// A start is spawning under this id.
+    Reserved,
+    Live(Arc<Entry>),
+    /// Evicted; remembers how it ended.
+    Tombstone(String),
+    /// A handle of an earlier daemon instance.
+    Restarted,
 }
 
-/// Retained output between the cursor and the newest chunk.
-#[derive(Default)]
-struct OutputBuffer {
-    chunks: VecDeque<RetainedChunk>,
-    retained_bytes: usize,
-    next_seq: u64,
-    delivered_seq: u64,
+struct Entry {
+    execution: Execution<ProcessOutput>,
+    record_path: PathBuf,
+    /// When a reply returning the settled exit with nothing left unread was
+    /// written.
+    fully_read_at: Mutex<Option<Instant>>,
 }
 
-struct RetainedChunk {
-    chunk: ProcessOutputChunk,
-    /// Bytes dropped from the buffer immediately before this chunk.
-    omitted_before: u64,
+/// A process's retained output and its daemon cursor.
+struct ProcessOutput {
+    log: OutputLog,
+    cursor: u64,
+    cap: u64,
 }
 
-impl OutputBuffer {
-    fn push(&mut self, stream: ProcessOutputStream, bytes: Vec<u8>) {
-        let seq = self.next_seq;
-        self.next_seq += 1;
-        self.retained_bytes += bytes.len();
-        self.chunks.push_back(RetainedChunk {
-            chunk: ProcessOutputChunk {
-                seq,
-                stream,
-                chunk: ByteChunk::from(bytes),
-            },
-            omitted_before: 0,
-        });
-        self.enforce_cap();
+impl OutputSink for ProcessOutput {
+    fn append(&mut self, stream: OutputStream, data: &[u8]) {
+        self.log.append(stream, data);
+        self.log.enforce_cap(self.cap, self.cursor);
     }
+}
 
-    fn unread_bytes(&self) -> usize {
-        self.retained_bytes
-    }
+/// The file of one spawn record.
+#[derive(Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct StoredSpawn {
+    process_id: ProcessId,
+    spawn: SpawnRecord,
+}
 
-    /// Drops chunks from just past the head until the buffer fits. The head
-    /// is the oldest half of the cap; the newest chunk is never dropped.
-    fn enforce_cap(&mut self) {
-        if self.retained_bytes <= RETAINED_OUTPUT_CAP {
-            return;
-        }
-        let head_cap = RETAINED_OUTPUT_CAP / 2;
-        let mut head_bytes = 0usize;
-        let mut head_len = 0usize;
-        for retained in &self.chunks {
-            // The head never grows past an omission: the chunk that follows
-            // dropped bytes stays the boundary, so every later drop extends
-            // the same gap instead of opening a second one. Pipe reads on
-            // Linux deliver uneven chunks, where a small survivor would
-            // otherwise be absorbed into the head.
-            if retained.omitted_before > 0 {
-                break;
-            }
-            let len = retained.chunk.chunk.as_slice().len();
-            if head_bytes + len > head_cap {
-                break;
-            }
-            head_bytes += len;
-            head_len += 1;
-        }
-        let mut omitted = 0u64;
-        while self.retained_bytes > RETAINED_OUTPUT_CAP && self.chunks.len() > head_len + 1 {
-            let Some(dropped) = self.chunks.remove(head_len) else {
-                break;
+impl ProcessManager {
+    /// Reconciles the spawn records an earlier instance left: groups of
+    /// this boot that still run are adopted as leftovers, and their ids
+    /// answer `notFound {daemonRestarted}`; every other record is deleted.
+    pub fn new(config: ProcessConfig) -> anyhow::Result<Self> {
+        let records_dir = config.state_dir.join("processes");
+        std::fs::create_dir_all(&records_dir)?;
+        let boot = process_group::boot_id();
+        let mut table = Table::default();
+        let mut leftover_groups = BTreeMap::new();
+        for entry in std::fs::read_dir(&records_dir)? {
+            let path = entry?.path();
+            let stored = std::fs::read(&path)
+                .ok()
+                .and_then(|bytes| serde_json::from_slice::<StoredSpawn>(&bytes).ok());
+            let Some(stored) = stored else {
+                eprintln!(
+                    "lightspeed-envd: removing unreadable spawn record {}",
+                    path.display()
+                );
+                let _ = std::fs::remove_file(&path);
+                continue;
             };
-            let len = dropped.chunk.chunk.as_slice().len();
-            self.retained_bytes -= len;
-            omitted += len as u64 + dropped.omitted_before;
-        }
-        if omitted > 0
-            && let Some(next) = self.chunks.get_mut(head_len)
-        {
-            next.omitted_before += omitted;
-        }
-    }
-
-    /// Delivers from the cursor, advancing it. Whole chunks are taken up to
-    /// `max_bytes`; when the very first chunk alone exceeds the budget it is
-    /// split and its remainder stays at the cursor under the same sequence.
-    fn deliver(&mut self, max_bytes: Option<usize>) -> (Vec<ProcessOutputChunk>, u64) {
-        let mut delivered = Vec::new();
-        let mut omitted = 0u64;
-        let mut bytes = 0usize;
-        while let Some(front) = self.chunks.front_mut() {
-            let len = front.chunk.chunk.as_slice().len();
-            if let Some(max_bytes) = max_bytes
-                && bytes + len > max_bytes
-            {
-                if delivered.is_empty() && max_bytes > 0 {
-                    let (head, rest) = front.chunk.chunk.as_slice().split_at(max_bytes);
-                    delivered.push(ProcessOutputChunk {
-                        seq: front.chunk.seq,
-                        stream: front.chunk.stream,
-                        chunk: ByteChunk::from(head.to_vec()),
-                    });
-                    omitted += front.omitted_before;
-                    front.omitted_before = 0;
-                    front.chunk.chunk = ByteChunk::from(rest.to_vec());
-                    self.retained_bytes -= max_bytes;
-                }
-                break;
+            if !stored.spawn.same_boot(boot.as_deref()) {
+                let _ = std::fs::remove_file(&path);
+                continue;
             }
-            let retained = self.chunks.pop_front().expect("front chunk exists");
-            self.retained_bytes -= len;
-            bytes += len;
-            omitted += retained.omitted_before;
-            delivered.push(retained.chunk);
-        }
-        self.delivered_seq = self
-            .chunks
-            .front()
-            .map_or(self.next_seq, |front| front.chunk.seq);
-        (delivered, omitted)
-    }
-
-    /// Re-reads retained chunks from a sequence number without moving the
-    /// cursor. Best effort: delivered chunks are gone.
-    fn reread(&self, after_seq: u64, max_bytes: Option<usize>) -> (Vec<ProcessOutputChunk>, u64) {
-        let mut chunks = Vec::new();
-        let mut omitted = 0u64;
-        let mut bytes = 0usize;
-        for retained in self
-            .chunks
-            .iter()
-            .filter(|retained| retained.chunk.seq >= after_seq)
-        {
-            let slice = retained.chunk.chunk.as_slice();
-            if let Some(max_bytes) = max_bytes {
-                if bytes >= max_bytes {
-                    break;
-                }
-                let remaining = max_bytes - bytes;
-                if slice.len() > remaining {
-                    chunks.push(ProcessOutputChunk {
-                        seq: retained.chunk.seq,
-                        stream: retained.chunk.stream,
-                        chunk: ByteChunk::from(slice[..remaining].to_vec()),
-                    });
-                    omitted += retained.omitted_before;
-                    break;
-                }
+            table.slots.insert(stored.process_id, Slot::Restarted);
+            if stored.spawn.group_survives() {
+                leftover_groups.insert(stored.spawn.pgid, (stored.spawn.group(), path));
+            } else {
+                let _ = std::fs::remove_file(&path);
             }
-            bytes += slice.len();
-            omitted += retained.omitted_before;
-            chunks.push(retained.chunk.clone());
-        }
-        (chunks, omitted)
-    }
-}
-
-impl ProcessManager {
-    pub fn new(cwd: PathBuf, fs_root: PathBuf) -> Self {
-        Self {
-            cwd: normalize_path(cwd),
-            fs_root: normalize_path(fs_root),
-            processes: Arc::new(Mutex::new(BTreeMap::new())),
-            scrubbed_env: Arc::new(Vec::new()),
-            leftover_groups: Arc::new(StdMutex::new(BTreeSet::new())),
         }
+        Ok(Self {
+            inner: Arc::new(ManagerInner {
+                config,
+                records_dir,
+                table: Mutex::new(table),
+                leftover_groups: Mutex::new(leftover_groups),
+            }),
+        })
     }
 
-    pub fn with_scrubbed_env(mut self, names: Vec<String>) -> Self {
-        self.scrubbed_env = Arc::new(names);
-        self
-    }
-
-    /// Processes started here that have not exited yet.
+    /// Processes whose root has not exited.
     pub async fn running_count(&self) -> u32 {
-        let entries: Vec<Arc<ProcessEntry>> =
-            self.processes.lock().await.values().cloned().collect();
-        let mut running = 0u32;
-        for entry in entries {
-            if !entry.state.lock().await.exited {
-                running += 1;
-            }
-        }
-        running
+        self.maintain();
+        let table = self.table();
+        let running = table
+            .slots
+            .values()
+            .filter(|slot| match slot {
+                Slot::Live(entry) => !entry.execution.with_state(|state| state.exited()),
+                _ => false,
+            })
+            .count();
+        u32::try_from(running).unwrap_or(u32::MAX)
     }
 
-    /// Process groups of finished commands that still have a live member.
-    /// Leftovers are not running work: a service waiting for requests is
-    /// idle, so this never feeds the quiescence check.
+    /// Process groups whose root exited while members still run, adopted
+    /// groups of an earlier instance included. Leftovers are not running
+    /// work: they never hold the idle clock.
     pub fn leftover_group_count(&self) -> u32 {
-        let mut groups = self
-            .leftover_groups
-            .lock()
-            .expect("leftover groups poisoned");
-        groups.retain(|pgid| process_group::group_alive(*pgid));
-        u32::try_from(groups.len()).unwrap_or(u32::MAX)
+        let live = {
+            let table = self.table();
+            table
+                .slots
+                .values()
+                .filter(|slot| match slot {
+                    Slot::Live(entry) => {
+                        entry.execution.with_state(|state| state.exited())
+                            && entry.execution.group_alive()
+                    }
+                    _ => false,
+                })
+                .count()
+        };
+        let mut groups = lock(&self.inner.leftover_groups);
+        groups.retain(|_, (group, record)| {
+            let alive = group.alive();
+            if !alive {
+                let _ = std::fs::remove_file(record);
+            }
+            alive
+        });
+        u32::try_from(live + groups.len()).unwrap_or(u32::MAX)
     }
 
-    pub async fn start_process(
+    pub async fn start(
         &self,
+        _ctx: &RequestContext,
         params: StartProcessParams,
-    ) -> Result<StartProcessResponse, EnvironmentProtocolError> {
-        if params.argv.is_empty() {
-            return Err(EnvironmentProtocolError::new(
-                EnvironmentProtocolErrorCode::InvalidRequest,
-                "process argv must not be empty",
-            ));
-        }
-        let cwd = params
-            .cwd
-            .as_ref()
-            .map(|path| self.resolve_cwd(path))
-            .transpose()?
-            .unwrap_or_else(|| self.cwd.clone());
-        for name in params.secret_env.keys() {
-            if params.env.contains_key(name) {
-                return Err(EnvironmentProtocolError::new(
-                    EnvironmentProtocolErrorCode::InvalidRequest,
-                    format!("process env collides with secret env: {name}"),
+    ) -> Result<StartProcessResponse, ProtocolError> {
+        let StartProcessParams {
+            process_id,
+            command,
+            pty,
+        } = params;
+        let config = &self.inner.config;
+        validate_command(&command, "command")?;
+        if let Some(size) = pty {
+            validate_pty(size, &command.input)?;
+            if !config.pty_supported {
+                return Err(ProtocolError::capability_unavailable(
+                    Capability::ProcessPty,
+                    "this daemon cannot run processes under a PTY",
                 ));
             }
         }
+        let cwd = match &command.cwd {
+            Some(path) => config.confinement.resolve_directory(path)?,
+            None => config.cwd.clone(),
+        };
+        self.maintain();
+        self.reserve(&process_id)?;
 
-        if params.tty {
-            return self.start_pty_process(params, cwd).await;
-        }
-
-        let mut command = Command::new(&params.argv[0]);
-        command
-            .args(&params.argv[1..])
-            .current_dir(&cwd)
-            .envs(params.env.iter())
-            .stdout(Stdio::piped())
-            .stderr(Stdio::piped());
-        for name in self.scrubbed_env.iter() {
-            command.env_remove(name);
-        }
-        for (name, value) in &params.secret_env {
-            command.env(name, value.expose());
-        }
-        // Plain pipes never keep an input open: a one-shot payload is
-        // written and closed at start, otherwise the child reads EOF at
-        // once. Interactive input needs a PTY.
-        if params.stdin.is_some() {
-            command.stdin(Stdio::piped());
-        } else {
-            command.stdin(Stdio::null());
-        }
-        process_group::spawn_in_own_group(&mut command);
-
-        let mut child = command.spawn().map_err(|error| {
-            EnvironmentProtocolError::new(
-                EnvironmentProtocolErrorCode::ProcessFailed,
-                format!("spawn process {:?}: {error}", params.argv),
-            )
-        })?;
-        let pid = child.id();
-        let stdout = child.stdout.take();
-        let stderr = child.stderr.take();
-        let stdin = child.stdin.take();
-        if let Some(input) = params.stdin {
-            let Some(mut writer) = stdin else {
-                return Err(EnvironmentProtocolError::new(
-                    EnvironmentProtocolErrorCode::ProcessFailed,
-                    "process stdin was not available",
-                ));
-            };
-            writer.write_all(input.as_slice()).await.map_err(|error| {
-                EnvironmentProtocolError::new(
-                    EnvironmentProtocolErrorCode::ProcessFailed,
-                    error.to_string(),
-                )
-            })?;
-            drop(writer);
-        }
-
-        let process_id = params.process_id;
-        let redactions = redactions_for_secret_env(&params.secret_env);
-        let readers_open = u32::from(stdout.is_some()) + u32::from(stderr.is_some());
-        let entry = Arc::new(ProcessEntry {
-            state: Mutex::new(ProcessState::new(
-                ProcessChild::Pipe(child),
-                pid,
-                pid,
-                None,
-                None,
-                redactions,
-                readers_open,
-            )),
-            notify: Notify::new(),
-            readers: Mutex::new(Vec::new()),
-        });
-        self.insert_entry(&process_id, entry.clone()).await?;
-
-        {
-            let mut readers = entry.readers.lock().await;
-            if let Some(stdout) = stdout {
-                readers.push(tokio::spawn(read_stream(
-                    entry.clone(),
-                    stdout,
-                    ProcessOutputStream::Stdout,
-                )));
-            }
-            if let Some(stderr) = stderr {
-                readers.push(tokio::spawn(read_stream(
-                    entry.clone(),
-                    stderr,
-                    ProcessOutputStream::Stderr,
-                )));
+        let options = ExecOptions {
+            timeout: command.timeout_ms.map(Duration::from_millis),
+            terminate_grace: Duration::from_millis(config.limits.terminate_grace_ms),
+            after_exit: AfterExit::Keep,
+        };
+        let sink = ProcessOutput {
+            log: OutputLog::default(),
+            cursor: 0,
+            cap: config.limits.max_retained_output_bytes,
+        };
+        let prepared = PreparedCommand::new(command, cwd, &config.scrubbed_env, pty);
+        let execution = match prepared.spawn(sink, options, config.limits.max_input_queue_bytes) {
+            Ok(execution) => execution,
+            Err(error) => {
+                self.release(&process_id);
+                return Err(error);
             }
+        };
+        let pid = execution.pid();
+        let record_path = self
+            .inner
+            .records_dir
+            .join(format!("{}.json", process_id.as_str()));
+        let entry = Arc::new(Entry {
+            execution: execution.clone(),
+            record_path: record_path.clone(),
+            fully_read_at: Mutex::new(None),
+        });
+        self.table()
+            .slots
+            .insert(process_id.clone(), Slot::Live(entry));
+        let stored = StoredSpawn {
+            process_id,
+            spawn: SpawnRecord::new(execution.group(), &config.instance_id),
+        };
+        if let Err(error) = write_json_atomic(&record_path, &stored) {
+            eprintln!(
+                "lightspeed-envd: could not persist the spawn record of {}: {error}",
+                stored.process_id
+            );
         }
-        self.spawn_watchers(entry, params.timeout_ms);
-        Ok(StartProcessResponse { process_id })
+        execution.start_input();
+        Ok(StartProcessResponse { pid })
     }
 
-    async fn start_pty_process(
+    pub async fn read(
         &self,
-        params: StartProcessParams,
-        cwd: PathBuf,
-    ) -> Result<StartProcessResponse, EnvironmentProtocolError> {
-        let pty = native_pty_system()
-            .openpty(PtySize::default())
-            .map_err(process_error("open PTY"))?;
-        let mut command = CommandBuilder::new(&params.argv[0]);
-        command.args(&params.argv[1..]);
-        command.cwd(&cwd);
-        for name in self.scrubbed_env.iter() {
-            command.env_remove(name);
-        }
-        for (name, value) in &params.env {
-            command.env(name, value);
-        }
-        for (name, value) in &params.secret_env {
-            command.env(name, value.expose());
-        }
-        let child = pty
-            .slave
-            .spawn_command(command)
-            .map_err(process_error("spawn PTY process"))?;
-        // The PTY child is a session leader, so its pid is its group id.
-        let pid = child.process_id();
-        let reader = pty
-            .master
-            .try_clone_reader()
-            .map_err(process_error("clone PTY reader"))?;
-        let mut stdin = pty
-            .master
-            .take_writer()
-            .map_err(process_error("open PTY writer"))?;
-        if let Some(input) = params.stdin.as_ref() {
-            stdin
-                .write_all(input.as_slice())
-                .map_err(process_error("write initial PTY input"))?;
-            stdin.flush().map_err(process_error("flush PTY input"))?;
+        ctx: &RequestContext,
+        params: ReadProcessParams,
+    ) -> Result<Reply<ReadProcessResponse>, ProtocolError> {
+        let config = &self.inner.config;
+        if params.max_bytes > config.limits.max_read_bytes {
+            return Err(ProtocolError::above_ceiling(
+                "maxBytes",
+                params.max_bytes,
+                config.limits.max_read_bytes,
+            ));
         }
-        let process_id = params.process_id;
-        let redactions = redactions_for_secret_env(&params.secret_env);
-        let entry = Arc::new(ProcessEntry {
-            state: Mutex::new(ProcessState::new(
-                ProcessChild::Pty(child),
-                pid,
-                pid,
-                Some(ProcessInput::Pty(stdin)),
-                Some(pty.master),
-                redactions,
-                1,
-            )),
-            notify: Notify::new(),
-            readers: Mutex::new(Vec::new()),
-        });
-        self.insert_entry(&process_id, entry.clone()).await?;
-        entry
-            .readers
-            .lock()
-            .await
-            .push(read_pty_stream(entry.clone(), reader));
-        self.spawn_watchers(entry, params.timeout_ms);
-        Ok(StartProcessResponse { process_id })
-    }
-
-    async fn insert_entry(
-        &self,
-        process_id: &ProcessId,
-        entry: Arc<ProcessEntry>,
-    ) -> Result<(), EnvironmentProtocolError> {
-        let mut processes = self.processes.lock().await;
-        if processes.contains_key(process_id.as_str()) {
-            return Err(EnvironmentProtocolError::new(
-                EnvironmentProtocolErrorCode::Conflict,
-                format!("process id already exists: {process_id}"),
+        if params.wait_ms > config.max_wait_ms {
+            return Err(ProtocolError::above_ceiling(
+                "waitMs",
+                params.wait_ms,
+                config.max_wait_ms,
             ));
         }
-        processes.insert(process_id.to_string(), entry);
-        Ok(())
-    }
-
-    fn spawn_watchers(&self, entry: Arc<ProcessEntry>, timeout_ms: Option<u64>) {
-        if let Some(timeout_ms) = timeout_ms {
-            tokio::spawn(timeout_process(
-                entry.clone(),
-                Duration::from_millis(timeout_ms),
+        if params.after.is_some() && params.tail_bytes.is_some() {
+            return Err(ProtocolError::invalid_field(
+                "tailBytes",
+                "after and tailBytes exclude each other",
             ));
         }
-        tokio::spawn(watch_exit(entry, self.leftover_groups.clone()));
-    }
-
-    pub async fn read_process(
-        &self,
-        params: ReadProcessParams,
-    ) -> Result<ReadProcessResponse, EnvironmentProtocolError> {
-        let Some(entry) = self.entry(&params.process_id).await else {
-            return Err(EnvironmentProtocolError::new(
-                EnvironmentProtocolErrorCode::NotFound,
-                format!("unknown process id: {}", params.process_id),
+        self.maintain();
+        let entry = self.lookup(&params.process_id)?;
+        let execution = &entry.execution;
+
+        let (start, end) = execution.with_state(|state| {
+            let output = &mut state.sink;
+            if let Some(ack) = params.ack {
+                output.cursor = output.cursor.max(ack.min(output.log.end()));
+            }
+            let end = output.log.end();
+            let start = match (params.after, params.tail_bytes) {
+                (Some(after), _) => after,
+                (None, Some(tail)) => end.saturating_sub(tail),
+                (None, None) => output.cursor,
+            };
+            (start, end)
+        });
+        if start > end {
+            return Err(ProtocolError::invalid_field(
+                "after",
+                format!("after {start} is past the end of the output ({end})"),
             ));
-        };
-        let deadline = params
-            .wait_ms
-            .map(|wait_ms| Instant::now() + Duration::from_millis(wait_ms));
+        }
 
+        let deadline = tokio::time::Instant::now() + Duration::from_millis(params.wait_ms);
+        let mut changes = execution.subscribe();
         loop {
-            let (response, schedule_cleanup, wake_at) = {
-                let mut state = entry.state.lock().await;
-                if let Some(pgid) = update_exit_status(&mut state)? {
-                    self.observe_exit(&entry, pgid);
-                }
-                let now = Instant::now();
-                let (done, drain_deadline) = exit_settled(&state, now);
-                let should_return = if params.wait_ms.is_some() {
-                    done || deadline.is_some_and(|deadline| now >= deadline)
-                        || params
-                            .max_bytes
-                            .is_some_and(|max_bytes| state.output.unread_bytes() >= max_bytes)
-                } else {
-                    done
-                };
-                if should_return {
-                    let schedule_cleanup = state.exited && !state.cleanup_scheduled;
-                    if schedule_cleanup {
-                        state.cleanup_scheduled = true;
+            changes.borrow_and_update();
+            let ready = execution.with_state(|state| {
+                state.settled()
+                    || match params.return_on {
+                        ReturnOn::AnyOutput => state.sink.log.end() > start,
+                        ReturnOn::Window => state.sink.log.end() - start >= params.max_bytes,
+                        ReturnOn::Exit => false,
                     }
-                    (
-                        Some(response_from_state(
-                            &mut state,
-                            params.after_seq,
-                            params.max_bytes,
-                        )),
-                        schedule_cleanup,
-                        None,
-                    )
-                } else {
-                    let wake_at = match (deadline, drain_deadline) {
-                        (Some(a), Some(b)) => Some(a.min(b)),
-                        (a, b) => a.or(b),
-                    };
-                    (None, false, wake_at)
-                }
-            };
-            if let Some(response) = response {
-                if schedule_cleanup {
-                    self.schedule_terminal_cleanup(params.process_id.clone(), entry.clone());
-                }
-                return Ok(response);
+            });
+            if ready {
+                break;
             }
-
-            if let Some(wake_at) = wake_at {
-                tokio::select! {
-                    _ = entry.notify.notified() => {}
-                    _ = tokio::time::sleep_until(wake_at) => {}
-                }
-            } else {
-                entry.notify.notified().await;
+            tokio::select! {
+                () = ctx.cancel.cancelled() => return Err(ProtocolError::cancelled()),
+                () = tokio::time::sleep_until(deadline) => break,
+                changed = changes.changed() => if changed.is_err() { break },
             }
         }
-    }
 
-    pub async fn write_process(
-        &self,
-        params: WriteProcessParams,
-    ) -> Result<WriteProcessResponse, EnvironmentProtocolError> {
-        let Some(entry) = self.entry(&params.process_id).await else {
-            return Ok(WriteProcessResponse {
-                status: WriteProcessStatus::UnknownProcess,
-            });
-        };
-        let mut state = entry.state.lock().await;
-        if let Some(pgid) = update_exit_status(&mut state)? {
-            self.observe_exit(&entry, pgid);
-        }
-        let chunk = params.chunk.filter(|chunk| !chunk.as_slice().is_empty());
-        // No input and nothing to close is a wait; the caller's read follows.
-        if chunk.is_none() && !params.close_stdin {
-            return Ok(WriteProcessResponse {
-                status: WriteProcessStatus::Accepted,
-            });
-        }
-        if state.exited {
-            return Ok(WriteProcessResponse {
-                status: if chunk.is_some() {
-                    WriteProcessStatus::StdinClosed
-                } else {
-                    WriteProcessStatus::Accepted
+        let (mut response, settled) = execution.with_state(|state| {
+            let page = state
+                .sink
+                .log
+                .page(start, params.max_bytes, MAX_PAGE_CHUNKS);
+            let settled = state.settled();
+            let response = ReadProcessResponse {
+                output: OutputPage {
+                    chunks: page.chunks,
+                    next: page.next,
+                    end: state.sink.log.end(),
+                    gaps: page.gaps,
                 },
-            });
-        }
-        let Some(stdin) = state.stdin.as_mut() else {
-            return Ok(WriteProcessResponse {
-                status: if chunk.is_some() {
-                    WriteProcessStatus::StdinClosed
+                state: if settled {
+                    ExecState::Exited
                 } else {
-                    WriteProcessStatus::Accepted
+                    ExecState::Running
                 },
-            });
-        };
-        if let Some(chunk) = chunk {
-            match stdin {
-                ProcessInput::Pty(stdin) => stdin
-                    .write_all(chunk.as_slice())
-                    .and_then(|()| stdin.flush()),
-            }
-            .map_err(|error| {
-                EnvironmentProtocolError::new(
-                    EnvironmentProtocolErrorCode::ProcessFailed,
-                    error.to_string(),
-                )
-            })?;
-        }
-        if params.close_stdin {
-            state.stdin.take();
+                exit: state.exit().filter(|_| settled).cloned(),
+                stopped_by: state.stopped_by().filter(|_| settled),
+                error: state.error().cloned(),
+                pid: execution.pid(),
+                leftovers: None,
+            };
+            (response, settled)
+        });
+        if settled {
+            response.leftovers = execution.sample_leftovers(LeftoverDisposition::Kept);
         }
-        Ok(WriteProcessResponse {
-            status: WriteProcessStatus::Accepted,
-        })
-    }
 
-    pub async fn terminate_process(
-        &self,
-        params: TerminateProcessParams,
-    ) -> Result<TerminateProcessResponse, EnvironmentProtocolError> {
-        let Some(entry) = self.entry(&params.process_id).await else {
-            return Ok(TerminateProcessResponse { running: false });
-        };
-        let mut state = entry.state.lock().await;
-        if let Some(pgid) = update_exit_status(&mut state)? {
-            self.observe_exit(&entry, pgid);
-        }
-        if state.exited {
-            // The root is gone; the signal still reaches whatever it left in
-            // its group, which is how a handle stops the service it started.
-            if let Some(pgid) = state.pgid {
-                match params.signal {
-                    ProcessSignal::Interrupt => {
-                        process_group::interrupt_group(pgid);
-                    }
-                    ProcessSignal::Kill => {
-                        process_group::kill_group(pgid);
-                    }
-                }
-            }
-            return Ok(TerminateProcessResponse { running: false });
+        let consuming = params.after.is_none() && params.tail_bytes.is_none();
+        let complete = settled && response.output.next == response.output.end;
+        if !consuming && !complete {
+            return Ok(Reply::new(response));
         }
-        match params.signal {
-            ProcessSignal::Interrupt => {
-                if let Some(pgid) = state.pgid {
-                    process_group::interrupt_group(pgid);
-                } else {
-                    interrupt_child(&mut state.child);
-                }
+        let next = response.output.next;
+        let entry = entry.clone();
+        Ok(Reply::with_commit(response, move || {
+            if consuming {
+                entry.execution.with_state(|state| {
+                    state.sink.cursor = state.sink.cursor.max(next);
+                });
             }
-            ProcessSignal::Kill => {
-                if let Some(pgid) = state.pgid {
-                    process_group::kill_group(pgid);
-                }
-                kill_child(&mut state.child).await?;
-                state.exited = true;
-                state.exit_observed_at = Some(Instant::now());
-                state.exit_code = None;
-                state.termination = Some(ProcessTermination::Killed);
-                state.stdin.take();
-                spawn_reader_drain(entry.clone());
-                entry.notify.notify_waiters();
+            if complete {
+                lock(&entry.fully_read_at).get_or_insert_with(Instant::now);
             }
-        }
-        Ok(TerminateProcessResponse { running: true })
+        }))
     }
 
-    pub async fn resize_process(
+    pub async fn write(
         &self,
-        params: ResizeProcessParams,
-    ) -> Result<ResizeProcessResponse, EnvironmentProtocolError> {
-        let Some(entry) = self.entry(&params.process_id).await else {
-            return Err(EnvironmentProtocolError::new(
-                EnvironmentProtocolErrorCode::NotFound,
-                format!("unknown process id: {}", params.process_id),
-            ));
-        };
-        let state = entry.state.lock().await;
-        let Some(master) = state.pty_master.as_ref() else {
-            return Err(EnvironmentProtocolError::new(
-                EnvironmentProtocolErrorCode::InvalidRequest,
-                "process is not attached to a PTY",
-            ));
-        };
-        master
-            .resize(PtySize {
-                rows: params.size.rows,
-                cols: params.size.cols,
-                pixel_width: 0,
-                pixel_height: 0,
-            })
-            .map_err(process_error("resize PTY"))?;
-        Ok(ResizeProcessResponse {})
-    }
-
-    /// Records that a newly exited root left its group alive, for the idle
-    /// report, and starts the drain. The readers are left on the pipes; the
-    /// drain task switches them to discard mode once the grace passes.
-    fn observe_exit(&self, entry: &Arc<ProcessEntry>, pgid: u32) {
-        record_leftover_group(pgid, &self.leftover_groups);
-        spawn_group_drain(entry.clone());
+        _ctx: &RequestContext,
+        params: WriteProcessParams,
+    ) -> Result<WriteProcessResponse, ProtocolError> {
+        self.maintain();
+        let entry = self.lookup(&params.process_id)?;
+        let accepted_bytes = entry
+            .execution
+            .offer_input(params.data.as_slice(), params.close_input)?;
+        Ok(WriteProcessResponse { accepted_bytes })
     }
 
-    fn resolve_cwd(&self, path: &EnvironmentPath) -> Result<PathBuf, EnvironmentProtocolError> {
-        let candidate = if path.is_absolute() {
-            PathBuf::from(path.as_str())
-        } else if path.as_str() == "." {
-            self.cwd.clone()
-        } else {
-            self.cwd.join(path.as_str())
+    pub async fn terminate(
+        &self,
+        _ctx: &RequestContext,
+        params: TerminateProcessParams,
+    ) -> Result<TerminateProcessResponse, ProtocolError> {
+        self.maintain();
+        let entry = self.lookup(&params.process_id)?;
+        let running = match params.signal {
+            ProcessSignal::Interrupt => entry.execution.interrupt(),
+            ProcessSignal::Terminate => entry.execution.stop(StoppedBy::Terminate),
+            ProcessSignal::Kill => entry.execution.stop(StoppedBy::Kill),
         };
-        let normalized = normalize_path(candidate);
-        if !normalized.starts_with(&self.fs_root) {
-            return Err(EnvironmentProtocolError::new(
-                EnvironmentProtocolErrorCode::Forbidden,
-                format!(
-                    "process cwd is outside bridge fs root: {} (root {})",
-                    normalized.display(),
-                    self.fs_root.display()
-                ),
-            ));
-        }
-        Ok(normalized)
-    }
-
-    async fn entry(&self, process_id: &ProcessId) -> Option<Arc<ProcessEntry>> {
-        self.processes
-            .lock()
-            .await
-            .get(process_id.as_str())
-            .cloned()
-    }
-
-    /// Drops the entry after the retention period. Readers are never
-    /// aborted here: those a sweep abandoned are gone already, and those
-    /// draining a pipe a leftover still holds must stay on it until end of
-    /// file so the leftover never sees `EPIPE`.
-    fn schedule_terminal_cleanup(&self, process_id: ProcessId, entry: Arc<ProcessEntry>) {
-        let processes = self.processes.clone();
-        tokio::spawn(async move {
-            tokio::time::sleep(TERMINAL_PROCESS_RETENTION).await;
-            let mut processes = processes.lock().await;
-            if processes
-                .get(process_id.as_str())
-                .is_some_and(|current| Arc::ptr_eq(current, &entry))
-            {
-                processes.remove(process_id.as_str());
-            }
-        });
+        Ok(TerminateProcessResponse { running })
     }
-}
 
-impl ProcessState {
-    fn new(
-        child: ProcessChild,
-        pid: Option<u32>,
-        pgid: Option<u32>,
-        stdin: Option<ProcessInput>,
-        pty_master: Option<Box<dyn MasterPty + Send>>,
-        redactions: Vec<Vec<u8>>,
-        readers_open: u32,
-    ) -> Self {
-        Self {
-            child,
-            pid,
-            pgid,
-            stdin,
-            pty_master,
-            redactions,
-            output: OutputBuffer::default(),
-            readers_open,
-            exited: false,
-            exit_observed_at: None,
-            exit_code: None,
-            termination: None,
-            leftover_processes: Vec::new(),
-            failure: None,
-            cleanup_scheduled: false,
-            discarding: false,
+    /// Claims `process_id` before any side effect: a running, retained,
+    /// tombstoned or earlier-instance id is `alreadyExists`.
+    fn reserve(&self, process_id: &ProcessId) -> Result<(), ProtocolError> {
+        let mut table = self.table();
+        if table.slots.contains_key(process_id) {
+            return Err(ProtocolError::already_exists(format!(
+                "process id {process_id} is already in use"
+            )));
         }
+        table.slots.insert(process_id.clone(), Slot::Reserved);
+        Ok(())
     }
 
-    fn push_output(&mut self, stream: ProcessOutputStream, bytes: &[u8]) {
-        if self.discarding {
-            return;
+    fn release(&self, process_id: &ProcessId) {
+        let mut table = self.table();
+        if matches!(table.slots.get(process_id), Some(Slot::Reserved)) {
+            table.slots.remove(process_id);
         }
-        let bytes = redact_bytes(bytes, &self.redactions);
-        self.output.push(stream, bytes);
     }
 
-    fn reader_closed(&mut self) {
-        self.readers_open = self.readers_open.saturating_sub(1);
-    }
-}
-
-/// Whether a read may return for an exited root: the readers reached end of
-/// file, or the drain grace since the exit passed and leftovers still hold
-/// the pipes. Also returns when to wake up for the grace when it has not.
-fn exit_settled(state: &ProcessState, now: Instant) -> (bool, Option<Instant>) {
-    if !state.exited {
-        return (false, None);
-    }
-    if state.readers_open == 0 || state.discarding {
-        return (true, None);
+    fn lookup(&self, process_id: &ProcessId) -> Result<Arc<Entry>, ProtocolError> {
+        match self.table().slots.get(process_id) {
+            Some(Slot::Live(entry)) => Ok(entry.clone()),
+            Some(Slot::Tombstone(ended)) => Err(ProtocolError::not_found_because(
+                NotFoundReason::Expired,
+                format!("process {process_id} {ended} and its output is no longer retained"),
+            )),
+            Some(Slot::Restarted) => Err(ProtocolError::not_found_because(
+                NotFoundReason::DaemonRestarted,
+                format!("process {process_id} belongs to an earlier daemon instance"),
+            )),
+            Some(Slot::Reserved) | None => Err(ProtocolError::not_found(format!(
+                "unknown process id: {process_id}"
+            ))),
+        }
     }
-    let Some(exit_observed_at) = state.exit_observed_at else {
-        return (true, None);
-    };
-    let drain_deadline = exit_observed_at + process_group::OUTPUT_DRAIN_GRACE;
-    (now >= drain_deadline, Some(drain_deadline))
-}
 
-async fn read_stream<R>(entry: Arc<ProcessEntry>, mut reader: R, stream: ProcessOutputStream)
-where
-    R: AsyncRead + Unpin,
-{
-    let mut buffer = vec![0; READ_BUFFER_BYTES];
-    loop {
-        match reader.read(&mut buffer).await {
-            Ok(0) => break,
-            Ok(read) => {
-                let mut state = entry.state.lock().await;
-                state.push_output(stream, &buffer[..read]);
-                entry.notify.notify_waiters();
+    /// Evicts settled entries past their retention or beyond the exited
+    /// byte budget, oldest exit first, and prunes old tombstones.
+    fn maintain(&self) {
+        let limits = &self.inner.config.limits;
+        let now = Instant::now();
+        let after_read = Duration::from_millis(limits.retention_after_exit_ms);
+        let unread = Duration::from_millis(limits.unread_retention_ms);
+        let mut table = self.table();
+
+        let mut settled = Vec::new();
+        let mut evict = Vec::new();
+        for (process_id, slot) in &table.slots {
+            let Slot::Live(entry) = slot else {
+                continue;
+            };
+            let Some((settled_at, retained)) = entry.execution.with_state(|state| {
+                state
+                    .settled_at()
+                    .map(|at| (at, state.sink.log.retained_bytes()))
+            }) else {
+                continue;
+            };
+            let read_at = *lock(&entry.fully_read_at);
+            let expired =
+                read_at.is_some_and(|at| now >= at + after_read) || now >= settled_at + unread;
+            if expired {
+                evict.push(process_id.clone());
+            } else {
+                settled.push((settled_at, retained, process_id.clone()));
             }
-            Err(error) => {
-                let mut state = entry.state.lock().await;
-                if state.failure.is_none() && !state.exited {
-                    state.failure = Some(error.to_string());
-                }
+        }
+        settled.sort();
+        let mut total: u64 = settled.iter().map(|(_, retained, _)| retained).sum();
+        for (_, retained, process_id) in settled {
+            if total <= limits.max_exited_retained_bytes {
                 break;
             }
+            total -= retained;
+            evict.push(process_id);
         }
-    }
-    entry.state.lock().await.reader_closed();
-    entry.notify.notify_waiters();
-}
 
-fn read_pty_stream(
-    entry: Arc<ProcessEntry>,
-    mut reader: Box<dyn std::io::Read + Send>,
-) -> JoinHandle<()> {
-    tokio::task::spawn_blocking(move || {
-        let handle = tokio::runtime::Handle::current();
-        let mut buffer = vec![0; READ_BUFFER_BYTES];
-        loop {
-            match reader.read(&mut buffer) {
-                Ok(0) => break,
-                Ok(read) => {
-                    let entry = entry.clone();
-                    let bytes = buffer[..read].to_vec();
-                    handle.block_on(async move {
-                        let mut state = entry.state.lock().await;
-                        state.push_output(ProcessOutputStream::Pty, &bytes);
-                        entry.notify.notify_waiters();
-                    });
-                }
-                Err(error) => {
-                    let entry = entry.clone();
-                    handle.block_on(async move {
-                        let mut state = entry.state.lock().await;
-                        if state.failure.is_none() && !state.exited {
-                            state.failure = Some(error.to_string());
-                        }
-                    });
-                    break;
+        for process_id in evict {
+            let Some(Slot::Live(entry)) = table.slots.remove(&process_id) else {
+                continue;
+            };
+            let ended = entry.execution.with_state(|state| {
+                let mut ended = state
+                    .exit()
+                    .map_or_else(|| "ended".to_owned(), describe_exit);
+                if let Some(stopped_by) = state.stopped_by() {
+                    let _ = write!(ended, " (stopped by {stopped_by:?})");
                 }
+                // Readers a leftover keeps on the pipes outlive the entry;
+                // they discard, and the retained output goes now.
+                state.sink.log = OutputLog::default();
+                ended
+            });
+            let group = entry.execution.group();
+            if entry.execution.group_alive() {
+                lock(&self.inner.leftover_groups)
+                    .insert(group.pgid, (group, entry.record_path.clone()));
+            } else {
+                let _ = std::fs::remove_file(&entry.record_path);
             }
+            table
+                .slots
+                .insert(process_id.clone(), Slot::Tombstone(ended));
+            table.tombstones.push_back((process_id, now));
         }
-        handle.block_on(async move {
-            entry.state.lock().await.reader_closed();
-            entry.notify.notify_waiters();
-        });
-    })
-}
 
-/// Observes the child's exit independently of pipe events so a silent child
-/// whose leftovers hold the pipes open still completes promptly.
-async fn watch_exit(entry: Arc<ProcessEntry>, leftover_groups: Arc<StdMutex<BTreeSet<u32>>>) {
-    loop {
-        tokio::time::sleep(EXIT_POLL_INTERVAL).await;
-        let done = {
-            let mut state = entry.state.lock().await;
-            if state.exited {
-                true
-            } else {
-                match update_exit_status(&mut state) {
-                    Ok(Some(pgid)) => {
-                        record_leftover_group(pgid, &leftover_groups);
-                        spawn_group_drain(entry.clone());
-                        true
-                    }
-                    Ok(None) => state.exited,
-                    Err(_) => true,
-                }
+        while let Some((_, evicted_at)) = table.tombstones.front() {
+            if table.tombstones.len() <= MAX_TOMBSTONES && now < *evicted_at + TOMBSTONE_RETENTION {
+                break;
+            }
+            let (process_id, _) = table.tombstones.pop_front().expect("front exists");
+            if matches!(table.slots.get(&process_id), Some(Slot::Tombstone(_))) {
+                table.slots.remove(&process_id);
             }
-        };
-        if done {
-            entry.notify.notify_waiters();
-            return;
         }
     }
-}
 
-async fn timeout_process(entry: Arc<ProcessEntry>, timeout: Duration) {
-    tokio::time::sleep(timeout).await;
-    {
-        let mut state = entry.state.lock().await;
-        if state.exited {
-            return;
-        }
-        if let Some(pgid) = state.pgid {
-            process_group::kill_group(pgid);
-        }
-        let _ = kill_child(&mut state.child).await;
-        state.exited = true;
-        state.exit_observed_at = Some(Instant::now());
-        state.exit_code = None;
-        state.termination = Some(ProcessTermination::TimedOut);
-        state.stdin.take();
+    fn table(&self) -> MutexGuard<'_, Table> {
+        lock(&self.inner.table)
     }
-    drain_or_abort_readers(&entry).await;
-    entry.notify.notify_waiters();
 }
 
-/// Polls the child for exit. When the exit is newly observed while members
-/// of its process group are still alive, returns the group id so the caller
-/// can record the leftovers.
-fn update_exit_status(state: &mut ProcessState) -> Result<Option<u32>, EnvironmentProtocolError> {
-    if state.exited {
-        return Ok(None);
-    }
-    let result = match &mut state.child {
-        ProcessChild::Pipe(child) => child
-            .try_wait()
-            .map(|status| status.map(|status| status.code())),
-        ProcessChild::Pty(child) => child
-            .try_wait()
-            .map(|status| status.map(|status| Some(status.exit_code() as i32))),
-    };
-    match result {
-        Ok(Some(status)) => {
-            state.exited = true;
-            state.exit_observed_at = Some(Instant::now());
-            state.exit_code = status;
-            state.stdin.take();
-            Ok(state.pgid.filter(|pgid| process_group::group_alive(*pgid)))
-        }
-        Ok(None) => Ok(None),
-        Err(error) => {
-            state.failure = Some(error.to_string());
-            Err(EnvironmentProtocolError::new(
-                EnvironmentProtocolErrorCode::ProcessFailed,
-                format!("poll process exit: {error}"),
-            ))
-        }
-    }
+fn validate_pty(size: PtySize, input: &ExecInput) -> Result<(), ProtocolError> {
+    let valid = 1..=PtySize::MAX_DIMENSION;
+    if !valid.contains(&size.rows) || !valid.contains(&size.cols) {
+        return Err(ProtocolError::invalid_field(
+            "pty",
+            format!("PTY rows and cols must be 1 to {}", PtySize::MAX_DIMENSION),
+        ));
+    }
+    if matches!(input, ExecInput::Pipe {}) {
+        return Err(ProtocolError::invalid_field(
+            "command.input",
+            "a PTY is the input; pipe input cannot be combined with pty",
+        ));
+    }
+    Ok(())
 }
 
-fn record_leftover_group(pgid: u32, leftover_groups: &StdMutex<BTreeSet<u32>>) {
-    leftover_groups
+fn lock<T>(mutex: &Mutex<T>) -> MutexGuard<'_, T> {
+    mutex
         .lock()
-        .expect("leftover groups poisoned")
-        .insert(pgid);
+        .unwrap_or_else(|poisoned| poisoned.into_inner())
 }
 
-async fn kill_child(child: &mut ProcessChild) -> Result<(), EnvironmentProtocolError> {
-    let result = match child {
-        ProcessChild::Pipe(child) => child.kill().await,
-        ProcessChild::Pty(child) => child.kill(),
-    };
-    result.map_err(|error| {
-        EnvironmentProtocolError::new(
-            EnvironmentProtocolErrorCode::ProcessFailed,
-            error.to_string(),
-        )
-    })
-}
+#[cfg(test)]
+mod tests {
+    use std::collections::BTreeMap;
 
-fn interrupt_child(child: &mut ProcessChild) {
-    let pid = match child {
-        ProcessChild::Pipe(child) => child.id(),
-        ProcessChild::Pty(child) => child.process_id(),
+    use environment_protocol::{
+        bytes::{ByteChunk, SecretString},
+        data::exec::{CommandSpec, ExitStatus, GapReason, SignalName},
+        error::{ErrorData, PreconditionReason, ProtocolErrorKind},
     };
-    #[cfg(unix)]
-    if let Some(pid) = pid
-        .and_then(|pid| i32::try_from(pid).ok())
-        .and_then(rustix::process::Pid::from_raw)
-    {
-        let _ = rustix::process::kill_process(pid, rustix::process::Signal::INT);
-    }
-    #[cfg(not(unix))]
-    let _ = pid;
-}
 
-fn process_error<E: std::fmt::Display>(
-    context: &'static str,
-) -> impl FnOnce(E) -> EnvironmentProtocolError {
-    move |error| {
-        EnvironmentProtocolError::new(
-            EnvironmentProtocolErrorCode::ProcessFailed,
-            format!("{context}: {error}"),
-        )
-    }
-}
-
-/// After a natural exit, gives the readers the drain grace to reach end of
-/// file so bytes the root wrote just before exiting are kept, then leaves
-/// them on the pipes in discard mode. The pipe's own end of file, when the
-/// last leftover holding it exits, ends them. The group is never signalled.
-fn spawn_group_drain(entry: Arc<ProcessEntry>) {
-    tokio::spawn(async move {
-        tokio::time::sleep(process_group::OUTPUT_DRAIN_GRACE).await;
-        let mut state = entry.state.lock().await;
-        if state.readers_open > 0 {
-            state.discarding = true;
-        }
-        drop(state);
-        entry.notify.notify_waiters();
-    });
-}
-
-fn spawn_reader_drain(entry: Arc<ProcessEntry>) {
-    tokio::spawn(async move {
-        drain_or_abort_readers(&entry).await;
-        entry.notify.notify_waiters();
-    });
-}
+    use super::*;
 
-/// After the group was killed: waits the drain grace for the readers, then
-/// abandons any still stuck on a pipe an escaped descendant holds.
-async fn drain_or_abort_readers(entry: &ProcessEntry) {
-    let mut readers = std::mem::take(&mut *entry.readers.lock().await);
-    let deadline = Instant::now() + process_group::OUTPUT_DRAIN_GRACE;
-    for reader in &mut readers {
-        if tokio::time::timeout_at(deadline, &mut *reader)
-            .await
-            .is_err()
-        {
-            reader.abort();
+    fn limits() -> ProcessLimits {
+        ProcessLimits {
+            max_read_bytes: 4 * 1024 * 1024,
+            max_retained_output_bytes: 4 * 1024 * 1024,
+            retention_after_exit_ms: 60_000,
+            unread_retention_ms: 7_200_000,
+            max_exited_retained_bytes: 64 * 1024 * 1024,
+            terminate_grace_ms: 200,
+            max_input_queue_bytes: 64 * 1024,
         }
     }
-    let mut state = entry.state.lock().await;
-    state.readers_open = 0;
-    state.discarding = true;
-}
 
-fn response_from_state(
-    state: &mut ProcessState,
-    after_seq: Option<u64>,
-    max_bytes: Option<usize>,
-) -> ReadProcessResponse {
-    let (chunks, omitted_bytes, next_seq) = match after_seq {
-        None => {
-            let (chunks, omitted) = state.output.deliver(max_bytes);
-            (chunks, omitted, state.output.delivered_seq)
-        }
-        Some(after_seq) => {
-            let (chunks, omitted) = state.output.reread(after_seq, max_bytes);
-            let next_seq = chunks
-                .last()
-                .map_or(after_seq.max(state.output.delivered_seq), |chunk| {
-                    chunk.seq + 1
-                });
-            (chunks, omitted, next_seq)
-        }
-    };
-    // Leftovers are sampled when the caller looks, so the list reflects
-    // what is alive now rather than the instant the root exited, when a
-    // background child may still have been mid-exec.
-    if state.exited {
-        state.leftover_processes = match state.pgid.filter(|pgid| process_group::group_alive(*pgid))
-        {
-            Some(pgid) => sample_group_members(pgid),
-            None => Vec::new(),
-        };
-    }
-    ReadProcessResponse {
-        chunks,
-        next_seq,
-        exited: state.exited,
-        exit_code: state.exit_code,
-        closed: state.exited,
-        failure: state.failure.clone(),
-        termination: state.termination,
-        pid: state.pid,
-        omitted_bytes,
-        leftover_processes: state.leftover_processes.clone(),
+    struct Fixture {
+        _temp: tempfile::TempDir,
+        root: PathBuf,
+        state_dir: PathBuf,
+        manager: ProcessManager,
     }
-}
 
-fn normalize_path(path: PathBuf) -> PathBuf {
-    let mut normalized = PathBuf::new();
-    for component in path.components() {
-        match component {
-            Component::Prefix(prefix) => normalized.push(prefix.as_os_str()),
-            Component::RootDir => normalized.push(std::path::MAIN_SEPARATOR.to_string()),
-            Component::CurDir => {}
-            Component::ParentDir => {
-                normalized.pop();
-            }
-            Component::Normal(segment) => normalized.push(segment),
+    fn fixture_with(limits: ProcessLimits) -> Fixture {
+        let temp = tempfile::tempdir().expect("tempdir");
+        let root = temp.path().canonicalize().expect("canonical root");
+        let state_dir = root.join("state");
+        let manager = manager_at(&root, &state_dir, limits, "envd_first");
+        Fixture {
+            _temp: temp,
+            root,
+            state_dir,
+            manager,
         }
     }
-    normalized
-}
 
-/// Live, non-zombie members of a process group with their command lines,
-/// best effort: `/proc` on Linux, libproc on macOS, empty elsewhere.
-#[cfg(target_os = "linux")]
-fn sample_group_members(pgid: u32) -> Vec<LeftoverProcess> {
-    let Ok(entries) = std::fs::read_dir("/proc") else {
-        return Vec::new();
-    };
-    let mut members = Vec::new();
-    for entry in entries.flatten() {
-        let Some(pid) = entry
-            .file_name()
-            .to_str()
-            .and_then(|name| name.parse::<u32>().ok())
-        else {
-            continue;
-        };
-        let Ok(stat) = std::fs::read_to_string(entry.path().join("stat")) else {
-            continue;
-        };
-        // "pid (comm) state ppid pgrp ..."; comm may contain spaces and
-        // parentheses, so split at the last closing parenthesis.
-        let Some(open) = stat.find('(') else {
-            continue;
-        };
-        let Some(close) = stat.rfind(')') else {
-            continue;
-        };
-        let mut fields = stat[close + 1..].split_whitespace();
-        let state = fields.next();
-        let _ppid = fields.next();
-        let pgrp = fields.next().and_then(|value| value.parse::<u32>().ok());
-        if pgrp != Some(pgid) || state == Some("Z") {
-            continue;
-        }
-        let command = std::fs::read(entry.path().join("cmdline"))
-            .ok()
-            .map(|bytes| {
-                bytes
-                    .split(|byte| *byte == 0)
-                    .filter(|part| !part.is_empty())
-                    .map(|part| String::from_utf8_lossy(part).into_owned())
-                    .collect::<Vec<_>>()
-                    .join(" ")
-            })
-            .filter(|command| !command.is_empty())
-            .unwrap_or_else(|| stat[open + 1..close].to_owned());
-        members.push(LeftoverProcess { pid, command });
+    fn fixture() -> Fixture {
+        fixture_with(limits())
+    }
+
+    fn manager_at(
+        root: &std::path::Path,
+        state_dir: &std::path::Path,
+        limits: ProcessLimits,
+        instance: &str,
+    ) -> ProcessManager {
+        let confinement =
+            Confinement::new(root.to_owned(), state_dir.to_owned()).expect("confinement");
+        ProcessManager::new(ProcessConfig {
+            cwd: root.to_owned(),
+            confinement: Arc::new(confinement),
+            state_dir: state_dir.to_owned(),
+            scrubbed_env: Vec::new(),
+            instance_id: DaemonInstanceId::new(instance).unwrap(),
+            limits,
+            max_wait_ms: 60_000,
+            pty_supported: true,
+        })
+        .expect("manager")
     }
-    members.sort_by_key(|member| member.pid);
-    members
-}
 
-#[cfg(target_os = "macos")]
-fn sample_group_members(pgid: u32) -> Vec<LeftoverProcess> {
-    use std::{ffi::c_void, mem};
-
-    let Ok(group) = libc::pid_t::try_from(pgid) else {
-        return Vec::new();
-    };
-    let pid_size = mem::size_of::<libc::pid_t>();
-    // libproc's group listing returns pid counts, not bytes: with a null
-    // buffer the count of every process on the system, which is an upper
-    // bound for the group, and with a buffer the count it filled.
-    let upper_bound = unsafe { libc::proc_listpgrppids(group, std::ptr::null_mut(), 0) };
-    if upper_bound <= 0 {
-        return Vec::new();
-    }
-    let mut pids = vec![0 as libc::pid_t; upper_bound as usize + 16];
-    let count = unsafe {
-        libc::proc_listpgrppids(
-            group,
-            pids.as_mut_ptr() as *mut c_void,
-            (pids.len() * pid_size) as libc::c_int,
-        )
-    };
-    if count <= 0 {
-        return Vec::new();
-    }
-    pids.truncate(count as usize);
-    let mut members = Vec::new();
-    for pid in pids {
-        if pid <= 0 {
-            continue;
-        }
-        let mut info: libc::proc_bsdinfo = unsafe { mem::zeroed() };
-        let info_size = mem::size_of::<libc::proc_bsdinfo>() as libc::c_int;
-        let read = unsafe {
-            libc::proc_pidinfo(
-                pid,
-                libc::PROC_PIDTBSDINFO,
-                0,
-                &mut info as *mut libc::proc_bsdinfo as *mut c_void,
-                info_size,
-            )
-        };
-        if read == info_size && info.pbi_status == libc::SZOMB {
-            continue;
-        }
-        let mut path = vec![0u8; 4096];
-        let len =
-            unsafe { libc::proc_pidpath(pid, path.as_mut_ptr() as *mut c_void, path.len() as u32) };
-        let command = if len > 0 {
-            String::from_utf8_lossy(&path[..len as usize]).into_owned()
-        } else {
-            String::new()
-        };
-        members.push(LeftoverProcess {
-            pid: pid as u32,
-            command,
-        });
+    fn ctx() -> RequestContext {
+        RequestContext::detached()
     }
-    members.sort_by_key(|member| member.pid);
-    members
-}
-
-#[cfg(not(any(target_os = "linux", target_os = "macos")))]
-fn sample_group_members(_pgid: u32) -> Vec<LeftoverProcess> {
-    Vec::new()
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use environment_protocol::shared::SecretString;
 
-    fn manager() -> (tempfile::TempDir, PathBuf, ProcessManager) {
-        let temp = tempfile::tempdir().expect("tempdir");
-        let root = temp.path().canonicalize().expect("canonical root");
-        let manager = ProcessManager::new(root.clone(), root.clone());
-        (temp, root, manager)
+    fn id(value: &str) -> ProcessId {
+        ProcessId::new(value).unwrap()
     }
 
-    fn params(process_id: &str, script: &str) -> StartProcessParams {
+    fn shell(process_id: &str, script: &str) -> StartProcessParams {
         StartProcessParams {
-            process_id: ProcessId::new(process_id),
-            argv: vec!["/bin/sh".to_owned(), "-c".to_owned(), script.to_owned()],
-            cwd: None,
-            env: BTreeMap::new(),
-            secret_env: BTreeMap::new(),
-            stdin: None,
-            timeout_ms: Some(30_000),
-            tty: false,
+            process_id: id(process_id),
+            command: CommandSpec {
+                argv: vec!["/bin/sh".to_owned(), "-c".to_owned(), script.to_owned()],
+                cwd: None,
+                env: BTreeMap::new(),
+                secret_env: BTreeMap::new(),
+                input: ExecInput::None {},
+                timeout_ms: Some(30_000),
+            },
+            pty: None,
         }
     }
 
-    fn read_params(process_id: &str, wait_ms: Option<u64>) -> ReadProcessParams {
+    fn read_params(process_id: &str, return_on: ReturnOn, wait_ms: u64) -> ReadProcessParams {
         ReadProcessParams {
-            process_id: ProcessId::new(process_id),
-            after_seq: None,
-            max_bytes: None,
+            process_id: id(process_id),
+            after: None,
+            tail_bytes: None,
+            ack: None,
+            max_bytes: 4 * 1024 * 1024,
             wait_ms,
+            return_on,
         }
     }
 
-    fn stream_bytes(response: &ReadProcessResponse, stream: ProcessOutputStream) -> Vec<u8> {
-        response
-            .chunks
-            .iter()
-            .filter(|chunk| chunk.stream == stream)
-            .flat_map(|chunk| chunk.chunk.as_slice().to_vec())
-            .collect()
+    fn written(reply: Reply<ReadProcessResponse>) -> ReadProcessResponse {
+        if let Some(hook) = reply.on_written {
+            hook();
+        }
+        reply.value
     }
 
-    fn all_bytes(response: &ReadProcessResponse) -> Vec<u8> {
+    fn data(response: &ReadProcessResponse) -> Vec<u8> {
         response
+            .output
             .chunks
             .iter()
-            .flat_map(|chunk| chunk.chunk.as_slice().to_vec())
+            .flat_map(|chunk| chunk.data.as_slice().to_vec())
             .collect()
     }
 
-    #[tokio::test(flavor = "current_thread")]
-    async fn process_reports_stdout_stderr_exit_code_and_pid() {
-        let (_temp, _root, manager) = manager();
-        manager
-            .start_process(params("proc-1", "printf out; printf err >&2"))
-            .await
-            .expect("start");
-
-        let output = manager
-            .read_process(read_params("proc-1", None))
-            .await
-            .expect("read");
-
-        assert!(output.exited);
-        assert_eq!(output.exit_code, Some(0));
-        assert!(output.pid.is_some());
-        assert_eq!(output.termination, None);
-        assert!(output.leftover_processes.is_empty());
-        assert_eq!(stream_bytes(&output, ProcessOutputStream::Stdout), b"out");
-        assert_eq!(stream_bytes(&output, ProcessOutputStream::Stderr), b"err");
+    /// Cursor reads until the settled exit with nothing left unread.
+    async fn read_to_end(
+        manager: &ProcessManager,
+        process_id: &str,
+    ) -> (Vec<u8>, ReadProcessResponse) {
+        let mut bytes = Vec::new();
+        loop {
+            let reply = manager
+                .read(&ctx(), read_params(process_id, ReturnOn::AnyOutput, 10_000))
+                .await
+                .expect("read");
+            let response = written(reply);
+            bytes.extend(data(&response));
+            if response.state == ExecState::Exited && response.output.next == response.output.end {
+                return (bytes, response);
+            }
+        }
     }
 
-    #[tokio::test(flavor = "current_thread")]
-    async fn terminal_process_records_are_pruned_and_reusable() {
-        let (_temp, _root, manager) = manager();
-        let params = params("proc-reused", "true");
+    fn not_found_reason(error: &ProtocolError) -> Option<NotFoundReason> {
+        match &error.data {
+            ErrorData::NotFound { reason } => *reason,
+            _ => panic!("expected notFound, got {error:?}"),
+        }
+    }
 
-        manager
-            .start_process(params.clone())
-            .await
-            .expect("start first");
-        let output = manager
-            .read_process(read_params("proc-reused", None))
-            .await
-            .expect("read terminal output");
-        assert!(output.exited);
+    #[cfg(unix)]
+    async fn wait_for_pid_file(path: &std::path::Path) -> i32 {
+        let deadline = Instant::now() + Duration::from_secs(5);
+        loop {
+            if let Ok(content) = std::fs::read_to_string(path)
+                && let Ok(pid) = content.trim().parse()
+            {
+                return pid;
+            }
+            assert!(Instant::now() < deadline, "pid file was not written");
+            tokio::time::sleep(Duration::from_millis(20)).await;
+        }
+    }
 
-        tokio::time::sleep(TERMINAL_PROCESS_RETENTION * 2).await;
+    #[cfg(unix)]
+    fn process_alive(pid: i32) -> bool {
+        rustix::process::Pid::from_raw(pid)
+            .is_some_and(|pid| rustix::process::test_kill_process(pid).is_ok())
+    }
 
-        manager
-            .start_process(params)
-            .await
-            .expect("start reused id");
+    #[cfg(unix)]
+    fn kill(pid: i32) {
+        let _ = rustix::process::kill_process(
+            rustix::process::Pid::from_raw(pid).expect("pid"),
+            rustix::process::Signal::KILL,
+        );
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn plain_pipe_process_reads_eof_on_stdin_at_once() {
-        let (_temp, _root, manager) = manager();
-        manager
-            .start_process(params("proc-cat", "cat; echo done"))
+    async fn reports_both_streams_exit_code_and_pid() {
+        let fixture = fixture();
+        let started = fixture
+            .manager
+            .start(&ctx(), shell("p1", "printf out; printf err >&2; exit 3"))
             .await
             .expect("start");
-        let output = tokio::time::timeout(
+        let (bytes, response) = read_to_end(&fixture.manager, "p1").await;
+        assert_eq!(response.pid, started.pid);
+        assert_eq!(response.exit, Some(ExitStatus::Code { code: 3 }));
+        assert_eq!(response.stopped_by, None);
+        assert!(response.leftovers.is_none());
+        // The two streams interleave in arrival order.
+        let mut sorted = bytes;
+        sorted.sort_unstable();
+        let mut expected = b"outerr".to_vec();
+        expected.sort_unstable();
+        assert_eq!(sorted, expected);
+        assert_eq!(response.output.end, 6);
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn large_bytes_input_never_blocks_the_start() {
+        // More input than any pipe buffer, to a child that writes before it
+        // has read everything: the start must not wait for the input.
+        let fixture = fixture();
+        let input: Vec<u8> = (0..1024 * 1024u32).map(|i| b'a' + (i % 26) as u8).collect();
+        let mut params = shell("cat", "cat");
+        params.command.input = ExecInput::Bytes {
+            data: ByteChunk::from(input.clone()),
+        };
+        tokio::time::timeout(
             Duration::from_secs(5),
-            manager.read_process(read_params("proc-cat", None)),
+            fixture.manager.start(&ctx(), params),
         )
         .await
-        .expect("cat exits without waiting for input")
-        .expect("read");
-        assert!(output.exited);
-        assert_eq!(
-            stream_bytes(&output, ProcessOutputStream::Stdout),
-            b"done\n"
-        );
-
-        let write = manager
-            .write_process(WriteProcessParams {
-                process_id: ProcessId::new("proc-cat"),
-                chunk: Some(ByteChunk::from(b"late".as_slice())),
-                close_stdin: false,
-            })
-            .await
-            .expect("write");
-        assert_eq!(write.status, WriteProcessStatus::StdinClosed);
+        .expect("the start answers at once")
+        .expect("start");
+        let (bytes, response) = read_to_end(&fixture.manager, "cat").await;
+        assert_eq!(response.exit, Some(ExitStatus::Code { code: 0 }));
+        assert_eq!(bytes, input, "every byte went through");
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn one_shot_stdin_is_written_and_closed_at_start() {
-        let (_temp, _root, manager) = manager();
-        let mut params = params("proc-stdin", "cat");
-        params.stdin = Some(ByteChunk::from(b"hello".as_slice()));
-        manager.start_process(params).await.expect("start");
-        let output = manager
-            .read_process(read_params("proc-stdin", None))
+    async fn a_large_pty_write_never_freezes_the_daemon() {
+        // A PTY child that never reads: a write must not block the runtime
+        // thread under the entry lock until the child is killed.
+        let fixture = fixture();
+        let mut params = shell("pty", "sleep 30");
+        params.pty = Some(PtySize { rows: 24, cols: 80 });
+        fixture.manager.start(&ctx(), params).await.expect("start");
+        let chunk = vec![b'x'; 16 * 1024];
+        let mut accepted = 0;
+        for _ in 0..64 {
+            let write = tokio::time::timeout(
+                Duration::from_secs(1),
+                fixture.manager.write(
+                    &ctx(),
+                    WriteProcessParams {
+                        process_id: id("pty"),
+                        data: ByteChunk::from(chunk.clone()),
+                        close_input: false,
+                    },
+                ),
+            )
             .await
-            .expect("read");
-        assert!(output.exited);
-        assert_eq!(stream_bytes(&output, ProcessOutputStream::Stdout), b"hello");
+            .expect("a write answers without blocking")
+            .expect("write");
+            accepted += write.accepted_bytes;
+        }
+        // Whether the terminal blocks or discards input a child never reads
+        // differs by platform; either way no write may exceed what was sent.
+        assert!(accepted <= 64 * 16 * 1024);
+        // The runtime thread is free, and a kill still works.
+        tokio::time::sleep(Duration::from_millis(10)).await;
+        let terminated = fixture
+            .manager
+            .terminate(
+                &ctx(),
+                TerminateProcessParams {
+                    process_id: id("pty"),
+                    signal: ProcessSignal::Kill,
+                },
+            )
+            .await
+            .expect("kill");
+        assert!(terminated.running);
+        let (_, response) = read_to_end(&fixture.manager, "pty").await;
+        assert_eq!(response.stopped_by, Some(StoppedBy::Kill));
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn pty_process_accepts_input_echoes_and_resizes() {
-        let (_temp, _root, manager) = manager();
-        let mut params = params("proc-pty", "read line; printf '%s' \"$line\"");
-        params.tty = true;
-        manager.start_process(params).await.expect("start PTY");
-        manager
-            .resize_process(ResizeProcessParams {
-                process_id: ProcessId::new("proc-pty"),
-                size: environment_protocol::data::process::TerminalSize {
-                    rows: 40,
-                    cols: 120,
-                },
-            })
-            .await
-            .expect("resize PTY");
-        let write = manager
-            .write_process(WriteProcessParams {
-                process_id: ProcessId::new("proc-pty"),
-                chunk: Some(ByteChunk::from(b"hello\n".as_slice())),
-                close_stdin: false,
-            })
-            .await
-            .expect("write PTY");
-        assert_eq!(write.status, WriteProcessStatus::Accepted);
-        let output = manager
-            .read_process(read_params("proc-pty", None))
-            .await
-            .expect("read PTY");
-        assert!(output.exited);
-        assert!(
-            output
-                .chunks
-                .iter()
-                .all(|chunk| chunk.stream == ProcessOutputStream::Pty)
+    async fn pipe_input_streams_until_closed() {
+        let fixture = fixture();
+        let mut params = shell("pipe", "cat; echo done");
+        params.command.input = ExecInput::Pipe {};
+        fixture.manager.start(&ctx(), params).await.expect("start");
+        let write = |data: &'static [u8], close_input| WriteProcessParams {
+            process_id: id("pipe"),
+            data: ByteChunk::from(data),
+            close_input,
+        };
+        assert_eq!(
+            fixture
+                .manager
+                .write(&ctx(), write(b"hello ", false))
+                .await
+                .unwrap()
+                .accepted_bytes,
+            6
+        );
+        assert_eq!(
+            fixture
+                .manager
+                .write(&ctx(), write(b"world\n", true))
+                .await
+                .unwrap()
+                .accepted_bytes,
+            6
         );
-        assert!(String::from_utf8_lossy(&all_bytes(&output)).contains("hello"));
+        let (bytes, response) = read_to_end(&fixture.manager, "pipe").await;
+        assert_eq!(bytes, b"hello world\ndone\n");
+        assert_eq!(response.exit, Some(ExitStatus::Code { code: 0 }));
+        let error = fixture
+            .manager
+            .write(&ctx(), write(b"late", false))
+            .await
+            .unwrap_err();
+        assert!(matches!(
+            error.data,
+            ErrorData::FailedPrecondition {
+                reason: PreconditionReason::InputClosed
+            }
+        ));
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn wait_collects_for_the_whole_window_or_until_exit() {
-        let (_temp, _root, manager) = manager();
-        manager
-            .start_process(params(
-                "proc-window",
-                "for i in 1 2 3 4 5 6 7 8 9 10; do echo line$i; sleep 0.02; done",
-            ))
+    async fn the_cursor_moves_only_once_the_reply_is_written() {
+        let fixture = fixture();
+        fixture
+            .manager
+            .start(&ctx(), shell("cursor", "printf first; sleep 30"))
             .await
             .expect("start");
-
-        let started = std::time::Instant::now();
-        let output = manager
-            .read_process(read_params("proc-window", Some(10_000)))
+        let lost = fixture
+            .manager
+            .read(&ctx(), read_params("cursor", ReturnOn::AnyOutput, 5_000))
             .await
             .expect("read");
-        assert!(output.exited, "a long wait returns at exit");
-        assert!(started.elapsed() < Duration::from_secs(5));
-        let text = String::from_utf8_lossy(&all_bytes(&output)).into_owned();
-        assert_eq!(text.lines().count(), 10, "every line arrives in one read");
-
-        manager
-            .start_process(params(
-                "proc-short",
-                "for i in 1 2 3 4 5 6 7 8 9 10; do echo line$i; sleep 0.05; done",
-            ))
+        assert_eq!(data(&lost.value), b"first");
+        // The connection dropped before the frame went out: no hook runs.
+        drop(lost);
+        let again = written(
+            fixture
+                .manager
+                .read(&ctx(), read_params("cursor", ReturnOn::AnyOutput, 5_000))
+                .await
+                .expect("read again"),
+        );
+        assert_eq!(data(&again), b"first", "nothing was consumed");
+        let after = fixture
+            .manager
+            .read(&ctx(), read_params("cursor", ReturnOn::AnyOutput, 0))
             .await
-            .expect("start short");
-        let started = std::time::Instant::now();
-        let output = manager
-            .read_process(read_params("proc-short", Some(120)))
+            .expect("read after commit")
+            .value;
+        assert!(after.output.chunks.is_empty());
+        assert_eq!(after.output.next, 5);
+
+        // A cancelled wait answers aborted and consumes nothing either.
+        let cancelled = ctx();
+        cancelled.cancel.cancel();
+        let error = fixture
+            .manager
+            .read(&cancelled, read_params("cursor", ReturnOn::Exit, 5_000))
             .await
-            .expect("read short");
-        let elapsed = started.elapsed();
-        assert!(!output.exited);
-        assert!(
-            elapsed >= Duration::from_millis(100) && elapsed < Duration::from_millis(400),
-            "returned at the window, not the first chunk: {elapsed:?}"
-        );
-        let lines = String::from_utf8_lossy(&all_bytes(&output)).lines().count();
-        assert!(
-            (1..10).contains(&lines),
-            "partial output at the window: {lines} lines"
-        );
+            .unwrap_err();
+        assert_eq!(error.kind(), ProtocolErrorKind::Aborted);
+        fixture
+            .manager
+            .terminate(
+                &ctx(),
+                TerminateProcessParams {
+                    process_id: id("cursor"),
+                    signal: ProcessSignal::Kill,
+                },
+            )
+            .await
+            .expect("kill");
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn cursor_reads_return_disjoint_output_and_rereads_do_not_move_it() {
-        let (_temp, _root, manager) = manager();
-        manager
-            .start_process(params(
-                "proc-cursor",
-                "echo first; sleep 0.2; echo second; sleep 0.2; echo third",
-            ))
+    async fn the_end_of_a_large_output_survives_and_exit_waits_for_it() {
+        // A command that prints far more than is retained and then its
+        // summary: the read at exit shows the head, one gap and the end.
+        let fixture = fixture_with(ProcessLimits {
+            max_retained_output_bytes: 64 * 1024,
+            ..limits()
+        });
+        fixture
+            .manager
+            .start(
+                &ctx(),
+                shell(
+                    "build",
+                    "i=0; while [ $i -lt 20000 ]; do echo line-$i; i=$((i+1)); done; echo 'FAILED: 3 tests'",
+                ),
+            )
             .await
             .expect("start");
-
-        let first = manager
-            .read_process(read_params("proc-cursor", Some(80)))
-            .await
-            .expect("first read");
-        assert_eq!(all_bytes(&first), b"first\n");
-        assert!(!first.exited);
-
-        let reread = manager
-            .read_process(ReadProcessParams {
-                process_id: ProcessId::new("proc-cursor"),
-                after_seq: Some(0),
-                max_bytes: None,
-                wait_ms: Some(0),
-            })
-            .await
-            .expect("reread");
-        assert!(
-            reread.chunks.is_empty(),
-            "delivered chunks are not retained"
+        let response = written(
+            fixture
+                .manager
+                .read(&ctx(), read_params("build", ReturnOn::Exit, 30_000))
+                .await
+                .expect("read"),
         );
-
-        let rest = manager
-            .read_process(read_params("proc-cursor", Some(10_000)))
-            .await
-            .expect("second read");
-        assert!(rest.exited);
-        assert_eq!(all_bytes(&rest), b"second\nthird\n");
+        assert_eq!(response.state, ExecState::Exited);
+        assert_eq!(
+            response.output.next, response.output.end,
+            "nothing left unread"
+        );
+        assert_eq!(response.output.gaps.len(), 1);
+        assert_eq!(response.output.gaps[0].reason, GapReason::Overflow);
+        let text = String::from_utf8(data(&response)).unwrap();
+        assert!(text.starts_with("line-0\n"));
         assert!(
-            rest.chunks
-                .iter()
-                .all(|chunk| chunk.seq > first.chunks[0].seq),
-            "the second read never repeats the first"
+            text.ends_with("FAILED: 3 tests\n"),
+            "the summary at the end survives"
         );
+        let gap = response.output.gaps[0].omitted_bytes;
+        assert_eq!(text.len() as u64 + gap, response.output.end);
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn max_bytes_splits_the_first_chunk_and_keeps_the_remainder() {
-        let (_temp, _root, manager) = manager();
-        manager
-            .start_process(params("proc-split", "printf abcdefgh"))
+    async fn pages_at_explicit_offsets_never_consume_and_tail_reads_start_at_the_end() {
+        let fixture = fixture();
+        fixture
+            .manager
+            .start(&ctx(), shell("pages", "printf abcdefgh"))
             .await
             .expect("start");
-        let head = manager
-            .read_process(ReadProcessParams {
-                process_id: ProcessId::new("proc-split"),
-                after_seq: None,
-                max_bytes: Some(3),
-                wait_ms: None,
-            })
-            .await
-            .expect("head");
-        assert_eq!(all_bytes(&head), b"abc");
-        let tail = manager
-            .read_process(ReadProcessParams {
-                process_id: ProcessId::new("proc-split"),
-                after_seq: None,
-                max_bytes: Some(100),
-                wait_ms: None,
-            })
-            .await
-            .expect("tail");
-        assert_eq!(all_bytes(&tail), b"defgh");
-        assert_eq!(head.chunks[0].seq, tail.chunks[0].seq);
+        let mut params = read_params("pages", ReturnOn::Exit, 10_000);
+        // `after` past the output produced so far is refused before any
+        // wait, so settle the process first with a non-consuming read.
+        params.after = Some(0);
+        let settled = written(fixture.manager.read(&ctx(), params.clone()).await.unwrap());
+        assert_eq!(settled.state, ExecState::Exited);
+        assert_eq!(settled.output.end, 8);
+        params.after = Some(2);
+        params.max_bytes = 3;
+        let page = written(fixture.manager.read(&ctx(), params.clone()).await.unwrap());
+        assert_eq!(data(&page), b"cde");
+        assert_eq!(page.output.next, 5);
+        params.after = None;
+        params.tail_bytes = Some(2);
+        let tail = written(fixture.manager.read(&ctx(), params.clone()).await.unwrap());
+        assert_eq!(data(&tail), b"gh");
+        params.tail_bytes = None;
+        params.after = Some(9);
+        let error = fixture.manager.read(&ctx(), params).await.unwrap_err();
+        assert_eq!(error.kind(), ProtocolErrorKind::InvalidParams);
+        let (all, _) = read_to_end(&fixture.manager, "pages").await;
+        assert_eq!(all, b"abcdefgh", "offset reads left the cursor at 0");
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn unread_output_is_capped_to_head_and_tail() {
-        let (_temp, _root, manager) = manager();
-        // 64 KiB of numbered lines against a 16 KiB test cap.
-        manager
-            .start_process(params(
-                "proc-cap",
-                "i=0; while [ $i -lt 4096 ]; do printf '%015d\\n' $i; i=$((i+1)); done",
-            ))
+    async fn a_duplicate_id_runs_nothing() {
+        let fixture = fixture();
+        let script = "echo run >> runs.txt";
+        fixture
+            .manager
+            .start(&ctx(), shell("dup", script))
             .await
             .expect("start");
-        let output = manager
-            .read_process(read_params("proc-cap", None))
+        let error = fixture
+            .manager
+            .start(&ctx(), shell("dup", script))
             .await
-            .expect("read");
-        assert!(output.exited);
-        let delivered = all_bytes(&output);
-        assert!(
-            delivered.len() <= RETAINED_OUTPUT_CAP,
-            "{}",
-            delivered.len()
-        );
-        assert!(output.omitted_bytes > 0);
-        assert_eq!(
-            delivered.len() as u64 + output.omitted_bytes,
-            4096 * 16,
-            "head + omitted + tail account for every byte"
-        );
-        let text = String::from_utf8_lossy(&delivered).into_owned();
-        assert!(text.starts_with("000000000000000\n"), "head kept");
-        assert!(text.ends_with("000000000004095\n"), "tail kept");
-        let gaps = output
-            .chunks
-            .windows(2)
-            .filter(|pair| pair[1].seq != pair[0].seq + 1)
-            .count();
-        assert_eq!(gaps, 1, "one gap where the middle was");
-
-        let again = manager
-            .read_process(read_params("proc-cap", Some(0)))
-            .await
-            .expect("second read");
-        assert!(again.chunks.is_empty());
-        assert_eq!(again.omitted_bytes, 0, "the omission is reported once");
-    }
-
-    #[test]
-    fn cap_keeps_one_contiguous_gap_when_chunk_sizes_are_uneven() {
-        // 16 KiB test cap, 8 KiB head. Seven 1000-byte chunks fill the head;
-        // the 1500-byte chunk after them is the first to be dropped, which
-        // leaves a 500-byte survivor right behind the head. A head recomputed
-        // purely by bytes would absorb that survivor on the next drop and
-        // open a second gap behind it.
-        let mut buffer = OutputBuffer::default();
-        let mut push = |len: usize| buffer.push(ProcessOutputStream::Stdout, vec![b'x'; len]);
-        for _ in 0..7 {
-            push(1000);
-        }
-        push(1500);
-        push(500);
-        for _ in 0..5 {
-            push(1500);
-        }
-        push(1500);
-        let total = 7 * 1000 + 1500 + 500 + 5 * 1500 + 1500;
-
-        let (chunks, omitted) = buffer.deliver(None);
-
-        let delivered: usize = chunks
-            .iter()
-            .map(|chunk| chunk.chunk.as_slice().len())
-            .sum();
-        assert!(delivered <= RETAINED_OUTPUT_CAP, "{delivered}");
-        assert!(omitted > 0);
-        assert_eq!(delivered as u64 + omitted, total as u64);
-        let gaps = chunks
-            .windows(2)
-            .filter(|pair| pair[1].seq != pair[0].seq + 1)
-            .count();
-        assert_eq!(gaps, 1, "one contiguous gap after the head");
-        assert_eq!(chunks[6].seq, 6, "the whole head survives");
+            .unwrap_err();
+        assert_eq!(error.kind(), ProtocolErrorKind::AlreadyExists);
+        read_to_end(&fixture.manager, "dup").await;
+        let runs = std::fs::read_to_string(fixture.root.join("runs.txt")).unwrap();
+        assert_eq!(runs, "run\n", "the command ran once");
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn empty_write_is_a_wait_until_the_entry_is_pruned() {
-        let (_temp, _root, manager) = manager();
-        manager
-            .start_process(params("proc-wait", "echo bye; exit 7"))
+    async fn unread_exited_processes_expire_into_tombstones() {
+        let fixture = fixture_with(ProcessLimits {
+            unread_retention_ms: 50,
+            ..limits()
+        });
+        fixture
+            .manager
+            .start(&ctx(), shell("old", "true"))
             .await
             .expect("start");
         for _ in 0..200 {
-            if manager.running_count().await == 0 {
+            if fixture.manager.running_count().await == 0 {
                 break;
             }
             tokio::time::sleep(Duration::from_millis(10)).await;
         }
-        let write = manager
-            .write_process(WriteProcessParams {
-                process_id: ProcessId::new("proc-wait"),
-                chunk: None,
-                close_stdin: false,
-            })
+        tokio::time::sleep(process_group::OUTPUT_DRAIN_GRACE + Duration::from_millis(100)).await;
+        fixture.manager.running_count().await;
+        let error = fixture
+            .manager
+            .read(&ctx(), read_params("old", ReturnOn::Exit, 0))
             .await
-            .expect("empty write");
-        assert_eq!(write.status, WriteProcessStatus::Accepted);
-        let output = manager
-            .read_process(read_params("proc-wait", Some(1_000)))
+            .unwrap_err();
+        assert_eq!(not_found_reason(&error), Some(NotFoundReason::Expired));
+        let error = fixture
+            .manager
+            .start(&ctx(), shell("old", "true"))
             .await
-            .expect("read");
-        assert!(output.exited);
-        assert_eq!(output.exit_code, Some(7));
-        assert_eq!(all_bytes(&output), b"bye\n");
-
-        tokio::time::sleep(TERMINAL_PROCESS_RETENTION * 3).await;
-        let write = manager
-            .write_process(WriteProcessParams {
-                process_id: ProcessId::new("proc-wait"),
-                chunk: None,
-                close_stdin: false,
-            })
-            .await
-            .expect("late write");
-        assert_eq!(write.status, WriteProcessStatus::UnknownProcess);
-    }
-
-    #[cfg(unix)]
-    async fn wait_for_pid_file(path: &std::path::Path) -> i32 {
-        let deadline = std::time::Instant::now() + std::time::Duration::from_secs(5);
-        loop {
-            if let Ok(content) = std::fs::read_to_string(path)
-                && let Ok(pid) = content.trim().parse()
-            {
-                return pid;
-            }
-            assert!(
-                std::time::Instant::now() < deadline,
-                "pid file was not written"
-            );
-            tokio::time::sleep(Duration::from_millis(20)).await;
-        }
-    }
-
-    #[cfg(unix)]
-    fn process_alive(pid: i32) -> bool {
-        rustix::process::Pid::from_raw(pid)
-            .is_some_and(|pid| rustix::process::test_kill_process(pid).is_ok())
-    }
-
-    #[cfg(unix)]
-    async fn wait_for_process_gone(pid: i32) {
-        let deadline = std::time::Instant::now() + std::time::Duration::from_secs(5);
-        loop {
-            if !process_alive(pid) {
-                return;
-            }
-            assert!(
-                std::time::Instant::now() < deadline,
-                "descendant {pid} was not terminated"
-            );
-            tokio::time::sleep(Duration::from_millis(20)).await;
-        }
+            .unwrap_err();
+        assert_eq!(
+            error.kind(),
+            ProtocolErrorKind::AlreadyExists,
+            "a tombstoned id is not reused"
+        );
     }
 
-    #[cfg(unix)]
     #[tokio::test(flavor = "current_thread")]
-    async fn kill_terminates_descendants_in_group() {
-        let (_temp, root, manager) = manager();
-        manager
-            .start_process(params(
-                "proc-group",
-                "sleep 30 & echo $! > orphan.pid; sleep 30",
-            ))
+    async fn unknown_handles_are_not_found_on_every_method() {
+        let fixture = fixture();
+        let read = fixture
+            .manager
+            .read(&ctx(), read_params("nope", ReturnOn::Exit, 0))
             .await
-            .expect("start");
-
-        let pid = wait_for_pid_file(&root.join("orphan.pid")).await;
-        let terminated = manager
-            .terminate_process(TerminateProcessParams {
-                process_id: ProcessId::new("proc-group"),
-                signal: ProcessSignal::Kill,
-            })
-            .await
-            .expect("terminate");
-        assert!(terminated.running);
-        wait_for_process_gone(pid).await;
-        let output = manager
-            .read_process(read_params("proc-group", Some(1_000)))
+            .unwrap_err();
+        assert_eq!(not_found_reason(&read), None);
+        let write = fixture
+            .manager
+            .write(
+                &ctx(),
+                WriteProcessParams {
+                    process_id: id("nope"),
+                    data: ByteChunk::default(),
+                    close_input: true,
+                },
+            )
             .await
-            .expect("read");
-        assert!(output.exited);
-        assert_eq!(output.termination, Some(ProcessTermination::Killed));
-    }
-
-    #[cfg(unix)]
-    #[tokio::test(flavor = "current_thread")]
-    async fn timeout_terminates_descendants_in_group() {
-        let (_temp, root, manager) = manager();
-        let mut params = params("proc-timeout", "sleep 30 & echo $! > orphan.pid; sleep 30");
-        params.timeout_ms = Some(200);
-        manager.start_process(params).await.expect("start");
-
-        let pid = wait_for_pid_file(&root.join("orphan.pid")).await;
-        let output = manager
-            .read_process(read_params("proc-timeout", None))
+            .unwrap_err();
+        assert_eq!(write.kind(), ProtocolErrorKind::NotFound);
+        let terminate = fixture
+            .manager
+            .terminate(
+                &ctx(),
+                TerminateProcessParams {
+                    process_id: id("nope"),
+                    signal: ProcessSignal::Kill,
+                },
+            )
             .await
-            .expect("read");
-        assert!(output.exited);
-        assert_eq!(output.termination, Some(ProcessTermination::TimedOut));
-        wait_for_process_gone(pid).await;
+            .unwrap_err();
+        assert_eq!(terminate.kind(), ProtocolErrorKind::NotFound);
     }
 
     #[cfg(unix)]
     #[tokio::test(flavor = "current_thread")]
-    async fn interrupt_reaches_the_group_and_the_next_read_observes_the_trap() {
-        let (_temp, _root, manager) = manager();
-        manager
-            .start_process(params(
-                "proc-int",
-                "trap 'echo caught; exit 3' INT; sleep 100 & wait $!",
-            ))
+    async fn signal_deaths_are_named_on_pipes_and_ptys() {
+        let fixture = fixture();
+        fixture
+            .manager
+            .start(&ctx(), shell("segv", "kill -SEGV $$"))
             .await
             .expect("start");
-        tokio::time::sleep(Duration::from_millis(200)).await;
-        let signalled = manager
-            .terminate_process(TerminateProcessParams {
-                process_id: ProcessId::new("proc-int"),
-                signal: ProcessSignal::Interrupt,
-            })
-            .await
-            .expect("interrupt");
-        assert!(signalled.running);
-        let output = manager
-            .read_process(read_params("proc-int", Some(5_000)))
-            .await
-            .expect("read");
-        assert!(output.exited);
-        assert_eq!(output.exit_code, Some(3));
-        assert_eq!(output.termination, None);
-        assert_eq!(all_bytes(&output), b"caught\n");
+        let mut pty = shell("pty-term", "kill -TERM $$");
+        pty.pty = Some(PtySize { rows: 24, cols: 80 });
+        fixture.manager.start(&ctx(), pty).await.expect("start PTY");
+        let (_, segv) = read_to_end(&fixture.manager, "segv").await;
+        assert!(matches!(
+            segv.exit,
+            Some(ExitStatus::Signal { ref signal, .. }) if signal == &SignalName::new("SIGSEGV").unwrap()
+        ));
+        let (_, term) = read_to_end(&fixture.manager, "pty-term").await;
+        assert_eq!(
+            term.exit,
+            Some(ExitStatus::Signal {
+                signal: SignalName::new("SIGTERM").unwrap(),
+                core_dumped: false,
+            }),
+            "a PTY signal death is not exit code 1"
+        );
     }
 
     #[cfg(unix)]
     #[tokio::test(flavor = "current_thread")]
-    async fn process_exit_keeps_leftover_descendants_and_reports_them() {
-        let (_temp, root, manager) = manager();
-        manager
-            .start_process(params(
-                "proc-leftover",
-                "nohup sleep 30 >/dev/null 2>&1 & echo $! > orphan.pid; exit 0",
-            ))
+    async fn terminate_escalates_to_kill_after_the_grace() {
+        let fixture = fixture();
+        fixture
+            .manager
+            .start(&ctx(), shell("stubborn", "trap '' TERM; sleep 30"))
             .await
             .expect("start");
-
-        let pid = wait_for_pid_file(&root.join("orphan.pid")).await;
-        // Let the background child finish exec'ing so the sample names it.
         tokio::time::sleep(Duration::from_millis(100)).await;
-        let started = std::time::Instant::now();
-        let output = manager
-            .read_process(read_params("proc-leftover", None))
+        let terminated = fixture
+            .manager
+            .terminate(
+                &ctx(),
+                TerminateProcessParams {
+                    process_id: id("stubborn"),
+                    signal: ProcessSignal::Terminate,
+                },
+            )
             .await
-            .expect("read");
-        assert!(started.elapsed() < Duration::from_secs(5));
-        assert!(output.exited);
-        assert_eq!(output.exit_code, Some(0));
-        assert!(process_alive(pid), "the leftover survives the call");
+            .expect("terminate");
+        assert!(terminated.running);
+        let (_, response) = read_to_end(&fixture.manager, "stubborn").await;
+        assert_eq!(response.stopped_by, Some(StoppedBy::Terminate));
         assert_eq!(
-            output
-                .leftover_processes
-                .iter()
-                .map(|member| member.pid)
-                .collect::<Vec<_>>(),
-            vec![pid as u32],
-            "{:?}",
-            output.leftover_processes
-        );
-        assert!(
-            output.leftover_processes[0].command.contains("sleep"),
-            "{:?}",
-            output.leftover_processes
-        );
-        assert_eq!(manager.leftover_group_count(), 1);
-
-        tokio::time::sleep(TERMINAL_PROCESS_RETENTION * 3).await;
-        assert!(
-            process_alive(pid),
-            "the leftover survives the entry's pruning"
+            response.exit,
+            Some(ExitStatus::Signal {
+                signal: SignalName::new("SIGKILL").unwrap(),
+                core_dumped: false,
+            })
         );
-        let stale = manager
-            .read_process(read_params("proc-leftover", Some(0)))
-            .await;
-        assert!(stale.is_err(), "the entry was pruned");
+    }
 
-        let _ = rustix::process::kill_process(
-            rustix::process::Pid::from_raw(pid).expect("valid child pid"),
-            rustix::process::Signal::KILL,
-        );
-        wait_for_process_gone(pid).await;
-        assert_eq!(manager.leftover_group_count(), 0);
+    #[cfg(unix)]
+    #[tokio::test(flavor = "current_thread")]
+    async fn a_timeout_stops_the_group() {
+        let fixture = fixture();
+        let mut params = shell("slow", "sleep 30 & echo $! > orphan.pid; sleep 30");
+        params.command.timeout_ms = Some(200);
+        fixture.manager.start(&ctx(), params).await.expect("start");
+        let orphan = wait_for_pid_file(&fixture.root.join("orphan.pid")).await;
+        let (_, response) = read_to_end(&fixture.manager, "slow").await;
+        assert_eq!(response.stopped_by, Some(StoppedBy::Timeout));
+        for _ in 0..100 {
+            if !process_alive(orphan) {
+                break;
+            }
+            tokio::time::sleep(Duration::from_millis(20)).await;
+        }
+        assert!(!process_alive(orphan), "the group was stopped");
     }
 
     #[cfg(unix)]
     #[tokio::test(flavor = "current_thread")]
-    async fn leftover_writing_to_the_pipe_after_exit_is_neither_blocked_nor_killed() {
-        let (_temp, root, manager) = manager();
-        manager
-            .start_process(params(
-                "proc-chatty",
-                "(while true; do echo x; sleep 0.01; done) & echo $! > orphan.pid; exit 0",
-            ))
+    async fn natural_exit_keeps_and_reports_leftovers() {
+        let fixture = fixture();
+        fixture
+            .manager
+            .start(
+                &ctx(),
+                shell(
+                    "service",
+                    "nohup sleep 30 >/dev/null 2>&1 & echo $! > orphan.pid; exit 0",
+                ),
+            )
             .await
             .expect("start");
-        let entry = manager
-            .entry(&ProcessId::new("proc-chatty"))
-            .await
-            .expect("entry exists while running");
-        let output = manager
-            .read_process(read_params("proc-chatty", None))
-            .await
-            .expect("read");
-        assert!(output.exited);
-        let pid = wait_for_pid_file(&root.join("orphan.pid")).await;
-
-        // Past the drain grace the readers discard; nothing accumulates and
-        // the writer keeps running. The entry handle outlives the pruning
-        // that the read started.
-        tokio::time::sleep(process_group::OUTPUT_DRAIN_GRACE * 2).await;
-        let (discarding, retained) = {
-            let state = entry.state.lock().await;
-            (state.discarding, state.output.unread_bytes())
-        };
-        assert!(discarding);
+        let orphan = wait_for_pid_file(&fixture.root.join("orphan.pid")).await;
         tokio::time::sleep(Duration::from_millis(100)).await;
-        assert_eq!(
-            entry.state.lock().await.output.unread_bytes(),
-            retained,
-            "stored output does not grow after the drain grace"
-        );
-        assert!(process_alive(pid), "the writer was not killed by EPIPE");
-
-        let _ = rustix::process::kill_process(
-            rustix::process::Pid::from_raw(pid).expect("valid child pid"),
-            rustix::process::Signal::KILL,
-        );
-        wait_for_process_gone(pid).await;
+        let (_, response) = read_to_end(&fixture.manager, "service").await;
+        let leftovers = response.leftovers.expect("leftovers reported");
+        assert_eq!(leftovers.disposition, LeftoverDisposition::Kept);
+        assert_eq!(leftovers.processes[0].pid, orphan as u32);
+        assert!(process_alive(orphan), "never swept on natural exit");
+        assert_eq!(fixture.manager.leftover_group_count(), 1);
+        assert_eq!(fixture.manager.running_count().await, 0);
+        kill(orphan);
     }
 
-    #[cfg(unix)]
+    #[cfg(any(target_os = "linux", target_os = "macos"))]
     #[tokio::test(flavor = "current_thread")]
-    async fn kill_after_exit_stops_the_leftover_group() {
-        let (_temp, root, manager) = manager();
-        manager
-            .start_process(params(
-                "proc-service",
-                "nohup sleep 30 >/dev/null 2>&1 & echo $! > orphan.pid; exit 0",
-            ))
+    async fn a_restarted_daemon_adopts_surviving_groups() {
+        let fixture = fixture();
+        fixture
+            .manager
+            .start(
+                &ctx(),
+                shell(
+                    "survivor",
+                    "nohup sleep 30 >/dev/null 2>&1 & echo $! > orphan.pid; exit 0",
+                ),
+            )
             .await
             .expect("start");
-        let pid = wait_for_pid_file(&root.join("orphan.pid")).await;
-        assert!(process_alive(pid));
-        for _ in 0..200 {
-            if manager.running_count().await == 0 {
-                break;
-            }
-            tokio::time::sleep(Duration::from_millis(10)).await;
-        }
-        assert_eq!(manager.leftover_group_count(), 1);
-
-        let terminated = manager
-            .terminate_process(TerminateProcessParams {
-                process_id: ProcessId::new("proc-service"),
-                signal: ProcessSignal::Kill,
-            })
+        let orphan = wait_for_pid_file(&fixture.root.join("orphan.pid")).await;
+        fixture
+            .manager
+            .start(&ctx(), shell("gone", "true"))
             .await
-            .expect("kill");
-        assert!(!terminated.running, "the root had already exited");
-        wait_for_process_gone(pid).await;
-        assert_eq!(manager.leftover_group_count(), 0);
-        let output = manager
-            .read_process(read_params("proc-service", Some(0)))
+            .expect("start");
+        read_to_end(&fixture.manager, "survivor").await;
+        read_to_end(&fixture.manager, "gone").await;
+
+        let restarted = manager_at(&fixture.root, &fixture.state_dir, limits(), "envd_second");
+        let error = restarted
+            .read(&ctx(), read_params("survivor", ReturnOn::Exit, 0))
             .await
-            .expect("first read after the kill");
-        assert!(output.exited);
-        assert!(
-            output.leftover_processes.is_empty(),
-            "a dead group is no longer reported"
+            .unwrap_err();
+        assert_eq!(
+            not_found_reason(&error),
+            Some(NotFoundReason::DaemonRestarted)
+        );
+        assert_eq!(
+            restarted.leftover_group_count(),
+            1,
+            "the surviving group is adopted"
         );
+        assert!(process_alive(orphan), "adopted, never killed");
+        kill(orphan);
+        for _ in 0..100 {
+            if restarted.leftover_group_count() == 0 {
+                break;
+            }
+            tokio::time::sleep(Duration::from_millis(20)).await;
+        }
+        assert_eq!(restarted.leftover_group_count(), 0);
+        let records = std::fs::read_dir(fixture.state_dir.join("processes"))
+            .unwrap()
+            .count();
+        assert_eq!(records, 0, "records of dead groups are deleted");
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn process_injects_secret_env_and_redacts_output() {
-        let (_temp, _root, manager) = manager();
-        let mut params = params("proc-secret", "printf \"$SECRET_TOKEN\"");
-        params.secret_env = BTreeMap::from([(
-            "SECRET_TOKEN".to_owned(),
-            SecretString::new("super-secret-token"),
-        )]);
-        manager.start_process(params).await.expect("start");
-
-        let output = manager
-            .read_process(read_params("proc-secret", None))
-            .await
-            .expect("read");
+    async fn secrets_are_redacted_and_ptys_need_the_capability() {
+        let fixture = fixture();
+        let mut params = shell("secret", "printf \"$TOKEN\"");
+        params.command.secret_env =
+            BTreeMap::from([("TOKEN".to_owned(), SecretString::new("hunter2"))]);
+        fixture.manager.start(&ctx(), params).await.expect("start");
+        let (bytes, _) = read_to_end(&fixture.manager, "secret").await;
+        assert_eq!(bytes, b"<redacted>");
+
+        let temp = tempfile::tempdir().unwrap();
+        let root = temp.path().canonicalize().unwrap();
+        let confinement = Confinement::new(root.clone(), root.join("state")).unwrap();
+        let without_pty = ProcessManager::new(ProcessConfig {
+            cwd: root.clone(),
+            confinement: Arc::new(confinement),
+            state_dir: root.join("state"),
+            scrubbed_env: Vec::new(),
+            instance_id: DaemonInstanceId::new("envd_nopty").unwrap(),
+            limits: limits(),
+            max_wait_ms: 1_000,
+            pty_supported: false,
+        })
+        .unwrap();
+        let mut pty = shell("pty", "true");
+        pty.pty = Some(PtySize { rows: 24, cols: 80 });
+        let error = without_pty.start(&ctx(), pty).await.unwrap_err();
+        assert_eq!(error.kind(), ProtocolErrorKind::CapabilityUnavailable);
+        let mut wait = read_params("pty", ReturnOn::Exit, 1_001);
+        wait.max_bytes = 0;
+        let error = without_pty.read(&ctx(), wait).await.unwrap_err();
         assert_eq!(
-            stream_bytes(&output, ProcessOutputStream::Stdout),
-            b"<redacted>"
+            error.kind(),
+            ProtocolErrorKind::InvalidParams,
+            "waitMs above the ceiling"
         );
     }
 }
diff --git a/crates/environment-daemon/src/process_group.rs b/crates/environment-daemon/src/process_group.rs
index 787d5e4c2..610366673 100644
--- a/crates/environment-daemon/src/process_group.rs
+++ b/crates/environment-daemon/src/process_group.rs
@@ -1,11 +1,11 @@
 //! Unix process-group lifecycle shared by job and process execution.
 //!
-//! Job and process commands start in their own process group so that
-//! descendants a script leaves behind can be signalled as a unit. Jobs sweep
-//! the group when the root exits; processes sweep it only on timeout, kill,
-//! or cancellation, and otherwise let leftovers live with the environment. A
-//! descendant can still escape the group (`setsid`), so callers must never
-//! make completion depend on the group being fully swept.
+//! Every command starts as the leader of its own process group, so the
+//! descendants a script leaves behind can be signalled as a unit. Jobs
+//! sweep the group when the root exits; processes signal it only on
+//! timeout or an explicit terminate or kill, and otherwise let leftovers
+//! live with the environment. A descendant can still escape the group
+//! (`setsid`), so completion never depends on the group being empty.
 
 use std::time::Duration;
 
@@ -14,27 +14,35 @@ use tokio::process::Command;
 #[cfg(unix)]
 use rustix::process::{Pid, Signal, kill_process_group, test_kill_process_group};
 
-/// How long a terminated group gets between SIGTERM and SIGKILL.
-#[cfg(not(test))]
-pub(crate) const GROUP_TERM_GRACE: Duration = Duration::from_secs(1);
-#[cfg(test)]
-pub(crate) const GROUP_TERM_GRACE: Duration = Duration::from_millis(50);
-
-/// How long remaining pipe output is drained after the root process exits
-/// before the job or process completes without it.
+/// How long remaining output is drained after the root process exits
+/// before the execution settles without it.
 #[cfg(not(test))]
 pub(crate) const OUTPUT_DRAIN_GRACE: Duration = Duration::from_secs(2);
 #[cfg(test)]
 pub(crate) const OUTPUT_DRAIN_GRACE: Duration = Duration::from_millis(200);
 
+/// How often a terminating group is checked for members during its grace.
+const GRACE_POLL_INTERVAL: Duration = Duration::from_millis(20);
+
+/// A signal the daemon sends to a whole process group.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum GroupSignal {
+    Interrupt,
+    Terminate,
+    Kill,
+}
+
 /// Places the spawned command in its own process group (the child becomes
 /// the group leader).
 pub(crate) fn spawn_in_own_group(command: &mut Command) {
     #[cfg(unix)]
     command.process_group(0);
+    #[cfg(not(unix))]
+    let _ = command;
 }
 
-/// True when at least one process is left in the group.
+/// True when at least one process is left in the group. Says nothing about
+/// whose group it is; see [`Group::alive`].
 pub(crate) fn group_alive(pgid: u32) -> bool {
     #[cfg(unix)]
     return group_pid(pgid).is_some_and(|pid| test_kill_process_group(pid).is_ok());
@@ -45,60 +53,302 @@ pub(crate) fn group_alive(pgid: u32) -> bool {
     }
 }
 
-/// Immediately kills every process left in the group.
-pub(crate) fn kill_group(pgid: u32) -> bool {
+/// Sends `signal` to every process in the group. Returns true when the
+/// group had at least one member to signal.
+pub(crate) fn signal_group(pgid: u32, signal: GroupSignal) -> bool {
     #[cfg(unix)]
-    return signal_group(pgid, Signal::KILL);
+    {
+        let signal = match signal {
+            GroupSignal::Interrupt => Signal::INT,
+            GroupSignal::Terminate => Signal::TERM,
+            GroupSignal::Kill => Signal::KILL,
+        };
+        group_pid(pgid).is_some_and(|pid| kill_process_group(pid, signal).is_ok())
+    }
     #[cfg(not(unix))]
     {
-        let _ = pgid;
+        let _ = (pgid, signal);
         false
     }
 }
 
-/// Terminates every process left in the group: SIGTERM, a bounded grace
-/// period, then SIGKILL. Returns true when any process had to be signalled.
-pub(crate) async fn sweep_group(pgid: u32) -> bool {
-    #[cfg(unix)]
-    {
-        if !signal_group(pgid, Signal::TERM) {
+/// One spawned process group, named by its id and its leader's start time.
+///
+/// A group id stays reserved while the group has members, so a live group
+/// whose leader is gone is still this group. Once the group empties, the id
+/// may name a later, unrelated group whose leader got the same pid: a live
+/// process with the group's pid and another start time means the group is
+/// gone.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) struct Group {
+    pub pgid: u32,
+    pub leader_start_time: Option<u64>,
+}
+
+impl Group {
+    /// The group led by `pgid`, a live process (a just spawned root).
+    pub fn capture(pgid: u32) -> Self {
+        Self {
+            pgid,
+            leader_start_time: process_start_time(pgid),
+        }
+    }
+
+    /// The group still has members, and they are this group's.
+    pub fn alive(&self) -> bool {
+        if !group_alive(self.pgid) {
             return false;
         }
-        tokio::time::sleep(GROUP_TERM_GRACE).await;
-        signal_group(pgid, Signal::KILL);
+        match process_start_time(self.pgid) {
+            None => true,
+            Some(started) => self.leader_start_time == Some(started),
+        }
+    }
+
+    /// Sends `signal` to the group while it is alive. Returns true when it
+    /// had a member to signal.
+    pub fn signal(&self, signal: GroupSignal) -> bool {
+        self.alive() && signal_group(self.pgid, signal)
+    }
+
+    /// Terminates every process left in the group: `SIGTERM`, up to
+    /// `grace` for the members to exit, then `SIGKILL` to whatever remains.
+    /// Returns true when the group had members to signal.
+    pub async fn terminate(self, grace: Duration) -> bool {
+        if !self.signal(GroupSignal::Terminate) {
+            return false;
+        }
+        self.kill_after_grace(grace).await;
         true
     }
-    #[cfg(not(unix))]
-    {
-        let _ = pgid;
-        false
+
+    /// Waits up to `grace` for the group to empty, then kills what is left.
+    pub async fn kill_after_grace(self, grace: Duration) {
+        let deadline = tokio::time::Instant::now() + grace;
+        while self.alive() {
+            if tokio::time::Instant::now() >= deadline {
+                self.signal(GroupSignal::Kill);
+                return;
+            }
+            tokio::time::sleep(GRACE_POLL_INTERVAL.min(grace)).await;
+        }
     }
 }
 
 #[cfg(unix)]
 fn group_pid(pgid: u32) -> Option<Pid> {
-    // Group IDs 0 and 1 have special kill semantics rather than naming a child group.
+    // Group ids 0 and 1 have special kill semantics rather than naming a
+    // child group.
     let pgid = i32::try_from(pgid).ok().filter(|pid| *pid > 1)?;
     Pid::from_raw(pgid)
 }
 
-#[cfg(unix)]
-fn signal_group(pgid: u32, signal: Signal) -> bool {
-    group_pid(pgid).is_some_and(|pid| kill_process_group(pid, signal).is_ok())
+/// Sends `SIGINT` to one process group by id, such as a terminal's
+/// foreground group. Returns true when it had a member to signal.
+pub(crate) fn interrupt_foreground(pgid: u32) -> bool {
+    signal_group(pgid, GroupSignal::Interrupt)
 }
 
-/// Sends `SIGINT` to every process left in the group. Returns true when the
-/// group had at least one member to signal.
-pub(crate) fn interrupt_group(pgid: u32) -> bool {
-    #[cfg(unix)]
-    return signal_group(pgid, Signal::INT);
-    #[cfg(not(unix))]
+/// This boot of the machine, so spawn records of an earlier boot are never
+/// mistaken for live groups: Linux's boot id, macOS's boot time.
+pub(crate) fn boot_id() -> Option<String> {
+    #[cfg(target_os = "linux")]
     {
-        let _ = pgid;
-        false
+        std::fs::read_to_string("/proc/sys/kernel/random/boot_id")
+            .ok()
+            .map(|id| id.trim().to_owned())
+            .filter(|id| !id.is_empty())
+    }
+    #[cfg(target_os = "macos")]
+    {
+        let mut boot = libc::timeval {
+            tv_sec: 0,
+            tv_usec: 0,
+        };
+        let mut size = std::mem::size_of::<libc::timeval>();
+        // SAFETY: the name is NUL-terminated and the buffer is a timeval of
+        // the size passed.
+        let status = unsafe {
+            libc::sysctlbyname(
+                c"kern.boottime".as_ptr(),
+                (&mut boot as *mut libc::timeval).cast(),
+                &mut size,
+                std::ptr::null_mut(),
+                0,
+            )
+        };
+        (status == 0 && boot.tv_sec > 0)
+            .then(|| format!("boottime:{}.{:06}", boot.tv_sec, boot.tv_usec))
+    }
+    #[cfg(not(any(target_os = "linux", target_os = "macos")))]
+    {
+        None
+    }
+}
+
+/// When process `pid` started, in a platform unit that only needs to be
+/// stable for one boot: clock ticks since boot on Linux, microseconds since
+/// the epoch on macOS. Tells a group leader apart from a later process that
+/// reused its pid.
+pub(crate) fn process_start_time(pid: u32) -> Option<u64> {
+    #[cfg(target_os = "linux")]
+    {
+        let stat = std::fs::read_to_string(format!("/proc/{pid}/stat")).ok()?;
+        // "pid (comm) state ppid ..."; comm may contain spaces and
+        // parentheses, so split after the last closing parenthesis. The
+        // start time is field 22, the 20th after comm.
+        let close = stat.rfind(')')?;
+        stat[close + 1..]
+            .split_whitespace()
+            .nth(19)
+            .and_then(|value| value.parse().ok())
+    }
+    #[cfg(target_os = "macos")]
+    {
+        let info = bsd_info(pid)?;
+        Some(info.pbi_start_tvsec * 1_000_000 + info.pbi_start_tvusec)
+    }
+    #[cfg(not(any(target_os = "linux", target_os = "macos")))]
+    {
+        let _ = pid;
+        None
     }
 }
 
+/// Live, non-zombie members of a process group with their command lines,
+/// lowest pid first. Best effort: `/proc` on Linux, libproc on macOS,
+/// nothing elsewhere.
+#[cfg(target_os = "linux")]
+pub(crate) fn group_members(pgid: u32) -> Vec<(u32, Option<String>)> {
+    let Ok(entries) = std::fs::read_dir("/proc") else {
+        return Vec::new();
+    };
+    let mut members = Vec::new();
+    for entry in entries.flatten() {
+        let Some(pid) = entry
+            .file_name()
+            .to_str()
+            .and_then(|name| name.parse::<u32>().ok())
+        else {
+            continue;
+        };
+        let Ok(stat) = std::fs::read_to_string(entry.path().join("stat")) else {
+            continue;
+        };
+        let (Some(open), Some(close)) = (stat.find('('), stat.rfind(')')) else {
+            continue;
+        };
+        let mut fields = stat[close + 1..].split_whitespace();
+        let state = fields.next();
+        let _ppid = fields.next();
+        let pgrp = fields.next().and_then(|value| value.parse::<u32>().ok());
+        if pgrp != Some(pgid) || state == Some("Z") {
+            continue;
+        }
+        let command = std::fs::read(entry.path().join("cmdline"))
+            .ok()
+            .map(|bytes| {
+                bytes
+                    .split(|byte| *byte == 0)
+                    .filter(|part| !part.is_empty())
+                    .map(|part| String::from_utf8_lossy(part).into_owned())
+                    .collect::<Vec<_>>()
+                    .join(" ")
+            })
+            .filter(|command| !command.is_empty())
+            .or_else(|| {
+                let comm = stat.get(open + 1..close).unwrap_or_default();
+                (!comm.is_empty()).then(|| comm.to_owned())
+            });
+        members.push((pid, command));
+    }
+    members.sort_by_key(|(pid, _)| *pid);
+    members
+}
+
+#[cfg(target_os = "macos")]
+pub(crate) fn group_members(pgid: u32) -> Vec<(u32, Option<String>)> {
+    use std::{ffi::c_void, mem};
+
+    let Ok(group) = libc::pid_t::try_from(pgid) else {
+        return Vec::new();
+    };
+    let pid_size = mem::size_of::<libc::pid_t>();
+    // libproc's group listing returns pid counts, not bytes: with a null
+    // buffer the count of every process on the system, which is an upper
+    // bound for the group, and with a buffer the count it filled.
+    // SAFETY: a null buffer of size 0 only queries the count.
+    let upper_bound = unsafe { libc::proc_listpgrppids(group, std::ptr::null_mut(), 0) };
+    if upper_bound <= 0 {
+        return Vec::new();
+    }
+    let mut pids = vec![0 as libc::pid_t; upper_bound as usize + 16];
+    // SAFETY: the buffer holds `pids.len()` pids and its byte size is passed.
+    let count = unsafe {
+        libc::proc_listpgrppids(
+            group,
+            pids.as_mut_ptr() as *mut c_void,
+            (pids.len() * pid_size) as libc::c_int,
+        )
+    };
+    if count <= 0 {
+        return Vec::new();
+    }
+    pids.truncate(count as usize);
+    let mut members = Vec::new();
+    for pid in pids {
+        let Ok(pid) = u32::try_from(pid) else {
+            continue;
+        };
+        if pid == 0 {
+            continue;
+        }
+        if bsd_info(pid).is_some_and(|info| info.pbi_status == libc::SZOMB) {
+            continue;
+        }
+        let mut path = vec![0u8; 4096];
+        // SAFETY: the buffer is 4096 bytes and its length is passed.
+        let len = unsafe {
+            libc::proc_pidpath(
+                pid as libc::c_int,
+                path.as_mut_ptr() as *mut c_void,
+                path.len() as u32,
+            )
+        };
+        let command =
+            (len > 0).then(|| String::from_utf8_lossy(&path[..len as usize]).into_owned());
+        members.push((pid, command));
+    }
+    members.sort_by_key(|(pid, _)| *pid);
+    members
+}
+
+#[cfg(not(any(target_os = "linux", target_os = "macos")))]
+pub(crate) fn group_members(_pgid: u32) -> Vec<(u32, Option<String>)> {
+    Vec::new()
+}
+
+#[cfg(target_os = "macos")]
+fn bsd_info(pid: u32) -> Option<libc::proc_bsdinfo> {
+    use std::{ffi::c_void, mem};
+
+    let pid = libc::c_int::try_from(pid).ok()?;
+    // SAFETY: proc_bsdinfo is plain data; zeroed is a valid value.
+    let mut info: libc::proc_bsdinfo = unsafe { mem::zeroed() };
+    let size = mem::size_of::<libc::proc_bsdinfo>() as libc::c_int;
+    // SAFETY: the buffer is a proc_bsdinfo of the size passed.
+    let read = unsafe {
+        libc::proc_pidinfo(
+            pid,
+            libc::PROC_PIDTBSDINFO,
+            0,
+            &mut info as *mut libc::proc_bsdinfo as *mut c_void,
+            size,
+        )
+    };
+    (read == size).then_some(info)
+}
+
 #[cfg(all(test, unix))]
 mod tests {
     use super::*;
@@ -107,7 +357,38 @@ mod tests {
     fn process_groups_reject_special_and_out_of_range_ids() {
         for pgid in [0, 1, i32::MAX as u32 + 1, u32::MAX] {
             assert!(group_pid(pgid).is_none());
+            assert!(!signal_group(pgid, GroupSignal::Kill));
         }
         assert_eq!(group_pid(42), Pid::from_raw(42));
     }
+
+    #[cfg(any(target_os = "linux", target_os = "macos"))]
+    #[test]
+    fn this_process_has_a_start_time_and_the_machine_a_boot_id() {
+        assert!(process_start_time(std::process::id()).is_some());
+        assert!(boot_id().is_some());
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn terminate_escalates_to_kill_when_the_group_ignores_sigterm() {
+        let mut command = Command::new("/bin/sh");
+        command
+            .args(["-c", "trap '' TERM; sleep 30"])
+            .stdout(std::process::Stdio::null());
+        spawn_in_own_group(&mut command);
+        let mut child = command.spawn().expect("spawn");
+        let pgid = child.id().expect("pid");
+        // Give the shell time to install its trap.
+        tokio::time::sleep(Duration::from_millis(100)).await;
+        let started = std::time::Instant::now();
+        assert!(
+            Group::capture(pgid)
+                .terminate(Duration::from_millis(200))
+                .await
+        );
+        let status = child.wait().await.expect("wait");
+        assert!(started.elapsed() >= Duration::from_millis(150));
+        use std::os::unix::process::ExitStatusExt as _;
+        assert_eq!(status.signal(), Some(Signal::KILL.as_raw()));
+    }
 }
diff --git a/crates/environment-daemon/src/redaction.rs b/crates/environment-daemon/src/redaction.rs
index 47d6bde65..b921bd459 100644
--- a/crates/environment-daemon/src/redaction.rs
+++ b/crates/environment-daemon/src/redaction.rs
@@ -1,6 +1,6 @@
 //! Shared byte redaction for captured process and job output.
 
-use environment_protocol::shared::SecretString;
+use environment_protocol::bytes::SecretString;
 use std::collections::BTreeMap;
 
 pub(crate) fn redactions_for_secret_env(
diff --git a/crates/environment-daemon/src/registration.rs b/crates/environment-daemon/src/registration.rs
index 23b230f8c..5bbacbe69 100644
--- a/crates/environment-daemon/src/registration.rs
+++ b/crates/environment-daemon/src/registration.rs
@@ -1,316 +1,682 @@
 //! Outbound registration: dial the environment gateway, prove the daemon
-//! identity, and serve reverse-dialed data connections for as long as the
-//! control connection lives.
+//! identity, and serve reverse-dialed streams for as long as the control
+//! connection lives.
 //!
-//! The daemon never chooses an identity mode and never retries a terminal
-//! rejection: a closed environment, a refused key, or a bad signature ends
-//! the process with a non-zero exit so an orchestrator sees it.
+//! The control connection runs the shared JSON-RPC envelope with the daemon
+//! as the client (the frame rules and liveness rule are in
+//! `environment_protocol::registration`). The daemon reconnects with
+//! backoff after disconnects, heartbeat timeouts and retryable refusals,
+//! and ends the process on everything else, each with its own exit status
+//! ([`DaemonExit`]): a deliberate shutdown says goodbye first, a terminal
+//! refusal or an unsupported gateway protocol is `Refused`, and a
+//! `registration/closed` notification ends it as `EnvironmentClosed` or
+//! `Superseded`.
 
 use std::{
-    path::Path,
-    process::Command,
+    path::{Path, PathBuf},
     sync::Arc,
     time::{Duration, Instant},
 };
 
 use anyhow::{Context as _, Result, anyhow, bail};
 use environment_protocol::{
+    ENVD_PROTOCOL_VERSION,
+    bytes::SecretString,
+    error::{ErrorData, PreconditionReason, ProtocolError},
+    jsonrpc::{self, Id, Message as RpcMessage, Notification, Request, Response, ResponseError},
+    limits::HEARTBEAT_MISSED_INTERVALS,
+    manifest::{
+        RegistrationClosed, RegistrationGoodbye, RegistrationOpenStream, RegistrationRegister,
+    },
     registration::{
-        DaemonControlMessage, GatewayControlMessage, RegisterParams, RegistrationReceipt,
-        RegistrationRejectionCode, decode_hex,
+        ChallengeParams, ClosedParams, ClosedReason, GoodbyeParams, GoodbyeReason,
+        OpenStreamParams, OpenStreamResponse, RegisterParams, RegisterResponse,
+        RegistrationReceipt, StreamSpec, challenge_protocol_version,
     },
-    shared::{CURRENT_PROTOCOL_VERSION, SecretString},
 };
-use futures_util::{SinkExt as _, StreamExt as _};
+use futures_util::{SinkExt as _, StreamExt as _, stream::SplitSink, stream::SplitStream};
+use tokio::sync::mpsc;
 use tokio_tungstenite::{
     Connector, MaybeTlsStream, WebSocketStream, connect_async_tls_with_config,
     tungstenite::{
         Message,
         client::IntoClientRequest as _,
-        http::{HeaderValue, header::AUTHORIZATION},
+        http::{HeaderValue, header::AUTHORIZATION, header::USER_AGENT},
     },
 };
 
 use crate::{
     DaemonRuntime,
-    config::{REEXEC_REGISTRATION_KEY_ENV, RegistrationConfig},
+    config::{
+        AUTO_UPGRADE_ATTEMPTED_ENV, GatewayUrls, REEXEC_REGISTRATION_KEY_ENV, RegistrationConfig,
+        RestartInvocation,
+    },
     identity::DaemonIdentity,
-    server::{run_data_connection, tracing_line},
+    server::{DaemonExit, run_data_connection, tracing_line, websocket_config},
 };
 
-const AUTO_UPGRADE_ATTEMPTED_ENV: &str = "LIGHTSPEED_ENVD_AUTO_UPGRADE_ATTEMPTED";
-
-/// How long the daemon waits for the gateway's challenge and verdict.
+/// Bound on TCP connect, TLS and the WebSocket upgrade of the control
+/// connection.
+const DIAL_TIMEOUT: Duration = Duration::from_secs(20);
+/// How long the daemon waits for the gateway's first frame, and then for
+/// the register response.
 const HANDSHAKE_TIMEOUT: Duration = Duration::from_secs(20);
+/// Bound on dialing one reverse stream, upgrade included.
+const STREAM_DIAL_TIMEOUT: Duration = Duration::from_secs(10);
+/// How long a shutting-down daemon spends on goodbye and the close frame.
+const GOODBYE_TIMEOUT: Duration = Duration::from_secs(2);
+/// Shortest heartbeat interval the liveness deadline is derived from.
+const MIN_HEARTBEAT_INTERVAL: Duration = Duration::from_secs(1);
 const INITIAL_BACKOFF: Duration = Duration::from_secs(1);
 const MAX_BACKOFF: Duration = Duration::from_secs(60);
 /// A control session that lasted this long resets the reconnect backoff.
 const STABLE_SESSION: Duration = Duration::from_secs(30);
+/// The id of the daemon's only request on a control connection.
+const REGISTER_ID: i64 = 1;
+
+type ControlSocket = WebSocketStream<MaybeTlsStream<tokio::net::TcpStream>>;
+type ControlWriter = SplitSink<ControlSocket, Message>;
+type ControlReader = SplitStream<ControlSocket>;
 
 /// Why one control session ended.
+#[derive(Debug)]
 enum SessionEnd {
-    /// The gateway or network went away; reconnect with backoff.
+    /// The gateway or network went away, the liveness deadline passed, or
+    /// the gateway broke the frame rules; reconnect with backoff.
     Disconnected(String),
-    /// The gateway refused the daemon for a transient reason.
-    Retryable(RegistrationRejectionCode, String),
+    /// The gateway refused admission for a transient reason; reconnect no
+    /// sooner than its hint.
+    Retry {
+        reason: String,
+        retry_after: Option<Duration>,
+    },
+    /// The gateway speaks this other protocol version.
+    ProtocolMismatch(u32),
+    /// The gateway's first frame is unreadable: an incompatible gateway
+    /// whose protocol only its discovery document can tell.
+    IncompatibleGateway(String),
+    /// End the process.
+    Exit(DaemonExit),
 }
 
-/// Registration failure the daemon must not retry.
-#[derive(Debug, thiserror::Error)]
-#[error("registration rejected ({code:?}): {message}")]
-pub struct TerminalRejection {
-    pub code: RegistrationRejectionCode,
-    pub message: String,
+/// Register with the configured gateway and serve it until the process
+/// must end.
+pub async fn run_outbound(runtime: DaemonRuntime, registration: RegistrationConfig) -> DaemonExit {
+    let outbound = match Outbound::new(runtime, registration) {
+        Ok(outbound) => outbound,
+        Err(error) => return DaemonExit::Configuration(error),
+    };
+    outbound.run().await
 }
 
-pub async fn run_outbound(runtime: DaemonRuntime, registration: RegistrationConfig) -> Result<()> {
-    let identity = DaemonIdentity::load_or_create(&runtime.config().state_dir)
-        .context("load daemon identity")?;
-    tracing_line(&format!(
-        "registering with {} as daemon public key {}",
-        registration.gateway_url,
-        identity.public_key_hex()
-    ));
-    let tls = TlsSettings::from_config(registration.ca_file.as_deref())?;
-    let mut backoff = INITIAL_BACKOFF;
-    loop {
-        let started = Instant::now();
-        match control_session(&runtime, &registration, &identity, &tls).await {
-            Ok(SessionEnd::Disconnected(reason)) => {
-                tracing_line(&format!("control connection ended: {reason}"));
+struct Outbound {
+    runtime: DaemonRuntime,
+    registration: RegistrationConfig,
+    urls: GatewayUrls,
+    identity: DaemonIdentity,
+    tls: TlsSettings,
+    /// Held only until the first admission.
+    registration_key: Option<SecretString>,
+}
+
+impl Outbound {
+    fn new(runtime: DaemonRuntime, registration: RegistrationConfig) -> Result<Self> {
+        let urls = registration.validate()?;
+        if let Some(path) = &registration.receipt_path {
+            check_receipt_path(path)?;
+        }
+        let identity = DaemonIdentity::load_or_create(&runtime.config().state_dir)
+            .context("load daemon identity")?;
+        let tls = TlsSettings::from_config(registration.ca_file.as_deref())?;
+        let registration_key = registration.registration_key.clone();
+        Ok(Self {
+            runtime,
+            registration,
+            urls,
+            identity,
+            tls,
+            registration_key,
+        })
+    }
+
+    async fn run(mut self) -> DaemonExit {
+        tracing_line(&format!(
+            "registering with {} as daemon public key {}",
+            self.urls.connect,
+            self.identity.public_key()
+        ));
+        let shutdown = self.runtime.shutdown().clone();
+        let mut backoff = INITIAL_BACKOFF;
+        loop {
+            let started = Instant::now();
+            let mut retry_after = None;
+            match self.session().await {
+                SessionEnd::Exit(exit) => return exit,
+                SessionEnd::Disconnected(reason) => {
+                    tracing_line(&format!("control connection ended: {reason}"));
+                }
+                SessionEnd::Retry {
+                    reason,
+                    retry_after: hint,
+                } => {
+                    tracing_line(&format!("registration deferred: {reason}"));
+                    retry_after = hint;
+                }
+                SessionEnd::ProtocolMismatch(gateway_protocol) => {
+                    match self.upgrade(Some(gateway_protocol), None).await {
+                        SessionEnd::Exit(exit) => return exit,
+                        SessionEnd::Retry { reason, .. } | SessionEnd::Disconnected(reason) => {
+                            tracing_line(&reason);
+                        }
+                        SessionEnd::ProtocolMismatch(_) | SessionEnd::IncompatibleGateway(_) => {}
+                    }
+                }
+                SessionEnd::IncompatibleGateway(reason) => {
+                    match self.upgrade(None, Some(reason)).await {
+                        SessionEnd::Exit(exit) => return exit,
+                        SessionEnd::Retry { reason, .. } | SessionEnd::Disconnected(reason) => {
+                            tracing_line(&reason);
+                        }
+                        SessionEnd::ProtocolMismatch(_) | SessionEnd::IncompatibleGateway(_) => {}
+                    }
+                }
             }
-            Ok(SessionEnd::Retryable(code, message)) => {
-                tracing_line(&format!("registration deferred ({code:?}): {message}"));
+            if started.elapsed() >= STABLE_SESSION {
+                backoff = INITIAL_BACKOFF;
             }
-            Err(error) => {
-                if let Some(rejection) = error.downcast_ref::<TerminalRejection>() {
-                    tracing_line(&format!("{rejection}; not retrying"));
-                    return Err(error);
-                }
-                tracing_line(&format!("control connection failed: {error:#}"));
+            let delay = jittered(backoff).max(retry_after.unwrap_or_default());
+            tokio::select! {
+                _ = shutdown.cancelled() => return DaemonExit::Shutdown,
+                _ = tokio::time::sleep(delay) => {}
             }
+            backoff = (backoff * 2).min(MAX_BACKOFF);
         }
-        if started.elapsed() >= STABLE_SESSION {
-            backoff = INITIAL_BACKOFF;
-        }
-        tokio::time::sleep(jittered(backoff)).await;
-        backoff = (backoff * 2).min(MAX_BACKOFF);
     }
-}
 
-async fn control_session(
-    runtime: &DaemonRuntime,
-    registration: &RegistrationConfig,
-    identity: &DaemonIdentity,
-    tls: &TlsSettings,
-) -> Result<SessionEnd> {
-    let request = registration
-        .gateway_url
-        .as_str()
-        .into_client_request()
-        .context("gateway URL")?;
-    let (socket, _) = connect_async_tls_with_config(request, None, false, Some(tls.connector()))
-        .await
-        .map_err(|error| describe_connect_error(&registration.gateway_url, error))?;
-    let (mut writer, mut reader) = socket.split();
-
-    let challenge = tokio::time::timeout(HANDSHAKE_TIMEOUT, next_control_message(&mut reader))
-        .await
-        .context("waiting for gateway challenge")??;
-    let nonce = match challenge {
-        Some(GatewayControlMessage::Challenge {
-            protocol_version,
-            nonce,
-        }) => {
-            if protocol_version != CURRENT_PROTOCOL_VERSION {
-                return Err(protocol_mismatch_error(registration, protocol_version).await);
+    /// One control connection, from dial to its end.
+    async fn session(&mut self) -> SessionEnd {
+        let shutdown = self.runtime.shutdown().clone();
+        let dialed = tokio::select! {
+            _ = shutdown.cancelled() => return SessionEnd::Exit(DaemonExit::Shutdown),
+            dialed = tokio::time::timeout(
+                DIAL_TIMEOUT,
+                dial(&self.urls.connect, None, &self.tls),
+            ) => dialed,
+        };
+        let socket = match dialed {
+            Ok(Ok(socket)) => socket,
+            Ok(Err(error)) => return SessionEnd::Disconnected(format!("{error:#}")),
+            Err(_) => {
+                return SessionEnd::Disconnected(format!(
+                    "connecting to {} timed out after {} s",
+                    self.urls.connect,
+                    DIAL_TIMEOUT.as_secs()
+                ));
             }
-            decode_hex(&nonce).ok_or_else(|| anyhow!("gateway challenge nonce is not hex"))?
+        };
+        let (mut writer, mut reader) = socket.split();
+        let end = self.admitted_session(&mut writer, &mut reader).await;
+        if !matches!(end, SessionEnd::Exit(DaemonExit::Shutdown)) {
+            let _ = tokio::time::timeout(GOODBYE_TIMEOUT, writer.close()).await;
         }
-        Some(GatewayControlMessage::Rejected { code, message }) => {
-            return rejection(code, message);
+        end
+    }
+
+    async fn admitted_session(
+        &mut self,
+        writer: &mut ControlWriter,
+        reader: &mut ControlReader,
+    ) -> SessionEnd {
+        let shutdown = self.runtime.shutdown().clone();
+
+        // 1. The frozen first frame: its version is read before anything
+        //    else, so a gateway of any version can tell this daemon it is
+        //    stale.
+        let first = tokio::select! {
+            _ = shutdown.cancelled() => return SessionEnd::Exit(DaemonExit::Shutdown),
+            first = tokio::time::timeout(HANDSHAKE_TIMEOUT, next_text(reader)) => first,
+        };
+        let first = match first {
+            Ok(Ok(text)) => text,
+            Ok(Err(end)) => return end,
+            Err(_) => return SessionEnd::Disconnected("no challenge from the gateway".to_owned()),
+        };
+        let gateway_protocol = match challenge_protocol_version(&first) {
+            Ok(version) => version,
+            Err(error) => {
+                return SessionEnd::IncompatibleGateway(format!(
+                    "{} sent an unreadable first frame ({error})",
+                    self.urls.connect
+                ));
+            }
+        };
+        if gateway_protocol != ENVD_PROTOCOL_VERSION {
+            return SessionEnd::ProtocolMismatch(gateway_protocol);
         }
-        Some(other) => bail!("unexpected gateway message before challenge: {other:?}"),
-        None => {
-            return Ok(SessionEnd::Disconnected(
-                "closed before challenge".to_owned(),
-            ));
+        let challenge = match decode_challenge(&first) {
+            Ok(challenge) => challenge,
+            Err(error) => return SessionEnd::Disconnected(format!("{error:#}")),
+        };
+
+        // 2. Register, signing the nonce bound to the dialed origin.
+        let params = RegisterParams {
+            protocol_version: ENVD_PROTOCOL_VERSION,
+            registration_key: self.registration_key.clone(),
+            daemon_public_key: self.identity.public_key(),
+            signature: self
+                .identity
+                .sign_challenge(&challenge.nonce, &self.urls.origin),
+            display_name: self.registration.display_name.clone(),
+            metadata: self.registration.metadata.clone(),
+            implementation: self.runtime.server_info().clone(),
+        };
+        let request =
+            match Request::new(Id::Number(REGISTER_ID), RegistrationRegister::NAME, &params) {
+                Ok(request) => request,
+                Err(error) => {
+                    return SessionEnd::Exit(DaemonExit::Failed(anyhow!(
+                        "encode register: {error}"
+                    )));
+                }
+            };
+        if let Err(error) = writer.send(Message::Text(request.to_text().into())).await {
+            return SessionEnd::Disconnected(format!("send register: {error}"));
         }
-    };
+        let response = tokio::select! {
+            _ = shutdown.cancelled() => return SessionEnd::Exit(DaemonExit::Shutdown),
+            response = tokio::time::timeout(HANDSHAKE_TIMEOUT, register_response(reader)) => response,
+        };
+        let response = match response {
+            Ok(Ok(response)) => response,
+            Ok(Err(end)) => return end,
+            Err(_) => {
+                return SessionEnd::Disconnected(
+                    "no register response from the gateway".to_owned(),
+                );
+            }
+        };
+        let admitted = match response.decode::<RegisterResponse>() {
+            Ok(admitted) => admitted,
+            Err(ResponseError::Failed(error)) => return refusal(error),
+            Err(ResponseError::Undecodable(message)) => {
+                return SessionEnd::Disconnected(format!(
+                    "the register response breaks the contract: {message}"
+                ));
+            }
+        };
 
-    let register = DaemonControlMessage::Register(RegisterParams {
-        protocol_version: CURRENT_PROTOCOL_VERSION,
-        registration_key: registration.registration_key.clone(),
-        daemon_public_key: identity.public_key_hex(),
-        signature: identity.sign_challenge(&nonce),
-        display_name: registration.display_name.clone(),
-        metadata: registration.metadata.clone(),
-        implementation: runtime.implementation(),
-    });
-    writer
-        .send(Message::Text(serde_json::to_string(&register)?.into()))
-        .await
-        .context("send register")?;
-
-    let verdict = tokio::time::timeout(HANDSHAKE_TIMEOUT, next_control_message(&mut reader))
-        .await
-        .context("waiting for gateway verdict")??;
-    let (receipt, heartbeat_interval_ms) = match verdict {
-        Some(GatewayControlMessage::Accepted {
-            receipt,
-            heartbeat_interval_ms,
-        }) => (receipt, heartbeat_interval_ms),
-        Some(GatewayControlMessage::Rejected { code, message }) => {
-            return rejection(code, message);
+        // 3. Admitted: the key has done its job.
+        self.registration_key = None;
+        if let Err(error) =
+            announce_receipt(&admitted.receipt, self.registration.receipt_path.as_deref())
+        {
+            return SessionEnd::Exit(DaemonExit::Configuration(error));
         }
-        Some(other) => bail!("unexpected gateway message after register: {other:?}"),
-        None => return Ok(SessionEnd::Disconnected("closed before verdict".to_owned())),
-    };
-    announce_receipt(&receipt, registration.receipt_path.as_deref())?;
-    let _ = heartbeat_interval_ms;
+        let interval =
+            Duration::from_millis(admitted.heartbeat_interval_ms).max(MIN_HEARTBEAT_INTERVAL);
+        let liveness = interval * HEARTBEAT_MISSED_INTERVALS;
+        self.serve_admitted(writer, reader, liveness).await
+    }
 
-    loop {
-        let message = match reader.next().await {
-            Some(Ok(message)) => message,
-            Some(Err(error)) => return Ok(SessionEnd::Disconnected(error.to_string())),
-            None => return Ok(SessionEnd::Disconnected("gateway closed".to_owned())),
-        };
-        match message {
-            Message::Text(text) => match serde_json::from_str::<GatewayControlMessage>(&text) {
-                Ok(GatewayControlMessage::OpenData { token, data_url }) => {
-                    let runtime = runtime.clone();
-                    let tls = tls.clone();
-                    tokio::spawn(async move {
-                        if let Err(error) =
-                            serve_data_connection(runtime, &data_url, token, &tls).await
-                        {
-                            tracing_line(&format!("data connection failed: {error:#}"));
-                        }
-                    });
+    /// The admitted control connection: answer `registration/openStream`,
+    /// obey `registration/closed`, and treat `liveness` without any frame
+    /// as a dead connection.
+    async fn serve_admitted(
+        &self,
+        writer: &mut ControlWriter,
+        reader: &mut ControlReader,
+        liveness: Duration,
+    ) -> SessionEnd {
+        let shutdown = self.runtime.shutdown().clone();
+        let (answers, mut queued) = mpsc::channel::<String>(64);
+        let mut deadline = tokio::time::Instant::now() + liveness;
+        loop {
+            tokio::select! {
+                _ = shutdown.cancelled() => {
+                    say_goodbye(writer).await;
+                    return SessionEnd::Exit(DaemonExit::Shutdown);
                 }
-                Ok(GatewayControlMessage::Rejected { code, message }) => {
-                    return rejection(code, message);
+                Some(text) = queued.recv() => {
+                    if let Err(error) = writer.send(Message::Text(text.into())).await {
+                        return SessionEnd::Disconnected(format!("send to the gateway: {error}"));
+                    }
                 }
-                Ok(other) => tracing_line(&format!("ignoring gateway message {other:?}")),
-                Err(error) => tracing_line(&format!("ignoring undecodable gateway frame: {error}")),
-            },
-            Message::Ping(bytes) => {
-                if writer.send(Message::Pong(bytes)).await.is_err() {
-                    return Ok(SessionEnd::Disconnected("pong failed".to_owned()));
+                incoming = tokio::time::timeout_at(deadline, reader.next()) => {
+                    let Ok(incoming) = incoming else {
+                        return SessionEnd::Disconnected(format!(
+                            "no frame from the gateway for {} ms (heartbeat timeout)",
+                            liveness.as_millis()
+                        ));
+                    };
+                    deadline = tokio::time::Instant::now() + liveness;
+                    let message = match incoming {
+                        Some(Ok(message)) => message,
+                        Some(Err(error)) => return SessionEnd::Disconnected(error.to_string()),
+                        None => return SessionEnd::Disconnected("gateway closed".to_owned()),
+                    };
+                    match message {
+                        Message::Text(text) => {
+                            if let Some(end) = self.on_admitted_text(text.as_str(), &answers) {
+                                return end;
+                            }
+                        }
+                        Message::Binary(_) => {
+                            return SessionEnd::Disconnected(
+                                "the gateway sent a binary frame".to_owned(),
+                            );
+                        }
+                        Message::Close(frame) => {
+                            return SessionEnd::Disconnected(
+                                frame
+                                    .map(|frame| frame.reason.to_string())
+                                    .filter(|reason| !reason.is_empty())
+                                    .unwrap_or_else(|| "gateway closed".to_owned()),
+                            );
+                        }
+                        Message::Ping(_) | Message::Pong(_) | Message::Frame(_) => {}
+                    }
                 }
             }
-            Message::Close(frame) => {
-                let _ = writer.flush().await;
-                return Ok(SessionEnd::Disconnected(
-                    frame
-                        .map(|frame| frame.reason.to_string())
-                        .unwrap_or_else(|| "gateway closed".to_owned()),
+        }
+    }
+
+    /// Handle one text frame after admission; `Some` ends the session.
+    fn on_admitted_text(&self, text: &str, answers: &mpsc::Sender<String>) -> Option<SessionEnd> {
+        match jsonrpc::parse(text) {
+            Err(rejection) => Some(SessionEnd::Disconnected(format!(
+                "the gateway sent an invalid frame: {}",
+                rejection.error
+            ))),
+            Ok(RpcMessage::Request(request)) => {
+                if request.method == RegistrationOpenStream::NAME {
+                    match request.params::<OpenStreamParams>() {
+                        Ok(params) => self.open_stream(request.id, params, answers.clone()),
+                        Err(error) => answer(answers, Response::failure(Some(request.id), error)),
+                    }
+                } else {
+                    answer(
+                        answers,
+                        Response::failure(
+                            Some(request.id),
+                            ProtocolError::method_not_found(&request.method),
+                        ),
+                    );
+                }
+                None
+            }
+            Ok(RpcMessage::Notification(notification)) => self.on_notification(notification),
+            Ok(RpcMessage::Response(response)) => {
+                tracing_line(&format!(
+                    "ignoring a gateway response to id {}",
+                    response
+                        .id
+                        .map_or_else(|| "null".to_owned(), |id| id.to_string())
                 ));
+                None
             }
-            Message::Binary(_) | Message::Pong(_) | Message::Frame(_) => {}
         }
     }
-}
 
-async fn protocol_mismatch_error(
-    registration: &RegistrationConfig,
-    gateway_protocol: u32,
-) -> anyhow::Error {
-    let base = format!(
-        "gateway speaks protocol {gateway_protocol}; this daemon speaks {CURRENT_PROTOCOL_VERSION}; discovery document: {}",
-        registration.discovery_url
-    );
-    let Some(restart) = &registration.auto_upgrade else {
-        return TerminalRejection {
-            code: RegistrationRejectionCode::UnsupportedProtocol,
-            message: format!(
-                "{base}; run `lightspeed-envd upgrade` or set LIGHTSPEED_ENVD_AUTO_UPGRADE=1"
-            ),
+    fn on_notification(&self, notification: Notification) -> Option<SessionEnd> {
+        if notification.method != RegistrationClosed::NAME {
+            tracing_line(&format!(
+                "ignoring gateway notification {}",
+                notification.method
+            ));
+            return None;
         }
-        .into();
-    };
-    if std::env::var_os(AUTO_UPGRADE_ATTEMPTED_ENV).is_some() {
-        return TerminalRejection {
-            code: RegistrationRejectionCode::UnsupportedProtocol,
-            message: format!(
-                "{base}; automatic upgrade was already attempted by this process lineage"
+        let params = match notification.params::<ClosedParams>() {
+            Ok(params) => params,
+            Err(error) => {
+                tracing_line(&format!(
+                    "ignoring undecodable registration/closed: {error}"
+                ));
+                return None;
+            }
+        };
+        if let Some(message) = &params.message {
+            tracing_line(&format!("gateway closed the session: {}", message.as_str()));
+        }
+        Some(SessionEnd::Exit(match params.reason {
+            ClosedReason::Superseded => DaemonExit::Superseded {
+                daemon_public_key: self.identity.public_key().to_hex(),
+            },
+            ClosedReason::EnvironmentClosed => DaemonExit::EnvironmentClosed,
+        }))
+    }
+
+    /// Dial the stream the gateway asked for on its own task and answer
+    /// once it is upgraded (or failed), then serve it.
+    fn open_stream(&self, id: Id, params: OpenStreamParams, answers: mpsc::Sender<String>) {
+        let OpenStreamParams { token, stream } = params;
+        let StreamSpec::DataProtocol {} = stream;
+        let runtime = self.runtime.clone();
+        let stream_url = self.urls.stream.clone();
+        let tls = self.tls.clone();
+        tokio::spawn(async move {
+            let dialed =
+                tokio::time::timeout(STREAM_DIAL_TIMEOUT, dial(&stream_url, Some(&token), &tls))
+                    .await;
+            let socket = match dialed {
+                Ok(Ok(socket)) => socket,
+                Ok(Err(error)) => {
+                    tracing_line(&format!("stream dial failed: {error:#}"));
+                    let error = ProtocolError::unavailable(format!("dial {stream_url}: {error:#}"));
+                    let _ = answers
+                        .send(Response::failure(Some(id), error).to_text())
+                        .await;
+                    return;
+                }
+                Err(_) => {
+                    let error = ProtocolError::unavailable(format!(
+                        "dialing {stream_url} timed out after {} s",
+                        STREAM_DIAL_TIMEOUT.as_secs()
+                    ));
+                    let _ = answers
+                        .send(Response::failure(Some(id), error).to_text())
+                        .await;
+                    return;
+                }
+            };
+            let _ = answers
+                .send(Response::success(id, &OpenStreamResponse {}).to_text())
+                .await;
+            drop(answers);
+            run_data_connection(&runtime, socket).await;
+        });
+    }
+
+    /// Install the gateway's build and re-execute it, or say why not.
+    /// Install the gateway's envd build and re-execute it: the build of
+    /// `gateway_protocol` when the challenge named one, otherwise (an
+    /// unreadable first frame, explained by `unreadable`) whatever protocol
+    /// discovery publishes, provided it is not this daemon's own. Each
+    /// lineage tries once per target protocol, and once after an
+    /// unreadable frame.
+    async fn upgrade(
+        &self,
+        gateway_protocol: Option<u32>,
+        unreadable: Option<String>,
+    ) -> SessionEnd {
+        let base = match (gateway_protocol, &unreadable) {
+            (Some(gateway_protocol), _) => mismatch_summary(&self.registration, gateway_protocol),
+            (None, reason) => format!(
+                "{}; it is not an environment gateway this daemon can register with; discovery document: {}",
+                reason.as_deref().unwrap_or("the gateway is incompatible"),
+                self.registration.discovery_url
             ),
+        };
+        if let Some(refusal) = upgrade_refusal(&self.registration, gateway_protocol) {
+            return SessionEnd::Exit(DaemonExit::Refused(format!("{base}; {refusal}")));
         }
-        .into();
+        let Some(restart) = &self.registration.auto_upgrade else {
+            return SessionEnd::Exit(DaemonExit::Refused(base));
+        };
+        tracing_line(&format!(
+            "{base}; automatic upgrade enabled, installing the gateway's envd build"
+        ));
+        let request = crate::upgrade::UpgradeRequest {
+            discovery_url: self.registration.discovery_url.clone(),
+            ca_file: self.registration.ca_file.clone(),
+            install_path: restart.executable.clone(),
+            target: release_info::TARGET.to_owned(),
+            expected_protocol: gateway_protocol,
+            other_than: gateway_protocol.is_none().then_some(ENVD_PROTOCOL_VERSION),
+        };
+        let installed = tokio::select! {
+            _ = self.runtime.shutdown().cancelled() => {
+                return SessionEnd::Exit(DaemonExit::Shutdown);
+            }
+            installed = crate::upgrade::install(request) => installed,
+        };
+        let installed = match installed {
+            Ok(installed) => installed,
+            Err(error) if error.is_transient() => {
+                return SessionEnd::Retry {
+                    reason: format!("{base}; automatic upgrade will retry: {error}"),
+                    retry_after: None,
+                };
+            }
+            Err(error) => {
+                return SessionEnd::Exit(DaemonExit::Refused(format!(
+                    "{base}; automatic upgrade failed: {error}"
+                )));
+            }
+        };
+        tracing_line(&format!(
+            "installed lightspeed-envd {} ({}, protocol {}); re-executing {}",
+            installed.version,
+            installed.git_sha,
+            installed.protocol_version,
+            restart.executable.display()
+        ));
+        let error = exec_replacement(
+            restart,
+            installed.protocol_version,
+            self.registration_key.as_ref(),
+        );
+        SessionEnd::Exit(DaemonExit::Refused(format!(
+            "{base}; installed the replacement but could not re-execute it: {error}"
+        )))
     }
+}
 
-    tracing_line(&format!(
-        "{base}; automatic upgrade enabled, installing the gateway's envd build"
-    ));
-    let request = crate::upgrade::UpgradeRequest {
-        discovery_url: registration.discovery_url.clone(),
-        ca_file: registration.ca_file.clone(),
-        install_path: restart.executable.clone(),
-        target: release_info::TARGET.to_owned(),
-        expected_protocol: Some(gateway_protocol),
-    };
-    let installed = match crate::upgrade::install(request).await {
-        Ok(installed) => installed,
-        Err(error) => {
-            return TerminalRejection {
-                code: RegistrationRejectionCode::UnsupportedProtocol,
-                message: format!("{base}; automatic upgrade failed: {error:#}"),
+/// The challenge params, decoded tolerantly: the frame is frozen and may
+/// carry members this daemon does not know.
+fn decode_challenge(frame: &str) -> Result<ChallengeParams> {
+    let value: serde_json::Value = serde_json::from_str(frame).context("decode challenge")?;
+    let params = value
+        .get("params")
+        .cloned()
+        .ok_or_else(|| anyhow!("challenge has no params"))?;
+    serde_json::from_value(params).context("decode challenge params")
+}
+
+/// Map a register error to what the daemon does next.
+fn refusal(error: ProtocolError) -> SessionEnd {
+    match &error.data {
+        ErrorData::VersionMismatch { expected, .. } => SessionEnd::ProtocolMismatch(*expected),
+        ErrorData::FailedPrecondition {
+            reason: PreconditionReason::EnvironmentClosed,
+        } => SessionEnd::Exit(DaemonExit::EnvironmentClosed),
+        ErrorData::Busy { retry_after_ms, .. } | ErrorData::Unavailable { retry_after_ms } => {
+            SessionEnd::Retry {
+                reason: error.to_string(),
+                retry_after: retry_after_ms.map(Duration::from_millis),
             }
-            .into();
         }
-    };
-    tracing_line(&format!(
-        "installed lightspeed-envd {} ({}, protocol {}); re-executing {}",
-        installed.version,
-        installed.git_sha,
-        installed.protocol_version,
-        restart.executable.display()
-    ));
-    let error = exec_replacement(
-        &restart.executable,
-        &restart.arg0,
-        &restart.args,
-        registration.registration_key.as_ref(),
-    );
-    TerminalRejection {
-        code: RegistrationRejectionCode::UnsupportedProtocol,
-        message: format!("{base}; installed the replacement but could not re-execute it: {error}"),
+        _ if error.is_retryable() => SessionEnd::Retry {
+            reason: error.to_string(),
+            retry_after: None,
+        },
+        _ => SessionEnd::Exit(DaemonExit::Refused(error.to_string())),
     }
-    .into()
+}
+
+fn mismatch_summary(registration: &RegistrationConfig, gateway_protocol: u32) -> String {
+    format!(
+        "gateway speaks protocol {gateway_protocol}; this daemon speaks {ENVD_PROTOCOL_VERSION}; discovery document: {}",
+        registration.discovery_url
+    )
+}
+
+/// Why no automatic upgrade runs for this gateway protocol (`None`: an
+/// unreadable first frame), if it does not.
+fn upgrade_refusal(
+    registration: &RegistrationConfig,
+    gateway_protocol: Option<u32>,
+) -> Option<String> {
+    if registration.auto_upgrade.is_none() {
+        return Some(
+            "run `lightspeed-envd upgrade` or set LIGHTSPEED_ENVD_AUTO_UPGRADE=1".to_owned(),
+        );
+    }
+    match (gateway_protocol, registration.upgrade_attempted_for) {
+        (Some(gateway_protocol), Some(attempted)) if attempted == gateway_protocol => {
+            Some(format!(
+                "an automatic upgrade to protocol {gateway_protocol} already ran in this process lineage and the result still does not match"
+            ))
+        }
+        (None, Some(attempted)) => Some(format!(
+            "an automatic upgrade (to protocol {attempted}) already ran in this process lineage and the gateway's first frame is still unreadable"
+        )),
+        _ => None,
+    }
+}
+
+/// Arguments of the restarted daemon: the original ones without any
+/// registration key option, which travels only through the one-exec
+/// variable and only while it is still needed.
+fn replacement_args(args: &[std::ffi::OsString]) -> Vec<std::ffi::OsString> {
+    let mut kept = Vec::with_capacity(args.len());
+    let mut skip_value = false;
+    for arg in args {
+        if std::mem::take(&mut skip_value) {
+            continue;
+        }
+        let text = arg.to_string_lossy();
+        if text == "--registration-key" || text == "--registration-key-file" {
+            skip_value = true;
+            continue;
+        }
+        if text.starts_with("--registration-key=") || text.starts_with("--registration-key-file=") {
+            continue;
+        }
+        kept.push(arg.clone());
+    }
+    kept
 }
 
 #[cfg(unix)]
 fn exec_replacement(
-    executable: &Path,
-    arg0: &std::ffi::OsStr,
-    args: &[std::ffi::OsString],
+    restart: &RestartInvocation,
+    gateway_protocol: u32,
     registration_key: Option<&SecretString>,
 ) -> std::io::Error {
     use std::os::unix::process::CommandExt as _;
 
-    let mut command = Command::new(executable);
+    let mut command = std::process::Command::new(&restart.executable);
     command
-        .arg0(arg0)
-        .args(args)
-        .env(AUTO_UPGRADE_ATTEMPTED_ENV, "1");
-    // Configuration parsing deliberately removes key variables from the
-    // current process. Hand the already-held value across exactly this exec
-    // so a first-seen daemon can still register even if its key file was
-    // removed; the replacement consumes and scrubs this internal variable.
+        .arg0(&restart.arg0)
+        .args(replacement_args(&restart.args))
+        .env(AUTO_UPGRADE_ATTEMPTED_ENV, gateway_protocol.to_string())
+        .env_remove("LIGHTSPEED_ENVD_REGISTRATION_KEY")
+        .env_remove("LIGHTSPEED_ENVD_REGISTRATION_KEY_FILE")
+        .env_remove(REEXEC_REGISTRATION_KEY_ENV);
+    // Configuration removed the key variables from this process. A daemon
+    // not yet admitted hands the held key across exactly this exec, so it
+    // can still register even if its key file was removed; an admitted one
+    // proves itself with its private key alone.
     if let Some(registration_key) = registration_key {
-        command
-            .env(REEXEC_REGISTRATION_KEY_ENV, registration_key.expose())
-            .env_remove("LIGHTSPEED_ENVD_REGISTRATION_KEY")
-            .env_remove("LIGHTSPEED_ENVD_REGISTRATION_KEY_FILE");
+        command.env(REEXEC_REGISTRATION_KEY_ENV, registration_key.expose());
     }
     command.exec()
 }
 
 #[cfg(not(unix))]
 fn exec_replacement(
-    _executable: &Path,
-    _arg0: &std::ffi::OsStr,
-    _args: &[std::ffi::OsString],
+    _restart: &RestartInvocation,
+    _gateway_protocol: u32,
     _registration_key: Option<&SecretString>,
 ) -> std::io::Error {
     std::io::Error::new(
@@ -319,59 +685,161 @@ fn exec_replacement(
     )
 }
 
+/// Send `registration/goodbye` and the close frame, within a short bound.
+async fn say_goodbye(writer: &mut ControlWriter) {
+    let goodbye = Notification::new(
+        RegistrationGoodbye::NAME,
+        &GoodbyeParams {
+            reason: GoodbyeReason::Shutdown,
+        },
+    )
+    .expect("goodbye params encode");
+    let _ = tokio::time::timeout(GOODBYE_TIMEOUT, async {
+        writer.send(Message::Text(goodbye.to_text().into())).await?;
+        writer.close().await
+    })
+    .await;
+}
+
+fn answer(answers: &mpsc::Sender<String>, response: Response) {
+    if answers.try_send(response.to_text()).is_err() {
+        tracing_line("dropping an answer to the gateway: the control writer is backed up");
+    }
+}
+
+/// The next text frame before admission. Control frames are skipped; a
+/// binary frame, a close or a transport error ends the session.
+async fn next_text(reader: &mut ControlReader) -> Result<String, SessionEnd> {
+    loop {
+        match reader.next().await {
+            Some(Ok(Message::Text(text))) => return Ok(text.as_str().to_owned()),
+            Some(Ok(Message::Binary(_))) => {
+                return Err(SessionEnd::Disconnected(
+                    "the gateway sent a binary frame".to_owned(),
+                ));
+            }
+            Some(Ok(Message::Close(_))) | None => {
+                return Err(SessionEnd::Disconnected(
+                    "gateway closed before admission".to_owned(),
+                ));
+            }
+            Some(Ok(_)) => continue,
+            Some(Err(error)) => return Err(SessionEnd::Disconnected(error.to_string())),
+        }
+    }
+}
+
+/// Wait for the register response. Until it arrives the gateway may send
+/// nothing else: any request or notification breaks the frame rules.
+async fn register_response(reader: &mut ControlReader) -> Result<Response, SessionEnd> {
+    loop {
+        let text = next_text(reader).await?;
+        match jsonrpc::parse(&text) {
+            Ok(RpcMessage::Response(response)) if response.id == Some(Id::Number(REGISTER_ID)) => {
+                return Ok(response);
+            }
+            Ok(RpcMessage::Response(response)) => tracing_line(&format!(
+                "ignoring a gateway response to id {}",
+                response
+                    .id
+                    .map_or_else(|| "null".to_owned(), |id| id.to_string())
+            )),
+            Ok(RpcMessage::Request(request)) => {
+                return Err(SessionEnd::Disconnected(format!(
+                    "the gateway sent {} before the register response",
+                    request.method
+                )));
+            }
+            Ok(RpcMessage::Notification(notification)) => {
+                return Err(SessionEnd::Disconnected(format!(
+                    "the gateway sent {} before the register response",
+                    notification.method
+                )));
+            }
+            Err(rejection) => {
+                return Err(SessionEnd::Disconnected(format!(
+                    "the gateway sent an invalid frame: {}",
+                    rejection.error
+                )));
+            }
+        }
+    }
+}
+
+/// Dial a gateway route with the protocol's message limits, optionally
+/// presenting a bearer token.
+async fn dial(
+    url: &str,
+    bearer: Option<&SecretString>,
+    tls: &TlsSettings,
+) -> Result<ControlSocket> {
+    let mut request = url.into_client_request().context("gateway URL")?;
+    request.headers_mut().insert(
+        USER_AGENT,
+        HeaderValue::from_static(concat!("lightspeed-envd/", env!("CARGO_PKG_VERSION"))),
+    );
+    if let Some(token) = bearer {
+        let mut value =
+            HeaderValue::from_str(&format!("Bearer {}", token.expose())).context("token header")?;
+        value.set_sensitive(true);
+        request.headers_mut().insert(AUTHORIZATION, value);
+    }
+    let (socket, _) = connect_async_tls_with_config(
+        request,
+        Some(websocket_config()),
+        false,
+        Some(tls.connector()),
+    )
+    .await
+    .map_err(|error| describe_connect_error(url, error))?;
+    Ok(socket)
+}
+
 /// A gateway that answers the WebSocket upgrade with an HTTP status is
 /// reachable but not serving registration; say so instead of leaking a raw
 /// handshake error. Still retried, because a deploy can produce the same
 /// answer for a moment.
 fn describe_connect_error(
-    gateway_url: &str,
+    url: &str,
     error: tokio_tungstenite::tungstenite::Error,
 ) -> anyhow::Error {
     if let tokio_tungstenite::tungstenite::Error::Http(response) = &error {
         let status = response.status();
         if status == 404 {
             return anyhow!(
-                "{gateway_url} does not serve environment registration (HTTP 404): point LIGHTSPEED_ENVD_GATEWAY_URL at a Lightspeed process running the environment-gateway role"
+                "{url} does not serve environment registration (HTTP 404): point LIGHTSPEED_ENVD_GATEWAY_URL at a Lightspeed process running the environment-gateway role"
             );
         }
-        return anyhow!(
-            "environment gateway {gateway_url} answered HTTP {status} instead of upgrading"
-        );
+        return anyhow!("environment gateway {url} answered HTTP {status} instead of upgrading");
     }
-    anyhow::Error::new(error).context(format!("connect to environment gateway {gateway_url}"))
+    anyhow::Error::new(error).context(format!("connect to environment gateway {url}"))
 }
 
-fn rejection(code: RegistrationRejectionCode, message: String) -> Result<SessionEnd> {
-    if code.is_terminal() {
-        Err(TerminalRejection { code, message }.into())
-    } else {
-        Ok(SessionEnd::Retryable(code, message))
-    }
+/// Refuse to start when the receipt cannot be written: a daemon admitted
+/// without its receipt would be unusable to whoever waits for it.
+fn check_receipt_path(path: &Path) -> Result<()> {
+    let parent = receipt_parent(path);
+    std::fs::create_dir_all(&parent)
+        .with_context(|| format!("create receipt dir {}", parent.display()))?;
+    let probe = parent.join(format!(
+        ".{}.probe.{}",
+        path.file_name()
+            .map_or_else(|| "receipt".into(), |name| name.to_string_lossy()),
+        std::process::id()
+    ));
+    std::fs::OpenOptions::new()
+        .write(true)
+        .create_new(true)
+        .open(&probe)
+        .with_context(|| format!("receipt dir {} is not writable", parent.display()))?;
+    let _ = std::fs::remove_file(&probe);
+    Ok(())
 }
 
-async fn next_control_message<S>(
-    reader: &mut futures_util::stream::SplitStream<WebSocketStream<S>>,
-) -> Result<Option<GatewayControlMessage>>
-where
-    S: tokio::io::AsyncRead + tokio::io::AsyncWrite + Unpin,
-{
-    loop {
-        match reader.next().await {
-            Some(Ok(Message::Text(text))) => {
-                return serde_json::from_str(&text)
-                    .map(Some)
-                    .context("decode gateway control message");
-            }
-            Some(Ok(Message::Binary(bytes))) => {
-                return serde_json::from_slice(&bytes)
-                    .map(Some)
-                    .context("decode gateway control message");
-            }
-            Some(Ok(Message::Close(_))) | None => return Ok(None),
-            Some(Ok(_)) => continue,
-            Some(Err(error)) => return Err(error.into()),
-        }
-    }
+fn receipt_parent(path: &Path) -> PathBuf {
+    path.parent()
+        .filter(|parent| !parent.as_os_str().is_empty())
+        .map_or_else(|| PathBuf::from("."), Path::to_path_buf)
 }
 
 /// Write the receipt atomically (when a path is configured) and log it once.
@@ -379,43 +847,21 @@ where
 fn announce_receipt(receipt: &RegistrationReceipt, path: Option<&Path>) -> Result<()> {
     let json = serde_json::to_string(receipt)?;
     if let Some(path) = path {
-        if let Some(parent) = path
-            .parent()
-            .filter(|parent| !parent.as_os_str().is_empty())
-        {
-            std::fs::create_dir_all(parent)
-                .with_context(|| format!("create receipt dir {}", parent.display()))?;
-        }
+        let parent = receipt_parent(path);
+        std::fs::create_dir_all(&parent)
+            .with_context(|| format!("create receipt dir {}", parent.display()))?;
         let temp = path.with_extension(format!("tmp.{}", std::process::id()));
         std::fs::write(&temp, format!("{json}\n"))
             .with_context(|| format!("write receipt {}", temp.display()))?;
-        std::fs::rename(&temp, path)
-            .with_context(|| format!("install receipt {}", path.display()))?;
+        if let Err(error) = std::fs::rename(&temp, path) {
+            let _ = std::fs::remove_file(&temp);
+            bail!("install receipt {}: {error}", path.display());
+        }
     }
     tracing_line(&format!("registered {json}"));
     Ok(())
 }
 
-/// Dial the gateway data route for one waiting worker and run the ordinary
-/// data protocol on it. The token is a one-time pairing credential issued
-/// over the authenticated control connection.
-async fn serve_data_connection(
-    runtime: DaemonRuntime,
-    data_url: &str,
-    token: SecretString,
-    tls: &TlsSettings,
-) -> Result<()> {
-    let mut request = data_url.into_client_request().context("data URL")?;
-    request.headers_mut().insert(
-        AUTHORIZATION,
-        HeaderValue::from_str(&format!("Bearer {}", token.expose())).context("token header")?,
-    );
-    let (socket, _) = connect_async_tls_with_config(request, None, false, Some(tls.connector()))
-        .await
-        .context("connect data route")?;
-    run_data_connection(&runtime, socket).await
-}
-
 /// TLS trust for the gateway: the bundled WebPKI roots, plus an operator
 /// supplied PEM bundle for gateways behind a private CA.
 ///
@@ -472,65 +918,584 @@ fn jittered(base: Duration) -> Duration {
     base.mul_f64(factor)
 }
 
-#[allow(dead_code)]
-type ControlSocket = WebSocketStream<MaybeTlsStream<tokio::net::TcpStream>>;
-
 #[cfg(test)]
 mod tests {
+    use std::sync::Mutex;
+
+    use environment_protocol::{
+        error::{BusyReason, PermissionReason},
+        registration::{ChallengeNonce, signed_registration_message},
+        routes::{CONNECT_PATH, DATA_PATH, canonical_origin},
+    };
+    use serde_json::{Value, json};
+    use tokio::net::{TcpListener, TcpStream};
+    use tokio_tungstenite::{
+        accept_hdr_async_with_config,
+        tungstenite::handshake::server::{Request as HttpRequest, Response as HttpResponse},
+    };
+
     use super::*;
+    use crate::test_support::runtime_with;
+
+    type GatewaySocket = WebSocketStream<TcpStream>;
+
+    /// A scripted gateway on a loopback port.
+    struct FakeGateway {
+        listener: TcpListener,
+        connect_url: String,
+    }
+
+    struct Accepted {
+        socket: GatewaySocket,
+        path: String,
+        authorization: Option<String>,
+    }
+
+    impl FakeGateway {
+        async fn start(prefix: &str) -> Self {
+            let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+            let connect_url = format!(
+                "ws://{}{prefix}{CONNECT_PATH}",
+                listener.local_addr().unwrap()
+            );
+            Self {
+                listener,
+                connect_url,
+            }
+        }
+
+        // The callback's error type is fixed by tungstenite's `Callback`.
+        #[allow(clippy::result_large_err)]
+        async fn accept(&self) -> Accepted {
+            let (stream, _) = tokio::time::timeout(Duration::from_secs(10), self.listener.accept())
+                .await
+                .expect("the daemon dials in time")
+                .unwrap();
+            let seen = Arc::new(Mutex::new((String::new(), None)));
+            let record = seen.clone();
+            let socket = accept_hdr_async_with_config(
+                stream,
+                move |request: &HttpRequest, response: HttpResponse| {
+                    let authorization = request
+                        .headers()
+                        .get(AUTHORIZATION)
+                        .map(|value| value.to_str().unwrap().to_owned());
+                    *record.lock().unwrap() = (request.uri().path().to_owned(), authorization);
+                    Ok(response)
+                },
+                Some(websocket_config()),
+            )
+            .await
+            .unwrap();
+            let (path, authorization) = seen.lock().unwrap().clone();
+            Accepted {
+                socket,
+                path,
+                authorization,
+            }
+        }
+    }
+
+    async fn send(socket: &mut GatewaySocket, frame: Value) {
+        socket
+            .send(Message::Text(frame.to_string().into()))
+            .await
+            .unwrap();
+    }
+
+    async fn recv(socket: &mut GatewaySocket) -> Value {
+        loop {
+            let frame = tokio::time::timeout(Duration::from_secs(10), socket.next())
+                .await
+                .expect("a frame in time")
+                .expect("open")
+                .expect("frame");
+            if let Message::Text(text) = frame {
+                return serde_json::from_str(text.as_str()).unwrap();
+            }
+        }
+    }
+
+    async fn challenge(socket: &mut GatewaySocket, nonce: [u8; 32]) {
+        send(
+            socket,
+            json!({
+                "jsonrpc": "2.0",
+                "method": "registration/challenge",
+                "params": {
+                    "protocolVersion": ENVD_PROTOCOL_VERSION,
+                    "nonce": ChallengeNonce::from_bytes(nonce).to_hex(),
+                    "addedLater": {"x": 1},
+                },
+            }),
+        )
+        .await;
+    }
+
+    fn receipt(admission: &str) -> Value {
+        json!({
+            "environmentId": "environment_a",
+            "incarnationId": "incarnation_a",
+            "daemonId": "daemon_a",
+            "controlConnectionId": "connection_a",
+            "identityMode": "ephemeral",
+            "admission": admission,
+        })
+    }
+
+    async fn admit(socket: &mut GatewaySocket, register: &Value, heartbeat_ms: u64) {
+        send(
+            socket,
+            json!({
+                "jsonrpc": "2.0",
+                "id": register["id"],
+                "result": {"receipt": receipt("created"), "heartbeatIntervalMs": heartbeat_ms},
+            }),
+        )
+        .await;
+    }
+
+    async fn refuse(socket: &mut GatewaySocket, register: &Value, error: ProtocolError) {
+        send(
+            socket,
+            Response::failure(
+                Some(serde_json::from_value(register["id"].clone()).unwrap()),
+                error,
+            )
+            .to_value(),
+        )
+        .await;
+    }
+
+    fn daemon(
+        gateway: &FakeGateway,
+        adjust: impl FnOnce(&mut RegistrationConfig),
+    ) -> (tempfile::TempDir, DaemonRuntime, RegistrationConfig) {
+        let mut registration = RegistrationConfig::new(
+            gateway.connect_url.clone(),
+            crate::upgrade::resolve_discovery_url(Some(&gateway.connect_url), None).unwrap(),
+        );
+        registration.registration_key = Some(SecretString::new("lsrk_test"));
+        adjust(&mut registration);
+        let config_registration = registration.clone();
+        let (temp, runtime) = runtime_with(move |config| {
+            config.registration = Some(config_registration);
+        });
+        (temp, runtime, registration)
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn registers_with_an_origin_bound_signature_and_drops_the_key_once_admitted() {
+        let gateway = FakeGateway::start("/ls").await;
+        let receipt_dir = tempfile::tempdir().unwrap();
+        let receipt_path = receipt_dir.path().join("out").join("registration.json");
+        let (_temp, runtime, registration) = daemon(&gateway, |registration| {
+            registration.receipt_path = Some(receipt_path.clone());
+        });
+        let task = tokio::spawn(run_outbound(runtime.clone(), registration));
+
+        let mut first = gateway.accept().await;
+        assert_eq!(first.path, format!("/ls{CONNECT_PATH}"));
+        let nonce = [5u8; 32];
+        challenge(&mut first.socket, nonce).await;
+        let register = recv(&mut first.socket).await;
+        assert_eq!(register["method"], "registration/register");
+        let params = RegisterParams::decode(&register["params"]).expect("valid register");
+        assert_eq!(params.protocol_version, ENVD_PROTOCOL_VERSION);
+        assert_eq!(
+            params.registration_key.as_ref().map(SecretString::expose),
+            Some("lsrk_test")
+        );
+        let origin = canonical_origin(&gateway.connect_url).unwrap();
+        let key =
+            ed25519_dalek::VerifyingKey::from_bytes(params.daemon_public_key.as_bytes()).unwrap();
+        let signature = ed25519_dalek::Signature::from_bytes(params.signature.as_bytes());
+        key.verify_strict(
+            &signed_registration_message(&ChallengeNonce::from_bytes(nonce), &origin),
+            &signature,
+        )
+        .expect("the signature binds the nonce and the dialed origin");
+        admit(&mut first.socket, &register, 30_000).await;
+
+        // The receipt is written once admitted.
+        for _ in 0..200 {
+            if receipt_path.exists() {
+                break;
+            }
+            tokio::time::sleep(Duration::from_millis(10)).await;
+        }
+        let written: RegistrationReceipt =
+            serde_json::from_str(&std::fs::read_to_string(&receipt_path).unwrap()).unwrap();
+        assert_eq!(written.daemon_id.as_str(), "daemon_a");
+
+        // A reconnect proves the identity by its key alone.
+        drop(first);
+        let mut second = gateway.accept().await;
+        challenge(&mut second.socket, [6u8; 32]).await;
+        let again = recv(&mut second.socket).await;
+        let again = RegisterParams::decode(&again["params"]).unwrap();
+        assert!(again.registration_key.is_none(), "the key is never resent");
+        assert_eq!(again.daemon_public_key, params.daemon_public_key);
+
+        task.abort();
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn open_stream_dials_the_derived_data_route_with_the_token() {
+        let gateway = FakeGateway::start("").await;
+        let (_temp, runtime, registration) = daemon(&gateway, |_| {});
+        let task = tokio::spawn(run_outbound(runtime.clone(), registration));
+        let mut control = gateway.accept().await;
+        challenge(&mut control.socket, [1u8; 32]).await;
+        let register = recv(&mut control.socket).await;
+        admit(&mut control.socket, &register, 30_000).await;
+
+        send(
+            &mut control.socket,
+            json!({
+                "jsonrpc": "2.0",
+                "id": "g1",
+                "method": "registration/openStream",
+                "params": {"token": "stream-token", "stream": {"kind": "dataProtocol"}},
+            }),
+        )
+        .await;
+        let mut stream = gateway.accept().await;
+        assert_eq!(stream.path, DATA_PATH);
+        assert_eq!(stream.authorization.as_deref(), Some("Bearer stream-token"));
+        let answer = recv(&mut control.socket).await;
+        assert_eq!(answer["id"], "g1");
+        assert_eq!(answer["result"], json!({}));
+
+        // The stream serves the data plane.
+        send(
+            &mut stream.socket,
+            json!({"jsonrpc": "2.0", "id": 1, "method": "initialize", "params": {
+                "protocolVersion": ENVD_PROTOCOL_VERSION, "clientInfo": {"name": "gateway-test"},
+            }}),
+        )
+        .await;
+        let initialized = recv(&mut stream.socket).await;
+        assert_eq!(initialized["result"]["plane"], "data");
+
+        // An unknown gateway request is answered, and the session stays.
+        send(
+            &mut control.socket,
+            json!({"jsonrpc": "2.0", "id": "g2", "method": "registration/somethingNew"}),
+        )
+        .await;
+        let unknown: ProtocolError =
+            serde_json::from_value(recv(&mut control.socket).await["error"].clone()).unwrap();
+        assert_eq!(
+            unknown.kind(),
+            environment_protocol::error::ProtocolErrorKind::MethodNotFound
+        );
+        task.abort();
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn a_silent_gateway_is_dropped_after_three_heartbeat_intervals() {
+        let gateway = FakeGateway::start("").await;
+        let (_temp, runtime, registration) = daemon(&gateway, |_| {});
+        let task = tokio::spawn(run_outbound(runtime.clone(), registration));
+        let mut first = gateway.accept().await;
+        challenge(&mut first.socket, [2u8; 32]).await;
+        let register = recv(&mut first.socket).await;
+        let admitted_at = Instant::now();
+        admit(&mut first.socket, &register, 1_000).await;
+        // Keep the socket open but silent: only the deadline can end it.
+        let _held = first;
+        let _second = gateway.accept().await;
+        let elapsed = admitted_at.elapsed();
+        assert!(
+            elapsed >= Duration::from_millis(2_900),
+            "reconnected after {elapsed:?}, before the deadline"
+        );
+        task.abort();
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn closed_notifications_end_the_process_with_distinct_statuses() {
+        for (reason, status) in [("superseded", 5), ("environmentClosed", 4)] {
+            let gateway = FakeGateway::start("").await;
+            let (_temp, runtime, registration) = daemon(&gateway, |_| {});
+            let task = tokio::spawn(run_outbound(runtime.clone(), registration));
+            let mut control = gateway.accept().await;
+            challenge(&mut control.socket, [3u8; 32]).await;
+            let register = recv(&mut control.socket).await;
+            admit(&mut control.socket, &register, 30_000).await;
+            send(
+                &mut control.socket,
+                json!({"jsonrpc": "2.0", "method": "registration/closed", "params": {
+                    "reason": reason, "message": "another process with this identity connected",
+                }}),
+            )
+            .await;
+            let exit = tokio::time::timeout(Duration::from_secs(10), task)
+                .await
+                .expect("the daemon ends")
+                .unwrap();
+            assert_eq!(exit.status(), status, "{reason}: {exit}");
+        }
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn register_errors_are_terminal_unless_retryable() {
+        let terminal = [
+            (
+                ProtocolError::permission_denied(
+                    Some(PermissionReason::InvalidRegistrationKey),
+                    "unknown key",
+                ),
+                3,
+            ),
+            (
+                ProtocolError::failed_precondition(PreconditionReason::EnvironmentClosed, "closed"),
+                4,
+            ),
+            (
+                ProtocolError::invalid_request("implementation.version is too long"),
+                3,
+            ),
+        ];
+        for (error, status) in terminal {
+            let gateway = FakeGateway::start("").await;
+            let (_temp, runtime, registration) = daemon(&gateway, |_| {});
+            let task = tokio::spawn(run_outbound(runtime.clone(), registration));
+            let mut control = gateway.accept().await;
+            challenge(&mut control.socket, [4u8; 32]).await;
+            let register = recv(&mut control.socket).await;
+            refuse(&mut control.socket, &register, error.clone()).await;
+            let exit = tokio::time::timeout(Duration::from_secs(10), task)
+                .await
+                .expect("the daemon ends")
+                .unwrap();
+            assert_eq!(exit.status(), status, "{error}");
+        }
+
+        let gateway = FakeGateway::start("").await;
+        let (_temp, runtime, registration) = daemon(&gateway, |_| {});
+        let task = tokio::spawn(run_outbound(runtime.clone(), registration));
+        let mut control = gateway.accept().await;
+        challenge(&mut control.socket, [4u8; 32]).await;
+        let register = recv(&mut control.socket).await;
+        refuse(
+            &mut control.socket,
+            &register,
+            ProtocolError::busy(Some(BusyReason::RateLimited), Some(1_500), "slow down"),
+        )
+        .await;
+        let refused_at = Instant::now();
+        let _again = gateway.accept().await;
+        assert!(
+            refused_at.elapsed() >= Duration::from_millis(1_400),
+            "the retry hint is honoured"
+        );
+        assert!(!task.is_finished());
+        task.abort();
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn a_gateway_request_before_admission_breaks_the_session() {
+        let gateway = FakeGateway::start("").await;
+        let (_temp, runtime, registration) = daemon(&gateway, |_| {});
+        let task = tokio::spawn(run_outbound(runtime.clone(), registration));
+        let mut control = gateway.accept().await;
+        challenge(&mut control.socket, [7u8; 32]).await;
+        let _register = recv(&mut control.socket).await;
+        send(
+            &mut control.socket,
+            json!({"jsonrpc": "2.0", "id": "early", "method": "registration/openStream", "params": {
+                "token": "t", "stream": {"kind": "dataProtocol"},
+            }}),
+        )
+        .await;
+        let mut ended = false;
+        while let Ok(Some(frame)) =
+            tokio::time::timeout(Duration::from_secs(5), control.socket.next()).await
+        {
+            match frame {
+                Ok(Message::Close(_)) | Err(_) => {
+                    ended = true;
+                    break;
+                }
+                Ok(Message::Text(text)) => panic!("the daemon answered: {text}"),
+                Ok(_) => {}
+            }
+        }
+        assert!(ended, "the daemon closed the connection");
+        let _reconnected = gateway.accept().await;
+        task.abort();
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn shutdown_says_goodbye_and_exits_cleanly() {
+        let gateway = FakeGateway::start("").await;
+        let (_temp, runtime, registration) = daemon(&gateway, |_| {});
+        let task = tokio::spawn(run_outbound(runtime.clone(), registration));
+        let mut control = gateway.accept().await;
+        challenge(&mut control.socket, [8u8; 32]).await;
+        let register = recv(&mut control.socket).await;
+        admit(&mut control.socket, &register, 30_000).await;
+        // Give the daemon a moment to enter its admitted loop.
+        tokio::time::sleep(Duration::from_millis(100)).await;
+        runtime.shutdown().cancel();
+        let goodbye = recv(&mut control.socket).await;
+        assert_eq!(goodbye["method"], "registration/goodbye");
+        assert_eq!(goodbye["params"], json!({"reason": "shutdown"}));
+        assert!(goodbye.get("id").is_none());
+        let exit = tokio::time::timeout(Duration::from_secs(10), task)
+            .await
+            .expect("the daemon ends")
+            .unwrap();
+        assert_eq!(exit.status(), 0);
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn a_gateway_of_another_version_without_auto_upgrade_is_terminal() {
+        let gateway = FakeGateway::start("").await;
+        let (_temp, runtime, registration) = daemon(&gateway, |_| {});
+        let discovery = registration.discovery_url.clone();
+        let task = tokio::spawn(run_outbound(runtime.clone(), registration));
+        let mut control = gateway.accept().await;
+        send(
+            &mut control.socket,
+            json!({"jsonrpc": "2.0", "method": "registration/challenge", "params": {
+                "protocolVersion": ENVD_PROTOCOL_VERSION + 1, "nonce": "not even hex",
+            }}),
+        )
+        .await;
+        let exit = tokio::time::timeout(Duration::from_secs(10), task)
+            .await
+            .expect("the daemon ends")
+            .unwrap();
+        assert_eq!(exit.status(), 3);
+        let DaemonExit::Refused(message) = exit else {
+            panic!("refused");
+        };
+        assert!(message.contains(&discovery));
+        assert!(message.contains("lightspeed-envd upgrade"));
+    }
+
+    #[test]
+    fn an_upgrade_runs_once_per_target_version() {
+        let mut registration = RegistrationConfig::new(
+            "wss://gateway.example/environment-gateway/connect".to_owned(),
+            "https://gateway.example/.well-known/lightspeed-envd".to_owned(),
+        );
+        assert!(
+            upgrade_refusal(&registration, Some(4)).is_some(),
+            "not opted in"
+        );
+        assert!(
+            upgrade_refusal(&registration, None).is_some(),
+            "not opted in"
+        );
+        registration.auto_upgrade = Some(RestartInvocation {
+            executable: PathBuf::from("/usr/local/bin/lightspeed-envd"),
+            arg0: "lightspeed-envd".into(),
+            args: Vec::new(),
+        });
+        assert!(upgrade_refusal(&registration, Some(4)).is_none());
+        assert!(
+            upgrade_refusal(&registration, None).is_none(),
+            "an unreadable first frame upgrades to whatever discovery publishes"
+        );
+        registration.upgrade_attempted_for = Some(4);
+        assert!(upgrade_refusal(&registration, Some(4)).is_some());
+        assert!(
+            upgrade_refusal(&registration, Some(5)).is_none(),
+            "a later bump upgrades again"
+        );
+        assert!(
+            upgrade_refusal(&registration, None).is_some(),
+            "a replacement that still cannot read the first frame stops"
+        );
+    }
+
+    #[test]
+    fn a_replacement_never_inherits_a_registration_key_argument() {
+        let args: Vec<std::ffi::OsString> = [
+            "--registration-key",
+            "lsrk_secret",
+            "--gateway-url",
+            "wss://g/environment-gateway/connect",
+            "--registration-key-file=/run/key",
+            "--registration-name",
+            "n",
+        ]
+        .into_iter()
+        .map(Into::into)
+        .collect();
+        let kept: Vec<String> = replacement_args(&args)
+            .into_iter()
+            .map(|arg| arg.into_string().unwrap())
+            .collect();
+        assert_eq!(
+            kept,
+            [
+                "--gateway-url",
+                "wss://g/environment-gateway/connect",
+                "--registration-name",
+                "n"
+            ]
+        );
+    }
+
+    #[test]
+    fn retryable_refusals_carry_their_hint() {
+        let SessionEnd::Retry { retry_after, .. } = refusal(ProtocolError::busy(
+            Some(BusyReason::RateLimited),
+            Some(250),
+            "x",
+        )) else {
+            panic!("retry");
+        };
+        assert_eq!(retry_after, Some(Duration::from_millis(250)));
+        assert!(matches!(
+            refusal(ProtocolError::unavailable("store down")),
+            SessionEnd::Retry { .. }
+        ));
+        assert!(matches!(
+            refusal(ProtocolError::version_mismatch(4, 3)),
+            SessionEnd::ProtocolMismatch(4)
+        ));
+        assert!(matches!(
+            refusal(ProtocolError::expired("key expired")),
+            SessionEnd::Exit(DaemonExit::Refused(_))
+        ));
+    }
 
     #[test]
     fn receipts_are_written_atomically_and_contain_only_ids() {
         let temp = tempfile::tempdir().expect("tempdir");
         let path = temp.path().join("out").join("registration.json");
-        let receipt = RegistrationReceipt {
-            environment_id: "environment_a".to_owned(),
-            incarnation_id: "incarnation_a".to_owned(),
-            daemon_id: "daemon_a".to_owned(),
-            connection_id: "connection_a".to_owned(),
-            identity_mode: "ephemeral".to_owned(),
-        };
+        check_receipt_path(&path).expect("writable");
+        let receipt: RegistrationReceipt = serde_json::from_value(receipt("reconnected")).unwrap();
         announce_receipt(&receipt, Some(&path)).expect("write");
         let written: RegistrationReceipt =
             serde_json::from_str(&std::fs::read_to_string(&path).expect("read")).expect("json");
         assert_eq!(written, receipt);
-        assert!(std::fs::read_dir(path.parent().unwrap()).unwrap().count() == 1);
+        assert_eq!(
+            std::fs::read_dir(path.parent().unwrap()).unwrap().count(),
+            1
+        );
     }
 
+    #[cfg(unix)]
     #[test]
-    fn terminal_rejections_stop_and_transient_ones_retry() {
-        assert!(rejection(RegistrationRejectionCode::EnvironmentClosed, "x".to_owned()).is_err());
-        assert!(matches!(
-            rejection(RegistrationRejectionCode::CapacityExhausted, "x".to_owned()),
-            Ok(SessionEnd::Retryable(
-                RegistrationRejectionCode::CapacityExhausted,
-                _
-            ))
-        ));
-    }
-
-    #[tokio::test(flavor = "current_thread")]
-    async fn protocol_mismatch_without_auto_upgrade_names_discovery_and_command() {
-        let registration = RegistrationConfig {
-            gateway_url: "wss://gateway.example/environment-gateway/connect".to_owned(),
-            registration_key: None,
-            display_name: None,
-            metadata: Default::default(),
-            receipt_path: None,
-            ca_file: None,
-            discovery_url: "https://gateway.example/.well-known/lightspeed-envd".to_owned(),
-            auto_upgrade: None,
-        };
-        let error = protocol_mismatch_error(&registration, CURRENT_PROTOCOL_VERSION + 1).await;
-        let rejection = error
-            .downcast_ref::<TerminalRejection>()
-            .expect("terminal rejection");
-        assert_eq!(
-            rejection.code,
-            RegistrationRejectionCode::UnsupportedProtocol
-        );
-        assert!(rejection.message.contains(&registration.discovery_url));
-        assert!(rejection.message.contains("lightspeed-envd upgrade"));
+    fn an_unwritable_receipt_dir_is_refused_at_startup() {
+        use std::os::unix::fs::PermissionsExt as _;
+        let temp = tempfile::tempdir().expect("tempdir");
+        let locked = temp.path().join("locked");
+        std::fs::create_dir(&locked).unwrap();
+        std::fs::set_permissions(&locked, std::fs::Permissions::from_mode(0o500)).unwrap();
+        let refused = check_receipt_path(&locked.join("registration.json"));
+        std::fs::set_permissions(&locked, std::fs::Permissions::from_mode(0o700)).unwrap();
+        // Root ignores directory permissions.
+        if !rustix::process::geteuid().is_root() {
+            assert!(refused.is_err());
+        }
     }
 
     /// A self-signed EC certificate, valid 2026-2036, used only as PEM input.
diff --git a/crates/environment-daemon/src/rpc.rs b/crates/environment-daemon/src/rpc.rs
deleted file mode 100644
index 35d2a370b..000000000
--- a/crates/environment-daemon/src/rpc.rs
+++ /dev/null
@@ -1,82 +0,0 @@
-use environment_protocol::error::{EnvironmentProtocolError, EnvironmentProtocolErrorCode};
-use serde::{Serialize, de::DeserializeOwned};
-use serde_json::{Value, json};
-
-#[derive(Debug)]
-pub struct RpcRequest {
-    pub id: Option<Value>,
-    pub method: Option<String>,
-    pub params: Value,
-}
-
-pub fn parse_request(value: Value) -> Result<RpcRequest, EnvironmentProtocolError> {
-    if !value.is_object() {
-        return Err(EnvironmentProtocolError::new(
-            EnvironmentProtocolErrorCode::InvalidRequest,
-            "JSON-RPC request must be an object",
-        ));
-    }
-    let id = value.get("id").cloned();
-    let method = value
-        .get("method")
-        .and_then(Value::as_str)
-        .map(ToOwned::to_owned);
-    let params = value.get("params").cloned().unwrap_or(Value::Null);
-    Ok(RpcRequest { id, method, params })
-}
-
-pub fn decode_params<T>(params: Value) -> Result<T, EnvironmentProtocolError>
-where
-    T: DeserializeOwned,
-{
-    serde_json::from_value(params).map_err(|error| {
-        EnvironmentProtocolError::new(
-            EnvironmentProtocolErrorCode::InvalidRequest,
-            error.to_string(),
-        )
-    })
-}
-
-pub fn encode_result<T>(value: T) -> Result<Value, EnvironmentProtocolError>
-where
-    T: Serialize,
-{
-    serde_json::to_value(value).map_err(|error| {
-        EnvironmentProtocolError::new(EnvironmentProtocolErrorCode::Internal, error.to_string())
-    })
-}
-
-pub fn success_response(id: Value, result: Value) -> Value {
-    json!({
-        "jsonrpc": "2.0",
-        "id": id,
-        "result": result
-    })
-}
-
-pub fn error_response(id: Option<Value>, error: EnvironmentProtocolError) -> Value {
-    json!({
-        "jsonrpc": "2.0",
-        "id": id.unwrap_or(Value::Null),
-        "error": error
-    })
-}
-
-pub fn method_not_found(method: &str) -> EnvironmentProtocolError {
-    EnvironmentProtocolError::new(
-        EnvironmentProtocolErrorCode::Unsupported,
-        format!("unsupported environment-protocol method: {method}"),
-    )
-}
-
-pub fn invalid_request(message: impl Into<String>) -> EnvironmentProtocolError {
-    EnvironmentProtocolError::new(EnvironmentProtocolErrorCode::InvalidRequest, message)
-}
-
-pub fn not_found(message: impl Into<String>) -> EnvironmentProtocolError {
-    EnvironmentProtocolError::new(EnvironmentProtocolErrorCode::NotFound, message)
-}
-
-pub fn unsupported(message: impl Into<String>) -> EnvironmentProtocolError {
-    EnvironmentProtocolError::new(EnvironmentProtocolErrorCode::Unsupported, message)
-}
diff --git a/crates/environment-daemon/src/server.rs b/crates/environment-daemon/src/server.rs
index 21db1d868..2f4d8be54 100644
--- a/crates/environment-daemon/src/server.rs
+++ b/crates/environment-daemon/src/server.rs
@@ -1,44 +1,111 @@
-use anyhow::Context as _;
-use environment_protocol::data::{
-    methods::{FS_CAPTURE_METHOD, FS_MATERIALIZE_METHOD},
-    transfer::*,
+//! Serving the data plane: the passive listener and the connection loop
+//! every data socket runs, accepted or reverse-dialed.
+//!
+//! Per connection, one reader parses frames with the shared envelope and
+//! enforces the handshake; one writer task owns the socket sink. Requests
+//! after `initialize` run as their own tasks, up to
+//! `limits.maxConcurrentRequests` at once, so responses leave in completion
+//! order and the reader never waits on the writer. When the reader ends,
+//! every pending request of the connection is cancelled and its reply,
+//! with any after-write hook, is dropped.
+
+use std::{
+    collections::HashMap,
+    sync::{Arc, Mutex},
+    time::Duration,
 };
+
+use anyhow::Context as _;
 use environment_protocol::{
-    data::{
-        fs::{
-            CopyParams, CreateDirectoryParams, GetMetadataParams, GlobFilesParams,
-            ReadDirectoryParams, ReadFileParams, RemoveParams, SearchTextParams, WriteFileParams,
-        },
-        handshake::{InitializeParams, InitializeResponse, InitializedParams},
-        idle::IdleParams,
-        jobs::{CancelJobsParams, ListJobsParams, ReadJobsParams, StartJobsParams},
-        methods::{
-            ENV_IDLE_METHOD, FS_COPY_METHOD, FS_CREATE_DIRECTORY_METHOD, FS_GET_METADATA_METHOD,
-            FS_GLOB_FILES_METHOD, FS_READ_DIRECTORY_METHOD, FS_READ_FILE_METHOD, FS_REMOVE_METHOD,
-            FS_SEARCH_TEXT_METHOD, FS_WRITE_FILE_METHOD,
-            INITIALIZE_METHOD as DATA_INITIALIZE_METHOD, INITIALIZED_METHOD, JOB_CANCEL_METHOD,
-            JOB_LIST_METHOD, JOB_READ_METHOD, JOB_START_METHOD, PROCESS_READ_METHOD,
-            PROCESS_RESIZE_METHOD, PROCESS_START_METHOD, PROCESS_TERMINATE_METHOD,
-            PROCESS_WRITE_METHOD,
-        },
-        process::{
-            ReadProcessParams, ResizeProcessParams, StartProcessParams, TerminateProcessParams,
-            WriteProcessParams,
-        },
+    ENVD_PROTOCOL_VERSION,
+    error::{BusyReason, ProtocolError},
+    jsonrpc::{
+        self, CANCEL_REQUEST_METHOD, CancelRequestParams, Id, Message as RpcMessage, Request,
+        Response,
     },
-    error::{EnvironmentProtocolError, EnvironmentProtocolErrorCode},
-    shared::CURRENT_PROTOCOL_VERSION,
+    limits::MAX_MESSAGE_BYTES,
+    manifest::DataInitialize,
 };
-use futures_util::{SinkExt as _, StreamExt as _};
-use serde_json::Value;
-use tokio::net::TcpListener;
-use tokio::sync::{Semaphore, mpsc};
-use tokio_tungstenite::{accept_async, tungstenite::Message};
-
-/// Serve the daemon until a transport fails terminally: the passive listener
-/// when one is configured, the outbound registration loop when a gateway
-/// URL is configured, or both.
-pub async fn run(runtime: DaemonRuntime) -> anyhow::Result<()> {
+use futures_util::{Sink, SinkExt as _, StreamExt as _};
+use tokio::{
+    net::TcpListener,
+    sync::{Semaphore, mpsc},
+};
+use tokio_tungstenite::{
+    WebSocketStream, accept_async_with_config,
+    tungstenite::{Message, protocol::WebSocketConfig},
+};
+use tokio_util::sync::CancellationToken;
+
+use crate::{
+    DaemonRuntime,
+    config::ListenAddr,
+    dispatch::{self, ConnectionInfo, RequestContext, WrittenHook},
+};
+
+/// How the daemon process ends. Each outcome has its own exit status so an
+/// orchestrator can tell a deliberate stop from a refusal or a cloned
+/// identity.
+#[derive(Debug)]
+pub enum DaemonExit {
+    /// `SIGTERM` or `SIGINT`; a registered daemon said goodbye first.
+    Shutdown,
+    /// Local configuration, state or receipt-file error.
+    Configuration(anyhow::Error),
+    /// The gateway refused registration for good, or it speaks another
+    /// protocol and no automatic upgrade succeeded.
+    Refused(String),
+    /// The gateway closed the identity's environment.
+    EnvironmentClosed,
+    /// Another process with this daemon identity connected and won.
+    Superseded { daemon_public_key: String },
+    /// An unexpected failure.
+    Failed(anyhow::Error),
+}
+
+impl DaemonExit {
+    pub fn status(&self) -> u8 {
+        match self {
+            Self::Shutdown => 0,
+            Self::Failed(_) => 1,
+            Self::Configuration(_) => 2,
+            Self::Refused(_) => 3,
+            Self::EnvironmentClosed => 4,
+            Self::Superseded { .. } => 5,
+        }
+    }
+}
+
+impl std::fmt::Display for DaemonExit {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::Shutdown => formatter.write_str("shut down"),
+            Self::Configuration(error) => write!(formatter, "configuration error: {error:#}"),
+            Self::Refused(message) => write!(formatter, "registration refused: {message}"),
+            Self::EnvironmentClosed => formatter.write_str("the environment was closed"),
+            Self::Superseded { daemon_public_key } => write!(
+                formatter,
+                "superseded: another process with daemon public key {daemon_public_key} connected; \
+                 two daemons share one state directory"
+            ),
+            Self::Failed(error) => write!(formatter, "failed: {error:#}"),
+        }
+    }
+}
+
+/// The WebSocket limits of every envd socket: one message is one frame of
+/// at most `MAX_MESSAGE_BYTES`.
+pub(crate) fn websocket_config() -> WebSocketConfig {
+    let limit = usize::try_from(MAX_MESSAGE_BYTES).unwrap_or(usize::MAX);
+    WebSocketConfig::default()
+        .max_message_size(Some(limit))
+        .max_frame_size(Some(limit))
+}
+
+/// Serve the daemon until it stops: the passive listener when one is
+/// configured, the outbound registration loop when a gateway URL is
+/// configured, or both.
+pub async fn run(runtime: DaemonRuntime) -> DaemonExit {
     let listen = runtime.config().listen.clone();
     let registration = runtime.config().registration.clone();
     match (listen, registration) {
@@ -47,18 +114,51 @@ pub async fn run(runtime: DaemonRuntime) -> anyhow::Result<()> {
             crate::registration::run_outbound(runtime, registration).await
         }
         (Some(listen), Some(registration)) => {
-            let listener = tokio::spawn(run_listener(runtime.clone(), listen));
-            let outbound = tokio::spawn(crate::registration::run_outbound(runtime, registration));
+            let listener = run_listener(runtime.clone(), listen);
+            let outbound = crate::registration::run_outbound(runtime, registration);
+            tokio::pin!(listener, outbound);
             tokio::select! {
-                result = listener => result.context("listener task")?,
-                result = outbound => result.context("registration task")?,
+                exit = &mut listener => match exit {
+                    // The registration loop says goodbye on the same token.
+                    DaemonExit::Shutdown => outbound.await,
+                    other => other,
+                },
+                exit = &mut outbound => exit,
             }
         }
-        (None, None) => anyhow::bail!("configure a listener or a gateway URL"),
+        (None, None) => {
+            DaemonExit::Configuration(anyhow::anyhow!("configure a listener or a gateway URL"))
+        }
     }
 }
 
-async fn run_listener(runtime: DaemonRuntime, listen: ListenAddr) -> anyhow::Result<()> {
+/// Cancel the runtime's shutdown token on the first `SIGTERM` or `SIGINT`.
+pub fn spawn_signal_listener(runtime: &DaemonRuntime) -> anyhow::Result<()> {
+    let shutdown = runtime.shutdown().clone();
+    #[cfg(unix)]
+    {
+        use tokio::signal::unix::{SignalKind, signal};
+        let mut terminate = signal(SignalKind::terminate()).context("install SIGTERM handler")?;
+        let mut interrupt = signal(SignalKind::interrupt()).context("install SIGINT handler")?;
+        tokio::spawn(async move {
+            tokio::select! {
+                _ = terminate.recv() => tracing_line("SIGTERM received; shutting down"),
+                _ = interrupt.recv() => tracing_line("SIGINT received; shutting down"),
+            }
+            shutdown.cancel();
+        });
+    }
+    #[cfg(not(unix))]
+    tokio::spawn(async move {
+        if tokio::signal::ctrl_c().await.is_ok() {
+            tracing_line("interrupt received; shutting down");
+            shutdown.cancel();
+        }
+    });
+    Ok(())
+}
+
+async fn run_listener(runtime: DaemonRuntime, listen: ListenAddr) -> DaemonExit {
     match listen {
         ListenAddr::Tcp(addr) => run_tcp_listener(runtime, addr).await,
         #[cfg(unix)]
@@ -66,31 +166,43 @@ async fn run_listener(runtime: DaemonRuntime, listen: ListenAddr) -> anyhow::Res
     }
 }
 
-async fn run_tcp_listener(
-    runtime: DaemonRuntime,
-    listen: std::net::SocketAddr,
-) -> anyhow::Result<()> {
-    let listener = TcpListener::bind(listen)
+async fn run_tcp_listener(runtime: DaemonRuntime, listen: std::net::SocketAddr) -> DaemonExit {
+    let listener = match TcpListener::bind(listen)
         .await
-        .context("bind environment daemon listener")?;
+        .context("bind environment daemon listener")
+    {
+        Ok(listener) => listener,
+        Err(error) => return DaemonExit::Configuration(error),
+    };
     tracing_line(&format!("listener ready on {listen}"));
+    let shutdown = runtime.shutdown().clone();
     loop {
-        match listener.accept().await {
-            Ok((stream, peer)) => serve_accepted(runtime.clone(), stream, peer.to_string()),
-            Err(error) => accept_failed(error).await,
+        tokio::select! {
+            _ = shutdown.cancelled() => return DaemonExit::Shutdown,
+            accepted = listener.accept() => match accepted {
+                Ok((stream, peer)) => serve_accepted(runtime.clone(), stream, peer.to_string()),
+                Err(error) => accept_failed(error).await,
+            },
         }
     }
 }
 
 #[cfg(unix)]
-async fn run_unix_listener(runtime: DaemonRuntime, path: std::path::PathBuf) -> anyhow::Result<()> {
-    let listener = bind_unix_listener(&path)?;
+async fn run_unix_listener(runtime: DaemonRuntime, path: std::path::PathBuf) -> DaemonExit {
+    let listener = match bind_unix_listener(&path) {
+        Ok(listener) => listener,
+        Err(error) => return DaemonExit::Configuration(error),
+    };
     let label = ListenAddr::Unix(path).to_string();
     tracing_line(&format!("listener ready on {label}"));
+    let shutdown = runtime.shutdown().clone();
     loop {
-        match listener.accept().await {
-            Ok((stream, _)) => serve_accepted(runtime.clone(), stream, label.clone()),
-            Err(error) => accept_failed(error).await,
+        tokio::select! {
+            _ = shutdown.cancelled() => return DaemonExit::Shutdown,
+            accepted = listener.accept() => match accepted {
+                Ok((stream, _)) => serve_accepted(runtime.clone(), stream, label.clone()),
+                Err(error) => accept_failed(error).await,
+            },
         }
     }
 }
@@ -100,7 +212,7 @@ async fn run_unix_listener(runtime: DaemonRuntime, path: std::path::PathBuf) ->
 /// The pause stops a persistent error from spinning the loop.
 async fn accept_failed(error: std::io::Error) {
     tracing_line(&format!("accept failed: {error}"));
-    tokio::time::sleep(std::time::Duration::from_millis(100)).await;
+    tokio::time::sleep(Duration::from_millis(100)).await;
 }
 
 /// Bind a Unix-socket listener only this daemon's user can connect to. A
@@ -154,465 +266,840 @@ where
     S: tokio::io::AsyncRead + tokio::io::AsyncWrite + Unpin + Send + 'static,
 {
     tokio::spawn(async move {
-        match accept_async(stream).await {
-            Ok(socket) => {
-                if let Err(error) = run_data_connection(&runtime, socket).await {
-                    eprintln!("lightspeed-envd connection {peer} failed: {error:#}");
-                }
-            }
-            Err(error) => {
-                eprintln!("lightspeed-envd websocket handshake {peer} failed: {error}")
-            }
+        if let Err(error) = serve_stream(runtime, stream).await {
+            tracing_line(&format!("connection {peer} failed: {error:#}"));
         }
     });
 }
 
+/// Accept a WebSocket upgrade on an already connected byte stream and serve
+/// the data plane on it until the connection ends. In-process callers pair
+/// it with `DataClient::connect_initialized_over` on the other end of a
+/// `tokio::io::duplex`.
+pub async fn serve_stream<S>(runtime: DaemonRuntime, stream: S) -> anyhow::Result<()>
+where
+    S: tokio::io::AsyncRead + tokio::io::AsyncWrite + Unpin + Send + 'static,
+{
+    let socket = accept_async_with_config(stream, Some(websocket_config()))
+        .await
+        .context("websocket handshake")?;
+    run_data_connection(&runtime, socket).await;
+    Ok(())
+}
+
+/// One frame for the writer task: an encoded response and the hook to run
+/// once it is on the socket.
+struct Outgoing {
+    text: String,
+    on_written: Option<WrittenHook>,
+}
+
+impl Outgoing {
+    fn response(response: Response) -> Self {
+        Self {
+            text: response.to_text(),
+            on_written: None,
+        }
+    }
+}
+
+/// Pending requests of one connection by id, each with the token that
+/// `$/cancelRequest` and the connection's close cancel.
+type PendingRequests = Arc<Mutex<HashMap<Id, CancellationToken>>>;
+
 /// Serve the data protocol on one accepted or dialed socket. Outbound data
 /// sockets and passive connections run this same loop.
-pub(crate) async fn run_data_connection<S>(
-    runtime: &DaemonRuntime,
-    socket: tokio_tungstenite::WebSocketStream<S>,
-) -> anyhow::Result<()>
+pub(crate) async fn run_data_connection<S>(runtime: &DaemonRuntime, socket: WebSocketStream<S>)
 where
     S: tokio::io::AsyncRead + tokio::io::AsyncWrite + Unpin + Send + 'static,
 {
-    let (mut writer, mut reader) = socket.split();
-    let (responses, mut response_rx) = mpsc::channel::<Value>(64);
-    let concurrency = std::sync::Arc::new(Semaphore::new(32));
+    let connection = Arc::new(ConnectionInfo {
+        connection_id: runtime.next_connection_id(),
+        closed: CancellationToken::new(),
+    });
+    let max_concurrent = runtime.limits().max_concurrent_requests as usize;
+    // Handler replies are bounded by the request permits; the rest of the
+    // capacity holds the reader's own answers (framing errors, busy). A
+    // peer that fills it without reading is closed rather than buffered.
+    let (outgoing, outgoing_rx) = mpsc::channel::<Outgoing>(max_concurrent + 64);
+    let (sink, mut stream) = socket.split();
+    let writer = tokio::spawn(write_loop(sink, outgoing_rx, connection.closed.clone()));
+    let permits = Arc::new(Semaphore::new(max_concurrent));
+    let pending: PendingRequests = Arc::default();
+    let shutdown = runtime.shutdown().clone();
+    let mut session = Session {
+        runtime,
+        connection: &connection,
+        outgoing: &outgoing,
+        permits: &permits,
+        pending: &pending,
+        initialized: false,
+    };
     loop {
-        tokio::select! {
-            response = response_rx.recv() => {
-                let Some(response) = response else { return Ok(()) };
-                writer.send(Message::Text(response.to_string().into())).await?;
-            }
-            message = reader.next() => {
-                let Some(message) = message else { return Ok(()) };
-                match message? {
-                    Message::Text(text) => dispatch_gateway_json(runtime, &responses, &concurrency, &text).await?,
-                    Message::Binary(bytes) => {
-                        let text = std::str::from_utf8(&bytes).context("binary provider frame is not UTF-8")?;
-                        dispatch_gateway_json(runtime, &responses, &concurrency, text).await?;
-                    }
-                    Message::Ping(bytes) => writer.send(Message::Pong(bytes)).await?,
-                    Message::Pong(_) | Message::Frame(_) => {}
-                    Message::Close(_) => {
-                        // Tungstenite queues the close reply while reading the
-                        // peer's frame; flush it before dropping the socket.
-                        writer.flush().await?;
-                        return Ok(())
-                    },
-                }
+        let frame = tokio::select! {
+            _ = connection.closed.cancelled() => break,
+            _ = shutdown.cancelled() => break,
+            frame = stream.next() => frame,
+        };
+        let message = match frame {
+            Some(Ok(message)) => message,
+            Some(Err(error)) => {
+                tracing_line(&format!(
+                    "connection {} ended: {error}",
+                    connection.connection_id
+                ));
+                break;
             }
+            None => break,
+        };
+        let keep_open = match message {
+            Message::Text(text) => session.on_text(text.as_str()),
+            Message::Binary(_) => session.answer(Response::failure(
+                None,
+                ProtocolError::invalid_request("binary frames are not part of the protocol"),
+            )),
+            // Tungstenite answers pings itself on the read path, ahead of
+            // anything the writer has queued.
+            Message::Ping(_) | Message::Pong(_) | Message::Frame(_) => true,
+            Message::Close(_) => break,
+        };
+        if !keep_open {
+            break;
         }
     }
+    connection.closed.cancel();
+    pending
+        .lock()
+        .unwrap_or_else(|poison| poison.into_inner())
+        .clear();
+    drop(outgoing);
+    let _ = writer.await;
 }
 
-use crate::{
-    DaemonRuntime,
-    config::ListenAddr,
-    rpc::{
-        decode_params, encode_result, error_response, invalid_request, method_not_found,
-        parse_request, success_response,
-    },
-};
+/// The reader's view of one connection.
+struct Session<'a> {
+    runtime: &'a DaemonRuntime,
+    connection: &'a Arc<ConnectionInfo>,
+    outgoing: &'a mpsc::Sender<Outgoing>,
+    permits: &'a Arc<Semaphore>,
+    pending: &'a PendingRequests,
+    initialized: bool,
+}
 
-async fn dispatch_gateway_json(
-    runtime: &DaemonRuntime,
-    responses: &mpsc::Sender<Value>,
-    concurrency: &std::sync::Arc<Semaphore>,
-    text: &str,
-) -> anyhow::Result<()> {
-    let value: Value = serde_json::from_str(text)?;
-    let request = match parse_request(value) {
-        Ok(request) => request,
-        Err(error) => {
-            responses.send(error_response(None, error)).await?;
-            return Ok(());
+impl Session<'_> {
+    /// Handle one text frame; false closes the connection.
+    fn on_text(&mut self, text: &str) -> bool {
+        match jsonrpc::parse(text) {
+            Err(rejection) => match rejection.into_response() {
+                Some(response) => self.answer(response),
+                None => true,
+            },
+            Ok(RpcMessage::Request(request)) => self.on_request(request),
+            Ok(RpcMessage::Notification(notification)) => {
+                if self.initialized
+                    && notification.method == CANCEL_REQUEST_METHOD
+                    && let Ok(params) = notification.params::<CancelRequestParams>()
+                {
+                    self.cancel(&params.id);
+                }
+                true
+            }
+            // envd never sends requests, so no response can be one it
+            // waits for.
+            Ok(RpcMessage::Response(response)) => {
+                tracing_line(&format!(
+                    "connection {} ignored a response to id {}",
+                    self.connection.connection_id,
+                    response
+                        .id
+                        .map_or_else(|| "null".to_owned(), |id| id.to_string())
+                ));
+                true
+            }
         }
-    };
-    let Some(id) = request.id else {
-        if request.method.as_deref() == Some(INITIALIZED_METHOD) {
-            let _ = decode_params::<InitializedParams>(request.params);
+    }
+
+    fn on_request(&mut self, request: Request) -> bool {
+        if !self.initialized {
+            if request.method != DataInitialize::NAME {
+                return self.answer(Response::failure(
+                    Some(request.id),
+                    ProtocolError::not_initialized(),
+                ));
+            }
+            let result = initialize(self.runtime, &request);
+            self.initialized = result.is_ok();
+            return self.answer(Response::from_result(request.id, result));
         }
-        return Ok(());
-    };
-    let Ok(permit) = concurrency.clone().try_acquire_owned() else {
-        responses
-            .send(error_response(
-                Some(id),
-                EnvironmentProtocolError::new(
-                    EnvironmentProtocolErrorCode::Conflict,
-                    "daemon request limit reached",
+        if request.method == DataInitialize::NAME {
+            return self.answer(Response::failure(
+                Some(request.id),
+                ProtocolError::invalid_request(
+                    "initialize was already answered on this connection",
                 ),
-            ))
-            .await?;
-        return Ok(());
-    };
-    let runtime = runtime.clone();
-    let responses = responses.clone();
-    tokio::spawn(async move {
-        let _permit = permit;
-        let result = match request.method.as_deref() {
-            Some(method) => handle_data(&runtime, method, request.params).await,
-            None => Err(invalid_request("request missing method")),
-        };
-        let response = match result {
-            Ok(result) => success_response(id, result),
-            Err(error) => error_response(Some(id), error),
-        };
-        let _ = responses.send(response).await;
-    });
-    Ok(())
-}
-
-async fn handle_data(
-    runtime: &DaemonRuntime,
-    method: &str,
-    params: Value,
-) -> Result<Value, EnvironmentProtocolError> {
-    // Handshakes and idle reports are observation, not use: only real
-    // filesystem/process/job requests count as activity.
-    if !matches!(method, DATA_INITIALIZE_METHOD | ENV_IDLE_METHOD) {
-        runtime.touch_activity();
-    }
-    match method {
-        ENV_IDLE_METHOD => {
-            decode_params::<IdleParams>(params)?;
-            encode_result(runtime.idle_report().await)
+            ));
         }
-        DATA_INITIALIZE_METHOD => {
-            let params = decode_params::<InitializeParams>(params)?;
-            if params.protocol_version != CURRENT_PROTOCOL_VERSION {
-                return Err(EnvironmentProtocolError::new(
-                    EnvironmentProtocolErrorCode::Unsupported,
+        let Ok(permit) = self.permits.clone().try_acquire_owned() else {
+            return self.answer(Response::failure(
+                Some(request.id),
+                ProtocolError::busy(
+                    Some(BusyReason::RequestLimit),
+                    None,
                     format!(
-                        "unsupported data protocol version {}; expected {CURRENT_PROTOCOL_VERSION}",
-                        params.protocol_version
+                        "{} requests are already in flight on this connection",
+                        self.runtime.limits().max_concurrent_requests
                     ),
+                ),
+            ));
+        };
+        let ctx = RequestContext::new(self.connection.clone());
+        {
+            let mut pending = self
+                .pending
+                .lock()
+                .unwrap_or_else(|poison| poison.into_inner());
+            if pending.contains_key(&request.id) {
+                drop(pending);
+                return self.answer(Response::failure(
+                    Some(request.id),
+                    ProtocolError::invalid_request("a request with this id is already in flight"),
                 ));
             }
-            encode_result(InitializeResponse {
-                home_directory: std::env::var("HOME").ok(),
-                protocol_version: CURRENT_PROTOCOL_VERSION,
-                connection_id: runtime.next_connection_id(),
-                capabilities: runtime.capabilities(),
-                default_cwd: Some(runtime.config().cwd.to_string_lossy().into_owned()),
-                implementation: runtime.implementation(),
-            })
+            pending.insert(request.id.clone(), ctx.cancel.clone());
         }
-        FS_READ_FILE_METHOD => encode_result(
-            runtime
-                .filesystem()
-                .read_file(decode_params::<ReadFileParams>(params)?)
-                .await?,
-        ),
-        FS_WRITE_FILE_METHOD => encode_result(
-            runtime
-                .filesystem()
-                .write_file(decode_params::<WriteFileParams>(params)?)
-                .await?,
-        ),
-        FS_CREATE_DIRECTORY_METHOD => encode_result(
-            runtime
-                .filesystem()
-                .create_directory(decode_params::<CreateDirectoryParams>(params)?)
-                .await?,
-        ),
-        FS_GET_METADATA_METHOD => encode_result(
-            runtime
-                .filesystem()
-                .get_metadata(decode_params::<GetMetadataParams>(params)?)
-                .await?,
-        ),
-        FS_READ_DIRECTORY_METHOD => encode_result(
-            runtime
-                .filesystem()
-                .read_directory(decode_params::<ReadDirectoryParams>(params)?)
-                .await?,
-        ),
-        FS_REMOVE_METHOD => encode_result(
-            runtime
-                .filesystem()
-                .remove(decode_params::<RemoveParams>(params)?)
-                .await?,
-        ),
-        environment_protocol::data::methods::FS_SCAN_METHOD => {
-            encode_result(runtime.filesystem().scan(decode_params(params)?).await?)
+        let runtime = self.runtime.clone();
+        let outgoing = self.outgoing.clone();
+        let pending = self.pending.clone();
+        tokio::spawn(async move {
+            let _permit = permit;
+            let Request { id, method, params } = request;
+            let result = dispatch::handle_request(&runtime, &ctx, &method, params).await;
+            pending
+                .lock()
+                .unwrap_or_else(|poison| poison.into_inner())
+                .remove(&id);
+            if ctx.connection.closed.is_cancelled() {
+                return;
+            }
+            let _ = outgoing.send(encode_reply(id, result)).await;
+        });
+        true
+    }
+
+    fn cancel(&self, id: &Id) {
+        let pending = self
+            .pending
+            .lock()
+            .unwrap_or_else(|poison| poison.into_inner());
+        if let Some(token) = pending.get(id) {
+            token.cancel();
         }
-        environment_protocol::data::methods::FS_TRANSFER_METHOD => encode_result(
-            runtime
-                .filesystem()
-                .transfer(decode_params(params)?)
-                .await?,
-        ),
-        FS_CAPTURE_METHOD => encode_result(
-            runtime
-                .filesystem()
-                .capture(decode_params::<CaptureParams>(params)?)
-                .await?,
-        ),
-        FS_MATERIALIZE_METHOD => encode_result(
-            runtime
-                .filesystem()
-                .materialize(decode_params::<MaterializeParams>(params)?)
-                .await?,
-        ),
-        FS_COPY_METHOD => encode_result(
-            runtime
-                .filesystem()
-                .copy(decode_params::<CopyParams>(params)?)
-                .await?,
-        ),
-        FS_SEARCH_TEXT_METHOD => encode_result(
-            runtime
-                .filesystem()
-                .search_text(decode_params::<SearchTextParams>(params)?)
-                .await?,
-        ),
-        FS_GLOB_FILES_METHOD => encode_result(
-            runtime
-                .filesystem()
-                .glob_files(decode_params::<GlobFilesParams>(params)?)
-                .await?,
-        ),
-        PROCESS_START_METHOD => encode_result(
-            runtime
-                .processes()
-                .start_process(decode_params::<StartProcessParams>(params)?)
-                .await?,
-        ),
-        PROCESS_READ_METHOD => encode_result(
-            runtime
-                .processes()
-                .read_process(decode_params::<ReadProcessParams>(params)?)
-                .await?,
-        ),
-        PROCESS_WRITE_METHOD => encode_result(
-            runtime
-                .processes()
-                .write_process(decode_params::<WriteProcessParams>(params)?)
-                .await?,
-        ),
-        PROCESS_TERMINATE_METHOD => encode_result(
-            runtime
-                .processes()
-                .terminate_process(decode_params::<TerminateProcessParams>(params)?)
-                .await?,
-        ),
-        PROCESS_RESIZE_METHOD => encode_result(
-            runtime
-                .processes()
-                .resize_process(decode_params::<ResizeProcessParams>(params)?)
-                .await?,
-        ),
-        JOB_START_METHOD => encode_result(
-            runtime
-                .jobs()
-                .start_jobs(decode_params::<StartJobsParams>(params)?)
-                .await?,
-        ),
-        JOB_LIST_METHOD => encode_result(
-            runtime
-                .jobs()
-                .list_jobs(decode_params::<ListJobsParams>(params)?)
-                .await?,
-        ),
-        JOB_READ_METHOD => encode_result(
-            runtime
-                .jobs()
-                .read_jobs(decode_params::<ReadJobsParams>(params)?)
-                .await?,
-        ),
-        JOB_CANCEL_METHOD => encode_result(
-            runtime
-                .jobs()
-                .cancel_jobs(decode_params::<CancelJobsParams>(params)?)
-                .await?,
-        ),
-        other => Err(method_not_found(other)),
     }
+
+    /// Queue a reader-produced answer without waiting; false when the peer
+    /// stopped reading and the queue is full.
+    fn answer(&self, response: Response) -> bool {
+        match self.outgoing.try_send(Outgoing::response(response)) {
+            Ok(()) => true,
+            Err(mpsc::error::TrySendError::Full(_)) => {
+                tracing_line(&format!(
+                    "connection {} closed: the peer does not read its responses",
+                    self.connection.connection_id
+                ));
+                false
+            }
+            Err(mpsc::error::TrySendError::Closed(_)) => false,
+        }
+    }
+}
+
+/// Encode a handler's result. A success whose encoding would break the
+/// message limit becomes `payloadTooLarge`, and its after-write hook is
+/// dropped with it: nothing the client never received may be committed.
+fn encode_reply(
+    id: Id,
+    result: Result<dispatch::Reply<serde_json::Value>, ProtocolError>,
+) -> Outgoing {
+    match result {
+        Ok(reply) => {
+            let response = Response {
+                id: Some(id),
+                result: Ok(reply.value),
+            };
+            let text = response.to_value().to_string();
+            if jsonrpc::check_message_size(&text).is_ok() {
+                Outgoing {
+                    text,
+                    on_written: reply.on_written,
+                }
+            } else {
+                Outgoing::response(response)
+            }
+        }
+        Err(error) => Outgoing::response(Response::failure(Some(id), error)),
+    }
+}
+
+/// `initialize`: the version is compared before the strict decode, so a
+/// client of another version learns that rather than which field it sent
+/// that this daemon does not know.
+fn initialize(
+    runtime: &DaemonRuntime,
+    request: &Request,
+) -> Result<environment_protocol::data::handshake::InitializeResponse, ProtocolError> {
+    if let Some(received) = request
+        .params
+        .get("protocolVersion")
+        .and_then(serde_json::Value::as_u64)
+        && received != u64::from(ENVD_PROTOCOL_VERSION)
+    {
+        return Err(ProtocolError::version_mismatch(
+            ENVD_PROTOCOL_VERSION,
+            u32::try_from(received).unwrap_or(u32::MAX),
+        ));
+    }
+    let _params: environment_protocol::data::handshake::InitializeParams = request.params()?;
+    Ok(runtime.initialize_response())
+}
+
+/// The connection's only writer: sends frames in the order handlers finish
+/// and runs each after-write hook once its frame is on the socket. Stops,
+/// dropping whatever is still queued, when the connection closes.
+async fn write_loop<Si>(
+    mut sink: Si,
+    mut queue: mpsc::Receiver<Outgoing>,
+    closed: CancellationToken,
+) where
+    Si: Sink<Message, Error = tokio_tungstenite::tungstenite::Error> + Unpin,
+{
+    loop {
+        let next = tokio::select! {
+            biased;
+            _ = closed.cancelled() => break,
+            next = queue.recv() => next,
+        };
+        let Some(Outgoing { text, on_written }) = next else {
+            break;
+        };
+        let sent = tokio::select! {
+            biased;
+            _ = closed.cancelled() => break,
+            sent = sink.send(Message::Text(text.into())) => sent,
+        };
+        match sent {
+            Ok(()) => {
+                if let Some(hook) = on_written {
+                    hook();
+                }
+            }
+            Err(_) => {
+                closed.cancel();
+                break;
+            }
+        }
+    }
+    // Sends our close frame, or the reply tungstenite queued for the peer's.
+    let _ = tokio::time::timeout(Duration::from_secs(5), sink.close()).await;
 }
 
 pub(crate) fn tracing_line(message: &str) {
     eprintln!("lightspeed-envd {message}");
 }
 
-#[cfg(all(test, unix))]
-mod unix_listener_tests {
-    use std::os::unix::fs::PermissionsExt as _;
+#[cfg(test)]
+mod tests {
+    use std::time::Duration;
 
-    use environment_protocol::{data::handshake::InitializeParams, shared::EnvironmentScope};
-    use tokio_tungstenite::client_async;
+    use environment_protocol::{
+        error::{ErrorData, ProtocolErrorKind},
+        handshake::ImplementationInfo,
+    };
+    use serde_json::{Value, json};
+    use tokio::io::DuplexStream;
+    use tokio_tungstenite::client_async_with_config;
 
     use super::*;
-    use crate::config::DaemonConfig;
-
-    fn runtime(root: &std::path::Path, socket: &std::path::Path) -> DaemonRuntime {
-        DaemonRuntime::new(DaemonConfig {
-            listen: Some(ListenAddr::Unix(socket.to_path_buf())),
-            cwd: root.to_path_buf(),
-            fs_root: root.to_path_buf(),
-            state_dir: root.join("state"),
-            read_only_fs: false,
-            registration: None,
-            scrubbed_env: vec![],
-        })
-        .unwrap()
+    use crate::test_support::runtime;
+
+    type Client = WebSocketStream<DuplexStream>;
+
+    async fn connect(runtime: &DaemonRuntime) -> Client {
+        let (client, server) = tokio::io::duplex(1 << 20);
+        tokio::spawn(serve_stream(runtime.clone(), server));
+        client_async_with_config("ws://localhost/", client, Some(websocket_config()))
+            .await
+            .expect("upgrade")
+            .0
     }
 
-    #[tokio::test(flavor = "current_thread")]
-    async fn serves_the_data_protocol_on_a_private_unix_socket() {
-        let temp = tempfile::tempdir().unwrap();
-        let root = temp.path().canonicalize().unwrap();
-        // The parent does not exist yet: guest tmpfs paths start empty.
-        let socket = root.join("run").join("envd.sock");
-        let server = tokio::spawn(run(runtime(&root, &socket)));
-        while !socket.exists() {
-            tokio::task::yield_now().await;
-        }
-        let mode = std::fs::metadata(&socket).unwrap().permissions().mode();
-        assert_eq!(mode & 0o777, 0o600);
-
-        let stream = tokio::net::UnixStream::connect(&socket).await.unwrap();
-        let (mut client, _) = client_async("ws://envd/", stream).await.unwrap();
-        let params = InitializeParams {
-            protocol_version: CURRENT_PROTOCOL_VERSION,
-            client_name: "unix-listener-test".to_owned(),
-            scope: EnvironmentScope::Default,
-            resume_connection_id: None,
-        };
-        let request = serde_json::json!({
-            "jsonrpc": "2.0",
-            "id": 1,
-            "method": DATA_INITIALIZE_METHOD,
-            "params": params,
-        });
+    async fn send(client: &mut Client, frame: Value) {
         client
-            .send(Message::Text(request.to_string().into()))
+            .send(Message::Text(frame.to_string().into()))
             .await
-            .unwrap();
-        let Some(Ok(Message::Text(reply))) = client.next().await else {
-            panic!("expected an initialize response");
-        };
-        let reply: Value = serde_json::from_str(reply.as_str()).unwrap();
-        assert_eq!(reply["id"], 1);
-        assert_eq!(reply["result"]["protocolVersion"], CURRENT_PROTOCOL_VERSION);
-        server.abort();
+            .expect("send");
     }
 
-    #[tokio::test(flavor = "current_thread")]
-    async fn stale_sockets_are_replaced_but_live_ones_and_files_are_not() {
-        let temp = tempfile::tempdir().unwrap();
-        let socket = temp.path().join("envd.sock");
+    async fn next_json(client: &mut Client) -> Value {
+        loop {
+            let frame = tokio::time::timeout(Duration::from_secs(10), client.next())
+                .await
+                .expect("a frame in time")
+                .expect("open")
+                .expect("frame");
+            if let Message::Text(text) = frame {
+                return serde_json::from_str(text.as_str()).expect("json");
+            }
+        }
+    }
 
-        drop(std::os::unix::net::UnixListener::bind(&socket).unwrap());
-        assert!(socket.exists(), "a dropped listener leaves its node behind");
-        let listener = bind_unix_listener(&socket).expect("stale socket replaced");
+    fn error_kind(response: &Value) -> ProtocolErrorKind {
+        let error: ProtocolError =
+            serde_json::from_value(response["error"].clone()).expect("an error response");
+        error.kind()
+    }
 
-        assert!(bind_unix_listener(&socket).is_err(), "live listener kept");
-        drop(listener);
+    fn initialize_params(version: u32) -> Value {
+        json!({
+            "protocolVersion": version,
+            "clientInfo": {"name": "envd-server-test"},
+        })
+    }
 
-        let file = temp.path().join("not-a-socket");
-        std::fs::write(&file, b"data").unwrap();
-        assert!(bind_unix_listener(&file).is_err());
-        assert_eq!(std::fs::read(&file).unwrap(), b"data");
+    async fn initialized(runtime: &DaemonRuntime) -> Client {
+        let mut client = connect(runtime).await;
+        send(
+            &mut client,
+            json!({"jsonrpc": "2.0", "id": 0, "method": "initialize", "params": initialize_params(ENVD_PROTOCOL_VERSION)}),
+        )
+        .await;
+        let response = next_json(&mut client).await;
+        assert_eq!(response["result"]["plane"], "data", "{response}");
+        client
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn a_live_socket_that_cannot_be_probed_is_left_in_place() {
-        let temp = tempfile::tempdir().unwrap();
-        let socket = temp.path().join("envd.sock");
-        let _live = std::os::unix::net::UnixListener::bind(&socket).unwrap();
-        // Without write permission, connect fails with EACCES rather than
-        // ECONNREFUSED (root bypasses this and sees the live listener).
-        std::fs::set_permissions(&socket, std::fs::Permissions::from_mode(0o000)).unwrap();
-
-        assert!(bind_unix_listener(&socket).is_err());
-        assert!(
-            std::fs::symlink_metadata(&socket).is_ok(),
-            "live socket kept"
+    async fn the_handshake_is_enforced_and_the_connection_survives_every_refusal() {
+        let (_temp, runtime) = runtime();
+        let mut client = connect(&runtime).await;
+
+        send(
+            &mut client,
+            json!({"jsonrpc": "2.0", "id": 1, "method": "env/getIdle"}),
+        )
+        .await;
+        let early = next_json(&mut client).await;
+        assert_eq!(early["id"], 1);
+        assert_eq!(error_kind(&early), ProtocolErrorKind::NotInitialized);
+
+        send(
+            &mut client,
+            json!({"jsonrpc": "2.0", "id": 2, "method": "initialize", "params": {"protocolVersion": 4, "clientInfo": {"name": "x"}, "fromTheFuture": true}}),
+        )
+        .await;
+        let mismatch: ProtocolError =
+            serde_json::from_value(next_json(&mut client).await["error"].clone()).unwrap();
+        assert_eq!(
+            mismatch.data,
+            ErrorData::VersionMismatch {
+                expected: ENVD_PROTOCOL_VERSION,
+                received: 4
+            }
         );
-    }
-}
 
-#[cfg(all(test, any(target_os = "linux", target_os = "macos")))]
-mod transfer_tests {
-    use super::*;
-    use crate::config::DaemonConfig;
-    use environment_protocol::shared::{ByteChunk, EnvironmentPath};
+        send(
+            &mut client,
+            json!({"jsonrpc": "2.0", "id": 3, "method": "initialize", "params": initialize_params(ENVD_PROTOCOL_VERSION)}),
+        )
+        .await;
+        let response = next_json(&mut client).await;
+        assert_eq!(response["id"], 3);
+        assert_eq!(response["result"]["protocolVersion"], ENVD_PROTOCOL_VERSION);
+        assert_eq!(
+            response["result"]["daemonInstanceId"],
+            runtime.instance_id().as_str()
+        );
+
+        send(
+            &mut client,
+            json!({"jsonrpc": "2.0", "id": 4, "method": "initialize", "params": initialize_params(ENVD_PROTOCOL_VERSION)}),
+        )
+        .await;
+        assert_eq!(
+            error_kind(&next_json(&mut client).await),
+            ProtocolErrorKind::InvalidRequest
+        );
+
+        send(
+            &mut client,
+            json!({"jsonrpc": "2.0", "id": 5, "method": "env/getIdle"}),
+        )
+        .await;
+        let idle = next_json(&mut client).await;
+        assert!(idle["result"]["idleForMs"].is_u64(), "{idle}");
+    }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn transfer_dispatch_and_read_only_capabilities() {
-        let temp = tempfile::tempdir().unwrap();
-        let root = temp.path().to_path_buf();
-        for read_only in [false, true] {
-            let runtime = DaemonRuntime::new(DaemonConfig {
-                listen: None,
-                cwd: root.clone(),
-                fs_root: root.clone(),
-                state_dir: root.join("state"),
-                read_only_fs: read_only,
-                registration: None,
-                scrubbed_env: vec![],
-            })
+    async fn framing_errors_are_answered_with_null_ids_and_notifications_never() {
+        let (_temp, runtime) = runtime();
+        let mut client = initialized(&runtime).await;
+
+        client.send(Message::Text("not json".into())).await.unwrap();
+        let parse = next_json(&mut client).await;
+        assert_eq!(parse["id"], Value::Null);
+        assert_eq!(error_kind(&parse), ProtocolErrorKind::ParseError);
+
+        client
+            .send(Message::Binary(b"{}".to_vec().into()))
+            .await
             .unwrap();
-            assert!(runtime.capabilities().filesystem_capture);
-            assert_eq!(runtime.capabilities().filesystem_materialize, !read_only);
-            let limits = TransferLimits {
-                max_entries: 1,
-                max_depth: 0,
-                max_file_bytes: 2,
-                max_total_bytes: 2,
-                // This checks dispatch and access, not storage latency. Allow
-                // shared-runner delays across the transfer's journal fsyncs.
-                max_duration_ms: MAX_TRANSFER_DURATION_MS,
-            };
-            let entries = vec![TransferEntry {
-                path: "".into(),
-                content: TransferContent::File {
-                    data: ByteChunk::from(vec![0, 255]),
-                    executable: true,
-                },
-            }];
-            let request = MaterializeParams {
-                destination: EnvironmentPath::new("binary").unwrap(),
-                entries: entries.clone(),
-                limits,
-                on_existing: TransferOnExisting::Replace,
-            };
-            let result = handle_data(
+        let binary = next_json(&mut client).await;
+        assert_eq!(binary["id"], Value::Null);
+        assert_eq!(error_kind(&binary), ProtocolErrorKind::InvalidRequest);
+
+        // A malformed notification and an unknown one: no answer at all.
+        send(
+            &mut client,
+            json!({"jsonrpc": "2.0", "method": "$/cancelRequest", "params": [1]}),
+        )
+        .await;
+        send(
+            &mut client,
+            json!({"jsonrpc": "2.0", "method": "x/unknown"}),
+        )
+        .await;
+        send(
+            &mut client,
+            json!({"jsonrpc": "2.0", "id": "after", "method": "nope/nothing"}),
+        )
+        .await;
+        let next = next_json(&mut client).await;
+        assert_eq!(next["id"], "after");
+        assert_eq!(error_kind(&next), ProtocolErrorKind::MethodNotFound);
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn params_are_decoded_strictly_and_name_the_field() {
+        let (_temp, runtime) = runtime();
+        let mut client = initialized(&runtime).await;
+        send(
+            &mut client,
+            json!({"jsonrpc": "2.0", "id": 9, "method": "env/getIdle", "params": {"unexpected": 1}}),
+        )
+        .await;
+        let response = next_json(&mut client).await;
+        assert_eq!(error_kind(&response), ProtocolErrorKind::InvalidParams);
+    }
+
+    /// Every data request in the manifest reaches a handler: none falls
+    /// through to `methodNotFound`.
+    #[tokio::test(flavor = "current_thread")]
+    async fn every_manifest_request_is_dispatched() {
+        use environment_protocol::{
+            handshake::Plane,
+            manifest::{self, Direction, MessageKind},
+        };
+        let (_temp, runtime) = runtime();
+        for spec in manifest::plane_methods(Plane::Data).filter(|spec| {
+            spec.kind == MessageKind::Request && spec.direction == Direction::ClientToServer
+        }) {
+            let result = dispatch::handle_request(
                 &runtime,
-                FS_MATERIALIZE_METHOD,
-                serde_json::to_value(request).unwrap(),
+                &RequestContext::detached(),
+                spec.name,
+                json!({"__unknownMember": true}),
             )
             .await;
-            if read_only {
-                assert_eq!(
-                    result.unwrap_err().code,
-                    EnvironmentProtocolErrorCode::CapabilityUnavailable
+            if let Err(error) = result {
+                assert_ne!(
+                    error.kind(),
+                    ProtocolErrorKind::MethodNotFound,
+                    "{} is not dispatched",
+                    spec.name
                 );
-            } else {
-                assert_eq!(result.unwrap()["bytes"], 2);
             }
-            let captured: CaptureResponse = serde_json::from_value(
-                handle_data(
-                    &runtime,
-                    FS_CAPTURE_METHOD,
-                    serde_json::to_value(CaptureParams {
-                        source: EnvironmentPath::new("binary").unwrap(),
-                        limits,
-                    })
-                    .unwrap(),
-                )
-                .await
-                .unwrap(),
+        }
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn requests_are_pipelined_and_abortable_waits_are_cancelled() {
+        let (_temp, runtime) = runtime();
+        let mut client = initialized(&runtime).await;
+        send(
+            &mut client,
+            json!({"jsonrpc": "2.0", "id": "start", "method": "process/start", "params": {
+                "processId": "quiet",
+                "command": {"argv": ["/bin/sh", "-c", "sleep 30"], "timeoutMs": 60000},
+            }}),
+        )
+        .await;
+        assert!(next_json(&mut client).await["result"]["pid"].is_u64());
+
+        send(
+            &mut client,
+            json!({"jsonrpc": "2.0", "id": "wait", "method": "process/read", "params": {
+                "processId": "quiet", "maxBytes": 1024, "waitMs": 30000, "returnOn": "exit",
+            }}),
+        )
+        .await;
+        send(
+            &mut client,
+            json!({"jsonrpc": "2.0", "id": "idle", "method": "env/getIdle"}),
+        )
+        .await;
+        let first = next_json(&mut client).await;
+        assert_eq!(
+            first["id"], "idle",
+            "a later request answers first: {first}"
+        );
+
+        send(
+            &mut client,
+            json!({"jsonrpc": "2.0", "method": "$/cancelRequest", "params": {"id": "wait"}}),
+        )
+        .await;
+        let cancelled = next_json(&mut client).await;
+        assert_eq!(cancelled["id"], "wait");
+        let error: ProtocolError = serde_json::from_value(cancelled["error"].clone()).unwrap();
+        assert_eq!(error, ProtocolError::cancelled());
+
+        send(
+            &mut client,
+            json!({"jsonrpc": "2.0", "id": "kill", "method": "process/terminate", "params": {"processId": "quiet", "signal": "kill"}}),
+        )
+        .await;
+        assert_eq!(next_json(&mut client).await["id"], "kill");
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn requests_beyond_the_concurrency_ceiling_are_busy() {
+        let (_temp, runtime) = runtime();
+        let mut client = initialized(&runtime).await;
+        send(
+            &mut client,
+            json!({"jsonrpc": "2.0", "id": "start", "method": "process/start", "params": {
+                "processId": "quiet",
+                "command": {"argv": ["/bin/sh", "-c", "sleep 30"], "timeoutMs": 60000},
+            }}),
+        )
+        .await;
+        next_json(&mut client).await;
+        let ceiling = runtime.limits().max_concurrent_requests;
+        for index in 0..=ceiling {
+            send(
+                &mut client,
+                json!({"jsonrpc": "2.0", "id": index, "method": "process/read", "params": {
+                    "processId": "quiet", "after": 0, "maxBytes": 0, "waitMs": 30000, "returnOn": "exit",
+                }}),
             )
-            .unwrap();
-            assert_eq!(captured.entries, entries);
+            .await;
         }
+        let busy = next_json(&mut client).await;
+        assert_eq!(busy["id"], ceiling);
+        let error: ProtocolError = serde_json::from_value(busy["error"].clone()).unwrap();
+        assert!(matches!(
+            error.data,
+            ErrorData::Busy {
+                reason: Some(BusyReason::RequestLimit),
+                ..
+            }
+        ));
+        send(
+            &mut client,
+            json!({"jsonrpc": "2.0", "method": "$/cancelRequest", "params": {"id": 0}}),
+        )
+        .await;
+        assert_eq!(next_json(&mut client).await["id"], 0);
+        send(
+            &mut client,
+            json!({"jsonrpc": "2.0", "id": "kill", "method": "process/terminate", "params": {"processId": "quiet", "signal": "kill"}}),
+        )
+        .await;
     }
-}
 
-#[cfg(all(test, any(target_os = "linux", target_os = "macos")))]
-#[path = "filesystem/transfer/tests.rs"]
-mod streaming_transfer_tests;
+    /// A cursor read whose connection drops is cancelled and consumes
+    /// nothing: the next connection's cursor read still sees every byte.
+    #[tokio::test(flavor = "current_thread")]
+    async fn a_dropped_connection_consumes_no_output() {
+        let (_temp, runtime) = runtime();
+        let mut first = initialized(&runtime).await;
+        send(
+            &mut first,
+            json!({"jsonrpc": "2.0", "id": 1, "method": "process/start", "params": {
+                "processId": "late",
+                "command": {"argv": ["/bin/sh", "-c", "printf early; sleep 1; printf late"], "timeoutMs": 60000},
+            }}),
+        )
+        .await;
+        next_json(&mut first).await;
+        send(
+            &mut first,
+            json!({"jsonrpc": "2.0", "id": 2, "method": "process/read", "params": {
+                "processId": "late", "maxBytes": 1024, "waitMs": 30000, "returnOn": "exit",
+            }}),
+        )
+        .await;
+        tokio::time::sleep(Duration::from_millis(200)).await;
+        drop(first);
+
+        tokio::time::sleep(Duration::from_millis(1500)).await;
+        let mut second = initialized(&runtime).await;
+        send(
+            &mut second,
+            json!({"jsonrpc": "2.0", "id": 3, "method": "process/read", "params": {
+                "processId": "late", "maxBytes": 1024, "waitMs": 10000, "returnOn": "exit",
+            }}),
+        )
+        .await;
+        let page = next_json(&mut second).await;
+        let text: String = page["result"]["output"]["chunks"]
+            .as_array()
+            .expect("chunks")
+            .iter()
+            .map(|chunk| {
+                let bytes: environment_protocol::bytes::ByteChunk =
+                    serde_json::from_value(chunk["data"].clone()).unwrap();
+                String::from_utf8(bytes.into_inner()).unwrap()
+            })
+            .collect();
+        assert_eq!(text, "earlylate", "{page}");
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn the_client_library_completes_the_handshake() {
+        let (_temp, runtime) = runtime();
+        let (client_io, server_io) = tokio::io::duplex(1 << 20);
+        tokio::spawn(serve_stream(runtime.clone(), server_io));
+        let options = environment_client::ConnectOptions::new(
+            ImplementationInfo::new("envd-server-test").unwrap(),
+        );
+        let (client, initialize) =
+            environment_client::DataClient::connect_initialized_over(client_io, options)
+                .await
+                .expect("initialized");
+        assert_eq!(&initialize.daemon_instance_id, runtime.instance_id());
+        client
+            .get_idle(&environment_protocol::data::idle::GetIdleParams {})
+            .await
+            .expect("idle");
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn shutdown_ends_listeners_and_connections() {
+        let (_temp, runtime) = runtime();
+        let mut client = initialized(&runtime).await;
+        runtime.shutdown().cancel();
+        let ended = tokio::time::timeout(Duration::from_secs(5), async {
+            loop {
+                match client.next().await {
+                    None | Some(Err(_)) | Some(Ok(Message::Close(_))) => break,
+                    Some(Ok(_)) => continue,
+                }
+            }
+        })
+        .await;
+        assert!(ended.is_ok(), "the daemon closed the connection");
+    }
+
+    #[cfg(unix)]
+    mod unix_listener {
+        use std::os::unix::fs::PermissionsExt as _;
+
+        use super::*;
+        use crate::test_support::runtime_with;
+
+        #[tokio::test(flavor = "current_thread")]
+        async fn serves_the_data_protocol_on_a_private_unix_socket() {
+            let socket_dir = tempfile::tempdir().unwrap();
+            // The parent does not exist yet: guest tmpfs paths start empty.
+            let socket = socket_dir.path().join("run").join("envd.sock");
+            let (_temp, runtime) = runtime_with(|config| {
+                config.listen = Some(ListenAddr::Unix(socket.clone()));
+            });
+            let server = tokio::spawn(run(runtime.clone()));
+            while !socket.exists() {
+                tokio::task::yield_now().await;
+            }
+            let mode = std::fs::metadata(&socket).unwrap().permissions().mode();
+            assert_eq!(mode & 0o777, 0o600);
+
+            let stream = tokio::net::UnixStream::connect(&socket).await.unwrap();
+            let (mut client, _) =
+                client_async_with_config("ws://envd/", stream, Some(websocket_config()))
+                    .await
+                    .unwrap();
+            client
+                .send(Message::Text(
+                    json!({"jsonrpc": "2.0", "id": 1, "method": "initialize", "params": initialize_params(ENVD_PROTOCOL_VERSION)})
+                        .to_string()
+                        .into(),
+                ))
+                .await
+                .unwrap();
+            let Some(Ok(Message::Text(reply))) = client.next().await else {
+                panic!("expected an initialize response");
+            };
+            let reply: Value = serde_json::from_str(reply.as_str()).unwrap();
+            assert_eq!(reply["id"], 1);
+            assert_eq!(reply["result"]["protocolVersion"], ENVD_PROTOCOL_VERSION);
+
+            runtime.shutdown().cancel();
+            let exit = tokio::time::timeout(Duration::from_secs(5), server)
+                .await
+                .expect("listener stops")
+                .unwrap();
+            assert_eq!(exit.status(), 0);
+        }
+
+        #[tokio::test(flavor = "current_thread")]
+        async fn stale_sockets_are_replaced_but_live_ones_and_files_are_not() {
+            let temp = tempfile::tempdir().unwrap();
+            let socket = temp.path().join("envd.sock");
+
+            drop(std::os::unix::net::UnixListener::bind(&socket).unwrap());
+            assert!(socket.exists(), "a dropped listener leaves its node behind");
+            let listener = bind_unix_listener(&socket).expect("stale socket replaced");
+
+            assert!(bind_unix_listener(&socket).is_err(), "live listener kept");
+            drop(listener);
+
+            let file = temp.path().join("not-a-socket");
+            std::fs::write(&file, b"data").unwrap();
+            assert!(bind_unix_listener(&file).is_err());
+            assert_eq!(std::fs::read(&file).unwrap(), b"data");
+        }
+
+        #[tokio::test(flavor = "current_thread")]
+        async fn a_live_socket_that_cannot_be_probed_is_left_in_place() {
+            let temp = tempfile::tempdir().unwrap();
+            let socket = temp.path().join("envd.sock");
+            let _live = std::os::unix::net::UnixListener::bind(&socket).unwrap();
+            // Without write permission, connect fails with EACCES rather than
+            // ECONNREFUSED (root bypasses this and sees the live listener).
+            std::fs::set_permissions(&socket, std::fs::Permissions::from_mode(0o000)).unwrap();
+
+            assert!(bind_unix_listener(&socket).is_err());
+            assert!(
+                std::fs::symlink_metadata(&socket).is_ok(),
+                "live socket kept"
+            );
+        }
+    }
+
+    #[test]
+    fn exit_statuses_are_distinct() {
+        let statuses = [
+            DaemonExit::Shutdown.status(),
+            DaemonExit::Failed(anyhow::anyhow!("x")).status(),
+            DaemonExit::Configuration(anyhow::anyhow!("x")).status(),
+            DaemonExit::Refused("x".to_owned()).status(),
+            DaemonExit::EnvironmentClosed.status(),
+            DaemonExit::Superseded {
+                daemon_public_key: "k".to_owned(),
+            }
+            .status(),
+        ];
+        let unique: std::collections::BTreeSet<_> = statuses.iter().collect();
+        assert_eq!(unique.len(), statuses.len());
+        assert_eq!(statuses, [0, 1, 2, 3, 4, 5]);
+    }
+}
diff --git a/crates/environment-daemon/src/upgrade.rs b/crates/environment-daemon/src/upgrade.rs
index 013539645..331dcfa30 100644
--- a/crates/environment-daemon/src/upgrade.rs
+++ b/crates/environment-daemon/src/upgrade.rs
@@ -6,21 +6,22 @@
 //! before it can replace the running executable.
 
 use std::{
-    collections::BTreeMap,
     io::{Read as _, Seek as _, Write as _},
     net::IpAddr,
     path::{Path, PathBuf},
     time::Duration,
 };
 
-use anyhow::{Context as _, Result, anyhow, bail};
+use anyhow::{Context as _, anyhow};
+use environment_protocol::{
+    bootstrap::{ArtifactSha256, BuildFacts, DiscoveryArtifact, DiscoveryDocument},
+    routes::{DISCOVERY_PATH, canonical_origin},
+};
 use flate2::read::GzDecoder;
 use futures_util::StreamExt as _;
 use reqwest::Url;
-use serde::Deserialize;
 use sha2::{Digest as _, Sha256};
 
-const DISCOVERY_PATH: &str = "/.well-known/lightspeed-envd";
 const MAX_DISCOVERY_BYTES: usize = 1_048_576;
 const MAX_ARCHIVE_BYTES: u64 = 256 * 1024 * 1024;
 const MAX_BINARY_BYTES: u64 = 256 * 1024 * 1024;
@@ -36,6 +37,10 @@ pub struct UpgradeRequest {
     /// challenge. Manual upgrades install whichever protocol the deployment
     /// currently publishes.
     pub expected_protocol: Option<u32>,
+    /// A protocol that installing would not change, refused as terminal:
+    /// an automatic upgrade after an unreadable first frame installs any
+    /// protocol but the daemon's own.
+    pub other_than: Option<u32>,
 }
 
 #[derive(Clone, Debug, PartialEq, Eq)]
@@ -46,38 +51,61 @@ pub struct InstalledBuild {
     pub path: PathBuf,
 }
 
-#[derive(Debug, Deserialize)]
-#[serde(rename_all = "camelCase")]
-struct DiscoveryDocument {
-    version: String,
-    git_sha: String,
-    protocol_version: u32,
-    artifacts: BTreeMap<String, DiscoveryArtifact>,
+/// Why an upgrade did not install anything.
+#[derive(Debug, thiserror::Error)]
+pub enum UpgradeError {
+    /// A network failure, timeout, HTTP 5xx or 429 while fetching the
+    /// discovery document or the archive: retry later.
+    #[error("{0:#}")]
+    Transient(anyhow::Error),
+    /// Everything else: an integrity failure (checksum, candidate build
+    /// facts, a discovery protocol other than the challenge's), a document
+    /// without this target, or a local install failure. Retrying cannot
+    /// help.
+    #[error("{0:#}")]
+    Terminal(anyhow::Error),
 }
 
-#[derive(Debug, Deserialize)]
-struct DiscoveryArtifact {
-    file: String,
-    sha256: String,
-    url: Option<String>,
+impl UpgradeError {
+    pub fn is_transient(&self) -> bool {
+        matches!(self, Self::Transient(_))
+    }
+}
+
+type UpgradeResult<T> = Result<T, UpgradeError>;
+
+fn terminal(error: impl Into<anyhow::Error>) -> UpgradeError {
+    UpgradeError::Terminal(error.into())
+}
+
+/// Classify a failed HTTP exchange: transport trouble and server-side
+/// statuses are transient, a client-side status is terminal.
+fn http_failure(error: reqwest::Error, context: String) -> UpgradeError {
+    let transient = match error.status() {
+        Some(status) => status.is_server_error() || status.as_u16() == 429,
+        None => true,
+    };
+    let error = anyhow::Error::new(error).context(context);
+    if transient {
+        UpgradeError::Transient(error)
+    } else {
+        UpgradeError::Terminal(error)
+    }
 }
 
-#[derive(Debug, Deserialize)]
-#[serde(rename_all = "camelCase")]
-struct CandidateBuild {
-    name: String,
-    version: String,
-    git_sha: String,
-    target: String,
-    protocol_version: u32,
+macro_rules! fail {
+    ($($arg:tt)*) => {
+        return Err(terminal(anyhow!($($arg)*)))
+    };
 }
 
 /// Resolve an explicit override or derive the deployment discovery endpoint
-/// from an outbound WebSocket gateway URL.
+/// from an outbound WebSocket gateway URL: its canonical origin, as HTTP,
+/// with `DISCOVERY_PATH`.
 pub fn resolve_discovery_url(
     gateway_url: Option<&str>,
     override_url: Option<&str>,
-) -> Result<String> {
+) -> anyhow::Result<String> {
     if let Some(url) = override_url {
         validate_discovery_url(url)?;
         return Ok(url.to_owned());
@@ -85,123 +113,133 @@ pub fn resolve_discovery_url(
     let gateway_url = gateway_url.ok_or_else(|| {
         anyhow!("upgrade needs LIGHTSPEED_ENVD_GATEWAY_URL or LIGHTSPEED_ENVD_DISCOVERY_URL")
     })?;
-    let mut url = Url::parse(gateway_url).context("parse environment gateway URL")?;
-    let http_scheme = match url.scheme() {
-        "wss" => "https",
-        "ws" => "http",
-        scheme => bail!("cannot derive discovery URL from gateway scheme {scheme}"),
+    if !gateway_url.starts_with("ws://") && !gateway_url.starts_with("wss://") {
+        anyhow::bail!("cannot derive a discovery URL from gateway URL {gateway_url}");
+    }
+    let origin = canonical_origin(gateway_url).context("parse environment gateway URL")?;
+    let resolved = match origin.as_str().strip_prefix("wss://") {
+        Some(authority) => format!("https://{authority}{DISCOVERY_PATH}"),
+        None => format!(
+            "http://{}{DISCOVERY_PATH}",
+            origin.as_str().trim_start_matches("ws://")
+        ),
     };
-    url.set_scheme(http_scheme)
-        .map_err(|_| anyhow!("derive discovery URL scheme"))?;
-    url.set_path(DISCOVERY_PATH);
-    url.set_query(None);
-    url.set_fragment(None);
-    let resolved = url.to_string();
     validate_discovery_url(&resolved)?;
     Ok(resolved)
 }
 
 /// Discovery and archive downloads require HTTPS. Plain HTTP exists only for
 /// loopback development and the local automatic-upgrade acceptance fixture.
-pub fn validate_discovery_url(value: &str) -> Result<()> {
+pub fn validate_discovery_url(value: &str) -> anyhow::Result<()> {
     validate_download_url(value, "discovery URL").map(|_| ())
 }
 
-pub async fn install(request: UpgradeRequest) -> Result<InstalledBuild> {
+pub async fn install(request: UpgradeRequest) -> UpgradeResult<InstalledBuild> {
     crate::install_crypto_provider();
-    validate_discovery_url(&request.discovery_url)?;
-    let client = http_client(request.ca_file.as_deref()).await?;
+    validate_discovery_url(&request.discovery_url).map_err(terminal)?;
+    let client = http_client(request.ca_file.as_deref())
+        .await
+        .map_err(terminal)?;
     let discovery = fetch_discovery(&client, &request.discovery_url).await?;
     if let Some(expected) = request.expected_protocol
         && discovery.protocol_version != expected
     {
-        bail!(
+        fail!(
             "discovery document {} advertises protocol {}, but the gateway challenged with protocol {expected}",
             request.discovery_url,
             discovery.protocol_version
         );
     }
-    validate_git_sha(&discovery.git_sha, "discovery gitSha")?;
-    let artifact = discovery.artifacts.get(&request.target).ok_or_else(|| {
-        anyhow!(
+    if request.other_than == Some(discovery.protocol_version) {
+        fail!(
+            "discovery document {} advertises protocol {}, which this daemon already speaks",
+            request.discovery_url,
+            discovery.protocol_version
+        );
+    }
+    validate_git_sha(&discovery.git_sha, "discovery gitSha").map_err(terminal)?;
+    let Some(artifact) = discovery.artifacts.get(&request.target) else {
+        fail!(
             "discovery document {} has no envd artifact for target {}",
             request.discovery_url,
             request.target
-        )
-    })?;
-    validate_artifact(artifact)?;
-    let artifact_url = artifact.url.as_deref().ok_or_else(|| {
-        anyhow!(
+        );
+    };
+    validate_artifact(artifact).map_err(terminal)?;
+    let Some(artifact_url) = artifact.url.as_deref() else {
+        fail!(
             "deployment discovery document {} has no public URL for target {}",
             request.discovery_url,
             request.target
-        )
-    })?;
-    let artifact_url = validate_download_url(artifact_url, "envd artifact URL")?;
+        );
+    };
+    let artifact_url =
+        validate_download_url(artifact_url, "envd artifact URL").map_err(terminal)?;
     if !artifact_url
         .path()
         .ends_with(&format!("/{}", artifact.file))
     {
-        bail!("envd artifact URL does not end with its declared filename");
+        fail!("envd artifact URL does not end with its declared filename");
     }
 
     let (mut archive_file, actual_sha) =
         download_archive(&client, &artifact_url, MAX_ARCHIVE_BYTES).await?;
     if actual_sha != artifact.sha256 {
-        bail!(
+        fail!(
             "envd archive checksum mismatch: expected {}, downloaded {actual_sha}",
             artifact.sha256
         );
     }
 
-    let parent = request.install_path.parent().ok_or_else(|| {
-        anyhow!(
+    let manual = || {
+        manual_install_command(
+            artifact_url.as_str(),
+            &artifact.sha256.to_hex(),
+            &request.install_path,
+        )
+    };
+    let Some(parent) = request.install_path.parent() else {
+        fail!(
             "envd executable has no parent directory: {}",
             request.install_path.display()
-        )
-    })?;
+        );
+    };
     let mut candidate = tempfile::Builder::new()
         .prefix(".lightspeed-envd-upgrade-")
         .tempfile_in(parent)
         .map_err(|error| {
-            anyhow!(
+            terminal(anyhow!(
                 "cannot write next to {}: {error}\n{}",
                 request.install_path.display(),
-                manual_install_command(
-                    artifact_url.as_str(),
-                    &artifact.sha256,
-                    &request.install_path
-                )
-            )
+                manual()
+            ))
         })?;
-    extract_binary(&mut archive_file, candidate.as_file_mut())?;
-    make_executable(candidate.path())?;
+    extract_binary(&mut archive_file, candidate.as_file_mut()).map_err(terminal)?;
+    make_executable(candidate.path()).map_err(terminal)?;
     candidate
         .as_file_mut()
         .sync_all()
-        .context("sync candidate envd executable")?;
+        .context("sync candidate envd executable")
+        .map_err(terminal)?;
     // Close the write handle before executing the candidate: Linux refuses
     // to run a file that is still open for writing (ETXTBSY). The path stays
     // reserved and is removed on every failure path.
     let candidate = candidate.into_temp_path();
 
-    let build = inspect_candidate(&candidate).await?;
-    verify_candidate(&build, &discovery, &request.target)?;
+    let build = inspect_candidate(&candidate).await.map_err(terminal)?;
+    verify_candidate(&build, &discovery, &request.target).map_err(terminal)?;
     candidate.persist(&request.install_path).map_err(|error| {
-        anyhow!(
+        terminal(anyhow!(
             "replace {} atomically: {}\n{}",
             request.install_path.display(),
             error.error,
-            manual_install_command(
-                artifact_url.as_str(),
-                &artifact.sha256,
-                &request.install_path
-            )
-        )
+            manual()
+        ))
     })?;
     std::fs::File::open(&request.install_path)
         .and_then(|installed| installed.sync_all())
-        .context("sync installed envd executable")?;
+        .context("sync installed envd executable")
+        .map_err(terminal)?;
 
     Ok(InstalledBuild {
         version: build.version,
@@ -211,7 +249,7 @@ pub async fn install(request: UpgradeRequest) -> Result<InstalledBuild> {
     })
 }
 
-async fn http_client(ca_file: Option<&Path>) -> Result<reqwest::Client> {
+async fn http_client(ca_file: Option<&Path>) -> anyhow::Result<reqwest::Client> {
     let mut builder = reqwest::Client::builder()
         .connect_timeout(Duration::from_secs(15))
         .read_timeout(Duration::from_secs(30))
@@ -223,7 +261,7 @@ async fn http_client(ca_file: Option<&Path>) -> Result<reqwest::Client> {
         let certificates = reqwest::tls::Certificate::from_pem_bundle(&pem)
             .with_context(|| format!("parse CA file {}", ca_file.display()))?;
         if certificates.is_empty() {
-            bail!("CA file {} holds no certificates", ca_file.display());
+            anyhow::bail!("CA file {} holds no certificates", ca_file.display());
         }
         for certificate in certificates {
             builder = builder.add_root_certificate(certificate);
@@ -232,79 +270,91 @@ async fn http_client(ca_file: Option<&Path>) -> Result<reqwest::Client> {
     builder.build().context("build envd upgrade HTTP client")
 }
 
-async fn fetch_discovery(client: &reqwest::Client, url: &str) -> Result<DiscoveryDocument> {
+/// Fetch and decode the discovery document. It is part of the frozen
+/// bootstrap surface: members this daemon does not know are ignored.
+async fn fetch_discovery(client: &reqwest::Client, url: &str) -> UpgradeResult<DiscoveryDocument> {
+    let context = || format!("fetch envd discovery document {url}");
     let response = client
         .get(url)
         .send()
         .await
-        .with_context(|| format!("fetch envd discovery document {url}"))?
-        .error_for_status()
-        .with_context(|| format!("fetch envd discovery document {url}"))?;
+        .and_then(reqwest::Response::error_for_status)
+        .map_err(|error| http_failure(error, context()))?;
     if response
         .content_length()
         .is_some_and(|length| length > MAX_DISCOVERY_BYTES as u64)
     {
-        bail!("envd discovery document exceeds {MAX_DISCOVERY_BYTES} bytes");
+        fail!("envd discovery document exceeds {MAX_DISCOVERY_BYTES} bytes");
     }
     let mut bytes = Vec::new();
     let mut stream = response.bytes_stream();
     while let Some(chunk) = stream.next().await {
-        let chunk = chunk.context("read envd discovery document")?;
+        let chunk = chunk.map_err(|error| http_failure(error, context()))?;
         if bytes.len().saturating_add(chunk.len()) > MAX_DISCOVERY_BYTES {
-            bail!("envd discovery document exceeds {MAX_DISCOVERY_BYTES} bytes");
+            fail!("envd discovery document exceeds {MAX_DISCOVERY_BYTES} bytes");
         }
         bytes.extend_from_slice(&chunk);
     }
-    serde_json::from_slice(&bytes).context("decode envd discovery document")
+    serde_json::from_slice(&bytes)
+        .context("decode envd discovery document")
+        .map_err(terminal)
 }
 
 async fn download_archive(
     client: &reqwest::Client,
     url: &Url,
     max_bytes: u64,
-) -> Result<(tempfile::NamedTempFile, String)> {
+) -> UpgradeResult<(tempfile::NamedTempFile, ArtifactSha256)> {
+    let context = || format!("download envd archive {url}");
     let response = client
         .get(url.clone())
         .send()
         .await
-        .with_context(|| format!("download envd archive {url}"))?
-        .error_for_status()
-        .with_context(|| format!("download envd archive {url}"))?;
+        .and_then(reqwest::Response::error_for_status)
+        .map_err(|error| http_failure(error, context()))?;
     if response
         .content_length()
         .is_some_and(|length| length > max_bytes)
     {
-        bail!("envd archive exceeds {max_bytes} bytes");
+        fail!("envd archive exceeds {max_bytes} bytes");
     }
-    let mut file = tempfile::NamedTempFile::new().context("create temporary envd archive")?;
+    let mut file = tempfile::NamedTempFile::new()
+        .context("create temporary envd archive")
+        .map_err(terminal)?;
     let mut stream = response.bytes_stream();
     let mut size = 0_u64;
     let mut sha = Sha256::new();
     while let Some(chunk) = stream.next().await {
-        let chunk = chunk.context("read envd archive response")?;
-        size = size
-            .checked_add(chunk.len() as u64)
-            .ok_or_else(|| anyhow!("envd archive size overflow"))?;
+        let chunk = chunk.map_err(|error| http_failure(error, context()))?;
+        size = size.saturating_add(chunk.len() as u64);
         if size > max_bytes {
-            bail!("envd archive exceeds {max_bytes} bytes");
+            fail!("envd archive exceeds {max_bytes} bytes");
         }
         sha.update(&chunk);
         file.write_all(&chunk)
-            .context("write temporary envd archive")?;
+            .context("write temporary envd archive")
+            .map_err(terminal)?;
     }
     file.as_file_mut()
         .sync_all()
-        .context("sync temporary envd archive")?;
+        .context("sync temporary envd archive")
+        .map_err(terminal)?;
     file.as_file_mut()
         .rewind()
-        .context("rewind temporary envd archive")?;
-    Ok((file, hex::encode(sha.finalize())))
+        .context("rewind temporary envd archive")
+        .map_err(terminal)?;
+    let digest: [u8; 32] = sha
+        .finalize()
+        .as_slice()
+        .try_into()
+        .expect("sha256 is 32 bytes");
+    Ok((file, ArtifactSha256::from_bytes(digest)))
 }
 
 fn extract_binary(
     archive_file: &mut tempfile::NamedTempFile,
     destination: &mut std::fs::File,
-) -> Result<()> {
+) -> anyhow::Result<()> {
     archive_file
         .as_file_mut()
         .rewind()
@@ -316,27 +366,27 @@ fn extract_binary(
         let mut entry = entry.context("read envd archive entry")?;
         let path = entry.path().context("read envd archive path")?;
         if path.as_ref() != Path::new("lightspeed-envd") {
-            bail!("envd archive contains unexpected entry {}", path.display());
+            anyhow::bail!("envd archive contains unexpected entry {}", path.display());
         }
         if found {
-            bail!("envd archive contains lightspeed-envd more than once");
+            anyhow::bail!("envd archive contains lightspeed-envd more than once");
         }
         if !entry.header().entry_type().is_file() {
-            bail!("envd archive entry lightspeed-envd is not a regular file");
+            anyhow::bail!("envd archive entry lightspeed-envd is not a regular file");
         }
         let size = entry.size();
         if size == 0 || size > MAX_BINARY_BYTES {
-            bail!("envd executable has invalid size {size}");
+            anyhow::bail!("envd executable has invalid size {size}");
         }
         let copied = std::io::copy(&mut entry.by_ref().take(MAX_BINARY_BYTES + 1), destination)
             .context("extract envd executable")?;
         if copied != size {
-            bail!("envd executable size differs from its archive header");
+            anyhow::bail!("envd executable size differs from its archive header");
         }
         found = true;
     }
     if !found {
-        bail!("envd archive does not contain lightspeed-envd");
+        anyhow::bail!("envd archive does not contain lightspeed-envd");
     }
     destination
         .flush()
@@ -344,18 +394,20 @@ fn extract_binary(
 }
 
 #[cfg(unix)]
-fn make_executable(path: &Path) -> Result<()> {
+fn make_executable(path: &Path) -> anyhow::Result<()> {
     use std::os::unix::fs::PermissionsExt as _;
     std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o755))
         .with_context(|| format!("make candidate executable {}", path.display()))
 }
 
 #[cfg(not(unix))]
-fn make_executable(_path: &Path) -> Result<()> {
-    bail!("envd self-upgrade is supported only on Unix")
+fn make_executable(_path: &Path) -> anyhow::Result<()> {
+    anyhow::bail!("envd self-upgrade is supported only on Unix")
 }
 
-async fn inspect_candidate(path: &Path) -> Result<CandidateBuild> {
+/// Run the candidate's `--print-build`, decoded as the frozen
+/// [`BuildFacts`].
+async fn inspect_candidate(path: &Path) -> anyhow::Result<BuildFacts> {
     let output = tokio::time::timeout(
         CANDIDATE_TIMEOUT,
         tokio::process::Command::new(path)
@@ -367,7 +419,7 @@ async fn inspect_candidate(path: &Path) -> Result<CandidateBuild> {
     .context("candidate envd --print-build timed out")?
     .with_context(|| format!("run candidate envd {}", path.display()))?;
     if !output.status.success() {
-        bail!(
+        anyhow::bail!(
             "candidate envd --print-build exited with {}: {}",
             output.status,
             String::from_utf8_lossy(&output.stderr).trim()
@@ -377,38 +429,39 @@ async fn inspect_candidate(path: &Path) -> Result<CandidateBuild> {
 }
 
 fn verify_candidate(
-    build: &CandidateBuild,
+    build: &BuildFacts,
     discovery: &DiscoveryDocument,
     target: &str,
-) -> Result<()> {
-    if build.name != "lightspeed-envd" {
-        bail!(
-            "candidate build name is {}, expected lightspeed-envd",
-            build.name
+) -> anyhow::Result<()> {
+    if build.name != crate::DAEMON_NAME {
+        anyhow::bail!(
+            "candidate build name is {}, expected {}",
+            build.name,
+            crate::DAEMON_NAME
         );
     }
     if build.version != discovery.version {
-        bail!(
+        anyhow::bail!(
             "candidate version {} differs from discovery version {}",
             build.version,
             discovery.version
         );
     }
     if build.git_sha != discovery.git_sha {
-        bail!(
+        anyhow::bail!(
             "candidate gitSha {} differs from discovery gitSha {}",
             build.git_sha,
             discovery.git_sha
         );
     }
     if build.target != target {
-        bail!(
+        anyhow::bail!(
             "candidate target {} differs from requested target {target}",
             build.target
         );
     }
     if build.protocol_version != discovery.protocol_version {
-        bail!(
+        anyhow::bail!(
             "candidate protocol {} differs from discovery protocol {}",
             build.protocol_version,
             discovery.protocol_version
@@ -417,55 +470,47 @@ fn verify_candidate(
     Ok(())
 }
 
-fn validate_artifact(artifact: &DiscoveryArtifact) -> Result<()> {
+fn validate_artifact(artifact: &DiscoveryArtifact) -> anyhow::Result<()> {
     if artifact.file.is_empty()
         || Path::new(&artifact.file)
             .file_name()
             .and_then(|name| name.to_str())
             != Some(artifact.file.as_str())
     {
-        bail!("envd artifact has an unsafe filename");
+        anyhow::bail!("envd artifact has an unsafe filename");
     }
     if !artifact.file.ends_with(".tar.gz") {
-        bail!("envd artifact is not a .tar.gz archive");
-    }
-    if artifact.sha256.len() != 64
-        || !artifact
-            .sha256
-            .bytes()
-            .all(|byte| byte.is_ascii_hexdigit() && !byte.is_ascii_uppercase())
-    {
-        bail!("envd artifact has an invalid SHA-256 checksum");
+        anyhow::bail!("envd artifact is not a .tar.gz archive");
     }
     Ok(())
 }
 
-fn validate_git_sha(value: &str, label: &str) -> Result<()> {
+fn validate_git_sha(value: &str, label: &str) -> anyhow::Result<()> {
     if value.len() != 40
         || !value
             .bytes()
             .all(|byte| byte.is_ascii_hexdigit() && !byte.is_ascii_uppercase())
     {
-        bail!("{label} must be a full lowercase hexadecimal commit");
+        anyhow::bail!("{label} must be a full lowercase hexadecimal commit");
     }
     Ok(())
 }
 
-fn validate_download_url(value: &str, label: &str) -> Result<Url> {
+fn validate_download_url(value: &str, label: &str) -> anyhow::Result<Url> {
     let url = Url::parse(value).with_context(|| format!("parse {label}"))?;
     if !url.username().is_empty() || url.password().is_some() {
-        bail!("{label} must not contain credentials");
+        anyhow::bail!("{label} must not contain credentials");
     }
     if url.fragment().is_some() {
-        bail!("{label} must not contain a fragment");
+        anyhow::bail!("{label} must not contain a fragment");
     }
     match url.scheme() {
         "https" => {}
         "http" if is_loopback(&url) => {}
-        _ => bail!("{label} must use https (or http toward loopback)"),
+        _ => anyhow::bail!("{label} must use https (or http toward loopback)"),
     }
     if url.host_str().is_none() {
-        bail!("{label} has no host");
+        anyhow::bail!("{label} has no host");
     }
     Ok(url)
 }
@@ -474,6 +519,7 @@ fn is_loopback(url: &Url) -> bool {
     let Some(host) = url.host_str() else {
         return false;
     };
+    let host = host.trim_start_matches('[').trim_end_matches(']');
     host == "localhost"
         || host
             .parse::<IpAddr>()
@@ -539,7 +585,7 @@ mod tests {
             release_info::TARGET
         );
         let archive = envd_archive(script.as_bytes());
-        let archive_sha = hex::encode(Sha256::digest(&archive));
+        let archive_sha = environment_protocol::bytes::encode_hex(&Sha256::digest(&archive));
         let (origin, server) = serve_upgrade_with_document(archive, |origin| {
             discovery_json(origin, &archive_sha, &git_sha, 3)
         })
@@ -551,6 +597,7 @@ mod tests {
             install_path: install_path.clone(),
             target: release_info::TARGET.to_owned(),
             expected_protocol: Some(3),
+            other_than: None,
         })
         .await
         .expect("install");
@@ -581,10 +628,12 @@ mod tests {
             install_path: install_path.clone(),
             target: release_info::TARGET.to_owned(),
             expected_protocol: Some(3),
+            other_than: None,
         })
         .await
         .expect_err("protocol mismatch");
         server.abort();
+        assert!(!error.is_transient());
         assert!(
             error
                 .to_string()
@@ -596,6 +645,36 @@ mod tests {
         );
     }
 
+    #[cfg(unix)]
+    #[tokio::test(flavor = "current_thread")]
+    async fn an_upgrade_to_the_daemons_own_protocol_is_refused() {
+        let temp = tempfile::tempdir().expect("tempdir");
+        let install_path = temp.path().join("lightspeed-envd");
+        std::fs::write(&install_path, b"old envd").expect("old executable");
+        let git_sha = "d".repeat(40);
+        let archive = envd_archive(b"#!/bin/sh\nexit 1\n");
+        let (origin, server) = serve_upgrade_with_document(archive, |origin| {
+            discovery_json(origin, &"0".repeat(64), &git_sha, 3)
+        })
+        .await;
+        let error = install(UpgradeRequest {
+            discovery_url: format!("{origin}/envd.json"),
+            ca_file: None,
+            install_path: install_path.clone(),
+            target: release_info::TARGET.to_owned(),
+            expected_protocol: None,
+            other_than: Some(3),
+        })
+        .await
+        .expect_err("own protocol");
+        server.abort();
+        assert!(!error.is_transient(), "reinstalling cannot help");
+        assert_eq!(
+            std::fs::read(&install_path).expect("old executable"),
+            b"old envd"
+        );
+    }
+
     #[cfg(unix)]
     #[tokio::test(flavor = "current_thread")]
     async fn checksum_mismatch_leaves_the_executable_untouched() {
@@ -614,10 +693,12 @@ mod tests {
             install_path: install_path.clone(),
             target: release_info::TARGET.to_owned(),
             expected_protocol: Some(4),
+            other_than: None,
         })
         .await
         .expect_err("checksum mismatch");
         server.await.expect("server");
+        assert!(!error.is_transient(), "integrity failures are terminal");
         assert!(error.to_string().contains("archive checksum mismatch"));
         assert_eq!(
             std::fs::read(&install_path).expect("old executable"),
@@ -625,6 +706,51 @@ mod tests {
         );
     }
 
+    #[tokio::test(flavor = "current_thread")]
+    async fn server_errors_are_transient_and_client_errors_terminal() {
+        for (status, transient) in [(503, true), (429, true), (404, false)] {
+            let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+                .await
+                .expect("listener");
+            let origin = format!("http://{}", listener.local_addr().expect("address"));
+            let server = tokio::spawn(async move {
+                use tokio::io::{AsyncReadExt as _, AsyncWriteExt as _};
+                let (mut socket, _) = listener.accept().await.expect("accept");
+                let mut request = vec![0_u8; 4096];
+                let _ = socket.read(&mut request).await;
+                let response = format!(
+                    "HTTP/1.1 {status} Status\r\nContent-Length: 0\r\nConnection: close\r\n\r\n"
+                );
+                socket.write_all(response.as_bytes()).await.expect("write");
+            });
+            let temp = tempfile::tempdir().expect("tempdir");
+            let error = install(UpgradeRequest {
+                discovery_url: format!("{origin}/envd.json"),
+                ca_file: None,
+                install_path: temp.path().join("lightspeed-envd"),
+                target: release_info::TARGET.to_owned(),
+                expected_protocol: Some(3),
+                other_than: None,
+            })
+            .await
+            .expect_err("no document");
+            server.await.expect("server");
+            assert_eq!(error.is_transient(), transient, "HTTP {status}: {error}");
+        }
+
+        let unreachable = install(UpgradeRequest {
+            discovery_url: "http://127.0.0.1:9/envd.json".to_owned(),
+            ca_file: None,
+            install_path: PathBuf::from("/nonexistent/lightspeed-envd"),
+            target: release_info::TARGET.to_owned(),
+            expected_protocol: None,
+            other_than: None,
+        })
+        .await
+        .expect_err("nothing listens");
+        assert!(unreachable.is_transient(), "{unreachable}");
+    }
+
     #[cfg(unix)]
     fn envd_archive(bytes: &[u8]) -> Vec<u8> {
         use flate2::{Compression, write::GzEncoder};
diff --git a/crates/environment-daemon/tests/client_round_trip.rs b/crates/environment-daemon/tests/client_round_trip.rs
new file mode 100644
index 000000000..e7991405e
--- /dev/null
+++ b/crates/environment-daemon/tests/client_round_trip.rs
@@ -0,0 +1,497 @@
+//! envd's data plane driven end to end by its real consumers: the client
+//! library over envd's own connection loop, the tools' data conformance
+//! suite, the tools' transfer orchestration against a blob store, and the
+//! builtin file tools over a remote environment.
+
+use std::{
+    os::unix::fs::PermissionsExt,
+    path::{Path, PathBuf},
+    sync::{
+        Arc,
+        atomic::{AtomicBool, AtomicUsize, Ordering},
+    },
+};
+
+use environment_client::{ClientError, ConnectOptions, DataClient};
+use environment_daemon::{
+    DaemonRuntime,
+    config::DaemonConfig,
+    dispatch::{RequestContext, handle_request},
+    server,
+};
+use environment_protocol::{
+    data::transfer::{TransferOnExisting, TransferPhase},
+    handshake::ImplementationInfo,
+    jsonrpc::Response,
+    paths::EnvironmentPath,
+};
+use harness::storage::BlobStore;
+use serde_json::json;
+use tools::{
+    builtin::{
+        BuiltinTool, BuiltinToolContext, BuiltinToolOperation as Op, BuiltinToolSurface as Surface,
+    },
+    environment_protocol::{RemoteEnvironmentConnection, conformance},
+    transfer,
+};
+
+fn daemon_config(root: &Path, state_dir: PathBuf) -> DaemonConfig {
+    DaemonConfig {
+        listen: None,
+        cwd: root.to_path_buf(),
+        fs_root: root.to_path_buf(),
+        state_dir,
+        read_only_fs: false,
+        registration: None,
+        scrubbed_env: Vec::new(),
+    }
+}
+
+/// A daemon over a fresh root, its state dir beside the root, and an
+/// initialized client connected to it through the real connection loop.
+struct Daemon {
+    _temp: tempfile::TempDir,
+    base: PathBuf,
+    root: PathBuf,
+    client: DataClient,
+}
+
+impl Daemon {
+    async fn start() -> Self {
+        let temp = tempfile::tempdir().expect("tempdir");
+        let base = temp.path().canonicalize().expect("canonical temp");
+        let root = base.join("root");
+        std::fs::create_dir_all(&root).expect("root");
+        let runtime =
+            DaemonRuntime::new(daemon_config(&root, base.join("state"))).expect("runtime");
+        let (client_io, server_io) = tokio::io::duplex(1 << 20);
+        tokio::spawn(server::serve_stream(runtime, server_io));
+        let options =
+            ConnectOptions::new(ImplementationInfo::new("envd-round-trip-test").expect("name"));
+        let (client, _) = DataClient::connect_initialized_over(client_io, options)
+            .await
+            .expect("initialized");
+        Self {
+            _temp: temp,
+            base,
+            root,
+            client,
+        }
+    }
+
+    fn path(&self, relative: &str) -> EnvironmentPath {
+        let path = if relative.is_empty() {
+            self.root.clone()
+        } else {
+            self.root.join(relative)
+        };
+        EnvironmentPath::new(path.to_str().expect("UTF-8 temp path")).expect("environment path")
+    }
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn envd_passes_the_data_conformance_suite() {
+    let daemon = Daemon::start().await;
+    let outside = daemon.base.join("outside");
+    std::fs::create_dir_all(&outside).expect("outside");
+    let mut suite = conformance::DataConformance::new(daemon.client.clone(), daemon.path(""));
+    suite.outside_root =
+        Some(EnvironmentPath::new(outside.to_str().expect("UTF-8")).expect("outside path"));
+    let report = conformance::run(&suite).await;
+    if let Err(failure) = report.into_result() {
+        panic!("{failure}");
+    }
+}
+
+/// A VFS tree materialized into envd and captured back is the same tree;
+/// a repeat reuses the bytes already there, and capturing into an empty
+/// store moves them.
+#[tokio::test(flavor = "current_thread")]
+async fn vfs_trees_round_trip_through_materialize_and_capture() {
+    let daemon = Daemon::start().await;
+    let cas = tempfile::tempdir().expect("cas");
+    let store = store_fs::FsBlobStore::open(cas.path())
+        .await
+        .expect("store");
+    // Larger than one content chunk, so content moves in several writes.
+    let size = 5 * 1024 * 1024 + 7;
+    let content: Vec<u8> = (0..size).map(|index| (index % 251) as u8).collect();
+    let blob = store.put_bytes(content.clone()).await.expect("blob");
+    let mut directory = vfs::VfsDirectory::default();
+    directory.entries.insert(
+        "run".into(),
+        vfs::VfsEntry::File(vfs::VfsFile {
+            blob_ref: blob.clone(),
+            size_bytes: size as u64,
+            media_type: None,
+            executable: true,
+        }),
+    );
+    directory.entries.insert(
+        "empty".into(),
+        vfs::VfsEntry::Directory(vfs::VfsDirectory::default()),
+    );
+    let selection = vfs::VfsEntry::Directory(directory);
+    std::fs::write(daemon.root.join("sibling"), b"preserved").expect("sibling");
+
+    let first = transfer::materialize(
+        &daemon.client,
+        &store,
+        "first",
+        &selection,
+        daemon.path("selected"),
+        TransferOnExisting::Replace,
+    )
+    .await
+    .expect("materialize");
+    assert_eq!(first.phase, TransferPhase::Complete);
+    assert_eq!(first.total_bytes, size as u64);
+    assert_eq!(first.transferred_bytes, size as u64);
+    assert_eq!(first.reused_bytes, 0);
+    let run = daemon.root.join("selected/run");
+    assert_eq!(std::fs::read(&run).expect("run"), content);
+    assert_eq!(
+        std::fs::metadata(&run).expect("run").permissions().mode() & 0o111,
+        0o111
+    );
+    assert!(daemon.root.join("selected/empty").is_dir());
+
+    let again = transfer::materialize(
+        &daemon.client,
+        &store,
+        "again",
+        &selection,
+        daemon.path("selected"),
+        TransferOnExisting::Replace,
+    )
+    .await
+    .expect("materialize again");
+    assert_eq!(again.transferred_bytes, 0);
+    assert_eq!(again.reused_bytes, size as u64);
+
+    let captured = transfer::capture(
+        &daemon.client,
+        &store,
+        None,
+        "capture-known",
+        daemon.path("selected"),
+    )
+    .await
+    .expect("capture");
+    assert_eq!(captured.entry, selection);
+    assert_eq!(captured.status.transferred_bytes, 0);
+
+    let empty_cas = tempfile::tempdir().expect("empty cas");
+    let empty_store = store_fs::FsBlobStore::open(empty_cas.path())
+        .await
+        .expect("empty store");
+    let captured = transfer::capture(
+        &daemon.client,
+        &empty_store,
+        None,
+        "capture-missing",
+        daemon.path("selected"),
+    )
+    .await
+    .expect("capture into an empty store");
+    assert_eq!(captured.entry, selection);
+    assert_eq!(captured.status.transferred_bytes, size as u64);
+    assert!(empty_store.has_blob(&blob).await.expect("has blob"));
+    assert_eq!(
+        std::fs::read(daemon.root.join("sibling")).expect("sibling"),
+        b"preserved"
+    );
+}
+
+/// A client whose every request is dispatched straight into `runtime`,
+/// recording the largest frame either way, and able to lose the response
+/// of the next `transfer/commit` after the daemon acted on it.
+fn in_process_client(runtime: DaemonRuntime) -> (DataClient, Arc<AtomicUsize>, Arc<AtomicBool>) {
+    let largest = Arc::new(AtomicUsize::new(0));
+    let lose_commit = Arc::new(AtomicBool::new(false));
+    let initialize = runtime.initialize_response();
+    let client = DataClient::in_process(initialize, {
+        let largest = largest.clone();
+        let lose_commit = lose_commit.clone();
+        move |request| {
+            let runtime = runtime.clone();
+            let largest = largest.clone();
+            let lose_commit = lose_commit.clone();
+            Box::pin(async move {
+                largest.fetch_max(request.to_text().len(), Ordering::Relaxed);
+                let result = handle_request(
+                    &runtime,
+                    &RequestContext::detached(),
+                    &request.method,
+                    request.params.clone(),
+                )
+                .await;
+                let response = match result {
+                    Ok(reply) => {
+                        let response = Response::success(request.id.clone(), &reply.value);
+                        if let Some(on_written) = reply.on_written {
+                            on_written();
+                        }
+                        response
+                    }
+                    Err(error) => Response::failure(Some(request.id.clone()), error),
+                };
+                if request.method == "transfer/commit" && lose_commit.swap(false, Ordering::Relaxed)
+                {
+                    return Err(ClientError::Transport("response lost".to_owned()));
+                }
+                largest.fetch_max(response.to_text().len(), Ordering::Relaxed);
+                Ok(response)
+            })
+        }
+    });
+    (client, largest, lose_commit)
+}
+
+/// The builtin `write_file` (from a blob reference) and `reference` tools
+/// move large binary files through bounded transfer chunks on every tool
+/// surface; a retried operation answers its first receipt, even after the
+/// source changed, the file was edited, or the commit response was lost.
+#[tokio::test(flavor = "current_thread")]
+async fn blob_file_tools_stream_and_keep_receipts_across_retries() {
+    for surface in [
+        Surface::Canonical,
+        Surface::CodexLike,
+        Surface::ClaudeCodeLike,
+    ] {
+        let temp = tempfile::tempdir().expect("tempdir");
+        let base = temp.path().canonicalize().expect("canonical temp");
+        let root = base.join("root");
+        std::fs::create_dir_all(&root).expect("root");
+        let runtime =
+            DaemonRuntime::new(daemon_config(&root, base.join("state"))).expect("runtime");
+        let cas = tempfile::tempdir().expect("cas");
+        let store = Arc::new(
+            store_fs::FsBlobStore::open(cas.path())
+                .await
+                .expect("store"),
+        );
+        // Larger than the daemon's content chunk and its whole-file read ceiling.
+        let size = 9 * 1024 * 1024 + 7;
+        let content = store.put_bytes(vec![0x83; size]).await.expect("blob");
+        let (client, largest, lose_commit) = in_process_client(runtime);
+        let (_, context) = RemoteEnvironmentConnection::new(client)
+            .with_cwd(tools::fs::FsPath::new(root.to_str().expect("UTF-8")).expect("cwd"))
+            .into_contexts(store.clone());
+        let context = context.with_environment_id("test-env");
+        let key = if surface == Surface::ClaudeCodeLike {
+            "file_path"
+        } else {
+            "path"
+        };
+        let write = BuiltinTool::environment(Op::WriteFile, surface);
+        let capture = BuiltinTool::environment(Op::Reference, surface);
+
+        let writer = context.clone().with_operation_id("write-binary");
+        let output = write
+            .invoke_json(
+                BuiltinToolContext::Environment(&writer),
+                json!({key: "nested/source.bin", "content_ref": content}),
+            )
+            .await
+            .expect("write from reference");
+        assert_eq!(output.output_json["bytes_written"], size);
+        assert_eq!(output.output_json["receipt"]["total_bytes"], size);
+        let source = root.join("nested/source.bin");
+        assert_eq!(
+            std::fs::metadata(&source).expect("written").len(),
+            size as u64
+        );
+
+        let capture_cas = tempfile::tempdir().expect("capture cas");
+        let capture_store = Arc::new(
+            store_fs::FsBlobStore::open(capture_cas.path())
+                .await
+                .expect("capture store"),
+        );
+        let mut capture_context = context.clone().with_operation_id("capture-binary");
+        capture_context.blobs = capture_store.clone();
+        let captured = capture
+            .invoke_json(
+                BuiltinToolContext::Environment(&capture_context),
+                json!({"path": "nested/source.bin"}),
+            )
+            .await
+            .expect("capture");
+        assert_eq!(captured.output_json["content_ref"], content.to_string());
+        assert_eq!(captured.output_json["byte_len"], size);
+        assert_eq!(captured.output_json["source"]["id"], "test-env");
+        assert_eq!(captured.attachments.len(), 1);
+        assert_eq!(
+            capture_store
+                .read_blob_range(&content, size as u64 - 7, 7)
+                .await
+                .expect("captured tail"),
+            vec![0x83; 7]
+        );
+
+        std::fs::write(&source, b"changed live file").expect("change source");
+        let changed = capture
+            .invoke_json(
+                BuiltinToolContext::Environment(&capture_context),
+                json!({"path": "nested/source.bin"}),
+            )
+            .await
+            .expect("retry after change");
+        assert_eq!(
+            changed.output_json, captured.output_json,
+            "a retried capture answers the version it first captured"
+        );
+        std::fs::remove_file(&source).expect("remove source");
+        let deleted = capture
+            .invoke_json(
+                BuiltinToolContext::Environment(&capture_context),
+                json!({"path": "nested/source.bin"}),
+            )
+            .await
+            .expect("retry after delete");
+        assert_eq!(
+            deleted.output_json, captured.output_json,
+            "a completed capture never revisits the live path"
+        );
+
+        // A lost commit response leaves the write's receipt to answer the retry.
+        let result = root.join("result.bin");
+        std::fs::write(&result, b"original").expect("result");
+        std::fs::set_permissions(&result, std::fs::Permissions::from_mode(0o751)).expect("mode");
+        let writer = context.clone().with_operation_id("lost-write-receipt");
+        lose_commit.store(true, Ordering::Relaxed);
+        assert!(
+            write
+                .invoke_json(
+                    BuiltinToolContext::Environment(&writer),
+                    json!({key: "result.bin", "content_ref": content}),
+                )
+                .await
+                .is_err()
+        );
+        assert_eq!(
+            std::fs::metadata(&result)
+                .expect("result")
+                .permissions()
+                .mode()
+                & 0o777,
+            0o751
+        );
+        std::fs::write(&result, b"later local edit").expect("edit");
+        let retry = write
+            .invoke_json(
+                BuiltinToolContext::Environment(&writer),
+                json!({key: "result.bin", "content_ref": content}),
+            )
+            .await
+            .expect("retry the write");
+        assert_eq!(retry.output_json["receipt"]["total_bytes"], size);
+        assert_eq!(std::fs::read(&result).expect("result"), b"later local edit");
+
+        std::fs::create_dir(root.join("directory")).expect("directory");
+        std::fs::write(root.join("directory/keep"), b"keep").expect("keep");
+        let writer = context.clone().with_operation_id("reject-directory-write");
+        assert!(
+            write
+                .invoke_json(
+                    BuiltinToolContext::Environment(&writer),
+                    json!({key: "directory", "content_ref": content}),
+                )
+                .await
+                .is_err()
+        );
+        assert_eq!(
+            std::fs::read(root.join("directory/keep")).expect("keep"),
+            b"keep"
+        );
+        let reader = context
+            .clone()
+            .with_operation_id("reject-directory-capture");
+        assert!(
+            capture
+                .invoke_json(
+                    BuiltinToolContext::Environment(&reader),
+                    json!({"path": "directory"}),
+                )
+                .await
+                .is_err()
+        );
+        assert!(
+            largest.load(Ordering::Relaxed) < 8 * 1024 * 1024,
+            "large binary transfers move in bounded chunks"
+        );
+    }
+}
+
+/// Skill discovery over envd's per-root scans: installer layouts under two
+/// roots, per-root fingerprint caching, edits that do not change a skill's
+/// metadata, and a malformed skill reported as a warning naming its root.
+#[tokio::test(flavor = "current_thread")]
+async fn skill_discovery_reads_installer_layouts_per_root() {
+    use tools::skills::environment::{
+        apply_cached_fingerprints, environment_skill_catalog, environment_skill_scan_query,
+    };
+    let daemon = Daemon::start().await;
+    let project_root = daemon.root.join("project/.agents/skills");
+    let home_root = daemon.root.join("home/.codex/skills");
+    let review = project_root.join("review");
+    for directory in [&review, &home_root.join("copy")] {
+        std::fs::create_dir_all(directory).expect("skill directory");
+    }
+    let doc = "---\nname: review\ndescription: >-\n  Review code\n  carefully.\n---\nbody one";
+    std::fs::write(review.join("SKILL.md"), doc).expect("review");
+    std::fs::write(home_root.join("copy/SKILL.md"), doc).expect("copy");
+    let config = harness::EnvironmentSkillsConfig {
+        roots: Some(vec![
+            project_root.to_string_lossy().into_owned(),
+            home_root.to_string_lossy().into_owned(),
+        ]),
+    };
+    let cwd = daemon.root.join("project");
+    let mut query = environment_skill_scan_query(&config, cwd.to_str(), None).expect("query");
+
+    let first = daemon.client.scan(&query).await.expect("scan");
+    let catalog = environment_skill_catalog("machine-a", &first, None).expect("catalog");
+    assert!(catalog.warnings.is_empty(), "{:?}", catalog.warnings);
+    assert_eq!(catalog.skills.len(), 2, "independent copies stay separate");
+    assert!(
+        catalog
+            .skills
+            .iter()
+            .all(|skill| skill.description == "Review code carefully.")
+    );
+    assert_ne!(catalog.skills[0].skill_id, catalog.skills[1].skill_id);
+    let other = environment_skill_catalog("machine-b", &first, None).expect("other catalog");
+    assert_ne!(catalog.skills[0].skill_id, other.skills[0].skill_id);
+    assert_eq!(catalog.root_fingerprints.len(), 2);
+
+    apply_cached_fingerprints(&mut query, &catalog);
+    let unchanged = daemon.client.scan(&query).await.expect("rescan");
+    let cached =
+        environment_skill_catalog("machine-a", &unchanged, Some(&catalog)).expect("cached");
+    assert_eq!(cached, catalog);
+
+    std::fs::write(review.join("SKILL.md"), doc.replace("one", "two")).expect("body edit");
+    let edited = daemon.client.scan(&query).await.expect("scan after edit");
+    let edited =
+        environment_skill_catalog("machine-a", &edited, Some(&catalog)).expect("edited catalog");
+    assert_eq!(edited.skills, catalog.skills);
+
+    std::fs::write(
+        review.join("SKILL.md"),
+        "---\nname: broken\ndescription: [invalid]\n---",
+    )
+    .expect("broken");
+    apply_cached_fingerprints(&mut query, &edited);
+    let broken = daemon.client.scan(&query).await.expect("scan broken");
+    let broken =
+        environment_skill_catalog("machine-a", &broken, Some(&edited)).expect("broken catalog");
+    assert_eq!(broken.skills.len(), 1, "the other root's skill remains");
+    assert_eq!(broken.warnings.len(), 1);
+    assert!(
+        broken.warnings[0].starts_with(project_root.to_str().expect("UTF-8")),
+        "{:?}",
+        broken.warnings
+    );
+}
diff --git a/crates/environment-protocol/Cargo.toml b/crates/environment-protocol/Cargo.toml
index b8eaf45db..13f9407a6 100644
--- a/crates/environment-protocol/Cargo.toml
+++ b/crates/environment-protocol/Cargo.toml
@@ -10,5 +10,17 @@ schema = ["dep:schemars"]
 base64 = "0.23"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
+serde_path_to_error = "0.1"
+sha2 = "0.11"
 schemars = { version = "1", optional = true }
 thiserror = "2"
+
+[dev-dependencies]
+# Integration tests check the committed contract, which needs the schema
+# export.
+environment-protocol = { path = ".", features = ["schema"] }
+
+[[bin]]
+name = "export-contract"
+path = "src/bin/export-contract.rs"
+required-features = ["schema"]
diff --git a/crates/environment-protocol/contract/controller.openrpc.json b/crates/environment-protocol/contract/controller.openrpc.json
new file mode 100644
index 000000000..706c453a7
--- /dev/null
+++ b/crates/environment-protocol/contract/controller.openrpc.json
@@ -0,0 +1,1701 @@
+{
+  "components": {
+    "schemas": {
+      "AbortReason": {
+        "description": "Why an operation was `aborted`.",
+        "oneOf": [
+          {
+            "const": "cancelled",
+            "description": "`$/cancelRequest` named the request.",
+            "type": "string"
+          },
+          {
+            "const": "sourceChanged",
+            "description": "A file or directory changed while it was being read.",
+            "type": "string"
+          }
+        ]
+      },
+      "AdoptTargetParams": {
+        "additionalProperties": false,
+        "description": "`target/adopt` params: take ownership of an existing provider target.\nIdempotent per owner. Requires `capabilities.adoptTarget`. A source that\nbelongs to another owner, or an owner that already holds a different\ntarget, is `failedPrecondition` (`ownerMismatch`); a source the provider\ncannot take over is `failedPrecondition` (`notAdoptable`).",
+        "properties": {
+          "owner": {
+            "$ref": "#/components/schemas/TargetOwner"
+          },
+          "sourceTarget": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/ProviderNativeRef"
+              }
+            ],
+            "description": "Provider-native reference to the existing target; the provider\ndefines its format."
+          }
+        },
+        "required": [
+          "owner",
+          "sourceTarget"
+        ],
+        "type": "object"
+      },
+      "BindingId": {
+        "description": "`bindingId` of a provider binding within a universe.",
+        "maxLength": 128,
+        "minLength": 1,
+        "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$",
+        "type": "string"
+      },
+      "BindingRef": {
+        "additionalProperties": false,
+        "description": "The provider binding a call is scoped to, for calls that concern no\nparticular target.",
+        "properties": {
+          "bindingId": {
+            "$ref": "#/components/schemas/BindingId"
+          },
+          "universeId": {
+            "$ref": "#/components/schemas/UniverseId"
+          }
+        },
+        "required": [
+          "universeId",
+          "bindingId"
+        ],
+        "type": "object"
+      },
+      "BusyReason": {
+        "description": "What limit a `busy` request hit.",
+        "oneOf": [
+          {
+            "const": "requestLimit",
+            "description": "The connection's concurrent request limit.",
+            "type": "string"
+          },
+          {
+            "const": "transferCapacity",
+            "description": "The daemon's limit on active transfer operations.",
+            "type": "string"
+          },
+          {
+            "const": "rateLimited",
+            "description": "A rate limit on the caller's identity.",
+            "type": "string"
+          },
+          {
+            "const": "capacityExhausted",
+            "description": "A registration key's limit on active environments.",
+            "type": "string"
+          }
+        ]
+      },
+      "Capability": {
+        "description": "A capability a request needed and the endpoint lacks.",
+        "oneOf": [
+          {
+            "const": "filesystem",
+            "description": "The `filesystem` family.",
+            "type": "string"
+          },
+          {
+            "const": "filesystemWrite",
+            "description": "`capabilities.filesystem.write`: the filesystem is writable.",
+            "type": "string"
+          },
+          {
+            "const": "process",
+            "description": "The `process` family.",
+            "type": "string"
+          },
+          {
+            "const": "processPty",
+            "description": "`capabilities.process.pty`.",
+            "type": "string"
+          },
+          {
+            "const": "job",
+            "description": "The `job` family.",
+            "type": "string"
+          },
+          {
+            "const": "adoptTarget",
+            "description": "The controller's `adoptTarget` capability.",
+            "type": "string"
+          },
+          {
+            "const": "ingress",
+            "description": "The controller's `ingress` capability.",
+            "type": "string"
+          }
+        ]
+      },
+      "CloseTargetParams": {
+        "additionalProperties": false,
+        "description": "`target/close` params: destroy the owner's target and every resource it\nholds, public ingress included. Graceful within the provider's own bound,\nthen forced. Answers `closing` until the target is gone, then `closed`;\n`closed` also when the provider holds no target for the owner.",
+        "properties": {
+          "target": {
+            "$ref": "#/components/schemas/TargetRef"
+          }
+        },
+        "required": [
+          "target"
+        ],
+        "type": "object"
+      },
+      "ControllerCapabilities": {
+        "additionalProperties": false,
+        "description": "Optional controller methods. Calling an absent one is\n`capabilityUnavailable`.",
+        "properties": {
+          "adoptTarget": {
+            "description": "`target/adopt` is served.",
+            "type": "boolean"
+          },
+          "ingress": {
+            "description": "`ingress/ensure` and `ingress/remove` are served.",
+            "type": "boolean"
+          }
+        },
+        "type": "object"
+      },
+      "ControllerInitializeParams": {
+        "additionalProperties": false,
+        "description": "`initialize` params on the controller plane.",
+        "properties": {
+          "clientInfo": {
+            "$ref": "#/components/schemas/ImplementationInfo"
+          },
+          "protocolVersion": {
+            "description": "The client's `CONTROLLER_PROTOCOL_VERSION`.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "protocolVersion",
+          "clientInfo"
+        ],
+        "type": "object"
+      },
+      "ControllerInitializeResponse": {
+        "additionalProperties": false,
+        "description": "`initialize` response on the controller plane.",
+        "properties": {
+          "capabilities": {
+            "$ref": "#/components/schemas/ControllerCapabilities"
+          },
+          "plane": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/Plane"
+              }
+            ],
+            "description": "Always `controller`."
+          },
+          "protocolVersion": {
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "routes": {
+            "$ref": "#/components/schemas/ControllerRoutes"
+          },
+          "serverInfo": {
+            "$ref": "#/components/schemas/ImplementationInfo"
+          }
+        },
+        "required": [
+          "protocolVersion",
+          "plane",
+          "serverInfo",
+          "capabilities",
+          "routes"
+        ],
+        "type": "object"
+      },
+      "ControllerRoutes": {
+        "additionalProperties": false,
+        "description": "Where Lightspeed reaches a target's data plane through this provider.",
+        "properties": {
+          "data": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/DataRouteBase"
+              }
+            ],
+            "description": "Base URL of the data routes. A target's data route is this base\nfollowed by\n`/{universeId}/{bindingId}/{environmentId}/{incarnationId}/{targetId}`,\neach segment percent-encoded\n(`provider_data_route`), and is\ndialed with the same bearer credential as the controller. A\ncontroller reached over `wss` must advertise a `wss` base."
+          }
+        },
+        "required": [
+          "data"
+        ],
+        "type": "object"
+      },
+      "CreateTargetParams": {
+        "additionalProperties": false,
+        "description": "`target/create` params. Idempotent per owner: when the owner already\nhas a target, the provider returns its observation and applies no\ncreation policy (template deprecation, binding or image checks).",
+        "properties": {
+          "owner": {
+            "$ref": "#/components/schemas/TargetOwner"
+          },
+          "templateId": {
+            "$ref": "#/components/schemas/TemplateId"
+          }
+        },
+        "required": [
+          "owner",
+          "templateId"
+        ],
+        "type": "object"
+      },
+      "DataRouteBase": {
+        "description": "`routes.data` of a controller's `initialize`: the absolute `ws://` or\n`wss://` base URL of the provider's data routes, validated on decode and\nnever rewritten. Lowercase scheme, a host and optional port, an optional\npath that does not end with `/`, no user information, query or\nfragment, at most 2048 bytes. A controller reached over `wss` must\nadvertise a `wss` base, so the provider credential never travels in\ncleartext; the runtime checks it with\n`DataRouteBase::check_for_controller`.",
+        "maxLength": 2048,
+        "minLength": 1,
+        "pattern": "^wss?://[^/?#@\\s]+(/[^?#\\s]*[^/?#\\s])?$",
+        "type": "string"
+      },
+      "DescriptiveText": {
+        "description": "A short human-readable text: 1 to 1024 bytes without control characters\nother than line feed and tab. Never parsed.",
+        "maxLength": 1024,
+        "minLength": 1,
+        "pattern": "^[^\\u0000-\\u0008\\u000B-\\u001F\\u007F-\\u009F]+$",
+        "type": "string"
+      },
+      "DisplayName": {
+        "description": "A display name: 1 to 128 bytes without control characters.",
+        "maxLength": 128,
+        "minLength": 1,
+        "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+        "type": "string"
+      },
+      "EnsureIngressParams": {
+        "additionalProperties": false,
+        "description": "`ingress/ensure` params: route the template's public ingress to the\ntarget. Idempotent. A target whose template has no `publicIngress` is\n`failedPrecondition` (`ingressUnsupported`).",
+        "properties": {
+          "target": {
+            "$ref": "#/components/schemas/TargetRef"
+          }
+        },
+        "required": [
+          "target"
+        ],
+        "type": "object"
+      },
+      "EnvironmentId": {
+        "description": "`environmentId` of a Lightspeed environment.",
+        "maxLength": 128,
+        "minLength": 1,
+        "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$",
+        "type": "string"
+      },
+      "EnvironmentTemplate": {
+        "additionalProperties": false,
+        "description": "A template targets are created from.",
+        "properties": {
+          "deprecated": {
+            "description": "Creates no new targets; existing targets keep working.",
+            "type": "boolean"
+          },
+          "description": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/DescriptiveText"
+              }
+            ]
+          },
+          "displayName": {
+            "$ref": "#/components/schemas/DisplayName"
+          },
+          "metadata": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/Metadata"
+              }
+            ],
+            "description": "Provider-specific display facts, such as an image fingerprint."
+          },
+          "publicIngress": {
+            "description": "Targets of this template can serve public ingress.",
+            "type": "boolean"
+          },
+          "resources": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/TemplateResources"
+              }
+            ]
+          },
+          "templateId": {
+            "$ref": "#/components/schemas/TemplateId"
+          }
+        },
+        "required": [
+          "templateId",
+          "displayName"
+        ],
+        "type": "object"
+      },
+      "ErrorData": {
+        "description": "The `data` member of an error object: the kind and its typed fields.\n\nKinds without fields are empty struct variants rather than unit\nvariants: serde does not apply `deny_unknown_fields` to the unit\nvariants of an internally tagged enum, and every kind must refuse\nunknown members.",
+        "oneOf": [
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "parseError",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "invalidRequest",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "methodNotFound",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "ceiling": {
+                "description": "The advertised ceiling the value exceeded.",
+                "format": "uint64",
+                "minimum": 0,
+                "type": "integer"
+              },
+              "field": {
+                "description": "Wire path of the offending field, such as `limits.maxDurationMs`.",
+                "type": "string"
+              },
+              "kind": {
+                "const": "invalidParams",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "notInitialized",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "expected": {
+                "description": "The version of the peer that sent this error.",
+                "format": "uint32",
+                "minimum": 0,
+                "type": "integer"
+              },
+              "kind": {
+                "const": "versionMismatch",
+                "type": "string"
+              },
+              "received": {
+                "description": "The version the requester stated.",
+                "format": "uint32",
+                "minimum": 0,
+                "type": "integer"
+              }
+            },
+            "required": [
+              "kind",
+              "expected",
+              "received"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "notFound",
+                "type": "string"
+              },
+              "reason": {
+                "anyOf": [
+                  {
+                    "$ref": "#/components/schemas/NotFoundReason"
+                  }
+                ]
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "alreadyExists",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "failedPrecondition",
+                "type": "string"
+              },
+              "reason": {
+                "$ref": "#/components/schemas/PreconditionReason"
+              }
+            },
+            "required": [
+              "kind",
+              "reason"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "permissionDenied",
+                "type": "string"
+              },
+              "reason": {
+                "anyOf": [
+                  {
+                    "$ref": "#/components/schemas/PermissionReason"
+                  }
+                ]
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "capability": {
+                "$ref": "#/components/schemas/Capability"
+              },
+              "kind": {
+                "const": "capabilityUnavailable",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind",
+              "capability"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "busy",
+                "type": "string"
+              },
+              "reason": {
+                "anyOf": [
+                  {
+                    "$ref": "#/components/schemas/BusyReason"
+                  }
+                ]
+              },
+              "retryAfterMs": {
+                "description": "Earliest useful retry, when the server knows it.",
+                "format": "uint64",
+                "minimum": 0,
+                "type": "integer"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "deadlineExceeded",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "expired",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "aborted",
+                "type": "string"
+              },
+              "reason": {
+                "anyOf": [
+                  {
+                    "$ref": "#/components/schemas/AbortReason"
+                  }
+                ]
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "payloadTooLarge",
+                "type": "string"
+              },
+              "limitBytes": {
+                "description": "The byte limit the payload exceeded.",
+                "format": "uint64",
+                "minimum": 0,
+                "type": "integer"
+              },
+              "limitEntries": {
+                "description": "The entry-count limit the result exceeded.",
+                "format": "uint32",
+                "minimum": 0,
+                "type": "integer"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "processFailed",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "unavailable",
+                "type": "string"
+              },
+              "retryAfterMs": {
+                "format": "uint64",
+                "minimum": 0,
+                "type": "integer"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "internal",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          }
+        ]
+      },
+      "GetTargetParams": {
+        "additionalProperties": false,
+        "description": "`target/get` params. A pure read: it never creates or changes anything.\nA target that no longer exists is `notFound`.",
+        "properties": {
+          "target": {
+            "$ref": "#/components/schemas/TargetRef"
+          }
+        },
+        "required": [
+          "target"
+        ],
+        "type": "object"
+      },
+      "ImplementationInfo": {
+        "additionalProperties": false,
+        "description": "What a peer says about its own build: `clientInfo`, `serverInfo` and a\ndaemon's registration `implementation`. Descriptive only; the protocol\nversion alone decides whether two peers can talk, and nothing here\nselects, authenticates or gates. Every field is 1 to 256 bytes without control characters,\nchecked on decode and by every constructor, so a value that would be\nrefused can never be built or sent.",
+        "properties": {
+          "gitSha": {
+            "description": "Full or abbreviated git commit of the build.",
+            "maxLength": 256,
+            "minLength": 1,
+            "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+            "type": "string"
+          },
+          "name": {
+            "description": "Product name, such as `lightspeed-envd`.",
+            "maxLength": 256,
+            "minLength": 1,
+            "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+            "type": "string"
+          },
+          "target": {
+            "description": "Rust target triple of the build.",
+            "maxLength": 256,
+            "minLength": 1,
+            "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+            "type": "string"
+          },
+          "version": {
+            "description": "Release version, such as `0.5.0`.",
+            "maxLength": 256,
+            "minLength": 1,
+            "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+            "type": "string"
+          }
+        },
+        "required": [
+          "name"
+        ],
+        "type": "object"
+      },
+      "IncarnationId": {
+        "description": "`incarnationId` of one incarnation of an environment.",
+        "maxLength": 128,
+        "minLength": 1,
+        "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$",
+        "type": "string"
+      },
+      "IngressObservation": {
+        "additionalProperties": false,
+        "description": "Realized public ingress of a target.",
+        "properties": {
+          "endpoint": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/PublicUrl"
+              }
+            ],
+            "description": "Public URL that reaches the target's application."
+          }
+        },
+        "required": [
+          "endpoint"
+        ],
+        "type": "object"
+      },
+      "ListTemplatesParams": {
+        "additionalProperties": false,
+        "description": "`template/list` params.",
+        "properties": {
+          "binding": {
+            "$ref": "#/components/schemas/BindingRef"
+          }
+        },
+        "required": [
+          "binding"
+        ],
+        "type": "object"
+      },
+      "ListTemplatesResponse": {
+        "additionalProperties": false,
+        "description": "`template/list` response.",
+        "properties": {
+          "templates": {
+            "items": {
+              "$ref": "#/components/schemas/EnvironmentTemplate"
+            },
+            "type": "array"
+          }
+        },
+        "type": "object"
+      },
+      "Metadata": {
+        "additionalProperties": {
+          "maxLength": 256,
+          "minLength": 1,
+          "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+          "type": "string"
+        },
+        "description": "Descriptive key-value metadata: at most 32 entries, keys 1 to 64 bytes outside the reserved `lightspeed.` prefix, values 1 to 256 bytes, no control characters.",
+        "maxProperties": 32,
+        "propertyNames": {
+          "maxLength": 64,
+          "minLength": 1,
+          "not": {
+            "pattern": "^lightspeed\\."
+          },
+          "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$"
+        },
+        "type": "object"
+      },
+      "NotFoundReason": {
+        "description": "Why a handle, path or identity was not found.",
+        "oneOf": [
+          {
+            "const": "expired",
+            "description": "Its retention window ended; a tombstone remembers it.",
+            "type": "string"
+          },
+          {
+            "const": "daemonRestarted",
+            "description": "It belonged to an earlier daemon instance (see `daemonInstanceId`).",
+            "type": "string"
+          },
+          {
+            "const": "unknownDaemon",
+            "description": "A daemon identity the gateway has never admitted presented no\nregistration key.",
+            "type": "string"
+          }
+        ]
+      },
+      "PermissionReason": {
+        "description": "Why a `permissionDenied` request was refused.",
+        "oneOf": [
+          {
+            "const": "outsideRoot",
+            "description": "The path, or a symlink it passes through, resolves outside the\ndaemon's filesystem root.",
+            "type": "string"
+          },
+          {
+            "const": "daemonState",
+            "description": "The path names or contains the daemon's state directory.",
+            "type": "string"
+          },
+          {
+            "const": "filePermission",
+            "description": "The operating system refused access.",
+            "type": "string"
+          },
+          {
+            "const": "invalidSignature",
+            "description": "The registration signature does not verify.",
+            "type": "string"
+          },
+          {
+            "const": "invalidRegistrationKey",
+            "description": "The registration key is unknown.",
+            "type": "string"
+          },
+          {
+            "const": "registrationKeyRevoked",
+            "description": "The registration key was revoked.",
+            "type": "string"
+          }
+        ]
+      },
+      "Plane": {
+        "description": "The plane a connection serves. Each `initialize` response names its\nplane, so a client that reached the wrong socket fails at the handshake.",
+        "oneOf": [
+          {
+            "const": "data",
+            "description": "envd's data plane, versioned by `ENVD_PROTOCOL_VERSION`.",
+            "type": "string"
+          },
+          {
+            "const": "controller",
+            "description": "A provider controller, versioned by `CONTROLLER_PROTOCOL_VERSION`.",
+            "type": "string"
+          },
+          {
+            "const": "registration",
+            "description": "The registration channel between a daemon and the gateway, versioned\nby `ENVD_PROTOCOL_VERSION`.",
+            "type": "string"
+          }
+        ]
+      },
+      "PowerState": {
+        "description": "Steady power state of an active target, in provider-neutral terms.",
+        "oneOf": [
+          {
+            "enum": [
+              "running"
+            ],
+            "type": "string"
+          },
+          {
+            "const": "paused",
+            "description": "Execution halted, memory retained; resuming is fast.",
+            "type": "string"
+          },
+          {
+            "const": "suspended",
+            "description": "Execution state persisted, compute released; resuming restores it.",
+            "type": "string"
+          },
+          {
+            "const": "stopped",
+            "description": "Powered off; disks retained.",
+            "type": "string"
+          }
+        ]
+      },
+      "PreconditionReason": {
+        "description": "The state that forbids a `failedPrecondition` request.",
+        "oneOf": [
+          {
+            "const": "inputClosed",
+            "description": "The process has no open input: started without `pipe` or `pty`,\ninput already closed, or exited.",
+            "type": "string"
+          },
+          {
+            "const": "ifMatchFailed",
+            "description": "The file's current `version` differs from `ifMatch`.",
+            "type": "string"
+          },
+          {
+            "const": "createCondition",
+            "description": "`create: ifAbsent` met an existing file, or `create: ifPresent` a\nmissing one.",
+            "type": "string"
+          },
+          {
+            "const": "notEmpty",
+            "description": "The directory is not empty and `recursive` was not set.",
+            "type": "string"
+          },
+          {
+            "const": "isDirectory",
+            "description": "The path names a directory where a file is required.",
+            "type": "string"
+          },
+          {
+            "const": "notDirectory",
+            "description": "A path component or the path names a non-directory where a directory\nis required.",
+            "type": "string"
+          },
+          {
+            "const": "notRegularFile",
+            "description": "The path names a device, FIFO, socket or other non-regular file.",
+            "type": "string"
+          },
+          {
+            "const": "symlinkLoop",
+            "description": "A symlink chain loops.",
+            "type": "string"
+          },
+          {
+            "const": "symlinkRejected",
+            "description": "A capture met a symlink that leaves the selection, or one the\nselection's symlink policy rejects.",
+            "type": "string"
+          },
+          {
+            "const": "filesystemRoot",
+            "description": "The filesystem root itself cannot be replaced or removed.",
+            "type": "string"
+          },
+          {
+            "const": "crossDevice",
+            "description": "Rename across filesystems.",
+            "type": "string"
+          },
+          {
+            "const": "noSpace",
+            "description": "No space left on the device.",
+            "type": "string"
+          },
+          {
+            "const": "jobIdInUse",
+            "description": "A job id is in use by a job with another `requestId` or spec; choose\na new job id.",
+            "type": "string"
+          },
+          {
+            "const": "operationIdInUse",
+            "description": "A transfer `operationId` is in use for different input.",
+            "type": "string"
+          },
+          {
+            "const": "transferPhase",
+            "description": "The transfer action is not valid in the operation's current phase.",
+            "type": "string"
+          },
+          {
+            "const": "transferOffset",
+            "description": "A transfer write's `offset` is not the digest's next expected offset.",
+            "type": "string"
+          },
+          {
+            "const": "digestMismatch",
+            "description": "Uploaded bytes do not hash to their digest.",
+            "type": "string"
+          },
+          {
+            "const": "environmentClosed",
+            "description": "The environment is closed; its identity or target is spent.",
+            "type": "string"
+          },
+          {
+            "const": "identityInUse",
+            "description": "The daemon identity is bound to another universe.",
+            "type": "string"
+          },
+          {
+            "const": "ownerMismatch",
+            "description": "The target belongs to another owner, or (`target/adopt`) the owner\nalready holds a different target.",
+            "type": "string"
+          },
+          {
+            "const": "templateDeprecated",
+            "description": "The template is deprecated and creates no new targets.",
+            "type": "string"
+          },
+          {
+            "const": "ingressUnsupported",
+            "description": "`ingress/ensure` on a target whose template has no public ingress.",
+            "type": "string"
+          },
+          {
+            "const": "targetNotActive",
+            "description": "A power change on a target whose `phase` is not `active`\n(provisioning, closing, closed or failed).",
+            "type": "string"
+          },
+          {
+            "const": "notAdoptable",
+            "description": "`target/adopt`: the source target exists but the provider cannot take\nit over, for example an instance of a kind it does not manage.",
+            "type": "string"
+          }
+        ]
+      },
+      "ProtocolError": {
+        "additionalProperties": false,
+        "description": "A protocol error: one kind, its typed data and a message.\n\nSerializes as an `ErrorObject`. Displays as `{kind}: {message}`.",
+        "properties": {
+          "code": {
+            "description": "Fixed by `data.kind`; see `ProtocolErrorKind::code`.",
+            "format": "int32",
+            "type": "integer"
+          },
+          "data": {
+            "$ref": "#/components/schemas/ErrorData"
+          },
+          "message": {
+            "description": "Human-readable description. Never parsed.",
+            "type": "string"
+          }
+        },
+        "required": [
+          "code",
+          "message",
+          "data"
+        ],
+        "type": "object"
+      },
+      "ProviderNativeRef": {
+        "description": "`sourceTarget` of `target/adopt`: a provider-native reference to an\nexisting target, in a format the provider defines.",
+        "maxLength": 255,
+        "minLength": 1,
+        "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+        "type": "string"
+      },
+      "ProviderTargetId": {
+        "description": "`targetId`: the provider's own id for a target, opaque to Lightspeed.",
+        "maxLength": 255,
+        "minLength": 1,
+        "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+        "type": "string"
+      },
+      "PublicUrl": {
+        "description": "A public `http://` or `https://` URL a provider reports, such as a\ntarget's ingress `endpoint`: lowercase scheme, a host and optional port,\noptional path and query, no user information or fragment, at most 2048\nbytes. Validated on decode.",
+        "maxLength": 2048,
+        "minLength": 1,
+        "pattern": "^https?://[^/?#@\\s]+([/?][^#\\s]*)?$",
+        "type": "string"
+      },
+      "RemoveIngressParams": {
+        "additionalProperties": false,
+        "description": "`ingress/remove` params: stop routing public ingress to the target.\nIdempotent.",
+        "properties": {
+          "target": {
+            "$ref": "#/components/schemas/TargetRef"
+          }
+        },
+        "required": [
+          "target"
+        ],
+        "type": "object"
+      },
+      "SetTargetPowerParams": {
+        "additionalProperties": false,
+        "description": "`target/setPower` params: converge the target toward `power`. A target\nalready in, or moving toward, that state is observed without further\naction. Resuming may replace the underlying host process. A target whose\n`phase` is not `active` is `failedPrecondition` (`targetNotActive`); a\nstate outside `supportedPowerStates` is `invalidParams`.",
+        "properties": {
+          "power": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/PowerState"
+              }
+            ],
+            "description": "One of the target's `supportedPowerStates`."
+          },
+          "target": {
+            "$ref": "#/components/schemas/TargetRef"
+          }
+        },
+        "required": [
+          "target",
+          "power"
+        ],
+        "type": "object"
+      },
+      "TargetObservation": {
+        "additionalProperties": false,
+        "description": "What the provider observes about a target. Every target method answers\nwith one.",
+        "properties": {
+          "displayName": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/DisplayName"
+              }
+            ]
+          },
+          "ingress": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/IngressObservation"
+              }
+            ],
+            "description": "Public ingress as realized; absent when disabled."
+          },
+          "metadata": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/Metadata"
+              }
+            ],
+            "description": "Provider-specific display facts."
+          },
+          "owner": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/TargetOwner"
+              }
+            ],
+            "description": "Echoed from the request."
+          },
+          "state": {
+            "$ref": "#/components/schemas/TargetState"
+          },
+          "supportedPowerStates": {
+            "description": "Power states `target/setPower` can move this target to. Empty when\nthe provider offers no power control beyond create and close.",
+            "items": {
+              "$ref": "#/components/schemas/PowerState"
+            },
+            "type": "array"
+          },
+          "targetId": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/ProviderTargetId"
+              }
+            ],
+            "description": "The provider's id for the target. Absent in two cases only: while\n`phase` is `provisioning` and the provider has not assigned an id\nyet (an asynchronous create answers before it has one; the runtime\nrecords the id from the first observation that carries it), and in a\n`closed` observation of an owner the provider holds no target for."
+          }
+        },
+        "required": [
+          "owner",
+          "state"
+        ],
+        "type": "object"
+      },
+      "TargetOwner": {
+        "additionalProperties": false,
+        "description": "The Lightspeed incarnation a target belongs to. A provider owns at most\none target per owner.",
+        "properties": {
+          "bindingId": {
+            "$ref": "#/components/schemas/BindingId"
+          },
+          "environmentId": {
+            "$ref": "#/components/schemas/EnvironmentId"
+          },
+          "incarnationId": {
+            "$ref": "#/components/schemas/IncarnationId"
+          },
+          "universeId": {
+            "$ref": "#/components/schemas/UniverseId"
+          }
+        },
+        "required": [
+          "universeId",
+          "bindingId",
+          "environmentId",
+          "incarnationId"
+        ],
+        "type": "object"
+      },
+      "TargetPhase": {
+        "description": "Lifecycle phase of a target.",
+        "oneOf": [
+          {
+            "const": "provisioning",
+            "description": "Being created; not yet usable.",
+            "type": "string"
+          },
+          {
+            "const": "active",
+            "description": "Exists; see `power`.",
+            "type": "string"
+          },
+          {
+            "const": "closing",
+            "description": "Being destroyed.",
+            "type": "string"
+          },
+          {
+            "const": "closed",
+            "description": "Gone, and nothing of it remains.",
+            "type": "string"
+          },
+          {
+            "const": "failed",
+            "description": "Broken beyond the provider's own recovery; see `message`.",
+            "type": "string"
+          },
+          {
+            "const": "unknown",
+            "description": "The provider cannot tell; see `message`.",
+            "type": "string"
+          }
+        ]
+      },
+      "TargetRef": {
+        "additionalProperties": false,
+        "description": "A reference to an existing target: its owner and, once known, its id.\nWithout `targetId` the provider resolves the owner's target itself.",
+        "properties": {
+          "owner": {
+            "$ref": "#/components/schemas/TargetOwner"
+          },
+          "targetId": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/ProviderTargetId"
+              }
+            ]
+          }
+        },
+        "required": [
+          "owner"
+        ],
+        "type": "object"
+      },
+      "TargetResponse": {
+        "additionalProperties": false,
+        "description": "Response of every target method and both ingress methods.",
+        "properties": {
+          "target": {
+            "$ref": "#/components/schemas/TargetObservation"
+          }
+        },
+        "required": [
+          "target"
+        ],
+        "type": "object"
+      },
+      "TargetState": {
+        "additionalProperties": false,
+        "description": "A target's state on two axes: lifecycle `phase`, and `power` while\nactive.",
+        "properties": {
+          "daemonReady": {
+            "description": "envd answers on the target's data route (running targets only).",
+            "type": "boolean"
+          },
+          "message": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/DescriptiveText"
+              }
+            ],
+            "description": "Why the target is `failed` or `unknown`, or what a transition waits\nfor. Providers build it with\n`DescriptiveText::lossy` from whatever their backend reports."
+          },
+          "phase": {
+            "$ref": "#/components/schemas/TargetPhase"
+          },
+          "power": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/PowerState"
+              }
+            ],
+            "description": "Present exactly when `phase` is `active`."
+          }
+        },
+        "required": [
+          "phase"
+        ],
+        "type": "object"
+      },
+      "TemplateId": {
+        "description": "`templateId`: the provider's own id for a template.",
+        "maxLength": 255,
+        "minLength": 1,
+        "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+        "type": "string"
+      },
+      "TemplateResources": {
+        "additionalProperties": false,
+        "description": "Compute a template's targets get, in provider-neutral units. Each\nfield is absent when the provider does not fix it.",
+        "properties": {
+          "diskBytes": {
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "memoryBytes": {
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "vcpus": {
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "type": "object"
+      },
+      "UniverseId": {
+        "description": "`universeId` of a Lightspeed universe.",
+        "maxLength": 128,
+        "minLength": 1,
+        "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$",
+        "type": "string"
+      }
+    }
+  },
+  "info": {
+    "description": "JSON-RPC 2.0 over WebSocket text frames of at most 16777216 bytes. Exact-match protocolVersion 3. Errors carry code, message and data.kind; see x-lightspeed-error-kinds.",
+    "title": "Lightspeed environment controller plane",
+    "version": "3"
+  },
+  "methods": [
+    {
+      "name": "initialize",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "clientInfo",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/ImplementationInfo"
+          }
+        },
+        {
+          "name": "protocolVersion",
+          "required": true,
+          "schema": {
+            "description": "The client's `CONTROLLER_PROTOCOL_VERSION`.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/ControllerInitializeResponse"
+        }
+      },
+      "summary": "Check the protocol version and read the controller's capabilities and routes.",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "handshake",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "ControllerInitializeParams",
+      "x-lightspeed-result-type": "ControllerInitializeResponse"
+    },
+    {
+      "name": "template/list",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "binding",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/BindingRef"
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/ListTemplatesResponse"
+        }
+      },
+      "summary": "List the templates a binding may create targets from.",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "template",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "ListTemplatesParams",
+      "x-lightspeed-result-type": "ListTemplatesResponse"
+    },
+    {
+      "name": "target/create",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "owner",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/TargetOwner"
+          }
+        },
+        {
+          "name": "templateId",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/TemplateId"
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/TargetResponse"
+        }
+      },
+      "summary": "Create the owner's target, or observe the one it has.",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "target",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "CreateTargetParams",
+      "x-lightspeed-result-type": "TargetResponse"
+    },
+    {
+      "name": "target/adopt",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "owner",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/TargetOwner"
+          }
+        },
+        {
+          "name": "sourceTarget",
+          "required": true,
+          "schema": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/ProviderNativeRef"
+              }
+            ],
+            "description": "Provider-native reference to the existing target; the provider\ndefines its format."
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/TargetResponse"
+        }
+      },
+      "summary": "Take ownership of an existing provider target.",
+      "x-lightspeed-capability": "adoptTarget",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "target",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "AdoptTargetParams",
+      "x-lightspeed-result-type": "TargetResponse"
+    },
+    {
+      "name": "target/get",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "target",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/TargetRef"
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/TargetResponse"
+        }
+      },
+      "summary": "Observe a target without changing it.",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "target",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "GetTargetParams",
+      "x-lightspeed-result-type": "TargetResponse"
+    },
+    {
+      "name": "target/setPower",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "power",
+          "required": true,
+          "schema": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/PowerState"
+              }
+            ],
+            "description": "One of the target's `supportedPowerStates`."
+          }
+        },
+        {
+          "name": "target",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/TargetRef"
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/TargetResponse"
+        }
+      },
+      "summary": "Converge a target toward a power state.",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "target",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "SetTargetPowerParams",
+      "x-lightspeed-result-type": "TargetResponse"
+    },
+    {
+      "name": "target/close",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "target",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/TargetRef"
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/TargetResponse"
+        }
+      },
+      "summary": "Destroy the owner's target and everything it holds.",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "target",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "CloseTargetParams",
+      "x-lightspeed-result-type": "TargetResponse"
+    },
+    {
+      "name": "ingress/ensure",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "target",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/TargetRef"
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/TargetResponse"
+        }
+      },
+      "summary": "Route public ingress to a target.",
+      "x-lightspeed-capability": "ingress",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "ingress",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "EnsureIngressParams",
+      "x-lightspeed-result-type": "TargetResponse"
+    },
+    {
+      "name": "ingress/remove",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "target",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/TargetRef"
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/TargetResponse"
+        }
+      },
+      "summary": "Stop routing public ingress to a target that stays.",
+      "x-lightspeed-capability": "ingress",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "ingress",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "RemoveIngressParams",
+      "x-lightspeed-result-type": "TargetResponse"
+    }
+  ],
+  "openrpc": "1.3.2",
+  "x-lightspeed-error": {
+    "$ref": "#/components/schemas/ProtocolError"
+  },
+  "x-lightspeed-error-kinds": [
+    {
+      "code": -32700,
+      "kind": "parseError",
+      "retryable": false
+    },
+    {
+      "code": -32600,
+      "kind": "invalidRequest",
+      "retryable": false
+    },
+    {
+      "code": -32601,
+      "kind": "methodNotFound",
+      "retryable": false
+    },
+    {
+      "code": -32602,
+      "kind": "invalidParams",
+      "retryable": false
+    },
+    {
+      "code": -32002,
+      "kind": "notInitialized",
+      "retryable": false
+    },
+    {
+      "code": -32005,
+      "kind": "versionMismatch",
+      "retryable": false
+    },
+    {
+      "code": -32004,
+      "kind": "notFound",
+      "retryable": false
+    },
+    {
+      "code": -32009,
+      "kind": "alreadyExists",
+      "retryable": false
+    },
+    {
+      "code": -32007,
+      "kind": "failedPrecondition",
+      "retryable": false
+    },
+    {
+      "code": -32003,
+      "kind": "permissionDenied",
+      "retryable": false
+    },
+    {
+      "code": -32006,
+      "kind": "capabilityUnavailable",
+      "retryable": false
+    },
+    {
+      "code": -32008,
+      "kind": "busy",
+      "retryable": true
+    },
+    {
+      "code": -32015,
+      "kind": "deadlineExceeded",
+      "retryable": false
+    },
+    {
+      "code": -32016,
+      "kind": "expired",
+      "retryable": false
+    },
+    {
+      "code": -32017,
+      "kind": "aborted",
+      "retryable": true
+    },
+    {
+      "code": -32013,
+      "kind": "payloadTooLarge",
+      "retryable": false
+    },
+    {
+      "code": -32018,
+      "kind": "processFailed",
+      "retryable": false
+    },
+    {
+      "code": -32019,
+      "kind": "unavailable",
+      "retryable": true
+    },
+    {
+      "code": -32603,
+      "kind": "internal",
+      "retryable": false
+    }
+  ],
+  "x-lightspeed-plane": "controller"
+}
diff --git a/crates/environment-protocol/contract/controller.schema.json b/crates/environment-protocol/contract/controller.schema.json
new file mode 100644
index 000000000..136d04fa5
--- /dev/null
+++ b/crates/environment-protocol/contract/controller.schema.json
@@ -0,0 +1,1324 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "definitions": {
+    "AbortReason": {
+      "description": "Why an operation was `aborted`.",
+      "oneOf": [
+        {
+          "const": "cancelled",
+          "description": "`$/cancelRequest` named the request.",
+          "type": "string"
+        },
+        {
+          "const": "sourceChanged",
+          "description": "A file or directory changed while it was being read.",
+          "type": "string"
+        }
+      ]
+    },
+    "AdoptTargetParams": {
+      "additionalProperties": false,
+      "description": "`target/adopt` params: take ownership of an existing provider target.\nIdempotent per owner. Requires `capabilities.adoptTarget`. A source that\nbelongs to another owner, or an owner that already holds a different\ntarget, is `failedPrecondition` (`ownerMismatch`); a source the provider\ncannot take over is `failedPrecondition` (`notAdoptable`).",
+      "properties": {
+        "owner": {
+          "$ref": "#/definitions/TargetOwner"
+        },
+        "sourceTarget": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/ProviderNativeRef"
+            }
+          ],
+          "description": "Provider-native reference to the existing target; the provider\ndefines its format."
+        }
+      },
+      "required": [
+        "owner",
+        "sourceTarget"
+      ],
+      "type": "object"
+    },
+    "BindingId": {
+      "description": "`bindingId` of a provider binding within a universe.",
+      "maxLength": 128,
+      "minLength": 1,
+      "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$",
+      "type": "string"
+    },
+    "BindingRef": {
+      "additionalProperties": false,
+      "description": "The provider binding a call is scoped to, for calls that concern no\nparticular target.",
+      "properties": {
+        "bindingId": {
+          "$ref": "#/definitions/BindingId"
+        },
+        "universeId": {
+          "$ref": "#/definitions/UniverseId"
+        }
+      },
+      "required": [
+        "universeId",
+        "bindingId"
+      ],
+      "type": "object"
+    },
+    "BusyReason": {
+      "description": "What limit a `busy` request hit.",
+      "oneOf": [
+        {
+          "const": "requestLimit",
+          "description": "The connection's concurrent request limit.",
+          "type": "string"
+        },
+        {
+          "const": "transferCapacity",
+          "description": "The daemon's limit on active transfer operations.",
+          "type": "string"
+        },
+        {
+          "const": "rateLimited",
+          "description": "A rate limit on the caller's identity.",
+          "type": "string"
+        },
+        {
+          "const": "capacityExhausted",
+          "description": "A registration key's limit on active environments.",
+          "type": "string"
+        }
+      ]
+    },
+    "Capability": {
+      "description": "A capability a request needed and the endpoint lacks.",
+      "oneOf": [
+        {
+          "const": "filesystem",
+          "description": "The `filesystem` family.",
+          "type": "string"
+        },
+        {
+          "const": "filesystemWrite",
+          "description": "`capabilities.filesystem.write`: the filesystem is writable.",
+          "type": "string"
+        },
+        {
+          "const": "process",
+          "description": "The `process` family.",
+          "type": "string"
+        },
+        {
+          "const": "processPty",
+          "description": "`capabilities.process.pty`.",
+          "type": "string"
+        },
+        {
+          "const": "job",
+          "description": "The `job` family.",
+          "type": "string"
+        },
+        {
+          "const": "adoptTarget",
+          "description": "The controller's `adoptTarget` capability.",
+          "type": "string"
+        },
+        {
+          "const": "ingress",
+          "description": "The controller's `ingress` capability.",
+          "type": "string"
+        }
+      ]
+    },
+    "CloseTargetParams": {
+      "additionalProperties": false,
+      "description": "`target/close` params: destroy the owner's target and every resource it\nholds, public ingress included. Graceful within the provider's own bound,\nthen forced. Answers `closing` until the target is gone, then `closed`;\n`closed` also when the provider holds no target for the owner.",
+      "properties": {
+        "target": {
+          "$ref": "#/definitions/TargetRef"
+        }
+      },
+      "required": [
+        "target"
+      ],
+      "type": "object"
+    },
+    "ControllerCapabilities": {
+      "additionalProperties": false,
+      "description": "Optional controller methods. Calling an absent one is\n`capabilityUnavailable`.",
+      "properties": {
+        "adoptTarget": {
+          "description": "`target/adopt` is served.",
+          "type": "boolean"
+        },
+        "ingress": {
+          "description": "`ingress/ensure` and `ingress/remove` are served.",
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "ControllerInitializeParams": {
+      "additionalProperties": false,
+      "description": "`initialize` params on the controller plane.",
+      "properties": {
+        "clientInfo": {
+          "$ref": "#/definitions/ImplementationInfo"
+        },
+        "protocolVersion": {
+          "description": "The client's `CONTROLLER_PROTOCOL_VERSION`.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "required": [
+        "protocolVersion",
+        "clientInfo"
+      ],
+      "type": "object"
+    },
+    "ControllerInitializeResponse": {
+      "additionalProperties": false,
+      "description": "`initialize` response on the controller plane.",
+      "properties": {
+        "capabilities": {
+          "$ref": "#/definitions/ControllerCapabilities"
+        },
+        "plane": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/Plane"
+            }
+          ],
+          "description": "Always `controller`."
+        },
+        "protocolVersion": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "routes": {
+          "$ref": "#/definitions/ControllerRoutes"
+        },
+        "serverInfo": {
+          "$ref": "#/definitions/ImplementationInfo"
+        }
+      },
+      "required": [
+        "protocolVersion",
+        "plane",
+        "serverInfo",
+        "capabilities",
+        "routes"
+      ],
+      "type": "object"
+    },
+    "ControllerRoutes": {
+      "additionalProperties": false,
+      "description": "Where Lightspeed reaches a target's data plane through this provider.",
+      "properties": {
+        "data": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/DataRouteBase"
+            }
+          ],
+          "description": "Base URL of the data routes. A target's data route is this base\nfollowed by\n`/{universeId}/{bindingId}/{environmentId}/{incarnationId}/{targetId}`,\neach segment percent-encoded\n(`provider_data_route`), and is\ndialed with the same bearer credential as the controller. A\ncontroller reached over `wss` must advertise a `wss` base."
+        }
+      },
+      "required": [
+        "data"
+      ],
+      "type": "object"
+    },
+    "CreateTargetParams": {
+      "additionalProperties": false,
+      "description": "`target/create` params. Idempotent per owner: when the owner already\nhas a target, the provider returns its observation and applies no\ncreation policy (template deprecation, binding or image checks).",
+      "properties": {
+        "owner": {
+          "$ref": "#/definitions/TargetOwner"
+        },
+        "templateId": {
+          "$ref": "#/definitions/TemplateId"
+        }
+      },
+      "required": [
+        "owner",
+        "templateId"
+      ],
+      "type": "object"
+    },
+    "DataRouteBase": {
+      "description": "`routes.data` of a controller's `initialize`: the absolute `ws://` or\n`wss://` base URL of the provider's data routes, validated on decode and\nnever rewritten. Lowercase scheme, a host and optional port, an optional\npath that does not end with `/`, no user information, query or\nfragment, at most 2048 bytes. A controller reached over `wss` must\nadvertise a `wss` base, so the provider credential never travels in\ncleartext; the runtime checks it with\n`DataRouteBase::check_for_controller`.",
+      "maxLength": 2048,
+      "minLength": 1,
+      "pattern": "^wss?://[^/?#@\\s]+(/[^?#\\s]*[^/?#\\s])?$",
+      "type": "string"
+    },
+    "DescriptiveText": {
+      "description": "A short human-readable text: 1 to 1024 bytes without control characters\nother than line feed and tab. Never parsed.",
+      "maxLength": 1024,
+      "minLength": 1,
+      "pattern": "^[^\\u0000-\\u0008\\u000B-\\u001F\\u007F-\\u009F]+$",
+      "type": "string"
+    },
+    "DisplayName": {
+      "description": "A display name: 1 to 128 bytes without control characters.",
+      "maxLength": 128,
+      "minLength": 1,
+      "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+      "type": "string"
+    },
+    "EnsureIngressParams": {
+      "additionalProperties": false,
+      "description": "`ingress/ensure` params: route the template's public ingress to the\ntarget. Idempotent. A target whose template has no `publicIngress` is\n`failedPrecondition` (`ingressUnsupported`).",
+      "properties": {
+        "target": {
+          "$ref": "#/definitions/TargetRef"
+        }
+      },
+      "required": [
+        "target"
+      ],
+      "type": "object"
+    },
+    "EnvironmentId": {
+      "description": "`environmentId` of a Lightspeed environment.",
+      "maxLength": 128,
+      "minLength": 1,
+      "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$",
+      "type": "string"
+    },
+    "EnvironmentTemplate": {
+      "additionalProperties": false,
+      "description": "A template targets are created from.",
+      "properties": {
+        "deprecated": {
+          "description": "Creates no new targets; existing targets keep working.",
+          "type": "boolean"
+        },
+        "description": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/DescriptiveText"
+            }
+          ]
+        },
+        "displayName": {
+          "$ref": "#/definitions/DisplayName"
+        },
+        "metadata": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/Metadata"
+            }
+          ],
+          "description": "Provider-specific display facts, such as an image fingerprint."
+        },
+        "publicIngress": {
+          "description": "Targets of this template can serve public ingress.",
+          "type": "boolean"
+        },
+        "resources": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/TemplateResources"
+            }
+          ]
+        },
+        "templateId": {
+          "$ref": "#/definitions/TemplateId"
+        }
+      },
+      "required": [
+        "templateId",
+        "displayName"
+      ],
+      "type": "object"
+    },
+    "ErrorData": {
+      "description": "The `data` member of an error object: the kind and its typed fields.\n\nKinds without fields are empty struct variants rather than unit\nvariants: serde does not apply `deny_unknown_fields` to the unit\nvariants of an internally tagged enum, and every kind must refuse\nunknown members.",
+      "oneOf": [
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "parseError",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "invalidRequest",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "methodNotFound",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "ceiling": {
+              "description": "The advertised ceiling the value exceeded.",
+              "format": "uint64",
+              "minimum": 0,
+              "type": "integer"
+            },
+            "field": {
+              "description": "Wire path of the offending field, such as `limits.maxDurationMs`.",
+              "type": "string"
+            },
+            "kind": {
+              "const": "invalidParams",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "notInitialized",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "expected": {
+              "description": "The version of the peer that sent this error.",
+              "format": "uint32",
+              "minimum": 0,
+              "type": "integer"
+            },
+            "kind": {
+              "const": "versionMismatch",
+              "type": "string"
+            },
+            "received": {
+              "description": "The version the requester stated.",
+              "format": "uint32",
+              "minimum": 0,
+              "type": "integer"
+            }
+          },
+          "required": [
+            "kind",
+            "expected",
+            "received"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "notFound",
+              "type": "string"
+            },
+            "reason": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/NotFoundReason"
+                }
+              ]
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "alreadyExists",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "failedPrecondition",
+              "type": "string"
+            },
+            "reason": {
+              "$ref": "#/definitions/PreconditionReason"
+            }
+          },
+          "required": [
+            "kind",
+            "reason"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "permissionDenied",
+              "type": "string"
+            },
+            "reason": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/PermissionReason"
+                }
+              ]
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "capability": {
+              "$ref": "#/definitions/Capability"
+            },
+            "kind": {
+              "const": "capabilityUnavailable",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind",
+            "capability"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "busy",
+              "type": "string"
+            },
+            "reason": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/BusyReason"
+                }
+              ]
+            },
+            "retryAfterMs": {
+              "description": "Earliest useful retry, when the server knows it.",
+              "format": "uint64",
+              "minimum": 0,
+              "type": "integer"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "deadlineExceeded",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "expired",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "aborted",
+              "type": "string"
+            },
+            "reason": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/AbortReason"
+                }
+              ]
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "payloadTooLarge",
+              "type": "string"
+            },
+            "limitBytes": {
+              "description": "The byte limit the payload exceeded.",
+              "format": "uint64",
+              "minimum": 0,
+              "type": "integer"
+            },
+            "limitEntries": {
+              "description": "The entry-count limit the result exceeded.",
+              "format": "uint32",
+              "minimum": 0,
+              "type": "integer"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "processFailed",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "unavailable",
+              "type": "string"
+            },
+            "retryAfterMs": {
+              "format": "uint64",
+              "minimum": 0,
+              "type": "integer"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "internal",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        }
+      ]
+    },
+    "GetTargetParams": {
+      "additionalProperties": false,
+      "description": "`target/get` params. A pure read: it never creates or changes anything.\nA target that no longer exists is `notFound`.",
+      "properties": {
+        "target": {
+          "$ref": "#/definitions/TargetRef"
+        }
+      },
+      "required": [
+        "target"
+      ],
+      "type": "object"
+    },
+    "ImplementationInfo": {
+      "additionalProperties": false,
+      "description": "What a peer says about its own build: `clientInfo`, `serverInfo` and a\ndaemon's registration `implementation`. Descriptive only; the protocol\nversion alone decides whether two peers can talk, and nothing here\nselects, authenticates or gates. Every field is 1 to 256 bytes without control characters,\nchecked on decode and by every constructor, so a value that would be\nrefused can never be built or sent.",
+      "properties": {
+        "gitSha": {
+          "description": "Full or abbreviated git commit of the build.",
+          "maxLength": 256,
+          "minLength": 1,
+          "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+          "type": "string"
+        },
+        "name": {
+          "description": "Product name, such as `lightspeed-envd`.",
+          "maxLength": 256,
+          "minLength": 1,
+          "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+          "type": "string"
+        },
+        "target": {
+          "description": "Rust target triple of the build.",
+          "maxLength": 256,
+          "minLength": 1,
+          "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+          "type": "string"
+        },
+        "version": {
+          "description": "Release version, such as `0.5.0`.",
+          "maxLength": 256,
+          "minLength": 1,
+          "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+          "type": "string"
+        }
+      },
+      "required": [
+        "name"
+      ],
+      "type": "object"
+    },
+    "IncarnationId": {
+      "description": "`incarnationId` of one incarnation of an environment.",
+      "maxLength": 128,
+      "minLength": 1,
+      "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$",
+      "type": "string"
+    },
+    "IngressObservation": {
+      "additionalProperties": false,
+      "description": "Realized public ingress of a target.",
+      "properties": {
+        "endpoint": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/PublicUrl"
+            }
+          ],
+          "description": "Public URL that reaches the target's application."
+        }
+      },
+      "required": [
+        "endpoint"
+      ],
+      "type": "object"
+    },
+    "ListTemplatesParams": {
+      "additionalProperties": false,
+      "description": "`template/list` params.",
+      "properties": {
+        "binding": {
+          "$ref": "#/definitions/BindingRef"
+        }
+      },
+      "required": [
+        "binding"
+      ],
+      "type": "object"
+    },
+    "ListTemplatesResponse": {
+      "additionalProperties": false,
+      "description": "`template/list` response.",
+      "properties": {
+        "templates": {
+          "items": {
+            "$ref": "#/definitions/EnvironmentTemplate"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "Metadata": {
+      "additionalProperties": {
+        "maxLength": 256,
+        "minLength": 1,
+        "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+        "type": "string"
+      },
+      "description": "Descriptive key-value metadata: at most 32 entries, keys 1 to 64 bytes outside the reserved `lightspeed.` prefix, values 1 to 256 bytes, no control characters.",
+      "maxProperties": 32,
+      "propertyNames": {
+        "maxLength": 64,
+        "minLength": 1,
+        "not": {
+          "pattern": "^lightspeed\\."
+        },
+        "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$"
+      },
+      "type": "object"
+    },
+    "NotFoundReason": {
+      "description": "Why a handle, path or identity was not found.",
+      "oneOf": [
+        {
+          "const": "expired",
+          "description": "Its retention window ended; a tombstone remembers it.",
+          "type": "string"
+        },
+        {
+          "const": "daemonRestarted",
+          "description": "It belonged to an earlier daemon instance (see `daemonInstanceId`).",
+          "type": "string"
+        },
+        {
+          "const": "unknownDaemon",
+          "description": "A daemon identity the gateway has never admitted presented no\nregistration key.",
+          "type": "string"
+        }
+      ]
+    },
+    "PermissionReason": {
+      "description": "Why a `permissionDenied` request was refused.",
+      "oneOf": [
+        {
+          "const": "outsideRoot",
+          "description": "The path, or a symlink it passes through, resolves outside the\ndaemon's filesystem root.",
+          "type": "string"
+        },
+        {
+          "const": "daemonState",
+          "description": "The path names or contains the daemon's state directory.",
+          "type": "string"
+        },
+        {
+          "const": "filePermission",
+          "description": "The operating system refused access.",
+          "type": "string"
+        },
+        {
+          "const": "invalidSignature",
+          "description": "The registration signature does not verify.",
+          "type": "string"
+        },
+        {
+          "const": "invalidRegistrationKey",
+          "description": "The registration key is unknown.",
+          "type": "string"
+        },
+        {
+          "const": "registrationKeyRevoked",
+          "description": "The registration key was revoked.",
+          "type": "string"
+        }
+      ]
+    },
+    "Plane": {
+      "description": "The plane a connection serves. Each `initialize` response names its\nplane, so a client that reached the wrong socket fails at the handshake.",
+      "oneOf": [
+        {
+          "const": "data",
+          "description": "envd's data plane, versioned by `ENVD_PROTOCOL_VERSION`.",
+          "type": "string"
+        },
+        {
+          "const": "controller",
+          "description": "A provider controller, versioned by `CONTROLLER_PROTOCOL_VERSION`.",
+          "type": "string"
+        },
+        {
+          "const": "registration",
+          "description": "The registration channel between a daemon and the gateway, versioned\nby `ENVD_PROTOCOL_VERSION`.",
+          "type": "string"
+        }
+      ]
+    },
+    "PowerState": {
+      "description": "Steady power state of an active target, in provider-neutral terms.",
+      "oneOf": [
+        {
+          "enum": [
+            "running"
+          ],
+          "type": "string"
+        },
+        {
+          "const": "paused",
+          "description": "Execution halted, memory retained; resuming is fast.",
+          "type": "string"
+        },
+        {
+          "const": "suspended",
+          "description": "Execution state persisted, compute released; resuming restores it.",
+          "type": "string"
+        },
+        {
+          "const": "stopped",
+          "description": "Powered off; disks retained.",
+          "type": "string"
+        }
+      ]
+    },
+    "PreconditionReason": {
+      "description": "The state that forbids a `failedPrecondition` request.",
+      "oneOf": [
+        {
+          "const": "inputClosed",
+          "description": "The process has no open input: started without `pipe` or `pty`,\ninput already closed, or exited.",
+          "type": "string"
+        },
+        {
+          "const": "ifMatchFailed",
+          "description": "The file's current `version` differs from `ifMatch`.",
+          "type": "string"
+        },
+        {
+          "const": "createCondition",
+          "description": "`create: ifAbsent` met an existing file, or `create: ifPresent` a\nmissing one.",
+          "type": "string"
+        },
+        {
+          "const": "notEmpty",
+          "description": "The directory is not empty and `recursive` was not set.",
+          "type": "string"
+        },
+        {
+          "const": "isDirectory",
+          "description": "The path names a directory where a file is required.",
+          "type": "string"
+        },
+        {
+          "const": "notDirectory",
+          "description": "A path component or the path names a non-directory where a directory\nis required.",
+          "type": "string"
+        },
+        {
+          "const": "notRegularFile",
+          "description": "The path names a device, FIFO, socket or other non-regular file.",
+          "type": "string"
+        },
+        {
+          "const": "symlinkLoop",
+          "description": "A symlink chain loops.",
+          "type": "string"
+        },
+        {
+          "const": "symlinkRejected",
+          "description": "A capture met a symlink that leaves the selection, or one the\nselection's symlink policy rejects.",
+          "type": "string"
+        },
+        {
+          "const": "filesystemRoot",
+          "description": "The filesystem root itself cannot be replaced or removed.",
+          "type": "string"
+        },
+        {
+          "const": "crossDevice",
+          "description": "Rename across filesystems.",
+          "type": "string"
+        },
+        {
+          "const": "noSpace",
+          "description": "No space left on the device.",
+          "type": "string"
+        },
+        {
+          "const": "jobIdInUse",
+          "description": "A job id is in use by a job with another `requestId` or spec; choose\na new job id.",
+          "type": "string"
+        },
+        {
+          "const": "operationIdInUse",
+          "description": "A transfer `operationId` is in use for different input.",
+          "type": "string"
+        },
+        {
+          "const": "transferPhase",
+          "description": "The transfer action is not valid in the operation's current phase.",
+          "type": "string"
+        },
+        {
+          "const": "transferOffset",
+          "description": "A transfer write's `offset` is not the digest's next expected offset.",
+          "type": "string"
+        },
+        {
+          "const": "digestMismatch",
+          "description": "Uploaded bytes do not hash to their digest.",
+          "type": "string"
+        },
+        {
+          "const": "environmentClosed",
+          "description": "The environment is closed; its identity or target is spent.",
+          "type": "string"
+        },
+        {
+          "const": "identityInUse",
+          "description": "The daemon identity is bound to another universe.",
+          "type": "string"
+        },
+        {
+          "const": "ownerMismatch",
+          "description": "The target belongs to another owner, or (`target/adopt`) the owner\nalready holds a different target.",
+          "type": "string"
+        },
+        {
+          "const": "templateDeprecated",
+          "description": "The template is deprecated and creates no new targets.",
+          "type": "string"
+        },
+        {
+          "const": "ingressUnsupported",
+          "description": "`ingress/ensure` on a target whose template has no public ingress.",
+          "type": "string"
+        },
+        {
+          "const": "targetNotActive",
+          "description": "A power change on a target whose `phase` is not `active`\n(provisioning, closing, closed or failed).",
+          "type": "string"
+        },
+        {
+          "const": "notAdoptable",
+          "description": "`target/adopt`: the source target exists but the provider cannot take\nit over, for example an instance of a kind it does not manage.",
+          "type": "string"
+        }
+      ]
+    },
+    "ProtocolError": {
+      "additionalProperties": false,
+      "description": "A protocol error: one kind, its typed data and a message.\n\nSerializes as an `ErrorObject`. Displays as `{kind}: {message}`.",
+      "properties": {
+        "code": {
+          "description": "Fixed by `data.kind`; see `ProtocolErrorKind::code`.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "data": {
+          "$ref": "#/definitions/ErrorData"
+        },
+        "message": {
+          "description": "Human-readable description. Never parsed.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "code",
+        "message",
+        "data"
+      ],
+      "type": "object"
+    },
+    "ProviderNativeRef": {
+      "description": "`sourceTarget` of `target/adopt`: a provider-native reference to an\nexisting target, in a format the provider defines.",
+      "maxLength": 255,
+      "minLength": 1,
+      "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+      "type": "string"
+    },
+    "ProviderTargetId": {
+      "description": "`targetId`: the provider's own id for a target, opaque to Lightspeed.",
+      "maxLength": 255,
+      "minLength": 1,
+      "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+      "type": "string"
+    },
+    "PublicUrl": {
+      "description": "A public `http://` or `https://` URL a provider reports, such as a\ntarget's ingress `endpoint`: lowercase scheme, a host and optional port,\noptional path and query, no user information or fragment, at most 2048\nbytes. Validated on decode.",
+      "maxLength": 2048,
+      "minLength": 1,
+      "pattern": "^https?://[^/?#@\\s]+([/?][^#\\s]*)?$",
+      "type": "string"
+    },
+    "RemoveIngressParams": {
+      "additionalProperties": false,
+      "description": "`ingress/remove` params: stop routing public ingress to the target.\nIdempotent.",
+      "properties": {
+        "target": {
+          "$ref": "#/definitions/TargetRef"
+        }
+      },
+      "required": [
+        "target"
+      ],
+      "type": "object"
+    },
+    "SetTargetPowerParams": {
+      "additionalProperties": false,
+      "description": "`target/setPower` params: converge the target toward `power`. A target\nalready in, or moving toward, that state is observed without further\naction. Resuming may replace the underlying host process. A target whose\n`phase` is not `active` is `failedPrecondition` (`targetNotActive`); a\nstate outside `supportedPowerStates` is `invalidParams`.",
+      "properties": {
+        "power": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/PowerState"
+            }
+          ],
+          "description": "One of the target's `supportedPowerStates`."
+        },
+        "target": {
+          "$ref": "#/definitions/TargetRef"
+        }
+      },
+      "required": [
+        "target",
+        "power"
+      ],
+      "type": "object"
+    },
+    "TargetObservation": {
+      "additionalProperties": false,
+      "description": "What the provider observes about a target. Every target method answers\nwith one.",
+      "properties": {
+        "displayName": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/DisplayName"
+            }
+          ]
+        },
+        "ingress": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/IngressObservation"
+            }
+          ],
+          "description": "Public ingress as realized; absent when disabled."
+        },
+        "metadata": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/Metadata"
+            }
+          ],
+          "description": "Provider-specific display facts."
+        },
+        "owner": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/TargetOwner"
+            }
+          ],
+          "description": "Echoed from the request."
+        },
+        "state": {
+          "$ref": "#/definitions/TargetState"
+        },
+        "supportedPowerStates": {
+          "description": "Power states `target/setPower` can move this target to. Empty when\nthe provider offers no power control beyond create and close.",
+          "items": {
+            "$ref": "#/definitions/PowerState"
+          },
+          "type": "array"
+        },
+        "targetId": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/ProviderTargetId"
+            }
+          ],
+          "description": "The provider's id for the target. Absent in two cases only: while\n`phase` is `provisioning` and the provider has not assigned an id\nyet (an asynchronous create answers before it has one; the runtime\nrecords the id from the first observation that carries it), and in a\n`closed` observation of an owner the provider holds no target for."
+        }
+      },
+      "required": [
+        "owner",
+        "state"
+      ],
+      "type": "object"
+    },
+    "TargetOwner": {
+      "additionalProperties": false,
+      "description": "The Lightspeed incarnation a target belongs to. A provider owns at most\none target per owner.",
+      "properties": {
+        "bindingId": {
+          "$ref": "#/definitions/BindingId"
+        },
+        "environmentId": {
+          "$ref": "#/definitions/EnvironmentId"
+        },
+        "incarnationId": {
+          "$ref": "#/definitions/IncarnationId"
+        },
+        "universeId": {
+          "$ref": "#/definitions/UniverseId"
+        }
+      },
+      "required": [
+        "universeId",
+        "bindingId",
+        "environmentId",
+        "incarnationId"
+      ],
+      "type": "object"
+    },
+    "TargetPhase": {
+      "description": "Lifecycle phase of a target.",
+      "oneOf": [
+        {
+          "const": "provisioning",
+          "description": "Being created; not yet usable.",
+          "type": "string"
+        },
+        {
+          "const": "active",
+          "description": "Exists; see `power`.",
+          "type": "string"
+        },
+        {
+          "const": "closing",
+          "description": "Being destroyed.",
+          "type": "string"
+        },
+        {
+          "const": "closed",
+          "description": "Gone, and nothing of it remains.",
+          "type": "string"
+        },
+        {
+          "const": "failed",
+          "description": "Broken beyond the provider's own recovery; see `message`.",
+          "type": "string"
+        },
+        {
+          "const": "unknown",
+          "description": "The provider cannot tell; see `message`.",
+          "type": "string"
+        }
+      ]
+    },
+    "TargetRef": {
+      "additionalProperties": false,
+      "description": "A reference to an existing target: its owner and, once known, its id.\nWithout `targetId` the provider resolves the owner's target itself.",
+      "properties": {
+        "owner": {
+          "$ref": "#/definitions/TargetOwner"
+        },
+        "targetId": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/ProviderTargetId"
+            }
+          ]
+        }
+      },
+      "required": [
+        "owner"
+      ],
+      "type": "object"
+    },
+    "TargetResponse": {
+      "additionalProperties": false,
+      "description": "Response of every target method and both ingress methods.",
+      "properties": {
+        "target": {
+          "$ref": "#/definitions/TargetObservation"
+        }
+      },
+      "required": [
+        "target"
+      ],
+      "type": "object"
+    },
+    "TargetState": {
+      "additionalProperties": false,
+      "description": "A target's state on two axes: lifecycle `phase`, and `power` while\nactive.",
+      "properties": {
+        "daemonReady": {
+          "description": "envd answers on the target's data route (running targets only).",
+          "type": "boolean"
+        },
+        "message": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/DescriptiveText"
+            }
+          ],
+          "description": "Why the target is `failed` or `unknown`, or what a transition waits\nfor. Providers build it with\n`DescriptiveText::lossy` from whatever their backend reports."
+        },
+        "phase": {
+          "$ref": "#/definitions/TargetPhase"
+        },
+        "power": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/PowerState"
+            }
+          ],
+          "description": "Present exactly when `phase` is `active`."
+        }
+      },
+      "required": [
+        "phase"
+      ],
+      "type": "object"
+    },
+    "TemplateId": {
+      "description": "`templateId`: the provider's own id for a template.",
+      "maxLength": 255,
+      "minLength": 1,
+      "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+      "type": "string"
+    },
+    "TemplateResources": {
+      "additionalProperties": false,
+      "description": "Compute a template's targets get, in provider-neutral units. Each\nfield is absent when the provider does not fix it.",
+      "properties": {
+        "diskBytes": {
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "memoryBytes": {
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "vcpus": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "type": "object"
+    },
+    "UniverseId": {
+      "description": "`universeId` of a Lightspeed universe.",
+      "maxLength": 128,
+      "minLength": 1,
+      "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$",
+      "type": "string"
+    }
+  },
+  "description": "Every wire type of the controller plane, protocol version 3.",
+  "title": "Lightspeed environment controller plane"
+}
diff --git a/crates/environment-protocol/contract/data.openrpc.json b/crates/environment-protocol/contract/data.openrpc.json
new file mode 100644
index 000000000..8612aa09f
--- /dev/null
+++ b/crates/environment-protocol/contract/data.openrpc.json
@@ -0,0 +1,5768 @@
+{
+  "components": {
+    "schemas": {
+      "AbortReason": {
+        "description": "Why an operation was `aborted`.",
+        "oneOf": [
+          {
+            "const": "cancelled",
+            "description": "`$/cancelRequest` named the request.",
+            "type": "string"
+          },
+          {
+            "const": "sourceChanged",
+            "description": "A file or directory changed while it was being read.",
+            "type": "string"
+          }
+        ]
+      },
+      "AppendTransferInventoryParams": {
+        "additionalProperties": false,
+        "description": "`transfer/append` params: add incoming inventory entries in order.\nRetrying an identical page is safe.",
+        "properties": {
+          "entries": {
+            "description": "At most `limits.filesystem.transfer.maxInventoryPageEntries`.",
+            "items": {
+              "$ref": "#/components/schemas/InventoryEntry"
+            },
+            "type": "array"
+          },
+          "index": {
+            "description": "Index of the page's first entry: the number of entries appended\nbefore it.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "last": {
+            "description": "This page completes the inventory.",
+            "type": "boolean"
+          },
+          "operationId": {
+            "$ref": "#/components/schemas/TransferOperationId"
+          }
+        },
+        "required": [
+          "operationId",
+          "index",
+          "entries"
+        ],
+        "type": "object"
+      },
+      "BeginTransferParams": {
+        "additionalProperties": false,
+        "description": "`transfer/begin` params. Idempotent: a repeat with identical input\nreturns the operation's status; different input under the same id is\n`failedPrecondition` (`operationIdInUse`).",
+        "properties": {
+          "limits": {
+            "$ref": "#/components/schemas/TransferLimits"
+          },
+          "operationId": {
+            "$ref": "#/components/schemas/TransferOperationId"
+          },
+          "selection": {
+            "$ref": "#/components/schemas/TransferSelection"
+          }
+        },
+        "required": [
+          "operationId",
+          "selection",
+          "limits"
+        ],
+        "type": "object"
+      },
+      "BusyReason": {
+        "description": "What limit a `busy` request hit.",
+        "oneOf": [
+          {
+            "const": "requestLimit",
+            "description": "The connection's concurrent request limit.",
+            "type": "string"
+          },
+          {
+            "const": "transferCapacity",
+            "description": "The daemon's limit on active transfer operations.",
+            "type": "string"
+          },
+          {
+            "const": "rateLimited",
+            "description": "A rate limit on the caller's identity.",
+            "type": "string"
+          },
+          {
+            "const": "capacityExhausted",
+            "description": "A registration key's limit on active environments.",
+            "type": "string"
+          }
+        ]
+      },
+      "ByteChunk": {
+        "contentEncoding": "base64",
+        "description": "Payload bytes, always named `data` on the wire, as padded standard\nbase64.",
+        "pattern": "^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$",
+        "type": "string"
+      },
+      "CancelJobsParams": {
+        "additionalProperties": false,
+        "description": "`job/cancel` params.",
+        "properties": {
+          "force": {
+            "description": "Kill at once instead of `SIGTERM`, `limits.job.cancelGraceMs`, then\n`SIGKILL`.",
+            "type": "boolean"
+          },
+          "jobIds": {
+            "description": "1 to `limits.job.maxRequestJobs` ids.",
+            "items": {
+              "$ref": "#/components/schemas/JobId"
+            },
+            "type": "array"
+          },
+          "scope": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/JobCancelScope"
+              }
+            ],
+            "description": "`job` by default."
+          }
+        },
+        "required": [
+          "jobIds"
+        ],
+        "type": "object"
+      },
+      "CancelJobsResponse": {
+        "additionalProperties": false,
+        "description": "`job/cancel` response: one entry per affected job, named jobs first in\nrequest order, then dependents, at most `limits.job.maxRequestJobs`\nentries in total.",
+        "properties": {
+          "jobs": {
+            "description": "Never empty.",
+            "items": {
+              "$ref": "#/components/schemas/JobSummaryEntry"
+            },
+            "type": "array"
+          },
+          "unlistedJobCount": {
+            "description": "Dependents cancelled as well but not listed, beyond the entry limit.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "jobs"
+        ],
+        "type": "object"
+      },
+      "CancelRequestParams": {
+        "additionalProperties": false,
+        "description": "`$/cancelRequest` params.",
+        "properties": {
+          "id": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/Id"
+              }
+            ],
+            "description": "Id of the request to abort."
+          }
+        },
+        "required": [
+          "id"
+        ],
+        "type": "object"
+      },
+      "Capability": {
+        "description": "A capability a request needed and the endpoint lacks.",
+        "oneOf": [
+          {
+            "const": "filesystem",
+            "description": "The `filesystem` family.",
+            "type": "string"
+          },
+          {
+            "const": "filesystemWrite",
+            "description": "`capabilities.filesystem.write`: the filesystem is writable.",
+            "type": "string"
+          },
+          {
+            "const": "process",
+            "description": "The `process` family.",
+            "type": "string"
+          },
+          {
+            "const": "processPty",
+            "description": "`capabilities.process.pty`.",
+            "type": "string"
+          },
+          {
+            "const": "job",
+            "description": "The `job` family.",
+            "type": "string"
+          },
+          {
+            "const": "adoptTarget",
+            "description": "The controller's `adoptTarget` capability.",
+            "type": "string"
+          },
+          {
+            "const": "ingress",
+            "description": "The controller's `ingress` capability.",
+            "type": "string"
+          }
+        ]
+      },
+      "CommandSpec": {
+        "additionalProperties": false,
+        "description": "What to run. Shared by `process/start` and `job/start`.",
+        "properties": {
+          "argv": {
+            "description": "Program and arguments; `argv[0]` is resolved through `PATH`. Not\nempty.",
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "cwd": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/EnvironmentPath"
+              }
+            ],
+            "description": "Working directory; the daemon's `defaultCwd` when absent."
+          },
+          "env": {
+            "additionalProperties": {
+              "type": "string"
+            },
+            "description": "Variables added to the daemon's scrubbed environment.",
+            "type": "object"
+          },
+          "input": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/ExecInput"
+              }
+            ],
+            "description": "Standard input; none by default."
+          },
+          "secretEnv": {
+            "additionalProperties": {
+              "$ref": "#/components/schemas/SecretString"
+            },
+            "description": "Like `env`, but every value is redacted from the command's output.",
+            "type": "object"
+          },
+          "timeoutMs": {
+            "description": "Stop deadline from start. On expiry the daemon terminates the process\ngroup (`SIGTERM`, the advertised grace, then `SIGKILL`) and records\n`stoppedBy: timeout`. Absent means no deadline.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "argv"
+        ],
+        "type": "object"
+      },
+      "ContentDigest": {
+        "description": "`sha256:` followed by 64 lowercase hex digits: the digest of a file's raw\nbytes, independent of its path and mode.",
+        "pattern": "^sha256:[0-9a-f]{64}$",
+        "type": "string"
+      },
+      "CreateDirectoryParams": {
+        "additionalProperties": false,
+        "description": "`fs/createDirectory` params.",
+        "properties": {
+          "path": {
+            "$ref": "#/components/schemas/EnvironmentPath"
+          },
+          "recursive": {
+            "description": "Create missing parents, and succeed when the directory exists.",
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "path"
+        ],
+        "type": "object"
+      },
+      "CreateDirectoryResponse": {
+        "additionalProperties": false,
+        "description": "`fs/createDirectory` response.",
+        "type": "object"
+      },
+      "DaemonInstanceId": {
+        "description": "`daemonInstanceId`: random per daemon start. A change between two\nconnections means the daemon restarted and every process handle from\nthe earlier instance is gone.",
+        "maxLength": 128,
+        "minLength": 1,
+        "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$",
+        "type": "string"
+      },
+      "DataCapabilities": {
+        "additionalProperties": false,
+        "description": "Capability families. A present family means its base methods exist; a\nfamily's fields are facts that vary per instance. A request to an\nabsent family, or one needing an absent fact, is\n`capabilityUnavailable`.",
+        "properties": {
+          "filesystem": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/FilesystemCapabilities"
+              }
+            ],
+            "description": "`fs/*` (search, glob and scan included) and `transfer/*`."
+          },
+          "job": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/JobCapabilities"
+              }
+            ],
+            "description": "`job/*`."
+          },
+          "process": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/ProcessCapabilities"
+              }
+            ],
+            "description": "`process/*`."
+          }
+        },
+        "type": "object"
+      },
+      "DataLimits": {
+        "additionalProperties": false,
+        "description": "Operational ceilings this daemon enforces. A request above a ceiling is\n`invalidParams` naming the field and the ceiling; nothing is clamped.",
+        "properties": {
+          "filesystem": {
+            "$ref": "#/components/schemas/FilesystemLimits"
+          },
+          "job": {
+            "$ref": "#/components/schemas/JobLimits"
+          },
+          "maxConcurrentRequests": {
+            "description": "Requests in flight per connection before `busy`; at least\n`MIN_CONCURRENT_REQUESTS`.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxWaitMs": {
+            "description": "Largest `waitMs` of `process/read` and `job/read`.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "process": {
+            "$ref": "#/components/schemas/ProcessLimits"
+          }
+        },
+        "required": [
+          "maxConcurrentRequests",
+          "maxWaitMs",
+          "process",
+          "job",
+          "filesystem"
+        ],
+        "type": "object"
+      },
+      "DirectoryCursor": {
+        "description": "`cursor` and `nextCursor` of `fs/readDirectory`: an opaque position\nthe daemon mints, echoed back unchanged.",
+        "maxLength": 255,
+        "minLength": 1,
+        "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+        "type": "string"
+      },
+      "DirectoryEntry": {
+        "additionalProperties": false,
+        "description": "One `fs/readDirectory` entry.",
+        "properties": {
+          "metadata": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/FileMetadata"
+              }
+            ],
+            "description": "The entry itself, not a symlink's target. Entries that vanish while\nthe page is built are left out."
+          },
+          "name": {
+            "$ref": "#/components/schemas/EntryName"
+          }
+        },
+        "required": [
+          "name",
+          "metadata"
+        ],
+        "type": "object"
+      },
+      "EntryName": {
+        "description": "One entry name: a single path segment, neither `.` nor `..`, without\n`/` or NUL, at most 4096 bytes. `fs/readDirectory` entries use it.",
+        "maxLength": 4096,
+        "minLength": 1,
+        "pattern": "^(?!\\.\\.?$)[^/\\u0000]+$",
+        "type": "string"
+      },
+      "EnvironmentPath": {
+        "description": "An absolute, normalized POSIX path in the environment: `/`, or `/` and\none or more segments joined by `/`. Empty, `.` and `..` segments and a\ntrailing `/` are rejected, never rewritten. At most 4096 bytes.\n`defaultCwd`, `homeDirectory`, every `cwd` and every path parameter use\nthis type; see the module's path model and confinement rule.",
+        "maxLength": 4096,
+        "minLength": 1,
+        "pattern": "^(/|(/(?!\\.\\.?(/|$))[^/\\u0000]+)+)$",
+        "type": "string"
+      },
+      "ErrorData": {
+        "description": "The `data` member of an error object: the kind and its typed fields.\n\nKinds without fields are empty struct variants rather than unit\nvariants: serde does not apply `deny_unknown_fields` to the unit\nvariants of an internally tagged enum, and every kind must refuse\nunknown members.",
+        "oneOf": [
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "parseError",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "invalidRequest",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "methodNotFound",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "ceiling": {
+                "description": "The advertised ceiling the value exceeded.",
+                "format": "uint64",
+                "minimum": 0,
+                "type": "integer"
+              },
+              "field": {
+                "description": "Wire path of the offending field, such as `limits.maxDurationMs`.",
+                "type": "string"
+              },
+              "kind": {
+                "const": "invalidParams",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "notInitialized",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "expected": {
+                "description": "The version of the peer that sent this error.",
+                "format": "uint32",
+                "minimum": 0,
+                "type": "integer"
+              },
+              "kind": {
+                "const": "versionMismatch",
+                "type": "string"
+              },
+              "received": {
+                "description": "The version the requester stated.",
+                "format": "uint32",
+                "minimum": 0,
+                "type": "integer"
+              }
+            },
+            "required": [
+              "kind",
+              "expected",
+              "received"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "notFound",
+                "type": "string"
+              },
+              "reason": {
+                "anyOf": [
+                  {
+                    "$ref": "#/components/schemas/NotFoundReason"
+                  }
+                ]
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "alreadyExists",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "failedPrecondition",
+                "type": "string"
+              },
+              "reason": {
+                "$ref": "#/components/schemas/PreconditionReason"
+              }
+            },
+            "required": [
+              "kind",
+              "reason"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "permissionDenied",
+                "type": "string"
+              },
+              "reason": {
+                "anyOf": [
+                  {
+                    "$ref": "#/components/schemas/PermissionReason"
+                  }
+                ]
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "capability": {
+                "$ref": "#/components/schemas/Capability"
+              },
+              "kind": {
+                "const": "capabilityUnavailable",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind",
+              "capability"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "busy",
+                "type": "string"
+              },
+              "reason": {
+                "anyOf": [
+                  {
+                    "$ref": "#/components/schemas/BusyReason"
+                  }
+                ]
+              },
+              "retryAfterMs": {
+                "description": "Earliest useful retry, when the server knows it.",
+                "format": "uint64",
+                "minimum": 0,
+                "type": "integer"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "deadlineExceeded",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "expired",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "aborted",
+                "type": "string"
+              },
+              "reason": {
+                "anyOf": [
+                  {
+                    "$ref": "#/components/schemas/AbortReason"
+                  }
+                ]
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "payloadTooLarge",
+                "type": "string"
+              },
+              "limitBytes": {
+                "description": "The byte limit the payload exceeded.",
+                "format": "uint64",
+                "minimum": 0,
+                "type": "integer"
+              },
+              "limitEntries": {
+                "description": "The entry-count limit the result exceeded.",
+                "format": "uint32",
+                "minimum": 0,
+                "type": "integer"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "processFailed",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "unavailable",
+                "type": "string"
+              },
+              "retryAfterMs": {
+                "format": "uint64",
+                "minimum": 0,
+                "type": "integer"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "internal",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          }
+        ]
+      },
+      "ExecInput": {
+        "description": "Standard input of a command.",
+        "oneOf": [
+          {
+            "additionalProperties": false,
+            "description": "`/dev/null`: the command reads end of file. Model-facing tools use\nthis.",
+            "properties": {
+              "kind": {
+                "const": "none",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "description": "These bytes, then end of file. Written by a writer task after the\noutput readers, the exit watcher and the deadline are in place.",
+            "properties": {
+              "data": {
+                "$ref": "#/components/schemas/ByteChunk"
+              },
+              "kind": {
+                "const": "bytes",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind",
+              "data"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "description": "A persistent pipe fed by `process/write` until closed. Processes\nonly; `job/start` refuses it with `invalidParams`.",
+            "properties": {
+              "kind": {
+                "const": "pipe",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          }
+        ]
+      },
+      "ExecState": {
+        "description": "Lifecycle state of a process.",
+        "oneOf": [
+          {
+            "enum": [
+              "running"
+            ],
+            "type": "string"
+          },
+          {
+            "const": "exited",
+            "description": "The root exited and its output settled.",
+            "type": "string"
+          }
+        ]
+      },
+      "ExitStatus": {
+        "description": "How the root process ended.",
+        "oneOf": [
+          {
+            "additionalProperties": false,
+            "description": "Normal exit with this status code.",
+            "properties": {
+              "code": {
+                "format": "int32",
+                "type": "integer"
+              },
+              "kind": {
+                "const": "code",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind",
+              "code"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "description": "Killed by this signal.",
+            "properties": {
+              "coreDumped": {
+                "type": "boolean"
+              },
+              "kind": {
+                "const": "signal",
+                "type": "string"
+              },
+              "signal": {
+                "$ref": "#/components/schemas/SignalName"
+              }
+            },
+            "required": [
+              "kind",
+              "signal"
+            ],
+            "type": "object"
+          }
+        ]
+      },
+      "FileKind": {
+        "description": "Kind of a filesystem entry.",
+        "oneOf": [
+          {
+            "enum": [
+              "file",
+              "directory",
+              "symlink"
+            ],
+            "type": "string"
+          },
+          {
+            "const": "other",
+            "description": "Device, FIFO, socket or another special file.",
+            "type": "string"
+          }
+        ]
+      },
+      "FileMetadata": {
+        "additionalProperties": false,
+        "description": "One file-entry shape for `fs/getMetadata` and `fs/readDirectory`.",
+        "properties": {
+          "createdAtMs": {
+            "description": "Absent when the filesystem records no birth time.",
+            "format": "int64",
+            "type": "integer"
+          },
+          "executable": {
+            "description": "A regular file with any execute bit set; always false for\ndirectories, symlinks and special files.",
+            "type": "boolean"
+          },
+          "kind": {
+            "$ref": "#/components/schemas/FileKind"
+          },
+          "modifiedAtMs": {
+            "format": "int64",
+            "type": "integer"
+          },
+          "sizeBytes": {
+            "description": "Size in bytes; for a symlink, the length of its target text.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "symlinkTarget": {
+            "description": "Target text of a symlink, when it is UTF-8.",
+            "type": "string"
+          },
+          "version": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/FileVersion"
+              }
+            ],
+            "description": "Changes whenever the entry's content or identity changes; compare it\nwith `ifMatch`."
+          }
+        },
+        "required": [
+          "kind",
+          "sizeBytes",
+          "modifiedAtMs",
+          "version"
+        ],
+        "type": "object"
+      },
+      "FileVersion": {
+        "description": "Opaque version token of a file's content and identity. Equal tokens for\none path mean the content is unchanged. 1 to 255 bytes without control\ncharacters.",
+        "maxLength": 255,
+        "minLength": 1,
+        "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+        "type": "string"
+      },
+      "FilesystemCapabilities": {
+        "additionalProperties": false,
+        "description": "The `filesystem` family: `fs/*` and `transfer/*`.",
+        "properties": {
+          "write": {
+            "description": "Methods that change the filesystem are served; false on a daemon\nstarted read-only.",
+            "type": "boolean"
+          }
+        },
+        "type": "object"
+      },
+      "FilesystemLimits": {
+        "additionalProperties": false,
+        "description": "Ceilings of `fs/*` and `transfer/*`.",
+        "properties": {
+          "glob": {
+            "$ref": "#/components/schemas/GlobCeilings"
+          },
+          "maxDirectoryEntries": {
+            "description": "Largest `limit` of `fs/readDirectory`.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxReadFileBytes": {
+            "description": "Largest `maxBytes` of `fs/readFile`.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxWriteFileBytes": {
+            "description": "Largest `data` of `fs/writeFile`.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "scan": {
+            "$ref": "#/components/schemas/ScanCeilings"
+          },
+          "search": {
+            "$ref": "#/components/schemas/SearchCeilings"
+          },
+          "transfer": {
+            "$ref": "#/components/schemas/TransferCeilings"
+          }
+        },
+        "required": [
+          "maxReadFileBytes",
+          "maxWriteFileBytes",
+          "maxDirectoryEntries",
+          "search",
+          "glob",
+          "scan",
+          "transfer"
+        ],
+        "type": "object"
+      },
+      "GapReason": {
+        "description": "Why a range of output cannot be returned.",
+        "oneOf": [
+          {
+            "const": "overflow",
+            "description": "Never delivered: dropped from the middle because retained output\nexceeded the handle's cap. The head and the newest bytes are kept.",
+            "type": "string"
+          },
+          {
+            "const": "expired",
+            "description": "Already delivered through the daemon cursor (or acknowledged) and\nreleased since.",
+            "type": "string"
+          }
+        ]
+      },
+      "GetIdleParams": {
+        "additionalProperties": false,
+        "description": "`env/getIdle` params.",
+        "type": "object"
+      },
+      "GetIdleResponse": {
+        "additionalProperties": false,
+        "description": "`env/getIdle` response.",
+        "properties": {
+          "idleForMs": {
+            "description": "Milliseconds since the last `use` request, or since running work\nlast ended, whichever is later. Zero while any process or job runs.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "leftoverProcessGroupCount": {
+            "description": "Process groups of exited processes that still have members alive:\nservices a command started and left running. They are not running\nwork and do not hold `idleForMs` at zero.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "runningJobCount": {
+            "description": "Jobs that are `running`.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "runningProcessCount": {
+            "description": "Processes started with `process/start` whose root has not exited.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "idleForMs"
+        ],
+        "type": "object"
+      },
+      "GetMetadataParams": {
+        "additionalProperties": false,
+        "description": "`fs/getMetadata` params.",
+        "properties": {
+          "followSymlinks": {
+            "description": "Describe the symlink's target instead of the link (subject to\nconfinement).",
+            "type": "boolean"
+          },
+          "path": {
+            "$ref": "#/components/schemas/EnvironmentPath"
+          }
+        },
+        "required": [
+          "path"
+        ],
+        "type": "object"
+      },
+      "GetMetadataResponse": {
+        "additionalProperties": false,
+        "description": "`fs/getMetadata` response.",
+        "properties": {
+          "metadata": {
+            "$ref": "#/components/schemas/FileMetadata"
+          }
+        },
+        "required": [
+          "metadata"
+        ],
+        "type": "object"
+      },
+      "GlobCeilings": {
+        "additionalProperties": false,
+        "description": "Ceilings of `fs/globFiles` quotas, field for field.",
+        "properties": {
+          "maxDurationMs": {
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxFiles": {
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxMatches": {
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "maxMatches",
+          "maxFiles",
+          "maxDurationMs"
+        ],
+        "type": "object"
+      },
+      "GlobFilesLimits": {
+        "additionalProperties": false,
+        "description": "Caller quotas of one enumeration; each at most its advertised ceiling.",
+        "properties": {
+          "maxDurationMs": {
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxFiles": {
+            "description": "Non-directory entries visited.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxMatches": {
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "maxMatches",
+          "maxFiles",
+          "maxDurationMs"
+        ],
+        "type": "object"
+      },
+      "GlobFilesParams": {
+        "additionalProperties": false,
+        "description": "`fs/globFiles` params: bounded recursive enumeration of non-directory\nentries matching `filter.include`.",
+        "properties": {
+          "filter": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/TreeFilter"
+              }
+            ],
+            "description": "`include` must not be empty."
+          },
+          "limits": {
+            "$ref": "#/components/schemas/GlobFilesLimits"
+          },
+          "root": {
+            "$ref": "#/components/schemas/EnvironmentPath"
+          }
+        },
+        "required": [
+          "root",
+          "filter",
+          "limits"
+        ],
+        "type": "object"
+      },
+      "GlobFilesResponse": {
+        "additionalProperties": false,
+        "description": "`fs/globFiles` response.",
+        "properties": {
+          "elapsedMs": {
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "matches": {
+            "description": "In walk order (sorted by path).",
+            "items": {
+              "$ref": "#/components/schemas/EnvironmentPath"
+            },
+            "type": "array"
+          },
+          "skippedEntryCount": {
+            "description": "Entries the walk could not represent or list: names that are not\nUTF-8 and directories that could not be read.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "stopped": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/GlobFilesStop"
+              }
+            ]
+          },
+          "visitedFileCount": {
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "visitedFileCount",
+          "elapsedMs"
+        ],
+        "type": "object"
+      },
+      "GlobFilesStop": {
+        "description": "Why an enumeration stopped before finishing its walk.",
+        "oneOf": [
+          {
+            "const": "matchLimit",
+            "description": "`maxMatches` paths were found.",
+            "type": "string"
+          },
+          {
+            "const": "fileLimit",
+            "description": "`maxFiles` non-directory entries were visited.",
+            "type": "string"
+          },
+          {
+            "const": "timeLimit",
+            "description": "`maxDurationMs` ran out.",
+            "type": "string"
+          },
+          {
+            "const": "responseLimit",
+            "description": "The next match would push the encoded matches past\n`MAX_RESULT_BYTES`.",
+            "type": "string"
+          }
+        ]
+      },
+      "Id": {
+        "anyOf": [
+          {
+            "format": "int64",
+            "type": "integer"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "description": "A request id: an integer or a string, echoed in the response."
+      },
+      "ImplementationInfo": {
+        "additionalProperties": false,
+        "description": "What a peer says about its own build: `clientInfo`, `serverInfo` and a\ndaemon's registration `implementation`. Descriptive only; the protocol\nversion alone decides whether two peers can talk, and nothing here\nselects, authenticates or gates. Every field is 1 to 256 bytes without control characters,\nchecked on decode and by every constructor, so a value that would be\nrefused can never be built or sent.",
+        "properties": {
+          "gitSha": {
+            "description": "Full or abbreviated git commit of the build.",
+            "maxLength": 256,
+            "minLength": 1,
+            "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+            "type": "string"
+          },
+          "name": {
+            "description": "Product name, such as `lightspeed-envd`.",
+            "maxLength": 256,
+            "minLength": 1,
+            "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+            "type": "string"
+          },
+          "target": {
+            "description": "Rust target triple of the build.",
+            "maxLength": 256,
+            "minLength": 1,
+            "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+            "type": "string"
+          },
+          "version": {
+            "description": "Release version, such as `0.5.0`.",
+            "maxLength": 256,
+            "minLength": 1,
+            "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+            "type": "string"
+          }
+        },
+        "required": [
+          "name"
+        ],
+        "type": "object"
+      },
+      "InitializeParams": {
+        "additionalProperties": false,
+        "description": "`initialize` params on the data plane.",
+        "properties": {
+          "clientInfo": {
+            "$ref": "#/components/schemas/ImplementationInfo"
+          },
+          "protocolVersion": {
+            "description": "The client's `ENVD_PROTOCOL_VERSION`.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "protocolVersion",
+          "clientInfo"
+        ],
+        "type": "object"
+      },
+      "InitializeResponse": {
+        "additionalProperties": false,
+        "description": "`initialize` response on the data plane.",
+        "properties": {
+          "capabilities": {
+            "$ref": "#/components/schemas/DataCapabilities"
+          },
+          "daemonInstanceId": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/DaemonInstanceId"
+              }
+            ],
+            "description": "Random per daemon start; a different value than on an earlier\nconnection means the daemon restarted and the earlier instance's\nprocess handles are gone."
+          },
+          "defaultCwd": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/EnvironmentPath"
+              }
+            ],
+            "description": "The daemon's working directory: the default `cwd` of commands."
+          },
+          "homeDirectory": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/EnvironmentPath"
+              }
+            ],
+            "description": "Home directory of the user commands run as, when known."
+          },
+          "limits": {
+            "$ref": "#/components/schemas/DataLimits"
+          },
+          "plane": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/Plane"
+              }
+            ],
+            "description": "Always `data`."
+          },
+          "protocolVersion": {
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "serverInfo": {
+            "$ref": "#/components/schemas/ImplementationInfo"
+          }
+        },
+        "required": [
+          "protocolVersion",
+          "plane",
+          "daemonInstanceId",
+          "serverInfo",
+          "capabilities",
+          "limits",
+          "defaultCwd"
+        ],
+        "type": "object"
+      },
+      "InventoryEntry": {
+        "additionalProperties": false,
+        "description": "One inventory entry. Parents precede children.",
+        "properties": {
+          "content": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/TreeContent"
+              }
+            ],
+            "description": "A file entry always carries its `digest`."
+          },
+          "path": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/TreePath"
+              }
+            ],
+            "description": "Relative to the selected root; `.` is the root itself."
+          }
+        },
+        "required": [
+          "path",
+          "content"
+        ],
+        "type": "object"
+      },
+      "JobCancelScope": {
+        "description": "Which jobs a `job/cancel` affects.",
+        "oneOf": [
+          {
+            "const": "job",
+            "description": "Only the named jobs.",
+            "type": "string"
+          },
+          {
+            "const": "dependents",
+            "description": "The named jobs and every job that transitively depends on them.",
+            "type": "string"
+          }
+        ]
+      },
+      "JobCapabilities": {
+        "additionalProperties": false,
+        "description": "The `job` family: `job/*`. It has no instance facts.",
+        "type": "object"
+      },
+      "JobDependency": {
+        "description": "A dependency reference.",
+        "oneOf": [
+          {
+            "additionalProperties": false,
+            "description": "An existing job on this daemon, or one in the same request.",
+            "properties": {
+              "jobId": {
+                "$ref": "#/components/schemas/JobId"
+              },
+              "kind": {
+                "const": "jobId",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind",
+              "jobId"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "description": "The `name` of a job in the same `job/start`.",
+            "properties": {
+              "kind": {
+                "const": "name",
+                "type": "string"
+              },
+              "name": {
+                "$ref": "#/components/schemas/JobName"
+              }
+            },
+            "required": [
+              "kind",
+              "name"
+            ],
+            "type": "object"
+          }
+        ]
+      },
+      "JobDependencyPolicy": {
+        "description": "What a job waits for from its `dependsOn` jobs.",
+        "oneOf": [
+          {
+            "const": "allSucceeded",
+            "description": "Run once every dependency `succeeded`; any other terminal status\nmakes this job `dependencyFailed`.",
+            "type": "string"
+          },
+          {
+            "const": "allTerminal",
+            "description": "Run once every dependency is terminal, whatever its status.",
+            "type": "string"
+          }
+        ]
+      },
+      "JobId": {
+        "description": "`jobId`: caller-chosen name of one job run on one daemon.",
+        "maxLength": 128,
+        "minLength": 1,
+        "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$",
+        "type": "string"
+      },
+      "JobLimits": {
+        "additionalProperties": false,
+        "description": "Ceilings of `job/*`.",
+        "properties": {
+          "cancelGraceMs": {
+            "description": "Grace between `SIGTERM` and `SIGKILL` for a non-forced cancel and\ntimeouts.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxReadBytes": {
+            "description": "Largest `maxBytes` of one `job/read`, across its entries.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxRequestJobs": {
+            "description": "Most jobs one `job/start`, `job/read` or `job/cancel` names, and most\nentries a `job/cancel` response lists.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxRetainedOutputBytes": {
+            "description": "Output a job retains: the head and the tail, each half of this; the\nmiddle is an `overflow` gap.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "recordRetentionMs": {
+            "description": "How long a terminal job's record and output are kept.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "maxReadBytes",
+          "maxRequestJobs",
+          "maxRetainedOutputBytes",
+          "recordRetentionMs",
+          "cancelGraceMs"
+        ],
+        "type": "object"
+      },
+      "JobName": {
+        "description": "`name` of a job and `dependsOn {kind: name}`: a caller-chosen name,\nunique within one `job/start`, 1 to 128 bytes without control\ncharacters.",
+        "maxLength": 128,
+        "minLength": 1,
+        "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+        "type": "string"
+      },
+      "JobReadEntry": {
+        "description": "A `job/read` entry: the job's summary and output page, or why it could\nnot be read (`notFound` for an unknown or garbage-collected job).",
+        "oneOf": [
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "job",
+                "type": "string"
+              },
+              "output": {
+                "$ref": "#/components/schemas/OutputPage"
+              },
+              "summary": {
+                "$ref": "#/components/schemas/JobSummary"
+              }
+            },
+            "required": [
+              "kind",
+              "summary",
+              "output"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "error": {
+                "$ref": "#/components/schemas/ProtocolError"
+              },
+              "jobId": {
+                "$ref": "#/components/schemas/JobId"
+              },
+              "kind": {
+                "const": "error",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind",
+              "jobId",
+              "error"
+            ],
+            "type": "object"
+          }
+        ]
+      },
+      "JobReadRequest": {
+        "additionalProperties": false,
+        "description": "One entry of a `job/read`. Job reads never consume: without `after` and\n`tailBytes` the page starts at offset 0. One job may be named by several\nentries, such as a head and a tail page.",
+        "properties": {
+          "after": {
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "jobId": {
+            "$ref": "#/components/schemas/JobId"
+          },
+          "maxBytes": {
+            "description": "Most `data` bytes for this entry; the request's `maxBytes` still\nbounds the total. Absent: whatever of the request's budget remains.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "tailBytes": {
+            "description": "Start at `end - tailBytes`; excludes `after`.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "jobId"
+        ],
+        "type": "object"
+      },
+      "JobRequestId": {
+        "description": "`requestId` of a `job/start` call. Part of each job's identity: a\nretried start with the same request id and spec replays the job; any\nother reuse of the job id is refused.",
+        "maxLength": 128,
+        "minLength": 1,
+        "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$",
+        "type": "string"
+      },
+      "JobSpec": {
+        "additionalProperties": false,
+        "description": "One job of a `job/start`.",
+        "properties": {
+          "command": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/CommandSpec"
+              }
+            ],
+            "description": "`input` must be `none` or `bytes`."
+          },
+          "dependencyPolicy": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/JobDependencyPolicy"
+              }
+            ],
+            "description": "What \"finish\" means for `dependsOn`; `allSucceeded` by default."
+          },
+          "dependsOn": {
+            "description": "Jobs that must finish first.",
+            "items": {
+              "$ref": "#/components/schemas/JobDependency"
+            },
+            "type": "array"
+          },
+          "jobId": {
+            "$ref": "#/components/schemas/JobId"
+          },
+          "name": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/JobName"
+              }
+            ],
+            "description": "Local name other jobs of the same `job/start` can depend on; unique\nwithin the request."
+          },
+          "queueKey": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/QueueKey"
+              }
+            ]
+          }
+        },
+        "required": [
+          "jobId",
+          "command"
+        ],
+        "type": "object"
+      },
+      "JobStatus": {
+        "description": "Job lifecycle. `queued` and `running` are live; the rest are terminal.",
+        "oneOf": [
+          {
+            "enum": [
+              "running"
+            ],
+            "type": "string"
+          },
+          {
+            "const": "queued",
+            "description": "Accepted; waiting for dependencies or its queue.",
+            "type": "string"
+          },
+          {
+            "const": "succeeded",
+            "description": "Exited with code 0.",
+            "type": "string"
+          },
+          {
+            "const": "failed",
+            "description": "Exited otherwise, or could not start.",
+            "type": "string"
+          },
+          {
+            "const": "timedOut",
+            "description": "Its `timeoutMs` expired and the daemon stopped it.",
+            "type": "string"
+          },
+          {
+            "const": "cancelled",
+            "description": "Stopped or never started because of `job/cancel`.",
+            "type": "string"
+          },
+          {
+            "const": "dependencyFailed",
+            "description": "A dependency did not finish as the dependency policy requires.",
+            "type": "string"
+          },
+          {
+            "const": "interrupted",
+            "description": "The daemon stopped while the job was queued or running.",
+            "type": "string"
+          }
+        ]
+      },
+      "JobSummary": {
+        "additionalProperties": false,
+        "description": "What a job is and how it ended. Instants are the guest's wall clock.",
+        "properties": {
+          "cancelRequestedAtMs": {
+            "description": "When a `job/cancel` reached the job while it ran.",
+            "format": "int64",
+            "type": "integer"
+          },
+          "createdAtMs": {
+            "format": "int64",
+            "type": "integer"
+          },
+          "dependsOn": {
+            "description": "Resolved ids of the jobs this one depends on.",
+            "items": {
+              "$ref": "#/components/schemas/JobId"
+            },
+            "type": "array"
+          },
+          "durationMs": {
+            "description": "Monotonic run time from start to finish, immune to guest clock jumps.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "error": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/ProtocolError"
+              }
+            ],
+            "description": "Why a `failed` or `interrupted` job produced no exit, or an\ninfrastructure failure while it ran."
+          },
+          "exit": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/ExitStatus"
+              }
+            ],
+            "description": "How the root process ended, once it ran and exited."
+          },
+          "finishedAtMs": {
+            "format": "int64",
+            "type": "integer"
+          },
+          "jobId": {
+            "$ref": "#/components/schemas/JobId"
+          },
+          "leftovers": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/LeftoverReport"
+              }
+            ],
+            "description": "What the daemon swept from the job's group at completion\n(`disposition: swept`)."
+          },
+          "name": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/JobName"
+              }
+            ]
+          },
+          "queueKey": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/QueueKey"
+              }
+            ]
+          },
+          "queuedAtMs": {
+            "description": "When the job became runnable and waited for its queue.",
+            "format": "int64",
+            "type": "integer"
+          },
+          "requestId": {
+            "$ref": "#/components/schemas/JobRequestId"
+          },
+          "startedAtMs": {
+            "format": "int64",
+            "type": "integer"
+          },
+          "status": {
+            "$ref": "#/components/schemas/JobStatus"
+          },
+          "stoppedBy": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/StoppedBy"
+              }
+            ],
+            "description": "Set when the daemon stopped the running job: `timeout` for\n`timedOut`, `terminate` or `kill` for a cancel without or with\n`force`."
+          }
+        },
+        "required": [
+          "jobId",
+          "requestId",
+          "status",
+          "createdAtMs"
+        ],
+        "type": "object"
+      },
+      "JobSummaryEntry": {
+        "description": "A job summary, or why the named job could not be found.",
+        "oneOf": [
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "job",
+                "type": "string"
+              },
+              "summary": {
+                "$ref": "#/components/schemas/JobSummary"
+              }
+            },
+            "required": [
+              "kind",
+              "summary"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "error": {
+                "$ref": "#/components/schemas/ProtocolError"
+              },
+              "jobId": {
+                "$ref": "#/components/schemas/JobId"
+              },
+              "kind": {
+                "const": "error",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind",
+              "jobId",
+              "error"
+            ],
+            "type": "object"
+          }
+        ]
+      },
+      "LeftoverDisposition": {
+        "description": "What the daemon did with leftovers. The policies differ on purpose.",
+        "oneOf": [
+          {
+            "const": "kept",
+            "description": "Left running (processes): they keep the environment's lifetime and\nare reported until they exit.",
+            "type": "string"
+          },
+          {
+            "const": "swept",
+            "description": "Terminated when the job finished (jobs); the submitter should fix\nits script's teardown.",
+            "type": "string"
+          }
+        ]
+      },
+      "LeftoverProcess": {
+        "additionalProperties": false,
+        "description": "One leftover process.",
+        "properties": {
+          "command": {
+            "description": "Command line when the platform exposes it, otherwise the executable\nname, cut to\n`MAX_LEFTOVER_COMMAND_BYTES`\non a character boundary; absent when neither could be read.",
+            "type": "string"
+          },
+          "pid": {
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "pid"
+        ],
+        "type": "object"
+      },
+      "LeftoverReport": {
+        "additionalProperties": false,
+        "description": "Processes of a command's group still alive after its root exited.\nPresent only when there is at least one.",
+        "properties": {
+          "disposition": {
+            "$ref": "#/components/schemas/LeftoverDisposition"
+          },
+          "omittedProcessCount": {
+            "description": "Leftovers beyond the listed ones.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "processes": {
+            "description": "At most `MAX_LEFTOVER_PROCESSES`,\nlowest pid first; never empty.",
+            "items": {
+              "$ref": "#/components/schemas/LeftoverProcess"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "disposition",
+          "processes"
+        ],
+        "type": "object"
+      },
+      "ListTransferMissingParams": {
+        "additionalProperties": false,
+        "description": "`transfer/listMissing` params.",
+        "properties": {
+          "limit": {
+            "description": "Most digests to return, 1 to\n`limits.filesystem.transfer.maxInventoryPageEntries`.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "operationId": {
+            "$ref": "#/components/schemas/TransferOperationId"
+          }
+        },
+        "required": [
+          "operationId",
+          "limit"
+        ],
+        "type": "object"
+      },
+      "ListTransferMissingResponse": {
+        "additionalProperties": false,
+        "description": "`transfer/listMissing` response: digests whose content the daemon still\nneeds. The set shrinks as uploads complete; call again rather than\npaging.",
+        "properties": {
+          "digests": {
+            "items": {
+              "$ref": "#/components/schemas/ContentDigest"
+            },
+            "type": "array"
+          },
+          "remainingCount": {
+            "description": "Missing digests beyond this page.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "type": "object"
+      },
+      "NotFoundReason": {
+        "description": "Why a handle, path or identity was not found.",
+        "oneOf": [
+          {
+            "const": "expired",
+            "description": "Its retention window ended; a tombstone remembers it.",
+            "type": "string"
+          },
+          {
+            "const": "daemonRestarted",
+            "description": "It belonged to an earlier daemon instance (see `daemonInstanceId`).",
+            "type": "string"
+          },
+          {
+            "const": "unknownDaemon",
+            "description": "A daemon identity the gateway has never admitted presented no\nregistration key.",
+            "type": "string"
+          }
+        ]
+      },
+      "OutputChunk": {
+        "additionalProperties": false,
+        "description": "Contiguous output bytes from one stream.",
+        "properties": {
+          "data": {
+            "$ref": "#/components/schemas/ByteChunk"
+          },
+          "offset": {
+            "description": "Byte offset of the chunk's first byte in the combined output.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "stream": {
+            "$ref": "#/components/schemas/OutputStream"
+          }
+        },
+        "required": [
+          "offset",
+          "stream",
+          "data"
+        ],
+        "type": "object"
+      },
+      "OutputGap": {
+        "additionalProperties": false,
+        "description": "Output bytes in `[offset, offset + omittedBytes)` that a page cannot\nreturn.",
+        "properties": {
+          "offset": {
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "omittedBytes": {
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "reason": {
+            "$ref": "#/components/schemas/GapReason"
+          }
+        },
+        "required": [
+          "offset",
+          "omittedBytes",
+          "reason"
+        ],
+        "type": "object"
+      },
+      "OutputPage": {
+        "additionalProperties": false,
+        "description": "One page of a handle's output. Returned by `process/read` and in every\n`job/read` entry. A page holds at most\n`MAX_PAGE_CHUNKS` chunks and gaps\ntogether (for `job/read`, across all entries); one that reaches it ends\nearly, and `next` says where to continue.",
+        "properties": {
+          "chunks": {
+            "description": "In offset order, at most `maxBytes` of `data` in total.",
+            "items": {
+              "$ref": "#/components/schemas/OutputChunk"
+            },
+            "type": "array"
+          },
+          "end": {
+            "description": "Bytes produced so far; final once the handle has exited.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "gaps": {
+            "description": "Unreturnable ranges between the requested start and `next`.",
+            "items": {
+              "$ref": "#/components/schemas/OutputGap"
+            },
+            "type": "array"
+          },
+          "next": {
+            "description": "Offset to read from next: past the last returned byte or gap.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "next",
+          "end"
+        ],
+        "type": "object"
+      },
+      "OutputStream": {
+        "description": "Which descriptor produced a chunk. Jobs never produce `pty`.",
+        "oneOf": [
+          {
+            "enum": [
+              "stdout",
+              "stderr"
+            ],
+            "type": "string"
+          },
+          {
+            "const": "pty",
+            "description": "The PTY master, which merges stdout and stderr.",
+            "type": "string"
+          }
+        ]
+      },
+      "PermissionReason": {
+        "description": "Why a `permissionDenied` request was refused.",
+        "oneOf": [
+          {
+            "const": "outsideRoot",
+            "description": "The path, or a symlink it passes through, resolves outside the\ndaemon's filesystem root.",
+            "type": "string"
+          },
+          {
+            "const": "daemonState",
+            "description": "The path names or contains the daemon's state directory.",
+            "type": "string"
+          },
+          {
+            "const": "filePermission",
+            "description": "The operating system refused access.",
+            "type": "string"
+          },
+          {
+            "const": "invalidSignature",
+            "description": "The registration signature does not verify.",
+            "type": "string"
+          },
+          {
+            "const": "invalidRegistrationKey",
+            "description": "The registration key is unknown.",
+            "type": "string"
+          },
+          {
+            "const": "registrationKeyRevoked",
+            "description": "The registration key was revoked.",
+            "type": "string"
+          }
+        ]
+      },
+      "Plane": {
+        "description": "The plane a connection serves. Each `initialize` response names its\nplane, so a client that reached the wrong socket fails at the handshake.",
+        "oneOf": [
+          {
+            "const": "data",
+            "description": "envd's data plane, versioned by `ENVD_PROTOCOL_VERSION`.",
+            "type": "string"
+          },
+          {
+            "const": "controller",
+            "description": "A provider controller, versioned by `CONTROLLER_PROTOCOL_VERSION`.",
+            "type": "string"
+          },
+          {
+            "const": "registration",
+            "description": "The registration channel between a daemon and the gateway, versioned\nby `ENVD_PROTOCOL_VERSION`.",
+            "type": "string"
+          }
+        ]
+      },
+      "PreconditionReason": {
+        "description": "The state that forbids a `failedPrecondition` request.",
+        "oneOf": [
+          {
+            "const": "inputClosed",
+            "description": "The process has no open input: started without `pipe` or `pty`,\ninput already closed, or exited.",
+            "type": "string"
+          },
+          {
+            "const": "ifMatchFailed",
+            "description": "The file's current `version` differs from `ifMatch`.",
+            "type": "string"
+          },
+          {
+            "const": "createCondition",
+            "description": "`create: ifAbsent` met an existing file, or `create: ifPresent` a\nmissing one.",
+            "type": "string"
+          },
+          {
+            "const": "notEmpty",
+            "description": "The directory is not empty and `recursive` was not set.",
+            "type": "string"
+          },
+          {
+            "const": "isDirectory",
+            "description": "The path names a directory where a file is required.",
+            "type": "string"
+          },
+          {
+            "const": "notDirectory",
+            "description": "A path component or the path names a non-directory where a directory\nis required.",
+            "type": "string"
+          },
+          {
+            "const": "notRegularFile",
+            "description": "The path names a device, FIFO, socket or other non-regular file.",
+            "type": "string"
+          },
+          {
+            "const": "symlinkLoop",
+            "description": "A symlink chain loops.",
+            "type": "string"
+          },
+          {
+            "const": "symlinkRejected",
+            "description": "A capture met a symlink that leaves the selection, or one the\nselection's symlink policy rejects.",
+            "type": "string"
+          },
+          {
+            "const": "filesystemRoot",
+            "description": "The filesystem root itself cannot be replaced or removed.",
+            "type": "string"
+          },
+          {
+            "const": "crossDevice",
+            "description": "Rename across filesystems.",
+            "type": "string"
+          },
+          {
+            "const": "noSpace",
+            "description": "No space left on the device.",
+            "type": "string"
+          },
+          {
+            "const": "jobIdInUse",
+            "description": "A job id is in use by a job with another `requestId` or spec; choose\na new job id.",
+            "type": "string"
+          },
+          {
+            "const": "operationIdInUse",
+            "description": "A transfer `operationId` is in use for different input.",
+            "type": "string"
+          },
+          {
+            "const": "transferPhase",
+            "description": "The transfer action is not valid in the operation's current phase.",
+            "type": "string"
+          },
+          {
+            "const": "transferOffset",
+            "description": "A transfer write's `offset` is not the digest's next expected offset.",
+            "type": "string"
+          },
+          {
+            "const": "digestMismatch",
+            "description": "Uploaded bytes do not hash to their digest.",
+            "type": "string"
+          },
+          {
+            "const": "environmentClosed",
+            "description": "The environment is closed; its identity or target is spent.",
+            "type": "string"
+          },
+          {
+            "const": "identityInUse",
+            "description": "The daemon identity is bound to another universe.",
+            "type": "string"
+          },
+          {
+            "const": "ownerMismatch",
+            "description": "The target belongs to another owner, or (`target/adopt`) the owner\nalready holds a different target.",
+            "type": "string"
+          },
+          {
+            "const": "templateDeprecated",
+            "description": "The template is deprecated and creates no new targets.",
+            "type": "string"
+          },
+          {
+            "const": "ingressUnsupported",
+            "description": "`ingress/ensure` on a target whose template has no public ingress.",
+            "type": "string"
+          },
+          {
+            "const": "targetNotActive",
+            "description": "A power change on a target whose `phase` is not `active`\n(provisioning, closing, closed or failed).",
+            "type": "string"
+          },
+          {
+            "const": "notAdoptable",
+            "description": "`target/adopt`: the source target exists but the provider cannot take\nit over, for example an instance of a kind it does not manage.",
+            "type": "string"
+          }
+        ]
+      },
+      "ProcessCapabilities": {
+        "additionalProperties": false,
+        "description": "The `process` family: `process/*`.",
+        "properties": {
+          "pty": {
+            "description": "`process/start` accepts `pty`.",
+            "type": "boolean"
+          }
+        },
+        "type": "object"
+      },
+      "ProcessId": {
+        "description": "`processId`: caller-chosen handle of a process on one daemon.",
+        "maxLength": 128,
+        "minLength": 1,
+        "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$",
+        "type": "string"
+      },
+      "ProcessLimits": {
+        "additionalProperties": false,
+        "description": "Ceilings of `process/*`.",
+        "properties": {
+          "maxExitedRetainedBytes": {
+            "description": "Output retained across all exited processes; beyond it the oldest\nare evicted early.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxInputQueueBytes": {
+            "description": "Bytes queued for a process's input before `process/write` accepts\nfewer than it was sent.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxReadBytes": {
+            "description": "Largest `maxBytes` of one `process/read`.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxRetainedOutputBytes": {
+            "description": "Output a process retains; beyond it the oldest delivered bytes are\nreleased (`expired` gaps), then the undelivered middle (`overflow`\ngaps).",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "retentionAfterExitMs": {
+            "description": "How long an exited process stays readable after a read first\nreturned its settled exit with nothing left unread.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "terminateGraceMs": {
+            "description": "Grace between `SIGTERM` and `SIGKILL` for `terminate` and timeouts.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "unreadRetentionMs": {
+            "description": "How long an exited process whose output was never fully read stays\nreadable.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "maxReadBytes",
+          "maxRetainedOutputBytes",
+          "retentionAfterExitMs",
+          "unreadRetentionMs",
+          "maxExitedRetainedBytes",
+          "terminateGraceMs",
+          "maxInputQueueBytes"
+        ],
+        "type": "object"
+      },
+      "ProcessSignal": {
+        "description": "Signal delivered by `process/terminate`.",
+        "oneOf": [
+          {
+            "const": "interrupt",
+            "description": "`SIGINT` to the foreground process group (the terminal's under a\nPTY, otherwise the process group). Records nothing; the next read\nshows what the process did.",
+            "type": "string"
+          },
+          {
+            "const": "terminate",
+            "description": "`SIGTERM` to the group, then `SIGKILL` after\n`limits.process.terminateGraceMs` if members remain. Records\n`stoppedBy: terminate`.",
+            "type": "string"
+          },
+          {
+            "const": "kill",
+            "description": "`SIGKILL` to the group. Records `stoppedBy: kill`.",
+            "type": "string"
+          }
+        ]
+      },
+      "ProtocolError": {
+        "additionalProperties": false,
+        "description": "A protocol error: one kind, its typed data and a message.\n\nSerializes as an `ErrorObject`. Displays as `{kind}: {message}`.",
+        "properties": {
+          "code": {
+            "description": "Fixed by `data.kind`; see `ProtocolErrorKind::code`.",
+            "format": "int32",
+            "type": "integer"
+          },
+          "data": {
+            "$ref": "#/components/schemas/ErrorData"
+          },
+          "message": {
+            "description": "Human-readable description. Never parsed.",
+            "type": "string"
+          }
+        },
+        "required": [
+          "code",
+          "message",
+          "data"
+        ],
+        "type": "object"
+      },
+      "PtySize": {
+        "additionalProperties": false,
+        "description": "Terminal size of a PTY. Each dimension is 1 to 4096.",
+        "properties": {
+          "cols": {
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "rows": {
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "rows",
+          "cols"
+        ],
+        "type": "object"
+      },
+      "QueueKey": {
+        "description": "`queueKey`: jobs sharing a key run one at a time, in start order.",
+        "maxLength": 128,
+        "minLength": 1,
+        "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$",
+        "type": "string"
+      },
+      "ReadDirectoryParams": {
+        "additionalProperties": false,
+        "description": "`fs/readDirectory` params. Pages in name order.",
+        "properties": {
+          "cursor": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/DirectoryCursor"
+              }
+            ],
+            "description": "`nextCursor` of the previous page; a cursor this daemon did not mint\nis `invalidParams`."
+          },
+          "limit": {
+            "description": "Most entries per page, 1 to `limits.filesystem.maxDirectoryEntries`.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "path": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/EnvironmentPath"
+              }
+            ],
+            "description": "A directory, or a symlink to one inside the root."
+          }
+        },
+        "required": [
+          "path",
+          "limit"
+        ],
+        "type": "object"
+      },
+      "ReadDirectoryResponse": {
+        "additionalProperties": false,
+        "description": "`fs/readDirectory` response.",
+        "properties": {
+          "entries": {
+            "items": {
+              "$ref": "#/components/schemas/DirectoryEntry"
+            },
+            "type": "array"
+          },
+          "nextCursor": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/DirectoryCursor"
+              }
+            ],
+            "description": "Opaque cursor of the next page; absent on the last page."
+          },
+          "skippedEntryCount": {
+            "description": "Entries in this page's range skipped because their names are not\nUTF-8. Entries that vanish while the page is built are left out and\nnot counted.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "type": "object"
+      },
+      "ReadFileParams": {
+        "additionalProperties": false,
+        "description": "`fs/readFile` params. Reads a regular file only; anything else is\n`failedPrecondition` (`notRegularFile`) and is never opened for a\nblocking read.",
+        "properties": {
+          "maxBytes": {
+            "description": "Most bytes to return, at most `limits.filesystem.maxReadFileBytes`.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "offset": {
+            "description": "First byte to return; 0 by default.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "path": {
+            "$ref": "#/components/schemas/EnvironmentPath"
+          }
+        },
+        "required": [
+          "path",
+          "maxBytes"
+        ],
+        "type": "object"
+      },
+      "ReadFileResponse": {
+        "additionalProperties": false,
+        "description": "`fs/readFile` response.",
+        "properties": {
+          "data": {
+            "$ref": "#/components/schemas/ByteChunk"
+          },
+          "fileSize": {
+            "description": "Size of the whole file when it was read.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "truncated": {
+            "description": "Bytes exist after `offset` plus the length of `data`.",
+            "type": "boolean"
+          },
+          "version": {
+            "$ref": "#/components/schemas/FileVersion"
+          }
+        },
+        "required": [
+          "data",
+          "fileSize",
+          "version"
+        ],
+        "type": "object"
+      },
+      "ReadJobsParams": {
+        "additionalProperties": false,
+        "description": "`job/read` params.",
+        "properties": {
+          "jobs": {
+            "description": "1 to `limits.job.maxRequestJobs` entries, each with its own position.",
+            "items": {
+              "$ref": "#/components/schemas/JobReadRequest"
+            },
+            "type": "array"
+          },
+          "maxBytes": {
+            "description": "Most `data` bytes across all entries, at most\n`limits.job.maxReadBytes`, filled in request order: an entry reached\nafter the budget is spent returns its summary and an empty page at\nits start position. 0 reads only summaries.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "returnOn": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/ReturnOn"
+              }
+            ],
+            "description": "`anyOutput`: return when any entry has output past its position or\nchanged status; `exit`: when every entry is terminal; `window`: wait\nthe whole window."
+          },
+          "waitMs": {
+            "description": "How long to wait, at most `limits.maxWaitMs`. 0 polls.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "jobs",
+          "maxBytes",
+          "waitMs",
+          "returnOn"
+        ],
+        "type": "object"
+      },
+      "ReadJobsResponse": {
+        "additionalProperties": false,
+        "description": "`job/read` response: one entry per requested job, in request order.",
+        "properties": {
+          "jobs": {
+            "description": "Never empty.",
+            "items": {
+              "$ref": "#/components/schemas/JobReadEntry"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "jobs"
+        ],
+        "type": "object"
+      },
+      "ReadProcessParams": {
+        "additionalProperties": false,
+        "description": "`process/read` params.",
+        "properties": {
+          "ack": {
+            "description": "Acknowledge every byte before this offset first: the cursor moves to\nit (never backwards) whether or not this read's response arrives. A\ncaller that tracks positions reads with `after` and acknowledges\nwith `ack` for exactly-once delivery.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "after": {
+            "description": "Start offset. Absent: the daemon cursor, which this read advances to\n`next` once its response is written. Present: a non-consuming read\nthat leaves the cursor alone.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxBytes": {
+            "description": "Most `data` bytes to return, at most `limits.process.maxReadBytes`.\n0 reads only the state.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "processId": {
+            "$ref": "#/components/schemas/ProcessId"
+          },
+          "returnOn": {
+            "$ref": "#/components/schemas/ReturnOn"
+          },
+          "tailBytes": {
+            "description": "Start at `end - tailBytes` instead (clamped at 0). Non-consuming;\nexcludes `after`.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "waitMs": {
+            "description": "How long to wait, at most `limits.maxWaitMs`. 0 polls.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "processId",
+          "maxBytes",
+          "waitMs",
+          "returnOn"
+        ],
+        "type": "object"
+      },
+      "ReadProcessResponse": {
+        "additionalProperties": false,
+        "description": "`process/read` response.",
+        "properties": {
+          "error": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/ProtocolError"
+              }
+            ],
+            "description": "Infrastructure failure after start (output capture or wait failed)."
+          },
+          "exit": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/ExitStatus"
+              }
+            ],
+            "description": "How the root ended; present once `state` is `exited`, unless `error`\nexplains why it could not be observed."
+          },
+          "leftovers": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/LeftoverReport"
+              }
+            ],
+            "description": "Group members alive after the root exited (`disposition: kept`),\nsampled when this response was built. Absent while running, when\nnone remain, and on platforms without process enumeration."
+          },
+          "output": {
+            "$ref": "#/components/schemas/OutputPage"
+          },
+          "pid": {
+            "description": "OS pid of the root process.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "state": {
+            "$ref": "#/components/schemas/ExecState"
+          },
+          "stoppedBy": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/StoppedBy"
+              }
+            ],
+            "description": "Set when the daemon stopped the process; absent on a natural exit."
+          }
+        },
+        "required": [
+          "output",
+          "state",
+          "pid"
+        ],
+        "type": "object"
+      },
+      "ReadTransferContentParams": {
+        "additionalProperties": false,
+        "description": "`transfer/read` params: read a captured file's content by digest.",
+        "properties": {
+          "digest": {
+            "$ref": "#/components/schemas/ContentDigest"
+          },
+          "maxBytes": {
+            "description": "1 to `limits.filesystem.transfer.maxContentChunkBytes`.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "offset": {
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "operationId": {
+            "$ref": "#/components/schemas/TransferOperationId"
+          }
+        },
+        "required": [
+          "operationId",
+          "digest",
+          "offset",
+          "maxBytes"
+        ],
+        "type": "object"
+      },
+      "ReadTransferContentResponse": {
+        "additionalProperties": false,
+        "description": "`transfer/read` response.",
+        "properties": {
+          "data": {
+            "$ref": "#/components/schemas/ByteChunk"
+          },
+          "truncated": {
+            "description": "Bytes exist after `offset` plus the length of `data`, as for\n`fs/readFile`.",
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "data"
+        ],
+        "type": "object"
+      },
+      "ReadTransferInventoryParams": {
+        "additionalProperties": false,
+        "description": "`transfer/readInventory` params: page a sealed inventory by index.",
+        "properties": {
+          "index": {
+            "description": "Index of the first entry.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "limit": {
+            "description": "1 to `limits.filesystem.transfer.maxInventoryPageEntries`.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "operationId": {
+            "$ref": "#/components/schemas/TransferOperationId"
+          }
+        },
+        "required": [
+          "operationId",
+          "index",
+          "limit"
+        ],
+        "type": "object"
+      },
+      "ReadTransferInventoryResponse": {
+        "additionalProperties": false,
+        "description": "`transfer/readInventory` response.",
+        "properties": {
+          "entries": {
+            "items": {
+              "$ref": "#/components/schemas/InventoryEntry"
+            },
+            "type": "array"
+          },
+          "nextIndex": {
+            "description": "Index of the next page; absent after the last entry.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "type": "object"
+      },
+      "RemoveParams": {
+        "additionalProperties": false,
+        "description": "`fs/remove` params.",
+        "properties": {
+          "force": {
+            "description": "Succeed when the path does not exist.",
+            "type": "boolean"
+          },
+          "path": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/EnvironmentPath"
+              }
+            ],
+            "description": "A symlink is removed, never followed."
+          },
+          "recursive": {
+            "description": "Remove a directory and its contents.",
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "path"
+        ],
+        "type": "object"
+      },
+      "RemoveResponse": {
+        "additionalProperties": false,
+        "description": "`fs/remove` response.",
+        "type": "object"
+      },
+      "RenameParams": {
+        "additionalProperties": false,
+        "description": "`fs/rename` params. Atomic within one filesystem; across filesystems it\nis `failedPrecondition` (`crossDevice`). The entry keeps its mode.",
+        "properties": {
+          "destination": {
+            "$ref": "#/components/schemas/EnvironmentPath"
+          },
+          "ifMatch": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/FileVersion"
+              }
+            ],
+            "description": "Rename only when the source's version equals this token."
+          },
+          "overwrite": {
+            "description": "Replace an existing destination file; otherwise an existing\ndestination is `alreadyExists`. A directory destination is never\nreplaced.",
+            "type": "boolean"
+          },
+          "source": {
+            "$ref": "#/components/schemas/EnvironmentPath"
+          }
+        },
+        "required": [
+          "source",
+          "destination"
+        ],
+        "type": "object"
+      },
+      "RenameResponse": {
+        "additionalProperties": false,
+        "description": "`fs/rename` response.",
+        "type": "object"
+      },
+      "ReturnOn": {
+        "description": "When a waiting read returns. Every mode also returns when `waitMs`\nelapses, when the handle reaches a settled exit, or at once when there\nis nothing left to wait for.",
+        "oneOf": [
+          {
+            "const": "window",
+            "description": "Collect for the whole window; return early only when unread output\nreaches `maxBytes`.",
+            "type": "string"
+          },
+          {
+            "const": "anyOutput",
+            "description": "Return as soon as any output past the start position exists.",
+            "type": "string"
+          },
+          {
+            "const": "exit",
+            "description": "Return only at the settled exit (for `job/read`: once every entry is\nterminal), even if more than `maxBytes` of output accumulates.",
+            "type": "string"
+          }
+        ]
+      },
+      "ScanCeilings": {
+        "additionalProperties": false,
+        "description": "Ceilings of `fs/scan`: root and pattern counts, then its quotas.",
+        "properties": {
+          "maxDurationMs": {
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxEntries": {
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxFileBytes": {
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxPatterns": {
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxRoots": {
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxTotalBytes": {
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "maxRoots",
+          "maxPatterns",
+          "maxEntries",
+          "maxFileBytes",
+          "maxTotalBytes",
+          "maxDurationMs"
+        ],
+        "type": "object"
+      },
+      "ScanEntry": {
+        "additionalProperties": false,
+        "description": "One selected entry below a root.",
+        "properties": {
+          "content": {
+            "$ref": "#/components/schemas/TreeContent"
+          },
+          "data": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/ByteChunk"
+              }
+            ],
+            "description": "The file's bytes when `readContent` was set."
+          },
+          "path": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/TreePath"
+              }
+            ],
+            "description": "Relative to the root as requested."
+          }
+        },
+        "required": [
+          "path",
+          "content"
+        ],
+        "type": "object"
+      },
+      "ScanFingerprint": {
+        "description": "Opaque fingerprint of one root's selection, prefixed `scan:v1:`, at most\n255 bytes without control characters.",
+        "maxLength": 255,
+        "minLength": 9,
+        "pattern": "^scan:v1:[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+        "type": "string"
+      },
+      "ScanLimits": {
+        "additionalProperties": false,
+        "description": "Caller quotas of one scan.",
+        "properties": {
+          "maxDurationMs": {
+            "description": "Walk time per root; exhausting it fails that root\n(`deadlineExceeded`).",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxEntries": {
+            "description": "Selected entries per root; more fail that root (`payloadTooLarge`\nwith `limitEntries`).",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxFileBytes": {
+            "description": "Larger selected files are skipped (`fileTooLarge`).",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxTotalBytes": {
+            "description": "Content bytes returned across all roots, in root order: a root whose\ncontent would exceed the rest fails (`payloadTooLarge` with\n`limitBytes`) and later roots are still scanned. Independently, a\nroot whose encoded result (entries, skips and base64 content) would\npush the scan's results past\n`MAX_RESULT_BYTES` fails the same\nway.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "maxEntries",
+          "maxFileBytes",
+          "maxTotalBytes",
+          "maxDurationMs"
+        ],
+        "type": "object"
+      },
+      "ScanParams": {
+        "additionalProperties": false,
+        "description": "`fs/scan` params.",
+        "properties": {
+          "filter": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/TreeFilter"
+              }
+            ],
+            "description": "Applied below every root; at most `limits.filesystem.scan.maxPatterns`\npatterns in total."
+          },
+          "followSymlinks": {
+            "description": "Follow symlinks whose targets stay inside the filesystem root; others\nare skipped (`symlinkOutsideRoot`). Without it symlinks are skipped\n(`symlink`).",
+            "type": "boolean"
+          },
+          "includeDigests": {
+            "description": "Return each selected file's `digest`.",
+            "type": "boolean"
+          },
+          "limits": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/ScanLimits"
+              }
+            ],
+            "description": "Caller quotas; each at most its ceiling."
+          },
+          "readContent": {
+            "description": "Return the bytes of every selected file in `data`.",
+            "type": "boolean"
+          },
+          "roots": {
+            "description": "1 to `limits.filesystem.scan.maxRoots` roots.",
+            "items": {
+              "$ref": "#/components/schemas/ScanRoot"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "roots",
+          "limits"
+        ],
+        "type": "object"
+      },
+      "ScanResponse": {
+        "additionalProperties": false,
+        "description": "`fs/scan` response: one result per requested root, in request order.",
+        "properties": {
+          "roots": {
+            "description": "Never empty.",
+            "items": {
+              "$ref": "#/components/schemas/ScanRootResult"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "roots"
+        ],
+        "type": "object"
+      },
+      "ScanRoot": {
+        "additionalProperties": false,
+        "description": "One root of a scan.",
+        "properties": {
+          "ifNoneMatch": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/ScanFingerprint"
+              }
+            ],
+            "description": "The root's previous `fingerprint`: when the selection is unchanged\nthe result is `unchanged` and carries no entries."
+          },
+          "maxDepth": {
+            "description": "Overrides `filter.maxDepth` for this root. `0` examines only the\nroot itself: a `complete` result without entries proves it is an\nexisting directory, which is how discovery checks a working\ndirectory in the same call.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "path": {
+            "$ref": "#/components/schemas/EnvironmentPath"
+          }
+        },
+        "required": [
+          "path"
+        ],
+        "type": "object"
+      },
+      "ScanRootResult": {
+        "description": "The outcome of one root.",
+        "oneOf": [
+          {
+            "additionalProperties": false,
+            "description": "Every selected entry, plus what was skipped and why.",
+            "properties": {
+              "canonicalPath": {
+                "anyOf": [
+                  {
+                    "$ref": "#/components/schemas/EnvironmentPath"
+                  }
+                ],
+                "description": "Resolved absolute path of the root when it differs from `path`\n(the root is a symlink)."
+              },
+              "entries": {
+                "items": {
+                  "$ref": "#/components/schemas/ScanEntry"
+                },
+                "type": "array"
+              },
+              "fingerprint": {
+                "$ref": "#/components/schemas/ScanFingerprint"
+              },
+              "kind": {
+                "const": "complete",
+                "type": "string"
+              },
+              "path": {
+                "$ref": "#/components/schemas/EnvironmentPath"
+              },
+              "skipped": {
+                "description": "The first\n`MAX_LISTED_SKIPS` skipped\nentries, in walk order.",
+                "items": {
+                  "$ref": "#/components/schemas/ScanSkip"
+                },
+                "type": "array"
+              },
+              "skippedEntryCount": {
+                "description": "Total number of skipped entries, listed or not; present whenever\nit is not zero.",
+                "format": "uint32",
+                "minimum": 0,
+                "type": "integer"
+              }
+            },
+            "required": [
+              "kind",
+              "path",
+              "fingerprint"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "description": "The selection matches `ifNoneMatch`.",
+            "properties": {
+              "fingerprint": {
+                "$ref": "#/components/schemas/ScanFingerprint"
+              },
+              "kind": {
+                "const": "unchanged",
+                "type": "string"
+              },
+              "path": {
+                "$ref": "#/components/schemas/EnvironmentPath"
+              }
+            },
+            "required": [
+              "kind",
+              "path",
+              "fingerprint"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "description": "The root does not exist.",
+            "properties": {
+              "kind": {
+                "const": "missing",
+                "type": "string"
+              },
+              "path": {
+                "$ref": "#/components/schemas/EnvironmentPath"
+              }
+            },
+            "required": [
+              "kind",
+              "path"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "description": "The root could not be scanned; no entries are returned for it.",
+            "properties": {
+              "error": {
+                "$ref": "#/components/schemas/ProtocolError"
+              },
+              "kind": {
+                "const": "failed",
+                "type": "string"
+              },
+              "path": {
+                "$ref": "#/components/schemas/EnvironmentPath"
+              }
+            },
+            "required": [
+              "kind",
+              "path",
+              "error"
+            ],
+            "type": "object"
+          }
+        ]
+      },
+      "ScanSkip": {
+        "additionalProperties": false,
+        "description": "An entry a scan left out.",
+        "properties": {
+          "path": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/TreePath"
+              }
+            ],
+            "description": "Absent when the entry's name is not UTF-8."
+          },
+          "reason": {
+            "$ref": "#/components/schemas/ScanSkipReason"
+          }
+        },
+        "required": [
+          "reason"
+        ],
+        "type": "object"
+      },
+      "ScanSkipReason": {
+        "description": "Why a scan left an entry out.",
+        "oneOf": [
+          {
+            "const": "fileTooLarge",
+            "description": "Larger than `maxFileBytes`.",
+            "type": "string"
+          },
+          {
+            "const": "symlink",
+            "description": "A symlink, and `followSymlinks` is not set.",
+            "type": "string"
+          },
+          {
+            "const": "symlinkOutsideRoot",
+            "description": "A symlink whose target leaves the filesystem root, or a link cycle.",
+            "type": "string"
+          },
+          {
+            "const": "specialFile",
+            "description": "A device, FIFO, socket or another special file.",
+            "type": "string"
+          },
+          {
+            "const": "nonUtf8Name",
+            "description": "The name is not UTF-8.",
+            "type": "string"
+          },
+          {
+            "const": "unreadable",
+            "description": "The entry vanished or could not be read during the walk.",
+            "type": "string"
+          }
+        ]
+      },
+      "SearchCeilings": {
+        "additionalProperties": false,
+        "description": "Ceilings of `fs/searchText` quotas, field for field.",
+        "properties": {
+          "maxBytes": {
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxDurationMs": {
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxFiles": {
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxLineBytes": {
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxMatches": {
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "maxMatches",
+          "maxFiles",
+          "maxBytes",
+          "maxDurationMs",
+          "maxLineBytes"
+        ],
+        "type": "object"
+      },
+      "SearchTextLimits": {
+        "additionalProperties": false,
+        "description": "Caller quotas of one search; each at most its advertised ceiling.",
+        "properties": {
+          "maxBytes": {
+            "description": "Bytes actually read across files.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxDurationMs": {
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxFiles": {
+            "description": "Files searched, not merely visited.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxLineBytes": {
+            "description": "Longer matching lines are cut and marked `lineTruncated`.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxMatches": {
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "maxMatches",
+          "maxFiles",
+          "maxBytes",
+          "maxDurationMs",
+          "maxLineBytes"
+        ],
+        "type": "object"
+      },
+      "SearchTextMatch": {
+        "additionalProperties": false,
+        "description": "One matching line.",
+        "properties": {
+          "line": {
+            "description": "The matching line without its terminator, cut at `maxLineBytes` on a\ncharacter boundary.",
+            "type": "string"
+          },
+          "lineNumber": {
+            "description": "1-based.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "lineTruncated": {
+            "type": "boolean"
+          },
+          "path": {
+            "$ref": "#/components/schemas/EnvironmentPath"
+          }
+        },
+        "required": [
+          "path",
+          "lineNumber",
+          "line"
+        ],
+        "type": "object"
+      },
+      "SearchTextParams": {
+        "additionalProperties": false,
+        "description": "`fs/searchText` params: a bounded recursive regex search run by the\ndaemon. A file larger than the remaining byte budget is skipped and\ncounted; it never ends the walk.",
+        "properties": {
+          "filter": {
+            "$ref": "#/components/schemas/TreeFilter"
+          },
+          "limits": {
+            "$ref": "#/components/schemas/SearchTextLimits"
+          },
+          "pattern": {
+            "description": "Regular expression in the Rust `regex` crate's syntax, matched per\nline.",
+            "type": "string"
+          },
+          "patternIgnoreCase": {
+            "description": "Match `pattern` case-insensitively. `filter.ignoreCase` governs the\npath patterns instead.",
+            "type": "boolean"
+          },
+          "root": {
+            "$ref": "#/components/schemas/EnvironmentPath"
+          }
+        },
+        "required": [
+          "root",
+          "pattern",
+          "limits"
+        ],
+        "type": "object"
+      },
+      "SearchTextResponse": {
+        "additionalProperties": false,
+        "description": "`fs/searchText` response.",
+        "properties": {
+          "elapsedMs": {
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "matches": {
+            "items": {
+              "$ref": "#/components/schemas/SearchTextMatch"
+            },
+            "type": "array"
+          },
+          "searchedBytes": {
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "searchedFileCount": {
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "skippedEntryCount": {
+            "description": "Entries the walk could not represent or list: names that are not\nUTF-8 and directories that could not be read.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "skippedFileCount": {
+            "description": "Files skipped because they exceeded the remaining byte budget, are\nbinary or could not be read.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "stopped": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/SearchTextStop"
+              }
+            ],
+            "description": "Absent when the walk finished within its limits."
+          }
+        },
+        "required": [
+          "searchedFileCount",
+          "searchedBytes",
+          "elapsedMs"
+        ],
+        "type": "object"
+      },
+      "SearchTextStop": {
+        "description": "Why a search stopped before finishing its walk.",
+        "oneOf": [
+          {
+            "const": "matchLimit",
+            "description": "`maxMatches` matches were found.",
+            "type": "string"
+          },
+          {
+            "const": "fileLimit",
+            "description": "`maxFiles` files were searched.",
+            "type": "string"
+          },
+          {
+            "const": "byteLimit",
+            "description": "`maxBytes` bytes were read.",
+            "type": "string"
+          },
+          {
+            "const": "timeLimit",
+            "description": "`maxDurationMs` ran out.",
+            "type": "string"
+          },
+          {
+            "const": "responseLimit",
+            "description": "The next match would push the encoded matches past\n`MAX_RESULT_BYTES`.",
+            "type": "string"
+          }
+        ]
+      },
+      "SecretString": {
+        "description": "A secret value carried on the wire, such as a `secretEnv` value, a\nregistration key or a stream token. It serializes as a plain string;\n`Debug` is redacted so structured logging never prints it.",
+        "type": "string"
+      },
+      "SignalName": {
+        "description": "A POSIX signal name such as `SIGSEGV` or `SIGRTMIN+3`: `SIG` followed by\n1 to 16 uppercase letters, digits or `+`. Names, not numbers, because\nnumbers differ between platforms.",
+        "pattern": "^SIG[A-Z0-9+]{1,16}$",
+        "type": "string"
+      },
+      "SpecialFilePolicy": {
+        "description": "Devices, FIFOs and sockets met during a capture.",
+        "oneOf": [
+          {
+            "const": "reject",
+            "description": "Fail the operation (`notRegularFile`).",
+            "type": "string"
+          },
+          {
+            "const": "skip",
+            "description": "Leave them out and report them in `skipped`.",
+            "type": "string"
+          }
+        ]
+      },
+      "StartJobsParams": {
+        "additionalProperties": false,
+        "description": "`job/start` params. All-or-nothing: either every job is accepted (or\nreplayed) or none is.",
+        "properties": {
+          "jobs": {
+            "description": "1 to `limits.job.maxRequestJobs` jobs.",
+            "items": {
+              "$ref": "#/components/schemas/JobSpec"
+            },
+            "type": "array"
+          },
+          "requestId": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/JobRequestId"
+              }
+            ],
+            "description": "Idempotency key of this start. Retrying with the same request id and\nidentical jobs replays the existing jobs; reusing a job id with\nanother request id or spec is `failedPrecondition` (`jobIdInUse`)."
+          }
+        },
+        "required": [
+          "requestId",
+          "jobs"
+        ],
+        "type": "object"
+      },
+      "StartJobsResponse": {
+        "additionalProperties": false,
+        "description": "`job/start` response: one summary per requested job, in request order.",
+        "properties": {
+          "jobs": {
+            "description": "Never empty.",
+            "items": {
+              "$ref": "#/components/schemas/JobSummary"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "jobs"
+        ],
+        "type": "object"
+      },
+      "StartProcessParams": {
+        "additionalProperties": false,
+        "description": "`process/start` params.",
+        "properties": {
+          "command": {
+            "$ref": "#/components/schemas/CommandSpec"
+          },
+          "processId": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/ProcessId"
+              }
+            ],
+            "description": "Caller-chosen handle, reserved before any side effect: a start whose\nid is already in use (running, retained or remembered by a tombstone)\nis `alreadyExists` and runs nothing."
+          },
+          "pty": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/PtySize"
+              }
+            ],
+            "description": "Run under a PTY of this size. The PTY master is the input: `input`\nmust then be `none` or `bytes`, and `process/write` is always\naccepted while the process runs. Requires\n`capabilities.process.pty`."
+          }
+        },
+        "required": [
+          "processId",
+          "command"
+        ],
+        "type": "object"
+      },
+      "StartProcessResponse": {
+        "additionalProperties": false,
+        "description": "`process/start` response, sent once the process runs.",
+        "properties": {
+          "pid": {
+            "description": "OS pid of the root process, which is also its process group id.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "pid"
+        ],
+        "type": "object"
+      },
+      "StoppedBy": {
+        "description": "Why the daemon stopped a process or job that did not exit on its own.\nSet only when the daemon signalled a root that was still running.",
+        "oneOf": [
+          {
+            "const": "timeout",
+            "description": "`timeoutMs` expired: `SIGTERM`, the grace, then `SIGKILL`.",
+            "type": "string"
+          },
+          {
+            "const": "terminate",
+            "description": "`process/terminate` with `terminate`, or `job/cancel` without\n`force`: `SIGTERM`, the grace, then `SIGKILL`.",
+            "type": "string"
+          },
+          {
+            "const": "kill",
+            "description": "`process/terminate` with `kill`, or `job/cancel` with `force`:\n`SIGKILL` at once.",
+            "type": "string"
+          }
+        ]
+      },
+      "SymlinkPolicy": {
+        "description": "Symlinks met during a capture.",
+        "oneOf": [
+          {
+            "const": "expandInside",
+            "description": "Capture a link whose target stays inside the selection as the entry\nit points to; a link leaving the selection or a cycle fails the\noperation (`symlinkRejected`). A dangling link inside the selection\nis left out and reported in `skipped` as `symlink`.",
+            "type": "string"
+          },
+          {
+            "const": "skip",
+            "description": "Leave every link out and report it in `skipped`.",
+            "type": "string"
+          },
+          {
+            "const": "reject",
+            "description": "Fail on the first link.",
+            "type": "string"
+          }
+        ]
+      },
+      "TerminateProcessParams": {
+        "additionalProperties": false,
+        "description": "`process/terminate` params.",
+        "properties": {
+          "processId": {
+            "$ref": "#/components/schemas/ProcessId"
+          },
+          "signal": {
+            "$ref": "#/components/schemas/ProcessSignal"
+          }
+        },
+        "required": [
+          "processId",
+          "signal"
+        ],
+        "type": "object"
+      },
+      "TerminateProcessResponse": {
+        "additionalProperties": false,
+        "description": "`process/terminate` response, sent once the signal was delivered (any\nescalation continues in the background).",
+        "properties": {
+          "running": {
+            "description": "True when the root process was still running when the signal was\nsent.",
+            "type": "boolean"
+          }
+        },
+        "type": "object"
+      },
+      "TransferCeilings": {
+        "additionalProperties": false,
+        "description": "Ceilings of `transfer/*`: capacity, page and chunk sizes, receipt\nretention, then the per-operation quotas.",
+        "properties": {
+          "maxActiveOperations": {
+            "description": "Operations not yet complete, aborted or failed, across connections;\na begin beyond it is `busy` (`transferCapacity`).",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxContentChunkBytes": {
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxDepth": {
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxDurationMs": {
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxEntries": {
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxFileBytes": {
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxInventoryPageEntries": {
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxManifestBytes": {
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxTotalBytes": {
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "receiptRetentionMs": {
+            "description": "How long a finished operation's receipt is answered.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "maxActiveOperations",
+          "maxContentChunkBytes",
+          "maxInventoryPageEntries",
+          "receiptRetentionMs",
+          "maxEntries",
+          "maxDepth",
+          "maxFileBytes",
+          "maxTotalBytes",
+          "maxManifestBytes",
+          "maxDurationMs"
+        ],
+        "type": "object"
+      },
+      "TransferLimits": {
+        "additionalProperties": false,
+        "description": "Caller quotas of one operation; each at most its advertised ceiling.",
+        "properties": {
+          "maxDepth": {
+            "description": "The selected root has depth 0.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxDurationMs": {
+            "description": "From begin to commit.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxEntries": {
+            "description": "Entries, the selected root included.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxFileBytes": {
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxManifestBytes": {
+            "description": "Encoded inventory size.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "maxTotalBytes": {
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "maxEntries",
+          "maxDepth",
+          "maxFileBytes",
+          "maxTotalBytes",
+          "maxManifestBytes",
+          "maxDurationMs"
+        ],
+        "type": "object"
+      },
+      "TransferOnExisting": {
+        "description": "What a materialize does with an existing destination.",
+        "oneOf": [
+          {
+            "const": "error",
+            "description": "Refuse at begin (`alreadyExists`).",
+            "type": "string"
+          },
+          {
+            "const": "replace",
+            "description": "Replace it atomically at commit.",
+            "type": "string"
+          }
+        ]
+      },
+      "TransferOperationId": {
+        "description": "`operationId` of one transfer operation.",
+        "maxLength": 128,
+        "minLength": 1,
+        "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$",
+        "type": "string"
+      },
+      "TransferOperationParams": {
+        "additionalProperties": false,
+        "description": "Params of `transfer/advance`, `transfer/getStatus`, `transfer/commit`\nand `transfer/abort`: each names only the operation.",
+        "properties": {
+          "operationId": {
+            "$ref": "#/components/schemas/TransferOperationId"
+          }
+        },
+        "required": [
+          "operationId"
+        ],
+        "type": "object"
+      },
+      "TransferPhase": {
+        "description": "Where an operation stands; see the module docs for the order per\nselection kind.",
+        "oneOf": [
+          {
+            "enum": [
+              "complete",
+              "aborted"
+            ],
+            "type": "string"
+          },
+          {
+            "const": "scanning",
+            "description": "The daemon walks a tree: the capture source, or the destination of a\nmaterialize. Advance until the phase changes.",
+            "type": "string"
+          },
+          {
+            "const": "inventory",
+            "description": "Capture: the inventory is sealed and pageable. Materialize: waiting\nfor appended entries.",
+            "type": "string"
+          },
+          {
+            "const": "content",
+            "description": "Waiting for the content of `transfer/listMissing` digests.",
+            "type": "string"
+          },
+          {
+            "const": "staging",
+            "description": "The daemon assembles the staged tree. Advance until `ready`.",
+            "type": "string"
+          },
+          {
+            "const": "ready",
+            "description": "Ready for `transfer/commit`.",
+            "type": "string"
+          },
+          {
+            "const": "failed",
+            "description": "Stopped by an error; see `error`.",
+            "type": "string"
+          }
+        ]
+      },
+      "TransferSelection": {
+        "description": "What one operation transfers.",
+        "oneOf": [
+          {
+            "additionalProperties": false,
+            "description": "Read a file or tree out of the environment.",
+            "properties": {
+              "filter": {
+                "$ref": "#/components/schemas/TreeFilter"
+              },
+              "kind": {
+                "const": "capture",
+                "type": "string"
+              },
+              "source": {
+                "$ref": "#/components/schemas/EnvironmentPath"
+              },
+              "specialFiles": {
+                "$ref": "#/components/schemas/SpecialFilePolicy"
+              },
+              "symlinks": {
+                "$ref": "#/components/schemas/SymlinkPolicy"
+              }
+            },
+            "required": [
+              "kind",
+              "source"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "description": "Write a tree into the environment, replacing `destination` atomically\nat commit.",
+            "properties": {
+              "destination": {
+                "$ref": "#/components/schemas/EnvironmentPath"
+              },
+              "kind": {
+                "const": "materialize",
+                "type": "string"
+              },
+              "onExisting": {
+                "$ref": "#/components/schemas/TransferOnExisting"
+              }
+            },
+            "required": [
+              "kind",
+              "destination"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "description": "Write exactly one file with `fs/writeFile` semantics: staged,\natomic, an existing target keeps its permissions, an in-root symlink\nat `destination` is followed.",
+            "properties": {
+              "create": {
+                "$ref": "#/components/schemas/WriteCondition"
+              },
+              "destination": {
+                "$ref": "#/components/schemas/EnvironmentPath"
+              },
+              "executable": {
+                "type": "boolean"
+              },
+              "ifMatch": {
+                "anyOf": [
+                  {
+                    "$ref": "#/components/schemas/FileVersion"
+                  }
+                ]
+              },
+              "kind": {
+                "const": "writeFile",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind",
+              "destination"
+            ],
+            "type": "object"
+          }
+        ]
+      },
+      "TransferSkip": {
+        "additionalProperties": false,
+        "description": "An entry a capture left out.",
+        "properties": {
+          "path": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/TreePath"
+              }
+            ],
+            "description": "Absent when the entry's name is not UTF-8."
+          },
+          "reason": {
+            "$ref": "#/components/schemas/TransferSkipReason"
+          }
+        },
+        "required": [
+          "reason"
+        ],
+        "type": "object"
+      },
+      "TransferSkipReason": {
+        "description": "Why a capture left an entry out.",
+        "oneOf": [
+          {
+            "const": "symlink",
+            "description": "`symlinks: skip`, or a dangling link under `symlinks: expandInside`.",
+            "type": "string"
+          },
+          {
+            "const": "specialFile",
+            "description": "`specialFiles: skip`.",
+            "type": "string"
+          },
+          {
+            "const": "nonUtf8Name",
+            "description": "The name is not UTF-8; such entries are always skipped.",
+            "type": "string"
+          }
+        ]
+      },
+      "TransferStatus": {
+        "additionalProperties": false,
+        "description": "The operation's status: the response of `transfer/begin`,\n`transfer/advance`, `transfer/getStatus`, `transfer/append`,\n`transfer/commit` and `transfer/abort`.",
+        "properties": {
+          "deadlineAtMs": {
+            "description": "When `maxDurationMs` runs out for an active operation.",
+            "format": "int64",
+            "type": "integer"
+          },
+          "entryCount": {
+            "description": "Entries in the inventory so far.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "error": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/ProtocolError"
+              }
+            ],
+            "description": "Why the operation failed; present exactly when `phase` is `failed`."
+          },
+          "operationId": {
+            "$ref": "#/components/schemas/TransferOperationId"
+          },
+          "phase": {
+            "$ref": "#/components/schemas/TransferPhase"
+          },
+          "receiptExpiresAtMs": {
+            "description": "When the receipt of a finished (complete, aborted or failed)\noperation stops being answered; afterwards calls are `notFound`\n(`expired`).",
+            "format": "int64",
+            "type": "integer"
+          },
+          "reusedBytes": {
+            "description": "Content bytes satisfied from files already at the destination.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "skipped": {
+            "description": "The first\n`MAX_LISTED_SKIPS` entries a\ncapture left out under its policies.",
+            "items": {
+              "$ref": "#/components/schemas/TransferSkip"
+            },
+            "type": "array"
+          },
+          "skippedEntryCount": {
+            "description": "Total number of entries left out, listed or not; present whenever it\nis not zero.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "totalBytes": {
+            "description": "File bytes in the inventory so far.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "transferredBytes": {
+            "description": "Content bytes moved over the wire.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "operationId",
+          "phase",
+          "entryCount",
+          "totalBytes",
+          "transferredBytes",
+          "reusedBytes"
+        ],
+        "type": "object"
+      },
+      "TreeContent": {
+        "description": "What a tree entry is: a scan entry or a transfer inventory entry.\nDigests identify raw file bytes, not paths or modes.",
+        "oneOf": [
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "directory",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "digest": {
+                "anyOf": [
+                  {
+                    "$ref": "#/components/schemas/ContentDigest"
+                  }
+                ],
+                "description": "Scans: present when `includeDigests` was set. Transfer\ninventories: always present; an appended file entry without it\nis `invalidParams`."
+              },
+              "executable": {
+                "type": "boolean"
+              },
+              "kind": {
+                "const": "file",
+                "type": "string"
+              },
+              "sizeBytes": {
+                "format": "uint64",
+                "minimum": 0,
+                "type": "integer"
+              }
+            },
+            "required": [
+              "kind",
+              "sizeBytes"
+            ],
+            "type": "object"
+          }
+        ]
+      },
+      "TreeFilter": {
+        "additionalProperties": false,
+        "description": "Which entries a walk visits. The default visits everything except\nhidden and ignored entries.",
+        "properties": {
+          "exclude": {
+            "description": "Drop entries matching any pattern; a matching directory is pruned.",
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "ignoreCase": {
+            "description": "Match patterns case-insensitively.",
+            "type": "boolean"
+          },
+          "include": {
+            "description": "Select entries matching any pattern; empty selects every entry.",
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "includeHidden": {
+            "description": "Visit entries whose name starts with `.`.",
+            "type": "boolean"
+          },
+          "includeIgnored": {
+            "description": "Visit entries that ignore files exclude.",
+            "type": "boolean"
+          },
+          "maxDepth": {
+            "description": "Deepest entry depth visited: the root's direct children are depth\n1, so `1` selects direct children only. Unbounded when absent.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "type": "object"
+      },
+      "TreePath": {
+        "description": "A relative, normalized path below a selected root: segments joined by\n`/`, without empty, `.` or `..` segments. The single segment `.` names\nthe root itself. At most 4096 bytes. Used for scan, inventory and\ntransfer entries.",
+        "maxLength": 4096,
+        "minLength": 1,
+        "pattern": "^(\\.|(?!\\.\\.?(/|$))[^/\\u0000]+(/(?!\\.\\.?(/|$))[^/\\u0000]+)*)$",
+        "type": "string"
+      },
+      "WriteCondition": {
+        "description": "When `fs/writeFile` may write.",
+        "oneOf": [
+          {
+            "const": "always",
+            "description": "Create or replace.",
+            "type": "string"
+          },
+          {
+            "const": "ifAbsent",
+            "description": "Only create; an existing entry is `failedPrecondition`\n(`createCondition`).",
+            "type": "string"
+          },
+          {
+            "const": "ifPresent",
+            "description": "Only replace; a missing file is `failedPrecondition`\n(`createCondition`).",
+            "type": "string"
+          }
+        ]
+      },
+      "WriteFileParams": {
+        "additionalProperties": false,
+        "description": "`fs/writeFile` params. The write is staged in the target's directory and\npublished by an atomic rename: readers see the old or the new content,\nnever a mix. An existing target keeps its permissions. A symlink at\n`path` whose target stays inside the root is followed like any path: the\nfinal target is replaced and the link itself is kept (a dangling link\ncreates its target, subject to `create`); a link that leaves the root is\n`permissionDenied` (`outsideRoot`). A special file is\n`failedPrecondition` (`notRegularFile`), a directory\n`failedPrecondition` (`isDirectory`). The parent of the final target\nmust exist.",
+        "properties": {
+          "create": {
+            "$ref": "#/components/schemas/WriteCondition"
+          },
+          "data": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/ByteChunk"
+              }
+            ],
+            "description": "At most `limits.filesystem.maxWriteFileBytes`; larger files go\nthrough `transfer/*` with a `writeFile` selection."
+          },
+          "executable": {
+            "description": "Set the execute bits (the read bits' pattern). Without it a new file\ngets the default mode and an existing file keeps its mode.",
+            "type": "boolean"
+          },
+          "ifMatch": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/FileVersion"
+              }
+            ],
+            "description": "Write only when the current file's version equals this token;\notherwise `failedPrecondition` (`ifMatchFailed`)."
+          },
+          "path": {
+            "$ref": "#/components/schemas/EnvironmentPath"
+          }
+        },
+        "required": [
+          "path",
+          "data"
+        ],
+        "type": "object"
+      },
+      "WriteFileResponse": {
+        "additionalProperties": false,
+        "description": "`fs/writeFile` response.",
+        "properties": {
+          "version": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/FileVersion"
+              }
+            ],
+            "description": "Version of the written file."
+          }
+        },
+        "required": [
+          "version"
+        ],
+        "type": "object"
+      },
+      "WriteProcessParams": {
+        "additionalProperties": false,
+        "description": "`process/write` params.",
+        "properties": {
+          "closeInput": {
+            "description": "Close the input after `data`: end of file on a pipe, `VEOF` on a\nPTY. Applied only when every byte of `data` was accepted.",
+            "type": "boolean"
+          },
+          "data": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/ByteChunk"
+              }
+            ],
+            "description": "Bytes for the process's input pipe or PTY."
+          },
+          "processId": {
+            "$ref": "#/components/schemas/ProcessId"
+          }
+        },
+        "required": [
+          "processId"
+        ],
+        "type": "object"
+      },
+      "WriteProcessResponse": {
+        "additionalProperties": false,
+        "description": "`process/write` response.",
+        "properties": {
+          "acceptedBytes": {
+            "description": "Leading bytes of `data` queued to the process's writer. Fewer than\nsent (possibly 0) means the input queue is full: resend the rest\nlater.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "acceptedBytes"
+        ],
+        "type": "object"
+      },
+      "WriteTransferContentParams": {
+        "additionalProperties": false,
+        "description": "`transfer/write` params: upload content for a missing digest. Chunks for\none digest arrive in order; an identical chunk may be retried.\nDifferent digests may be uploaded concurrently.",
+        "properties": {
+          "data": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/ByteChunk"
+              }
+            ],
+            "description": "At most `limits.filesystem.transfer.maxContentChunkBytes`."
+          },
+          "digest": {
+            "$ref": "#/components/schemas/ContentDigest"
+          },
+          "offset": {
+            "description": "Must equal the digest's next expected offset.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "operationId": {
+            "$ref": "#/components/schemas/TransferOperationId"
+          }
+        },
+        "required": [
+          "operationId",
+          "digest",
+          "offset",
+          "data"
+        ],
+        "type": "object"
+      },
+      "WriteTransferContentResponse": {
+        "additionalProperties": false,
+        "description": "`transfer/write` response.",
+        "properties": {
+          "nextOffset": {
+            "description": "The digest's next expected offset; equal to its size once complete\nand verified.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "nextOffset"
+        ],
+        "type": "object"
+      }
+    }
+  },
+  "info": {
+    "description": "JSON-RPC 2.0 over WebSocket text frames of at most 16777216 bytes. Exact-match protocolVersion 3. Errors carry code, message and data.kind; see x-lightspeed-error-kinds.",
+    "title": "Lightspeed environment data plane",
+    "version": "3"
+  },
+  "methods": [
+    {
+      "name": "initialize",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "clientInfo",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/ImplementationInfo"
+          }
+        },
+        {
+          "name": "protocolVersion",
+          "required": true,
+          "schema": {
+            "description": "The client's `ENVD_PROTOCOL_VERSION`.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/InitializeResponse"
+        }
+      },
+      "summary": "Check the protocol version and read the daemon's instance id, capabilities and ceilings.",
+      "x-lightspeed-activity": "observation",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "handshake",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "InitializeParams",
+      "x-lightspeed-result-type": "InitializeResponse"
+    },
+    {
+      "name": "env/getIdle",
+      "paramStructure": "by-name",
+      "params": [],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/GetIdleResponse"
+        }
+      },
+      "summary": "Report how long the environment has been idle.",
+      "x-lightspeed-activity": "observation",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "env",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "GetIdleParams",
+      "x-lightspeed-result-type": "GetIdleResponse"
+    },
+    {
+      "name": "fs/readFile",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "maxBytes",
+          "required": true,
+          "schema": {
+            "description": "Most bytes to return, at most `limits.filesystem.maxReadFileBytes`.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        {
+          "name": "offset",
+          "required": false,
+          "schema": {
+            "description": "First byte to return; 0 by default.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        {
+          "name": "path",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/EnvironmentPath"
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/ReadFileResponse"
+        }
+      },
+      "summary": "Read a byte range of a regular file.",
+      "x-lightspeed-activity": "use",
+      "x-lightspeed-capability": "filesystem",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "filesystem",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "ReadFileParams",
+      "x-lightspeed-result-type": "ReadFileResponse"
+    },
+    {
+      "name": "fs/writeFile",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "create",
+          "required": false,
+          "schema": {
+            "$ref": "#/components/schemas/WriteCondition"
+          }
+        },
+        {
+          "name": "data",
+          "required": true,
+          "schema": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/ByteChunk"
+              }
+            ],
+            "description": "At most `limits.filesystem.maxWriteFileBytes`; larger files go\nthrough `transfer/*` with a `writeFile` selection."
+          }
+        },
+        {
+          "name": "executable",
+          "required": false,
+          "schema": {
+            "description": "Set the execute bits (the read bits' pattern). Without it a new file\ngets the default mode and an existing file keeps its mode.",
+            "type": "boolean"
+          }
+        },
+        {
+          "name": "ifMatch",
+          "required": false,
+          "schema": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/FileVersion"
+              }
+            ],
+            "description": "Write only when the current file's version equals this token;\notherwise `failedPrecondition` (`ifMatchFailed`)."
+          }
+        },
+        {
+          "name": "path",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/EnvironmentPath"
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/WriteFileResponse"
+        }
+      },
+      "summary": "Write a file atomically, optionally conditioned on its version.",
+      "x-lightspeed-activity": "use",
+      "x-lightspeed-capability": "filesystemWrite",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "filesystem",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "WriteFileParams",
+      "x-lightspeed-result-type": "WriteFileResponse"
+    },
+    {
+      "name": "fs/createDirectory",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "path",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/EnvironmentPath"
+          }
+        },
+        {
+          "name": "recursive",
+          "required": false,
+          "schema": {
+            "description": "Create missing parents, and succeed when the directory exists.",
+            "type": "boolean"
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/CreateDirectoryResponse"
+        }
+      },
+      "summary": "Create a directory.",
+      "x-lightspeed-activity": "use",
+      "x-lightspeed-capability": "filesystemWrite",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "filesystem",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "CreateDirectoryParams",
+      "x-lightspeed-result-type": "CreateDirectoryResponse"
+    },
+    {
+      "name": "fs/getMetadata",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "followSymlinks",
+          "required": false,
+          "schema": {
+            "description": "Describe the symlink's target instead of the link (subject to\nconfinement).",
+            "type": "boolean"
+          }
+        },
+        {
+          "name": "path",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/EnvironmentPath"
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/GetMetadataResponse"
+        }
+      },
+      "summary": "Describe one entry.",
+      "x-lightspeed-activity": "use",
+      "x-lightspeed-capability": "filesystem",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "filesystem",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "GetMetadataParams",
+      "x-lightspeed-result-type": "GetMetadataResponse"
+    },
+    {
+      "name": "fs/readDirectory",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "cursor",
+          "required": false,
+          "schema": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/DirectoryCursor"
+              }
+            ],
+            "description": "`nextCursor` of the previous page; a cursor this daemon did not mint\nis `invalidParams`."
+          }
+        },
+        {
+          "name": "limit",
+          "required": true,
+          "schema": {
+            "description": "Most entries per page, 1 to `limits.filesystem.maxDirectoryEntries`.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        {
+          "name": "path",
+          "required": true,
+          "schema": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/EnvironmentPath"
+              }
+            ],
+            "description": "A directory, or a symlink to one inside the root."
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/ReadDirectoryResponse"
+        }
+      },
+      "summary": "List one page of a directory's entries.",
+      "x-lightspeed-activity": "use",
+      "x-lightspeed-capability": "filesystem",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "filesystem",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "ReadDirectoryParams",
+      "x-lightspeed-result-type": "ReadDirectoryResponse"
+    },
+    {
+      "name": "fs/remove",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "force",
+          "required": false,
+          "schema": {
+            "description": "Succeed when the path does not exist.",
+            "type": "boolean"
+          }
+        },
+        {
+          "name": "path",
+          "required": true,
+          "schema": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/EnvironmentPath"
+              }
+            ],
+            "description": "A symlink is removed, never followed."
+          }
+        },
+        {
+          "name": "recursive",
+          "required": false,
+          "schema": {
+            "description": "Remove a directory and its contents.",
+            "type": "boolean"
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/RemoveResponse"
+        }
+      },
+      "summary": "Remove a file, symlink or directory.",
+      "x-lightspeed-activity": "use",
+      "x-lightspeed-capability": "filesystemWrite",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "filesystem",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "RemoveParams",
+      "x-lightspeed-result-type": "RemoveResponse"
+    },
+    {
+      "name": "fs/rename",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "destination",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/EnvironmentPath"
+          }
+        },
+        {
+          "name": "ifMatch",
+          "required": false,
+          "schema": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/FileVersion"
+              }
+            ],
+            "description": "Rename only when the source's version equals this token."
+          }
+        },
+        {
+          "name": "overwrite",
+          "required": false,
+          "schema": {
+            "description": "Replace an existing destination file; otherwise an existing\ndestination is `alreadyExists`. A directory destination is never\nreplaced.",
+            "type": "boolean"
+          }
+        },
+        {
+          "name": "source",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/EnvironmentPath"
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/RenameResponse"
+        }
+      },
+      "summary": "Rename an entry atomically.",
+      "x-lightspeed-activity": "use",
+      "x-lightspeed-capability": "filesystemWrite",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "filesystem",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "RenameParams",
+      "x-lightspeed-result-type": "RenameResponse"
+    },
+    {
+      "name": "fs/searchText",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "filter",
+          "required": false,
+          "schema": {
+            "$ref": "#/components/schemas/TreeFilter"
+          }
+        },
+        {
+          "name": "limits",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/SearchTextLimits"
+          }
+        },
+        {
+          "name": "pattern",
+          "required": true,
+          "schema": {
+            "description": "Regular expression in the Rust `regex` crate's syntax, matched per\nline.",
+            "type": "string"
+          }
+        },
+        {
+          "name": "patternIgnoreCase",
+          "required": false,
+          "schema": {
+            "description": "Match `pattern` case-insensitively. `filter.ignoreCase` governs the\npath patterns instead.",
+            "type": "boolean"
+          }
+        },
+        {
+          "name": "root",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/EnvironmentPath"
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/SearchTextResponse"
+        }
+      },
+      "summary": "Search file contents below a root with a regular expression.",
+      "x-lightspeed-abortable": true,
+      "x-lightspeed-activity": "use",
+      "x-lightspeed-capability": "filesystem",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "filesystem",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "SearchTextParams",
+      "x-lightspeed-result-type": "SearchTextResponse"
+    },
+    {
+      "name": "fs/globFiles",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "filter",
+          "required": true,
+          "schema": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/TreeFilter"
+              }
+            ],
+            "description": "`include` must not be empty."
+          }
+        },
+        {
+          "name": "limits",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/GlobFilesLimits"
+          }
+        },
+        {
+          "name": "root",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/EnvironmentPath"
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/GlobFilesResponse"
+        }
+      },
+      "summary": "List files below a root that match patterns.",
+      "x-lightspeed-abortable": true,
+      "x-lightspeed-activity": "use",
+      "x-lightspeed-capability": "filesystem",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "filesystem",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "GlobFilesParams",
+      "x-lightspeed-result-type": "GlobFilesResponse"
+    },
+    {
+      "name": "fs/scan",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "filter",
+          "required": false,
+          "schema": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/TreeFilter"
+              }
+            ],
+            "description": "Applied below every root; at most `limits.filesystem.scan.maxPatterns`\npatterns in total."
+          }
+        },
+        {
+          "name": "followSymlinks",
+          "required": false,
+          "schema": {
+            "description": "Follow symlinks whose targets stay inside the filesystem root; others\nare skipped (`symlinkOutsideRoot`). Without it symlinks are skipped\n(`symlink`).",
+            "type": "boolean"
+          }
+        },
+        {
+          "name": "includeDigests",
+          "required": false,
+          "schema": {
+            "description": "Return each selected file's `digest`.",
+            "type": "boolean"
+          }
+        },
+        {
+          "name": "limits",
+          "required": true,
+          "schema": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/ScanLimits"
+              }
+            ],
+            "description": "Caller quotas; each at most its ceiling."
+          }
+        },
+        {
+          "name": "readContent",
+          "required": false,
+          "schema": {
+            "description": "Return the bytes of every selected file in `data`.",
+            "type": "boolean"
+          }
+        },
+        {
+          "name": "roots",
+          "required": true,
+          "schema": {
+            "description": "1 to `limits.filesystem.scan.maxRoots` roots.",
+            "items": {
+              "$ref": "#/components/schemas/ScanRoot"
+            },
+            "type": "array"
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/ScanResponse"
+        }
+      },
+      "summary": "Observe small trees below several roots, each reported on its own.",
+      "x-lightspeed-abortable": true,
+      "x-lightspeed-activity": "observation",
+      "x-lightspeed-capability": "filesystem",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "filesystem",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "ScanParams",
+      "x-lightspeed-result-type": "ScanResponse"
+    },
+    {
+      "name": "transfer/begin",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "limits",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/TransferLimits"
+          }
+        },
+        {
+          "name": "operationId",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/TransferOperationId"
+          }
+        },
+        {
+          "name": "selection",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/TransferSelection"
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/TransferStatus"
+        }
+      },
+      "summary": "Start or resume a transfer operation.",
+      "x-lightspeed-activity": "use",
+      "x-lightspeed-capability": "filesystem",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "transfer",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "BeginTransferParams",
+      "x-lightspeed-result-type": "TransferStatus"
+    },
+    {
+      "name": "transfer/advance",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "operationId",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/TransferOperationId"
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/TransferStatus"
+        }
+      },
+      "summary": "Do a bounded step of scanning or staging work.",
+      "x-lightspeed-activity": "use",
+      "x-lightspeed-capability": "filesystem",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "transfer",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "TransferOperationParams",
+      "x-lightspeed-result-type": "TransferStatus"
+    },
+    {
+      "name": "transfer/getStatus",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "operationId",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/TransferOperationId"
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/TransferStatus"
+        }
+      },
+      "summary": "Read an operation's status or receipt.",
+      "x-lightspeed-activity": "use",
+      "x-lightspeed-capability": "filesystem",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "transfer",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "TransferOperationParams",
+      "x-lightspeed-result-type": "TransferStatus"
+    },
+    {
+      "name": "transfer/readInventory",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "index",
+          "required": true,
+          "schema": {
+            "description": "Index of the first entry.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        {
+          "name": "limit",
+          "required": true,
+          "schema": {
+            "description": "1 to `limits.filesystem.transfer.maxInventoryPageEntries`.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        {
+          "name": "operationId",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/TransferOperationId"
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/ReadTransferInventoryResponse"
+        }
+      },
+      "summary": "Read one page of a sealed inventory.",
+      "x-lightspeed-activity": "use",
+      "x-lightspeed-capability": "filesystem",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "transfer",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "ReadTransferInventoryParams",
+      "x-lightspeed-result-type": "ReadTransferInventoryResponse"
+    },
+    {
+      "name": "transfer/append",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "entries",
+          "required": true,
+          "schema": {
+            "description": "At most `limits.filesystem.transfer.maxInventoryPageEntries`.",
+            "items": {
+              "$ref": "#/components/schemas/InventoryEntry"
+            },
+            "type": "array"
+          }
+        },
+        {
+          "name": "index",
+          "required": true,
+          "schema": {
+            "description": "Index of the page's first entry: the number of entries appended\nbefore it.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        {
+          "name": "last",
+          "required": false,
+          "schema": {
+            "description": "This page completes the inventory.",
+            "type": "boolean"
+          }
+        },
+        {
+          "name": "operationId",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/TransferOperationId"
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/TransferStatus"
+        }
+      },
+      "summary": "Append incoming inventory entries.",
+      "x-lightspeed-activity": "use",
+      "x-lightspeed-capability": "filesystem",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "transfer",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "AppendTransferInventoryParams",
+      "x-lightspeed-result-type": "TransferStatus"
+    },
+    {
+      "name": "transfer/listMissing",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "limit",
+          "required": true,
+          "schema": {
+            "description": "Most digests to return, 1 to\n`limits.filesystem.transfer.maxInventoryPageEntries`.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        {
+          "name": "operationId",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/TransferOperationId"
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/ListTransferMissingResponse"
+        }
+      },
+      "summary": "List digests whose content the daemon still needs.",
+      "x-lightspeed-activity": "use",
+      "x-lightspeed-capability": "filesystem",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "transfer",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "ListTransferMissingParams",
+      "x-lightspeed-result-type": "ListTransferMissingResponse"
+    },
+    {
+      "name": "transfer/read",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "digest",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/ContentDigest"
+          }
+        },
+        {
+          "name": "maxBytes",
+          "required": true,
+          "schema": {
+            "description": "1 to `limits.filesystem.transfer.maxContentChunkBytes`.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        {
+          "name": "offset",
+          "required": true,
+          "schema": {
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        {
+          "name": "operationId",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/TransferOperationId"
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/ReadTransferContentResponse"
+        }
+      },
+      "summary": "Read captured content by digest.",
+      "x-lightspeed-activity": "use",
+      "x-lightspeed-capability": "filesystem",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "transfer",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "ReadTransferContentParams",
+      "x-lightspeed-result-type": "ReadTransferContentResponse"
+    },
+    {
+      "name": "transfer/write",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "data",
+          "required": true,
+          "schema": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/ByteChunk"
+              }
+            ],
+            "description": "At most `limits.filesystem.transfer.maxContentChunkBytes`."
+          }
+        },
+        {
+          "name": "digest",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/ContentDigest"
+          }
+        },
+        {
+          "name": "offset",
+          "required": true,
+          "schema": {
+            "description": "Must equal the digest's next expected offset.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        {
+          "name": "operationId",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/TransferOperationId"
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/WriteTransferContentResponse"
+        }
+      },
+      "summary": "Upload content for a missing digest.",
+      "x-lightspeed-activity": "use",
+      "x-lightspeed-capability": "filesystem",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "transfer",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "WriteTransferContentParams",
+      "x-lightspeed-result-type": "WriteTransferContentResponse"
+    },
+    {
+      "name": "transfer/commit",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "operationId",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/TransferOperationId"
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/TransferStatus"
+        }
+      },
+      "summary": "Finish a ready operation: publish a staged tree, or release a capture.",
+      "x-lightspeed-activity": "use",
+      "x-lightspeed-capability": "filesystem",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "transfer",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "TransferOperationParams",
+      "x-lightspeed-result-type": "TransferStatus"
+    },
+    {
+      "name": "transfer/abort",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "operationId",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/TransferOperationId"
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/TransferStatus"
+        }
+      },
+      "summary": "Abandon an operation and discard its staging.",
+      "x-lightspeed-activity": "use",
+      "x-lightspeed-capability": "filesystem",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "transfer",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "TransferOperationParams",
+      "x-lightspeed-result-type": "TransferStatus"
+    },
+    {
+      "name": "process/start",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "command",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/CommandSpec"
+          }
+        },
+        {
+          "name": "processId",
+          "required": true,
+          "schema": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/ProcessId"
+              }
+            ],
+            "description": "Caller-chosen handle, reserved before any side effect: a start whose\nid is already in use (running, retained or remembered by a tombstone)\nis `alreadyExists` and runs nothing."
+          }
+        },
+        {
+          "name": "pty",
+          "required": false,
+          "schema": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/PtySize"
+              }
+            ],
+            "description": "Run under a PTY of this size. The PTY master is the input: `input`\nmust then be `none` or `bytes`, and `process/write` is always\naccepted while the process runs. Requires\n`capabilities.process.pty`."
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/StartProcessResponse"
+        }
+      },
+      "summary": "Start a process under a caller-chosen handle.",
+      "x-lightspeed-activity": "use",
+      "x-lightspeed-capability": "process",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "process",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "StartProcessParams",
+      "x-lightspeed-result-type": "StartProcessResponse"
+    },
+    {
+      "name": "process/read",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "ack",
+          "required": false,
+          "schema": {
+            "description": "Acknowledge every byte before this offset first: the cursor moves to\nit (never backwards) whether or not this read's response arrives. A\ncaller that tracks positions reads with `after` and acknowledges\nwith `ack` for exactly-once delivery.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        {
+          "name": "after",
+          "required": false,
+          "schema": {
+            "description": "Start offset. Absent: the daemon cursor, which this read advances to\n`next` once its response is written. Present: a non-consuming read\nthat leaves the cursor alone.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        {
+          "name": "maxBytes",
+          "required": true,
+          "schema": {
+            "description": "Most `data` bytes to return, at most `limits.process.maxReadBytes`.\n0 reads only the state.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        {
+          "name": "processId",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/ProcessId"
+          }
+        },
+        {
+          "name": "returnOn",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/ReturnOn"
+          }
+        },
+        {
+          "name": "tailBytes",
+          "required": false,
+          "schema": {
+            "description": "Start at `end - tailBytes` instead (clamped at 0). Non-consuming;\nexcludes `after`.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        {
+          "name": "waitMs",
+          "required": true,
+          "schema": {
+            "description": "How long to wait, at most `limits.maxWaitMs`. 0 polls.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/ReadProcessResponse"
+        }
+      },
+      "summary": "Wait for and read a page of a process's output and its state.",
+      "x-lightspeed-abortable": true,
+      "x-lightspeed-activity": "use",
+      "x-lightspeed-capability": "process",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "process",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "ReadProcessParams",
+      "x-lightspeed-result-type": "ReadProcessResponse"
+    },
+    {
+      "name": "process/write",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "closeInput",
+          "required": false,
+          "schema": {
+            "description": "Close the input after `data`: end of file on a pipe, `VEOF` on a\nPTY. Applied only when every byte of `data` was accepted.",
+            "type": "boolean"
+          }
+        },
+        {
+          "name": "data",
+          "required": false,
+          "schema": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/ByteChunk"
+              }
+            ],
+            "description": "Bytes for the process's input pipe or PTY."
+          }
+        },
+        {
+          "name": "processId",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/ProcessId"
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/WriteProcessResponse"
+        }
+      },
+      "summary": "Queue bytes for a process's input pipe or PTY.",
+      "x-lightspeed-activity": "use",
+      "x-lightspeed-capability": "process",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "process",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "WriteProcessParams",
+      "x-lightspeed-result-type": "WriteProcessResponse"
+    },
+    {
+      "name": "process/terminate",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "processId",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/ProcessId"
+          }
+        },
+        {
+          "name": "signal",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/ProcessSignal"
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/TerminateProcessResponse"
+        }
+      },
+      "summary": "Interrupt, terminate or kill a process's group.",
+      "x-lightspeed-activity": "use",
+      "x-lightspeed-capability": "process",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "process",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "TerminateProcessParams",
+      "x-lightspeed-result-type": "TerminateProcessResponse"
+    },
+    {
+      "name": "job/start",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "jobs",
+          "required": true,
+          "schema": {
+            "description": "1 to `limits.job.maxRequestJobs` jobs.",
+            "items": {
+              "$ref": "#/components/schemas/JobSpec"
+            },
+            "type": "array"
+          }
+        },
+        {
+          "name": "requestId",
+          "required": true,
+          "schema": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/JobRequestId"
+              }
+            ],
+            "description": "Idempotency key of this start. Retrying with the same request id and\nidentical jobs replays the existing jobs; reusing a job id with\nanother request id or spec is `failedPrecondition` (`jobIdInUse`)."
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/StartJobsResponse"
+        }
+      },
+      "summary": "Start jobs, or replay an identical earlier start.",
+      "x-lightspeed-activity": "use",
+      "x-lightspeed-capability": "job",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "job",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "StartJobsParams",
+      "x-lightspeed-result-type": "StartJobsResponse"
+    },
+    {
+      "name": "job/read",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "jobs",
+          "required": true,
+          "schema": {
+            "description": "1 to `limits.job.maxRequestJobs` entries, each with its own position.",
+            "items": {
+              "$ref": "#/components/schemas/JobReadRequest"
+            },
+            "type": "array"
+          }
+        },
+        {
+          "name": "maxBytes",
+          "required": true,
+          "schema": {
+            "description": "Most `data` bytes across all entries, at most\n`limits.job.maxReadBytes`, filled in request order: an entry reached\nafter the budget is spent returns its summary and an empty page at\nits start position. 0 reads only summaries.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        {
+          "name": "returnOn",
+          "required": true,
+          "schema": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/ReturnOn"
+              }
+            ],
+            "description": "`anyOutput`: return when any entry has output past its position or\nchanged status; `exit`: when every entry is terminal; `window`: wait\nthe whole window."
+          }
+        },
+        {
+          "name": "waitMs",
+          "required": true,
+          "schema": {
+            "description": "How long to wait, at most `limits.maxWaitMs`. 0 polls.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/ReadJobsResponse"
+        }
+      },
+      "summary": "Wait for and read jobs' summaries and output pages.",
+      "x-lightspeed-abortable": true,
+      "x-lightspeed-activity": "observation",
+      "x-lightspeed-capability": "job",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "job",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "ReadJobsParams",
+      "x-lightspeed-result-type": "ReadJobsResponse"
+    },
+    {
+      "name": "job/cancel",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "force",
+          "required": false,
+          "schema": {
+            "description": "Kill at once instead of `SIGTERM`, `limits.job.cancelGraceMs`, then\n`SIGKILL`.",
+            "type": "boolean"
+          }
+        },
+        {
+          "name": "jobIds",
+          "required": true,
+          "schema": {
+            "description": "1 to `limits.job.maxRequestJobs` ids.",
+            "items": {
+              "$ref": "#/components/schemas/JobId"
+            },
+            "type": "array"
+          }
+        },
+        {
+          "name": "scope",
+          "required": false,
+          "schema": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/JobCancelScope"
+              }
+            ],
+            "description": "`job` by default."
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/CancelJobsResponse"
+        }
+      },
+      "summary": "Cancel jobs and optionally their dependents.",
+      "x-lightspeed-activity": "use",
+      "x-lightspeed-capability": "job",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "job",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "CancelJobsParams",
+      "x-lightspeed-result-type": "CancelJobsResponse"
+    },
+    {
+      "name": "$/cancelRequest",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "id",
+          "required": true,
+          "schema": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/Id"
+              }
+            ],
+            "description": "Id of the request to abort."
+          }
+        }
+      ],
+      "summary": "Abort a pending abortable request.",
+      "x-lightspeed-activity": "observation",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "envelope",
+      "x-lightspeed-kind": "notification",
+      "x-lightspeed-params-type": "CancelRequestParams"
+    }
+  ],
+  "openrpc": "1.3.2",
+  "x-lightspeed-error": {
+    "$ref": "#/components/schemas/ProtocolError"
+  },
+  "x-lightspeed-error-kinds": [
+    {
+      "code": -32700,
+      "kind": "parseError",
+      "retryable": false
+    },
+    {
+      "code": -32600,
+      "kind": "invalidRequest",
+      "retryable": false
+    },
+    {
+      "code": -32601,
+      "kind": "methodNotFound",
+      "retryable": false
+    },
+    {
+      "code": -32602,
+      "kind": "invalidParams",
+      "retryable": false
+    },
+    {
+      "code": -32002,
+      "kind": "notInitialized",
+      "retryable": false
+    },
+    {
+      "code": -32005,
+      "kind": "versionMismatch",
+      "retryable": false
+    },
+    {
+      "code": -32004,
+      "kind": "notFound",
+      "retryable": false
+    },
+    {
+      "code": -32009,
+      "kind": "alreadyExists",
+      "retryable": false
+    },
+    {
+      "code": -32007,
+      "kind": "failedPrecondition",
+      "retryable": false
+    },
+    {
+      "code": -32003,
+      "kind": "permissionDenied",
+      "retryable": false
+    },
+    {
+      "code": -32006,
+      "kind": "capabilityUnavailable",
+      "retryable": false
+    },
+    {
+      "code": -32008,
+      "kind": "busy",
+      "retryable": true
+    },
+    {
+      "code": -32015,
+      "kind": "deadlineExceeded",
+      "retryable": false
+    },
+    {
+      "code": -32016,
+      "kind": "expired",
+      "retryable": false
+    },
+    {
+      "code": -32017,
+      "kind": "aborted",
+      "retryable": true
+    },
+    {
+      "code": -32013,
+      "kind": "payloadTooLarge",
+      "retryable": false
+    },
+    {
+      "code": -32018,
+      "kind": "processFailed",
+      "retryable": false
+    },
+    {
+      "code": -32019,
+      "kind": "unavailable",
+      "retryable": true
+    },
+    {
+      "code": -32603,
+      "kind": "internal",
+      "retryable": false
+    }
+  ],
+  "x-lightspeed-plane": "data"
+}
diff --git a/crates/environment-protocol/contract/data.schema.json b/crates/environment-protocol/contract/data.schema.json
new file mode 100644
index 000000000..40e77831e
--- /dev/null
+++ b/crates/environment-protocol/contract/data.schema.json
@@ -0,0 +1,4285 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "definitions": {
+    "AbortReason": {
+      "description": "Why an operation was `aborted`.",
+      "oneOf": [
+        {
+          "const": "cancelled",
+          "description": "`$/cancelRequest` named the request.",
+          "type": "string"
+        },
+        {
+          "const": "sourceChanged",
+          "description": "A file or directory changed while it was being read.",
+          "type": "string"
+        }
+      ]
+    },
+    "AppendTransferInventoryParams": {
+      "additionalProperties": false,
+      "description": "`transfer/append` params: add incoming inventory entries in order.\nRetrying an identical page is safe.",
+      "properties": {
+        "entries": {
+          "description": "At most `limits.filesystem.transfer.maxInventoryPageEntries`.",
+          "items": {
+            "$ref": "#/definitions/InventoryEntry"
+          },
+          "type": "array"
+        },
+        "index": {
+          "description": "Index of the page's first entry: the number of entries appended\nbefore it.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "last": {
+          "description": "This page completes the inventory.",
+          "type": "boolean"
+        },
+        "operationId": {
+          "$ref": "#/definitions/TransferOperationId"
+        }
+      },
+      "required": [
+        "operationId",
+        "index",
+        "entries"
+      ],
+      "type": "object"
+    },
+    "BeginTransferParams": {
+      "additionalProperties": false,
+      "description": "`transfer/begin` params. Idempotent: a repeat with identical input\nreturns the operation's status; different input under the same id is\n`failedPrecondition` (`operationIdInUse`).",
+      "properties": {
+        "limits": {
+          "$ref": "#/definitions/TransferLimits"
+        },
+        "operationId": {
+          "$ref": "#/definitions/TransferOperationId"
+        },
+        "selection": {
+          "$ref": "#/definitions/TransferSelection"
+        }
+      },
+      "required": [
+        "operationId",
+        "selection",
+        "limits"
+      ],
+      "type": "object"
+    },
+    "BusyReason": {
+      "description": "What limit a `busy` request hit.",
+      "oneOf": [
+        {
+          "const": "requestLimit",
+          "description": "The connection's concurrent request limit.",
+          "type": "string"
+        },
+        {
+          "const": "transferCapacity",
+          "description": "The daemon's limit on active transfer operations.",
+          "type": "string"
+        },
+        {
+          "const": "rateLimited",
+          "description": "A rate limit on the caller's identity.",
+          "type": "string"
+        },
+        {
+          "const": "capacityExhausted",
+          "description": "A registration key's limit on active environments.",
+          "type": "string"
+        }
+      ]
+    },
+    "ByteChunk": {
+      "contentEncoding": "base64",
+      "description": "Payload bytes, always named `data` on the wire, as padded standard\nbase64.",
+      "pattern": "^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$",
+      "type": "string"
+    },
+    "CancelJobsParams": {
+      "additionalProperties": false,
+      "description": "`job/cancel` params.",
+      "properties": {
+        "force": {
+          "description": "Kill at once instead of `SIGTERM`, `limits.job.cancelGraceMs`, then\n`SIGKILL`.",
+          "type": "boolean"
+        },
+        "jobIds": {
+          "description": "1 to `limits.job.maxRequestJobs` ids.",
+          "items": {
+            "$ref": "#/definitions/JobId"
+          },
+          "type": "array"
+        },
+        "scope": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/JobCancelScope"
+            }
+          ],
+          "description": "`job` by default."
+        }
+      },
+      "required": [
+        "jobIds"
+      ],
+      "type": "object"
+    },
+    "CancelJobsResponse": {
+      "additionalProperties": false,
+      "description": "`job/cancel` response: one entry per affected job, named jobs first in\nrequest order, then dependents, at most `limits.job.maxRequestJobs`\nentries in total.",
+      "properties": {
+        "jobs": {
+          "description": "Never empty.",
+          "items": {
+            "$ref": "#/definitions/JobSummaryEntry"
+          },
+          "type": "array"
+        },
+        "unlistedJobCount": {
+          "description": "Dependents cancelled as well but not listed, beyond the entry limit.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "required": [
+        "jobs"
+      ],
+      "type": "object"
+    },
+    "CancelRequestParams": {
+      "additionalProperties": false,
+      "description": "`$/cancelRequest` params.",
+      "properties": {
+        "id": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/Id"
+            }
+          ],
+          "description": "Id of the request to abort."
+        }
+      },
+      "required": [
+        "id"
+      ],
+      "type": "object"
+    },
+    "Capability": {
+      "description": "A capability a request needed and the endpoint lacks.",
+      "oneOf": [
+        {
+          "const": "filesystem",
+          "description": "The `filesystem` family.",
+          "type": "string"
+        },
+        {
+          "const": "filesystemWrite",
+          "description": "`capabilities.filesystem.write`: the filesystem is writable.",
+          "type": "string"
+        },
+        {
+          "const": "process",
+          "description": "The `process` family.",
+          "type": "string"
+        },
+        {
+          "const": "processPty",
+          "description": "`capabilities.process.pty`.",
+          "type": "string"
+        },
+        {
+          "const": "job",
+          "description": "The `job` family.",
+          "type": "string"
+        },
+        {
+          "const": "adoptTarget",
+          "description": "The controller's `adoptTarget` capability.",
+          "type": "string"
+        },
+        {
+          "const": "ingress",
+          "description": "The controller's `ingress` capability.",
+          "type": "string"
+        }
+      ]
+    },
+    "CommandSpec": {
+      "additionalProperties": false,
+      "description": "What to run. Shared by `process/start` and `job/start`.",
+      "properties": {
+        "argv": {
+          "description": "Program and arguments; `argv[0]` is resolved through `PATH`. Not\nempty.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "cwd": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/EnvironmentPath"
+            }
+          ],
+          "description": "Working directory; the daemon's `defaultCwd` when absent."
+        },
+        "env": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "Variables added to the daemon's scrubbed environment.",
+          "type": "object"
+        },
+        "input": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/ExecInput"
+            }
+          ],
+          "description": "Standard input; none by default."
+        },
+        "secretEnv": {
+          "additionalProperties": {
+            "$ref": "#/definitions/SecretString"
+          },
+          "description": "Like `env`, but every value is redacted from the command's output.",
+          "type": "object"
+        },
+        "timeoutMs": {
+          "description": "Stop deadline from start. On expiry the daemon terminates the process\ngroup (`SIGTERM`, the advertised grace, then `SIGKILL`) and records\n`stoppedBy: timeout`. Absent means no deadline.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "required": [
+        "argv"
+      ],
+      "type": "object"
+    },
+    "ContentDigest": {
+      "description": "`sha256:` followed by 64 lowercase hex digits: the digest of a file's raw\nbytes, independent of its path and mode.",
+      "pattern": "^sha256:[0-9a-f]{64}$",
+      "type": "string"
+    },
+    "CreateDirectoryParams": {
+      "additionalProperties": false,
+      "description": "`fs/createDirectory` params.",
+      "properties": {
+        "path": {
+          "$ref": "#/definitions/EnvironmentPath"
+        },
+        "recursive": {
+          "description": "Create missing parents, and succeed when the directory exists.",
+          "type": "boolean"
+        }
+      },
+      "required": [
+        "path"
+      ],
+      "type": "object"
+    },
+    "CreateDirectoryResponse": {
+      "additionalProperties": false,
+      "description": "`fs/createDirectory` response.",
+      "type": "object"
+    },
+    "DaemonInstanceId": {
+      "description": "`daemonInstanceId`: random per daemon start. A change between two\nconnections means the daemon restarted and every process handle from\nthe earlier instance is gone.",
+      "maxLength": 128,
+      "minLength": 1,
+      "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$",
+      "type": "string"
+    },
+    "DataCapabilities": {
+      "additionalProperties": false,
+      "description": "Capability families. A present family means its base methods exist; a\nfamily's fields are facts that vary per instance. A request to an\nabsent family, or one needing an absent fact, is\n`capabilityUnavailable`.",
+      "properties": {
+        "filesystem": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/FilesystemCapabilities"
+            }
+          ],
+          "description": "`fs/*` (search, glob and scan included) and `transfer/*`."
+        },
+        "job": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/JobCapabilities"
+            }
+          ],
+          "description": "`job/*`."
+        },
+        "process": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/ProcessCapabilities"
+            }
+          ],
+          "description": "`process/*`."
+        }
+      },
+      "type": "object"
+    },
+    "DataLimits": {
+      "additionalProperties": false,
+      "description": "Operational ceilings this daemon enforces. A request above a ceiling is\n`invalidParams` naming the field and the ceiling; nothing is clamped.",
+      "properties": {
+        "filesystem": {
+          "$ref": "#/definitions/FilesystemLimits"
+        },
+        "job": {
+          "$ref": "#/definitions/JobLimits"
+        },
+        "maxConcurrentRequests": {
+          "description": "Requests in flight per connection before `busy`; at least\n`MIN_CONCURRENT_REQUESTS`.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxWaitMs": {
+          "description": "Largest `waitMs` of `process/read` and `job/read`.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "process": {
+          "$ref": "#/definitions/ProcessLimits"
+        }
+      },
+      "required": [
+        "maxConcurrentRequests",
+        "maxWaitMs",
+        "process",
+        "job",
+        "filesystem"
+      ],
+      "type": "object"
+    },
+    "DirectoryCursor": {
+      "description": "`cursor` and `nextCursor` of `fs/readDirectory`: an opaque position\nthe daemon mints, echoed back unchanged.",
+      "maxLength": 255,
+      "minLength": 1,
+      "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+      "type": "string"
+    },
+    "DirectoryEntry": {
+      "additionalProperties": false,
+      "description": "One `fs/readDirectory` entry.",
+      "properties": {
+        "metadata": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/FileMetadata"
+            }
+          ],
+          "description": "The entry itself, not a symlink's target. Entries that vanish while\nthe page is built are left out."
+        },
+        "name": {
+          "$ref": "#/definitions/EntryName"
+        }
+      },
+      "required": [
+        "name",
+        "metadata"
+      ],
+      "type": "object"
+    },
+    "EntryName": {
+      "description": "One entry name: a single path segment, neither `.` nor `..`, without\n`/` or NUL, at most 4096 bytes. `fs/readDirectory` entries use it.",
+      "maxLength": 4096,
+      "minLength": 1,
+      "pattern": "^(?!\\.\\.?$)[^/\\u0000]+$",
+      "type": "string"
+    },
+    "EnvironmentPath": {
+      "description": "An absolute, normalized POSIX path in the environment: `/`, or `/` and\none or more segments joined by `/`. Empty, `.` and `..` segments and a\ntrailing `/` are rejected, never rewritten. At most 4096 bytes.\n`defaultCwd`, `homeDirectory`, every `cwd` and every path parameter use\nthis type; see the module's path model and confinement rule.",
+      "maxLength": 4096,
+      "minLength": 1,
+      "pattern": "^(/|(/(?!\\.\\.?(/|$))[^/\\u0000]+)+)$",
+      "type": "string"
+    },
+    "ErrorData": {
+      "description": "The `data` member of an error object: the kind and its typed fields.\n\nKinds without fields are empty struct variants rather than unit\nvariants: serde does not apply `deny_unknown_fields` to the unit\nvariants of an internally tagged enum, and every kind must refuse\nunknown members.",
+      "oneOf": [
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "parseError",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "invalidRequest",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "methodNotFound",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "ceiling": {
+              "description": "The advertised ceiling the value exceeded.",
+              "format": "uint64",
+              "minimum": 0,
+              "type": "integer"
+            },
+            "field": {
+              "description": "Wire path of the offending field, such as `limits.maxDurationMs`.",
+              "type": "string"
+            },
+            "kind": {
+              "const": "invalidParams",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "notInitialized",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "expected": {
+              "description": "The version of the peer that sent this error.",
+              "format": "uint32",
+              "minimum": 0,
+              "type": "integer"
+            },
+            "kind": {
+              "const": "versionMismatch",
+              "type": "string"
+            },
+            "received": {
+              "description": "The version the requester stated.",
+              "format": "uint32",
+              "minimum": 0,
+              "type": "integer"
+            }
+          },
+          "required": [
+            "kind",
+            "expected",
+            "received"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "notFound",
+              "type": "string"
+            },
+            "reason": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/NotFoundReason"
+                }
+              ]
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "alreadyExists",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "failedPrecondition",
+              "type": "string"
+            },
+            "reason": {
+              "$ref": "#/definitions/PreconditionReason"
+            }
+          },
+          "required": [
+            "kind",
+            "reason"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "permissionDenied",
+              "type": "string"
+            },
+            "reason": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/PermissionReason"
+                }
+              ]
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "capability": {
+              "$ref": "#/definitions/Capability"
+            },
+            "kind": {
+              "const": "capabilityUnavailable",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind",
+            "capability"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "busy",
+              "type": "string"
+            },
+            "reason": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/BusyReason"
+                }
+              ]
+            },
+            "retryAfterMs": {
+              "description": "Earliest useful retry, when the server knows it.",
+              "format": "uint64",
+              "minimum": 0,
+              "type": "integer"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "deadlineExceeded",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "expired",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "aborted",
+              "type": "string"
+            },
+            "reason": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/AbortReason"
+                }
+              ]
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "payloadTooLarge",
+              "type": "string"
+            },
+            "limitBytes": {
+              "description": "The byte limit the payload exceeded.",
+              "format": "uint64",
+              "minimum": 0,
+              "type": "integer"
+            },
+            "limitEntries": {
+              "description": "The entry-count limit the result exceeded.",
+              "format": "uint32",
+              "minimum": 0,
+              "type": "integer"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "processFailed",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "unavailable",
+              "type": "string"
+            },
+            "retryAfterMs": {
+              "format": "uint64",
+              "minimum": 0,
+              "type": "integer"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "internal",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        }
+      ]
+    },
+    "ExecInput": {
+      "description": "Standard input of a command.",
+      "oneOf": [
+        {
+          "additionalProperties": false,
+          "description": "`/dev/null`: the command reads end of file. Model-facing tools use\nthis.",
+          "properties": {
+            "kind": {
+              "const": "none",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "description": "These bytes, then end of file. Written by a writer task after the\noutput readers, the exit watcher and the deadline are in place.",
+          "properties": {
+            "data": {
+              "$ref": "#/definitions/ByteChunk"
+            },
+            "kind": {
+              "const": "bytes",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind",
+            "data"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "description": "A persistent pipe fed by `process/write` until closed. Processes\nonly; `job/start` refuses it with `invalidParams`.",
+          "properties": {
+            "kind": {
+              "const": "pipe",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        }
+      ]
+    },
+    "ExecState": {
+      "description": "Lifecycle state of a process.",
+      "oneOf": [
+        {
+          "enum": [
+            "running"
+          ],
+          "type": "string"
+        },
+        {
+          "const": "exited",
+          "description": "The root exited and its output settled.",
+          "type": "string"
+        }
+      ]
+    },
+    "ExitStatus": {
+      "description": "How the root process ended.",
+      "oneOf": [
+        {
+          "additionalProperties": false,
+          "description": "Normal exit with this status code.",
+          "properties": {
+            "code": {
+              "format": "int32",
+              "type": "integer"
+            },
+            "kind": {
+              "const": "code",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind",
+            "code"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "description": "Killed by this signal.",
+          "properties": {
+            "coreDumped": {
+              "type": "boolean"
+            },
+            "kind": {
+              "const": "signal",
+              "type": "string"
+            },
+            "signal": {
+              "$ref": "#/definitions/SignalName"
+            }
+          },
+          "required": [
+            "kind",
+            "signal"
+          ],
+          "type": "object"
+        }
+      ]
+    },
+    "FileKind": {
+      "description": "Kind of a filesystem entry.",
+      "oneOf": [
+        {
+          "enum": [
+            "file",
+            "directory",
+            "symlink"
+          ],
+          "type": "string"
+        },
+        {
+          "const": "other",
+          "description": "Device, FIFO, socket or another special file.",
+          "type": "string"
+        }
+      ]
+    },
+    "FileMetadata": {
+      "additionalProperties": false,
+      "description": "One file-entry shape for `fs/getMetadata` and `fs/readDirectory`.",
+      "properties": {
+        "createdAtMs": {
+          "description": "Absent when the filesystem records no birth time.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "executable": {
+          "description": "A regular file with any execute bit set; always false for\ndirectories, symlinks and special files.",
+          "type": "boolean"
+        },
+        "kind": {
+          "$ref": "#/definitions/FileKind"
+        },
+        "modifiedAtMs": {
+          "format": "int64",
+          "type": "integer"
+        },
+        "sizeBytes": {
+          "description": "Size in bytes; for a symlink, the length of its target text.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "symlinkTarget": {
+          "description": "Target text of a symlink, when it is UTF-8.",
+          "type": "string"
+        },
+        "version": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/FileVersion"
+            }
+          ],
+          "description": "Changes whenever the entry's content or identity changes; compare it\nwith `ifMatch`."
+        }
+      },
+      "required": [
+        "kind",
+        "sizeBytes",
+        "modifiedAtMs",
+        "version"
+      ],
+      "type": "object"
+    },
+    "FileVersion": {
+      "description": "Opaque version token of a file's content and identity. Equal tokens for\none path mean the content is unchanged. 1 to 255 bytes without control\ncharacters.",
+      "maxLength": 255,
+      "minLength": 1,
+      "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+      "type": "string"
+    },
+    "FilesystemCapabilities": {
+      "additionalProperties": false,
+      "description": "The `filesystem` family: `fs/*` and `transfer/*`.",
+      "properties": {
+        "write": {
+          "description": "Methods that change the filesystem are served; false on a daemon\nstarted read-only.",
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "FilesystemLimits": {
+      "additionalProperties": false,
+      "description": "Ceilings of `fs/*` and `transfer/*`.",
+      "properties": {
+        "glob": {
+          "$ref": "#/definitions/GlobCeilings"
+        },
+        "maxDirectoryEntries": {
+          "description": "Largest `limit` of `fs/readDirectory`.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxReadFileBytes": {
+          "description": "Largest `maxBytes` of `fs/readFile`.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxWriteFileBytes": {
+          "description": "Largest `data` of `fs/writeFile`.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "scan": {
+          "$ref": "#/definitions/ScanCeilings"
+        },
+        "search": {
+          "$ref": "#/definitions/SearchCeilings"
+        },
+        "transfer": {
+          "$ref": "#/definitions/TransferCeilings"
+        }
+      },
+      "required": [
+        "maxReadFileBytes",
+        "maxWriteFileBytes",
+        "maxDirectoryEntries",
+        "search",
+        "glob",
+        "scan",
+        "transfer"
+      ],
+      "type": "object"
+    },
+    "GapReason": {
+      "description": "Why a range of output cannot be returned.",
+      "oneOf": [
+        {
+          "const": "overflow",
+          "description": "Never delivered: dropped from the middle because retained output\nexceeded the handle's cap. The head and the newest bytes are kept.",
+          "type": "string"
+        },
+        {
+          "const": "expired",
+          "description": "Already delivered through the daemon cursor (or acknowledged) and\nreleased since.",
+          "type": "string"
+        }
+      ]
+    },
+    "GetIdleParams": {
+      "additionalProperties": false,
+      "description": "`env/getIdle` params.",
+      "type": "object"
+    },
+    "GetIdleResponse": {
+      "additionalProperties": false,
+      "description": "`env/getIdle` response.",
+      "properties": {
+        "idleForMs": {
+          "description": "Milliseconds since the last `use` request, or since running work\nlast ended, whichever is later. Zero while any process or job runs.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "leftoverProcessGroupCount": {
+          "description": "Process groups of exited processes that still have members alive:\nservices a command started and left running. They are not running\nwork and do not hold `idleForMs` at zero.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "runningJobCount": {
+          "description": "Jobs that are `running`.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "runningProcessCount": {
+          "description": "Processes started with `process/start` whose root has not exited.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "required": [
+        "idleForMs"
+      ],
+      "type": "object"
+    },
+    "GetMetadataParams": {
+      "additionalProperties": false,
+      "description": "`fs/getMetadata` params.",
+      "properties": {
+        "followSymlinks": {
+          "description": "Describe the symlink's target instead of the link (subject to\nconfinement).",
+          "type": "boolean"
+        },
+        "path": {
+          "$ref": "#/definitions/EnvironmentPath"
+        }
+      },
+      "required": [
+        "path"
+      ],
+      "type": "object"
+    },
+    "GetMetadataResponse": {
+      "additionalProperties": false,
+      "description": "`fs/getMetadata` response.",
+      "properties": {
+        "metadata": {
+          "$ref": "#/definitions/FileMetadata"
+        }
+      },
+      "required": [
+        "metadata"
+      ],
+      "type": "object"
+    },
+    "GlobCeilings": {
+      "additionalProperties": false,
+      "description": "Ceilings of `fs/globFiles` quotas, field for field.",
+      "properties": {
+        "maxDurationMs": {
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxFiles": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxMatches": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "required": [
+        "maxMatches",
+        "maxFiles",
+        "maxDurationMs"
+      ],
+      "type": "object"
+    },
+    "GlobFilesLimits": {
+      "additionalProperties": false,
+      "description": "Caller quotas of one enumeration; each at most its advertised ceiling.",
+      "properties": {
+        "maxDurationMs": {
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxFiles": {
+          "description": "Non-directory entries visited.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxMatches": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "required": [
+        "maxMatches",
+        "maxFiles",
+        "maxDurationMs"
+      ],
+      "type": "object"
+    },
+    "GlobFilesParams": {
+      "additionalProperties": false,
+      "description": "`fs/globFiles` params: bounded recursive enumeration of non-directory\nentries matching `filter.include`.",
+      "properties": {
+        "filter": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/TreeFilter"
+            }
+          ],
+          "description": "`include` must not be empty."
+        },
+        "limits": {
+          "$ref": "#/definitions/GlobFilesLimits"
+        },
+        "root": {
+          "$ref": "#/definitions/EnvironmentPath"
+        }
+      },
+      "required": [
+        "root",
+        "filter",
+        "limits"
+      ],
+      "type": "object"
+    },
+    "GlobFilesResponse": {
+      "additionalProperties": false,
+      "description": "`fs/globFiles` response.",
+      "properties": {
+        "elapsedMs": {
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "matches": {
+          "description": "In walk order (sorted by path).",
+          "items": {
+            "$ref": "#/definitions/EnvironmentPath"
+          },
+          "type": "array"
+        },
+        "skippedEntryCount": {
+          "description": "Entries the walk could not represent or list: names that are not\nUTF-8 and directories that could not be read.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "stopped": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/GlobFilesStop"
+            }
+          ]
+        },
+        "visitedFileCount": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "required": [
+        "visitedFileCount",
+        "elapsedMs"
+      ],
+      "type": "object"
+    },
+    "GlobFilesStop": {
+      "description": "Why an enumeration stopped before finishing its walk.",
+      "oneOf": [
+        {
+          "const": "matchLimit",
+          "description": "`maxMatches` paths were found.",
+          "type": "string"
+        },
+        {
+          "const": "fileLimit",
+          "description": "`maxFiles` non-directory entries were visited.",
+          "type": "string"
+        },
+        {
+          "const": "timeLimit",
+          "description": "`maxDurationMs` ran out.",
+          "type": "string"
+        },
+        {
+          "const": "responseLimit",
+          "description": "The next match would push the encoded matches past\n`MAX_RESULT_BYTES`.",
+          "type": "string"
+        }
+      ]
+    },
+    "Id": {
+      "anyOf": [
+        {
+          "format": "int64",
+          "type": "integer"
+        },
+        {
+          "type": "string"
+        }
+      ],
+      "description": "A request id: an integer or a string, echoed in the response."
+    },
+    "ImplementationInfo": {
+      "additionalProperties": false,
+      "description": "What a peer says about its own build: `clientInfo`, `serverInfo` and a\ndaemon's registration `implementation`. Descriptive only; the protocol\nversion alone decides whether two peers can talk, and nothing here\nselects, authenticates or gates. Every field is 1 to 256 bytes without control characters,\nchecked on decode and by every constructor, so a value that would be\nrefused can never be built or sent.",
+      "properties": {
+        "gitSha": {
+          "description": "Full or abbreviated git commit of the build.",
+          "maxLength": 256,
+          "minLength": 1,
+          "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+          "type": "string"
+        },
+        "name": {
+          "description": "Product name, such as `lightspeed-envd`.",
+          "maxLength": 256,
+          "minLength": 1,
+          "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+          "type": "string"
+        },
+        "target": {
+          "description": "Rust target triple of the build.",
+          "maxLength": 256,
+          "minLength": 1,
+          "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+          "type": "string"
+        },
+        "version": {
+          "description": "Release version, such as `0.5.0`.",
+          "maxLength": 256,
+          "minLength": 1,
+          "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+          "type": "string"
+        }
+      },
+      "required": [
+        "name"
+      ],
+      "type": "object"
+    },
+    "InitializeParams": {
+      "additionalProperties": false,
+      "description": "`initialize` params on the data plane.",
+      "properties": {
+        "clientInfo": {
+          "$ref": "#/definitions/ImplementationInfo"
+        },
+        "protocolVersion": {
+          "description": "The client's `ENVD_PROTOCOL_VERSION`.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "required": [
+        "protocolVersion",
+        "clientInfo"
+      ],
+      "type": "object"
+    },
+    "InitializeResponse": {
+      "additionalProperties": false,
+      "description": "`initialize` response on the data plane.",
+      "properties": {
+        "capabilities": {
+          "$ref": "#/definitions/DataCapabilities"
+        },
+        "daemonInstanceId": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/DaemonInstanceId"
+            }
+          ],
+          "description": "Random per daemon start; a different value than on an earlier\nconnection means the daemon restarted and the earlier instance's\nprocess handles are gone."
+        },
+        "defaultCwd": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/EnvironmentPath"
+            }
+          ],
+          "description": "The daemon's working directory: the default `cwd` of commands."
+        },
+        "homeDirectory": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/EnvironmentPath"
+            }
+          ],
+          "description": "Home directory of the user commands run as, when known."
+        },
+        "limits": {
+          "$ref": "#/definitions/DataLimits"
+        },
+        "plane": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/Plane"
+            }
+          ],
+          "description": "Always `data`."
+        },
+        "protocolVersion": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "serverInfo": {
+          "$ref": "#/definitions/ImplementationInfo"
+        }
+      },
+      "required": [
+        "protocolVersion",
+        "plane",
+        "daemonInstanceId",
+        "serverInfo",
+        "capabilities",
+        "limits",
+        "defaultCwd"
+      ],
+      "type": "object"
+    },
+    "InventoryEntry": {
+      "additionalProperties": false,
+      "description": "One inventory entry. Parents precede children.",
+      "properties": {
+        "content": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/TreeContent"
+            }
+          ],
+          "description": "A file entry always carries its `digest`."
+        },
+        "path": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/TreePath"
+            }
+          ],
+          "description": "Relative to the selected root; `.` is the root itself."
+        }
+      },
+      "required": [
+        "path",
+        "content"
+      ],
+      "type": "object"
+    },
+    "JobCancelScope": {
+      "description": "Which jobs a `job/cancel` affects.",
+      "oneOf": [
+        {
+          "const": "job",
+          "description": "Only the named jobs.",
+          "type": "string"
+        },
+        {
+          "const": "dependents",
+          "description": "The named jobs and every job that transitively depends on them.",
+          "type": "string"
+        }
+      ]
+    },
+    "JobCapabilities": {
+      "additionalProperties": false,
+      "description": "The `job` family: `job/*`. It has no instance facts.",
+      "type": "object"
+    },
+    "JobDependency": {
+      "description": "A dependency reference.",
+      "oneOf": [
+        {
+          "additionalProperties": false,
+          "description": "An existing job on this daemon, or one in the same request.",
+          "properties": {
+            "jobId": {
+              "$ref": "#/definitions/JobId"
+            },
+            "kind": {
+              "const": "jobId",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind",
+            "jobId"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "description": "The `name` of a job in the same `job/start`.",
+          "properties": {
+            "kind": {
+              "const": "name",
+              "type": "string"
+            },
+            "name": {
+              "$ref": "#/definitions/JobName"
+            }
+          },
+          "required": [
+            "kind",
+            "name"
+          ],
+          "type": "object"
+        }
+      ]
+    },
+    "JobDependencyPolicy": {
+      "description": "What a job waits for from its `dependsOn` jobs.",
+      "oneOf": [
+        {
+          "const": "allSucceeded",
+          "description": "Run once every dependency `succeeded`; any other terminal status\nmakes this job `dependencyFailed`.",
+          "type": "string"
+        },
+        {
+          "const": "allTerminal",
+          "description": "Run once every dependency is terminal, whatever its status.",
+          "type": "string"
+        }
+      ]
+    },
+    "JobId": {
+      "description": "`jobId`: caller-chosen name of one job run on one daemon.",
+      "maxLength": 128,
+      "minLength": 1,
+      "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$",
+      "type": "string"
+    },
+    "JobLimits": {
+      "additionalProperties": false,
+      "description": "Ceilings of `job/*`.",
+      "properties": {
+        "cancelGraceMs": {
+          "description": "Grace between `SIGTERM` and `SIGKILL` for a non-forced cancel and\ntimeouts.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxReadBytes": {
+          "description": "Largest `maxBytes` of one `job/read`, across its entries.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxRequestJobs": {
+          "description": "Most jobs one `job/start`, `job/read` or `job/cancel` names, and most\nentries a `job/cancel` response lists.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxRetainedOutputBytes": {
+          "description": "Output a job retains: the head and the tail, each half of this; the\nmiddle is an `overflow` gap.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "recordRetentionMs": {
+          "description": "How long a terminal job's record and output are kept.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "required": [
+        "maxReadBytes",
+        "maxRequestJobs",
+        "maxRetainedOutputBytes",
+        "recordRetentionMs",
+        "cancelGraceMs"
+      ],
+      "type": "object"
+    },
+    "JobName": {
+      "description": "`name` of a job and `dependsOn {kind: name}`: a caller-chosen name,\nunique within one `job/start`, 1 to 128 bytes without control\ncharacters.",
+      "maxLength": 128,
+      "minLength": 1,
+      "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+      "type": "string"
+    },
+    "JobReadEntry": {
+      "description": "A `job/read` entry: the job's summary and output page, or why it could\nnot be read (`notFound` for an unknown or garbage-collected job).",
+      "oneOf": [
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "job",
+              "type": "string"
+            },
+            "output": {
+              "$ref": "#/definitions/OutputPage"
+            },
+            "summary": {
+              "$ref": "#/definitions/JobSummary"
+            }
+          },
+          "required": [
+            "kind",
+            "summary",
+            "output"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "error": {
+              "$ref": "#/definitions/ProtocolError"
+            },
+            "jobId": {
+              "$ref": "#/definitions/JobId"
+            },
+            "kind": {
+              "const": "error",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind",
+            "jobId",
+            "error"
+          ],
+          "type": "object"
+        }
+      ]
+    },
+    "JobReadRequest": {
+      "additionalProperties": false,
+      "description": "One entry of a `job/read`. Job reads never consume: without `after` and\n`tailBytes` the page starts at offset 0. One job may be named by several\nentries, such as a head and a tail page.",
+      "properties": {
+        "after": {
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "jobId": {
+          "$ref": "#/definitions/JobId"
+        },
+        "maxBytes": {
+          "description": "Most `data` bytes for this entry; the request's `maxBytes` still\nbounds the total. Absent: whatever of the request's budget remains.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "tailBytes": {
+          "description": "Start at `end - tailBytes`; excludes `after`.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "required": [
+        "jobId"
+      ],
+      "type": "object"
+    },
+    "JobRequestId": {
+      "description": "`requestId` of a `job/start` call. Part of each job's identity: a\nretried start with the same request id and spec replays the job; any\nother reuse of the job id is refused.",
+      "maxLength": 128,
+      "minLength": 1,
+      "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$",
+      "type": "string"
+    },
+    "JobSpec": {
+      "additionalProperties": false,
+      "description": "One job of a `job/start`.",
+      "properties": {
+        "command": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/CommandSpec"
+            }
+          ],
+          "description": "`input` must be `none` or `bytes`."
+        },
+        "dependencyPolicy": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/JobDependencyPolicy"
+            }
+          ],
+          "description": "What \"finish\" means for `dependsOn`; `allSucceeded` by default."
+        },
+        "dependsOn": {
+          "description": "Jobs that must finish first.",
+          "items": {
+            "$ref": "#/definitions/JobDependency"
+          },
+          "type": "array"
+        },
+        "jobId": {
+          "$ref": "#/definitions/JobId"
+        },
+        "name": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/JobName"
+            }
+          ],
+          "description": "Local name other jobs of the same `job/start` can depend on; unique\nwithin the request."
+        },
+        "queueKey": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/QueueKey"
+            }
+          ]
+        }
+      },
+      "required": [
+        "jobId",
+        "command"
+      ],
+      "type": "object"
+    },
+    "JobStatus": {
+      "description": "Job lifecycle. `queued` and `running` are live; the rest are terminal.",
+      "oneOf": [
+        {
+          "enum": [
+            "running"
+          ],
+          "type": "string"
+        },
+        {
+          "const": "queued",
+          "description": "Accepted; waiting for dependencies or its queue.",
+          "type": "string"
+        },
+        {
+          "const": "succeeded",
+          "description": "Exited with code 0.",
+          "type": "string"
+        },
+        {
+          "const": "failed",
+          "description": "Exited otherwise, or could not start.",
+          "type": "string"
+        },
+        {
+          "const": "timedOut",
+          "description": "Its `timeoutMs` expired and the daemon stopped it.",
+          "type": "string"
+        },
+        {
+          "const": "cancelled",
+          "description": "Stopped or never started because of `job/cancel`.",
+          "type": "string"
+        },
+        {
+          "const": "dependencyFailed",
+          "description": "A dependency did not finish as the dependency policy requires.",
+          "type": "string"
+        },
+        {
+          "const": "interrupted",
+          "description": "The daemon stopped while the job was queued or running.",
+          "type": "string"
+        }
+      ]
+    },
+    "JobSummary": {
+      "additionalProperties": false,
+      "description": "What a job is and how it ended. Instants are the guest's wall clock.",
+      "properties": {
+        "cancelRequestedAtMs": {
+          "description": "When a `job/cancel` reached the job while it ran.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "createdAtMs": {
+          "format": "int64",
+          "type": "integer"
+        },
+        "dependsOn": {
+          "description": "Resolved ids of the jobs this one depends on.",
+          "items": {
+            "$ref": "#/definitions/JobId"
+          },
+          "type": "array"
+        },
+        "durationMs": {
+          "description": "Monotonic run time from start to finish, immune to guest clock jumps.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "error": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/ProtocolError"
+            }
+          ],
+          "description": "Why a `failed` or `interrupted` job produced no exit, or an\ninfrastructure failure while it ran."
+        },
+        "exit": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/ExitStatus"
+            }
+          ],
+          "description": "How the root process ended, once it ran and exited."
+        },
+        "finishedAtMs": {
+          "format": "int64",
+          "type": "integer"
+        },
+        "jobId": {
+          "$ref": "#/definitions/JobId"
+        },
+        "leftovers": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/LeftoverReport"
+            }
+          ],
+          "description": "What the daemon swept from the job's group at completion\n(`disposition: swept`)."
+        },
+        "name": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/JobName"
+            }
+          ]
+        },
+        "queueKey": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/QueueKey"
+            }
+          ]
+        },
+        "queuedAtMs": {
+          "description": "When the job became runnable and waited for its queue.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "requestId": {
+          "$ref": "#/definitions/JobRequestId"
+        },
+        "startedAtMs": {
+          "format": "int64",
+          "type": "integer"
+        },
+        "status": {
+          "$ref": "#/definitions/JobStatus"
+        },
+        "stoppedBy": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/StoppedBy"
+            }
+          ],
+          "description": "Set when the daemon stopped the running job: `timeout` for\n`timedOut`, `terminate` or `kill` for a cancel without or with\n`force`."
+        }
+      },
+      "required": [
+        "jobId",
+        "requestId",
+        "status",
+        "createdAtMs"
+      ],
+      "type": "object"
+    },
+    "JobSummaryEntry": {
+      "description": "A job summary, or why the named job could not be found.",
+      "oneOf": [
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "job",
+              "type": "string"
+            },
+            "summary": {
+              "$ref": "#/definitions/JobSummary"
+            }
+          },
+          "required": [
+            "kind",
+            "summary"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "error": {
+              "$ref": "#/definitions/ProtocolError"
+            },
+            "jobId": {
+              "$ref": "#/definitions/JobId"
+            },
+            "kind": {
+              "const": "error",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind",
+            "jobId",
+            "error"
+          ],
+          "type": "object"
+        }
+      ]
+    },
+    "LeftoverDisposition": {
+      "description": "What the daemon did with leftovers. The policies differ on purpose.",
+      "oneOf": [
+        {
+          "const": "kept",
+          "description": "Left running (processes): they keep the environment's lifetime and\nare reported until they exit.",
+          "type": "string"
+        },
+        {
+          "const": "swept",
+          "description": "Terminated when the job finished (jobs); the submitter should fix\nits script's teardown.",
+          "type": "string"
+        }
+      ]
+    },
+    "LeftoverProcess": {
+      "additionalProperties": false,
+      "description": "One leftover process.",
+      "properties": {
+        "command": {
+          "description": "Command line when the platform exposes it, otherwise the executable\nname, cut to\n`MAX_LEFTOVER_COMMAND_BYTES`\non a character boundary; absent when neither could be read.",
+          "type": "string"
+        },
+        "pid": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "required": [
+        "pid"
+      ],
+      "type": "object"
+    },
+    "LeftoverReport": {
+      "additionalProperties": false,
+      "description": "Processes of a command's group still alive after its root exited.\nPresent only when there is at least one.",
+      "properties": {
+        "disposition": {
+          "$ref": "#/definitions/LeftoverDisposition"
+        },
+        "omittedProcessCount": {
+          "description": "Leftovers beyond the listed ones.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "processes": {
+          "description": "At most `MAX_LEFTOVER_PROCESSES`,\nlowest pid first; never empty.",
+          "items": {
+            "$ref": "#/definitions/LeftoverProcess"
+          },
+          "type": "array"
+        }
+      },
+      "required": [
+        "disposition",
+        "processes"
+      ],
+      "type": "object"
+    },
+    "ListTransferMissingParams": {
+      "additionalProperties": false,
+      "description": "`transfer/listMissing` params.",
+      "properties": {
+        "limit": {
+          "description": "Most digests to return, 1 to\n`limits.filesystem.transfer.maxInventoryPageEntries`.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "operationId": {
+          "$ref": "#/definitions/TransferOperationId"
+        }
+      },
+      "required": [
+        "operationId",
+        "limit"
+      ],
+      "type": "object"
+    },
+    "ListTransferMissingResponse": {
+      "additionalProperties": false,
+      "description": "`transfer/listMissing` response: digests whose content the daemon still\nneeds. The set shrinks as uploads complete; call again rather than\npaging.",
+      "properties": {
+        "digests": {
+          "items": {
+            "$ref": "#/definitions/ContentDigest"
+          },
+          "type": "array"
+        },
+        "remainingCount": {
+          "description": "Missing digests beyond this page.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "type": "object"
+    },
+    "NotFoundReason": {
+      "description": "Why a handle, path or identity was not found.",
+      "oneOf": [
+        {
+          "const": "expired",
+          "description": "Its retention window ended; a tombstone remembers it.",
+          "type": "string"
+        },
+        {
+          "const": "daemonRestarted",
+          "description": "It belonged to an earlier daemon instance (see `daemonInstanceId`).",
+          "type": "string"
+        },
+        {
+          "const": "unknownDaemon",
+          "description": "A daemon identity the gateway has never admitted presented no\nregistration key.",
+          "type": "string"
+        }
+      ]
+    },
+    "OutputChunk": {
+      "additionalProperties": false,
+      "description": "Contiguous output bytes from one stream.",
+      "properties": {
+        "data": {
+          "$ref": "#/definitions/ByteChunk"
+        },
+        "offset": {
+          "description": "Byte offset of the chunk's first byte in the combined output.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "stream": {
+          "$ref": "#/definitions/OutputStream"
+        }
+      },
+      "required": [
+        "offset",
+        "stream",
+        "data"
+      ],
+      "type": "object"
+    },
+    "OutputGap": {
+      "additionalProperties": false,
+      "description": "Output bytes in `[offset, offset + omittedBytes)` that a page cannot\nreturn.",
+      "properties": {
+        "offset": {
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "omittedBytes": {
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "reason": {
+          "$ref": "#/definitions/GapReason"
+        }
+      },
+      "required": [
+        "offset",
+        "omittedBytes",
+        "reason"
+      ],
+      "type": "object"
+    },
+    "OutputPage": {
+      "additionalProperties": false,
+      "description": "One page of a handle's output. Returned by `process/read` and in every\n`job/read` entry. A page holds at most\n`MAX_PAGE_CHUNKS` chunks and gaps\ntogether (for `job/read`, across all entries); one that reaches it ends\nearly, and `next` says where to continue.",
+      "properties": {
+        "chunks": {
+          "description": "In offset order, at most `maxBytes` of `data` in total.",
+          "items": {
+            "$ref": "#/definitions/OutputChunk"
+          },
+          "type": "array"
+        },
+        "end": {
+          "description": "Bytes produced so far; final once the handle has exited.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "gaps": {
+          "description": "Unreturnable ranges between the requested start and `next`.",
+          "items": {
+            "$ref": "#/definitions/OutputGap"
+          },
+          "type": "array"
+        },
+        "next": {
+          "description": "Offset to read from next: past the last returned byte or gap.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "required": [
+        "next",
+        "end"
+      ],
+      "type": "object"
+    },
+    "OutputStream": {
+      "description": "Which descriptor produced a chunk. Jobs never produce `pty`.",
+      "oneOf": [
+        {
+          "enum": [
+            "stdout",
+            "stderr"
+          ],
+          "type": "string"
+        },
+        {
+          "const": "pty",
+          "description": "The PTY master, which merges stdout and stderr.",
+          "type": "string"
+        }
+      ]
+    },
+    "PermissionReason": {
+      "description": "Why a `permissionDenied` request was refused.",
+      "oneOf": [
+        {
+          "const": "outsideRoot",
+          "description": "The path, or a symlink it passes through, resolves outside the\ndaemon's filesystem root.",
+          "type": "string"
+        },
+        {
+          "const": "daemonState",
+          "description": "The path names or contains the daemon's state directory.",
+          "type": "string"
+        },
+        {
+          "const": "filePermission",
+          "description": "The operating system refused access.",
+          "type": "string"
+        },
+        {
+          "const": "invalidSignature",
+          "description": "The registration signature does not verify.",
+          "type": "string"
+        },
+        {
+          "const": "invalidRegistrationKey",
+          "description": "The registration key is unknown.",
+          "type": "string"
+        },
+        {
+          "const": "registrationKeyRevoked",
+          "description": "The registration key was revoked.",
+          "type": "string"
+        }
+      ]
+    },
+    "Plane": {
+      "description": "The plane a connection serves. Each `initialize` response names its\nplane, so a client that reached the wrong socket fails at the handshake.",
+      "oneOf": [
+        {
+          "const": "data",
+          "description": "envd's data plane, versioned by `ENVD_PROTOCOL_VERSION`.",
+          "type": "string"
+        },
+        {
+          "const": "controller",
+          "description": "A provider controller, versioned by `CONTROLLER_PROTOCOL_VERSION`.",
+          "type": "string"
+        },
+        {
+          "const": "registration",
+          "description": "The registration channel between a daemon and the gateway, versioned\nby `ENVD_PROTOCOL_VERSION`.",
+          "type": "string"
+        }
+      ]
+    },
+    "PreconditionReason": {
+      "description": "The state that forbids a `failedPrecondition` request.",
+      "oneOf": [
+        {
+          "const": "inputClosed",
+          "description": "The process has no open input: started without `pipe` or `pty`,\ninput already closed, or exited.",
+          "type": "string"
+        },
+        {
+          "const": "ifMatchFailed",
+          "description": "The file's current `version` differs from `ifMatch`.",
+          "type": "string"
+        },
+        {
+          "const": "createCondition",
+          "description": "`create: ifAbsent` met an existing file, or `create: ifPresent` a\nmissing one.",
+          "type": "string"
+        },
+        {
+          "const": "notEmpty",
+          "description": "The directory is not empty and `recursive` was not set.",
+          "type": "string"
+        },
+        {
+          "const": "isDirectory",
+          "description": "The path names a directory where a file is required.",
+          "type": "string"
+        },
+        {
+          "const": "notDirectory",
+          "description": "A path component or the path names a non-directory where a directory\nis required.",
+          "type": "string"
+        },
+        {
+          "const": "notRegularFile",
+          "description": "The path names a device, FIFO, socket or other non-regular file.",
+          "type": "string"
+        },
+        {
+          "const": "symlinkLoop",
+          "description": "A symlink chain loops.",
+          "type": "string"
+        },
+        {
+          "const": "symlinkRejected",
+          "description": "A capture met a symlink that leaves the selection, or one the\nselection's symlink policy rejects.",
+          "type": "string"
+        },
+        {
+          "const": "filesystemRoot",
+          "description": "The filesystem root itself cannot be replaced or removed.",
+          "type": "string"
+        },
+        {
+          "const": "crossDevice",
+          "description": "Rename across filesystems.",
+          "type": "string"
+        },
+        {
+          "const": "noSpace",
+          "description": "No space left on the device.",
+          "type": "string"
+        },
+        {
+          "const": "jobIdInUse",
+          "description": "A job id is in use by a job with another `requestId` or spec; choose\na new job id.",
+          "type": "string"
+        },
+        {
+          "const": "operationIdInUse",
+          "description": "A transfer `operationId` is in use for different input.",
+          "type": "string"
+        },
+        {
+          "const": "transferPhase",
+          "description": "The transfer action is not valid in the operation's current phase.",
+          "type": "string"
+        },
+        {
+          "const": "transferOffset",
+          "description": "A transfer write's `offset` is not the digest's next expected offset.",
+          "type": "string"
+        },
+        {
+          "const": "digestMismatch",
+          "description": "Uploaded bytes do not hash to their digest.",
+          "type": "string"
+        },
+        {
+          "const": "environmentClosed",
+          "description": "The environment is closed; its identity or target is spent.",
+          "type": "string"
+        },
+        {
+          "const": "identityInUse",
+          "description": "The daemon identity is bound to another universe.",
+          "type": "string"
+        },
+        {
+          "const": "ownerMismatch",
+          "description": "The target belongs to another owner, or (`target/adopt`) the owner\nalready holds a different target.",
+          "type": "string"
+        },
+        {
+          "const": "templateDeprecated",
+          "description": "The template is deprecated and creates no new targets.",
+          "type": "string"
+        },
+        {
+          "const": "ingressUnsupported",
+          "description": "`ingress/ensure` on a target whose template has no public ingress.",
+          "type": "string"
+        },
+        {
+          "const": "targetNotActive",
+          "description": "A power change on a target whose `phase` is not `active`\n(provisioning, closing, closed or failed).",
+          "type": "string"
+        },
+        {
+          "const": "notAdoptable",
+          "description": "`target/adopt`: the source target exists but the provider cannot take\nit over, for example an instance of a kind it does not manage.",
+          "type": "string"
+        }
+      ]
+    },
+    "ProcessCapabilities": {
+      "additionalProperties": false,
+      "description": "The `process` family: `process/*`.",
+      "properties": {
+        "pty": {
+          "description": "`process/start` accepts `pty`.",
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "ProcessId": {
+      "description": "`processId`: caller-chosen handle of a process on one daemon.",
+      "maxLength": 128,
+      "minLength": 1,
+      "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$",
+      "type": "string"
+    },
+    "ProcessLimits": {
+      "additionalProperties": false,
+      "description": "Ceilings of `process/*`.",
+      "properties": {
+        "maxExitedRetainedBytes": {
+          "description": "Output retained across all exited processes; beyond it the oldest\nare evicted early.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxInputQueueBytes": {
+          "description": "Bytes queued for a process's input before `process/write` accepts\nfewer than it was sent.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxReadBytes": {
+          "description": "Largest `maxBytes` of one `process/read`.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxRetainedOutputBytes": {
+          "description": "Output a process retains; beyond it the oldest delivered bytes are\nreleased (`expired` gaps), then the undelivered middle (`overflow`\ngaps).",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "retentionAfterExitMs": {
+          "description": "How long an exited process stays readable after a read first\nreturned its settled exit with nothing left unread.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "terminateGraceMs": {
+          "description": "Grace between `SIGTERM` and `SIGKILL` for `terminate` and timeouts.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "unreadRetentionMs": {
+          "description": "How long an exited process whose output was never fully read stays\nreadable.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "required": [
+        "maxReadBytes",
+        "maxRetainedOutputBytes",
+        "retentionAfterExitMs",
+        "unreadRetentionMs",
+        "maxExitedRetainedBytes",
+        "terminateGraceMs",
+        "maxInputQueueBytes"
+      ],
+      "type": "object"
+    },
+    "ProcessSignal": {
+      "description": "Signal delivered by `process/terminate`.",
+      "oneOf": [
+        {
+          "const": "interrupt",
+          "description": "`SIGINT` to the foreground process group (the terminal's under a\nPTY, otherwise the process group). Records nothing; the next read\nshows what the process did.",
+          "type": "string"
+        },
+        {
+          "const": "terminate",
+          "description": "`SIGTERM` to the group, then `SIGKILL` after\n`limits.process.terminateGraceMs` if members remain. Records\n`stoppedBy: terminate`.",
+          "type": "string"
+        },
+        {
+          "const": "kill",
+          "description": "`SIGKILL` to the group. Records `stoppedBy: kill`.",
+          "type": "string"
+        }
+      ]
+    },
+    "ProtocolError": {
+      "additionalProperties": false,
+      "description": "A protocol error: one kind, its typed data and a message.\n\nSerializes as an `ErrorObject`. Displays as `{kind}: {message}`.",
+      "properties": {
+        "code": {
+          "description": "Fixed by `data.kind`; see `ProtocolErrorKind::code`.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "data": {
+          "$ref": "#/definitions/ErrorData"
+        },
+        "message": {
+          "description": "Human-readable description. Never parsed.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "code",
+        "message",
+        "data"
+      ],
+      "type": "object"
+    },
+    "PtySize": {
+      "additionalProperties": false,
+      "description": "Terminal size of a PTY. Each dimension is 1 to 4096.",
+      "properties": {
+        "cols": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "rows": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "required": [
+        "rows",
+        "cols"
+      ],
+      "type": "object"
+    },
+    "QueueKey": {
+      "description": "`queueKey`: jobs sharing a key run one at a time, in start order.",
+      "maxLength": 128,
+      "minLength": 1,
+      "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$",
+      "type": "string"
+    },
+    "ReadDirectoryParams": {
+      "additionalProperties": false,
+      "description": "`fs/readDirectory` params. Pages in name order.",
+      "properties": {
+        "cursor": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/DirectoryCursor"
+            }
+          ],
+          "description": "`nextCursor` of the previous page; a cursor this daemon did not mint\nis `invalidParams`."
+        },
+        "limit": {
+          "description": "Most entries per page, 1 to `limits.filesystem.maxDirectoryEntries`.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "path": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/EnvironmentPath"
+            }
+          ],
+          "description": "A directory, or a symlink to one inside the root."
+        }
+      },
+      "required": [
+        "path",
+        "limit"
+      ],
+      "type": "object"
+    },
+    "ReadDirectoryResponse": {
+      "additionalProperties": false,
+      "description": "`fs/readDirectory` response.",
+      "properties": {
+        "entries": {
+          "items": {
+            "$ref": "#/definitions/DirectoryEntry"
+          },
+          "type": "array"
+        },
+        "nextCursor": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/DirectoryCursor"
+            }
+          ],
+          "description": "Opaque cursor of the next page; absent on the last page."
+        },
+        "skippedEntryCount": {
+          "description": "Entries in this page's range skipped because their names are not\nUTF-8. Entries that vanish while the page is built are left out and\nnot counted.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "type": "object"
+    },
+    "ReadFileParams": {
+      "additionalProperties": false,
+      "description": "`fs/readFile` params. Reads a regular file only; anything else is\n`failedPrecondition` (`notRegularFile`) and is never opened for a\nblocking read.",
+      "properties": {
+        "maxBytes": {
+          "description": "Most bytes to return, at most `limits.filesystem.maxReadFileBytes`.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "offset": {
+          "description": "First byte to return; 0 by default.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "path": {
+          "$ref": "#/definitions/EnvironmentPath"
+        }
+      },
+      "required": [
+        "path",
+        "maxBytes"
+      ],
+      "type": "object"
+    },
+    "ReadFileResponse": {
+      "additionalProperties": false,
+      "description": "`fs/readFile` response.",
+      "properties": {
+        "data": {
+          "$ref": "#/definitions/ByteChunk"
+        },
+        "fileSize": {
+          "description": "Size of the whole file when it was read.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "truncated": {
+          "description": "Bytes exist after `offset` plus the length of `data`.",
+          "type": "boolean"
+        },
+        "version": {
+          "$ref": "#/definitions/FileVersion"
+        }
+      },
+      "required": [
+        "data",
+        "fileSize",
+        "version"
+      ],
+      "type": "object"
+    },
+    "ReadJobsParams": {
+      "additionalProperties": false,
+      "description": "`job/read` params.",
+      "properties": {
+        "jobs": {
+          "description": "1 to `limits.job.maxRequestJobs` entries, each with its own position.",
+          "items": {
+            "$ref": "#/definitions/JobReadRequest"
+          },
+          "type": "array"
+        },
+        "maxBytes": {
+          "description": "Most `data` bytes across all entries, at most\n`limits.job.maxReadBytes`, filled in request order: an entry reached\nafter the budget is spent returns its summary and an empty page at\nits start position. 0 reads only summaries.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "returnOn": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/ReturnOn"
+            }
+          ],
+          "description": "`anyOutput`: return when any entry has output past its position or\nchanged status; `exit`: when every entry is terminal; `window`: wait\nthe whole window."
+        },
+        "waitMs": {
+          "description": "How long to wait, at most `limits.maxWaitMs`. 0 polls.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "required": [
+        "jobs",
+        "maxBytes",
+        "waitMs",
+        "returnOn"
+      ],
+      "type": "object"
+    },
+    "ReadJobsResponse": {
+      "additionalProperties": false,
+      "description": "`job/read` response: one entry per requested job, in request order.",
+      "properties": {
+        "jobs": {
+          "description": "Never empty.",
+          "items": {
+            "$ref": "#/definitions/JobReadEntry"
+          },
+          "type": "array"
+        }
+      },
+      "required": [
+        "jobs"
+      ],
+      "type": "object"
+    },
+    "ReadProcessParams": {
+      "additionalProperties": false,
+      "description": "`process/read` params.",
+      "properties": {
+        "ack": {
+          "description": "Acknowledge every byte before this offset first: the cursor moves to\nit (never backwards) whether or not this read's response arrives. A\ncaller that tracks positions reads with `after` and acknowledges\nwith `ack` for exactly-once delivery.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "after": {
+          "description": "Start offset. Absent: the daemon cursor, which this read advances to\n`next` once its response is written. Present: a non-consuming read\nthat leaves the cursor alone.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxBytes": {
+          "description": "Most `data` bytes to return, at most `limits.process.maxReadBytes`.\n0 reads only the state.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "processId": {
+          "$ref": "#/definitions/ProcessId"
+        },
+        "returnOn": {
+          "$ref": "#/definitions/ReturnOn"
+        },
+        "tailBytes": {
+          "description": "Start at `end - tailBytes` instead (clamped at 0). Non-consuming;\nexcludes `after`.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "waitMs": {
+          "description": "How long to wait, at most `limits.maxWaitMs`. 0 polls.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "required": [
+        "processId",
+        "maxBytes",
+        "waitMs",
+        "returnOn"
+      ],
+      "type": "object"
+    },
+    "ReadProcessResponse": {
+      "additionalProperties": false,
+      "description": "`process/read` response.",
+      "properties": {
+        "error": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/ProtocolError"
+            }
+          ],
+          "description": "Infrastructure failure after start (output capture or wait failed)."
+        },
+        "exit": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/ExitStatus"
+            }
+          ],
+          "description": "How the root ended; present once `state` is `exited`, unless `error`\nexplains why it could not be observed."
+        },
+        "leftovers": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/LeftoverReport"
+            }
+          ],
+          "description": "Group members alive after the root exited (`disposition: kept`),\nsampled when this response was built. Absent while running, when\nnone remain, and on platforms without process enumeration."
+        },
+        "output": {
+          "$ref": "#/definitions/OutputPage"
+        },
+        "pid": {
+          "description": "OS pid of the root process.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "state": {
+          "$ref": "#/definitions/ExecState"
+        },
+        "stoppedBy": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/StoppedBy"
+            }
+          ],
+          "description": "Set when the daemon stopped the process; absent on a natural exit."
+        }
+      },
+      "required": [
+        "output",
+        "state",
+        "pid"
+      ],
+      "type": "object"
+    },
+    "ReadTransferContentParams": {
+      "additionalProperties": false,
+      "description": "`transfer/read` params: read a captured file's content by digest.",
+      "properties": {
+        "digest": {
+          "$ref": "#/definitions/ContentDigest"
+        },
+        "maxBytes": {
+          "description": "1 to `limits.filesystem.transfer.maxContentChunkBytes`.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "offset": {
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "operationId": {
+          "$ref": "#/definitions/TransferOperationId"
+        }
+      },
+      "required": [
+        "operationId",
+        "digest",
+        "offset",
+        "maxBytes"
+      ],
+      "type": "object"
+    },
+    "ReadTransferContentResponse": {
+      "additionalProperties": false,
+      "description": "`transfer/read` response.",
+      "properties": {
+        "data": {
+          "$ref": "#/definitions/ByteChunk"
+        },
+        "truncated": {
+          "description": "Bytes exist after `offset` plus the length of `data`, as for\n`fs/readFile`.",
+          "type": "boolean"
+        }
+      },
+      "required": [
+        "data"
+      ],
+      "type": "object"
+    },
+    "ReadTransferInventoryParams": {
+      "additionalProperties": false,
+      "description": "`transfer/readInventory` params: page a sealed inventory by index.",
+      "properties": {
+        "index": {
+          "description": "Index of the first entry.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "limit": {
+          "description": "1 to `limits.filesystem.transfer.maxInventoryPageEntries`.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "operationId": {
+          "$ref": "#/definitions/TransferOperationId"
+        }
+      },
+      "required": [
+        "operationId",
+        "index",
+        "limit"
+      ],
+      "type": "object"
+    },
+    "ReadTransferInventoryResponse": {
+      "additionalProperties": false,
+      "description": "`transfer/readInventory` response.",
+      "properties": {
+        "entries": {
+          "items": {
+            "$ref": "#/definitions/InventoryEntry"
+          },
+          "type": "array"
+        },
+        "nextIndex": {
+          "description": "Index of the next page; absent after the last entry.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "type": "object"
+    },
+    "RemoveParams": {
+      "additionalProperties": false,
+      "description": "`fs/remove` params.",
+      "properties": {
+        "force": {
+          "description": "Succeed when the path does not exist.",
+          "type": "boolean"
+        },
+        "path": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/EnvironmentPath"
+            }
+          ],
+          "description": "A symlink is removed, never followed."
+        },
+        "recursive": {
+          "description": "Remove a directory and its contents.",
+          "type": "boolean"
+        }
+      },
+      "required": [
+        "path"
+      ],
+      "type": "object"
+    },
+    "RemoveResponse": {
+      "additionalProperties": false,
+      "description": "`fs/remove` response.",
+      "type": "object"
+    },
+    "RenameParams": {
+      "additionalProperties": false,
+      "description": "`fs/rename` params. Atomic within one filesystem; across filesystems it\nis `failedPrecondition` (`crossDevice`). The entry keeps its mode.",
+      "properties": {
+        "destination": {
+          "$ref": "#/definitions/EnvironmentPath"
+        },
+        "ifMatch": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/FileVersion"
+            }
+          ],
+          "description": "Rename only when the source's version equals this token."
+        },
+        "overwrite": {
+          "description": "Replace an existing destination file; otherwise an existing\ndestination is `alreadyExists`. A directory destination is never\nreplaced.",
+          "type": "boolean"
+        },
+        "source": {
+          "$ref": "#/definitions/EnvironmentPath"
+        }
+      },
+      "required": [
+        "source",
+        "destination"
+      ],
+      "type": "object"
+    },
+    "RenameResponse": {
+      "additionalProperties": false,
+      "description": "`fs/rename` response.",
+      "type": "object"
+    },
+    "ReturnOn": {
+      "description": "When a waiting read returns. Every mode also returns when `waitMs`\nelapses, when the handle reaches a settled exit, or at once when there\nis nothing left to wait for.",
+      "oneOf": [
+        {
+          "const": "window",
+          "description": "Collect for the whole window; return early only when unread output\nreaches `maxBytes`.",
+          "type": "string"
+        },
+        {
+          "const": "anyOutput",
+          "description": "Return as soon as any output past the start position exists.",
+          "type": "string"
+        },
+        {
+          "const": "exit",
+          "description": "Return only at the settled exit (for `job/read`: once every entry is\nterminal), even if more than `maxBytes` of output accumulates.",
+          "type": "string"
+        }
+      ]
+    },
+    "ScanCeilings": {
+      "additionalProperties": false,
+      "description": "Ceilings of `fs/scan`: root and pattern counts, then its quotas.",
+      "properties": {
+        "maxDurationMs": {
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxEntries": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxFileBytes": {
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxPatterns": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxRoots": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxTotalBytes": {
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "required": [
+        "maxRoots",
+        "maxPatterns",
+        "maxEntries",
+        "maxFileBytes",
+        "maxTotalBytes",
+        "maxDurationMs"
+      ],
+      "type": "object"
+    },
+    "ScanEntry": {
+      "additionalProperties": false,
+      "description": "One selected entry below a root.",
+      "properties": {
+        "content": {
+          "$ref": "#/definitions/TreeContent"
+        },
+        "data": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/ByteChunk"
+            }
+          ],
+          "description": "The file's bytes when `readContent` was set."
+        },
+        "path": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/TreePath"
+            }
+          ],
+          "description": "Relative to the root as requested."
+        }
+      },
+      "required": [
+        "path",
+        "content"
+      ],
+      "type": "object"
+    },
+    "ScanFingerprint": {
+      "description": "Opaque fingerprint of one root's selection, prefixed `scan:v1:`, at most\n255 bytes without control characters.",
+      "maxLength": 255,
+      "minLength": 9,
+      "pattern": "^scan:v1:[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+      "type": "string"
+    },
+    "ScanLimits": {
+      "additionalProperties": false,
+      "description": "Caller quotas of one scan.",
+      "properties": {
+        "maxDurationMs": {
+          "description": "Walk time per root; exhausting it fails that root\n(`deadlineExceeded`).",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxEntries": {
+          "description": "Selected entries per root; more fail that root (`payloadTooLarge`\nwith `limitEntries`).",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxFileBytes": {
+          "description": "Larger selected files are skipped (`fileTooLarge`).",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxTotalBytes": {
+          "description": "Content bytes returned across all roots, in root order: a root whose\ncontent would exceed the rest fails (`payloadTooLarge` with\n`limitBytes`) and later roots are still scanned. Independently, a\nroot whose encoded result (entries, skips and base64 content) would\npush the scan's results past\n`MAX_RESULT_BYTES` fails the same\nway.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "required": [
+        "maxEntries",
+        "maxFileBytes",
+        "maxTotalBytes",
+        "maxDurationMs"
+      ],
+      "type": "object"
+    },
+    "ScanParams": {
+      "additionalProperties": false,
+      "description": "`fs/scan` params.",
+      "properties": {
+        "filter": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/TreeFilter"
+            }
+          ],
+          "description": "Applied below every root; at most `limits.filesystem.scan.maxPatterns`\npatterns in total."
+        },
+        "followSymlinks": {
+          "description": "Follow symlinks whose targets stay inside the filesystem root; others\nare skipped (`symlinkOutsideRoot`). Without it symlinks are skipped\n(`symlink`).",
+          "type": "boolean"
+        },
+        "includeDigests": {
+          "description": "Return each selected file's `digest`.",
+          "type": "boolean"
+        },
+        "limits": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/ScanLimits"
+            }
+          ],
+          "description": "Caller quotas; each at most its ceiling."
+        },
+        "readContent": {
+          "description": "Return the bytes of every selected file in `data`.",
+          "type": "boolean"
+        },
+        "roots": {
+          "description": "1 to `limits.filesystem.scan.maxRoots` roots.",
+          "items": {
+            "$ref": "#/definitions/ScanRoot"
+          },
+          "type": "array"
+        }
+      },
+      "required": [
+        "roots",
+        "limits"
+      ],
+      "type": "object"
+    },
+    "ScanResponse": {
+      "additionalProperties": false,
+      "description": "`fs/scan` response: one result per requested root, in request order.",
+      "properties": {
+        "roots": {
+          "description": "Never empty.",
+          "items": {
+            "$ref": "#/definitions/ScanRootResult"
+          },
+          "type": "array"
+        }
+      },
+      "required": [
+        "roots"
+      ],
+      "type": "object"
+    },
+    "ScanRoot": {
+      "additionalProperties": false,
+      "description": "One root of a scan.",
+      "properties": {
+        "ifNoneMatch": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/ScanFingerprint"
+            }
+          ],
+          "description": "The root's previous `fingerprint`: when the selection is unchanged\nthe result is `unchanged` and carries no entries."
+        },
+        "maxDepth": {
+          "description": "Overrides `filter.maxDepth` for this root. `0` examines only the\nroot itself: a `complete` result without entries proves it is an\nexisting directory, which is how discovery checks a working\ndirectory in the same call.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "path": {
+          "$ref": "#/definitions/EnvironmentPath"
+        }
+      },
+      "required": [
+        "path"
+      ],
+      "type": "object"
+    },
+    "ScanRootResult": {
+      "description": "The outcome of one root.",
+      "oneOf": [
+        {
+          "additionalProperties": false,
+          "description": "Every selected entry, plus what was skipped and why.",
+          "properties": {
+            "canonicalPath": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/EnvironmentPath"
+                }
+              ],
+              "description": "Resolved absolute path of the root when it differs from `path`\n(the root is a symlink)."
+            },
+            "entries": {
+              "items": {
+                "$ref": "#/definitions/ScanEntry"
+              },
+              "type": "array"
+            },
+            "fingerprint": {
+              "$ref": "#/definitions/ScanFingerprint"
+            },
+            "kind": {
+              "const": "complete",
+              "type": "string"
+            },
+            "path": {
+              "$ref": "#/definitions/EnvironmentPath"
+            },
+            "skipped": {
+              "description": "The first\n`MAX_LISTED_SKIPS` skipped\nentries, in walk order.",
+              "items": {
+                "$ref": "#/definitions/ScanSkip"
+              },
+              "type": "array"
+            },
+            "skippedEntryCount": {
+              "description": "Total number of skipped entries, listed or not; present whenever\nit is not zero.",
+              "format": "uint32",
+              "minimum": 0,
+              "type": "integer"
+            }
+          },
+          "required": [
+            "kind",
+            "path",
+            "fingerprint"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "description": "The selection matches `ifNoneMatch`.",
+          "properties": {
+            "fingerprint": {
+              "$ref": "#/definitions/ScanFingerprint"
+            },
+            "kind": {
+              "const": "unchanged",
+              "type": "string"
+            },
+            "path": {
+              "$ref": "#/definitions/EnvironmentPath"
+            }
+          },
+          "required": [
+            "kind",
+            "path",
+            "fingerprint"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "description": "The root does not exist.",
+          "properties": {
+            "kind": {
+              "const": "missing",
+              "type": "string"
+            },
+            "path": {
+              "$ref": "#/definitions/EnvironmentPath"
+            }
+          },
+          "required": [
+            "kind",
+            "path"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "description": "The root could not be scanned; no entries are returned for it.",
+          "properties": {
+            "error": {
+              "$ref": "#/definitions/ProtocolError"
+            },
+            "kind": {
+              "const": "failed",
+              "type": "string"
+            },
+            "path": {
+              "$ref": "#/definitions/EnvironmentPath"
+            }
+          },
+          "required": [
+            "kind",
+            "path",
+            "error"
+          ],
+          "type": "object"
+        }
+      ]
+    },
+    "ScanSkip": {
+      "additionalProperties": false,
+      "description": "An entry a scan left out.",
+      "properties": {
+        "path": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/TreePath"
+            }
+          ],
+          "description": "Absent when the entry's name is not UTF-8."
+        },
+        "reason": {
+          "$ref": "#/definitions/ScanSkipReason"
+        }
+      },
+      "required": [
+        "reason"
+      ],
+      "type": "object"
+    },
+    "ScanSkipReason": {
+      "description": "Why a scan left an entry out.",
+      "oneOf": [
+        {
+          "const": "fileTooLarge",
+          "description": "Larger than `maxFileBytes`.",
+          "type": "string"
+        },
+        {
+          "const": "symlink",
+          "description": "A symlink, and `followSymlinks` is not set.",
+          "type": "string"
+        },
+        {
+          "const": "symlinkOutsideRoot",
+          "description": "A symlink whose target leaves the filesystem root, or a link cycle.",
+          "type": "string"
+        },
+        {
+          "const": "specialFile",
+          "description": "A device, FIFO, socket or another special file.",
+          "type": "string"
+        },
+        {
+          "const": "nonUtf8Name",
+          "description": "The name is not UTF-8.",
+          "type": "string"
+        },
+        {
+          "const": "unreadable",
+          "description": "The entry vanished or could not be read during the walk.",
+          "type": "string"
+        }
+      ]
+    },
+    "SearchCeilings": {
+      "additionalProperties": false,
+      "description": "Ceilings of `fs/searchText` quotas, field for field.",
+      "properties": {
+        "maxBytes": {
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxDurationMs": {
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxFiles": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxLineBytes": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxMatches": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "required": [
+        "maxMatches",
+        "maxFiles",
+        "maxBytes",
+        "maxDurationMs",
+        "maxLineBytes"
+      ],
+      "type": "object"
+    },
+    "SearchTextLimits": {
+      "additionalProperties": false,
+      "description": "Caller quotas of one search; each at most its advertised ceiling.",
+      "properties": {
+        "maxBytes": {
+          "description": "Bytes actually read across files.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxDurationMs": {
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxFiles": {
+          "description": "Files searched, not merely visited.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxLineBytes": {
+          "description": "Longer matching lines are cut and marked `lineTruncated`.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxMatches": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "required": [
+        "maxMatches",
+        "maxFiles",
+        "maxBytes",
+        "maxDurationMs",
+        "maxLineBytes"
+      ],
+      "type": "object"
+    },
+    "SearchTextMatch": {
+      "additionalProperties": false,
+      "description": "One matching line.",
+      "properties": {
+        "line": {
+          "description": "The matching line without its terminator, cut at `maxLineBytes` on a\ncharacter boundary.",
+          "type": "string"
+        },
+        "lineNumber": {
+          "description": "1-based.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "lineTruncated": {
+          "type": "boolean"
+        },
+        "path": {
+          "$ref": "#/definitions/EnvironmentPath"
+        }
+      },
+      "required": [
+        "path",
+        "lineNumber",
+        "line"
+      ],
+      "type": "object"
+    },
+    "SearchTextParams": {
+      "additionalProperties": false,
+      "description": "`fs/searchText` params: a bounded recursive regex search run by the\ndaemon. A file larger than the remaining byte budget is skipped and\ncounted; it never ends the walk.",
+      "properties": {
+        "filter": {
+          "$ref": "#/definitions/TreeFilter"
+        },
+        "limits": {
+          "$ref": "#/definitions/SearchTextLimits"
+        },
+        "pattern": {
+          "description": "Regular expression in the Rust `regex` crate's syntax, matched per\nline.",
+          "type": "string"
+        },
+        "patternIgnoreCase": {
+          "description": "Match `pattern` case-insensitively. `filter.ignoreCase` governs the\npath patterns instead.",
+          "type": "boolean"
+        },
+        "root": {
+          "$ref": "#/definitions/EnvironmentPath"
+        }
+      },
+      "required": [
+        "root",
+        "pattern",
+        "limits"
+      ],
+      "type": "object"
+    },
+    "SearchTextResponse": {
+      "additionalProperties": false,
+      "description": "`fs/searchText` response.",
+      "properties": {
+        "elapsedMs": {
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "matches": {
+          "items": {
+            "$ref": "#/definitions/SearchTextMatch"
+          },
+          "type": "array"
+        },
+        "searchedBytes": {
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "searchedFileCount": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "skippedEntryCount": {
+          "description": "Entries the walk could not represent or list: names that are not\nUTF-8 and directories that could not be read.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "skippedFileCount": {
+          "description": "Files skipped because they exceeded the remaining byte budget, are\nbinary or could not be read.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "stopped": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/SearchTextStop"
+            }
+          ],
+          "description": "Absent when the walk finished within its limits."
+        }
+      },
+      "required": [
+        "searchedFileCount",
+        "searchedBytes",
+        "elapsedMs"
+      ],
+      "type": "object"
+    },
+    "SearchTextStop": {
+      "description": "Why a search stopped before finishing its walk.",
+      "oneOf": [
+        {
+          "const": "matchLimit",
+          "description": "`maxMatches` matches were found.",
+          "type": "string"
+        },
+        {
+          "const": "fileLimit",
+          "description": "`maxFiles` files were searched.",
+          "type": "string"
+        },
+        {
+          "const": "byteLimit",
+          "description": "`maxBytes` bytes were read.",
+          "type": "string"
+        },
+        {
+          "const": "timeLimit",
+          "description": "`maxDurationMs` ran out.",
+          "type": "string"
+        },
+        {
+          "const": "responseLimit",
+          "description": "The next match would push the encoded matches past\n`MAX_RESULT_BYTES`.",
+          "type": "string"
+        }
+      ]
+    },
+    "SecretString": {
+      "description": "A secret value carried on the wire, such as a `secretEnv` value, a\nregistration key or a stream token. It serializes as a plain string;\n`Debug` is redacted so structured logging never prints it.",
+      "type": "string"
+    },
+    "SignalName": {
+      "description": "A POSIX signal name such as `SIGSEGV` or `SIGRTMIN+3`: `SIG` followed by\n1 to 16 uppercase letters, digits or `+`. Names, not numbers, because\nnumbers differ between platforms.",
+      "pattern": "^SIG[A-Z0-9+]{1,16}$",
+      "type": "string"
+    },
+    "SpecialFilePolicy": {
+      "description": "Devices, FIFOs and sockets met during a capture.",
+      "oneOf": [
+        {
+          "const": "reject",
+          "description": "Fail the operation (`notRegularFile`).",
+          "type": "string"
+        },
+        {
+          "const": "skip",
+          "description": "Leave them out and report them in `skipped`.",
+          "type": "string"
+        }
+      ]
+    },
+    "StartJobsParams": {
+      "additionalProperties": false,
+      "description": "`job/start` params. All-or-nothing: either every job is accepted (or\nreplayed) or none is.",
+      "properties": {
+        "jobs": {
+          "description": "1 to `limits.job.maxRequestJobs` jobs.",
+          "items": {
+            "$ref": "#/definitions/JobSpec"
+          },
+          "type": "array"
+        },
+        "requestId": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/JobRequestId"
+            }
+          ],
+          "description": "Idempotency key of this start. Retrying with the same request id and\nidentical jobs replays the existing jobs; reusing a job id with\nanother request id or spec is `failedPrecondition` (`jobIdInUse`)."
+        }
+      },
+      "required": [
+        "requestId",
+        "jobs"
+      ],
+      "type": "object"
+    },
+    "StartJobsResponse": {
+      "additionalProperties": false,
+      "description": "`job/start` response: one summary per requested job, in request order.",
+      "properties": {
+        "jobs": {
+          "description": "Never empty.",
+          "items": {
+            "$ref": "#/definitions/JobSummary"
+          },
+          "type": "array"
+        }
+      },
+      "required": [
+        "jobs"
+      ],
+      "type": "object"
+    },
+    "StartProcessParams": {
+      "additionalProperties": false,
+      "description": "`process/start` params.",
+      "properties": {
+        "command": {
+          "$ref": "#/definitions/CommandSpec"
+        },
+        "processId": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/ProcessId"
+            }
+          ],
+          "description": "Caller-chosen handle, reserved before any side effect: a start whose\nid is already in use (running, retained or remembered by a tombstone)\nis `alreadyExists` and runs nothing."
+        },
+        "pty": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/PtySize"
+            }
+          ],
+          "description": "Run under a PTY of this size. The PTY master is the input: `input`\nmust then be `none` or `bytes`, and `process/write` is always\naccepted while the process runs. Requires\n`capabilities.process.pty`."
+        }
+      },
+      "required": [
+        "processId",
+        "command"
+      ],
+      "type": "object"
+    },
+    "StartProcessResponse": {
+      "additionalProperties": false,
+      "description": "`process/start` response, sent once the process runs.",
+      "properties": {
+        "pid": {
+          "description": "OS pid of the root process, which is also its process group id.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "required": [
+        "pid"
+      ],
+      "type": "object"
+    },
+    "StoppedBy": {
+      "description": "Why the daemon stopped a process or job that did not exit on its own.\nSet only when the daemon signalled a root that was still running.",
+      "oneOf": [
+        {
+          "const": "timeout",
+          "description": "`timeoutMs` expired: `SIGTERM`, the grace, then `SIGKILL`.",
+          "type": "string"
+        },
+        {
+          "const": "terminate",
+          "description": "`process/terminate` with `terminate`, or `job/cancel` without\n`force`: `SIGTERM`, the grace, then `SIGKILL`.",
+          "type": "string"
+        },
+        {
+          "const": "kill",
+          "description": "`process/terminate` with `kill`, or `job/cancel` with `force`:\n`SIGKILL` at once.",
+          "type": "string"
+        }
+      ]
+    },
+    "SymlinkPolicy": {
+      "description": "Symlinks met during a capture.",
+      "oneOf": [
+        {
+          "const": "expandInside",
+          "description": "Capture a link whose target stays inside the selection as the entry\nit points to; a link leaving the selection or a cycle fails the\noperation (`symlinkRejected`). A dangling link inside the selection\nis left out and reported in `skipped` as `symlink`.",
+          "type": "string"
+        },
+        {
+          "const": "skip",
+          "description": "Leave every link out and report it in `skipped`.",
+          "type": "string"
+        },
+        {
+          "const": "reject",
+          "description": "Fail on the first link.",
+          "type": "string"
+        }
+      ]
+    },
+    "TerminateProcessParams": {
+      "additionalProperties": false,
+      "description": "`process/terminate` params.",
+      "properties": {
+        "processId": {
+          "$ref": "#/definitions/ProcessId"
+        },
+        "signal": {
+          "$ref": "#/definitions/ProcessSignal"
+        }
+      },
+      "required": [
+        "processId",
+        "signal"
+      ],
+      "type": "object"
+    },
+    "TerminateProcessResponse": {
+      "additionalProperties": false,
+      "description": "`process/terminate` response, sent once the signal was delivered (any\nescalation continues in the background).",
+      "properties": {
+        "running": {
+          "description": "True when the root process was still running when the signal was\nsent.",
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "TransferCeilings": {
+      "additionalProperties": false,
+      "description": "Ceilings of `transfer/*`: capacity, page and chunk sizes, receipt\nretention, then the per-operation quotas.",
+      "properties": {
+        "maxActiveOperations": {
+          "description": "Operations not yet complete, aborted or failed, across connections;\na begin beyond it is `busy` (`transferCapacity`).",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxContentChunkBytes": {
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxDepth": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxDurationMs": {
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxEntries": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxFileBytes": {
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxInventoryPageEntries": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxManifestBytes": {
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxTotalBytes": {
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "receiptRetentionMs": {
+          "description": "How long a finished operation's receipt is answered.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "required": [
+        "maxActiveOperations",
+        "maxContentChunkBytes",
+        "maxInventoryPageEntries",
+        "receiptRetentionMs",
+        "maxEntries",
+        "maxDepth",
+        "maxFileBytes",
+        "maxTotalBytes",
+        "maxManifestBytes",
+        "maxDurationMs"
+      ],
+      "type": "object"
+    },
+    "TransferLimits": {
+      "additionalProperties": false,
+      "description": "Caller quotas of one operation; each at most its advertised ceiling.",
+      "properties": {
+        "maxDepth": {
+          "description": "The selected root has depth 0.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxDurationMs": {
+          "description": "From begin to commit.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxEntries": {
+          "description": "Entries, the selected root included.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxFileBytes": {
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxManifestBytes": {
+          "description": "Encoded inventory size.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "maxTotalBytes": {
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "required": [
+        "maxEntries",
+        "maxDepth",
+        "maxFileBytes",
+        "maxTotalBytes",
+        "maxManifestBytes",
+        "maxDurationMs"
+      ],
+      "type": "object"
+    },
+    "TransferOnExisting": {
+      "description": "What a materialize does with an existing destination.",
+      "oneOf": [
+        {
+          "const": "error",
+          "description": "Refuse at begin (`alreadyExists`).",
+          "type": "string"
+        },
+        {
+          "const": "replace",
+          "description": "Replace it atomically at commit.",
+          "type": "string"
+        }
+      ]
+    },
+    "TransferOperationId": {
+      "description": "`operationId` of one transfer operation.",
+      "maxLength": 128,
+      "minLength": 1,
+      "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$",
+      "type": "string"
+    },
+    "TransferOperationParams": {
+      "additionalProperties": false,
+      "description": "Params of `transfer/advance`, `transfer/getStatus`, `transfer/commit`\nand `transfer/abort`: each names only the operation.",
+      "properties": {
+        "operationId": {
+          "$ref": "#/definitions/TransferOperationId"
+        }
+      },
+      "required": [
+        "operationId"
+      ],
+      "type": "object"
+    },
+    "TransferPhase": {
+      "description": "Where an operation stands; see the module docs for the order per\nselection kind.",
+      "oneOf": [
+        {
+          "enum": [
+            "complete",
+            "aborted"
+          ],
+          "type": "string"
+        },
+        {
+          "const": "scanning",
+          "description": "The daemon walks a tree: the capture source, or the destination of a\nmaterialize. Advance until the phase changes.",
+          "type": "string"
+        },
+        {
+          "const": "inventory",
+          "description": "Capture: the inventory is sealed and pageable. Materialize: waiting\nfor appended entries.",
+          "type": "string"
+        },
+        {
+          "const": "content",
+          "description": "Waiting for the content of `transfer/listMissing` digests.",
+          "type": "string"
+        },
+        {
+          "const": "staging",
+          "description": "The daemon assembles the staged tree. Advance until `ready`.",
+          "type": "string"
+        },
+        {
+          "const": "ready",
+          "description": "Ready for `transfer/commit`.",
+          "type": "string"
+        },
+        {
+          "const": "failed",
+          "description": "Stopped by an error; see `error`.",
+          "type": "string"
+        }
+      ]
+    },
+    "TransferSelection": {
+      "description": "What one operation transfers.",
+      "oneOf": [
+        {
+          "additionalProperties": false,
+          "description": "Read a file or tree out of the environment.",
+          "properties": {
+            "filter": {
+              "$ref": "#/definitions/TreeFilter"
+            },
+            "kind": {
+              "const": "capture",
+              "type": "string"
+            },
+            "source": {
+              "$ref": "#/definitions/EnvironmentPath"
+            },
+            "specialFiles": {
+              "$ref": "#/definitions/SpecialFilePolicy"
+            },
+            "symlinks": {
+              "$ref": "#/definitions/SymlinkPolicy"
+            }
+          },
+          "required": [
+            "kind",
+            "source"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "description": "Write a tree into the environment, replacing `destination` atomically\nat commit.",
+          "properties": {
+            "destination": {
+              "$ref": "#/definitions/EnvironmentPath"
+            },
+            "kind": {
+              "const": "materialize",
+              "type": "string"
+            },
+            "onExisting": {
+              "$ref": "#/definitions/TransferOnExisting"
+            }
+          },
+          "required": [
+            "kind",
+            "destination"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "description": "Write exactly one file with `fs/writeFile` semantics: staged,\natomic, an existing target keeps its permissions, an in-root symlink\nat `destination` is followed.",
+          "properties": {
+            "create": {
+              "$ref": "#/definitions/WriteCondition"
+            },
+            "destination": {
+              "$ref": "#/definitions/EnvironmentPath"
+            },
+            "executable": {
+              "type": "boolean"
+            },
+            "ifMatch": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/FileVersion"
+                }
+              ]
+            },
+            "kind": {
+              "const": "writeFile",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind",
+            "destination"
+          ],
+          "type": "object"
+        }
+      ]
+    },
+    "TransferSkip": {
+      "additionalProperties": false,
+      "description": "An entry a capture left out.",
+      "properties": {
+        "path": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/TreePath"
+            }
+          ],
+          "description": "Absent when the entry's name is not UTF-8."
+        },
+        "reason": {
+          "$ref": "#/definitions/TransferSkipReason"
+        }
+      },
+      "required": [
+        "reason"
+      ],
+      "type": "object"
+    },
+    "TransferSkipReason": {
+      "description": "Why a capture left an entry out.",
+      "oneOf": [
+        {
+          "const": "symlink",
+          "description": "`symlinks: skip`, or a dangling link under `symlinks: expandInside`.",
+          "type": "string"
+        },
+        {
+          "const": "specialFile",
+          "description": "`specialFiles: skip`.",
+          "type": "string"
+        },
+        {
+          "const": "nonUtf8Name",
+          "description": "The name is not UTF-8; such entries are always skipped.",
+          "type": "string"
+        }
+      ]
+    },
+    "TransferStatus": {
+      "additionalProperties": false,
+      "description": "The operation's status: the response of `transfer/begin`,\n`transfer/advance`, `transfer/getStatus`, `transfer/append`,\n`transfer/commit` and `transfer/abort`.",
+      "properties": {
+        "deadlineAtMs": {
+          "description": "When `maxDurationMs` runs out for an active operation.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "entryCount": {
+          "description": "Entries in the inventory so far.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "error": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/ProtocolError"
+            }
+          ],
+          "description": "Why the operation failed; present exactly when `phase` is `failed`."
+        },
+        "operationId": {
+          "$ref": "#/definitions/TransferOperationId"
+        },
+        "phase": {
+          "$ref": "#/definitions/TransferPhase"
+        },
+        "receiptExpiresAtMs": {
+          "description": "When the receipt of a finished (complete, aborted or failed)\noperation stops being answered; afterwards calls are `notFound`\n(`expired`).",
+          "format": "int64",
+          "type": "integer"
+        },
+        "reusedBytes": {
+          "description": "Content bytes satisfied from files already at the destination.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "skipped": {
+          "description": "The first\n`MAX_LISTED_SKIPS` entries a\ncapture left out under its policies.",
+          "items": {
+            "$ref": "#/definitions/TransferSkip"
+          },
+          "type": "array"
+        },
+        "skippedEntryCount": {
+          "description": "Total number of entries left out, listed or not; present whenever it\nis not zero.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "totalBytes": {
+          "description": "File bytes in the inventory so far.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "transferredBytes": {
+          "description": "Content bytes moved over the wire.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "required": [
+        "operationId",
+        "phase",
+        "entryCount",
+        "totalBytes",
+        "transferredBytes",
+        "reusedBytes"
+      ],
+      "type": "object"
+    },
+    "TreeContent": {
+      "description": "What a tree entry is: a scan entry or a transfer inventory entry.\nDigests identify raw file bytes, not paths or modes.",
+      "oneOf": [
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "directory",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "digest": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ContentDigest"
+                }
+              ],
+              "description": "Scans: present when `includeDigests` was set. Transfer\ninventories: always present; an appended file entry without it\nis `invalidParams`."
+            },
+            "executable": {
+              "type": "boolean"
+            },
+            "kind": {
+              "const": "file",
+              "type": "string"
+            },
+            "sizeBytes": {
+              "format": "uint64",
+              "minimum": 0,
+              "type": "integer"
+            }
+          },
+          "required": [
+            "kind",
+            "sizeBytes"
+          ],
+          "type": "object"
+        }
+      ]
+    },
+    "TreeFilter": {
+      "additionalProperties": false,
+      "description": "Which entries a walk visits. The default visits everything except\nhidden and ignored entries.",
+      "properties": {
+        "exclude": {
+          "description": "Drop entries matching any pattern; a matching directory is pruned.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "ignoreCase": {
+          "description": "Match patterns case-insensitively.",
+          "type": "boolean"
+        },
+        "include": {
+          "description": "Select entries matching any pattern; empty selects every entry.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "includeHidden": {
+          "description": "Visit entries whose name starts with `.`.",
+          "type": "boolean"
+        },
+        "includeIgnored": {
+          "description": "Visit entries that ignore files exclude.",
+          "type": "boolean"
+        },
+        "maxDepth": {
+          "description": "Deepest entry depth visited: the root's direct children are depth\n1, so `1` selects direct children only. Unbounded when absent.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "type": "object"
+    },
+    "TreePath": {
+      "description": "A relative, normalized path below a selected root: segments joined by\n`/`, without empty, `.` or `..` segments. The single segment `.` names\nthe root itself. At most 4096 bytes. Used for scan, inventory and\ntransfer entries.",
+      "maxLength": 4096,
+      "minLength": 1,
+      "pattern": "^(\\.|(?!\\.\\.?(/|$))[^/\\u0000]+(/(?!\\.\\.?(/|$))[^/\\u0000]+)*)$",
+      "type": "string"
+    },
+    "WriteCondition": {
+      "description": "When `fs/writeFile` may write.",
+      "oneOf": [
+        {
+          "const": "always",
+          "description": "Create or replace.",
+          "type": "string"
+        },
+        {
+          "const": "ifAbsent",
+          "description": "Only create; an existing entry is `failedPrecondition`\n(`createCondition`).",
+          "type": "string"
+        },
+        {
+          "const": "ifPresent",
+          "description": "Only replace; a missing file is `failedPrecondition`\n(`createCondition`).",
+          "type": "string"
+        }
+      ]
+    },
+    "WriteFileParams": {
+      "additionalProperties": false,
+      "description": "`fs/writeFile` params. The write is staged in the target's directory and\npublished by an atomic rename: readers see the old or the new content,\nnever a mix. An existing target keeps its permissions. A symlink at\n`path` whose target stays inside the root is followed like any path: the\nfinal target is replaced and the link itself is kept (a dangling link\ncreates its target, subject to `create`); a link that leaves the root is\n`permissionDenied` (`outsideRoot`). A special file is\n`failedPrecondition` (`notRegularFile`), a directory\n`failedPrecondition` (`isDirectory`). The parent of the final target\nmust exist.",
+      "properties": {
+        "create": {
+          "$ref": "#/definitions/WriteCondition"
+        },
+        "data": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/ByteChunk"
+            }
+          ],
+          "description": "At most `limits.filesystem.maxWriteFileBytes`; larger files go\nthrough `transfer/*` with a `writeFile` selection."
+        },
+        "executable": {
+          "description": "Set the execute bits (the read bits' pattern). Without it a new file\ngets the default mode and an existing file keeps its mode.",
+          "type": "boolean"
+        },
+        "ifMatch": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/FileVersion"
+            }
+          ],
+          "description": "Write only when the current file's version equals this token;\notherwise `failedPrecondition` (`ifMatchFailed`)."
+        },
+        "path": {
+          "$ref": "#/definitions/EnvironmentPath"
+        }
+      },
+      "required": [
+        "path",
+        "data"
+      ],
+      "type": "object"
+    },
+    "WriteFileResponse": {
+      "additionalProperties": false,
+      "description": "`fs/writeFile` response.",
+      "properties": {
+        "version": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/FileVersion"
+            }
+          ],
+          "description": "Version of the written file."
+        }
+      },
+      "required": [
+        "version"
+      ],
+      "type": "object"
+    },
+    "WriteProcessParams": {
+      "additionalProperties": false,
+      "description": "`process/write` params.",
+      "properties": {
+        "closeInput": {
+          "description": "Close the input after `data`: end of file on a pipe, `VEOF` on a\nPTY. Applied only when every byte of `data` was accepted.",
+          "type": "boolean"
+        },
+        "data": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/ByteChunk"
+            }
+          ],
+          "description": "Bytes for the process's input pipe or PTY."
+        },
+        "processId": {
+          "$ref": "#/definitions/ProcessId"
+        }
+      },
+      "required": [
+        "processId"
+      ],
+      "type": "object"
+    },
+    "WriteProcessResponse": {
+      "additionalProperties": false,
+      "description": "`process/write` response.",
+      "properties": {
+        "acceptedBytes": {
+          "description": "Leading bytes of `data` queued to the process's writer. Fewer than\nsent (possibly 0) means the input queue is full: resend the rest\nlater.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "required": [
+        "acceptedBytes"
+      ],
+      "type": "object"
+    },
+    "WriteTransferContentParams": {
+      "additionalProperties": false,
+      "description": "`transfer/write` params: upload content for a missing digest. Chunks for\none digest arrive in order; an identical chunk may be retried.\nDifferent digests may be uploaded concurrently.",
+      "properties": {
+        "data": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/ByteChunk"
+            }
+          ],
+          "description": "At most `limits.filesystem.transfer.maxContentChunkBytes`."
+        },
+        "digest": {
+          "$ref": "#/definitions/ContentDigest"
+        },
+        "offset": {
+          "description": "Must equal the digest's next expected offset.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "operationId": {
+          "$ref": "#/definitions/TransferOperationId"
+        }
+      },
+      "required": [
+        "operationId",
+        "digest",
+        "offset",
+        "data"
+      ],
+      "type": "object"
+    },
+    "WriteTransferContentResponse": {
+      "additionalProperties": false,
+      "description": "`transfer/write` response.",
+      "properties": {
+        "nextOffset": {
+          "description": "The digest's next expected offset; equal to its size once complete\nand verified.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "required": [
+        "nextOffset"
+      ],
+      "type": "object"
+    }
+  },
+  "description": "Every wire type of the data plane, protocol version 3.",
+  "title": "Lightspeed environment data plane"
+}
diff --git a/crates/environment-protocol/contract/registration.openrpc.json b/crates/environment-protocol/contract/registration.openrpc.json
new file mode 100644
index 000000000..e5299c57b
--- /dev/null
+++ b/crates/environment-protocol/contract/registration.openrpc.json
@@ -0,0 +1,1420 @@
+{
+  "components": {
+    "schemas": {
+      "AbortReason": {
+        "description": "Why an operation was `aborted`.",
+        "oneOf": [
+          {
+            "const": "cancelled",
+            "description": "`$/cancelRequest` named the request.",
+            "type": "string"
+          },
+          {
+            "const": "sourceChanged",
+            "description": "A file or directory changed while it was being read.",
+            "type": "string"
+          }
+        ]
+      },
+      "Admission": {
+        "description": "Whether this admission created the environment or rejoined it.",
+        "oneOf": [
+          {
+            "const": "created",
+            "description": "First admission of this daemon identity: a new environment.",
+            "type": "string"
+          },
+          {
+            "const": "reconnected",
+            "description": "A known identity reconnected to its environment.",
+            "type": "string"
+          }
+        ]
+      },
+      "ArtifactSha256": {
+        "description": "`sha256` of a published archive: 64 lowercase hex digits.",
+        "pattern": "^[0-9a-f]{64}$",
+        "type": "string"
+      },
+      "BuildFacts": {
+        "description": "What `lightspeed-envd --print-build` prints, as one JSON object.",
+        "properties": {
+          "gitSha": {
+            "type": "string"
+          },
+          "name": {
+            "description": "Always `lightspeed-envd`.",
+            "type": "string"
+          },
+          "protocolVersion": {
+            "description": "The binary's `ENVD_PROTOCOL_VERSION`.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "target": {
+            "description": "Rust target triple.",
+            "type": "string"
+          },
+          "version": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "name",
+          "version",
+          "gitSha",
+          "target",
+          "protocolVersion"
+        ],
+        "type": "object"
+      },
+      "BusyReason": {
+        "description": "What limit a `busy` request hit.",
+        "oneOf": [
+          {
+            "const": "requestLimit",
+            "description": "The connection's concurrent request limit.",
+            "type": "string"
+          },
+          {
+            "const": "transferCapacity",
+            "description": "The daemon's limit on active transfer operations.",
+            "type": "string"
+          },
+          {
+            "const": "rateLimited",
+            "description": "A rate limit on the caller's identity.",
+            "type": "string"
+          },
+          {
+            "const": "capacityExhausted",
+            "description": "A registration key's limit on active environments.",
+            "type": "string"
+          }
+        ]
+      },
+      "Capability": {
+        "description": "A capability a request needed and the endpoint lacks.",
+        "oneOf": [
+          {
+            "const": "filesystem",
+            "description": "The `filesystem` family.",
+            "type": "string"
+          },
+          {
+            "const": "filesystemWrite",
+            "description": "`capabilities.filesystem.write`: the filesystem is writable.",
+            "type": "string"
+          },
+          {
+            "const": "process",
+            "description": "The `process` family.",
+            "type": "string"
+          },
+          {
+            "const": "processPty",
+            "description": "`capabilities.process.pty`.",
+            "type": "string"
+          },
+          {
+            "const": "job",
+            "description": "The `job` family.",
+            "type": "string"
+          },
+          {
+            "const": "adoptTarget",
+            "description": "The controller's `adoptTarget` capability.",
+            "type": "string"
+          },
+          {
+            "const": "ingress",
+            "description": "The controller's `ingress` capability.",
+            "type": "string"
+          }
+        ]
+      },
+      "ChallengeNonce": {
+        "description": "`nonce`: the gateway's 32 random bytes for one control connection.",
+        "pattern": "^[0-9a-f]{64}$",
+        "type": "string"
+      },
+      "ChallengeParams": {
+        "description": "`registration/challenge` params.\n\n**Frozen.** This is the first frame of every control connection and the\nonly frame a daemon of any version must parse to learn it is stale: it\nonly ever gains fields, is decoded tolerantly (unknown members are\nignored), and a receiver reads `protocolVersion` with\n`challenge_protocol_version` before decoding anything else. The whole\nframe is\n`{\"jsonrpc\":\"2.0\",\"method\":\"registration/challenge\",\"params\":{\"protocolVersion\":N,\"nonce\":\"<64 hex>\"}}`.",
+        "properties": {
+          "nonce": {
+            "$ref": "#/components/schemas/ChallengeNonce"
+          },
+          "protocolVersion": {
+            "description": "The gateway's `ENVD_PROTOCOL_VERSION`.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "protocolVersion",
+          "nonce"
+        ],
+        "type": "object"
+      },
+      "ClosedParams": {
+        "additionalProperties": false,
+        "description": "`registration/closed` params: the gateway ends the session for good and\ncloses the socket after this frame. The daemon exits and does not\nreconnect.",
+        "properties": {
+          "message": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/DescriptiveText"
+              }
+            ]
+          },
+          "reason": {
+            "$ref": "#/components/schemas/ClosedReason"
+          }
+        },
+        "required": [
+          "reason"
+        ],
+        "type": "object"
+      },
+      "ClosedReason": {
+        "description": "Why the gateway ended the session for good.",
+        "oneOf": [
+          {
+            "const": "superseded",
+            "description": "Another process with this daemon identity connected; the newest\nconnection wins and this daemon exits with its own status naming the\nshared identity.",
+            "type": "string"
+          },
+          {
+            "const": "environmentClosed",
+            "description": "The identity's environment was closed; the identity is spent.",
+            "type": "string"
+          }
+        ]
+      },
+      "ControlConnectionId": {
+        "description": "`controlConnectionId` the gateway assigns to one control connection.",
+        "maxLength": 128,
+        "minLength": 1,
+        "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$",
+        "type": "string"
+      },
+      "DaemonId": {
+        "description": "`daemonId` the gateway assigns to an admitted daemon identity.",
+        "maxLength": 128,
+        "minLength": 1,
+        "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$",
+        "type": "string"
+      },
+      "DaemonPublicKey": {
+        "description": "`daemonPublicKey`: a raw Ed25519 public key.",
+        "pattern": "^[0-9a-f]{64}$",
+        "type": "string"
+      },
+      "DescriptiveText": {
+        "description": "A short human-readable text: 1 to 1024 bytes without control characters\nother than line feed and tab. Never parsed.",
+        "maxLength": 1024,
+        "minLength": 1,
+        "pattern": "^[^\\u0000-\\u0008\\u000B-\\u001F\\u007F-\\u009F]+$",
+        "type": "string"
+      },
+      "DiscoveryArtifact": {
+        "description": "One published envd archive.",
+        "properties": {
+          "file": {
+            "description": "Archive file name.",
+            "type": "string"
+          },
+          "sha256": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/ArtifactSha256"
+              }
+            ],
+            "description": "Digest of the archive's bytes."
+          },
+          "url": {
+            "description": "Absolute download URL; absent (or null) when the archive is served\nnext to the document.",
+            "type": "string"
+          }
+        },
+        "required": [
+          "file",
+          "sha256"
+        ],
+        "type": "object"
+      },
+      "DiscoveryDocument": {
+        "description": "The discovery document.",
+        "properties": {
+          "artifacts": {
+            "additionalProperties": {
+              "$ref": "#/components/schemas/DiscoveryArtifact"
+            },
+            "description": "Archives by Rust target triple.",
+            "type": "object"
+          },
+          "builtAtMs": {
+            "format": "int64",
+            "type": "integer"
+          },
+          "channel": {
+            "description": "Release channel, such as `stable` or `snapshot`.",
+            "type": "string"
+          },
+          "gitSha": {
+            "type": "string"
+          },
+          "protocolVersion": {
+            "description": "The published envd's `ENVD_PROTOCOL_VERSION`.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "version": {
+            "description": "Release version of the published envd.",
+            "type": "string"
+          }
+        },
+        "required": [
+          "version",
+          "gitSha",
+          "protocolVersion",
+          "artifacts"
+        ],
+        "type": "object"
+      },
+      "DisplayName": {
+        "description": "A display name: 1 to 128 bytes without control characters.",
+        "maxLength": 128,
+        "minLength": 1,
+        "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+        "type": "string"
+      },
+      "Ed25519Signature": {
+        "description": "`signature`: an Ed25519 signature over\n`signed_registration_message`.",
+        "pattern": "^[0-9a-f]{128}$",
+        "type": "string"
+      },
+      "EnvironmentId": {
+        "description": "`environmentId` of a Lightspeed environment.",
+        "maxLength": 128,
+        "minLength": 1,
+        "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$",
+        "type": "string"
+      },
+      "ErrorData": {
+        "description": "The `data` member of an error object: the kind and its typed fields.\n\nKinds without fields are empty struct variants rather than unit\nvariants: serde does not apply `deny_unknown_fields` to the unit\nvariants of an internally tagged enum, and every kind must refuse\nunknown members.",
+        "oneOf": [
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "parseError",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "invalidRequest",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "methodNotFound",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "ceiling": {
+                "description": "The advertised ceiling the value exceeded.",
+                "format": "uint64",
+                "minimum": 0,
+                "type": "integer"
+              },
+              "field": {
+                "description": "Wire path of the offending field, such as `limits.maxDurationMs`.",
+                "type": "string"
+              },
+              "kind": {
+                "const": "invalidParams",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "notInitialized",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "expected": {
+                "description": "The version of the peer that sent this error.",
+                "format": "uint32",
+                "minimum": 0,
+                "type": "integer"
+              },
+              "kind": {
+                "const": "versionMismatch",
+                "type": "string"
+              },
+              "received": {
+                "description": "The version the requester stated.",
+                "format": "uint32",
+                "minimum": 0,
+                "type": "integer"
+              }
+            },
+            "required": [
+              "kind",
+              "expected",
+              "received"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "notFound",
+                "type": "string"
+              },
+              "reason": {
+                "anyOf": [
+                  {
+                    "$ref": "#/components/schemas/NotFoundReason"
+                  }
+                ]
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "alreadyExists",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "failedPrecondition",
+                "type": "string"
+              },
+              "reason": {
+                "$ref": "#/components/schemas/PreconditionReason"
+              }
+            },
+            "required": [
+              "kind",
+              "reason"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "permissionDenied",
+                "type": "string"
+              },
+              "reason": {
+                "anyOf": [
+                  {
+                    "$ref": "#/components/schemas/PermissionReason"
+                  }
+                ]
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "capability": {
+                "$ref": "#/components/schemas/Capability"
+              },
+              "kind": {
+                "const": "capabilityUnavailable",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind",
+              "capability"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "busy",
+                "type": "string"
+              },
+              "reason": {
+                "anyOf": [
+                  {
+                    "$ref": "#/components/schemas/BusyReason"
+                  }
+                ]
+              },
+              "retryAfterMs": {
+                "description": "Earliest useful retry, when the server knows it.",
+                "format": "uint64",
+                "minimum": 0,
+                "type": "integer"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "deadlineExceeded",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "expired",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "aborted",
+                "type": "string"
+              },
+              "reason": {
+                "anyOf": [
+                  {
+                    "$ref": "#/components/schemas/AbortReason"
+                  }
+                ]
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "payloadTooLarge",
+                "type": "string"
+              },
+              "limitBytes": {
+                "description": "The byte limit the payload exceeded.",
+                "format": "uint64",
+                "minimum": 0,
+                "type": "integer"
+              },
+              "limitEntries": {
+                "description": "The entry-count limit the result exceeded.",
+                "format": "uint32",
+                "minimum": 0,
+                "type": "integer"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "processFailed",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "unavailable",
+                "type": "string"
+              },
+              "retryAfterMs": {
+                "format": "uint64",
+                "minimum": 0,
+                "type": "integer"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "const": "internal",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          }
+        ]
+      },
+      "GoodbyeParams": {
+        "additionalProperties": false,
+        "description": "`registration/goodbye` params: the daemon is stopping deliberately.",
+        "properties": {
+          "reason": {
+            "$ref": "#/components/schemas/GoodbyeReason"
+          }
+        },
+        "required": [
+          "reason"
+        ],
+        "type": "object"
+      },
+      "GoodbyeReason": {
+        "description": "Why the daemon is leaving.",
+        "oneOf": [
+          {
+            "const": "shutdown",
+            "description": "`SIGTERM` or `SIGINT`.",
+            "type": "string"
+          }
+        ]
+      },
+      "ImplementationInfo": {
+        "additionalProperties": false,
+        "description": "What a peer says about its own build: `clientInfo`, `serverInfo` and a\ndaemon's registration `implementation`. Descriptive only; the protocol\nversion alone decides whether two peers can talk, and nothing here\nselects, authenticates or gates. Every field is 1 to 256 bytes without control characters,\nchecked on decode and by every constructor, so a value that would be\nrefused can never be built or sent.",
+        "properties": {
+          "gitSha": {
+            "description": "Full or abbreviated git commit of the build.",
+            "maxLength": 256,
+            "minLength": 1,
+            "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+            "type": "string"
+          },
+          "name": {
+            "description": "Product name, such as `lightspeed-envd`.",
+            "maxLength": 256,
+            "minLength": 1,
+            "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+            "type": "string"
+          },
+          "target": {
+            "description": "Rust target triple of the build.",
+            "maxLength": 256,
+            "minLength": 1,
+            "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+            "type": "string"
+          },
+          "version": {
+            "description": "Release version, such as `0.5.0`.",
+            "maxLength": 256,
+            "minLength": 1,
+            "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+            "type": "string"
+          }
+        },
+        "required": [
+          "name"
+        ],
+        "type": "object"
+      },
+      "IncarnationId": {
+        "description": "`incarnationId` of one incarnation of an environment.",
+        "maxLength": 128,
+        "minLength": 1,
+        "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$",
+        "type": "string"
+      },
+      "Metadata": {
+        "additionalProperties": {
+          "maxLength": 256,
+          "minLength": 1,
+          "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+          "type": "string"
+        },
+        "description": "Descriptive key-value metadata: at most 32 entries, keys 1 to 64 bytes outside the reserved `lightspeed.` prefix, values 1 to 256 bytes, no control characters.",
+        "maxProperties": 32,
+        "propertyNames": {
+          "maxLength": 64,
+          "minLength": 1,
+          "not": {
+            "pattern": "^lightspeed\\."
+          },
+          "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$"
+        },
+        "type": "object"
+      },
+      "NotFoundReason": {
+        "description": "Why a handle, path or identity was not found.",
+        "oneOf": [
+          {
+            "const": "expired",
+            "description": "Its retention window ended; a tombstone remembers it.",
+            "type": "string"
+          },
+          {
+            "const": "daemonRestarted",
+            "description": "It belonged to an earlier daemon instance (see `daemonInstanceId`).",
+            "type": "string"
+          },
+          {
+            "const": "unknownDaemon",
+            "description": "A daemon identity the gateway has never admitted presented no\nregistration key.",
+            "type": "string"
+          }
+        ]
+      },
+      "OpenStreamParams": {
+        "additionalProperties": false,
+        "description": "`registration/openStream` params: the gateway asks the daemon to dial\none stream.",
+        "properties": {
+          "stream": {
+            "$ref": "#/components/schemas/StreamSpec"
+          },
+          "token": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/SecretString"
+              }
+            ],
+            "description": "One-time bearer token for the stream dial; short-lived."
+          }
+        },
+        "required": [
+          "token",
+          "stream"
+        ],
+        "type": "object"
+      },
+      "OpenStreamResponse": {
+        "additionalProperties": false,
+        "description": "`registration/openStream` response, sent once the stream socket is\nupgraded and served. A failed dial answers `unavailable`; the gateway\nfails the waiting route at once.",
+        "type": "object"
+      },
+      "PermissionReason": {
+        "description": "Why a `permissionDenied` request was refused.",
+        "oneOf": [
+          {
+            "const": "outsideRoot",
+            "description": "The path, or a symlink it passes through, resolves outside the\ndaemon's filesystem root.",
+            "type": "string"
+          },
+          {
+            "const": "daemonState",
+            "description": "The path names or contains the daemon's state directory.",
+            "type": "string"
+          },
+          {
+            "const": "filePermission",
+            "description": "The operating system refused access.",
+            "type": "string"
+          },
+          {
+            "const": "invalidSignature",
+            "description": "The registration signature does not verify.",
+            "type": "string"
+          },
+          {
+            "const": "invalidRegistrationKey",
+            "description": "The registration key is unknown.",
+            "type": "string"
+          },
+          {
+            "const": "registrationKeyRevoked",
+            "description": "The registration key was revoked.",
+            "type": "string"
+          }
+        ]
+      },
+      "PreconditionReason": {
+        "description": "The state that forbids a `failedPrecondition` request.",
+        "oneOf": [
+          {
+            "const": "inputClosed",
+            "description": "The process has no open input: started without `pipe` or `pty`,\ninput already closed, or exited.",
+            "type": "string"
+          },
+          {
+            "const": "ifMatchFailed",
+            "description": "The file's current `version` differs from `ifMatch`.",
+            "type": "string"
+          },
+          {
+            "const": "createCondition",
+            "description": "`create: ifAbsent` met an existing file, or `create: ifPresent` a\nmissing one.",
+            "type": "string"
+          },
+          {
+            "const": "notEmpty",
+            "description": "The directory is not empty and `recursive` was not set.",
+            "type": "string"
+          },
+          {
+            "const": "isDirectory",
+            "description": "The path names a directory where a file is required.",
+            "type": "string"
+          },
+          {
+            "const": "notDirectory",
+            "description": "A path component or the path names a non-directory where a directory\nis required.",
+            "type": "string"
+          },
+          {
+            "const": "notRegularFile",
+            "description": "The path names a device, FIFO, socket or other non-regular file.",
+            "type": "string"
+          },
+          {
+            "const": "symlinkLoop",
+            "description": "A symlink chain loops.",
+            "type": "string"
+          },
+          {
+            "const": "symlinkRejected",
+            "description": "A capture met a symlink that leaves the selection, or one the\nselection's symlink policy rejects.",
+            "type": "string"
+          },
+          {
+            "const": "filesystemRoot",
+            "description": "The filesystem root itself cannot be replaced or removed.",
+            "type": "string"
+          },
+          {
+            "const": "crossDevice",
+            "description": "Rename across filesystems.",
+            "type": "string"
+          },
+          {
+            "const": "noSpace",
+            "description": "No space left on the device.",
+            "type": "string"
+          },
+          {
+            "const": "jobIdInUse",
+            "description": "A job id is in use by a job with another `requestId` or spec; choose\na new job id.",
+            "type": "string"
+          },
+          {
+            "const": "operationIdInUse",
+            "description": "A transfer `operationId` is in use for different input.",
+            "type": "string"
+          },
+          {
+            "const": "transferPhase",
+            "description": "The transfer action is not valid in the operation's current phase.",
+            "type": "string"
+          },
+          {
+            "const": "transferOffset",
+            "description": "A transfer write's `offset` is not the digest's next expected offset.",
+            "type": "string"
+          },
+          {
+            "const": "digestMismatch",
+            "description": "Uploaded bytes do not hash to their digest.",
+            "type": "string"
+          },
+          {
+            "const": "environmentClosed",
+            "description": "The environment is closed; its identity or target is spent.",
+            "type": "string"
+          },
+          {
+            "const": "identityInUse",
+            "description": "The daemon identity is bound to another universe.",
+            "type": "string"
+          },
+          {
+            "const": "ownerMismatch",
+            "description": "The target belongs to another owner, or (`target/adopt`) the owner\nalready holds a different target.",
+            "type": "string"
+          },
+          {
+            "const": "templateDeprecated",
+            "description": "The template is deprecated and creates no new targets.",
+            "type": "string"
+          },
+          {
+            "const": "ingressUnsupported",
+            "description": "`ingress/ensure` on a target whose template has no public ingress.",
+            "type": "string"
+          },
+          {
+            "const": "targetNotActive",
+            "description": "A power change on a target whose `phase` is not `active`\n(provisioning, closing, closed or failed).",
+            "type": "string"
+          },
+          {
+            "const": "notAdoptable",
+            "description": "`target/adopt`: the source target exists but the provider cannot take\nit over, for example an instance of a kind it does not manage.",
+            "type": "string"
+          }
+        ]
+      },
+      "ProtocolError": {
+        "additionalProperties": false,
+        "description": "A protocol error: one kind, its typed data and a message.\n\nSerializes as an `ErrorObject`. Displays as `{kind}: {message}`.",
+        "properties": {
+          "code": {
+            "description": "Fixed by `data.kind`; see `ProtocolErrorKind::code`.",
+            "format": "int32",
+            "type": "integer"
+          },
+          "data": {
+            "$ref": "#/components/schemas/ErrorData"
+          },
+          "message": {
+            "description": "Human-readable description. Never parsed.",
+            "type": "string"
+          }
+        },
+        "required": [
+          "code",
+          "message",
+          "data"
+        ],
+        "type": "object"
+      },
+      "RegisterParams": {
+        "additionalProperties": false,
+        "description": "`registration/register` params. `registrationKey`, `displayName` and\n`metadata` are read only at a daemon identity's first admission; a\ndaemon sends the key until it is admitted once and never afterwards.\n\nThe gateway decodes them with `RegisterParams::decode`: build facts,\na display name or metadata out of bounds refuse admission with\n`invalidRequest`; anything else that does not decode is\n`invalidParams`.",
+        "properties": {
+          "daemonPublicKey": {
+            "$ref": "#/components/schemas/DaemonPublicKey"
+          },
+          "displayName": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/DisplayName"
+              }
+            ]
+          },
+          "implementation": {
+            "$ref": "#/components/schemas/ImplementationInfo"
+          },
+          "metadata": {
+            "$ref": "#/components/schemas/Metadata"
+          },
+          "protocolVersion": {
+            "description": "The daemon's `ENVD_PROTOCOL_VERSION`.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "registrationKey": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/SecretString"
+              }
+            ]
+          },
+          "signature": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/Ed25519Signature"
+              }
+            ],
+            "description": "Over `signed_registration_message` of the challenge nonce and the\ncanonical origin of the URL the daemon dialed."
+          }
+        },
+        "required": [
+          "protocolVersion",
+          "daemonPublicKey",
+          "signature",
+          "implementation"
+        ],
+        "type": "object"
+      },
+      "RegisterResponse": {
+        "additionalProperties": false,
+        "description": "`registration/register` response: the daemon is admitted.",
+        "properties": {
+          "heartbeatIntervalMs": {
+            "description": "How often the gateway pings; see the liveness rule.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "receipt": {
+            "$ref": "#/components/schemas/RegistrationReceipt"
+          }
+        },
+        "required": [
+          "receipt",
+          "heartbeatIntervalMs"
+        ],
+        "type": "object"
+      },
+      "RegistrationIdentityMode": {
+        "description": "Registration-key policy for the daemon's environment.",
+        "oneOf": [
+          {
+            "const": "persistent",
+            "description": "The environment outlives disconnects.",
+            "type": "string"
+          },
+          {
+            "const": "ephemeral",
+            "description": "The environment closes after it stays disconnected past its grace.",
+            "type": "string"
+          }
+        ]
+      },
+      "RegistrationReceipt": {
+        "additionalProperties": false,
+        "description": "What the daemon learns about the environment it serves. Written to the\nreceipt file as is; contains no secret.",
+        "properties": {
+          "admission": {
+            "$ref": "#/components/schemas/Admission"
+          },
+          "controlConnectionId": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/ControlConnectionId"
+              }
+            ],
+            "description": "The gateway's id for this control connection."
+          },
+          "daemonId": {
+            "$ref": "#/components/schemas/DaemonId"
+          },
+          "environmentId": {
+            "$ref": "#/components/schemas/EnvironmentId"
+          },
+          "identityMode": {
+            "$ref": "#/components/schemas/RegistrationIdentityMode"
+          },
+          "incarnationId": {
+            "$ref": "#/components/schemas/IncarnationId"
+          }
+        },
+        "required": [
+          "environmentId",
+          "incarnationId",
+          "daemonId",
+          "controlConnectionId",
+          "identityMode",
+          "admission"
+        ],
+        "type": "object"
+      },
+      "SecretString": {
+        "description": "A secret value carried on the wire, such as a `secretEnv` value, a\nregistration key or a stream token. It serializes as a plain string;\n`Debug` is redacted so structured logging never prints it.",
+        "type": "string"
+      },
+      "StreamSpec": {
+        "description": "What the dialed stream carries.",
+        "oneOf": [
+          {
+            "additionalProperties": false,
+            "description": "The data plane, served by the daemon as on any data connection.",
+            "properties": {
+              "kind": {
+                "const": "dataProtocol",
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          }
+        ]
+      }
+    }
+  },
+  "info": {
+    "description": "JSON-RPC 2.0 over WebSocket text frames of at most 16777216 bytes. Exact-match protocolVersion 3. Errors carry code, message and data.kind; see x-lightspeed-error-kinds.",
+    "title": "Lightspeed environment registration channel",
+    "version": "3"
+  },
+  "methods": [
+    {
+      "name": "registration/register",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "daemonPublicKey",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/DaemonPublicKey"
+          }
+        },
+        {
+          "name": "displayName",
+          "required": false,
+          "schema": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/DisplayName"
+              }
+            ]
+          }
+        },
+        {
+          "name": "implementation",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/ImplementationInfo"
+          }
+        },
+        {
+          "name": "metadata",
+          "required": false,
+          "schema": {
+            "$ref": "#/components/schemas/Metadata"
+          }
+        },
+        {
+          "name": "protocolVersion",
+          "required": true,
+          "schema": {
+            "description": "The daemon's `ENVD_PROTOCOL_VERSION`.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        {
+          "name": "registrationKey",
+          "required": false,
+          "schema": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/SecretString"
+              }
+            ]
+          }
+        },
+        {
+          "name": "signature",
+          "required": true,
+          "schema": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/Ed25519Signature"
+              }
+            ],
+            "description": "Over `signed_registration_message` of the challenge nonce and the\ncanonical origin of the URL the daemon dialed."
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/RegisterResponse"
+        }
+      },
+      "summary": "Prove the daemon identity and be admitted to its environment.",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "registration",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "RegisterParams",
+      "x-lightspeed-result-type": "RegisterResponse"
+    },
+    {
+      "name": "registration/openStream",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "stream",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/StreamSpec"
+          }
+        },
+        {
+          "name": "token",
+          "required": true,
+          "schema": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/SecretString"
+              }
+            ],
+            "description": "One-time bearer token for the stream dial; short-lived."
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/OpenStreamResponse"
+        }
+      },
+      "summary": "Ask the daemon to dial one reverse stream.",
+      "x-lightspeed-direction": "serverToClient",
+      "x-lightspeed-family": "registration",
+      "x-lightspeed-kind": "request",
+      "x-lightspeed-params-type": "OpenStreamParams",
+      "x-lightspeed-result-type": "OpenStreamResponse"
+    },
+    {
+      "name": "registration/challenge",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "nonce",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/ChallengeNonce"
+          }
+        },
+        {
+          "name": "protocolVersion",
+          "required": true,
+          "schema": {
+            "description": "The gateway's `ENVD_PROTOCOL_VERSION`.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          }
+        }
+      ],
+      "summary": "The frozen first frame: the gateway's version and nonce.",
+      "x-lightspeed-direction": "serverToClient",
+      "x-lightspeed-family": "registration",
+      "x-lightspeed-kind": "notification",
+      "x-lightspeed-params-type": "ChallengeParams"
+    },
+    {
+      "name": "registration/goodbye",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "reason",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/GoodbyeReason"
+          }
+        }
+      ],
+      "summary": "The daemon is stopping deliberately.",
+      "x-lightspeed-direction": "clientToServer",
+      "x-lightspeed-family": "registration",
+      "x-lightspeed-kind": "notification",
+      "x-lightspeed-params-type": "GoodbyeParams"
+    },
+    {
+      "name": "registration/closed",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "message",
+          "required": false,
+          "schema": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/DescriptiveText"
+              }
+            ]
+          }
+        },
+        {
+          "name": "reason",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/ClosedReason"
+          }
+        }
+      ],
+      "summary": "The gateway ends the session for good.",
+      "x-lightspeed-direction": "serverToClient",
+      "x-lightspeed-family": "registration",
+      "x-lightspeed-kind": "notification",
+      "x-lightspeed-params-type": "ClosedParams"
+    }
+  ],
+  "openrpc": "1.3.2",
+  "x-lightspeed-bootstrap": {
+    "buildFacts": {
+      "$ref": "#/components/schemas/BuildFacts"
+    },
+    "discoveryDocument": {
+      "$ref": "#/components/schemas/DiscoveryDocument"
+    }
+  },
+  "x-lightspeed-error": {
+    "$ref": "#/components/schemas/ProtocolError"
+  },
+  "x-lightspeed-error-kinds": [
+    {
+      "code": -32700,
+      "kind": "parseError",
+      "retryable": false
+    },
+    {
+      "code": -32600,
+      "kind": "invalidRequest",
+      "retryable": false
+    },
+    {
+      "code": -32601,
+      "kind": "methodNotFound",
+      "retryable": false
+    },
+    {
+      "code": -32602,
+      "kind": "invalidParams",
+      "retryable": false
+    },
+    {
+      "code": -32002,
+      "kind": "notInitialized",
+      "retryable": false
+    },
+    {
+      "code": -32005,
+      "kind": "versionMismatch",
+      "retryable": false
+    },
+    {
+      "code": -32004,
+      "kind": "notFound",
+      "retryable": false
+    },
+    {
+      "code": -32009,
+      "kind": "alreadyExists",
+      "retryable": false
+    },
+    {
+      "code": -32007,
+      "kind": "failedPrecondition",
+      "retryable": false
+    },
+    {
+      "code": -32003,
+      "kind": "permissionDenied",
+      "retryable": false
+    },
+    {
+      "code": -32006,
+      "kind": "capabilityUnavailable",
+      "retryable": false
+    },
+    {
+      "code": -32008,
+      "kind": "busy",
+      "retryable": true
+    },
+    {
+      "code": -32015,
+      "kind": "deadlineExceeded",
+      "retryable": false
+    },
+    {
+      "code": -32016,
+      "kind": "expired",
+      "retryable": false
+    },
+    {
+      "code": -32017,
+      "kind": "aborted",
+      "retryable": true
+    },
+    {
+      "code": -32013,
+      "kind": "payloadTooLarge",
+      "retryable": false
+    },
+    {
+      "code": -32018,
+      "kind": "processFailed",
+      "retryable": false
+    },
+    {
+      "code": -32019,
+      "kind": "unavailable",
+      "retryable": true
+    },
+    {
+      "code": -32603,
+      "kind": "internal",
+      "retryable": false
+    }
+  ],
+  "x-lightspeed-plane": "registration"
+}
diff --git a/crates/environment-protocol/contract/registration.schema.json b/crates/environment-protocol/contract/registration.schema.json
new file mode 100644
index 000000000..2749b1691
--- /dev/null
+++ b/crates/environment-protocol/contract/registration.schema.json
@@ -0,0 +1,1117 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "definitions": {
+    "AbortReason": {
+      "description": "Why an operation was `aborted`.",
+      "oneOf": [
+        {
+          "const": "cancelled",
+          "description": "`$/cancelRequest` named the request.",
+          "type": "string"
+        },
+        {
+          "const": "sourceChanged",
+          "description": "A file or directory changed while it was being read.",
+          "type": "string"
+        }
+      ]
+    },
+    "Admission": {
+      "description": "Whether this admission created the environment or rejoined it.",
+      "oneOf": [
+        {
+          "const": "created",
+          "description": "First admission of this daemon identity: a new environment.",
+          "type": "string"
+        },
+        {
+          "const": "reconnected",
+          "description": "A known identity reconnected to its environment.",
+          "type": "string"
+        }
+      ]
+    },
+    "ArtifactSha256": {
+      "description": "`sha256` of a published archive: 64 lowercase hex digits.",
+      "pattern": "^[0-9a-f]{64}$",
+      "type": "string"
+    },
+    "BuildFacts": {
+      "description": "What `lightspeed-envd --print-build` prints, as one JSON object.",
+      "properties": {
+        "gitSha": {
+          "type": "string"
+        },
+        "name": {
+          "description": "Always `lightspeed-envd`.",
+          "type": "string"
+        },
+        "protocolVersion": {
+          "description": "The binary's `ENVD_PROTOCOL_VERSION`.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "target": {
+          "description": "Rust target triple.",
+          "type": "string"
+        },
+        "version": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "name",
+        "version",
+        "gitSha",
+        "target",
+        "protocolVersion"
+      ],
+      "type": "object"
+    },
+    "BusyReason": {
+      "description": "What limit a `busy` request hit.",
+      "oneOf": [
+        {
+          "const": "requestLimit",
+          "description": "The connection's concurrent request limit.",
+          "type": "string"
+        },
+        {
+          "const": "transferCapacity",
+          "description": "The daemon's limit on active transfer operations.",
+          "type": "string"
+        },
+        {
+          "const": "rateLimited",
+          "description": "A rate limit on the caller's identity.",
+          "type": "string"
+        },
+        {
+          "const": "capacityExhausted",
+          "description": "A registration key's limit on active environments.",
+          "type": "string"
+        }
+      ]
+    },
+    "Capability": {
+      "description": "A capability a request needed and the endpoint lacks.",
+      "oneOf": [
+        {
+          "const": "filesystem",
+          "description": "The `filesystem` family.",
+          "type": "string"
+        },
+        {
+          "const": "filesystemWrite",
+          "description": "`capabilities.filesystem.write`: the filesystem is writable.",
+          "type": "string"
+        },
+        {
+          "const": "process",
+          "description": "The `process` family.",
+          "type": "string"
+        },
+        {
+          "const": "processPty",
+          "description": "`capabilities.process.pty`.",
+          "type": "string"
+        },
+        {
+          "const": "job",
+          "description": "The `job` family.",
+          "type": "string"
+        },
+        {
+          "const": "adoptTarget",
+          "description": "The controller's `adoptTarget` capability.",
+          "type": "string"
+        },
+        {
+          "const": "ingress",
+          "description": "The controller's `ingress` capability.",
+          "type": "string"
+        }
+      ]
+    },
+    "ChallengeNonce": {
+      "description": "`nonce`: the gateway's 32 random bytes for one control connection.",
+      "pattern": "^[0-9a-f]{64}$",
+      "type": "string"
+    },
+    "ChallengeParams": {
+      "description": "`registration/challenge` params.\n\n**Frozen.** This is the first frame of every control connection and the\nonly frame a daemon of any version must parse to learn it is stale: it\nonly ever gains fields, is decoded tolerantly (unknown members are\nignored), and a receiver reads `protocolVersion` with\n`challenge_protocol_version` before decoding anything else. The whole\nframe is\n`{\"jsonrpc\":\"2.0\",\"method\":\"registration/challenge\",\"params\":{\"protocolVersion\":N,\"nonce\":\"<64 hex>\"}}`.",
+      "properties": {
+        "nonce": {
+          "$ref": "#/definitions/ChallengeNonce"
+        },
+        "protocolVersion": {
+          "description": "The gateway's `ENVD_PROTOCOL_VERSION`.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "required": [
+        "protocolVersion",
+        "nonce"
+      ],
+      "type": "object"
+    },
+    "ClosedParams": {
+      "additionalProperties": false,
+      "description": "`registration/closed` params: the gateway ends the session for good and\ncloses the socket after this frame. The daemon exits and does not\nreconnect.",
+      "properties": {
+        "message": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/DescriptiveText"
+            }
+          ]
+        },
+        "reason": {
+          "$ref": "#/definitions/ClosedReason"
+        }
+      },
+      "required": [
+        "reason"
+      ],
+      "type": "object"
+    },
+    "ClosedReason": {
+      "description": "Why the gateway ended the session for good.",
+      "oneOf": [
+        {
+          "const": "superseded",
+          "description": "Another process with this daemon identity connected; the newest\nconnection wins and this daemon exits with its own status naming the\nshared identity.",
+          "type": "string"
+        },
+        {
+          "const": "environmentClosed",
+          "description": "The identity's environment was closed; the identity is spent.",
+          "type": "string"
+        }
+      ]
+    },
+    "ControlConnectionId": {
+      "description": "`controlConnectionId` the gateway assigns to one control connection.",
+      "maxLength": 128,
+      "minLength": 1,
+      "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$",
+      "type": "string"
+    },
+    "DaemonId": {
+      "description": "`daemonId` the gateway assigns to an admitted daemon identity.",
+      "maxLength": 128,
+      "minLength": 1,
+      "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$",
+      "type": "string"
+    },
+    "DaemonPublicKey": {
+      "description": "`daemonPublicKey`: a raw Ed25519 public key.",
+      "pattern": "^[0-9a-f]{64}$",
+      "type": "string"
+    },
+    "DescriptiveText": {
+      "description": "A short human-readable text: 1 to 1024 bytes without control characters\nother than line feed and tab. Never parsed.",
+      "maxLength": 1024,
+      "minLength": 1,
+      "pattern": "^[^\\u0000-\\u0008\\u000B-\\u001F\\u007F-\\u009F]+$",
+      "type": "string"
+    },
+    "DiscoveryArtifact": {
+      "description": "One published envd archive.",
+      "properties": {
+        "file": {
+          "description": "Archive file name.",
+          "type": "string"
+        },
+        "sha256": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/ArtifactSha256"
+            }
+          ],
+          "description": "Digest of the archive's bytes."
+        },
+        "url": {
+          "description": "Absolute download URL; absent (or null) when the archive is served\nnext to the document.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "file",
+        "sha256"
+      ],
+      "type": "object"
+    },
+    "DiscoveryDocument": {
+      "description": "The discovery document.",
+      "properties": {
+        "artifacts": {
+          "additionalProperties": {
+            "$ref": "#/definitions/DiscoveryArtifact"
+          },
+          "description": "Archives by Rust target triple.",
+          "type": "object"
+        },
+        "builtAtMs": {
+          "format": "int64",
+          "type": "integer"
+        },
+        "channel": {
+          "description": "Release channel, such as `stable` or `snapshot`.",
+          "type": "string"
+        },
+        "gitSha": {
+          "type": "string"
+        },
+        "protocolVersion": {
+          "description": "The published envd's `ENVD_PROTOCOL_VERSION`.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "version": {
+          "description": "Release version of the published envd.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "version",
+        "gitSha",
+        "protocolVersion",
+        "artifacts"
+      ],
+      "type": "object"
+    },
+    "DisplayName": {
+      "description": "A display name: 1 to 128 bytes without control characters.",
+      "maxLength": 128,
+      "minLength": 1,
+      "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+      "type": "string"
+    },
+    "Ed25519Signature": {
+      "description": "`signature`: an Ed25519 signature over\n`signed_registration_message`.",
+      "pattern": "^[0-9a-f]{128}$",
+      "type": "string"
+    },
+    "EnvironmentId": {
+      "description": "`environmentId` of a Lightspeed environment.",
+      "maxLength": 128,
+      "minLength": 1,
+      "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$",
+      "type": "string"
+    },
+    "ErrorData": {
+      "description": "The `data` member of an error object: the kind and its typed fields.\n\nKinds without fields are empty struct variants rather than unit\nvariants: serde does not apply `deny_unknown_fields` to the unit\nvariants of an internally tagged enum, and every kind must refuse\nunknown members.",
+      "oneOf": [
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "parseError",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "invalidRequest",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "methodNotFound",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "ceiling": {
+              "description": "The advertised ceiling the value exceeded.",
+              "format": "uint64",
+              "minimum": 0,
+              "type": "integer"
+            },
+            "field": {
+              "description": "Wire path of the offending field, such as `limits.maxDurationMs`.",
+              "type": "string"
+            },
+            "kind": {
+              "const": "invalidParams",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "notInitialized",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "expected": {
+              "description": "The version of the peer that sent this error.",
+              "format": "uint32",
+              "minimum": 0,
+              "type": "integer"
+            },
+            "kind": {
+              "const": "versionMismatch",
+              "type": "string"
+            },
+            "received": {
+              "description": "The version the requester stated.",
+              "format": "uint32",
+              "minimum": 0,
+              "type": "integer"
+            }
+          },
+          "required": [
+            "kind",
+            "expected",
+            "received"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "notFound",
+              "type": "string"
+            },
+            "reason": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/NotFoundReason"
+                }
+              ]
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "alreadyExists",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "failedPrecondition",
+              "type": "string"
+            },
+            "reason": {
+              "$ref": "#/definitions/PreconditionReason"
+            }
+          },
+          "required": [
+            "kind",
+            "reason"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "permissionDenied",
+              "type": "string"
+            },
+            "reason": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/PermissionReason"
+                }
+              ]
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "capability": {
+              "$ref": "#/definitions/Capability"
+            },
+            "kind": {
+              "const": "capabilityUnavailable",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind",
+            "capability"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "busy",
+              "type": "string"
+            },
+            "reason": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/BusyReason"
+                }
+              ]
+            },
+            "retryAfterMs": {
+              "description": "Earliest useful retry, when the server knows it.",
+              "format": "uint64",
+              "minimum": 0,
+              "type": "integer"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "deadlineExceeded",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "expired",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "aborted",
+              "type": "string"
+            },
+            "reason": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/AbortReason"
+                }
+              ]
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "payloadTooLarge",
+              "type": "string"
+            },
+            "limitBytes": {
+              "description": "The byte limit the payload exceeded.",
+              "format": "uint64",
+              "minimum": 0,
+              "type": "integer"
+            },
+            "limitEntries": {
+              "description": "The entry-count limit the result exceeded.",
+              "format": "uint32",
+              "minimum": 0,
+              "type": "integer"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "processFailed",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "unavailable",
+              "type": "string"
+            },
+            "retryAfterMs": {
+              "format": "uint64",
+              "minimum": 0,
+              "type": "integer"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "internal",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        }
+      ]
+    },
+    "GoodbyeParams": {
+      "additionalProperties": false,
+      "description": "`registration/goodbye` params: the daemon is stopping deliberately.",
+      "properties": {
+        "reason": {
+          "$ref": "#/definitions/GoodbyeReason"
+        }
+      },
+      "required": [
+        "reason"
+      ],
+      "type": "object"
+    },
+    "GoodbyeReason": {
+      "description": "Why the daemon is leaving.",
+      "oneOf": [
+        {
+          "const": "shutdown",
+          "description": "`SIGTERM` or `SIGINT`.",
+          "type": "string"
+        }
+      ]
+    },
+    "ImplementationInfo": {
+      "additionalProperties": false,
+      "description": "What a peer says about its own build: `clientInfo`, `serverInfo` and a\ndaemon's registration `implementation`. Descriptive only; the protocol\nversion alone decides whether two peers can talk, and nothing here\nselects, authenticates or gates. Every field is 1 to 256 bytes without control characters,\nchecked on decode and by every constructor, so a value that would be\nrefused can never be built or sent.",
+      "properties": {
+        "gitSha": {
+          "description": "Full or abbreviated git commit of the build.",
+          "maxLength": 256,
+          "minLength": 1,
+          "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+          "type": "string"
+        },
+        "name": {
+          "description": "Product name, such as `lightspeed-envd`.",
+          "maxLength": 256,
+          "minLength": 1,
+          "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+          "type": "string"
+        },
+        "target": {
+          "description": "Rust target triple of the build.",
+          "maxLength": 256,
+          "minLength": 1,
+          "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+          "type": "string"
+        },
+        "version": {
+          "description": "Release version, such as `0.5.0`.",
+          "maxLength": 256,
+          "minLength": 1,
+          "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+          "type": "string"
+        }
+      },
+      "required": [
+        "name"
+      ],
+      "type": "object"
+    },
+    "IncarnationId": {
+      "description": "`incarnationId` of one incarnation of an environment.",
+      "maxLength": 128,
+      "minLength": 1,
+      "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$",
+      "type": "string"
+    },
+    "Metadata": {
+      "additionalProperties": {
+        "maxLength": 256,
+        "minLength": 1,
+        "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
+        "type": "string"
+      },
+      "description": "Descriptive key-value metadata: at most 32 entries, keys 1 to 64 bytes outside the reserved `lightspeed.` prefix, values 1 to 256 bytes, no control characters.",
+      "maxProperties": 32,
+      "propertyNames": {
+        "maxLength": 64,
+        "minLength": 1,
+        "not": {
+          "pattern": "^lightspeed\\."
+        },
+        "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$"
+      },
+      "type": "object"
+    },
+    "NotFoundReason": {
+      "description": "Why a handle, path or identity was not found.",
+      "oneOf": [
+        {
+          "const": "expired",
+          "description": "Its retention window ended; a tombstone remembers it.",
+          "type": "string"
+        },
+        {
+          "const": "daemonRestarted",
+          "description": "It belonged to an earlier daemon instance (see `daemonInstanceId`).",
+          "type": "string"
+        },
+        {
+          "const": "unknownDaemon",
+          "description": "A daemon identity the gateway has never admitted presented no\nregistration key.",
+          "type": "string"
+        }
+      ]
+    },
+    "OpenStreamParams": {
+      "additionalProperties": false,
+      "description": "`registration/openStream` params: the gateway asks the daemon to dial\none stream.",
+      "properties": {
+        "stream": {
+          "$ref": "#/definitions/StreamSpec"
+        },
+        "token": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/SecretString"
+            }
+          ],
+          "description": "One-time bearer token for the stream dial; short-lived."
+        }
+      },
+      "required": [
+        "token",
+        "stream"
+      ],
+      "type": "object"
+    },
+    "OpenStreamResponse": {
+      "additionalProperties": false,
+      "description": "`registration/openStream` response, sent once the stream socket is\nupgraded and served. A failed dial answers `unavailable`; the gateway\nfails the waiting route at once.",
+      "type": "object"
+    },
+    "PermissionReason": {
+      "description": "Why a `permissionDenied` request was refused.",
+      "oneOf": [
+        {
+          "const": "outsideRoot",
+          "description": "The path, or a symlink it passes through, resolves outside the\ndaemon's filesystem root.",
+          "type": "string"
+        },
+        {
+          "const": "daemonState",
+          "description": "The path names or contains the daemon's state directory.",
+          "type": "string"
+        },
+        {
+          "const": "filePermission",
+          "description": "The operating system refused access.",
+          "type": "string"
+        },
+        {
+          "const": "invalidSignature",
+          "description": "The registration signature does not verify.",
+          "type": "string"
+        },
+        {
+          "const": "invalidRegistrationKey",
+          "description": "The registration key is unknown.",
+          "type": "string"
+        },
+        {
+          "const": "registrationKeyRevoked",
+          "description": "The registration key was revoked.",
+          "type": "string"
+        }
+      ]
+    },
+    "PreconditionReason": {
+      "description": "The state that forbids a `failedPrecondition` request.",
+      "oneOf": [
+        {
+          "const": "inputClosed",
+          "description": "The process has no open input: started without `pipe` or `pty`,\ninput already closed, or exited.",
+          "type": "string"
+        },
+        {
+          "const": "ifMatchFailed",
+          "description": "The file's current `version` differs from `ifMatch`.",
+          "type": "string"
+        },
+        {
+          "const": "createCondition",
+          "description": "`create: ifAbsent` met an existing file, or `create: ifPresent` a\nmissing one.",
+          "type": "string"
+        },
+        {
+          "const": "notEmpty",
+          "description": "The directory is not empty and `recursive` was not set.",
+          "type": "string"
+        },
+        {
+          "const": "isDirectory",
+          "description": "The path names a directory where a file is required.",
+          "type": "string"
+        },
+        {
+          "const": "notDirectory",
+          "description": "A path component or the path names a non-directory where a directory\nis required.",
+          "type": "string"
+        },
+        {
+          "const": "notRegularFile",
+          "description": "The path names a device, FIFO, socket or other non-regular file.",
+          "type": "string"
+        },
+        {
+          "const": "symlinkLoop",
+          "description": "A symlink chain loops.",
+          "type": "string"
+        },
+        {
+          "const": "symlinkRejected",
+          "description": "A capture met a symlink that leaves the selection, or one the\nselection's symlink policy rejects.",
+          "type": "string"
+        },
+        {
+          "const": "filesystemRoot",
+          "description": "The filesystem root itself cannot be replaced or removed.",
+          "type": "string"
+        },
+        {
+          "const": "crossDevice",
+          "description": "Rename across filesystems.",
+          "type": "string"
+        },
+        {
+          "const": "noSpace",
+          "description": "No space left on the device.",
+          "type": "string"
+        },
+        {
+          "const": "jobIdInUse",
+          "description": "A job id is in use by a job with another `requestId` or spec; choose\na new job id.",
+          "type": "string"
+        },
+        {
+          "const": "operationIdInUse",
+          "description": "A transfer `operationId` is in use for different input.",
+          "type": "string"
+        },
+        {
+          "const": "transferPhase",
+          "description": "The transfer action is not valid in the operation's current phase.",
+          "type": "string"
+        },
+        {
+          "const": "transferOffset",
+          "description": "A transfer write's `offset` is not the digest's next expected offset.",
+          "type": "string"
+        },
+        {
+          "const": "digestMismatch",
+          "description": "Uploaded bytes do not hash to their digest.",
+          "type": "string"
+        },
+        {
+          "const": "environmentClosed",
+          "description": "The environment is closed; its identity or target is spent.",
+          "type": "string"
+        },
+        {
+          "const": "identityInUse",
+          "description": "The daemon identity is bound to another universe.",
+          "type": "string"
+        },
+        {
+          "const": "ownerMismatch",
+          "description": "The target belongs to another owner, or (`target/adopt`) the owner\nalready holds a different target.",
+          "type": "string"
+        },
+        {
+          "const": "templateDeprecated",
+          "description": "The template is deprecated and creates no new targets.",
+          "type": "string"
+        },
+        {
+          "const": "ingressUnsupported",
+          "description": "`ingress/ensure` on a target whose template has no public ingress.",
+          "type": "string"
+        },
+        {
+          "const": "targetNotActive",
+          "description": "A power change on a target whose `phase` is not `active`\n(provisioning, closing, closed or failed).",
+          "type": "string"
+        },
+        {
+          "const": "notAdoptable",
+          "description": "`target/adopt`: the source target exists but the provider cannot take\nit over, for example an instance of a kind it does not manage.",
+          "type": "string"
+        }
+      ]
+    },
+    "ProtocolError": {
+      "additionalProperties": false,
+      "description": "A protocol error: one kind, its typed data and a message.\n\nSerializes as an `ErrorObject`. Displays as `{kind}: {message}`.",
+      "properties": {
+        "code": {
+          "description": "Fixed by `data.kind`; see `ProtocolErrorKind::code`.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "data": {
+          "$ref": "#/definitions/ErrorData"
+        },
+        "message": {
+          "description": "Human-readable description. Never parsed.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "code",
+        "message",
+        "data"
+      ],
+      "type": "object"
+    },
+    "RegisterParams": {
+      "additionalProperties": false,
+      "description": "`registration/register` params. `registrationKey`, `displayName` and\n`metadata` are read only at a daemon identity's first admission; a\ndaemon sends the key until it is admitted once and never afterwards.\n\nThe gateway decodes them with `RegisterParams::decode`: build facts,\na display name or metadata out of bounds refuse admission with\n`invalidRequest`; anything else that does not decode is\n`invalidParams`.",
+      "properties": {
+        "daemonPublicKey": {
+          "$ref": "#/definitions/DaemonPublicKey"
+        },
+        "displayName": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/DisplayName"
+            }
+          ]
+        },
+        "implementation": {
+          "$ref": "#/definitions/ImplementationInfo"
+        },
+        "metadata": {
+          "$ref": "#/definitions/Metadata"
+        },
+        "protocolVersion": {
+          "description": "The daemon's `ENVD_PROTOCOL_VERSION`.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "registrationKey": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/SecretString"
+            }
+          ]
+        },
+        "signature": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/Ed25519Signature"
+            }
+          ],
+          "description": "Over `signed_registration_message` of the challenge nonce and the\ncanonical origin of the URL the daemon dialed."
+        }
+      },
+      "required": [
+        "protocolVersion",
+        "daemonPublicKey",
+        "signature",
+        "implementation"
+      ],
+      "type": "object"
+    },
+    "RegisterResponse": {
+      "additionalProperties": false,
+      "description": "`registration/register` response: the daemon is admitted.",
+      "properties": {
+        "heartbeatIntervalMs": {
+          "description": "How often the gateway pings; see the liveness rule.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "receipt": {
+          "$ref": "#/definitions/RegistrationReceipt"
+        }
+      },
+      "required": [
+        "receipt",
+        "heartbeatIntervalMs"
+      ],
+      "type": "object"
+    },
+    "RegistrationIdentityMode": {
+      "description": "Registration-key policy for the daemon's environment.",
+      "oneOf": [
+        {
+          "const": "persistent",
+          "description": "The environment outlives disconnects.",
+          "type": "string"
+        },
+        {
+          "const": "ephemeral",
+          "description": "The environment closes after it stays disconnected past its grace.",
+          "type": "string"
+        }
+      ]
+    },
+    "RegistrationReceipt": {
+      "additionalProperties": false,
+      "description": "What the daemon learns about the environment it serves. Written to the\nreceipt file as is; contains no secret.",
+      "properties": {
+        "admission": {
+          "$ref": "#/definitions/Admission"
+        },
+        "controlConnectionId": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/ControlConnectionId"
+            }
+          ],
+          "description": "The gateway's id for this control connection."
+        },
+        "daemonId": {
+          "$ref": "#/definitions/DaemonId"
+        },
+        "environmentId": {
+          "$ref": "#/definitions/EnvironmentId"
+        },
+        "identityMode": {
+          "$ref": "#/definitions/RegistrationIdentityMode"
+        },
+        "incarnationId": {
+          "$ref": "#/definitions/IncarnationId"
+        }
+      },
+      "required": [
+        "environmentId",
+        "incarnationId",
+        "daemonId",
+        "controlConnectionId",
+        "identityMode",
+        "admission"
+      ],
+      "type": "object"
+    },
+    "SecretString": {
+      "description": "A secret value carried on the wire, such as a `secretEnv` value, a\nregistration key or a stream token. It serializes as a plain string;\n`Debug` is redacted so structured logging never prints it.",
+      "type": "string"
+    },
+    "StreamSpec": {
+      "description": "What the dialed stream carries.",
+      "oneOf": [
+        {
+          "additionalProperties": false,
+          "description": "The data plane, served by the daemon as on any data connection.",
+          "properties": {
+            "kind": {
+              "const": "dataProtocol",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        }
+      ]
+    }
+  },
+  "description": "Every wire type of the registration plane, protocol version 3.",
+  "title": "Lightspeed environment registration channel",
+  "x-lightspeed-bootstrap": {
+    "buildFacts": {
+      "$ref": "#/definitions/BuildFacts"
+    },
+    "discoveryDocument": {
+      "$ref": "#/definitions/DiscoveryDocument"
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/bootstrap/build-facts.json b/crates/environment-protocol/fixtures/bootstrap/build-facts.json
new file mode 100644
index 000000000..e4dd66a6b
--- /dev/null
+++ b/crates/environment-protocol/fixtures/bootstrap/build-facts.json
@@ -0,0 +1,7 @@
+{
+  "name": "lightspeed-envd",
+  "version": "0.5.0",
+  "gitSha": "86f6adf3",
+  "target": "x86_64-unknown-linux-musl",
+  "protocolVersion": 3
+}
diff --git a/crates/environment-protocol/fixtures/bootstrap/discovery-document.json b/crates/environment-protocol/fixtures/bootstrap/discovery-document.json
new file mode 100644
index 000000000..b02b13851
--- /dev/null
+++ b/crates/environment-protocol/fixtures/bootstrap/discovery-document.json
@@ -0,0 +1,14 @@
+{
+  "version": "0.5.0",
+  "gitSha": "86f6adf3",
+  "channel": "stable",
+  "protocolVersion": 3,
+  "builtAtMs": 1761400000000,
+  "artifacts": {
+    "x86_64-unknown-linux-musl": {
+      "file": "lightspeed-envd-x86_64-unknown-linux-musl.tar.gz",
+      "sha256": "abababababababababababababababababababababababababababababababab",
+      "url": "https://releases.example.com/lightspeed-envd-x86_64-unknown-linux-musl.tar.gz"
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/controller/ingress.ensure.json b/crates/environment-protocol/fixtures/controller/ingress.ensure.json
new file mode 100644
index 000000000..a594e5383
--- /dev/null
+++ b/crates/environment-protocol/fixtures/controller/ingress.ensure.json
@@ -0,0 +1,49 @@
+{
+  "params": {
+    "target": {
+      "owner": {
+        "universeId": "u1",
+        "bindingId": "primary",
+        "environmentId": "env_1",
+        "incarnationId": "inc_1"
+      },
+      "targetId": "ls-3f2a"
+    }
+  },
+  "response": {
+    "target": {
+      "targetId": "ls-3f2a",
+      "owner": {
+        "universeId": "u1",
+        "bindingId": "primary",
+        "environmentId": "env_1",
+        "incarnationId": "inc_1"
+      },
+      "displayName": "env_1",
+      "state": {
+        "phase": "active",
+        "power": "running",
+        "daemonReady": true
+      },
+      "supportedPowerStates": [
+        "running",
+        "paused",
+        "stopped"
+      ],
+      "metadata": {
+        "incusMember": "node-1"
+      },
+      "ingress": {
+        "endpoint": "https://env-1.apps.example.com"
+      }
+    }
+  },
+  "error": {
+    "code": -32006,
+    "message": "this provider serves no public ingress",
+    "data": {
+      "kind": "capabilityUnavailable",
+      "capability": "ingress"
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/controller/ingress.remove.json b/crates/environment-protocol/fixtures/controller/ingress.remove.json
new file mode 100644
index 000000000..f5ab1d2d7
--- /dev/null
+++ b/crates/environment-protocol/fixtures/controller/ingress.remove.json
@@ -0,0 +1,45 @@
+{
+  "params": {
+    "target": {
+      "owner": {
+        "universeId": "u1",
+        "bindingId": "primary",
+        "environmentId": "env_1",
+        "incarnationId": "inc_1"
+      },
+      "targetId": "ls-3f2a"
+    }
+  },
+  "response": {
+    "target": {
+      "targetId": "ls-3f2a",
+      "owner": {
+        "universeId": "u1",
+        "bindingId": "primary",
+        "environmentId": "env_1",
+        "incarnationId": "inc_1"
+      },
+      "displayName": "env_1",
+      "state": {
+        "phase": "active",
+        "power": "running",
+        "daemonReady": true
+      },
+      "supportedPowerStates": [
+        "running",
+        "paused",
+        "stopped"
+      ],
+      "metadata": {
+        "incusMember": "node-1"
+      }
+    }
+  },
+  "error": {
+    "code": -32004,
+    "message": "target ls-3f2a no longer exists",
+    "data": {
+      "kind": "notFound"
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/controller/initialize.json b/crates/environment-protocol/fixtures/controller/initialize.json
new file mode 100644
index 000000000..a449dd0cf
--- /dev/null
+++ b/crates/environment-protocol/fixtures/controller/initialize.json
@@ -0,0 +1,33 @@
+{
+  "params": {
+    "protocolVersion": 3,
+    "clientInfo": {
+      "name": "lightspeed-runtime",
+      "version": "0.5.0"
+    }
+  },
+  "response": {
+    "protocolVersion": 3,
+    "plane": "controller",
+    "serverInfo": {
+      "name": "lightspeed-provider-incus",
+      "version": "0.5.0"
+    },
+    "capabilities": {
+      "adoptTarget": true,
+      "ingress": true
+    },
+    "routes": {
+      "data": "wss://incus.example.com:19090/routes"
+    }
+  },
+  "error": {
+    "code": -32005,
+    "message": "protocol version 4 is not supported; this peer speaks 3",
+    "data": {
+      "kind": "versionMismatch",
+      "expected": 3,
+      "received": 4
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/controller/target.adopt.json b/crates/environment-protocol/fixtures/controller/target.adopt.json
new file mode 100644
index 000000000..a8dc7100a
--- /dev/null
+++ b/crates/environment-protocol/fixtures/controller/target.adopt.json
@@ -0,0 +1,44 @@
+{
+  "params": {
+    "owner": {
+      "universeId": "u1",
+      "bindingId": "primary",
+      "environmentId": "env_1",
+      "incarnationId": "inc_1"
+    },
+    "sourceTarget": "default/legacy-vm"
+  },
+  "response": {
+    "target": {
+      "targetId": "ls-3f2a",
+      "owner": {
+        "universeId": "u1",
+        "bindingId": "primary",
+        "environmentId": "env_1",
+        "incarnationId": "inc_1"
+      },
+      "displayName": "env_1",
+      "state": {
+        "phase": "active",
+        "power": "running",
+        "daemonReady": true
+      },
+      "supportedPowerStates": [
+        "running",
+        "paused",
+        "stopped"
+      ],
+      "metadata": {
+        "incusMember": "node-1"
+      }
+    }
+  },
+  "error": {
+    "code": -32006,
+    "message": "this provider does not adopt targets",
+    "data": {
+      "kind": "capabilityUnavailable",
+      "capability": "adoptTarget"
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/controller/target.close.json b/crates/environment-protocol/fixtures/controller/target.close.json
new file mode 100644
index 000000000..06dd35918
--- /dev/null
+++ b/crates/environment-protocol/fixtures/controller/target.close.json
@@ -0,0 +1,33 @@
+{
+  "params": {
+    "target": {
+      "owner": {
+        "universeId": "u1",
+        "bindingId": "primary",
+        "environmentId": "env_1",
+        "incarnationId": "inc_1"
+      }
+    }
+  },
+  "response": {
+    "target": {
+      "owner": {
+        "universeId": "u1",
+        "bindingId": "primary",
+        "environmentId": "env_1",
+        "incarnationId": "inc_1"
+      },
+      "state": {
+        "phase": "closed"
+      }
+    }
+  },
+  "error": {
+    "code": -32019,
+    "message": "the Incus API is unreachable",
+    "data": {
+      "kind": "unavailable",
+      "retryAfterMs": 5000
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/controller/target.create.json b/crates/environment-protocol/fixtures/controller/target.create.json
new file mode 100644
index 000000000..48700553e
--- /dev/null
+++ b/crates/environment-protocol/fixtures/controller/target.create.json
@@ -0,0 +1,34 @@
+{
+  "params": {
+    "owner": {
+      "universeId": "u1",
+      "bindingId": "primary",
+      "environmentId": "env_1",
+      "incarnationId": "inc_1"
+    },
+    "templateId": "ubuntu-24.04-small"
+  },
+  "response": {
+    "target": {
+      "targetId": "ls-3f2a",
+      "owner": {
+        "universeId": "u1",
+        "bindingId": "primary",
+        "environmentId": "env_1",
+        "incarnationId": "inc_1"
+      },
+      "state": {
+        "phase": "provisioning",
+        "message": "pulling image"
+      }
+    }
+  },
+  "error": {
+    "code": -32007,
+    "message": "template ubuntu-24.04-small is deprecated",
+    "data": {
+      "kind": "failedPrecondition",
+      "reason": "templateDeprecated"
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/controller/target.get.json b/crates/environment-protocol/fixtures/controller/target.get.json
new file mode 100644
index 000000000..edf6ab717
--- /dev/null
+++ b/crates/environment-protocol/fixtures/controller/target.get.json
@@ -0,0 +1,48 @@
+{
+  "params": {
+    "target": {
+      "owner": {
+        "universeId": "u1",
+        "bindingId": "primary",
+        "environmentId": "env_1",
+        "incarnationId": "inc_1"
+      },
+      "targetId": "ls-3f2a"
+    }
+  },
+  "response": {
+    "target": {
+      "targetId": "ls-3f2a",
+      "owner": {
+        "universeId": "u1",
+        "bindingId": "primary",
+        "environmentId": "env_1",
+        "incarnationId": "inc_1"
+      },
+      "displayName": "env_1",
+      "state": {
+        "phase": "active",
+        "power": "running",
+        "daemonReady": true
+      },
+      "supportedPowerStates": [
+        "running",
+        "paused",
+        "stopped"
+      ],
+      "metadata": {
+        "incusMember": "node-1"
+      },
+      "ingress": {
+        "endpoint": "https://env-1.apps.example.com"
+      }
+    }
+  },
+  "error": {
+    "code": -32004,
+    "message": "target ls-3f2a no longer exists",
+    "data": {
+      "kind": "notFound"
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/controller/target.setPower.json b/crates/environment-protocol/fixtures/controller/target.setPower.json
new file mode 100644
index 000000000..9f9da2c9b
--- /dev/null
+++ b/crates/environment-protocol/fixtures/controller/target.setPower.json
@@ -0,0 +1,46 @@
+{
+  "params": {
+    "target": {
+      "owner": {
+        "universeId": "u1",
+        "bindingId": "primary",
+        "environmentId": "env_1",
+        "incarnationId": "inc_1"
+      },
+      "targetId": "ls-3f2a"
+    },
+    "power": "paused"
+  },
+  "response": {
+    "target": {
+      "targetId": "ls-3f2a",
+      "owner": {
+        "universeId": "u1",
+        "bindingId": "primary",
+        "environmentId": "env_1",
+        "incarnationId": "inc_1"
+      },
+      "displayName": "env_1",
+      "state": {
+        "phase": "active",
+        "power": "paused"
+      },
+      "supportedPowerStates": [
+        "running",
+        "paused",
+        "stopped"
+      ],
+      "metadata": {
+        "incusMember": "node-1"
+      }
+    }
+  },
+  "error": {
+    "code": -32007,
+    "message": "target ls-3f2a belongs to another incarnation",
+    "data": {
+      "kind": "failedPrecondition",
+      "reason": "ownerMismatch"
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/controller/template.list.json b/crates/environment-protocol/fixtures/controller/template.list.json
new file mode 100644
index 000000000..e0126e578
--- /dev/null
+++ b/crates/environment-protocol/fixtures/controller/template.list.json
@@ -0,0 +1,34 @@
+{
+  "params": {
+    "binding": {
+      "universeId": "u1",
+      "bindingId": "primary"
+    }
+  },
+  "response": {
+    "templates": [
+      {
+        "templateId": "ubuntu-24.04-small",
+        "displayName": "Ubuntu 24.04 (small)",
+        "description": "2 vCPU, 4 GiB",
+        "publicIngress": true,
+        "deprecated": true,
+        "resources": {
+          "vcpus": 2,
+          "memoryBytes": 4294967296,
+          "diskBytes": 21474836480
+        },
+        "metadata": {
+          "imageFingerprint": "a1b2c3"
+        }
+      }
+    ]
+  },
+  "error": {
+    "code": -32019,
+    "message": "the Incus API is unreachable",
+    "data": {
+      "kind": "unavailable"
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/controller_create_target_params.json b/crates/environment-protocol/fixtures/controller_create_target_params.json
deleted file mode 100644
index 2d2ffa85c..000000000
--- a/crates/environment-protocol/fixtures/controller_create_target_params.json
+++ /dev/null
@@ -1,10 +0,0 @@
-{
-  "binding": {
-    "bindingId": "primary",
-    "universeId": "universe-1"
-  },
-  "environmentId": "environment-1",
-  "incarnationId": "incarnation-1",
-  "requestId": "request-1",
-  "templateId": "lightspeed-dev-v1"
-}
diff --git a/crates/environment-protocol/fixtures/controller_create_target_response.json b/crates/environment-protocol/fixtures/controller_create_target_response.json
deleted file mode 100644
index 10b9ddf56..000000000
--- a/crates/environment-protocol/fixtures/controller_create_target_response.json
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  "target": {
-    "capabilities": {
-      "filesystemRead": true,
-      "filesystemSearch": true,
-      "filesystemGlob": true,
-      "filesystemRangedRead": true,
-      "filesystemWrite": true,
-      "jobCancel": true,
-      "jobDependencies": true,
-      "jobList": true,
-      "jobRead": true,
-      "jobQueueKeys": true,
-      "jobStart": true,
-      "jobWaitHint": false,
-      "network": true,
-      "processOutputNotifications": true,
-      "processOutputPolling": true,
-      "processPty": false,
-      "processStart": true,
-      "processStdin": true,
-      "processTerminate": true
-    },
-    "defaultCwd": "/workspace",
-    "displayName": "lightspeed dev",
-    "metadata": {
-      "provider": "smolvm"
-    },
-    "scope": {
-      "sessionId": "sandbox-123",
-      "type": "session"
-    },
-    "status": "ready",
-    "targetId": "sandbox-123"
-  }
-}
diff --git a/crates/environment-protocol/fixtures/controller_initialize_params.json b/crates/environment-protocol/fixtures/controller_initialize_params.json
deleted file mode 100644
index 55abb5153..000000000
--- a/crates/environment-protocol/fixtures/controller_initialize_params.json
+++ /dev/null
@@ -1,4 +0,0 @@
-{
-  "clientName": "lightspeed-test",
-  "protocolVersion": 2
-}
diff --git a/crates/environment-protocol/fixtures/controller_list_targets_response.json b/crates/environment-protocol/fixtures/controller_list_targets_response.json
deleted file mode 100644
index 5cb884925..000000000
--- a/crates/environment-protocol/fixtures/controller_list_targets_response.json
+++ /dev/null
@@ -1,38 +0,0 @@
-{
-  "targets": [
-    {
-      "capabilities": {
-        "filesystemRead": true,
-        "filesystemSearch": true,
-        "filesystemGlob": true,
-        "filesystemRangedRead": true,
-        "filesystemWrite": true,
-        "jobCancel": true,
-        "jobDependencies": true,
-        "jobList": true,
-        "jobRead": true,
-        "jobQueueKeys": true,
-        "jobStart": true,
-        "jobWaitHint": false,
-        "network": true,
-        "processOutputNotifications": true,
-        "processOutputPolling": true,
-        "processPty": false,
-        "processStart": true,
-        "processStdin": true,
-        "processTerminate": true
-      },
-      "defaultCwd": "/workspace",
-      "displayName": "lightspeed dev",
-      "metadata": {
-        "provider": "smolvm"
-      },
-      "scope": {
-        "sessionId": "sandbox-123",
-        "type": "session"
-      },
-      "status": "ready",
-      "targetId": "sandbox-123"
-    }
-  ]
-}
diff --git a/crates/environment-protocol/fixtures/data/env.getIdle.json b/crates/environment-protocol/fixtures/data/env.getIdle.json
new file mode 100644
index 000000000..9bd9ac05e
--- /dev/null
+++ b/crates/environment-protocol/fixtures/data/env.getIdle.json
@@ -0,0 +1,15 @@
+{
+  "params": {},
+  "response": {
+    "idleForMs": 0,
+    "runningProcessCount": 1,
+    "leftoverProcessGroupCount": 1
+  },
+  "error": {
+    "code": -32002,
+    "message": "initialize must be the first request on a connection",
+    "data": {
+      "kind": "notInitialized"
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/data/fs.createDirectory.json b/crates/environment-protocol/fixtures/data/fs.createDirectory.json
new file mode 100644
index 000000000..705890f70
--- /dev/null
+++ b/crates/environment-protocol/fixtures/data/fs.createDirectory.json
@@ -0,0 +1,15 @@
+{
+  "params": {
+    "path": "/workspace/build/out",
+    "recursive": true
+  },
+  "response": {},
+  "error": {
+    "code": -32006,
+    "message": "the filesystem is read-only",
+    "data": {
+      "kind": "capabilityUnavailable",
+      "capability": "filesystemWrite"
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/data/fs.getMetadata.json b/crates/environment-protocol/fixtures/data/fs.getMetadata.json
new file mode 100644
index 000000000..d8c16aba5
--- /dev/null
+++ b/crates/environment-protocol/fixtures/data/fs.getMetadata.json
@@ -0,0 +1,24 @@
+{
+  "params": {
+    "path": "/workspace/link",
+    "followSymlinks": true
+  },
+  "response": {
+    "metadata": {
+      "kind": "file",
+      "sizeBytes": 1024,
+      "executable": true,
+      "modifiedAtMs": 1761400000000,
+      "createdAtMs": 1761300000000,
+      "version": "v1:1761400000000000000:1024:42"
+    }
+  },
+  "error": {
+    "code": -32003,
+    "message": "/workspace/link resolves outside the filesystem root",
+    "data": {
+      "kind": "permissionDenied",
+      "reason": "outsideRoot"
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/data/fs.globFiles.json b/crates/environment-protocol/fixtures/data/fs.globFiles.json
new file mode 100644
index 000000000..f10ee1502
--- /dev/null
+++ b/crates/environment-protocol/fixtures/data/fs.globFiles.json
@@ -0,0 +1,33 @@
+{
+  "params": {
+    "root": "/workspace",
+    "filter": {
+      "include": [
+        "**/SKILL.md"
+      ],
+      "ignoreCase": true,
+      "includeHidden": true,
+      "includeIgnored": true
+    },
+    "limits": {
+      "maxMatches": 1000,
+      "maxFiles": 5000,
+      "maxDurationMs": 30000
+    }
+  },
+  "response": {
+    "matches": [
+      "/workspace/.agents/skills/review/SKILL.md"
+    ],
+    "visitedFileCount": 310,
+    "elapsedMs": 12
+  },
+  "error": {
+    "code": -32017,
+    "message": "request cancelled",
+    "data": {
+      "kind": "aborted",
+      "reason": "cancelled"
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/data/fs.readDirectory.json b/crates/environment-protocol/fixtures/data/fs.readDirectory.json
new file mode 100644
index 000000000..430060a53
--- /dev/null
+++ b/crates/environment-protocol/fixtures/data/fs.readDirectory.json
@@ -0,0 +1,40 @@
+{
+  "params": {
+    "path": "/workspace",
+    "limit": 2,
+    "cursor": "c:src"
+  },
+  "response": {
+    "entries": [
+      {
+        "name": "src",
+        "metadata": {
+          "kind": "directory",
+          "sizeBytes": 4096,
+          "executable": true,
+          "modifiedAtMs": 1761400000000,
+          "version": "v1:1761400000000000000:4096:7"
+        }
+      },
+      {
+        "name": "link",
+        "metadata": {
+          "kind": "symlink",
+          "sizeBytes": 6,
+          "modifiedAtMs": 1761400000000,
+          "symlinkTarget": "target",
+          "version": "v1:1761400000000000000:6:9"
+        }
+      }
+    ],
+    "nextCursor": "c:link",
+    "skippedEntryCount": 1
+  },
+  "error": {
+    "code": -32004,
+    "message": "/workspace/missing does not exist",
+    "data": {
+      "kind": "notFound"
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/data/fs.readFile.json b/crates/environment-protocol/fixtures/data/fs.readFile.json
new file mode 100644
index 000000000..e4deeccc3
--- /dev/null
+++ b/crates/environment-protocol/fixtures/data/fs.readFile.json
@@ -0,0 +1,21 @@
+{
+  "params": {
+    "path": "/workspace/src/lib.rs",
+    "offset": 1024,
+    "maxBytes": 65536
+  },
+  "response": {
+    "data": "aGVsbG8=",
+    "fileSize": 4096,
+    "truncated": true,
+    "version": "v1:1761400000000000000:4096:42"
+  },
+  "error": {
+    "code": -32007,
+    "message": "/dev/zero is not a regular file",
+    "data": {
+      "kind": "failedPrecondition",
+      "reason": "notRegularFile"
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/data/fs.remove.json b/crates/environment-protocol/fixtures/data/fs.remove.json
new file mode 100644
index 000000000..e2a9d4e7c
--- /dev/null
+++ b/crates/environment-protocol/fixtures/data/fs.remove.json
@@ -0,0 +1,16 @@
+{
+  "params": {
+    "path": "/workspace/build",
+    "recursive": true,
+    "force": true
+  },
+  "response": {},
+  "error": {
+    "code": -32003,
+    "message": "/var/lib/lightspeed-envd is the daemon state directory",
+    "data": {
+      "kind": "permissionDenied",
+      "reason": "daemonState"
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/data/fs.rename.json b/crates/environment-protocol/fixtures/data/fs.rename.json
new file mode 100644
index 000000000..cbca3341d
--- /dev/null
+++ b/crates/environment-protocol/fixtures/data/fs.rename.json
@@ -0,0 +1,16 @@
+{
+  "params": {
+    "source": "/workspace/a.rs",
+    "destination": "/workspace/b.rs",
+    "overwrite": true,
+    "ifMatch": "v1:1761400000000000000:4096:42"
+  },
+  "response": {},
+  "error": {
+    "code": -32009,
+    "message": "/workspace/b.rs exists",
+    "data": {
+      "kind": "alreadyExists"
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/data/fs.scan.json b/crates/environment-protocol/fixtures/data/fs.scan.json
new file mode 100644
index 000000000..b4ad2ca79
--- /dev/null
+++ b/crates/environment-protocol/fixtures/data/fs.scan.json
@@ -0,0 +1,89 @@
+{
+  "params": {
+    "roots": [
+      {
+        "path": "/workspace",
+        "maxDepth": 0
+      },
+      {
+        "path": "/workspace/.agents/skills",
+        "ifNoneMatch": "scan:v1:9f2c"
+      },
+      {
+        "path": "/home/dev/.agents/skills"
+      }
+    ],
+    "filter": {
+      "include": [
+        "SKILL.md",
+        "*/SKILL.md"
+      ],
+      "maxDepth": 2
+    },
+    "readContent": true,
+    "includeDigests": true,
+    "followSymlinks": true,
+    "limits": {
+      "maxEntries": 4096,
+      "maxFileBytes": 65536,
+      "maxTotalBytes": 4194304,
+      "maxDurationMs": 2000
+    }
+  },
+  "response": {
+    "roots": [
+      {
+        "kind": "complete",
+        "path": "/workspace",
+        "fingerprint": "scan:v1:0001"
+      },
+      {
+        "kind": "unchanged",
+        "path": "/workspace/.agents/skills",
+        "fingerprint": "scan:v1:9f2c"
+      },
+      {
+        "kind": "complete",
+        "path": "/home/dev/.agents/skills",
+        "canonicalPath": "/home/dev/dotfiles/skills",
+        "fingerprint": "scan:v1:77aa",
+        "entries": [
+          {
+            "path": "review",
+            "content": {
+              "kind": "directory"
+            }
+          },
+          {
+            "path": "review/SKILL.md",
+            "content": {
+              "kind": "file",
+              "sizeBytes": 5,
+              "digest": "sha256:abababababababababababababababababababababababababababababababab"
+            },
+            "data": "aGVsbG8="
+          }
+        ],
+        "skipped": [
+          {
+            "path": "huge/SKILL.md",
+            "reason": "fileTooLarge"
+          },
+          {
+            "reason": "nonUtf8Name"
+          }
+        ],
+        "skippedEntryCount": 2
+      }
+    ]
+  },
+  "error": {
+    "code": -32602,
+    "message": "roots has 40 entries; the ceiling is 32",
+    "data": {
+      "kind": "invalidParams",
+      "field": "roots",
+      "ceiling": 32
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/data/fs.searchText.json b/crates/environment-protocol/fixtures/data/fs.searchText.json
new file mode 100644
index 000000000..59f51f6eb
--- /dev/null
+++ b/crates/environment-protocol/fixtures/data/fs.searchText.json
@@ -0,0 +1,47 @@
+{
+  "params": {
+    "root": "/workspace",
+    "pattern": "fn main",
+    "patternIgnoreCase": true,
+    "filter": {
+      "include": [
+        "**/*.rs"
+      ],
+      "exclude": [
+        "target/**"
+      ],
+      "maxDepth": 8
+    },
+    "limits": {
+      "maxMatches": 1000,
+      "maxFiles": 5000,
+      "maxBytes": 67108864,
+      "maxDurationMs": 30000,
+      "maxLineBytes": 4096
+    }
+  },
+  "response": {
+    "matches": [
+      {
+        "path": "/workspace/src/main.rs",
+        "lineNumber": 3,
+        "line": "fn main() {"
+      }
+    ],
+    "searchedFileCount": 120,
+    "searchedBytes": 480000,
+    "skippedFileCount": 2,
+    "skippedEntryCount": 1,
+    "elapsedMs": 41,
+    "stopped": "matchLimit"
+  },
+  "error": {
+    "code": -32602,
+    "message": "limits.maxDurationMs is 90000; the ceiling is 60000",
+    "data": {
+      "kind": "invalidParams",
+      "field": "limits.maxDurationMs",
+      "ceiling": 60000
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/data/fs.writeFile.json b/crates/environment-protocol/fixtures/data/fs.writeFile.json
new file mode 100644
index 000000000..15ba5f557
--- /dev/null
+++ b/crates/environment-protocol/fixtures/data/fs.writeFile.json
@@ -0,0 +1,20 @@
+{
+  "params": {
+    "path": "/workspace/src/lib.rs",
+    "data": "aGVsbG8=",
+    "create": "ifPresent",
+    "ifMatch": "v1:1761400000000000000:4096:42",
+    "executable": true
+  },
+  "response": {
+    "version": "v1:1761400001000000000:5:42"
+  },
+  "error": {
+    "code": -32007,
+    "message": "/workspace/src/lib.rs changed since it was read",
+    "data": {
+      "kind": "failedPrecondition",
+      "reason": "ifMatchFailed"
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/data/initialize.json b/crates/environment-protocol/fixtures/data/initialize.json
new file mode 100644
index 000000000..2c98620d0
--- /dev/null
+++ b/crates/environment-protocol/fixtures/data/initialize.json
@@ -0,0 +1,97 @@
+{
+  "params": {
+    "protocolVersion": 3,
+    "clientInfo": {
+      "name": "lightspeed-runtime",
+      "version": "0.5.0"
+    }
+  },
+  "response": {
+    "protocolVersion": 3,
+    "plane": "data",
+    "daemonInstanceId": "envd_01jb8x7k2m",
+    "serverInfo": {
+      "name": "lightspeed-envd",
+      "version": "0.5.0",
+      "gitSha": "86f6adf3",
+      "target": "x86_64-unknown-linux-musl"
+    },
+    "capabilities": {
+      "filesystem": {
+        "write": true
+      },
+      "process": {
+        "pty": true
+      },
+      "job": {}
+    },
+    "limits": {
+      "maxConcurrentRequests": 32,
+      "maxWaitMs": 1800000,
+      "process": {
+        "maxReadBytes": 4194304,
+        "maxRetainedOutputBytes": 1048576,
+        "retentionAfterExitMs": 60000,
+        "unreadRetentionMs": 7200000,
+        "maxExitedRetainedBytes": 67108864,
+        "terminateGraceMs": 5000,
+        "maxInputQueueBytes": 1048576
+      },
+      "job": {
+        "maxReadBytes": 4194304,
+        "maxRequestJobs": 64,
+        "maxRetainedOutputBytes": 2097152,
+        "recordRetentionMs": 604800000,
+        "cancelGraceMs": 5000
+      },
+      "filesystem": {
+        "maxReadFileBytes": 8388608,
+        "maxWriteFileBytes": 8388608,
+        "maxDirectoryEntries": 1000,
+        "search": {
+          "maxMatches": 10000,
+          "maxFiles": 100000,
+          "maxBytes": 1073741824,
+          "maxDurationMs": 60000,
+          "maxLineBytes": 4096
+        },
+        "glob": {
+          "maxMatches": 100000,
+          "maxFiles": 1000000,
+          "maxDurationMs": 60000
+        },
+        "scan": {
+          "maxRoots": 32,
+          "maxPatterns": 32,
+          "maxEntries": 10000,
+          "maxFileBytes": 262144,
+          "maxTotalBytes": 4194304,
+          "maxDurationMs": 30000
+        },
+        "transfer": {
+          "maxActiveOperations": 8,
+          "maxContentChunkBytes": 4194304,
+          "maxInventoryPageEntries": 1000,
+          "receiptRetentionMs": 86400000,
+          "maxEntries": 100000,
+          "maxDepth": 64,
+          "maxFileBytes": 1099511627776,
+          "maxTotalBytes": 1099511627776,
+          "maxManifestBytes": 33554432,
+          "maxDurationMs": 86400000
+        }
+      }
+    },
+    "defaultCwd": "/workspace",
+    "homeDirectory": "/home/dev"
+  },
+  "error": {
+    "code": -32005,
+    "message": "protocol version 2 is not supported; this peer speaks 3",
+    "data": {
+      "kind": "versionMismatch",
+      "expected": 3,
+      "received": 2
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/data/job.cancel.json b/crates/environment-protocol/fixtures/data/job.cancel.json
new file mode 100644
index 000000000..d16db2602
--- /dev/null
+++ b/crates/environment-protocol/fixtures/data/job.cancel.json
@@ -0,0 +1,43 @@
+{
+  "params": {
+    "jobIds": [
+      "build"
+    ],
+    "scope": "dependents",
+    "force": true
+  },
+  "response": {
+    "jobs": [
+      {
+        "kind": "job",
+        "summary": {
+          "jobId": "build",
+          "requestId": "jobreq-run1-turn2-call3",
+          "status": "running",
+          "createdAtMs": 1761400000000,
+          "startedAtMs": 1761400000200,
+          "cancelRequestedAtMs": 1761400005000
+        }
+      },
+      {
+        "kind": "error",
+        "jobId": "deploy",
+        "error": {
+          "code": -32004,
+          "message": "unknown job id: deploy",
+          "data": {
+            "kind": "notFound"
+          }
+        }
+      }
+    ]
+  },
+  "error": {
+    "code": -32602,
+    "message": "jobIds must not be empty",
+    "data": {
+      "kind": "invalidParams",
+      "field": "jobIds"
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/data/job.read.json b/crates/environment-protocol/fixtures/data/job.read.json
new file mode 100644
index 000000000..811427576
--- /dev/null
+++ b/crates/environment-protocol/fixtures/data/job.read.json
@@ -0,0 +1,115 @@
+{
+  "params": {
+    "jobs": [
+      {
+        "jobId": "build",
+        "tailBytes": 8192,
+        "maxBytes": 8192
+      },
+      {
+        "jobId": "setup",
+        "after": 512
+      },
+      {
+        "jobId": "gone"
+      }
+    ],
+    "maxBytes": 16384,
+    "waitMs": 0,
+    "returnOn": "exit"
+  },
+  "response": {
+    "jobs": [
+      {
+        "kind": "job",
+        "summary": {
+          "jobId": "build",
+          "requestId": "jobreq-run1-turn2-call3",
+          "name": "build",
+          "status": "failed",
+          "dependsOn": [
+            "setup"
+          ],
+          "queueKey": "cargo",
+          "createdAtMs": 1761400000000,
+          "queuedAtMs": 1761400000100,
+          "startedAtMs": 1761400000200,
+          "finishedAtMs": 1761400009200,
+          "durationMs": 9000,
+          "exit": {
+            "kind": "code",
+            "code": 101
+          },
+          "leftovers": {
+            "disposition": "swept",
+            "processes": [
+              {
+                "pid": 4242,
+                "command": "sleep 600"
+              }
+            ]
+          },
+          "error": {
+            "code": -32018,
+            "message": "output capture failed",
+            "data": {
+              "kind": "processFailed"
+            }
+          }
+        },
+        "output": {
+          "chunks": [
+            {
+              "offset": 3000000,
+              "stream": "stderr",
+              "data": "ZXJyb3I="
+            }
+          ],
+          "next": 3000005,
+          "end": 3000005
+        }
+      },
+      {
+        "kind": "job",
+        "summary": {
+          "jobId": "setup",
+          "requestId": "jobreq-run1-turn2-call3",
+          "name": "setup",
+          "status": "succeeded",
+          "createdAtMs": 1761400000000,
+          "startedAtMs": 1761400000050,
+          "finishedAtMs": 1761400003050,
+          "durationMs": 3000,
+          "exit": {
+            "kind": "code",
+            "code": 0
+          }
+        },
+        "output": {
+          "next": 512,
+          "end": 512
+        }
+      },
+      {
+        "kind": "error",
+        "jobId": "gone",
+        "error": {
+          "code": -32004,
+          "message": "unknown job id: gone",
+          "data": {
+            "kind": "notFound"
+          }
+        }
+      }
+    ]
+  },
+  "error": {
+    "code": -32602,
+    "message": "waitMs is 3600000; the ceiling is 1800000",
+    "data": {
+      "kind": "invalidParams",
+      "field": "waitMs",
+      "ceiling": 1800000
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/data/job.start.json b/crates/environment-protocol/fixtures/data/job.start.json
new file mode 100644
index 000000000..af185d018
--- /dev/null
+++ b/crates/environment-protocol/fixtures/data/job.start.json
@@ -0,0 +1,75 @@
+{
+  "params": {
+    "requestId": "jobreq-run1-turn2-call3",
+    "jobs": [
+      {
+        "jobId": "setup",
+        "name": "setup",
+        "command": {
+          "argv": [
+            "npm",
+            "ci"
+          ]
+        }
+      },
+      {
+        "jobId": "build",
+        "command": {
+          "argv": [
+            "cargo",
+            "build"
+          ],
+          "cwd": "/workspace",
+          "input": {
+            "kind": "bytes",
+            "data": "aGVsbG8="
+          },
+          "timeoutMs": 1800000
+        },
+        "dependsOn": [
+          {
+            "kind": "name",
+            "name": "setup"
+          },
+          {
+            "kind": "jobId",
+            "jobId": "lint"
+          }
+        ],
+        "dependencyPolicy": "allTerminal",
+        "queueKey": "cargo"
+      }
+    ]
+  },
+  "response": {
+    "jobs": [
+      {
+        "jobId": "setup",
+        "requestId": "jobreq-run1-turn2-call3",
+        "name": "setup",
+        "status": "running",
+        "createdAtMs": 1761400000000,
+        "startedAtMs": 1761400000050
+      },
+      {
+        "jobId": "build",
+        "requestId": "jobreq-run1-turn2-call3",
+        "status": "queued",
+        "dependsOn": [
+          "setup",
+          "lint"
+        ],
+        "queueKey": "cargo",
+        "createdAtMs": 1761400000000
+      }
+    ]
+  },
+  "error": {
+    "code": -32007,
+    "message": "job id build names an earlier run; choose a new job id",
+    "data": {
+      "kind": "failedPrecondition",
+      "reason": "jobIdInUse"
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/data/process.read.json b/crates/environment-protocol/fixtures/data/process.read.json
new file mode 100644
index 000000000..74529eb76
--- /dev/null
+++ b/crates/environment-protocol/fixtures/data/process.read.json
@@ -0,0 +1,63 @@
+{
+  "params": {
+    "processId": "proc-7",
+    "after": 16384,
+    "ack": 16384,
+    "maxBytes": 65536,
+    "waitMs": 20000,
+    "returnOn": "anyOutput"
+  },
+  "response": {
+    "output": {
+      "chunks": [
+        {
+          "offset": 16384,
+          "stream": "stdout",
+          "data": "aGVsbG8="
+        },
+        {
+          "offset": 1048581,
+          "stream": "stderr",
+          "data": "ZmFpbA=="
+        }
+      ],
+      "next": 1048585,
+      "end": 1048585,
+      "gaps": [
+        {
+          "offset": 16389,
+          "omittedBytes": 1032192,
+          "reason": "overflow"
+        }
+      ]
+    },
+    "state": "exited",
+    "exit": {
+      "kind": "signal",
+      "signal": "SIGSEGV",
+      "coreDumped": true
+    },
+    "stoppedBy": "terminate",
+    "pid": 4242,
+    "leftovers": {
+      "disposition": "kept",
+      "processes": [
+        {
+          "pid": 4250,
+          "command": "postgres -D /data"
+        },
+        {
+          "pid": 4251
+        }
+      ]
+    }
+  },
+  "error": {
+    "code": -32004,
+    "message": "unknown process id: proc-7",
+    "data": {
+      "kind": "notFound",
+      "reason": "expired"
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/data/process.start.json b/crates/environment-protocol/fixtures/data/process.start.json
new file mode 100644
index 000000000..0cf4495bc
--- /dev/null
+++ b/crates/environment-protocol/fixtures/data/process.start.json
@@ -0,0 +1,38 @@
+{
+  "params": {
+    "processId": "proc-7",
+    "command": {
+      "argv": [
+        "sh",
+        "-lc",
+        "cat"
+      ],
+      "cwd": "/workspace",
+      "env": {
+        "RUST_LOG": "debug"
+      },
+      "secretEnv": {
+        "API_TOKEN": "s3cr3t"
+      },
+      "input": {
+        "kind": "bytes",
+        "data": "aGVsbG8="
+      },
+      "timeoutMs": 600000
+    },
+    "pty": {
+      "rows": 40,
+      "cols": 120
+    }
+  },
+  "response": {
+    "pid": 4242
+  },
+  "error": {
+    "code": -32009,
+    "message": "process id proc-7 is in use",
+    "data": {
+      "kind": "alreadyExists"
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/data/process.terminate.json b/crates/environment-protocol/fixtures/data/process.terminate.json
new file mode 100644
index 000000000..e0596a728
--- /dev/null
+++ b/crates/environment-protocol/fixtures/data/process.terminate.json
@@ -0,0 +1,17 @@
+{
+  "params": {
+    "processId": "proc-7",
+    "signal": "terminate"
+  },
+  "response": {
+    "running": true
+  },
+  "error": {
+    "code": -32004,
+    "message": "unknown process id: proc-7",
+    "data": {
+      "kind": "notFound",
+      "reason": "daemonRestarted"
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/data/process.write.json b/crates/environment-protocol/fixtures/data/process.write.json
new file mode 100644
index 000000000..efff05c73
--- /dev/null
+++ b/crates/environment-protocol/fixtures/data/process.write.json
@@ -0,0 +1,18 @@
+{
+  "params": {
+    "processId": "proc-7",
+    "data": "aGVsbG8K",
+    "closeInput": true
+  },
+  "response": {
+    "acceptedBytes": 6
+  },
+  "error": {
+    "code": -32007,
+    "message": "process proc-7 has no open input",
+    "data": {
+      "kind": "failedPrecondition",
+      "reason": "inputClosed"
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/data/rpc.cancelRequest.json b/crates/environment-protocol/fixtures/data/rpc.cancelRequest.json
new file mode 100644
index 000000000..b3e9ca10a
--- /dev/null
+++ b/crates/environment-protocol/fixtures/data/rpc.cancelRequest.json
@@ -0,0 +1,5 @@
+{
+  "params": {
+    "id": 42
+  }
+}
diff --git a/crates/environment-protocol/fixtures/data/transfer.abort.json b/crates/environment-protocol/fixtures/data/transfer.abort.json
new file mode 100644
index 000000000..8229f7231
--- /dev/null
+++ b/crates/environment-protocol/fixtures/data/transfer.abort.json
@@ -0,0 +1,22 @@
+{
+  "params": {
+    "operationId": "op-2"
+  },
+  "response": {
+    "operationId": "op-2",
+    "phase": "aborted",
+    "entryCount": 3,
+    "totalBytes": 2048,
+    "transferredBytes": 1024,
+    "reusedBytes": 512,
+    "deadlineAtMs": 1761400000000,
+    "receiptExpiresAtMs": 1761486400000
+  },
+  "error": {
+    "code": -32004,
+    "message": "unknown operation op-2",
+    "data": {
+      "kind": "notFound"
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/data/transfer.advance.json b/crates/environment-protocol/fixtures/data/transfer.advance.json
new file mode 100644
index 000000000..c6f52bfba
--- /dev/null
+++ b/crates/environment-protocol/fixtures/data/transfer.advance.json
@@ -0,0 +1,38 @@
+{
+  "params": {
+    "operationId": "op-1"
+  },
+  "response": {
+    "operationId": "op-1",
+    "phase": "failed",
+    "entryCount": 3,
+    "totalBytes": 2048,
+    "transferredBytes": 1024,
+    "reusedBytes": 512,
+    "deadlineAtMs": 1761400000000,
+    "skipped": [
+      {
+        "path": "node_modules/.bin/tsc",
+        "reason": "symlink"
+      }
+    ],
+    "skippedEntryCount": 140,
+    "error": {
+      "code": -32017,
+      "message": "src/lib.rs changed while it was read",
+      "data": {
+        "kind": "aborted",
+        "reason": "sourceChanged"
+      }
+    },
+    "receiptExpiresAtMs": 1761486400000
+  },
+  "error": {
+    "code": -32007,
+    "message": "advance is not valid in the complete phase",
+    "data": {
+      "kind": "failedPrecondition",
+      "reason": "transferPhase"
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/data/transfer.append.json b/crates/environment-protocol/fixtures/data/transfer.append.json
new file mode 100644
index 000000000..4270216ae
--- /dev/null
+++ b/crates/environment-protocol/fixtures/data/transfer.append.json
@@ -0,0 +1,40 @@
+{
+  "params": {
+    "operationId": "op-2",
+    "index": 0,
+    "entries": [
+      {
+        "path": ".",
+        "content": {
+          "kind": "directory"
+        }
+      },
+      {
+        "path": "README.md",
+        "content": {
+          "kind": "file",
+          "sizeBytes": 12,
+          "digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd"
+        }
+      }
+    ],
+    "last": true
+  },
+  "response": {
+    "operationId": "op-2",
+    "phase": "scanning",
+    "entryCount": 2,
+    "totalBytes": 12,
+    "transferredBytes": 0,
+    "reusedBytes": 0,
+    "deadlineAtMs": 1761400000000
+  },
+  "error": {
+    "code": -32007,
+    "message": "operation op-2 was begun with different input",
+    "data": {
+      "kind": "failedPrecondition",
+      "reason": "operationIdInUse"
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/data/transfer.begin.json b/crates/environment-protocol/fixtures/data/transfer.begin.json
new file mode 100644
index 000000000..7b548e881
--- /dev/null
+++ b/crates/environment-protocol/fixtures/data/transfer.begin.json
@@ -0,0 +1,43 @@
+{
+  "params": {
+    "operationId": "op-1",
+    "selection": {
+      "kind": "capture",
+      "source": "/workspace",
+      "filter": {
+        "exclude": [
+          "node_modules/**",
+          ".git/**"
+        ]
+      },
+      "symlinks": "skip",
+      "specialFiles": "skip"
+    },
+    "limits": {
+      "maxEntries": 100000,
+      "maxDepth": 64,
+      "maxFileBytes": 1073741824,
+      "maxTotalBytes": 1073741824,
+      "maxManifestBytes": 33554432,
+      "maxDurationMs": 86400000
+    }
+  },
+  "response": {
+    "operationId": "op-1",
+    "phase": "scanning",
+    "entryCount": 0,
+    "totalBytes": 0,
+    "transferredBytes": 0,
+    "reusedBytes": 0,
+    "deadlineAtMs": 1761400000000
+  },
+  "error": {
+    "code": -32008,
+    "message": "8 transfers are active",
+    "data": {
+      "kind": "busy",
+      "reason": "transferCapacity",
+      "retryAfterMs": 1000
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/data/transfer.commit.json b/crates/environment-protocol/fixtures/data/transfer.commit.json
new file mode 100644
index 000000000..b78e69dd6
--- /dev/null
+++ b/crates/environment-protocol/fixtures/data/transfer.commit.json
@@ -0,0 +1,22 @@
+{
+  "params": {
+    "operationId": "op-2"
+  },
+  "response": {
+    "operationId": "op-2",
+    "phase": "complete",
+    "entryCount": 3,
+    "totalBytes": 2048,
+    "transferredBytes": 1024,
+    "reusedBytes": 512,
+    "deadlineAtMs": 1761400000000,
+    "receiptExpiresAtMs": 1761486400000
+  },
+  "error": {
+    "code": -32015,
+    "message": "operation op-2 ran out of its 86400000 ms",
+    "data": {
+      "kind": "deadlineExceeded"
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/data/transfer.getStatus.json b/crates/environment-protocol/fixtures/data/transfer.getStatus.json
new file mode 100644
index 000000000..8ce8c3a14
--- /dev/null
+++ b/crates/environment-protocol/fixtures/data/transfer.getStatus.json
@@ -0,0 +1,23 @@
+{
+  "params": {
+    "operationId": "op-1"
+  },
+  "response": {
+    "operationId": "op-1",
+    "phase": "complete",
+    "entryCount": 3,
+    "totalBytes": 2048,
+    "transferredBytes": 1024,
+    "reusedBytes": 512,
+    "deadlineAtMs": 1761400000000,
+    "receiptExpiresAtMs": 1761486400000
+  },
+  "error": {
+    "code": -32004,
+    "message": "transfer receipt op-1 expired",
+    "data": {
+      "kind": "notFound",
+      "reason": "expired"
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/data/transfer.listMissing.json b/crates/environment-protocol/fixtures/data/transfer.listMissing.json
new file mode 100644
index 000000000..2bc25ac9f
--- /dev/null
+++ b/crates/environment-protocol/fixtures/data/transfer.listMissing.json
@@ -0,0 +1,20 @@
+{
+  "params": {
+    "operationId": "op-2",
+    "limit": 64
+  },
+  "response": {
+    "digests": [
+      "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd"
+    ],
+    "remainingCount": 3
+  },
+  "error": {
+    "code": -32007,
+    "message": "listMissing is not valid in the inventory phase",
+    "data": {
+      "kind": "failedPrecondition",
+      "reason": "transferPhase"
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/data/transfer.read.json b/crates/environment-protocol/fixtures/data/transfer.read.json
new file mode 100644
index 000000000..70d89110e
--- /dev/null
+++ b/crates/environment-protocol/fixtures/data/transfer.read.json
@@ -0,0 +1,18 @@
+{
+  "params": {
+    "operationId": "op-1",
+    "digest": "sha256:abababababababababababababababababababababababababababababababab",
+    "offset": 0,
+    "maxBytes": 4194304
+  },
+  "response": {
+    "data": "aGVsbG8="
+  },
+  "error": {
+    "code": -32004,
+    "message": "digest is not part of the inventory",
+    "data": {
+      "kind": "notFound"
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/data/transfer.readInventory.json b/crates/environment-protocol/fixtures/data/transfer.readInventory.json
new file mode 100644
index 000000000..5a6a26baf
--- /dev/null
+++ b/crates/environment-protocol/fixtures/data/transfer.readInventory.json
@@ -0,0 +1,35 @@
+{
+  "params": {
+    "operationId": "op-1",
+    "index": 0,
+    "limit": 128
+  },
+  "response": {
+    "entries": [
+      {
+        "path": ".",
+        "content": {
+          "kind": "directory"
+        }
+      },
+      {
+        "path": "bin/tool",
+        "content": {
+          "kind": "file",
+          "sizeBytes": 2048,
+          "executable": true,
+          "digest": "sha256:abababababababababababababababababababababababababababababababab"
+        }
+      }
+    ],
+    "nextIndex": 2
+  },
+  "error": {
+    "code": -32007,
+    "message": "the inventory is not sealed yet",
+    "data": {
+      "kind": "failedPrecondition",
+      "reason": "transferPhase"
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/data/transfer.write.json b/crates/environment-protocol/fixtures/data/transfer.write.json
new file mode 100644
index 000000000..080567086
--- /dev/null
+++ b/crates/environment-protocol/fixtures/data/transfer.write.json
@@ -0,0 +1,19 @@
+{
+  "params": {
+    "operationId": "op-2",
+    "digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
+    "offset": 0,
+    "data": "aGVsbG8gd29ybGQK"
+  },
+  "response": {
+    "nextOffset": 12
+  },
+  "error": {
+    "code": -32007,
+    "message": "uploaded bytes do not hash to the digest",
+    "data": {
+      "kind": "failedPrecondition",
+      "reason": "digestMismatch"
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/data_initialize_params.json b/crates/environment-protocol/fixtures/data_initialize_params.json
deleted file mode 100644
index 0e07e72db..000000000
--- a/crates/environment-protocol/fixtures/data_initialize_params.json
+++ /dev/null
@@ -1,9 +0,0 @@
-{
-  "clientName": "lightspeed-test",
-  "protocolVersion": 2,
-  "resumeConnectionId": "conn-prev",
-  "scope": {
-    "sessionId": "sandbox-123",
-    "type": "session"
-  }
-}
diff --git a/crates/environment-protocol/fixtures/fs_read_file_response.json b/crates/environment-protocol/fixtures/fs_read_file_response.json
deleted file mode 100644
index 5340bffb7..000000000
--- a/crates/environment-protocol/fixtures/fs_read_file_response.json
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-  "data": "aGVsbG8K"
-}
diff --git a/crates/environment-protocol/fixtures/job_read_response.json b/crates/environment-protocol/fixtures/job_read_response.json
deleted file mode 100644
index b8656ee16..000000000
--- a/crates/environment-protocol/fixtures/job_read_response.json
+++ /dev/null
@@ -1,39 +0,0 @@
-{
-  "jobs": [
-    {
-      "artifacts": [
-        {
-          "kind": "file",
-          "metadata": {
-            "role": "report"
-          },
-          "path": "/workspace/result.txt"
-        }
-      ],
-      "outputChunks": [
-        {
-          "chunk": "b2sK",
-          "seq": 1,
-          "stream": "stdout"
-        }
-      ],
-      "outputNextSeq": 2,
-      "summary": {
-        "createdAtMs": 1,
-        "dependencies": [
-          "checkout"
-        ],
-        "exitCode": 0,
-        "finishedAtMs": 4,
-        "jobId": "tests",
-        "name": "tests",
-        "namespace": "session_1",
-        "orphanedDescendants": true,
-        "queuedAtMs": 2,
-        "queueKey": "repo",
-        "startedAtMs": 3,
-        "status": "succeeded"
-      }
-    }
-  ]
-}
diff --git a/crates/environment-protocol/fixtures/job_start_params.json b/crates/environment-protocol/fixtures/job_start_params.json
deleted file mode 100644
index 64fd721b4..000000000
--- a/crates/environment-protocol/fixtures/job_start_params.json
+++ /dev/null
@@ -1,27 +0,0 @@
-{
-  "jobs": [
-    {
-      "argv": [
-        "git",
-        "status"
-      ],
-      "cwd": "/workspace",
-      "dependencyPolicy": "allSucceeded",
-      "dependsOn": [
-        {
-          "name": "setup"
-        }
-      ],
-      "env": {
-        "RUST_LOG": "debug"
-      },
-      "name": "checkout",
-      "jobId": "checkout",
-      "queueKey": "repo",
-      "stdin": "aGVsbG8K",
-      "timeoutMs": 60000
-    }
-  ],
-  "namespace": "session_1",
-  "requestId": "request-1"
-}
diff --git a/crates/environment-protocol/fixtures/process_read_response.json b/crates/environment-protocol/fixtures/process_read_response.json
deleted file mode 100644
index 2141c3ff8..000000000
--- a/crates/environment-protocol/fixtures/process_read_response.json
+++ /dev/null
@@ -1,25 +0,0 @@
-{
-  "chunks": [
-    {
-      "chunk": "b2sK",
-      "seq": 1,
-      "stream": "stdout"
-    },
-    {
-      "chunk": "d2Fybgo=",
-      "seq": 2,
-      "stream": "stderr"
-    }
-  ],
-  "closed": true,
-  "exitCode": 0,
-  "exited": true,
-  "leftoverProcesses": [
-    {
-      "command": "python -m http.server 8080",
-      "pid": 91
-    }
-  ],
-  "nextSeq": 3,
-  "pid": 90
-}
diff --git a/crates/environment-protocol/fixtures/process_start_params.json b/crates/environment-protocol/fixtures/process_start_params.json
deleted file mode 100644
index 9c6e5a190..000000000
--- a/crates/environment-protocol/fixtures/process_start_params.json
+++ /dev/null
@@ -1,15 +0,0 @@
-{
-  "argv": [
-    "sh",
-    "-lc",
-    "cat"
-  ],
-  "cwd": "/workspace",
-  "env": {
-    "RUST_LOG": "debug"
-  },
-  "processId": "proc-1",
-  "stdin": "aW5wdXQK",
-  "timeoutMs": 60000,
-  "tty": false
-}
diff --git a/crates/environment-protocol/fixtures/registration/registration.challenge.json b/crates/environment-protocol/fixtures/registration/registration.challenge.json
new file mode 100644
index 000000000..055bcd29d
--- /dev/null
+++ b/crates/environment-protocol/fixtures/registration/registration.challenge.json
@@ -0,0 +1,6 @@
+{
+  "params": {
+    "protocolVersion": 3,
+    "nonce": "0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f"
+  }
+}
diff --git a/crates/environment-protocol/fixtures/registration/registration.closed.json b/crates/environment-protocol/fixtures/registration/registration.closed.json
new file mode 100644
index 000000000..975d0bdf1
--- /dev/null
+++ b/crates/environment-protocol/fixtures/registration/registration.closed.json
@@ -0,0 +1,6 @@
+{
+  "params": {
+    "reason": "superseded",
+    "message": "another process with this daemon identity connected"
+  }
+}
diff --git a/crates/environment-protocol/fixtures/registration/registration.goodbye.json b/crates/environment-protocol/fixtures/registration/registration.goodbye.json
new file mode 100644
index 000000000..3675fe277
--- /dev/null
+++ b/crates/environment-protocol/fixtures/registration/registration.goodbye.json
@@ -0,0 +1,5 @@
+{
+  "params": {
+    "reason": "shutdown"
+  }
+}
diff --git a/crates/environment-protocol/fixtures/registration/registration.openStream.json b/crates/environment-protocol/fixtures/registration/registration.openStream.json
new file mode 100644
index 000000000..31ac34c21
--- /dev/null
+++ b/crates/environment-protocol/fixtures/registration/registration.openStream.json
@@ -0,0 +1,16 @@
+{
+  "params": {
+    "token": "tok_5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a",
+    "stream": {
+      "kind": "dataProtocol"
+    }
+  },
+  "response": {},
+  "error": {
+    "code": -32019,
+    "message": "dialing wss://gw.example.com/environment-gateway/data failed: connection refused",
+    "data": {
+      "kind": "unavailable"
+    }
+  }
+}
diff --git a/crates/environment-protocol/fixtures/registration/registration.register.json b/crates/environment-protocol/fixtures/registration/registration.register.json
new file mode 100644
index 000000000..aeaaa0f3b
--- /dev/null
+++ b/crates/environment-protocol/fixtures/registration/registration.register.json
@@ -0,0 +1,37 @@
+{
+  "params": {
+    "protocolVersion": 3,
+    "registrationKey": "lsrk_0123456789abcdef",
+    "daemonPublicKey": "3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b",
+    "signature": "9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c",
+    "displayName": "ci-runner-7",
+    "metadata": {
+      "harbor.trialId": "trial-1"
+    },
+    "implementation": {
+      "name": "lightspeed-envd",
+      "version": "0.5.0",
+      "gitSha": "86f6adf3",
+      "target": "x86_64-unknown-linux-musl"
+    }
+  },
+  "response": {
+    "receipt": {
+      "environmentId": "env_1",
+      "incarnationId": "inc_1",
+      "daemonId": "daemon_3b3b",
+      "controlConnectionId": "connection_7",
+      "identityMode": "ephemeral",
+      "admission": "created"
+    },
+    "heartbeatIntervalMs": 30000
+  },
+  "error": {
+    "code": -32003,
+    "message": "the registration signature does not verify",
+    "data": {
+      "kind": "permissionDenied",
+      "reason": "invalidSignature"
+    }
+  }
+}
diff --git a/crates/environment-protocol/src/bin/export-contract.rs b/crates/environment-protocol/src/bin/export-contract.rs
new file mode 100644
index 000000000..b3f077732
--- /dev/null
+++ b/crates/environment-protocol/src/bin/export-contract.rs
@@ -0,0 +1,25 @@
+//! Writes the committed contract under `crates/environment-protocol/contract/`.
+//!
+//! Usage: `cargo run -p environment-protocol --features schema --bin export-contract [output-dir]`
+
+use std::{env, fs, path::PathBuf};
+
+fn main() {
+    let out_dir = env::args()
+        .nth(1)
+        .map(PathBuf::from)
+        .unwrap_or_else(|| PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("contract"));
+    fs::create_dir_all(&out_dir).expect("create output directory");
+    for plane in environment_protocol::contract::export() {
+        for (name, value) in [
+            (plane.schema_file_name(), &plane.schema_bundle),
+            (plane.openrpc_file_name(), &plane.openrpc),
+        ] {
+            let mut text = serde_json::to_string_pretty(value).expect("serialize contract");
+            text.push('\n');
+            let path = out_dir.join(name);
+            fs::write(&path, text).expect("write contract");
+            println!("wrote {}", path.display());
+        }
+    }
+}
diff --git a/crates/environment-protocol/src/bootstrap.rs b/crates/environment-protocol/src/bootstrap.rs
new file mode 100644
index 000000000..fe995ffda
--- /dev/null
+++ b/crates/environment-protocol/src/bootstrap.rs
@@ -0,0 +1,70 @@
+//! The frozen bootstrap surface besides the `registration/challenge` frame:
+//! the envd discovery document the gateway serves at
+//! [`DISCOVERY_PATH`](crate::routes::DISCOVERY_PATH), and the build facts
+//! `lightspeed-envd --print-build` prints.
+//!
+//! Daemons of every version read these to upgrade themselves, so they only
+//! ever gain fields and are decoded tolerantly: unknown members are
+//! ignored.
+
+use std::collections::BTreeMap;
+
+use serde::{Deserialize, Serialize};
+
+use crate::bytes::hex_value;
+
+hex_value!(
+    /// `sha256` of a published archive: 64 lowercase hex digits.
+    ArtifactSha256,
+    32,
+    "^[0-9a-f]{64}$"
+);
+
+/// The discovery document.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase")]
+pub struct DiscoveryDocument {
+    /// Release version of the published envd.
+    pub version: String,
+    pub git_sha: String,
+    /// Release channel, such as `stable` or `snapshot`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub channel: Option<String>,
+    /// The published envd's `ENVD_PROTOCOL_VERSION`.
+    pub protocol_version: u32,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub built_at_ms: Option<i64>,
+    /// Archives by Rust target triple.
+    pub artifacts: BTreeMap<String, DiscoveryArtifact>,
+}
+
+/// One published envd archive.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase")]
+pub struct DiscoveryArtifact {
+    /// Archive file name.
+    pub file: String,
+    /// Digest of the archive's bytes.
+    pub sha256: ArtifactSha256,
+    /// Absolute download URL; absent (or null) when the archive is served
+    /// next to the document.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub url: Option<String>,
+}
+
+/// What `lightspeed-envd --print-build` prints, as one JSON object.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase")]
+pub struct BuildFacts {
+    /// Always `lightspeed-envd`.
+    pub name: String,
+    pub version: String,
+    pub git_sha: String,
+    /// Rust target triple.
+    pub target: String,
+    /// The binary's `ENVD_PROTOCOL_VERSION`.
+    pub protocol_version: u32,
+}
diff --git a/crates/environment-protocol/src/bytes.rs b/crates/environment-protocol/src/bytes.rs
new file mode 100644
index 000000000..35b8b84cf
--- /dev/null
+++ b/crates/environment-protocol/src/bytes.rs
@@ -0,0 +1,303 @@
+//! Byte encodings.
+//!
+//! Payload bytes are padded standard base64 ([`ByteChunk`]). Fixed-size
+//! cryptographic values are canonical lowercase hex, decoded byte by byte
+//! so malformed input fails cleanly and never panics.
+
+use std::fmt;
+
+use base64::{Engine as _, engine::general_purpose::STANDARD as BASE64_STANDARD};
+use serde::{Deserialize, Deserializer, Serialize, Serializer, de::Error as _};
+use thiserror::Error;
+
+/// JSON Schema pattern of padded standard base64.
+pub const BASE64_PATTERN: &str = "^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$";
+
+/// Payload bytes, always named `data` on the wire, as padded standard
+/// base64.
+#[derive(Clone, Default, PartialEq, Eq, Hash)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+pub struct ByteChunk(
+    #[cfg_attr(
+        feature = "schema",
+        schemars(
+            with = "String",
+            pattern(BASE64_PATTERN),
+            extend("contentEncoding" = "base64")
+        )
+    )]
+    Vec<u8>,
+);
+
+impl ByteChunk {
+    pub fn new(bytes: impl Into<Vec<u8>>) -> Self {
+        Self(bytes.into())
+    }
+
+    pub fn into_inner(self) -> Vec<u8> {
+        self.0
+    }
+
+    pub fn as_slice(&self) -> &[u8] {
+        &self.0
+    }
+
+    pub fn len(&self) -> usize {
+        self.0.len()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.0.is_empty()
+    }
+}
+
+impl fmt::Debug for ByteChunk {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(formatter, "ByteChunk({} bytes)", self.0.len())
+    }
+}
+
+impl From<Vec<u8>> for ByteChunk {
+    fn from(value: Vec<u8>) -> Self {
+        Self(value)
+    }
+}
+
+impl From<&[u8]> for ByteChunk {
+    fn from(value: &[u8]) -> Self {
+        Self(value.to_vec())
+    }
+}
+
+impl Serialize for ByteChunk {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        serializer.serialize_str(&BASE64_STANDARD.encode(&self.0))
+    }
+}
+
+impl<'de> Deserialize<'de> for ByteChunk {
+    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        let encoded = String::deserialize(deserializer)?;
+        BASE64_STANDARD
+            .decode(encoded)
+            .map(Self)
+            .map_err(D::Error::custom)
+    }
+}
+
+/// A secret value carried on the wire, such as a `secretEnv` value, a
+/// registration key or a stream token. It serializes as a plain string;
+/// `Debug` is redacted so structured logging never prints it.
+#[derive(Clone, PartialEq, Eq)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[cfg_attr(feature = "schema", schemars(with = "String"))]
+pub struct SecretString(String);
+
+impl SecretString {
+    pub fn new(value: impl Into<String>) -> Self {
+        Self(value.into())
+    }
+
+    pub fn expose(&self) -> &str {
+        &self.0
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.0.is_empty()
+    }
+}
+
+impl fmt::Debug for SecretString {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str("SecretString(<redacted>)")
+    }
+}
+
+impl From<String> for SecretString {
+    fn from(value: String) -> Self {
+        Self(value)
+    }
+}
+
+impl From<&str> for SecretString {
+    fn from(value: &str) -> Self {
+        Self(value.to_owned())
+    }
+}
+
+impl Serialize for SecretString {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        serializer.serialize_str(&self.0)
+    }
+}
+
+impl<'de> Deserialize<'de> for SecretString {
+    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        String::deserialize(deserializer).map(Self)
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Error)]
+pub enum HexError {
+    #[error("hex value has {actual} digits; expected {expected}")]
+    Length { expected: usize, actual: usize },
+
+    #[error("hex value has an odd number of digits")]
+    OddLength,
+
+    #[error("byte {index} is not a lowercase hex digit")]
+    Digit { index: usize },
+}
+
+/// Lowercase hex of `bytes`.
+pub fn encode_hex(bytes: &[u8]) -> String {
+    const DIGITS: &[u8; 16] = b"0123456789abcdef";
+    let mut text = String::with_capacity(bytes.len() * 2);
+    for byte in bytes {
+        text.push(DIGITS[usize::from(byte >> 4)] as char);
+        text.push(DIGITS[usize::from(byte & 0x0f)] as char);
+    }
+    text
+}
+
+/// Decode canonical lowercase hex of any even length.
+pub fn decode_hex(value: &str) -> Result<Vec<u8>, HexError> {
+    let digits = value.as_bytes();
+    if !digits.len().is_multiple_of(2) {
+        return Err(HexError::OddLength);
+    }
+    digits
+        .as_chunks::<2>()
+        .0
+        .iter()
+        .enumerate()
+        .map(|(pair, [high, low])| {
+            let high = hex_digit(*high).ok_or(HexError::Digit { index: pair * 2 })?;
+            let low = hex_digit(*low).ok_or(HexError::Digit {
+                index: pair * 2 + 1,
+            })?;
+            Ok((high << 4) | low)
+        })
+        .collect()
+}
+
+/// Decode canonical lowercase hex of exactly `N` bytes.
+pub fn decode_hex_array<const N: usize>(value: &str) -> Result<[u8; N], HexError> {
+    if value.len() != N * 2 {
+        return Err(HexError::Length {
+            expected: N * 2,
+            actual: value.len(),
+        });
+    }
+    let bytes = decode_hex(value)?;
+    let mut array = [0u8; N];
+    array.copy_from_slice(&bytes);
+    Ok(array)
+}
+
+fn hex_digit(digit: u8) -> Option<u8> {
+    match digit {
+        b'0'..=b'9' => Some(digit - b'0'),
+        b'a'..=b'f' => Some(digit - b'a' + 10),
+        _ => None,
+    }
+}
+
+/// A fixed-size value that travels as canonical lowercase hex.
+macro_rules! hex_value {
+    ($(#[$doc:meta])* $name:ident, $bytes:literal, $pattern:literal) => {
+        $(#[$doc])*
+        #[derive(Clone, Copy, PartialEq, Eq, Hash)]
+        #[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+        pub struct $name(
+            #[cfg_attr(
+                feature = "schema",
+                schemars(
+                    with = "String",
+                    pattern($pattern)
+                )
+            )]
+            [u8; $bytes],
+        );
+
+        impl $name {
+            pub const BYTES: usize = $bytes;
+
+            pub fn from_bytes(bytes: [u8; $bytes]) -> Self {
+                Self(bytes)
+            }
+
+            pub fn as_bytes(&self) -> &[u8; $bytes] {
+                &self.0
+            }
+
+            pub fn parse(value: &str) -> Result<Self, $crate::bytes::HexError> {
+                $crate::bytes::decode_hex_array::<$bytes>(value).map(Self)
+            }
+
+            pub fn to_hex(&self) -> String {
+                $crate::bytes::encode_hex(&self.0)
+            }
+        }
+
+        impl std::fmt::Debug for $name {
+            fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+                write!(formatter, "{}({})", stringify!($name), self.to_hex())
+            }
+        }
+
+        impl std::fmt::Display for $name {
+            fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+                formatter.write_str(&self.to_hex())
+            }
+        }
+
+        impl std::str::FromStr for $name {
+            type Err = $crate::bytes::HexError;
+
+            fn from_str(value: &str) -> Result<Self, Self::Err> {
+                Self::parse(value)
+            }
+        }
+
+        impl serde::Serialize for $name {
+            fn serialize<S: serde::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+                serializer.serialize_str(&self.to_hex())
+            }
+        }
+
+        impl<'de> serde::Deserialize<'de> for $name {
+            fn deserialize<D: serde::Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+                let value = <String as serde::Deserialize>::deserialize(deserializer)?;
+                Self::parse(&value).map_err(<D::Error as serde::de::Error>::custom)
+            }
+        }
+    };
+}
+
+pub(crate) use hex_value;
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn byte_chunks_are_padded_standard_base64() {
+        let value = serde_json::to_value(ByteChunk::from(b"hello".as_slice())).unwrap();
+        assert_eq!(value, serde_json::json!("aGVsbG8="));
+        assert!(serde_json::from_value::<ByteChunk>(serde_json::json!("aGVsbG8")).is_err());
+    }
+
+    #[test]
+    fn hex_decoding_is_canonical_and_never_panics() {
+        assert_eq!(decode_hex("0001abff").unwrap(), [0, 1, 0xab, 0xff]);
+        assert_eq!(encode_hex(&[0, 1, 0xab, 0xff]), "0001abff");
+        for bad in ["abc", "zz", "AB", "+1", "a\u{e9}b", "aaaaaaaaaaaaaaa\u{e9}"] {
+            assert!(decode_hex(bad).is_err(), "{bad:?}");
+        }
+        assert!(matches!(
+            decode_hex_array::<2>("00"),
+            Err(HexError::Length { .. })
+        ));
+    }
+}
diff --git a/crates/environment-protocol/src/contract.rs b/crates/environment-protocol/src/contract.rs
new file mode 100644
index 000000000..191b1ea6a
--- /dev/null
+++ b/crates/environment-protocol/src/contract.rs
@@ -0,0 +1,345 @@
+//! Machine-readable contract export, one set of documents per plane:
+//!
+//! - `<plane>.schema.json`: a draft-07 JSON Schema bundle of every wire type
+//!   the plane uses, under `definitions`;
+//! - `<plane>.openrpc.json`: an OpenRPC document of the plane's methods with
+//!   by-name params, the manifest facts as `x-lightspeed-*` members, and the
+//!   error kinds.
+//!
+//! The committed copies under `crates/environment-protocol/contract/` are
+//! checked by the `contract` integration test; regenerate them with
+//! `cargo run -p environment-protocol --features schema --bin export-contract`.
+
+use std::collections::BTreeMap;
+
+use schemars::generate::SchemaSettings;
+use serde_json::{Value, json};
+
+use crate::{
+    CONTROLLER_PROTOCOL_VERSION, ENVD_PROTOCOL_VERSION,
+    bootstrap::{BuildFacts, DiscoveryDocument},
+    error::{ProtocolError, ProtocolErrorKind},
+    handshake::Plane,
+    limits::MAX_MESSAGE_BYTES,
+    manifest::{MessageKind, plane_methods},
+};
+
+/// The exported documents of one plane.
+pub struct PlaneContract {
+    pub plane: Plane,
+    pub schema_bundle: Value,
+    pub openrpc: Value,
+}
+
+impl PlaneContract {
+    pub fn schema_file_name(&self) -> String {
+        format!("{}.schema.json", self.plane)
+    }
+
+    pub fn openrpc_file_name(&self) -> String {
+        format!("{}.openrpc.json", self.plane)
+    }
+}
+
+pub fn export() -> Vec<PlaneContract> {
+    [Plane::Data, Plane::Controller, Plane::Registration]
+        .into_iter()
+        .map(export_plane)
+        .collect()
+}
+
+fn export_plane(plane: Plane) -> PlaneContract {
+    let mut generator = SchemaSettings::draft07().into_generator();
+    let error_schema = to_value(generator.subschema_for::<ProtocolError>());
+    let bootstrap = (plane == Plane::Registration).then(|| {
+        json!({
+            "discoveryDocument": to_value(generator.subschema_for::<DiscoveryDocument>()),
+            "buildFacts": to_value(generator.subschema_for::<BuildFacts>()),
+        })
+    });
+    let mut entries = Vec::new();
+    for spec in plane_methods(plane) {
+        let schemas = (spec.schemas)(&mut generator);
+        entries.push((
+            spec,
+            to_value(schemas.params),
+            schemas.response.map(to_value),
+        ));
+    }
+    let definitions: BTreeMap<String, Value> = generator
+        .take_definitions(true)
+        .into_iter()
+        .map(|(name, mut schema)| {
+            strip_null(&mut schema);
+            clean_descriptions(&mut schema);
+            (name, schema)
+        })
+        .collect();
+
+    let methods: Vec<Value> = entries
+        .into_iter()
+        .map(|(spec, params, response)| {
+            let mut method = json!({
+                "name": spec.name,
+                "summary": spec.summary,
+                "paramStructure": "by-name",
+                "params": by_name_params(&params, &definitions),
+                "x-lightspeed-kind": spec.kind.as_str(),
+                "x-lightspeed-direction": spec.direction.as_str(),
+                "x-lightspeed-family": spec.family.as_str(),
+                "x-lightspeed-params-type": spec.params_type,
+            });
+            if let Some(activity) = spec.activity {
+                method["x-lightspeed-activity"] = json!(activity.as_str());
+            }
+            if let Some(capability) = spec.capability {
+                method["x-lightspeed-capability"] = json!(capability);
+            }
+            if spec.abortable {
+                method["x-lightspeed-abortable"] = json!(true);
+            }
+            if let (MessageKind::Request, Some(response)) = (spec.kind, response) {
+                method["result"] = json!({"name": "result", "schema": response});
+                method["x-lightspeed-result-type"] = json!(spec.response_type);
+            }
+            method
+        })
+        .collect();
+
+    let (title, version) = match plane {
+        Plane::Data => ("Lightspeed environment data plane", ENVD_PROTOCOL_VERSION),
+        Plane::Controller => (
+            "Lightspeed environment controller plane",
+            CONTROLLER_PROTOCOL_VERSION,
+        ),
+        Plane::Registration => (
+            "Lightspeed environment registration channel",
+            ENVD_PROTOCOL_VERSION,
+        ),
+    };
+    let error_kinds: Vec<Value> = ProtocolErrorKind::ALL
+        .into_iter()
+        .map(|kind| {
+            json!({
+                "kind": kind.as_str(),
+                "code": kind.code(),
+                "retryable": kind.is_retryable(),
+            })
+        })
+        .collect();
+
+    let mut schema_bundle = json!({
+        "$schema": "http://json-schema.org/draft-07/schema#",
+        "title": title,
+        "description": format!("Every wire type of the {plane} plane, protocol version {version}."),
+        "definitions": definitions,
+    });
+    if let Some(bootstrap) = &bootstrap {
+        schema_bundle["x-lightspeed-bootstrap"] = bootstrap.clone();
+    }
+
+    let mut openrpc = json!({
+        "openrpc": "1.3.2",
+        "info": {
+            "title": title,
+            "version": version.to_string(),
+            "description": format!(
+                "JSON-RPC 2.0 over WebSocket text frames of at most {MAX_MESSAGE_BYTES} bytes. \
+                 Exact-match protocolVersion {version}. Errors carry code, message and \
+                 data.kind; see x-lightspeed-error-kinds."
+            ),
+        },
+        "methods": methods,
+        "components": {
+            "schemas": schema_bundle["definitions"].clone(),
+        },
+        "x-lightspeed-plane": plane.as_str(),
+        "x-lightspeed-error": error_schema,
+        "x-lightspeed-error-kinds": error_kinds,
+    });
+    if let Some(bootstrap) = bootstrap {
+        openrpc["x-lightspeed-bootstrap"] = bootstrap;
+    }
+    rewrite_refs(&mut openrpc, "#/definitions/", "#/components/schemas/");
+
+    PlaneContract {
+        plane,
+        schema_bundle,
+        openrpc,
+    }
+}
+
+/// One OpenRPC content descriptor per property of the params object.
+fn by_name_params(schema: &Value, definitions: &BTreeMap<String, Value>) -> Value {
+    let resolved = schema
+        .get("$ref")
+        .and_then(Value::as_str)
+        .and_then(|reference| reference.strip_prefix("#/definitions/"))
+        .and_then(|name| definitions.get(name))
+        .unwrap_or(schema);
+    let required: Vec<&str> = resolved
+        .get("required")
+        .and_then(Value::as_array)
+        .map(|names| names.iter().filter_map(Value::as_str).collect())
+        .unwrap_or_default();
+    let Some(properties) = resolved.get("properties").and_then(Value::as_object) else {
+        return json!([]);
+    };
+    Value::Array(
+        properties
+            .iter()
+            .map(|(name, schema)| {
+                json!({
+                    "name": name,
+                    "required": required.contains(&name.as_str()),
+                    "schema": schema,
+                })
+            })
+            .collect(),
+    )
+}
+
+fn to_value(schema: schemars::Schema) -> Value {
+    let mut value = serde_json::to_value(schema).expect("schema serializes");
+    strip_null(&mut value);
+    clean_descriptions(&mut value);
+    value
+}
+
+/// Descriptions come from rustdoc comments; implementers read them without
+/// rustdoc, so intra-doc links become their plain text.
+fn clean_descriptions(value: &mut Value) {
+    match value {
+        Value::Object(map) => {
+            for (key, entry) in map.iter_mut() {
+                match entry {
+                    Value::String(text) if key == "description" => *text = strip_doc_links(text),
+                    _ => clean_descriptions(entry),
+                }
+            }
+        }
+        Value::Array(entries) => {
+            for entry in entries {
+                clean_descriptions(entry);
+            }
+        }
+        _ => {}
+    }
+}
+
+/// `[`X`](path)` and `[`X`]` become `` `X` ``, `[text](path)` becomes
+/// `text`; brackets inside code spans are left alone.
+fn strip_doc_links(text: &str) -> String {
+    let mut output = String::with_capacity(text.len());
+    let mut rest = text;
+    while let Some(index) = rest.find(['`', '[']) {
+        output.push_str(&rest[..index]);
+        rest = &rest[index..];
+        if let Some(after_tick) = rest.strip_prefix('`') {
+            let end = after_tick.find('`').map_or(rest.len(), |end| end + 2);
+            output.push_str(&rest[..end]);
+            rest = &rest[end..];
+            continue;
+        }
+        let Some(close) = rest.find(']') else {
+            output.push_str(rest);
+            return output;
+        };
+        let inner = &rest[1..close];
+        let after = &rest[close + 1..];
+        if let Some(target) = after.strip_prefix('(')
+            && let Some(target_end) = target.find(')')
+        {
+            output.push_str(inner);
+            rest = &target[target_end + 1..];
+        } else if inner.len() >= 2 && inner.starts_with('`') && inner.ends_with('`') {
+            output.push_str(inner);
+            rest = after;
+        } else {
+            output.push('[');
+            rest = &rest[1..];
+        }
+    }
+    output.push_str(rest);
+    output
+}
+
+/// Absent options are skipped on the wire, never sent as `null`, so the
+/// `null` alternatives the schema generator adds for `Option` fields are
+/// removed.
+fn strip_null(value: &mut Value) {
+    match value {
+        Value::Object(map) => {
+            if let Some(Value::Array(types)) = map.get_mut("type") {
+                types.retain(|kind| kind != "null");
+                if types.len() == 1 {
+                    let only = types.remove(0);
+                    map.insert("type".to_owned(), only);
+                }
+            }
+            for key in ["anyOf", "oneOf"] {
+                if let Some(Value::Array(variants)) = map.get_mut(key) {
+                    variants.retain(|variant| variant.get("type") != Some(&json!("null")));
+                }
+            }
+            for entry in map.values_mut() {
+                strip_null(entry);
+            }
+        }
+        Value::Array(entries) => {
+            for entry in entries {
+                strip_null(entry);
+            }
+        }
+        _ => {}
+    }
+}
+
+fn rewrite_refs(value: &mut Value, from: &str, to: &str) {
+    match value {
+        Value::Object(map) => {
+            for (key, entry) in map.iter_mut() {
+                if key == "$ref"
+                    && let Value::String(reference) = entry
+                    && let Some(rest) = reference.strip_prefix(from)
+                {
+                    *reference = format!("{to}{rest}");
+                } else {
+                    rewrite_refs(entry, from, to);
+                }
+            }
+        }
+        Value::Array(entries) => {
+            for entry in entries {
+                rewrite_refs(entry, from, to);
+            }
+        }
+        _ => {}
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn doc_links_become_plain_text() {
+        assert_eq!(
+            strip_doc_links("see [`MAX_PATH_BYTES`] and [`X`](crate::x::X) or [the docs](a::b)"),
+            "see `MAX_PATH_BYTES` and `X` or the docs"
+        );
+        assert_eq!(
+            strip_doc_links("`[...]` is a class; [1, 2] stays"),
+            "`[...]` is a class; [1, 2] stays"
+        );
+    }
+
+    #[test]
+    fn exported_descriptions_carry_no_doc_links() {
+        for plane in export() {
+            let text = plane.schema_bundle.to_string();
+            assert!(!text.contains("](crate::"), "{}", plane.plane);
+            assert!(!text.contains("[`"), "{}", plane.plane);
+        }
+    }
+}
diff --git a/crates/environment-protocol/src/control/handshake.rs b/crates/environment-protocol/src/control/handshake.rs
index 4895f7073..727a97c86 100644
--- a/crates/environment-protocol/src/control/handshake.rs
+++ b/crates/environment-protocol/src/control/handshake.rs
@@ -1,46 +1,68 @@
-//! Controller-plane connection handshake.
+//! Controller-plane `initialize`.
+//!
+//! The same handshake rules as the data plane apply: `initialize` first
+//! (`notInitialized` otherwise), once (`invalidRequest` on a repeat), with
+//! [`CONTROLLER_PROTOCOL_VERSION`](crate::CONTROLLER_PROTOCOL_VERSION)
+//! (`versionMismatch` otherwise). The core methods (`template/list` and
+//! every `target/*` method except `target/adopt`) are mandatory at this
+//! version; the capabilities name the optional ones.
 
 use serde::{Deserialize, Serialize};
 
-use crate::shared::{CURRENT_PROTOCOL_VERSION, ImplementationInfo};
+use crate::{
+    handshake::{ImplementationInfo, Plane},
+    routes::DataRouteBase,
+    serde_util::is_false,
+};
 
+/// `initialize` params on the controller plane.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct ControllerInitializeParams {
-    #[serde(default = "default_protocol_version")]
+    /// The client's `CONTROLLER_PROTOCOL_VERSION`.
     pub protocol_version: u32,
-    pub client_name: String,
+    pub client_info: ImplementationInfo,
 }
 
+/// `initialize` response on the controller plane.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct ControllerInitializeResponse {
     pub protocol_version: u32,
+    /// Always `controller`.
+    pub plane: Plane,
+    pub server_info: ImplementationInfo,
     pub capabilities: ControllerCapabilities,
-    pub implementation: ImplementationInfo,
+    pub routes: ControllerRoutes,
 }
 
+/// Optional controller methods. Calling an absent one is
+/// `capabilityUnavailable`.
 #[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct ControllerCapabilities {
-    #[serde(default)]
-    pub list_templates: bool,
-    #[serde(default)]
-    pub list_targets: bool,
-    #[serde(default)]
-    pub create_target: bool,
-    #[serde(default)]
+    /// `target/adopt` is served.
+    #[serde(default, skip_serializing_if = "is_false")]
     pub adopt_target: bool,
-    #[serde(default)]
-    pub get_target: bool,
-    #[serde(default)]
-    pub close_target: bool,
-    #[serde(default)]
-    pub set_target_power: bool,
-    #[serde(default)]
+    /// `ingress/ensure` and `ingress/remove` are served.
+    #[serde(default, skip_serializing_if = "is_false")]
     pub ingress: bool,
 }
 
-fn default_protocol_version() -> u32 {
-    CURRENT_PROTOCOL_VERSION
+/// Where Lightspeed reaches a target's data plane through this provider.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ControllerRoutes {
+    /// Base URL of the data routes. A target's data route is this base
+    /// followed by
+    /// `/{universeId}/{bindingId}/{environmentId}/{incarnationId}/{targetId}`,
+    /// each segment percent-encoded
+    /// ([`provider_data_route`](crate::routes::provider_data_route)), and is
+    /// dialed with the same bearer credential as the controller. A
+    /// controller reached over `wss` must advertise a `wss` base.
+    pub data: DataRouteBase,
 }
diff --git a/crates/environment-protocol/src/control/ingress.rs b/crates/environment-protocol/src/control/ingress.rs
index 230f2f93c..519681232 100644
--- a/crates/environment-protocol/src/control/ingress.rs
+++ b/crates/environment-protocol/src/control/ingress.rs
@@ -1,40 +1,29 @@
-//! Provider-owned public ingress lifecycle payloads.
+//! `ingress/*`: public ingress of one target. Requires
+//! `capabilities.ingress`. `target/close` removes ingress by contract, so
+//! `ingress/remove` exists only to disable ingress on a target that stays.
+//! Both answer [`TargetResponse`](crate::control::target::TargetResponse)
+//! with the realized ingress in the observation; the runtime converges its
+//! recorded intent against that observation.
 
 use serde::{Deserialize, Serialize};
 
-use crate::{control::targets::ProviderBindingContext, shared::ProviderTargetId};
+use crate::control::target::TargetRef;
 
+/// `ingress/ensure` params: route the template's public ingress to the
+/// target. Idempotent. A target whose template has no `publicIngress` is
+/// `failedPrecondition` (`ingressUnsupported`).
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct EnsureIngressParams {
-    pub request_id: String,
-    pub environment_id: String,
-    pub incarnation_id: String,
-    pub binding: ProviderBindingContext,
-    pub target_id: ProviderTargetId,
+    pub target: TargetRef,
 }
 
+/// `ingress/remove` params: stop routing public ingress to the target.
+/// Idempotent.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct RemoveIngressParams {
-    pub request_id: String,
-    pub environment_id: String,
-    pub incarnation_id: String,
-    pub binding: ProviderBindingContext,
-    pub target_id: ProviderTargetId,
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub enum ProviderIngressStatus {
-    Ready,
-    Disabled,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct IngressResponse {
-    pub status: ProviderIngressStatus,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub public_endpoint: Option<String>,
+    pub target: TargetRef,
 }
diff --git a/crates/environment-protocol/src/control/methods.rs b/crates/environment-protocol/src/control/methods.rs
deleted file mode 100644
index b36371e7e..000000000
--- a/crates/environment-protocol/src/control/methods.rs
+++ /dev/null
@@ -1,13 +0,0 @@
-//! JSON-RPC method names for the provider controller plane.
-
-pub const INITIALIZE_METHOD: &str = "controller/initialize";
-
-pub const LIST_TEMPLATES_METHOD: &str = "controller/listTemplates";
-pub const LIST_TARGETS_METHOD: &str = "controller/listTargets";
-pub const CREATE_TARGET_METHOD: &str = "controller/createTarget";
-pub const ADOPT_TARGET_METHOD: &str = "controller/adoptTarget";
-pub const GET_TARGET_METHOD: &str = "controller/getTarget";
-pub const CLOSE_TARGET_METHOD: &str = "controller/closeTarget";
-pub const SET_TARGET_POWER_METHOD: &str = "controller/setTargetPower";
-pub const ENSURE_INGRESS_METHOD: &str = "controller/ensureIngress";
-pub const REMOVE_INGRESS_METHOD: &str = "controller/removeIngress";
diff --git a/crates/environment-protocol/src/control/mod.rs b/crates/environment-protocol/src/control/mod.rs
index 1b621996d..d13749385 100644
--- a/crates/environment-protocol/src/control/mod.rs
+++ b/crates/environment-protocol/src/control/mod.rs
@@ -1,6 +1,22 @@
-//! Controller-plane protocol for provider target lifecycle and connection discovery.
+//! The controller plane: a provider controller creating, observing,
+//! powering and closing targets for Lightspeed environments. The runtime
+//! is the client; the provider is the server.
+//!
+//! The runtime connects with the provider credential as an
+//! `Authorization: Bearer` header, on the controller URL and on every data
+//! route the controller advertises; the provider checks it in constant time
+//! before the WebSocket upgrade.
+//!
+//! **Bounded calls.** Every target method answers `{target: observation}`
+//! promptly. Slow work (an image pull, a VM boot, a graceful shutdown)
+//! continues in the background and is followed with `target/get`.
+//!
+//! **Ownership.** A target belongs to exactly one [`TargetOwner`](target::TargetOwner). Every
+//! target method carries the owner; a provider resolves the target from
+//! the owner when no `targetId` is given, and refuses a target that belongs
+//! to another owner with `failedPrecondition` (`ownerMismatch`).
 
 pub mod handshake;
 pub mod ingress;
-pub mod methods;
-pub mod targets;
+pub mod target;
+pub mod template;
diff --git a/crates/environment-protocol/src/control/target.rs b/crates/environment-protocol/src/control/target.rs
new file mode 100644
index 000000000..f3b7e49fe
--- /dev/null
+++ b/crates/environment-protocol/src/control/target.rs
@@ -0,0 +1,230 @@
+//! `target/*`: create, adopt, observe, power and close provider targets.
+
+use serde::{Deserialize, Serialize};
+
+use crate::{
+    ids::{
+        BindingId, EnvironmentId, IncarnationId, ProviderNativeRef, ProviderTargetId, TemplateId,
+        UniverseId,
+    },
+    metadata::{DescriptiveText, DisplayName, Metadata},
+    routes::PublicUrl,
+    serde_util::is_false,
+};
+
+/// The Lightspeed incarnation a target belongs to. A provider owns at most
+/// one target per owner.
+#[derive(Clone, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct TargetOwner {
+    pub universe_id: UniverseId,
+    pub binding_id: BindingId,
+    pub environment_id: EnvironmentId,
+    pub incarnation_id: IncarnationId,
+}
+
+/// The provider binding a call is scoped to, for calls that concern no
+/// particular target.
+#[derive(Clone, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct BindingRef {
+    pub universe_id: UniverseId,
+    pub binding_id: BindingId,
+}
+
+/// A reference to an existing target: its owner and, once known, its id.
+/// Without `targetId` the provider resolves the owner's target itself.
+#[derive(Clone, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct TargetRef {
+    pub owner: TargetOwner,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub target_id: Option<ProviderTargetId>,
+}
+
+/// What the provider observes about a target. Every target method answers
+/// with one.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct TargetObservation {
+    /// The provider's id for the target. Absent in two cases only: while
+    /// `phase` is `provisioning` and the provider has not assigned an id
+    /// yet (an asynchronous create answers before it has one; the runtime
+    /// records the id from the first observation that carries it), and in a
+    /// `closed` observation of an owner the provider holds no target for.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub target_id: Option<ProviderTargetId>,
+    /// Echoed from the request.
+    pub owner: TargetOwner,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub display_name: Option<DisplayName>,
+    pub state: TargetState,
+    /// Power states `target/setPower` can move this target to. Empty when
+    /// the provider offers no power control beyond create and close.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub supported_power_states: Vec<PowerState>,
+    /// Public ingress as realized; absent when disabled.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub ingress: Option<IngressObservation>,
+    /// Provider-specific display facts.
+    #[serde(default, skip_serializing_if = "Metadata::is_empty")]
+    pub metadata: Metadata,
+}
+
+/// Realized public ingress of a target.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct IngressObservation {
+    /// Public URL that reaches the target's application.
+    pub endpoint: PublicUrl,
+}
+
+/// A target's state on two axes: lifecycle `phase`, and `power` while
+/// active.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct TargetState {
+    pub phase: TargetPhase,
+    /// Present exactly when `phase` is `active`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub power: Option<PowerState>,
+    /// envd answers on the target's data route (running targets only).
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub daemon_ready: bool,
+    /// Why the target is `failed` or `unknown`, or what a transition waits
+    /// for. Providers build it with
+    /// [`DescriptiveText::lossy`] from whatever their backend reports.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub message: Option<DescriptiveText>,
+}
+
+/// Lifecycle phase of a target.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase")]
+pub enum TargetPhase {
+    /// Being created; not yet usable.
+    Provisioning,
+    /// Exists; see `power`.
+    Active,
+    /// Being destroyed.
+    Closing,
+    /// Gone, and nothing of it remains.
+    Closed,
+    /// Broken beyond the provider's own recovery; see `message`.
+    Failed,
+    /// The provider cannot tell; see `message`.
+    Unknown,
+}
+
+/// Steady power state of an active target, in provider-neutral terms.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase")]
+pub enum PowerState {
+    Running,
+    /// Execution halted, memory retained; resuming is fast.
+    Paused,
+    /// Execution state persisted, compute released; resuming restores it.
+    Suspended,
+    /// Powered off; disks retained.
+    Stopped,
+}
+
+impl PowerState {
+    pub const ALL: [PowerState; 4] = [
+        PowerState::Running,
+        PowerState::Paused,
+        PowerState::Suspended,
+        PowerState::Stopped,
+    ];
+
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Running => "running",
+            Self::Paused => "paused",
+            Self::Suspended => "suspended",
+            Self::Stopped => "stopped",
+        }
+    }
+}
+
+impl std::fmt::Display for PowerState {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter.write_str(self.as_str())
+    }
+}
+
+/// `target/create` params. Idempotent per owner: when the owner already
+/// has a target, the provider returns its observation and applies no
+/// creation policy (template deprecation, binding or image checks).
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct CreateTargetParams {
+    pub owner: TargetOwner,
+    pub template_id: TemplateId,
+}
+
+/// `target/adopt` params: take ownership of an existing provider target.
+/// Idempotent per owner. Requires `capabilities.adoptTarget`. A source that
+/// belongs to another owner, or an owner that already holds a different
+/// target, is `failedPrecondition` (`ownerMismatch`); a source the provider
+/// cannot take over is `failedPrecondition` (`notAdoptable`).
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct AdoptTargetParams {
+    pub owner: TargetOwner,
+    /// Provider-native reference to the existing target; the provider
+    /// defines its format.
+    pub source_target: ProviderNativeRef,
+}
+
+/// `target/get` params. A pure read: it never creates or changes anything.
+/// A target that no longer exists is `notFound`.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct GetTargetParams {
+    pub target: TargetRef,
+}
+
+/// `target/setPower` params: converge the target toward `power`. A target
+/// already in, or moving toward, that state is observed without further
+/// action. Resuming may replace the underlying host process. A target whose
+/// `phase` is not `active` is `failedPrecondition` (`targetNotActive`); a
+/// state outside `supportedPowerStates` is `invalidParams`.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct SetTargetPowerParams {
+    pub target: TargetRef,
+    /// One of the target's `supportedPowerStates`.
+    pub power: PowerState,
+}
+
+/// `target/close` params: destroy the owner's target and every resource it
+/// holds, public ingress included. Graceful within the provider's own bound,
+/// then forced. Answers `closing` until the target is gone, then `closed`;
+/// `closed` also when the provider holds no target for the owner.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct CloseTargetParams {
+    pub target: TargetRef,
+}
+
+/// Response of every target method and both ingress methods.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct TargetResponse {
+    pub target: TargetObservation,
+}
diff --git a/crates/environment-protocol/src/control/targets.rs b/crates/environment-protocol/src/control/targets.rs
deleted file mode 100644
index 742c20434..000000000
--- a/crates/environment-protocol/src/control/targets.rs
+++ /dev/null
@@ -1,250 +0,0 @@
-//! Controller-plane target lifecycle payloads.
-
-use std::collections::BTreeMap;
-
-use serde::{Deserialize, Serialize};
-
-use crate::shared::{EnvironmentCapabilities, EnvironmentPath, EnvironmentScope, ProviderTargetId};
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct ProviderBindingContext {
-    pub universe_id: String,
-    pub binding_id: String,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct EnvironmentTemplate {
-    pub template_id: String,
-    pub display_name: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub description: Option<String>,
-    #[serde(default)]
-    pub public_ingress: bool,
-    #[serde(default)]
-    pub deprecated: bool,
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    pub metadata: BTreeMap<String, String>,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct ListTemplatesParams {
-    pub binding: ProviderBindingContext,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct ListTemplatesResponse {
-    pub templates: Vec<EnvironmentTemplate>,
-}
-
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct ListTargetsParams {
-    pub binding: ProviderBindingContext,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub status: Option<ProviderTargetStatus>,
-}
-
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct ListTargetsResponse {
-    pub targets: Vec<ProviderTargetSummary>,
-}
-
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct CreateTargetParams {
-    pub request_id: String,
-    pub environment_id: String,
-    pub incarnation_id: String,
-    pub binding: ProviderBindingContext,
-    pub template_id: String,
-}
-
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct CreateTargetResponse {
-    pub target: ProviderTargetSummary,
-}
-
-/// Explicit ownership transfer of an existing provider target into a
-/// Lightspeed-managed binding namespace.
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct AdoptTargetParams {
-    pub request_id: String,
-    pub environment_id: String,
-    pub incarnation_id: String,
-    pub binding: ProviderBindingContext,
-    /// Provider-native reference to the existing target. Incus uses
-    /// `<project>/<instance>` and defaults the project to `default`.
-    pub source_target: String,
-}
-
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct AdoptTargetResponse {
-    pub target: ProviderTargetSummary,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct GetTargetParams {
-    pub binding: ProviderBindingContext,
-    pub target_id: ProviderTargetId,
-}
-
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct GetTargetResponse {
-    pub target: ProviderTargetSummary,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct CloseTargetParams {
-    pub request_id: String,
-    pub environment_id: String,
-    pub incarnation_id: String,
-    pub binding: ProviderBindingContext,
-    pub target_id: ProviderTargetId,
-    #[serde(default)]
-    pub force: bool,
-}
-
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct CloseTargetResponse {
-    pub target_id: ProviderTargetId,
-    pub status: ProviderTargetStatus,
-}
-
-#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SandboxTargetSpec {
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub template: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub image: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub cwd: Option<EnvironmentPath>,
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    pub env: BTreeMap<String, String>,
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    pub labels: BTreeMap<String, String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub provider_options: Option<serde_json::Value>,
-}
-
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct ProviderTargetSummary {
-    pub target_id: ProviderTargetId,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub display_name: Option<String>,
-    pub status: ProviderTargetStatus,
-    pub scope: EnvironmentScope,
-    pub capabilities: EnvironmentCapabilities,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub default_cwd: Option<EnvironmentPath>,
-    /// Power states this target can be moved to with `controller/setTargetPower`.
-    /// Empty when the provider offers no power control beyond create/close.
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub power_states: Vec<PowerState>,
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    pub metadata: BTreeMap<String, String>,
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub enum ProviderTargetStatus {
-    Creating,
-    Starting,
-    Ready,
-    /// VMM alive with execution frozen; RAM stays resident, resume is instant.
-    Paused,
-    /// Execution state saved to disk and the VMM released; resume restores it.
-    Suspended,
-    Stopped,
-    Closing,
-    Closed,
-    Failed,
-    Unknown,
-}
-
-impl ProviderTargetStatus {
-    /// The power state a steady-state observation corresponds to, or `None`
-    /// while the target is transitioning or gone.
-    pub fn power_state(self) -> Option<PowerState> {
-        match self {
-            Self::Ready => Some(PowerState::Running),
-            Self::Paused => Some(PowerState::Paused),
-            Self::Suspended => Some(PowerState::Suspended),
-            Self::Stopped => Some(PowerState::Stopped),
-            Self::Creating
-            | Self::Starting
-            | Self::Closing
-            | Self::Closed
-            | Self::Failed
-            | Self::Unknown => None,
-        }
-    }
-}
-
-/// Requested steady power state of a provider target.
-#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub enum PowerState {
-    Running,
-    Paused,
-    Suspended,
-    Stopped,
-}
-
-impl PowerState {
-    pub const ALL: [PowerState; 4] = [
-        PowerState::Running,
-        PowerState::Paused,
-        PowerState::Suspended,
-        PowerState::Stopped,
-    ];
-
-    pub fn as_str(self) -> &'static str {
-        match self {
-            Self::Running => "running",
-            Self::Paused => "paused",
-            Self::Suspended => "suspended",
-            Self::Stopped => "stopped",
-        }
-    }
-}
-
-impl std::fmt::Display for PowerState {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        formatter.write_str(self.as_str())
-    }
-}
-
-/// Converge one target to a steady power state. Idempotent by inventory: a
-/// target already in `power` (or transitioning toward it) is reported as
-/// observed without further action; resuming may replace the underlying
-/// host process.
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SetTargetPowerParams {
-    pub request_id: String,
-    pub environment_id: String,
-    pub incarnation_id: String,
-    pub binding: ProviderBindingContext,
-    pub target_id: ProviderTargetId,
-    pub power: PowerState,
-}
-
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SetTargetPowerResponse {
-    pub target: ProviderTargetSummary,
-}
diff --git a/crates/environment-protocol/src/control/template.rs b/crates/environment-protocol/src/control/template.rs
new file mode 100644
index 000000000..03a4504a9
--- /dev/null
+++ b/crates/environment-protocol/src/control/template.rs
@@ -0,0 +1,63 @@
+//! `template/list`: the templates a binding may create targets from.
+
+use serde::{Deserialize, Serialize};
+
+use crate::{
+    control::target::BindingRef,
+    ids::TemplateId,
+    metadata::{DescriptiveText, DisplayName, Metadata},
+    serde_util::is_false,
+};
+
+/// `template/list` params.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ListTemplatesParams {
+    pub binding: BindingRef,
+}
+
+/// `template/list` response.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ListTemplatesResponse {
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub templates: Vec<EnvironmentTemplate>,
+}
+
+/// A template targets are created from.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct EnvironmentTemplate {
+    pub template_id: TemplateId,
+    pub display_name: DisplayName,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub description: Option<DescriptiveText>,
+    /// Targets of this template can serve public ingress.
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub public_ingress: bool,
+    /// Creates no new targets; existing targets keep working.
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub deprecated: bool,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub resources: Option<TemplateResources>,
+    /// Provider-specific display facts, such as an image fingerprint.
+    #[serde(default, skip_serializing_if = "Metadata::is_empty")]
+    pub metadata: Metadata,
+}
+
+/// Compute a template's targets get, in provider-neutral units. Each
+/// field is absent when the provider does not fix it.
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct TemplateResources {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub vcpus: Option<u32>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub memory_bytes: Option<u64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub disk_bytes: Option<u64>,
+}
diff --git a/crates/environment-protocol/src/data/events.rs b/crates/environment-protocol/src/data/events.rs
deleted file mode 100644
index 0f7fefe96..000000000
--- a/crates/environment-protocol/src/data/events.rs
+++ /dev/null
@@ -1,43 +0,0 @@
-//! Data-plane notifications.
-
-use serde::{Deserialize, Serialize};
-
-use crate::{
-    data::process::{ProcessOutputChunk, ProcessOutputStream},
-    shared::{ByteChunk, ProcessId},
-};
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct ProcessOutputNotification {
-    pub process_id: ProcessId,
-    pub seq: u64,
-    pub stream: ProcessOutputStream,
-    pub chunk: ByteChunk,
-}
-
-impl ProcessOutputNotification {
-    pub fn from_chunk(process_id: ProcessId, chunk: ProcessOutputChunk) -> Self {
-        Self {
-            process_id,
-            seq: chunk.seq,
-            stream: chunk.stream,
-            chunk: chunk.chunk,
-        }
-    }
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct ProcessExitedNotification {
-    pub process_id: ProcessId,
-    pub seq: u64,
-    pub exit_code: i32,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct ProcessClosedNotification {
-    pub process_id: ProcessId,
-    pub seq: u64,
-}
diff --git a/crates/environment-protocol/src/data/exec.rs b/crates/environment-protocol/src/data/exec.rs
new file mode 100644
index 000000000..bde6edfe8
--- /dev/null
+++ b/crates/environment-protocol/src/data/exec.rs
@@ -0,0 +1,373 @@
+//! The execution primitive processes and jobs share: the command, its
+//! input, its output stream and its outcome.
+//!
+//! **Output positions.** A handle's output is one byte stream: stdout,
+//! stderr and the PTY interleaved in arrival order. Positions are byte
+//! offsets into it. `end` is the number of bytes produced so far; a page
+//! cut at `maxBytes` loses nothing because the next read starts at `next`;
+//! a tail read starts at `end - tailBytes`. Bytes the daemon no longer
+//! retains are reported as typed [`OutputGap`]s, never skipped silently.
+//!
+//! **Settled exit.** `state` becomes `exited` only once the root process
+//! has exited and its output has settled (every reader reached end of file
+//! or was discarded), so `end` is final from then on.
+
+use std::collections::BTreeMap;
+
+use serde::{Deserialize, Serialize};
+use thiserror::Error;
+
+use crate::{
+    bytes::{ByteChunk, SecretString},
+    paths::EnvironmentPath,
+    serde_util::{is_false, is_zero_u32},
+};
+
+/// What to run. Shared by `process/start` and `job/start`.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct CommandSpec {
+    /// Program and arguments; `argv[0]` is resolved through `PATH`. Not
+    /// empty.
+    pub argv: Vec<String>,
+    /// Working directory; the daemon's `defaultCwd` when absent.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub cwd: Option<EnvironmentPath>,
+    /// Variables added to the daemon's scrubbed environment.
+    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+    pub env: BTreeMap<String, String>,
+    /// Like `env`, but every value is redacted from the command's output.
+    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+    pub secret_env: BTreeMap<String, SecretString>,
+    /// Standard input; none by default.
+    #[serde(default, skip_serializing_if = "ExecInput::is_none")]
+    pub input: ExecInput,
+    /// Stop deadline from start. On expiry the daemon terminates the process
+    /// group (`SIGTERM`, the advertised grace, then `SIGKILL`) and records
+    /// `stoppedBy: timeout`. Absent means no deadline.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub timeout_ms: Option<u64>,
+}
+
+/// Standard input of a command.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(
+    tag = "kind",
+    rename_all = "camelCase",
+    rename_all_fields = "camelCase",
+    deny_unknown_fields
+)]
+pub enum ExecInput {
+    /// `/dev/null`: the command reads end of file. Model-facing tools use
+    /// this.
+    None {},
+    /// These bytes, then end of file. Written by a writer task after the
+    /// output readers, the exit watcher and the deadline are in place.
+    Bytes { data: ByteChunk },
+    /// A persistent pipe fed by `process/write` until closed. Processes
+    /// only; `job/start` refuses it with `invalidParams`.
+    Pipe {},
+}
+
+impl Default for ExecInput {
+    fn default() -> Self {
+        Self::None {}
+    }
+}
+
+impl ExecInput {
+    pub fn is_none(&self) -> bool {
+        matches!(self, Self::None {})
+    }
+}
+
+/// Terminal size of a PTY. Each dimension is 1 to 4096.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct PtySize {
+    pub rows: u32,
+    pub cols: u32,
+}
+
+impl PtySize {
+    pub const MAX_DIMENSION: u32 = 4096;
+}
+
+/// Which descriptor produced a chunk. Jobs never produce `pty`.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase")]
+pub enum OutputStream {
+    Stdout,
+    Stderr,
+    /// The PTY master, which merges stdout and stderr.
+    Pty,
+}
+
+/// Contiguous output bytes from one stream.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct OutputChunk {
+    /// Byte offset of the chunk's first byte in the combined output.
+    pub offset: u64,
+    pub stream: OutputStream,
+    pub data: ByteChunk,
+}
+
+/// Output bytes in `[offset, offset + omittedBytes)` that a page cannot
+/// return.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct OutputGap {
+    pub offset: u64,
+    pub omitted_bytes: u64,
+    pub reason: GapReason,
+}
+
+/// Why a range of output cannot be returned.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase")]
+pub enum GapReason {
+    /// Never delivered: dropped from the middle because retained output
+    /// exceeded the handle's cap. The head and the newest bytes are kept.
+    Overflow,
+    /// Already delivered through the daemon cursor (or acknowledged) and
+    /// released since.
+    Expired,
+}
+
+/// One page of a handle's output. Returned by `process/read` and in every
+/// `job/read` entry. A page holds at most
+/// [`MAX_PAGE_CHUNKS`](crate::limits::MAX_PAGE_CHUNKS) chunks and gaps
+/// together (for `job/read`, across all entries); one that reaches it ends
+/// early, and `next` says where to continue.
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct OutputPage {
+    /// In offset order, at most `maxBytes` of `data` in total.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub chunks: Vec<OutputChunk>,
+    /// Offset to read from next: past the last returned byte or gap.
+    pub next: u64,
+    /// Bytes produced so far; final once the handle has exited.
+    pub end: u64,
+    /// Unreturnable ranges between the requested start and `next`.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub gaps: Vec<OutputGap>,
+}
+
+/// When a waiting read returns. Every mode also returns when `waitMs`
+/// elapses, when the handle reaches a settled exit, or at once when there
+/// is nothing left to wait for.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase")]
+pub enum ReturnOn {
+    /// Collect for the whole window; return early only when unread output
+    /// reaches `maxBytes`.
+    Window,
+    /// Return as soon as any output past the start position exists.
+    AnyOutput,
+    /// Return only at the settled exit (for `job/read`: once every entry is
+    /// terminal), even if more than `maxBytes` of output accumulates.
+    Exit,
+}
+
+/// Lifecycle state of a process.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase")]
+pub enum ExecState {
+    Running,
+    /// The root exited and its output settled.
+    Exited,
+}
+
+/// How the root process ended.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(
+    tag = "kind",
+    rename_all = "camelCase",
+    rename_all_fields = "camelCase",
+    deny_unknown_fields
+)]
+pub enum ExitStatus {
+    /// Normal exit with this status code.
+    Code { code: i32 },
+    /// Killed by this signal.
+    Signal {
+        signal: SignalName,
+        #[serde(default, skip_serializing_if = "is_false")]
+        core_dumped: bool,
+    },
+}
+
+/// Why the daemon stopped a process or job that did not exit on its own.
+/// Set only when the daemon signalled a root that was still running.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase")]
+pub enum StoppedBy {
+    /// `timeoutMs` expired: `SIGTERM`, the grace, then `SIGKILL`.
+    Timeout,
+    /// `process/terminate` with `terminate`, or `job/cancel` without
+    /// `force`: `SIGTERM`, the grace, then `SIGKILL`.
+    Terminate,
+    /// `process/terminate` with `kill`, or `job/cancel` with `force`:
+    /// `SIGKILL` at once.
+    Kill,
+}
+
+/// A POSIX signal name such as `SIGSEGV` or `SIGRTMIN+3`: `SIG` followed by
+/// 1 to 16 uppercase letters, digits or `+`. Names, not numbers, because
+/// numbers differ between platforms.
+#[derive(Clone, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+pub struct SignalName(
+    #[cfg_attr(feature = "schema", schemars(pattern(SIGNAL_NAME_PATTERN)))] String,
+);
+
+/// JSON Schema pattern of [`SignalName`].
+pub const SIGNAL_NAME_PATTERN: &str = "^SIG[A-Z0-9+]{1,16}$";
+
+#[derive(Clone, Debug, PartialEq, Eq, Error)]
+#[error("signal name must be SIG followed by 1..=16 uppercase letters, digits or '+': {0:?}")]
+pub struct SignalNameError(pub String);
+
+impl SignalName {
+    pub fn new(name: impl Into<String>) -> Result<Self, SignalNameError> {
+        let name = name.into();
+        let valid = name.strip_prefix("SIG").is_some_and(|rest| {
+            (1..=16).contains(&rest.len())
+                && rest
+                    .bytes()
+                    .all(|byte| byte.is_ascii_uppercase() || byte.is_ascii_digit() || byte == b'+')
+        });
+        if valid {
+            Ok(Self(name))
+        } else {
+            Err(SignalNameError(name))
+        }
+    }
+
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+impl std::fmt::Display for SignalName {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        self.0.fmt(formatter)
+    }
+}
+
+impl Serialize for SignalName {
+    fn serialize<S: serde::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        serializer.serialize_str(&self.0)
+    }
+}
+
+impl<'de> Deserialize<'de> for SignalName {
+    fn deserialize<D: serde::Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        let name = String::deserialize(deserializer)?;
+        Self::new(name).map_err(serde::de::Error::custom)
+    }
+}
+
+/// Processes of a command's group still alive after its root exited.
+/// Present only when there is at least one.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct LeftoverReport {
+    pub disposition: LeftoverDisposition,
+    /// At most [`MAX_LEFTOVER_PROCESSES`](crate::limits::MAX_LEFTOVER_PROCESSES),
+    /// lowest pid first; never empty.
+    pub processes: Vec<LeftoverProcess>,
+    /// Leftovers beyond the listed ones.
+    #[serde(default, skip_serializing_if = "is_zero_u32")]
+    pub omitted_process_count: u32,
+}
+
+/// What the daemon did with leftovers. The policies differ on purpose.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase")]
+pub enum LeftoverDisposition {
+    /// Left running (processes): they keep the environment's lifetime and
+    /// are reported until they exit.
+    Kept,
+    /// Terminated when the job finished (jobs); the submitter should fix
+    /// its script's teardown.
+    Swept,
+}
+
+/// One leftover process.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct LeftoverProcess {
+    pub pid: u32,
+    /// Command line when the platform exposes it, otherwise the executable
+    /// name, cut to
+    /// [`MAX_LEFTOVER_COMMAND_BYTES`](crate::limits::MAX_LEFTOVER_COMMAND_BYTES)
+    /// on a character boundary; absent when neither could be read.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub command: Option<String>,
+}
+
+#[cfg(test)]
+mod tests {
+    use serde_json::json;
+
+    use super::*;
+
+    #[test]
+    fn exit_status_names_signals() {
+        let status = ExitStatus::Signal {
+            signal: SignalName::new("SIGSEGV").unwrap(),
+            core_dumped: true,
+        };
+        assert_eq!(
+            serde_json::to_value(&status).unwrap(),
+            json!({"kind": "signal", "signal": "SIGSEGV", "coreDumped": true})
+        );
+        assert!(SignalName::new("SIGRTMIN+3").is_ok());
+        for bad in ["SEGV", "SIG", "sigsegv", "SIGSEGV!"] {
+            assert!(SignalName::new(bad).is_err(), "{bad}");
+        }
+    }
+
+    #[test]
+    fn input_defaults_to_none_and_is_omitted() {
+        let spec: CommandSpec = serde_json::from_value(json!({"argv": ["true"]})).unwrap();
+        assert!(spec.input.is_none());
+        assert_eq!(
+            serde_json::to_value(&spec).unwrap(),
+            json!({"argv": ["true"]})
+        );
+        let piped: CommandSpec =
+            serde_json::from_value(json!({"argv": ["cat"], "input": {"kind": "pipe"}})).unwrap();
+        assert_eq!(piped.input, ExecInput::Pipe {});
+        assert!(serde_json::from_value::<CommandSpec>(json!({"argv": [], "stdin": "x"})).is_err());
+    }
+
+    #[test]
+    fn fieldless_input_kinds_reject_unknown_members() {
+        for kind in ["none", "pipe"] {
+            assert!(serde_json::from_value::<ExecInput>(json!({"kind": kind})).is_ok());
+            assert!(
+                serde_json::from_value::<ExecInput>(json!({"kind": kind, "data": "aGk="})).is_err(),
+                "{kind}"
+            );
+        }
+    }
+}
diff --git a/crates/environment-protocol/src/data/fs.rs b/crates/environment-protocol/src/data/fs.rs
index 8ff51c0f9..075ec6075 100644
--- a/crates/environment-protocol/src/data/fs.rs
+++ b/crates/environment-protocol/src/data/fs.rs
@@ -1,232 +1,529 @@
-//! Filesystem method payloads.
+//! `fs/*`: path-based filesystem methods.
+//!
+//! Every path is an absolute [`EnvironmentPath`] resolved under the
+//! confinement rule stated on that type. Methods that change the
+//! filesystem need `capabilities.filesystem.write`; without it they answer
+//! `capabilityUnavailable` (`filesystemWrite`).
+//!
+//! **Pattern grammar** ([`TreeFilter`]), shared by `fs/searchText`,
+//! `fs/globFiles`, `fs/scan` and transfer captures. Patterns match paths
+//! relative to the walk's root, gitignore-style: `*` and `?` match within
+//! one segment, `**` spans segments, `[...]` is a character class and
+//! `{a,b}` an alternation. A pattern without `/` matches the entry's name
+//! at any depth; a leading `/` anchors it to the root. Walks always prune
+//! VCS metadata directories (`.git`, `.hg`, `.svn`, `.jj`) and the daemon
+//! state directory; by default they also respect ignore files (`.gitignore`,
+//! `.ignore`, git excludes) and skip hidden entries. An entry a walk cannot
+//! represent or read (a name that is not UTF-8, a directory that cannot be
+//! listed) is skipped and counted in the result's `skippedEntryCount`;
+//! it never ends the walk.
+//!
+//! **Two entry shapes, on purpose.** [`FileMetadata`] describes one path as
+//! it is now (`fs/getMetadata`, `fs/readDirectory`): kind including
+//! symlinks, times and a `version` for preconditions. [`TreeContent`]
+//! describes what a tree holds (`fs/scan` entries, transfer inventories):
+//! directories and files with size, mode and digest, the facts two trees
+//! are compared by. Trees never hold symlink entries: scans skip or follow
+//! links and captures expand or skip them.
 
 use serde::{Deserialize, Serialize};
 
-use crate::shared::{ByteChunk, EnvironmentPath};
+use crate::{
+    bytes::ByteChunk,
+    ids::{DirectoryCursor, validate_opaque_id},
+    paths::{ContentDigest, EntryName, EnvironmentPath},
+    serde_util::{is_false, is_zero_u32},
+};
 
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+/// Kind of a filesystem entry.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
 #[serde(rename_all = "camelCase")]
-pub struct ReadFileParams {
-    pub path: EnvironmentPath,
-    /// Byte offset to start reading from. Environment endpoints advertising
-    /// `filesystem_ranged_read` honor it; others ignore it and return the
-    /// full file.
+pub enum FileKind {
+    File,
+    Directory,
+    Symlink,
+    /// Device, FIFO, socket or another special file.
+    Other,
+}
+
+/// One file-entry shape for `fs/getMetadata` and `fs/readDirectory`.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct FileMetadata {
+    pub kind: FileKind,
+    /// Size in bytes; for a symlink, the length of its target text.
+    pub size_bytes: u64,
+    /// A regular file with any execute bit set; always false for
+    /// directories, symlinks and special files.
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub executable: bool,
+    pub modified_at_ms: i64,
+    /// Absent when the filesystem records no birth time.
     #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub offset: Option<u64>,
-    /// Maximum bytes to return. Environment endpoints advertising `filesystem_ranged_read`
-    /// truncate at the source and set `truncated`.
+    pub created_at_ms: Option<i64>,
+    /// Target text of a symlink, when it is UTF-8.
     #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub max_bytes: Option<u64>,
+    pub symlink_target: Option<String>,
+    /// Changes whenever the entry's content or identity changes; compare it
+    /// with `ifMatch`.
+    pub version: FileVersion,
+}
+
+/// Opaque version token of a file's content and identity. Equal tokens for
+/// one path mean the content is unchanged. 1 to 255 bytes without control
+/// characters.
+#[derive(Clone, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+pub struct FileVersion(
+    #[cfg_attr(
+        feature = "schema",
+        schemars(length(min = 1, max = 255), pattern(crate::ids::NO_CONTROL_PATTERN))
+    )]
+    String,
+);
+
+impl FileVersion {
+    pub fn new(value: impl Into<String>) -> Result<Self, crate::ids::IdError> {
+        let value = value.into();
+        validate_opaque_id("FileVersion", &value)?;
+        Ok(Self(value))
+    }
+
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+impl Serialize for FileVersion {
+    fn serialize<S: serde::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        serializer.serialize_str(&self.0)
+    }
+}
+
+impl<'de> Deserialize<'de> for FileVersion {
+    fn deserialize<D: serde::Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        let value = String::deserialize(deserializer)?;
+        Self::new(value).map_err(serde::de::Error::custom)
+    }
 }
 
+/// What a tree entry is: a scan entry or a transfer inventory entry.
+/// Digests identify raw file bytes, not paths or modes.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(
+    tag = "kind",
+    rename_all = "camelCase",
+    rename_all_fields = "camelCase",
+    deny_unknown_fields
+)]
+pub enum TreeContent {
+    Directory {},
+    File {
+        size_bytes: u64,
+        #[serde(default, skip_serializing_if = "is_false")]
+        executable: bool,
+        /// Scans: present when `includeDigests` was set. Transfer
+        /// inventories: always present; an appended file entry without it
+        /// is `invalidParams`.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        digest: Option<ContentDigest>,
+    },
+}
+/// `fs/readFile` params. Reads a regular file only; anything else is
+/// `failedPrecondition` (`notRegularFile`) and is never opened for a
+/// blocking read.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ReadFileParams {
+    pub path: EnvironmentPath,
+    /// First byte to return; 0 by default.
+    #[serde(default, skip_serializing_if = "crate::serde_util::is_zero_u64")]
+    pub offset: u64,
+    /// Most bytes to return, at most `limits.filesystem.maxReadFileBytes`.
+    pub max_bytes: u64,
+}
+
+/// `fs/readFile` response.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct ReadFileResponse {
     pub data: ByteChunk,
-    /// Total size of the file in the environment, independent of the returned range.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub file_size: Option<u64>,
-    /// True when the returned data is a strict prefix range of the file.
-    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    /// Size of the whole file when it was read.
+    pub file_size: u64,
+    /// Bytes exist after `offset` plus the length of `data`.
+    #[serde(default, skip_serializing_if = "is_false")]
     pub truncated: bool,
+    pub version: FileVersion,
 }
 
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+/// When `fs/writeFile` may write.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
 #[serde(rename_all = "camelCase")]
+pub enum WriteCondition {
+    /// Create or replace.
+    #[default]
+    Always,
+    /// Only create; an existing entry is `failedPrecondition`
+    /// (`createCondition`).
+    IfAbsent,
+    /// Only replace; a missing file is `failedPrecondition`
+    /// (`createCondition`).
+    IfPresent,
+}
+
+impl WriteCondition {
+    pub fn is_default(&self) -> bool {
+        *self == Self::Always
+    }
+}
+
+/// `fs/writeFile` params. The write is staged in the target's directory and
+/// published by an atomic rename: readers see the old or the new content,
+/// never a mix. An existing target keeps its permissions. A symlink at
+/// `path` whose target stays inside the root is followed like any path: the
+/// final target is replaced and the link itself is kept (a dangling link
+/// creates its target, subject to `create`); a link that leaves the root is
+/// `permissionDenied` (`outsideRoot`). A special file is
+/// `failedPrecondition` (`notRegularFile`), a directory
+/// `failedPrecondition` (`isDirectory`). The parent of the final target
+/// must exist.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct WriteFileParams {
     pub path: EnvironmentPath,
+    /// At most `limits.filesystem.maxWriteFileBytes`; larger files go
+    /// through `transfer/*` with a `writeFile` selection.
     pub data: ByteChunk,
+    #[serde(default, skip_serializing_if = "WriteCondition::is_default")]
+    pub create: WriteCondition,
+    /// Write only when the current file's version equals this token;
+    /// otherwise `failedPrecondition` (`ifMatchFailed`).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub if_match: Option<FileVersion>,
+    /// Set the execute bits (the read bits' pattern). Without it a new file
+    /// gets the default mode and an existing file keeps its mode.
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub executable: bool,
 }
 
-#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct WriteFileResponse {}
+/// `fs/writeFile` response.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct WriteFileResponse {
+    /// Version of the written file.
+    pub version: FileVersion,
+}
 
+/// `fs/createDirectory` params.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct CreateDirectoryParams {
     pub path: EnvironmentPath,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub recursive: Option<bool>,
+    /// Create missing parents, and succeed when the directory exists.
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub recursive: bool,
 }
 
+/// `fs/createDirectory` response.
 #[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct CreateDirectoryResponse {}
 
+/// `fs/getMetadata` params.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct GetMetadataParams {
     pub path: EnvironmentPath,
+    /// Describe the symlink's target instead of the link (subject to
+    /// confinement).
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub follow_symlinks: bool,
 }
 
+/// `fs/getMetadata` response.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct GetMetadataResponse {
-    pub is_directory: bool,
-    pub is_file: bool,
-    pub is_symlink: bool,
-    pub created_at_ms: i64,
-    pub modified_at_ms: i64,
+    pub metadata: FileMetadata,
 }
 
+/// `fs/readDirectory` params. Pages in name order.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct ReadDirectoryParams {
+    /// A directory, or a symlink to one inside the root.
     pub path: EnvironmentPath,
+    /// Most entries per page, 1 to `limits.filesystem.maxDirectoryEntries`.
+    pub limit: u32,
+    /// `nextCursor` of the previous page; a cursor this daemon did not mint
+    /// is `invalidParams`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub cursor: Option<DirectoryCursor>,
 }
 
+/// `fs/readDirectory` response.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct ReadDirectoryEntry {
-    pub file_name: String,
-    pub is_directory: bool,
-    pub is_file: bool,
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ReadDirectoryResponse {
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub entries: Vec<DirectoryEntry>,
+    /// Opaque cursor of the next page; absent on the last page.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub next_cursor: Option<DirectoryCursor>,
+    /// Entries in this page's range skipped because their names are not
+    /// UTF-8. Entries that vanish while the page is built are left out and
+    /// not counted.
+    #[serde(default, skip_serializing_if = "is_zero_u32")]
+    pub skipped_entry_count: u32,
 }
 
+/// One `fs/readDirectory` entry.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct ReadDirectoryResponse {
-    pub entries: Vec<ReadDirectoryEntry>,
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct DirectoryEntry {
+    pub name: EntryName,
+    /// The entry itself, not a symlink's target. Entries that vanish while
+    /// the page is built are left out.
+    pub metadata: FileMetadata,
 }
 
+/// `fs/remove` params.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct RemoveParams {
+    /// A symlink is removed, never followed.
     pub path: EnvironmentPath,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub recursive: Option<bool>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub force: Option<bool>,
+    /// Remove a directory and its contents.
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub recursive: bool,
+    /// Succeed when the path does not exist.
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub force: bool,
 }
 
+/// `fs/remove` response.
 #[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct RemoveResponse {}
 
+/// `fs/rename` params. Atomic within one filesystem; across filesystems it
+/// is `failedPrecondition` (`crossDevice`). The entry keeps its mode.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct CopyParams {
-    pub source_path: EnvironmentPath,
-    pub destination_path: EnvironmentPath,
-    #[serde(default)]
-    pub recursive: bool,
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct RenameParams {
+    pub source: EnvironmentPath,
+    pub destination: EnvironmentPath,
+    /// Replace an existing destination file; otherwise an existing
+    /// destination is `alreadyExists`. A directory destination is never
+    /// replaced.
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub overwrite: bool,
+    /// Rename only when the source's version equals this token.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub if_match: Option<FileVersion>,
 }
 
+/// `fs/rename` response.
 #[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct CopyResponse {}
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct RenameResponse {}
+
+/// Which entries a walk visits. The default visits everything except
+/// hidden and ignored entries.
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct TreeFilter {
+    /// Select entries matching any pattern; empty selects every entry.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub include: Vec<String>,
+    /// Drop entries matching any pattern; a matching directory is pruned.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub exclude: Vec<String>,
+    /// Match patterns case-insensitively.
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub ignore_case: bool,
+    /// Visit entries whose name starts with `.`.
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub include_hidden: bool,
+    /// Visit entries that ignore files exclude.
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub include_ignored: bool,
+    /// Deepest entry depth visited: the root's direct children are depth
+    /// 1, so `1` selects direct children only. Unbounded when absent.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub max_depth: Option<u32>,
+}
+
+impl TreeFilter {
+    pub fn is_default(&self) -> bool {
+        *self == Self::default()
+    }
+}
 
-/// Bounded recursive text search executed natively by the environment endpoint.
-///
-/// The environment endpoint performs traversal and matching locally and returns only bounded
-/// matches plus scan statistics, so a broad search does not become per-file
-/// transfer over the data plane. Every limit is mandatory: an endpoint must stop
-/// scanning when any bound is reached and report why.
+/// `fs/searchText` params: a bounded recursive regex search run by the
+/// daemon. A file larger than the remaining byte budget is skipped and
+/// counted; it never ends the walk.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct SearchTextParams {
     pub root: EnvironmentPath,
-    /// Regular expression (Rust `regex` dialect, the same dialect the
-    /// caller-side fallback uses).
+    /// Regular expression in the Rust `regex` crate's syntax, matched per
+    /// line.
     pub pattern: String,
-    /// Optional glob filter applied to the root-relative path or file name.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub include: Option<String>,
-    #[serde(default)]
-    pub case_sensitive: bool,
-    /// Maximum directory depth below the root, matching the generic
-    /// traversal's semantics; absent means unbounded depth.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub max_depth: Option<u32>,
+    /// Match `pattern` case-insensitively. `filter.ignoreCase` governs the
+    /// path patterns instead.
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub pattern_ignore_case: bool,
+    #[serde(default, skip_serializing_if = "TreeFilter::is_default")]
+    pub filter: TreeFilter,
     pub limits: SearchTextLimits,
 }
 
+/// Caller quotas of one search; each at most its advertised ceiling.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct SearchTextLimits {
-    pub max_matches: u64,
-    /// Maximum number of files searched (not merely visited by traversal).
-    pub max_files: u64,
-    /// Maximum cumulative bytes searched across files.
+    pub max_matches: u32,
+    /// Files searched, not merely visited.
+    pub max_files: u32,
+    /// Bytes actually read across files.
     pub max_bytes: u64,
     pub max_duration_ms: u64,
+    /// Longer matching lines are cut and marked `lineTruncated`.
+    pub max_line_bytes: u32,
 }
 
+/// `fs/searchText` response.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct SearchTextResponse {
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub matches: Vec<SearchTextMatch>,
+    pub searched_file_count: u32,
+    pub searched_bytes: u64,
+    /// Files skipped because they exceeded the remaining byte budget, are
+    /// binary or could not be read.
+    #[serde(default, skip_serializing_if = "is_zero_u32")]
+    pub skipped_file_count: u32,
+    /// Entries the walk could not represent or list: names that are not
+    /// UTF-8 and directories that could not be read.
+    #[serde(default, skip_serializing_if = "is_zero_u32")]
+    pub skipped_entry_count: u32,
+    pub elapsed_ms: u64,
+    /// Absent when the walk finished within its limits.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub stopped: Option<SearchTextStop>,
+}
+
+/// One matching line.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct SearchTextMatch {
     pub path: EnvironmentPath,
-    pub line_number: u64,
+    /// 1-based.
+    pub line_number: u32,
+    /// The matching line without its terminator, cut at `maxLineBytes` on a
+    /// character boundary.
     pub line: String,
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub line_truncated: bool,
 }
 
-/// Why a search stopped before exhausting the tree.
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+/// Why a search stopped before finishing its walk.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
 #[serde(rename_all = "camelCase")]
 pub enum SearchTextStop {
+    /// `maxMatches` matches were found.
     MatchLimit,
+    /// `maxFiles` files were searched.
     FileLimit,
+    /// `maxBytes` bytes were read.
     ByteLimit,
+    /// `maxDurationMs` ran out.
     TimeLimit,
+    /// The next match would push the encoded matches past
+    /// [`MAX_RESULT_BYTES`](crate::limits::MAX_RESULT_BYTES).
+    ResponseLimit,
 }
 
+/// `fs/globFiles` params: bounded recursive enumeration of non-directory
+/// entries matching `filter.include`.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SearchTextResponse {
-    pub matches: Vec<SearchTextMatch>,
-    pub files_searched: u64,
-    pub bytes_searched: u64,
-    pub elapsed_ms: u64,
-    /// Absent when the search exhausted the tree within its limits.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub stopped: Option<SearchTextStop>,
-}
-
-/// Bounded recursive file enumeration executed natively by the environment endpoint.
-///
-/// Pattern semantics mirror the caller-side generic glob tool: a pattern
-/// starting with `/` matches the caller-space absolute path; otherwise the
-/// root-relative path matches, and a pattern without `/` also matches bare
-/// file names.
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct GlobFilesParams {
     pub root: EnvironmentPath,
-    pub pattern: String,
-    /// Maximum directory depth below the root, matching the generic
-    /// traversal's semantics; absent means unbounded depth.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub max_depth: Option<u32>,
+    /// `include` must not be empty.
+    pub filter: TreeFilter,
     pub limits: GlobFilesLimits,
 }
 
+/// Caller quotas of one enumeration; each at most its advertised ceiling.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct GlobFilesLimits {
-    pub max_matches: u64,
-    /// Maximum directory entries (files and directories) visited by the
-    /// traversal.
-    pub max_entries: u64,
+    pub max_matches: u32,
+    /// Non-directory entries visited.
+    pub max_files: u32,
     pub max_duration_ms: u64,
 }
 
-/// Why an enumeration stopped before exhausting the tree.
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub enum GlobFilesStop {
-    MatchLimit,
-    EntryLimit,
-    TimeLimit,
-}
-
+/// `fs/globFiles` response.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct GlobFilesResponse {
+    /// In walk order (sorted by path).
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub matches: Vec<EnvironmentPath>,
-    pub entries_visited: u64,
+    pub visited_file_count: u32,
+    /// Entries the walk could not represent or list: names that are not
+    /// UTF-8 and directories that could not be read.
+    #[serde(default, skip_serializing_if = "is_zero_u32")]
+    pub skipped_entry_count: u32,
     pub elapsed_ms: u64,
-    /// Absent when the enumeration exhausted the tree within its limits.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub stopped: Option<GlobFilesStop>,
 }
+
+/// Why an enumeration stopped before finishing its walk.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase")]
+pub enum GlobFilesStop {
+    /// `maxMatches` paths were found.
+    MatchLimit,
+    /// `maxFiles` non-directory entries were visited.
+    FileLimit,
+    /// `maxDurationMs` ran out.
+    TimeLimit,
+    /// The next match would push the encoded matches past
+    /// [`MAX_RESULT_BYTES`](crate::limits::MAX_RESULT_BYTES).
+    ResponseLimit,
+}
diff --git a/crates/environment-protocol/src/data/handshake.rs b/crates/environment-protocol/src/data/handshake.rs
index 2a59d46e2..5def4fa5c 100644
--- a/crates/environment-protocol/src/data/handshake.rs
+++ b/crates/environment-protocol/src/data/handshake.rs
@@ -1,41 +1,230 @@
-//! Data-plane connection handshake.
+//! Data-plane `initialize`.
+//!
+//! `initialize` is the first request on every data connection; any other
+//! method before it is `notInitialized`, and a second `initialize` is
+//! `invalidRequest`. A `protocolVersion` other than
+//! [`ENVD_PROTOCOL_VERSION`](crate::ENVD_PROTOCOL_VERSION) is
+//! `versionMismatch`. The connection stays open after all three.
 
 use serde::{Deserialize, Serialize};
 
-use crate::shared::{
-    CURRENT_PROTOCOL_VERSION, EnvironmentCapabilities, EnvironmentConnectionId, EnvironmentScope,
-    ImplementationInfo,
+use crate::{
+    handshake::{ImplementationInfo, Plane},
+    ids::DaemonInstanceId,
+    paths::EnvironmentPath,
+    serde_util::is_false,
 };
 
+/// `initialize` params on the data plane.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct InitializeParams {
-    #[serde(default = "default_protocol_version")]
+    /// The client's `ENVD_PROTOCOL_VERSION`.
     pub protocol_version: u32,
-    pub client_name: String,
-    pub scope: EnvironmentScope,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub resume_connection_id: Option<EnvironmentConnectionId>,
+    pub client_info: ImplementationInfo,
 }
 
+/// `initialize` response on the data plane.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct InitializeResponse {
     pub protocol_version: u32,
-    pub connection_id: EnvironmentConnectionId,
-    pub capabilities: EnvironmentCapabilities,
+    /// Always `data`.
+    pub plane: Plane,
+    /// Random per daemon start; a different value than on an earlier
+    /// connection means the daemon restarted and the earlier instance's
+    /// process handles are gone.
+    pub daemon_instance_id: DaemonInstanceId,
+    pub server_info: ImplementationInfo,
+    pub capabilities: DataCapabilities,
+    pub limits: DataLimits,
+    /// The daemon's working directory: the default `cwd` of commands.
+    pub default_cwd: EnvironmentPath,
+    /// Home directory of the user commands run as, when known.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub home_directory: Option<EnvironmentPath>,
+}
+
+/// Capability families. A present family means its base methods exist; a
+/// family's fields are facts that vary per instance. A request to an
+/// absent family, or one needing an absent fact, is
+/// `capabilityUnavailable`.
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct DataCapabilities {
+    /// `fs/*` (search, glob and scan included) and `transfer/*`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub filesystem: Option<FilesystemCapabilities>,
+    /// `process/*`.
     #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub default_cwd: Option<String>,
-    /// Home directory of the endpoint execution user.
+    pub process: Option<ProcessCapabilities>,
+    /// `job/*`.
     #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub home_directory: Option<String>,
-    pub implementation: ImplementationInfo,
+    pub job: Option<JobCapabilities>,
 }
 
+/// The `filesystem` family: `fs/*` and `transfer/*`.
 #[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct InitializedParams {}
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct FilesystemCapabilities {
+    /// Methods that change the filesystem are served; false on a daemon
+    /// started read-only.
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub write: bool,
+}
+
+/// The `process` family: `process/*`.
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ProcessCapabilities {
+    /// `process/start` accepts `pty`.
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub pty: bool,
+}
+
+/// The `job` family: `job/*`. It has no instance facts.
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct JobCapabilities {}
+
+/// Operational ceilings this daemon enforces. A request above a ceiling is
+/// `invalidParams` naming the field and the ceiling; nothing is clamped.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct DataLimits {
+    /// Requests in flight per connection before `busy`; at least
+    /// [`MIN_CONCURRENT_REQUESTS`](crate::limits::MIN_CONCURRENT_REQUESTS).
+    pub max_concurrent_requests: u32,
+    /// Largest `waitMs` of `process/read` and `job/read`.
+    pub max_wait_ms: u64,
+    pub process: ProcessLimits,
+    pub job: JobLimits,
+    pub filesystem: FilesystemLimits,
+}
+
+/// Ceilings of `process/*`.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ProcessLimits {
+    /// Largest `maxBytes` of one `process/read`.
+    pub max_read_bytes: u64,
+    /// Output a process retains; beyond it the oldest delivered bytes are
+    /// released (`expired` gaps), then the undelivered middle (`overflow`
+    /// gaps).
+    pub max_retained_output_bytes: u64,
+    /// How long an exited process stays readable after a read first
+    /// returned its settled exit with nothing left unread.
+    pub retention_after_exit_ms: u64,
+    /// How long an exited process whose output was never fully read stays
+    /// readable.
+    pub unread_retention_ms: u64,
+    /// Output retained across all exited processes; beyond it the oldest
+    /// are evicted early.
+    pub max_exited_retained_bytes: u64,
+    /// Grace between `SIGTERM` and `SIGKILL` for `terminate` and timeouts.
+    pub terminate_grace_ms: u64,
+    /// Bytes queued for a process's input before `process/write` accepts
+    /// fewer than it was sent.
+    pub max_input_queue_bytes: u64,
+}
+
+/// Ceilings of `job/*`.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct JobLimits {
+    /// Largest `maxBytes` of one `job/read`, across its entries.
+    pub max_read_bytes: u64,
+    /// Most jobs one `job/start`, `job/read` or `job/cancel` names, and most
+    /// entries a `job/cancel` response lists.
+    pub max_request_jobs: u32,
+    /// Output a job retains: the head and the tail, each half of this; the
+    /// middle is an `overflow` gap.
+    pub max_retained_output_bytes: u64,
+    /// How long a terminal job's record and output are kept.
+    pub record_retention_ms: u64,
+    /// Grace between `SIGTERM` and `SIGKILL` for a non-forced cancel and
+    /// timeouts.
+    pub cancel_grace_ms: u64,
+}
+
+/// Ceilings of `fs/*` and `transfer/*`.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct FilesystemLimits {
+    /// Largest `maxBytes` of `fs/readFile`.
+    pub max_read_file_bytes: u64,
+    /// Largest `data` of `fs/writeFile`.
+    pub max_write_file_bytes: u64,
+    /// Largest `limit` of `fs/readDirectory`.
+    pub max_directory_entries: u32,
+    pub search: SearchCeilings,
+    pub glob: GlobCeilings,
+    pub scan: ScanCeilings,
+    pub transfer: TransferCeilings,
+}
+
+/// Ceilings of `fs/searchText` quotas, field for field.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct SearchCeilings {
+    pub max_matches: u32,
+    pub max_files: u32,
+    pub max_bytes: u64,
+    pub max_duration_ms: u64,
+    pub max_line_bytes: u32,
+}
+
+/// Ceilings of `fs/globFiles` quotas, field for field.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct GlobCeilings {
+    pub max_matches: u32,
+    pub max_files: u32,
+    pub max_duration_ms: u64,
+}
+
+/// Ceilings of `fs/scan`: root and pattern counts, then its quotas.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ScanCeilings {
+    pub max_roots: u32,
+    pub max_patterns: u32,
+    pub max_entries: u32,
+    pub max_file_bytes: u64,
+    pub max_total_bytes: u64,
+    pub max_duration_ms: u64,
+}
 
-fn default_protocol_version() -> u32 {
-    CURRENT_PROTOCOL_VERSION
+/// Ceilings of `transfer/*`: capacity, page and chunk sizes, receipt
+/// retention, then the per-operation quotas.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct TransferCeilings {
+    /// Operations not yet complete, aborted or failed, across connections;
+    /// a begin beyond it is `busy` (`transferCapacity`).
+    pub max_active_operations: u32,
+    pub max_content_chunk_bytes: u64,
+    pub max_inventory_page_entries: u32,
+    /// How long a finished operation's receipt is answered.
+    pub receipt_retention_ms: u64,
+    pub max_entries: u32,
+    pub max_depth: u32,
+    pub max_file_bytes: u64,
+    pub max_total_bytes: u64,
+    pub max_manifest_bytes: u64,
+    pub max_duration_ms: u64,
 }
diff --git a/crates/environment-protocol/src/data/idle.rs b/crates/environment-protocol/src/data/idle.rs
index 4ebd0bbfa..d95831bbe 100644
--- a/crates/environment-protocol/src/data/idle.rs
+++ b/crates/environment-protocol/src/data/idle.rs
@@ -1,41 +1,38 @@
-//! Daemon activity report used by idle power policy.
+//! `env/getIdle`: the daemon's activity report for idle power policy.
 //!
-//! The daemon reports a monotonic idle *duration*, never a wall-clock
-//! timestamp: after a freeze, stateful stop, or snapshot restore the guest
-//! clock is stale until it resyncs, while a monotonic duration stays correct.
+//! The daemon reports a monotonic idle duration, never a wall-clock
+//! timestamp: after a freeze, stateful stop or snapshot restore the guest
+//! clock is stale until it resyncs, while a monotonic duration stays
+//! correct. Policy decides on `idleForMs` alone; the counts are
+//! diagnostics.
 
 use serde::{Deserialize, Serialize};
 
+use crate::serde_util::is_zero_u32;
+
+/// `env/getIdle` params.
 #[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct IdleParams {}
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct GetIdleParams {}
 
+/// `env/getIdle` response.
 #[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct IdleResponse {
-    /// Milliseconds since the last data-plane request or since the last
-    /// process/job finished, whichever is later. Zero while anything runs.
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct GetIdleResponse {
+    /// Milliseconds since the last `use` request, or since running work
+    /// last ended, whichever is later. Zero while any process or job runs.
     pub idle_for_ms: u64,
-    /// Processes started through `process/start` that have not exited.
-    pub running_processes: u32,
-    /// Jobs that are running or cancelling.
-    pub running_jobs: u32,
-    /// Process groups of finished commands that still have members alive:
-    /// services and other leftovers a command started and did not stop.
-    /// They are not running work, so they never block idle power policy;
-    /// a policy may prefer freezing over stopping while the count is
-    /// non-zero.
-    #[serde(default, skip_serializing_if = "is_zero")]
-    pub leftover_process_groups: u32,
-}
-
-fn is_zero(value: &u32) -> bool {
-    *value == 0
-}
-
-impl IdleResponse {
-    /// True when nothing is executing inside the environment.
-    pub fn is_quiescent(&self) -> bool {
-        self.running_processes == 0 && self.running_jobs == 0
-    }
+    /// Processes started with `process/start` whose root has not exited.
+    #[serde(default, skip_serializing_if = "is_zero_u32")]
+    pub running_process_count: u32,
+    /// Jobs that are `running`.
+    #[serde(default, skip_serializing_if = "is_zero_u32")]
+    pub running_job_count: u32,
+    /// Process groups of exited processes that still have members alive:
+    /// services a command started and left running. They are not running
+    /// work and do not hold `idleForMs` at zero.
+    #[serde(default, skip_serializing_if = "is_zero_u32")]
+    pub leftover_process_group_count: u32,
 }
diff --git a/crates/environment-protocol/src/data/inventory.rs b/crates/environment-protocol/src/data/inventory.rs
deleted file mode 100644
index 42d9a58f0..000000000
--- a/crates/environment-protocol/src/data/inventory.rs
+++ /dev/null
@@ -1,122 +0,0 @@
-//! Portable filesystem inventories. Digests identify raw file bytes, not paths or modes.
-use crate::shared::{ByteChunk, EnvironmentPath};
-use serde::{Deserialize, Serialize};
-
-pub const MAX_INVENTORY_PAGE: usize = 128;
-pub const MAX_CONTENT_CHUNK: usize = 256 * 1024;
-pub const MAX_INVENTORY_PATH_BYTES: usize = 4096;
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(
-    tag = "kind",
-    rename_all = "camelCase",
-    rename_all_fields = "camelCase"
-)]
-pub enum InventoryContent {
-    Directory,
-    File {
-        size_bytes: u64,
-        executable: bool,
-        digest: String,
-    },
-}
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct InventoryEntry {
-    /// Empty for the selected root; otherwise a strict relative slash-separated path.
-    pub path: String,
-    pub content: InventoryContent,
-}
-
-/// Total operation quotas, separate from wire chunk and page limits.
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct InventoryLimits {
-    pub max_entries: u32,
-    pub max_depth: u32,
-    pub max_file_bytes: u64,
-    pub max_total_bytes: u64,
-    pub max_manifest_bytes: u64,
-    pub max_duration_ms: u64,
-}
-impl Default for InventoryLimits {
-    fn default() -> Self {
-        Self {
-            max_entries: 100_000,
-            max_depth: 64,
-            max_file_bytes: 1024_u64.pow(4),
-            max_total_bytes: 1024_u64.pow(4),
-            max_manifest_bytes: 32 * 1024 * 1024,
-            max_duration_ms: 24 * 60 * 60 * 1000,
-        }
-    }
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub enum ScanDigestAlgorithm {
-    Sha256,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(
-    tag = "kind",
-    rename_all = "camelCase",
-    rename_all_fields = "camelCase"
-)]
-pub enum ScanContent {
-    Directory,
-    File {
-        size_bytes: u64,
-        executable: bool,
-        #[serde(default, skip_serializing_if = "Option::is_none")]
-        digest: Option<String>,
-    },
-}
-
-/// Small, bounded observation for catalogs. Large inventories use transfer sessions.
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct ScanParams {
-    pub roots: Vec<EnvironmentPath>,
-    /// Filename-only patterns without `/` or `**` select direct children only.
-    /// Other patterns permit recursive traversal within the operation quotas.
-    #[serde(default)]
-    pub include_patterns: Vec<String>,
-    #[serde(default)]
-    pub read_content: bool,
-    /// Follow aliases only inside the endpoint filesystem access scope.
-    #[serde(default)]
-    pub follow_symlinks: bool,
-    #[serde(default)]
-    pub digest_algorithm: Option<ScanDigestAlgorithm>,
-    #[serde(default)]
-    pub limits: InventoryLimits,
-    pub if_none_match: Option<String>,
-}
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct ScanEntry {
-    /// Resolved absolute identity, while root/path retain the requested spelling.
-    pub canonical_path: EnvironmentPath,
-    pub root: EnvironmentPath,
-    pub path: String,
-    pub content: ScanContent,
-    pub data: Option<ByteChunk>,
-}
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct ScanDiagnostic {
-    pub root: EnvironmentPath,
-    pub error: crate::error::EnvironmentProtocolError,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct ScanResponse {
-    pub fingerprint: Option<String>,
-    pub unchanged: bool,
-    pub complete: bool,
-    pub entries: Vec<ScanEntry>,
-    pub diagnostics: Vec<ScanDiagnostic>,
-}
diff --git a/crates/environment-protocol/src/data/job.rs b/crates/environment-protocol/src/data/job.rs
new file mode 100644
index 000000000..30f5e8a04
--- /dev/null
+++ b/crates/environment-protocol/src/data/job.rs
@@ -0,0 +1,302 @@
+//! `job/*`: durable batch commands with dependencies and queues.
+//!
+//! A job is identified by its `jobId` on the daemon together with the
+//! `requestId` of the `job/start` that created it. Its record and output
+//! survive daemon restarts; a job that was queued or running when the
+//! daemon stopped is `interrupted`. When a job's root process finishes, the
+//! daemon sweeps the job's process group and reports what it swept.
+
+use serde::{Deserialize, Serialize};
+
+use crate::{
+    data::exec::{CommandSpec, ExitStatus, LeftoverReport, OutputPage, ReturnOn, StoppedBy},
+    error::ProtocolError,
+    ids::{JobId, JobName, JobRequestId, QueueKey},
+    serde_util::{is_false, is_zero_u32},
+};
+
+/// `job/start` params. All-or-nothing: either every job is accepted (or
+/// replayed) or none is.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct StartJobsParams {
+    /// Idempotency key of this start. Retrying with the same request id and
+    /// identical jobs replays the existing jobs; reusing a job id with
+    /// another request id or spec is `failedPrecondition` (`jobIdInUse`).
+    pub request_id: JobRequestId,
+    /// 1 to `limits.job.maxRequestJobs` jobs.
+    pub jobs: Vec<JobSpec>,
+}
+
+/// One job of a `job/start`.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct JobSpec {
+    pub job_id: JobId,
+    /// Local name other jobs of the same `job/start` can depend on; unique
+    /// within the request.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub name: Option<JobName>,
+    /// `input` must be `none` or `bytes`.
+    pub command: CommandSpec,
+    /// Jobs that must finish first.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub depends_on: Vec<JobDependency>,
+    /// What "finish" means for `dependsOn`; `allSucceeded` by default.
+    #[serde(default, skip_serializing_if = "JobDependencyPolicy::is_default")]
+    pub dependency_policy: JobDependencyPolicy,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub queue_key: Option<QueueKey>,
+}
+
+/// A dependency reference.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(
+    tag = "kind",
+    rename_all = "camelCase",
+    rename_all_fields = "camelCase",
+    deny_unknown_fields
+)]
+pub enum JobDependency {
+    /// An existing job on this daemon, or one in the same request.
+    JobId { job_id: JobId },
+    /// The `name` of a job in the same `job/start`.
+    Name { name: JobName },
+}
+
+/// What a job waits for from its `dependsOn` jobs.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase")]
+pub enum JobDependencyPolicy {
+    /// Run once every dependency `succeeded`; any other terminal status
+    /// makes this job `dependencyFailed`.
+    #[default]
+    AllSucceeded,
+    /// Run once every dependency is terminal, whatever its status.
+    AllTerminal,
+}
+
+impl JobDependencyPolicy {
+    pub fn is_default(&self) -> bool {
+        *self == Self::AllSucceeded
+    }
+}
+
+/// `job/start` response: one summary per requested job, in request order.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct StartJobsResponse {
+    /// Never empty.
+    pub jobs: Vec<JobSummary>,
+}
+
+/// `job/read` params.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ReadJobsParams {
+    /// 1 to `limits.job.maxRequestJobs` entries, each with its own position.
+    pub jobs: Vec<JobReadRequest>,
+    /// Most `data` bytes across all entries, at most
+    /// `limits.job.maxReadBytes`, filled in request order: an entry reached
+    /// after the budget is spent returns its summary and an empty page at
+    /// its start position. 0 reads only summaries.
+    pub max_bytes: u64,
+    /// How long to wait, at most `limits.maxWaitMs`. 0 polls.
+    pub wait_ms: u64,
+    /// `anyOutput`: return when any entry has output past its position or
+    /// changed status; `exit`: when every entry is terminal; `window`: wait
+    /// the whole window.
+    pub return_on: ReturnOn,
+}
+
+/// One entry of a `job/read`. Job reads never consume: without `after` and
+/// `tailBytes` the page starts at offset 0. One job may be named by several
+/// entries, such as a head and a tail page.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct JobReadRequest {
+    pub job_id: JobId,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub after: Option<u64>,
+    /// Start at `end - tailBytes`; excludes `after`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub tail_bytes: Option<u64>,
+    /// Most `data` bytes for this entry; the request's `maxBytes` still
+    /// bounds the total. Absent: whatever of the request's budget remains.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub max_bytes: Option<u64>,
+}
+
+/// `job/read` response: one entry per requested job, in request order.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ReadJobsResponse {
+    /// Never empty.
+    pub jobs: Vec<JobReadEntry>,
+}
+
+/// A `job/read` entry: the job's summary and output page, or why it could
+/// not be read (`notFound` for an unknown or garbage-collected job).
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(
+    tag = "kind",
+    rename_all = "camelCase",
+    rename_all_fields = "camelCase",
+    deny_unknown_fields
+)]
+pub enum JobReadEntry {
+    Job {
+        summary: Box<JobSummary>,
+        output: OutputPage,
+    },
+    Error {
+        job_id: JobId,
+        error: ProtocolError,
+    },
+}
+
+/// `job/cancel` params.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct CancelJobsParams {
+    /// 1 to `limits.job.maxRequestJobs` ids.
+    pub job_ids: Vec<JobId>,
+    /// `job` by default.
+    #[serde(default, skip_serializing_if = "JobCancelScope::is_default")]
+    pub scope: JobCancelScope,
+    /// Kill at once instead of `SIGTERM`, `limits.job.cancelGraceMs`, then
+    /// `SIGKILL`.
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub force: bool,
+}
+
+/// Which jobs a `job/cancel` affects.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase")]
+pub enum JobCancelScope {
+    /// Only the named jobs.
+    #[default]
+    Job,
+    /// The named jobs and every job that transitively depends on them.
+    Dependents,
+}
+
+impl JobCancelScope {
+    pub fn is_default(&self) -> bool {
+        *self == Self::Job
+    }
+}
+
+/// `job/cancel` response: one entry per affected job, named jobs first in
+/// request order, then dependents, at most `limits.job.maxRequestJobs`
+/// entries in total.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct CancelJobsResponse {
+    /// Never empty.
+    pub jobs: Vec<JobSummaryEntry>,
+    /// Dependents cancelled as well but not listed, beyond the entry limit.
+    #[serde(default, skip_serializing_if = "is_zero_u32")]
+    pub unlisted_job_count: u32,
+}
+
+/// A job summary, or why the named job could not be found.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(
+    tag = "kind",
+    rename_all = "camelCase",
+    rename_all_fields = "camelCase",
+    deny_unknown_fields
+)]
+pub enum JobSummaryEntry {
+    Job { summary: Box<JobSummary> },
+    Error { job_id: JobId, error: ProtocolError },
+}
+
+/// What a job is and how it ended. Instants are the guest's wall clock.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct JobSummary {
+    pub job_id: JobId,
+    pub request_id: JobRequestId,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub name: Option<JobName>,
+    pub status: JobStatus,
+    /// Resolved ids of the jobs this one depends on.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub depends_on: Vec<JobId>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub queue_key: Option<QueueKey>,
+    pub created_at_ms: i64,
+    /// When the job became runnable and waited for its queue.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub queued_at_ms: Option<i64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub started_at_ms: Option<i64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub finished_at_ms: Option<i64>,
+    /// When a `job/cancel` reached the job while it ran.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub cancel_requested_at_ms: Option<i64>,
+    /// Monotonic run time from start to finish, immune to guest clock jumps.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub duration_ms: Option<u64>,
+    /// How the root process ended, once it ran and exited.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub exit: Option<ExitStatus>,
+    /// Set when the daemon stopped the running job: `timeout` for
+    /// `timedOut`, `terminate` or `kill` for a cancel without or with
+    /// `force`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub stopped_by: Option<StoppedBy>,
+    /// What the daemon swept from the job's group at completion
+    /// (`disposition: swept`).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub leftovers: Option<LeftoverReport>,
+    /// Why a `failed` or `interrupted` job produced no exit, or an
+    /// infrastructure failure while it ran.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub error: Option<ProtocolError>,
+}
+
+/// Job lifecycle. `queued` and `running` are live; the rest are terminal.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase")]
+pub enum JobStatus {
+    /// Accepted; waiting for dependencies or its queue.
+    Queued,
+    Running,
+    /// Exited with code 0.
+    Succeeded,
+    /// Exited otherwise, or could not start.
+    Failed,
+    /// Its `timeoutMs` expired and the daemon stopped it.
+    TimedOut,
+    /// Stopped or never started because of `job/cancel`.
+    Cancelled,
+    /// A dependency did not finish as the dependency policy requires.
+    DependencyFailed,
+    /// The daemon stopped while the job was queued or running.
+    Interrupted,
+}
+
+impl JobStatus {
+    pub fn is_terminal(self) -> bool {
+        !matches!(self, Self::Queued | Self::Running)
+    }
+}
diff --git a/crates/environment-protocol/src/data/jobs.rs b/crates/environment-protocol/src/data/jobs.rs
deleted file mode 100644
index 7db917d75..000000000
--- a/crates/environment-protocol/src/data/jobs.rs
+++ /dev/null
@@ -1,240 +0,0 @@
-//! Durable job method payloads.
-
-use std::collections::BTreeMap;
-
-use serde::{Deserialize, Serialize};
-
-use crate::shared::{ByteChunk, EnvironmentPath, JobId, SecretString};
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct StartJobsParams {
-    pub namespace: String,
-    pub request_id: String,
-    pub jobs: Vec<JobStartSpec>,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct JobStartSpec {
-    pub job_id: JobId,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub name: Option<String>,
-    pub argv: Vec<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub cwd: Option<EnvironmentPath>,
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    pub env: BTreeMap<String, String>,
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    pub secret_env: BTreeMap<String, SecretString>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub stdin: Option<ByteChunk>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub timeout_ms: Option<u64>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub depends_on: Vec<JobDependency>,
-    #[serde(default)]
-    pub dependency_policy: JobDependencyPolicy,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub queue_key: Option<String>,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct JobDependency {
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub job_id: Option<JobId>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub name: Option<String>,
-}
-
-impl JobDependency {
-    pub fn job_id(job_id: impl Into<JobId>) -> Self {
-        Self {
-            job_id: Some(job_id.into()),
-            name: None,
-        }
-    }
-
-    pub fn name(name: impl Into<String>) -> Self {
-        Self {
-            job_id: None,
-            name: Some(name.into()),
-        }
-    }
-}
-
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub enum JobDependencyPolicy {
-    #[default]
-    AllSucceeded,
-    AllTerminal,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct StartJobsResponse {
-    pub jobs: Vec<JobSummary>,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct ListJobsParams {
-    pub namespace: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub limit: Option<usize>,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct ListJobsResponse {
-    pub jobs: Vec<JobSummary>,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct ReadJobsParams {
-    pub namespace: String,
-    pub jobs: Vec<JobId>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub after_seq: Option<u64>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub max_bytes: Option<usize>,
-    #[serde(default)]
-    pub include_artifacts: bool,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub wait_ms: Option<u64>,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct ReadJobsResponse {
-    pub jobs: Vec<JobReadResult>,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct JobReadResult {
-    pub summary: JobSummary,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub output_chunks: Vec<JobOutputChunk>,
-    pub output_next_seq: u64,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub artifacts: Vec<JobArtifact>,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct CancelJobsParams {
-    pub namespace: String,
-    pub jobs: Vec<JobId>,
-    #[serde(default)]
-    pub scope: JobCancelScope,
-    #[serde(default)]
-    pub force: bool,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct CancelJobsResponse {
-    pub jobs: Vec<JobSummary>,
-}
-
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub enum JobCancelScope {
-    #[default]
-    Job,
-    Dependents,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
-#[serde(rename_all = "camelCase")]
-pub struct JobSummary {
-    pub namespace: String,
-    pub job_id: JobId,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub name: Option<String>,
-    pub status: JobStatus,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub dependencies: Vec<JobId>,
-    pub created_at_ms: u64,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub queued_at_ms: Option<u64>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub started_at_ms: Option<u64>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub finished_at_ms: Option<u64>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub exit_code: Option<i32>,
-    /// True when the job's root process exited while descendants it spawned
-    /// were still running. The environment daemon terminates them best-effort at job
-    /// completion; a submitting agent should fix its script's teardown.
-    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
-    pub orphaned_descendants: bool,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub failure: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub queue_key: Option<String>,
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
-#[serde(rename_all = "camelCase")]
-pub enum JobStatus {
-    Accepted,
-    Queued,
-    Running,
-    Succeeded,
-    Failed,
-    CancelRequested,
-    Cancelled,
-    TimedOut,
-    DependencyFailed,
-    Interrupted,
-    Lost,
-}
-
-impl JobStatus {
-    pub fn is_terminal(self) -> bool {
-        matches!(
-            self,
-            Self::Succeeded
-                | Self::Failed
-                | Self::Cancelled
-                | Self::TimedOut
-                | Self::DependencyFailed
-                | Self::Interrupted
-                | Self::Lost
-        )
-    }
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct JobOutputChunk {
-    pub seq: u64,
-    pub stream: JobOutputStream,
-    pub chunk: ByteChunk,
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
-#[serde(rename_all = "camelCase")]
-pub enum JobOutputStream {
-    Stdout,
-    Stderr,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
-#[serde(rename_all = "camelCase")]
-pub struct JobArtifact {
-    pub path: EnvironmentPath,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub kind: Option<String>,
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    pub metadata: BTreeMap<String, String>,
-}
diff --git a/crates/environment-protocol/src/data/methods.rs b/crates/environment-protocol/src/data/methods.rs
deleted file mode 100644
index 3f9647c80..000000000
--- a/crates/environment-protocol/src/data/methods.rs
+++ /dev/null
@@ -1,36 +0,0 @@
-//! JSON-RPC method names for the environment data plane.
-
-pub const INITIALIZE_METHOD: &str = "initialize";
-pub const INITIALIZED_METHOD: &str = "initialized";
-
-pub const FS_READ_FILE_METHOD: &str = "fs/readFile";
-pub const FS_WRITE_FILE_METHOD: &str = "fs/writeFile";
-pub const FS_CREATE_DIRECTORY_METHOD: &str = "fs/createDirectory";
-pub const FS_GET_METADATA_METHOD: &str = "fs/getMetadata";
-pub const FS_READ_DIRECTORY_METHOD: &str = "fs/readDirectory";
-pub const FS_REMOVE_METHOD: &str = "fs/remove";
-pub const FS_COPY_METHOD: &str = "fs/copy";
-pub const FS_SEARCH_TEXT_METHOD: &str = "fs/searchText";
-pub const FS_GLOB_FILES_METHOD: &str = "fs/globFiles";
-
-pub const PROCESS_START_METHOD: &str = "process/start";
-pub const PROCESS_READ_METHOD: &str = "process/read";
-pub const PROCESS_WRITE_METHOD: &str = "process/write";
-pub const PROCESS_TERMINATE_METHOD: &str = "process/terminate";
-pub const PROCESS_RESIZE_METHOD: &str = "process/resize";
-pub const PROCESS_OUTPUT_METHOD: &str = "process/output";
-pub const PROCESS_EXITED_METHOD: &str = "process/exited";
-pub const PROCESS_CLOSED_METHOD: &str = "process/closed";
-
-pub const JOB_START_METHOD: &str = "job/start";
-pub const JOB_LIST_METHOD: &str = "job/list";
-pub const JOB_READ_METHOD: &str = "job/read";
-pub const JOB_CANCEL_METHOD: &str = "job/cancel";
-
-pub const ENV_IDLE_METHOD: &str = "env/idle";
-
-pub const FS_MATERIALIZE_METHOD: &str = "fs/materialize";
-pub const FS_CAPTURE_METHOD: &str = "fs/capture";
-
-pub const FS_SCAN_METHOD: &str = "fs/scan";
-pub const FS_TRANSFER_METHOD: &str = "fs/transfer";
diff --git a/crates/environment-protocol/src/data/mod.rs b/crates/environment-protocol/src/data/mod.rs
index f4dcb3340..5e143ce19 100644
--- a/crates/environment-protocol/src/data/mod.rs
+++ b/crates/environment-protocol/src/data/mod.rs
@@ -1,13 +1,11 @@
-//! Data-plane protocol for one selected environment execution scope.
+//! The data plane: one envd serving one environment's filesystem,
+//! processes and jobs. The runtime is the client; envd is the server.
 
-pub mod events;
+pub mod exec;
 pub mod fs;
 pub mod handshake;
 pub mod idle;
-pub mod jobs;
-pub mod methods;
+pub mod job;
 pub mod process;
+pub mod scan;
 pub mod transfer;
-
-pub mod inventory;
-pub mod transfer_session;
diff --git a/crates/environment-protocol/src/data/process.rs b/crates/environment-protocol/src/data/process.rs
index 57b69c643..fac452aea 100644
--- a/crates/environment-protocol/src/data/process.rs
+++ b/crates/environment-protocol/src/data/process.rs
@@ -1,203 +1,167 @@
-//! Process method payloads.
+//! `process/*`: interactive processes read through byte-offset pages.
 //!
-//! A process is started as the leader of its own process group and read
-//! through a daemon-owned cursor: `process/read` without `afterSeq` returns
-//! the output produced since the previous cursor read and advances the
-//! cursor, so a handle used from a later connection never re-reads output.
-//! The root's natural exit never sweeps the group; whatever it left running
-//! is reported and keeps the environment's lifetime.
-
-use std::collections::BTreeMap;
+//! A process runs as the leader of its own process group. Its root's
+//! natural exit never sweeps the group: whatever it left running is
+//! reported in `leftovers` and keeps the environment's lifetime. Each
+//! process has a daemon-owned cursor; a read without `after` starts there,
+//! and the cursor advances to `next` only after the response frame was
+//! written to the connection.
 
 use serde::{Deserialize, Serialize};
 
-use crate::shared::{ByteChunk, EnvironmentPath, ProcessId, SecretString};
-
+use crate::{
+    bytes::ByteChunk,
+    data::exec::{
+        CommandSpec, ExecState, ExitStatus, LeftoverReport, OutputPage, PtySize, ReturnOn,
+        StoppedBy,
+    },
+    error::ProtocolError,
+    ids::ProcessId,
+    serde_util::is_false,
+};
+
+/// `process/start` params.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct StartProcessParams {
+    /// Caller-chosen handle, reserved before any side effect: a start whose
+    /// id is already in use (running, retained or remembered by a tombstone)
+    /// is `alreadyExists` and runs nothing.
     pub process_id: ProcessId,
-    pub argv: Vec<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub cwd: Option<EnvironmentPath>,
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    pub env: BTreeMap<String, String>,
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    pub secret_env: BTreeMap<String, SecretString>,
-    /// One-shot standard input, written and closed at start. Plain-pipe
-    /// processes otherwise read end of file from `/dev/null`; interactive
-    /// input requires `tty`, whose master is the process's input.
+    pub command: CommandSpec,
+    /// Run under a PTY of this size. The PTY master is the input: `input`
+    /// must then be `none` or `bytes`, and `process/write` is always
+    /// accepted while the process runs. Requires
+    /// `capabilities.process.pty`.
     #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub stdin: Option<ByteChunk>,
-    /// Kill deadline. Absent means the call never kills a running process.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub timeout_ms: Option<u64>,
-    #[serde(default)]
-    pub tty: bool,
+    pub pty: Option<PtySize>,
 }
 
+/// `process/start` response, sent once the process runs.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct StartProcessResponse {
-    pub process_id: ProcessId,
+    /// OS pid of the root process, which is also its process group id.
+    pub pid: u32,
 }
 
+/// `process/read` params.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct ReadProcessParams {
     pub process_id: ProcessId,
-    /// Explicit re-read from a sequence number over the retained output. It
-    /// does not move the daemon's cursor; omit it to read after the last
-    /// delivered chunk and advance the cursor.
+    /// Start offset. Absent: the daemon cursor, which this read advances to
+    /// `next` once its response is written. Present: a non-consuming read
+    /// that leaves the cursor alone.
     #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub after_seq: Option<u64>,
+    pub after: Option<u64>,
+    /// Start at `end - tailBytes` instead (clamped at 0). Non-consuming;
+    /// excludes `after`.
     #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub max_bytes: Option<usize>,
-    /// Collect output for this long, returning early only when the process
-    /// exits or `max_bytes` is reached. Absent blocks until exit.
+    pub tail_bytes: Option<u64>,
+    /// Acknowledge every byte before this offset first: the cursor moves to
+    /// it (never backwards) whether or not this read's response arrives. A
+    /// caller that tracks positions reads with `after` and acknowledges
+    /// with `ack` for exactly-once delivery.
     #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub wait_ms: Option<u64>,
+    pub ack: Option<u64>,
+    /// Most `data` bytes to return, at most `limits.process.maxReadBytes`.
+    /// 0 reads only the state.
+    pub max_bytes: u64,
+    /// How long to wait, at most `limits.maxWaitMs`. 0 polls.
+    pub wait_ms: u64,
+    pub return_on: ReturnOn,
 }
 
+/// `process/read` response.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct ProcessOutputChunk {
-    pub seq: u64,
-    pub stream: ProcessOutputStream,
-    pub chunk: ByteChunk,
-}
-
-/// A process still running in the command's group after the root exited.
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct LeftoverProcess {
-    pub pid: u32,
-    /// Command line when the platform exposes it, otherwise the executable
-    /// name; may be empty when neither could be read.
-    #[serde(default, skip_serializing_if = "String::is_empty")]
-    pub command: String,
-}
-
-/// Why a process that did not exit on its own stopped.
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub enum ProcessTermination {
-    /// The start deadline (`timeoutMs`) expired and the group was killed.
-    TimedOut,
-    /// `process/terminate` with `kill` ended the group.
-    Killed,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct ReadProcessResponse {
-    pub chunks: Vec<ProcessOutputChunk>,
-    pub next_seq: u64,
-    pub exited: bool,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub exit_code: Option<i32>,
-    pub closed: bool,
+    pub output: OutputPage,
+    pub state: ExecState,
+    /// How the root ended; present once `state` is `exited`, unless `error`
+    /// explains why it could not be observed.
     #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub failure: Option<String>,
+    pub exit: Option<ExitStatus>,
     /// Set when the daemon stopped the process; absent on a natural exit.
     #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub termination: Option<ProcessTermination>,
-    /// OS pid of the root process, which is also its process group id.
+    pub stopped_by: Option<StoppedBy>,
+    /// Infrastructure failure after start (output capture or wait failed).
     #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub pid: Option<u32>,
-    /// Bytes dropped from the middle of the retained output since the last
-    /// cursor read because the retained buffer overflowed. The gap sits at
-    /// the sequence discontinuity between two returned chunks.
-    #[serde(default, skip_serializing_if = "is_zero")]
-    pub omitted_bytes: u64,
-    /// Processes still running in the command's group after the root
-    /// exited, sampled when this read was answered. Empty until the exit is
-    /// observed and on platforms without process enumeration.
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub leftover_processes: Vec<LeftoverProcess>,
-}
-
-fn is_zero(value: &u64) -> bool {
-    *value == 0
+    pub error: Option<ProtocolError>,
+    /// OS pid of the root process.
+    pub pid: u32,
+    /// Group members alive after the root exited (`disposition: kept`),
+    /// sampled when this response was built. Absent while running, when
+    /// none remain, and on platforms without process enumeration.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub leftovers: Option<LeftoverReport>,
 }
 
+/// `process/write` params.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct WriteProcessParams {
     pub process_id: ProcessId,
-    /// Bytes for the process's input. Requires an open input (a PTY); an
-    /// absent or empty chunk with `closeStdin: false` is a wait and is
-    /// accepted whether or not the process has exited.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub chunk: Option<ByteChunk>,
-    #[serde(default)]
-    pub close_stdin: bool,
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub enum WriteProcessStatus {
-    Accepted,
-    /// The entry is gone: the process finished and its retention elapsed.
-    UnknownProcess,
-    /// Input was given but the process has no open input, or has exited.
-    StdinClosed,
-    Starting,
+    /// Bytes for the process's input pipe or PTY.
+    #[serde(default, skip_serializing_if = "ByteChunk::is_empty")]
+    pub data: ByteChunk,
+    /// Close the input after `data`: end of file on a pipe, `VEOF` on a
+    /// PTY. Applied only when every byte of `data` was accepted.
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub close_input: bool,
 }
 
+/// `process/write` response.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct WriteProcessResponse {
-    pub status: WriteProcessStatus,
+    /// Leading bytes of `data` queued to the process's writer. Fewer than
+    /// sent (possibly 0) means the input queue is full: resend the rest
+    /// later.
+    pub accepted_bytes: u64,
 }
 
 /// Signal delivered by `process/terminate`.
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
 #[serde(rename_all = "camelCase")]
 pub enum ProcessSignal {
-    /// `SIGINT` to the process group; changes no daemon state, the next
-    /// read observes whatever the process did.
+    /// `SIGINT` to the foreground process group (the terminal's under a
+    /// PTY, otherwise the process group). Records nothing; the next read
+    /// shows what the process did.
     Interrupt,
-    /// Kill the whole group; the process is recorded as killed.
+    /// `SIGTERM` to the group, then `SIGKILL` after
+    /// `limits.process.terminateGraceMs` if members remain. Records
+    /// `stoppedBy: terminate`.
+    Terminate,
+    /// `SIGKILL` to the group. Records `stoppedBy: kill`.
     Kill,
 }
 
+/// `process/terminate` params.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct TerminateProcessParams {
     pub process_id: ProcessId,
     pub signal: ProcessSignal,
 }
 
+/// `process/terminate` response, sent once the signal was delivered (any
+/// escalation continues in the background).
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct TerminateProcessResponse {
-    /// True when the process was still running when the signal was sent.
+    /// True when the root process was still running when the signal was
+    /// sent.
+    #[serde(default, skip_serializing_if = "is_false")]
     pub running: bool,
 }
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct TerminalSize {
-    pub rows: u16,
-    pub cols: u16,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct ResizeProcessParams {
-    pub process_id: ProcessId,
-    pub size: TerminalSize,
-}
-
-#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct ResizeProcessResponse {}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub enum ProcessOutputStream {
-    Stdout,
-    Stderr,
-    Pty,
-}
diff --git a/crates/environment-protocol/src/data/scan.rs b/crates/environment-protocol/src/data/scan.rs
new file mode 100644
index 000000000..b2aad6894
--- /dev/null
+++ b/crates/environment-protocol/src/data/scan.rs
@@ -0,0 +1,231 @@
+//! `fs/scan`: a small, bounded observation of several roots, for catalogs
+//! such as skill and prompt discovery. An observation, not use: it never
+//! resets the idle clock. Large trees go through `transfer/*`.
+//!
+//! Each root is reported on its own, so one bad entry or one failed root
+//! never hides the others.
+
+use serde::{Deserialize, Serialize};
+
+use crate::{
+    bytes::ByteChunk,
+    data::fs::{TreeContent, TreeFilter},
+    error::ProtocolError,
+    ids::validate_opaque_id,
+    paths::{EnvironmentPath, TreePath},
+    serde_util::{is_false, is_zero_u32},
+};
+
+/// `fs/scan` params.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ScanParams {
+    /// 1 to `limits.filesystem.scan.maxRoots` roots.
+    pub roots: Vec<ScanRoot>,
+    /// Applied below every root; at most `limits.filesystem.scan.maxPatterns`
+    /// patterns in total.
+    #[serde(default, skip_serializing_if = "TreeFilter::is_default")]
+    pub filter: TreeFilter,
+    /// Return the bytes of every selected file in `data`.
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub read_content: bool,
+    /// Return each selected file's `digest`.
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub include_digests: bool,
+    /// Follow symlinks whose targets stay inside the filesystem root; others
+    /// are skipped (`symlinkOutsideRoot`). Without it symlinks are skipped
+    /// (`symlink`).
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub follow_symlinks: bool,
+    /// Caller quotas; each at most its ceiling.
+    pub limits: ScanLimits,
+}
+
+/// One root of a scan.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ScanRoot {
+    pub path: EnvironmentPath,
+    /// The root's previous `fingerprint`: when the selection is unchanged
+    /// the result is `unchanged` and carries no entries.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub if_none_match: Option<ScanFingerprint>,
+    /// Overrides `filter.maxDepth` for this root. `0` examines only the
+    /// root itself: a `complete` result without entries proves it is an
+    /// existing directory, which is how discovery checks a working
+    /// directory in the same call.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub max_depth: Option<u32>,
+}
+
+/// Caller quotas of one scan.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ScanLimits {
+    /// Selected entries per root; more fail that root (`payloadTooLarge`
+    /// with `limitEntries`).
+    pub max_entries: u32,
+    /// Larger selected files are skipped (`fileTooLarge`).
+    pub max_file_bytes: u64,
+    /// Content bytes returned across all roots, in root order: a root whose
+    /// content would exceed the rest fails (`payloadTooLarge` with
+    /// `limitBytes`) and later roots are still scanned. Independently, a
+    /// root whose encoded result (entries, skips and base64 content) would
+    /// push the scan's results past
+    /// [`MAX_RESULT_BYTES`](crate::limits::MAX_RESULT_BYTES) fails the same
+    /// way.
+    pub max_total_bytes: u64,
+    /// Walk time per root; exhausting it fails that root
+    /// (`deadlineExceeded`).
+    pub max_duration_ms: u64,
+}
+
+/// `fs/scan` response: one result per requested root, in request order.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ScanResponse {
+    /// Never empty.
+    pub roots: Vec<ScanRootResult>,
+}
+
+/// The outcome of one root.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(
+    tag = "kind",
+    rename_all = "camelCase",
+    rename_all_fields = "camelCase",
+    deny_unknown_fields
+)]
+pub enum ScanRootResult {
+    /// Every selected entry, plus what was skipped and why.
+    Complete {
+        path: EnvironmentPath,
+        /// Resolved absolute path of the root when it differs from `path`
+        /// (the root is a symlink).
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        canonical_path: Option<EnvironmentPath>,
+        fingerprint: ScanFingerprint,
+        #[serde(default, skip_serializing_if = "Vec::is_empty")]
+        entries: Vec<ScanEntry>,
+        /// The first
+        /// [`MAX_LISTED_SKIPS`](crate::limits::MAX_LISTED_SKIPS) skipped
+        /// entries, in walk order.
+        #[serde(default, skip_serializing_if = "Vec::is_empty")]
+        skipped: Vec<ScanSkip>,
+        /// Total number of skipped entries, listed or not; present whenever
+        /// it is not zero.
+        #[serde(default, skip_serializing_if = "is_zero_u32")]
+        skipped_entry_count: u32,
+    },
+    /// The selection matches `ifNoneMatch`.
+    Unchanged {
+        path: EnvironmentPath,
+        fingerprint: ScanFingerprint,
+    },
+    /// The root does not exist.
+    Missing { path: EnvironmentPath },
+    /// The root could not be scanned; no entries are returned for it.
+    Failed {
+        path: EnvironmentPath,
+        error: ProtocolError,
+    },
+}
+
+/// One selected entry below a root.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ScanEntry {
+    /// Relative to the root as requested.
+    pub path: TreePath,
+    pub content: TreeContent,
+    /// The file's bytes when `readContent` was set.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub data: Option<ByteChunk>,
+}
+
+/// An entry a scan left out.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ScanSkip {
+    /// Absent when the entry's name is not UTF-8.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub path: Option<TreePath>,
+    pub reason: ScanSkipReason,
+}
+
+/// Why a scan left an entry out.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase")]
+pub enum ScanSkipReason {
+    /// Larger than `maxFileBytes`.
+    FileTooLarge,
+    /// A symlink, and `followSymlinks` is not set.
+    Symlink,
+    /// A symlink whose target leaves the filesystem root, or a link cycle.
+    SymlinkOutsideRoot,
+    /// A device, FIFO, socket or another special file.
+    SpecialFile,
+    /// The name is not UTF-8.
+    NonUtf8Name,
+    /// The entry vanished or could not be read during the walk.
+    Unreadable,
+}
+
+/// Opaque fingerprint of one root's selection, prefixed `scan:v1:`, at most
+/// 255 bytes without control characters.
+#[derive(Clone, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+pub struct ScanFingerprint(
+    #[cfg_attr(
+        feature = "schema",
+        schemars(length(min = 9, max = 255), pattern(SCAN_FINGERPRINT_PATTERN))
+    )]
+    String,
+);
+
+/// JSON Schema pattern of [`ScanFingerprint`].
+pub const SCAN_FINGERPRINT_PATTERN: &str = "^scan:v1:[^\\u0000-\\u001F\\u007F-\\u009F]+$";
+
+impl ScanFingerprint {
+    pub const PREFIX: &'static str = "scan:v1:";
+
+    pub fn new(value: impl Into<String>) -> Result<Self, ScanFingerprintError> {
+        let value = value.into();
+        if !value.starts_with(Self::PREFIX)
+            || value.len() == Self::PREFIX.len()
+            || validate_opaque_id("ScanFingerprint", &value).is_err()
+        {
+            return Err(ScanFingerprintError(value));
+        }
+        Ok(Self(value))
+    }
+
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, thiserror::Error)]
+#[error("scan fingerprint must start with scan:v1: and be at most 255 bytes: {0:?}")]
+pub struct ScanFingerprintError(pub String);
+
+impl Serialize for ScanFingerprint {
+    fn serialize<S: serde::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        serializer.serialize_str(&self.0)
+    }
+}
+
+impl<'de> Deserialize<'de> for ScanFingerprint {
+    fn deserialize<D: serde::Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        let value = String::deserialize(deserializer)?;
+        Self::new(value).map_err(serde::de::Error::custom)
+    }
+}
diff --git a/crates/environment-protocol/src/data/transfer.rs b/crates/environment-protocol/src/data/transfer.rs
index cad1f5feb..0b8c130fc 100644
--- a/crates/environment-protocol/src/data/transfer.rs
+++ b/crates/environment-protocol/src/data/transfer.rs
@@ -1,111 +1,397 @@
-//! Bounded inline filesystem copies. No VFS identities or storage access are required.
-use crate::shared::{ByteChunk, EnvironmentPath};
+//! `transfer/*`: one logical tree or file transfer as many bounded calls.
+//!
+//! No storage or VFS identities cross this boundary: entries are tree paths
+//! and content digests. An operation is created by `transfer/begin` and
+//! keyed by its caller-chosen `operationId`; retrying any call with the same
+//! input is safe. Phases:
+//!
+//! - **capture** (environment to caller): `scanning` (advance until the
+//!   inventory is sealed) → `inventory` (page entries, read content) →
+//!   `complete` after `transfer/commit`.
+//! - **materialize** and **writeFile** (caller to environment):
+//!   `inventory` (append the incoming inventory) → `scanning` (the daemon
+//!   reads destination metadata and hashes only files whose size matches an
+//!   incoming entry) → `content` (upload `transfer/listMissing` digests) →
+//!   `staging` (advance) → `ready` → `complete` after `transfer/commit`,
+//!   which publishes the staged tree atomically.
+//!
+//! A failure of the operation's own work (walking, hashing, staging,
+//! publishing, a source changing, a digest mismatch, its duration bound)
+//! moves it to `failed` with its `error`, and every later call except
+//! `transfer/getStatus` and `transfer/abort` answers that error; nothing is
+//! committed. A call refused before it acts (invalid params, a phase or
+//! offset precondition, an unknown digest, `busy`) leaves the operation
+//! unchanged, so a retried or misdirected call cannot fail it. A completed, aborted or failed operation's
+//! receipt is answered for `limits.filesystem.transfer.receiptRetentionMs`
+//! after it finished, across daemon restarts. A completed capture's
+//! inventory stays pageable with `transfer/readInventory` for as long as its
+//! receipt, so a retried capture answers the tree it first captured; its
+//! content is no longer readable.
+
 use serde::{Deserialize, Serialize};
 
-/// Hard ceilings for one operation, before base64/JSON framing.
-pub const MAX_TRANSFER_BYTES: u64 = 8 * 1024 * 1024;
-pub const MAX_TRANSFER_ENTRIES: u32 = 1024;
-pub const MAX_TRANSFER_DEPTH: u32 = 32;
-pub const MAX_TRANSFER_DURATION_MS: u64 = 30_000;
-pub const MAX_TRANSFER_PATH_BYTES: usize = 4096;
+use crate::{
+    bytes::ByteChunk,
+    data::fs::{FileVersion, TreeContent, TreeFilter, WriteCondition},
+    error::ProtocolError,
+    ids::TransferOperationId,
+    paths::{ContentDigest, EnvironmentPath, TreePath},
+    serde_util::{is_false, is_zero_u32},
+};
 
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+/// What one operation transfers.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(
+    tag = "kind",
+    rename_all = "camelCase",
+    rename_all_fields = "camelCase",
+    deny_unknown_fields
+)]
+pub enum TransferSelection {
+    /// Read a file or tree out of the environment.
+    Capture {
+        source: EnvironmentPath,
+        #[serde(default, skip_serializing_if = "TreeFilter::is_default")]
+        filter: TreeFilter,
+        #[serde(default, skip_serializing_if = "SymlinkPolicy::is_default")]
+        symlinks: SymlinkPolicy,
+        #[serde(default, skip_serializing_if = "SpecialFilePolicy::is_default")]
+        special_files: SpecialFilePolicy,
+    },
+    /// Write a tree into the environment, replacing `destination` atomically
+    /// at commit.
+    Materialize {
+        destination: EnvironmentPath,
+        #[serde(default, skip_serializing_if = "TransferOnExisting::is_default")]
+        on_existing: TransferOnExisting,
+    },
+    /// Write exactly one file with `fs/writeFile` semantics: staged,
+    /// atomic, an existing target keeps its permissions, an in-root symlink
+    /// at `destination` is followed.
+    WriteFile {
+        destination: EnvironmentPath,
+        #[serde(default, skip_serializing_if = "WriteCondition::is_default")]
+        create: WriteCondition,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        if_match: Option<FileVersion>,
+        #[serde(default, skip_serializing_if = "is_false")]
+        executable: bool,
+    },
+}
+
+/// Symlinks met during a capture.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase")]
+pub enum SymlinkPolicy {
+    /// Capture a link whose target stays inside the selection as the entry
+    /// it points to; a link leaving the selection or a cycle fails the
+    /// operation (`symlinkRejected`). A dangling link inside the selection
+    /// is left out and reported in `skipped` as `symlink`.
+    #[default]
+    ExpandInside,
+    /// Leave every link out and report it in `skipped`.
+    Skip,
+    /// Fail on the first link.
+    Reject,
+}
+
+impl SymlinkPolicy {
+    pub fn is_default(&self) -> bool {
+        *self == Self::ExpandInside
+    }
+}
+
+/// Devices, FIFOs and sockets met during a capture.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
 #[serde(rename_all = "camelCase")]
+pub enum SpecialFilePolicy {
+    /// Fail the operation (`notRegularFile`).
+    #[default]
+    Reject,
+    /// Leave them out and report them in `skipped`.
+    Skip,
+}
+
+impl SpecialFilePolicy {
+    pub fn is_default(&self) -> bool {
+        *self == Self::Reject
+    }
+}
+
+/// What a materialize does with an existing destination.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase")]
+pub enum TransferOnExisting {
+    /// Refuse at begin (`alreadyExists`).
+    Error,
+    /// Replace it atomically at commit.
+    #[default]
+    Replace,
+}
+
+impl TransferOnExisting {
+    pub fn is_default(&self) -> bool {
+        *self == Self::Replace
+    }
+}
+
+/// Caller quotas of one operation; each at most its advertised ceiling.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct TransferLimits {
-    /// Counts the selected root, including an empty directory.
+    /// Entries, the selected root included.
     pub max_entries: u32,
-    /// Selected root has depth zero.
+    /// The selected root has depth 0.
     pub max_depth: u32,
     pub max_file_bytes: u64,
     pub max_total_bytes: u64,
-    /// Cooperative deadline checked between filesystem operations and byte chunks.
-    /// Does not interrupt an in-flight kernel syscall.
+    /// Encoded inventory size.
+    pub max_manifest_bytes: u64,
+    /// From begin to commit.
     pub max_duration_ms: u64,
 }
 
+/// One inventory entry. Parents precede children.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(tag = "kind", rename_all = "camelCase")]
-pub enum TransferContent {
-    Directory,
-    File { data: ByteChunk, executable: bool },
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct InventoryEntry {
+    /// Relative to the selected root; `.` is the root itself.
+    pub path: TreePath,
+    /// A file entry always carries its `digest`.
+    pub content: TreeContent,
 }
 
+/// `transfer/begin` params. Idempotent: a repeat with identical input
+/// returns the operation's status; different input under the same id is
+/// `failedPrecondition` (`operationIdInUse`).
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct TransferEntry {
-    /// Root is "". Others are strict relative '/' paths; parents must precede children.
-    /// UTF-8 names only; no empty, '.', '..', NUL or backslash components.
-    pub path: String,
-    pub content: TransferContent,
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct BeginTransferParams {
+    pub operation_id: TransferOperationId,
+    pub selection: TransferSelection,
+    pub limits: TransferLimits,
 }
 
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub enum TransferOnExisting {
-    Error,
-    #[default]
-    Replace,
+/// Params of `transfer/advance`, `transfer/getStatus`, `transfer/commit`
+/// and `transfer/abort`: each names only the operation.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct TransferOperationParams {
+    pub operation_id: TransferOperationId,
 }
 
+/// The operation's status: the response of `transfer/begin`,
+/// `transfer/advance`, `transfer/getStatus`, `transfer/append`,
+/// `transfer/commit` and `transfer/abort`.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct TransferStatus {
+    pub operation_id: TransferOperationId,
+    pub phase: TransferPhase,
+    /// Entries in the inventory so far.
+    pub entry_count: u32,
+    /// File bytes in the inventory so far.
+    pub total_bytes: u64,
+    /// Content bytes moved over the wire.
+    pub transferred_bytes: u64,
+    /// Content bytes satisfied from files already at the destination.
+    pub reused_bytes: u64,
+    /// The first
+    /// [`MAX_LISTED_SKIPS`](crate::limits::MAX_LISTED_SKIPS) entries a
+    /// capture left out under its policies.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub skipped: Vec<TransferSkip>,
+    /// Total number of entries left out, listed or not; present whenever it
+    /// is not zero.
+    #[serde(default, skip_serializing_if = "is_zero_u32")]
+    pub skipped_entry_count: u32,
+    /// Why the operation failed; present exactly when `phase` is `failed`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub error: Option<ProtocolError>,
+    /// When `maxDurationMs` runs out for an active operation.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub deadline_at_ms: Option<i64>,
+    /// When the receipt of a finished (complete, aborted or failed)
+    /// operation stops being answered; afterwards calls are `notFound`
+    /// (`expired`).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub receipt_expires_at_ms: Option<i64>,
+}
+
+/// Where an operation stands; see the module docs for the order per
+/// selection kind.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
 #[serde(rename_all = "camelCase")]
-pub struct MaterializeParams {
-    pub destination: EnvironmentPath,
-    pub entries: Vec<TransferEntry>,
-    pub limits: TransferLimits,
-    #[serde(default)]
-    pub on_existing: TransferOnExisting,
+pub enum TransferPhase {
+    /// The daemon walks a tree: the capture source, or the destination of a
+    /// materialize. Advance until the phase changes.
+    Scanning,
+    /// Capture: the inventory is sealed and pageable. Materialize: waiting
+    /// for appended entries.
+    Inventory,
+    /// Waiting for the content of `transfer/listMissing` digests.
+    Content,
+    /// The daemon assembles the staged tree. Advance until `ready`.
+    Staging,
+    /// Ready for `transfer/commit`.
+    Ready,
+    Complete,
+    Aborted,
+    /// Stopped by an error; see `error`.
+    Failed,
 }
 
+impl TransferPhase {
+    pub fn is_finished(self) -> bool {
+        matches!(self, Self::Complete | Self::Aborted | Self::Failed)
+    }
+}
+
+/// An entry a capture left out.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct TransferSkip {
+    /// Absent when the entry's name is not UTF-8.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub path: Option<TreePath>,
+    pub reason: TransferSkipReason,
+}
+
+/// Why a capture left an entry out.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
 #[serde(rename_all = "camelCase")]
-pub struct MaterializeResponse {
-    pub destination: EnvironmentPath,
-    pub entries: u32,
-    pub bytes: u64,
-    /// Reserved for compatibility with early daemons. Current daemons clean retired
-    /// staging trees asynchronously and return None.
-    pub retired_directory: Option<EnvironmentPath>,
+pub enum TransferSkipReason {
+    /// `symlinks: skip`, or a dangling link under `symlinks: expandInside`.
+    Symlink,
+    /// `specialFiles: skip`.
+    SpecialFile,
+    /// The name is not UTF-8; such entries are always skipped.
+    NonUtf8Name,
 }
 
+/// `transfer/readInventory` params: page a sealed inventory by index.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct CaptureParams {
-    pub source: EnvironmentPath,
-    pub limits: TransferLimits,
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ReadTransferInventoryParams {
+    pub operation_id: TransferOperationId,
+    /// Index of the first entry.
+    pub index: u32,
+    /// 1 to `limits.filesystem.transfer.maxInventoryPageEntries`.
+    pub limit: u32,
 }
 
+/// `transfer/readInventory` response.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct CaptureResponse {
-    pub source: EnvironmentPath,
-    /// Complete selected tree only; failures never return a partial inventory.
-    pub entries: Vec<TransferEntry>,
-    pub bytes: u64,
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    #[test]
-    fn binary_inventory_roundtrips_and_legacy_capabilities_default_false() {
-        let entry = TransferEntry {
-            path: "".into(),
-            content: TransferContent::File {
-                data: ByteChunk::from(vec![0, 255, 128]),
-                executable: true,
-            },
-        };
-        let json = serde_json::to_value(&entry).unwrap();
-        assert_eq!(json["content"]["data"], "AP+A");
-        assert_eq!(
-            serde_json::from_value::<TransferEntry>(json).unwrap(),
-            entry
-        );
-        let capabilities: crate::shared::EnvironmentCapabilities =
-            serde_json::from_str("{}").unwrap();
-        assert!(!capabilities.filesystem_capture);
-        assert!(!capabilities.filesystem_materialize);
-        assert!(serde_json::from_str::<CaptureParams>(r#"{"source":"."}"#).is_err());
-    }
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ReadTransferInventoryResponse {
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub entries: Vec<InventoryEntry>,
+    /// Index of the next page; absent after the last entry.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub next_index: Option<u32>,
+}
+
+/// `transfer/append` params: add incoming inventory entries in order.
+/// Retrying an identical page is safe.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct AppendTransferInventoryParams {
+    pub operation_id: TransferOperationId,
+    /// Index of the page's first entry: the number of entries appended
+    /// before it.
+    pub index: u32,
+    /// At most `limits.filesystem.transfer.maxInventoryPageEntries`.
+    pub entries: Vec<InventoryEntry>,
+    /// This page completes the inventory.
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub last: bool,
+}
+
+/// `transfer/listMissing` params.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ListTransferMissingParams {
+    pub operation_id: TransferOperationId,
+    /// Most digests to return, 1 to
+    /// `limits.filesystem.transfer.maxInventoryPageEntries`.
+    pub limit: u32,
+}
+
+/// `transfer/listMissing` response: digests whose content the daemon still
+/// needs. The set shrinks as uploads complete; call again rather than
+/// paging.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ListTransferMissingResponse {
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub digests: Vec<ContentDigest>,
+    /// Missing digests beyond this page.
+    #[serde(default, skip_serializing_if = "is_zero_u32")]
+    pub remaining_count: u32,
+}
+
+/// `transfer/read` params: read a captured file's content by digest.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ReadTransferContentParams {
+    pub operation_id: TransferOperationId,
+    pub digest: ContentDigest,
+    pub offset: u64,
+    /// 1 to `limits.filesystem.transfer.maxContentChunkBytes`.
+    pub max_bytes: u64,
+}
+
+/// `transfer/read` response.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ReadTransferContentResponse {
+    pub data: ByteChunk,
+    /// Bytes exist after `offset` plus the length of `data`, as for
+    /// `fs/readFile`.
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub truncated: bool,
+}
+
+/// `transfer/write` params: upload content for a missing digest. Chunks for
+/// one digest arrive in order; an identical chunk may be retried.
+/// Different digests may be uploaded concurrently.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct WriteTransferContentParams {
+    pub operation_id: TransferOperationId,
+    pub digest: ContentDigest,
+    /// Must equal the digest's next expected offset.
+    pub offset: u64,
+    /// At most `limits.filesystem.transfer.maxContentChunkBytes`.
+    pub data: ByteChunk,
+}
+
+/// `transfer/write` response.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct WriteTransferContentResponse {
+    /// The digest's next expected offset; equal to its size once complete
+    /// and verified.
+    pub next_offset: u64,
 }
diff --git a/crates/environment-protocol/src/data/transfer_session.rs b/crates/environment-protocol/src/data/transfer_session.rs
deleted file mode 100644
index a1d93ad67..000000000
--- a/crates/environment-protocol/src/data/transfer_session.rs
+++ /dev/null
@@ -1,149 +0,0 @@
-//! One logical transfer, many bounded exchanges. No storage or VFS identities cross this boundary.
-use super::{
-    inventory::{InventoryEntry, InventoryLimits},
-    transfer::TransferOnExisting,
-};
-use crate::shared::{ByteChunk, EnvironmentPath};
-use serde::{Deserialize, Serialize};
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(
-    tag = "direction",
-    rename_all = "camelCase",
-    rename_all_fields = "camelCase"
-)]
-pub enum TransferSelection {
-    Capture {
-        source: EnvironmentPath,
-    },
-    Materialize {
-        destination: EnvironmentPath,
-        #[serde(default)]
-        on_existing: TransferOnExisting,
-    },
-    /// Write exactly one file, rejecting directories and preserving existing
-    /// file permissions. Uses the same bounded chunks and durable receipts.
-    /// A separate direction makes older endpoints reject unsupported semantics.
-    WriteFile {
-        destination: EnvironmentPath,
-    },
-}
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(
-    tag = "action",
-    rename_all = "camelCase",
-    rename_all_fields = "camelCase"
-)]
-pub enum TransferRequest {
-    /// Idempotent until operation expiry, including completed receipts after daemon restart.
-    /// IDs must not be reused for different input.
-    Begin {
-        operation_id: String,
-        selection: TransferSelection,
-        #[serde(default)]
-        limits: InventoryLimits,
-    },
-    /// Advances bounded scan/staging work. Inspect status until ready, then commit.
-    Advance {
-        operation_id: String,
-    },
-    Inventory {
-        operation_id: String,
-        offset: u32,
-    },
-    /// Parent-before-child inventory pages. Retrying the identical page is safe.
-    Append {
-        operation_id: String,
-        offset: u32,
-        entries: Vec<InventoryEntry>,
-        last: bool,
-    },
-    Missing {
-        operation_id: String,
-        offset: u32,
-    },
-    Read {
-        operation_id: String,
-        digest: String,
-        offset: u64,
-    },
-    /// Sequential chunks; an identical chunk may be retried. Only complete verified files are reusable.
-    Write {
-        operation_id: String,
-        digest: String,
-        offset: u64,
-        data: ByteChunk,
-    },
-    Commit {
-        operation_id: String,
-    },
-    Status {
-        operation_id: String,
-    },
-    Abort {
-        operation_id: String,
-    },
-}
-impl TransferRequest {
-    pub fn operation_id(&self) -> &str {
-        match self {
-            Self::Begin { operation_id, .. }
-            | Self::Advance { operation_id }
-            | Self::Inventory { operation_id, .. }
-            | Self::Append { operation_id, .. }
-            | Self::Missing { operation_id, .. }
-            | Self::Read { operation_id, .. }
-            | Self::Write { operation_id, .. }
-            | Self::Commit { operation_id }
-            | Self::Status { operation_id }
-            | Self::Abort { operation_id } => operation_id,
-        }
-    }
-}
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
-#[serde(rename_all = "camelCase")]
-pub enum TransferPhase {
-    Scanning,
-    Inventory,
-    Content,
-    Staging,
-    Ready,
-    Complete,
-    Aborted,
-}
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
-#[serde(rename_all = "camelCase")]
-pub struct TransferStatus {
-    pub operation_id: String,
-    pub phase: TransferPhase,
-    pub entries: u32,
-    pub bytes: u64,
-    pub transferred_bytes: u64,
-    pub reused_bytes: u64,
-}
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(
-    tag = "result",
-    rename_all = "camelCase",
-    rename_all_fields = "camelCase"
-)]
-pub enum TransferResponse {
-    Status(TransferStatus),
-    Inventory {
-        entries: Vec<InventoryEntry>,
-        next_offset: Option<u32>,
-    },
-    Missing {
-        digests: Vec<String>,
-        next_offset: Option<u32>,
-    },
-    Chunk {
-        data: ByteChunk,
-        eof: bool,
-    },
-    Written {
-        next_offset: u64,
-    },
-}
diff --git a/crates/environment-protocol/src/error.rs b/crates/environment-protocol/src/error.rs
index f2e29b069..8cb49c8d1 100644
--- a/crates/environment-protocol/src/error.rs
+++ b/crates/environment-protocol/src/error.rs
@@ -1,38 +1,858 @@
-//! Shared error payloads for environment protocol methods.
+//! The one error vocabulary of every plane.
+//!
+//! An error travels as a JSON-RPC error object whose `code` is a fixed
+//! function of its kind and whose `data` carries the kind and its typed
+//! fields:
+//!
+//! ```json
+//! {"code": -32004, "message": "unknown process id: p1", "data": {"kind": "notFound", "reason": "expired"}}
+//! ```
+//!
+//! `data.kind` is authoritative: receivers branch on it, never on the code
+//! or the message. Retryability is a property of the kind
+//! ([`ProtocolErrorKind::is_retryable`]) and is never sent. The same error
+//! object is embedded in results that report per-entry failures (`job/read`
+//! entries, `fs/scan` roots, a failed transfer's status).
+
+use std::fmt;
 
 use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use thiserror::Error;
 
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+use crate::limits::MAX_ERROR_MESSAGE_BYTES;
+
+/// Closed set of error kinds. Each kind has one meaning and one code.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase")]
+pub enum ProtocolErrorKind {
+    /// The frame is not JSON. Answered with a null id.
+    ParseError,
+    /// The frame is JSON but not a valid request: wrong `jsonrpc`, a batch,
+    /// a missing or malformed member. A second `initialize` is also
+    /// `invalidRequest`.
+    InvalidRequest,
+    /// No method of that name exists on this plane.
+    MethodNotFound,
+    /// The params do not decode, or a value is out of range or above an
+    /// advertised ceiling.
+    InvalidParams,
+    /// A method other than `initialize` arrived before a successful
+    /// `initialize`.
+    NotInitialized,
+    /// The peer stated another protocol version.
+    VersionMismatch,
+    /// The named handle, path or target does not exist.
+    NotFound,
+    /// The thing to create already exists.
+    AlreadyExists,
+    /// The request is well-formed but the current state forbids it; `reason`
+    /// says which state.
+    FailedPrecondition,
+    /// The caller may not do this: confinement, credentials, signatures.
+    PermissionDenied,
+    /// The endpoint lacks the capability the request needs; an endpoint
+    /// never silently ignores a parameter it cannot honour.
+    CapabilityUnavailable,
+    /// A limit on concurrent work was reached; retry later.
+    Busy,
+    /// A server-side duration bound ran out.
+    DeadlineExceeded,
+    /// A credential or token is past its validity.
+    Expired,
+    /// The operation stopped before completing: cancelled, or its input
+    /// changed underneath it. Retrying from the start may succeed.
+    Aborted,
+    /// A message, payload or result is larger than allowed.
+    PayloadTooLarge,
+    /// A process could not be started or supervised.
+    ProcessFailed,
+    /// A dependency of the server is temporarily unreachable.
+    Unavailable,
+    /// A defect or unexpected failure inside the server.
+    Internal,
+}
+
+impl ProtocolErrorKind {
+    /// The JSON-RPC `code` of this kind. Framing kinds use the reserved
+    /// codes; domain kinds reuse the public API's numbers where the meaning
+    /// matches (`permissionDenied`, `notFound`, `alreadyExists`,
+    /// `payloadTooLarge`).
+    pub fn code(self) -> i32 {
+        match self {
+            Self::ParseError => -32700,
+            Self::InvalidRequest => -32600,
+            Self::MethodNotFound => -32601,
+            Self::InvalidParams => -32602,
+            Self::Internal => -32603,
+            Self::NotInitialized => -32002,
+            Self::PermissionDenied => -32003,
+            Self::NotFound => -32004,
+            Self::VersionMismatch => -32005,
+            Self::CapabilityUnavailable => -32006,
+            Self::FailedPrecondition => -32007,
+            Self::Busy => -32008,
+            Self::AlreadyExists => -32009,
+            Self::PayloadTooLarge => -32013,
+            Self::DeadlineExceeded => -32015,
+            Self::Expired => -32016,
+            Self::Aborted => -32017,
+            Self::ProcessFailed => -32018,
+            Self::Unavailable => -32019,
+        }
+    }
+
+    /// The kind a code stands for, for error objects that carry no `data`
+    /// (a non-conforming peer or an intermediary).
+    pub fn from_code(code: i64) -> Option<Self> {
+        Self::ALL
+            .into_iter()
+            .find(|kind| i64::from(kind.code()) == code)
+    }
+
+    /// True when retrying the same request later can succeed without any
+    /// change: `busy`, `unavailable` and `aborted`.
+    pub fn is_retryable(self) -> bool {
+        matches!(self, Self::Busy | Self::Unavailable | Self::Aborted)
+    }
+
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::ParseError => "parseError",
+            Self::InvalidRequest => "invalidRequest",
+            Self::MethodNotFound => "methodNotFound",
+            Self::InvalidParams => "invalidParams",
+            Self::NotInitialized => "notInitialized",
+            Self::VersionMismatch => "versionMismatch",
+            Self::NotFound => "notFound",
+            Self::AlreadyExists => "alreadyExists",
+            Self::FailedPrecondition => "failedPrecondition",
+            Self::PermissionDenied => "permissionDenied",
+            Self::CapabilityUnavailable => "capabilityUnavailable",
+            Self::Busy => "busy",
+            Self::DeadlineExceeded => "deadlineExceeded",
+            Self::Expired => "expired",
+            Self::Aborted => "aborted",
+            Self::PayloadTooLarge => "payloadTooLarge",
+            Self::ProcessFailed => "processFailed",
+            Self::Unavailable => "unavailable",
+            Self::Internal => "internal",
+        }
+    }
+
+    pub const ALL: [Self; 19] = [
+        Self::ParseError,
+        Self::InvalidRequest,
+        Self::MethodNotFound,
+        Self::InvalidParams,
+        Self::NotInitialized,
+        Self::VersionMismatch,
+        Self::NotFound,
+        Self::AlreadyExists,
+        Self::FailedPrecondition,
+        Self::PermissionDenied,
+        Self::CapabilityUnavailable,
+        Self::Busy,
+        Self::DeadlineExceeded,
+        Self::Expired,
+        Self::Aborted,
+        Self::PayloadTooLarge,
+        Self::ProcessFailed,
+        Self::Unavailable,
+        Self::Internal,
+    ];
+}
+
+impl fmt::Display for ProtocolErrorKind {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(self.as_str())
+    }
+}
+
+/// Why a handle, path or identity was not found.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase")]
+pub enum NotFoundReason {
+    /// Its retention window ended; a tombstone remembers it.
+    Expired,
+    /// It belonged to an earlier daemon instance (see `daemonInstanceId`).
+    DaemonRestarted,
+    /// A daemon identity the gateway has never admitted presented no
+    /// registration key.
+    UnknownDaemon,
+}
+
+/// The state that forbids a `failedPrecondition` request.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase")]
+pub enum PreconditionReason {
+    /// The process has no open input: started without `pipe` or `pty`,
+    /// input already closed, or exited.
+    InputClosed,
+    /// The file's current `version` differs from `ifMatch`.
+    IfMatchFailed,
+    /// `create: ifAbsent` met an existing file, or `create: ifPresent` a
+    /// missing one.
+    CreateCondition,
+    /// The directory is not empty and `recursive` was not set.
+    NotEmpty,
+    /// The path names a directory where a file is required.
+    IsDirectory,
+    /// A path component or the path names a non-directory where a directory
+    /// is required.
+    NotDirectory,
+    /// The path names a device, FIFO, socket or other non-regular file.
+    NotRegularFile,
+    /// A symlink chain loops.
+    SymlinkLoop,
+    /// A capture met a symlink that leaves the selection, or one the
+    /// selection's symlink policy rejects.
+    SymlinkRejected,
+    /// The filesystem root itself cannot be replaced or removed.
+    FilesystemRoot,
+    /// Rename across filesystems.
+    CrossDevice,
+    /// No space left on the device.
+    NoSpace,
+    /// A job id is in use by a job with another `requestId` or spec; choose
+    /// a new job id.
+    JobIdInUse,
+    /// A transfer `operationId` is in use for different input.
+    OperationIdInUse,
+    /// The transfer action is not valid in the operation's current phase.
+    TransferPhase,
+    /// A transfer write's `offset` is not the digest's next expected offset.
+    TransferOffset,
+    /// Uploaded bytes do not hash to their digest.
+    DigestMismatch,
+    /// The environment is closed; its identity or target is spent.
+    EnvironmentClosed,
+    /// The daemon identity is bound to another universe.
+    IdentityInUse,
+    /// The target belongs to another owner, or (`target/adopt`) the owner
+    /// already holds a different target.
+    OwnerMismatch,
+    /// The template is deprecated and creates no new targets.
+    TemplateDeprecated,
+    /// `ingress/ensure` on a target whose template has no public ingress.
+    IngressUnsupported,
+    /// A power change on a target whose `phase` is not `active`
+    /// (provisioning, closing, closed or failed).
+    TargetNotActive,
+    /// `target/adopt`: the source target exists but the provider cannot take
+    /// it over, for example an instance of a kind it does not manage.
+    NotAdoptable,
+}
+
+/// Why a `permissionDenied` request was refused.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase")]
+pub enum PermissionReason {
+    /// The path, or a symlink it passes through, resolves outside the
+    /// daemon's filesystem root.
+    OutsideRoot,
+    /// The path names or contains the daemon's state directory.
+    DaemonState,
+    /// The operating system refused access.
+    FilePermission,
+    /// The registration signature does not verify.
+    InvalidSignature,
+    /// The registration key is unknown.
+    InvalidRegistrationKey,
+    /// The registration key was revoked.
+    RegistrationKeyRevoked,
+}
+
+/// What limit a `busy` request hit.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase")]
+pub enum BusyReason {
+    /// The connection's concurrent request limit.
+    RequestLimit,
+    /// The daemon's limit on active transfer operations.
+    TransferCapacity,
+    /// A rate limit on the caller's identity.
+    RateLimited,
+    /// A registration key's limit on active environments.
+    CapacityExhausted,
+}
+
+/// Why an operation was `aborted`.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
 #[serde(rename_all = "camelCase")]
-pub struct EnvironmentProtocolError {
-    pub code: EnvironmentProtocolErrorCode,
+pub enum AbortReason {
+    /// `$/cancelRequest` named the request.
+    Cancelled,
+    /// A file or directory changed while it was being read.
+    SourceChanged,
+}
+
+/// A capability a request needed and the endpoint lacks.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase")]
+pub enum Capability {
+    /// The `filesystem` family.
+    Filesystem,
+    /// `capabilities.filesystem.write`: the filesystem is writable.
+    FilesystemWrite,
+    /// The `process` family.
+    Process,
+    /// `capabilities.process.pty`.
+    ProcessPty,
+    /// The `job` family.
+    Job,
+    /// The controller's `adoptTarget` capability.
+    AdoptTarget,
+    /// The controller's `ingress` capability.
+    Ingress,
+}
+
+/// The `data` member of an error object: the kind and its typed fields.
+///
+/// Kinds without fields are empty struct variants rather than unit
+/// variants: serde does not apply `deny_unknown_fields` to the unit
+/// variants of an internally tagged enum, and every kind must refuse
+/// unknown members.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(
+    tag = "kind",
+    rename_all = "camelCase",
+    rename_all_fields = "camelCase",
+    deny_unknown_fields
+)]
+pub enum ErrorData {
+    ParseError {},
+    InvalidRequest {},
+    MethodNotFound {},
+    InvalidParams {
+        /// Wire path of the offending field, such as `limits.maxDurationMs`.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        field: Option<String>,
+        /// The advertised ceiling the value exceeded.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        ceiling: Option<u64>,
+    },
+    NotInitialized {},
+    VersionMismatch {
+        /// The version of the peer that sent this error.
+        expected: u32,
+        /// The version the requester stated.
+        received: u32,
+    },
+    NotFound {
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        reason: Option<NotFoundReason>,
+    },
+    AlreadyExists {},
+    FailedPrecondition {
+        reason: PreconditionReason,
+    },
+    PermissionDenied {
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        reason: Option<PermissionReason>,
+    },
+    CapabilityUnavailable {
+        capability: Capability,
+    },
+    Busy {
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        reason: Option<BusyReason>,
+        /// Earliest useful retry, when the server knows it.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        retry_after_ms: Option<u64>,
+    },
+    DeadlineExceeded {},
+    Expired {},
+    Aborted {
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        reason: Option<AbortReason>,
+    },
+    PayloadTooLarge {
+        /// The byte limit the payload exceeded.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        limit_bytes: Option<u64>,
+        /// The entry-count limit the result exceeded.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        limit_entries: Option<u32>,
+    },
+    ProcessFailed {},
+    Unavailable {
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        retry_after_ms: Option<u64>,
+    },
+    Internal {},
+}
+
+impl ErrorData {
+    pub fn kind(&self) -> ProtocolErrorKind {
+        match self {
+            Self::ParseError {} => ProtocolErrorKind::ParseError,
+            Self::InvalidRequest {} => ProtocolErrorKind::InvalidRequest,
+            Self::MethodNotFound {} => ProtocolErrorKind::MethodNotFound,
+            Self::InvalidParams { .. } => ProtocolErrorKind::InvalidParams,
+            Self::NotInitialized {} => ProtocolErrorKind::NotInitialized,
+            Self::VersionMismatch { .. } => ProtocolErrorKind::VersionMismatch,
+            Self::NotFound { .. } => ProtocolErrorKind::NotFound,
+            Self::AlreadyExists {} => ProtocolErrorKind::AlreadyExists,
+            Self::FailedPrecondition { .. } => ProtocolErrorKind::FailedPrecondition,
+            Self::PermissionDenied { .. } => ProtocolErrorKind::PermissionDenied,
+            Self::CapabilityUnavailable { .. } => ProtocolErrorKind::CapabilityUnavailable,
+            Self::Busy { .. } => ProtocolErrorKind::Busy,
+            Self::DeadlineExceeded {} => ProtocolErrorKind::DeadlineExceeded,
+            Self::Expired {} => ProtocolErrorKind::Expired,
+            Self::Aborted { .. } => ProtocolErrorKind::Aborted,
+            Self::PayloadTooLarge { .. } => ProtocolErrorKind::PayloadTooLarge,
+            Self::ProcessFailed {} => ProtocolErrorKind::ProcessFailed,
+            Self::Unavailable { .. } => ProtocolErrorKind::Unavailable,
+            Self::Internal {} => ProtocolErrorKind::Internal,
+        }
+    }
+
+    /// The fieldless data of a kind, for kinds whose fields are all
+    /// optional. Kinds with required fields get their typed constructor on
+    /// [`ProtocolError`] instead.
+    fn bare(kind: ProtocolErrorKind) -> Option<Self> {
+        Some(match kind {
+            ProtocolErrorKind::ParseError => Self::ParseError {},
+            ProtocolErrorKind::InvalidRequest => Self::InvalidRequest {},
+            ProtocolErrorKind::MethodNotFound => Self::MethodNotFound {},
+            ProtocolErrorKind::InvalidParams => Self::InvalidParams {
+                field: None,
+                ceiling: None,
+            },
+            ProtocolErrorKind::NotInitialized => Self::NotInitialized {},
+            ProtocolErrorKind::NotFound => Self::NotFound { reason: None },
+            ProtocolErrorKind::AlreadyExists => Self::AlreadyExists {},
+            ProtocolErrorKind::PermissionDenied => Self::PermissionDenied { reason: None },
+            ProtocolErrorKind::Busy => Self::Busy {
+                reason: None,
+                retry_after_ms: None,
+            },
+            ProtocolErrorKind::DeadlineExceeded => Self::DeadlineExceeded {},
+            ProtocolErrorKind::Expired => Self::Expired {},
+            ProtocolErrorKind::Aborted => Self::Aborted { reason: None },
+            ProtocolErrorKind::ProcessFailed => Self::ProcessFailed {},
+            ProtocolErrorKind::Unavailable => Self::Unavailable {
+                retry_after_ms: None,
+            },
+            ProtocolErrorKind::Internal => Self::Internal {},
+            ProtocolErrorKind::PayloadTooLarge => Self::PayloadTooLarge {
+                limit_bytes: None,
+                limit_entries: None,
+            },
+            ProtocolErrorKind::VersionMismatch
+            | ProtocolErrorKind::FailedPrecondition
+            | ProtocolErrorKind::CapabilityUnavailable => return None,
+        })
+    }
+}
+
+/// A JSON-RPC error object as it appears on the wire.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ErrorObject {
+    /// Fixed by `data.kind`; see [`ProtocolErrorKind::code`].
+    pub code: i32,
+    /// Human-readable description. Never parsed.
     pub message: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub details: Option<serde_json::Value>,
+    pub data: ErrorData,
 }
 
-impl EnvironmentProtocolError {
-    pub fn new(code: EnvironmentProtocolErrorCode, message: impl Into<String>) -> Self {
+/// A protocol error: one kind, its typed data and a message.
+///
+/// Serializes as an [`ErrorObject`]. Displays as `{kind}: {message}`.
+#[derive(Clone, Debug, PartialEq, Eq, Error, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[cfg_attr(feature = "schema", schemars(with = "ErrorObject"))]
+#[serde(from = "ErrorObject", into = "ErrorObject")]
+#[error("{}: {message}", self.kind())]
+pub struct ProtocolError {
+    pub data: ErrorData,
+    pub message: String,
+}
+
+impl From<ErrorObject> for ProtocolError {
+    /// `data.kind` is authoritative; `code` is not consulted.
+    fn from(object: ErrorObject) -> Self {
         Self {
-            code,
-            message: message.into(),
-            details: None,
+            data: object.data,
+            message: object.message,
         }
     }
 }
 
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub enum EnvironmentProtocolErrorCode {
-    InvalidRequest,
-    Unauthorized,
-    Forbidden,
-    NotFound,
-    Conflict,
-    Unsupported,
-    CapabilityUnavailable,
-    ProcessFailed,
-    Timeout,
-    TransportClosed,
-    Internal,
+impl From<ProtocolError> for ErrorObject {
+    fn from(error: ProtocolError) -> Self {
+        Self {
+            code: error.code(),
+            message: error.message,
+            data: error.data,
+        }
+    }
+}
+
+impl ProtocolError {
+    /// An error of this kind. A message longer than
+    /// [`MAX_ERROR_MESSAGE_BYTES`] is cut on a character boundary, so errors
+    /// embedded in results stay bounded.
+    pub fn new(data: ErrorData, message: impl Into<String>) -> Self {
+        let mut message = message.into();
+        let max = MAX_ERROR_MESSAGE_BYTES as usize;
+        if message.len() > max {
+            let mut end = max;
+            while !message.is_char_boundary(end) {
+                end -= 1;
+            }
+            message.truncate(end);
+        }
+        Self { data, message }
+    }
+
+    pub fn kind(&self) -> ProtocolErrorKind {
+        self.data.kind()
+    }
+
+    pub fn code(&self) -> i32 {
+        self.kind().code()
+    }
+
+    pub fn is_retryable(&self) -> bool {
+        self.kind().is_retryable()
+    }
+
+    /// Decode an error object tolerantly: a conforming object keeps its
+    /// typed data; an object without valid `data` (from a non-conforming
+    /// peer or an intermediary) maps its code to a kind, falling back to
+    /// `internal`.
+    pub fn from_error_value(value: &Value) -> Self {
+        if let Ok(object) = serde_json::from_value::<ErrorObject>(value.clone()) {
+            return object.into();
+        }
+        let message = value
+            .get("message")
+            .and_then(Value::as_str)
+            .unwrap_or("JSON-RPC error")
+            .to_owned();
+        let data = value
+            .get("code")
+            .and_then(Value::as_i64)
+            .and_then(ProtocolErrorKind::from_code)
+            .and_then(ErrorData::bare)
+            .unwrap_or(ErrorData::Internal {});
+        Self { data, message }
+    }
+
+    pub fn parse_error(message: impl Into<String>) -> Self {
+        Self::new(ErrorData::ParseError {}, message)
+    }
+
+    pub fn invalid_request(message: impl Into<String>) -> Self {
+        Self::new(ErrorData::InvalidRequest {}, message)
+    }
+
+    pub fn method_not_found(method: &str) -> Self {
+        Self::new(
+            ErrorData::MethodNotFound {},
+            format!("method not found: {method}"),
+        )
+    }
+
+    pub fn invalid_params(message: impl Into<String>) -> Self {
+        Self::new(
+            ErrorData::InvalidParams {
+                field: None,
+                ceiling: None,
+            },
+            message,
+        )
+    }
+
+    /// `invalidParams` naming the offending field by its wire path.
+    pub fn invalid_field(field: impl Into<String>, message: impl Into<String>) -> Self {
+        Self::new(
+            ErrorData::InvalidParams {
+                field: Some(field.into()),
+                ceiling: None,
+            },
+            message,
+        )
+    }
+
+    /// `invalidParams` for a value above an advertised ceiling.
+    pub fn above_ceiling(field: impl Into<String>, value: u64, ceiling: u64) -> Self {
+        let field = field.into();
+        let message = format!("{field} is {value}; the ceiling is {ceiling}");
+        Self::new(
+            ErrorData::InvalidParams {
+                field: Some(field),
+                ceiling: Some(ceiling),
+            },
+            message,
+        )
+    }
+
+    pub fn not_initialized() -> Self {
+        Self::new(
+            ErrorData::NotInitialized {},
+            "initialize must be the first request on a connection",
+        )
+    }
+
+    pub fn version_mismatch(expected: u32, received: u32) -> Self {
+        Self::new(
+            ErrorData::VersionMismatch { expected, received },
+            format!("protocol version {received} is not supported; this peer speaks {expected}"),
+        )
+    }
+
+    pub fn not_found(message: impl Into<String>) -> Self {
+        Self::new(ErrorData::NotFound { reason: None }, message)
+    }
+
+    pub fn not_found_because(reason: NotFoundReason, message: impl Into<String>) -> Self {
+        Self::new(
+            ErrorData::NotFound {
+                reason: Some(reason),
+            },
+            message,
+        )
+    }
+
+    pub fn already_exists(message: impl Into<String>) -> Self {
+        Self::new(ErrorData::AlreadyExists {}, message)
+    }
+
+    pub fn failed_precondition(reason: PreconditionReason, message: impl Into<String>) -> Self {
+        Self::new(ErrorData::FailedPrecondition { reason }, message)
+    }
+
+    pub fn permission_denied(reason: Option<PermissionReason>, message: impl Into<String>) -> Self {
+        Self::new(ErrorData::PermissionDenied { reason }, message)
+    }
+
+    pub fn capability_unavailable(capability: Capability, message: impl Into<String>) -> Self {
+        Self::new(ErrorData::CapabilityUnavailable { capability }, message)
+    }
+
+    pub fn busy(
+        reason: Option<BusyReason>,
+        retry_after_ms: Option<u64>,
+        message: impl Into<String>,
+    ) -> Self {
+        Self::new(
+            ErrorData::Busy {
+                reason,
+                retry_after_ms,
+            },
+            message,
+        )
+    }
+
+    pub fn deadline_exceeded(message: impl Into<String>) -> Self {
+        Self::new(ErrorData::DeadlineExceeded {}, message)
+    }
+
+    pub fn expired(message: impl Into<String>) -> Self {
+        Self::new(ErrorData::Expired {}, message)
+    }
+
+    pub fn aborted(reason: Option<AbortReason>, message: impl Into<String>) -> Self {
+        Self::new(ErrorData::Aborted { reason }, message)
+    }
+
+    /// `aborted` for a request named by `$/cancelRequest`.
+    pub fn cancelled() -> Self {
+        Self::aborted(Some(AbortReason::Cancelled), "request cancelled")
+    }
+
+    pub fn payload_too_large(limit_bytes: u64, message: impl Into<String>) -> Self {
+        Self::new(
+            ErrorData::PayloadTooLarge {
+                limit_bytes: Some(limit_bytes),
+                limit_entries: None,
+            },
+            message,
+        )
+    }
+
+    /// `payloadTooLarge` for a result with more entries than allowed.
+    pub fn too_many_entries(limit_entries: u32, message: impl Into<String>) -> Self {
+        Self::new(
+            ErrorData::PayloadTooLarge {
+                limit_bytes: None,
+                limit_entries: Some(limit_entries),
+            },
+            message,
+        )
+    }
+
+    pub fn process_failed(message: impl Into<String>) -> Self {
+        Self::new(ErrorData::ProcessFailed {}, message)
+    }
+
+    pub fn unavailable(message: impl Into<String>) -> Self {
+        Self::new(
+            ErrorData::Unavailable {
+                retry_after_ms: None,
+            },
+            message,
+        )
+    }
+
+    pub fn internal(message: impl Into<String>) -> Self {
+        Self::new(ErrorData::Internal {}, message)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use serde_json::json;
+
+    use super::*;
+
+    #[test]
+    fn errors_serialize_as_json_rpc_error_objects_with_the_kind_code() {
+        let error = ProtocolError::not_found_because(NotFoundReason::Expired, "unknown process");
+        let value = serde_json::to_value(&error).unwrap();
+        assert_eq!(
+            value,
+            json!({"code": -32004, "message": "unknown process", "data": {"kind": "notFound", "reason": "expired"}})
+        );
+        assert_eq!(
+            serde_json::from_value::<ProtocolError>(value).unwrap(),
+            error
+        );
+        assert_eq!(error.to_string(), "notFound: unknown process");
+    }
+
+    #[test]
+    fn every_kind_has_a_distinct_code_that_maps_back() {
+        let mut codes = std::collections::BTreeSet::new();
+        for kind in ProtocolErrorKind::ALL {
+            assert!(codes.insert(kind.code()), "duplicate code for {kind}");
+            assert_eq!(ProtocolErrorKind::from_code(kind.code().into()), Some(kind));
+        }
+    }
+
+    #[test]
+    fn retryability_follows_the_kind() {
+        let retryable: Vec<_> = ProtocolErrorKind::ALL
+            .into_iter()
+            .filter(|kind| kind.is_retryable())
+            .collect();
+        assert_eq!(
+            retryable,
+            [
+                ProtocolErrorKind::Busy,
+                ProtocolErrorKind::Aborted,
+                ProtocolErrorKind::Unavailable
+            ]
+        );
+    }
+
+    #[test]
+    fn foreign_error_objects_map_reserved_codes_and_fall_back_to_internal() {
+        let parsed = ProtocolError::from_error_value(&json!({"code": -32601, "message": "nope"}));
+        assert_eq!(parsed.kind(), ProtocolErrorKind::MethodNotFound);
+        let parsed = ProtocolError::from_error_value(&json!({"code": "weird"}));
+        assert_eq!(parsed.kind(), ProtocolErrorKind::Internal);
+        assert_eq!(parsed.message, "JSON-RPC error");
+    }
+
+    #[test]
+    fn unknown_data_members_are_rejected() {
+        let value =
+            json!({"code": -32004, "message": "m", "data": {"kind": "notFound", "extra": 1}});
+        assert!(serde_json::from_value::<ProtocolError>(value).is_err());
+    }
+
+    /// One error of every kind, with every optional field set where the kind
+    /// has one.
+    fn one_of_each_kind() -> Vec<ProtocolError> {
+        vec![
+            ProtocolError::parse_error("m"),
+            ProtocolError::invalid_request("m"),
+            ProtocolError::method_not_found("x/y"),
+            ProtocolError::above_ceiling("waitMs", 2, 1),
+            ProtocolError::not_initialized(),
+            ProtocolError::version_mismatch(3, 2),
+            ProtocolError::not_found_because(NotFoundReason::DaemonRestarted, "m"),
+            ProtocolError::already_exists("m"),
+            ProtocolError::failed_precondition(PreconditionReason::TargetNotActive, "m"),
+            ProtocolError::permission_denied(Some(PermissionReason::OutsideRoot), "m"),
+            ProtocolError::capability_unavailable(Capability::ProcessPty, "m"),
+            ProtocolError::busy(Some(BusyReason::RateLimited), Some(500), "m"),
+            ProtocolError::deadline_exceeded("m"),
+            ProtocolError::expired("m"),
+            ProtocolError::aborted(Some(AbortReason::SourceChanged), "m"),
+            ProtocolError::new(
+                ErrorData::PayloadTooLarge {
+                    limit_bytes: Some(1),
+                    limit_entries: Some(2),
+                },
+                "m",
+            ),
+            ProtocolError::process_failed("m"),
+            ProtocolError::new(
+                ErrorData::Unavailable {
+                    retry_after_ms: Some(10),
+                },
+                "m",
+            ),
+            ProtocolError::internal("m"),
+        ]
+    }
+
+    #[test]
+    fn every_kind_round_trips_with_its_code() {
+        let errors = one_of_each_kind();
+        let kinds: Vec<_> = errors.iter().map(ProtocolError::kind).collect();
+        assert_eq!(kinds, ProtocolErrorKind::ALL);
+        for error in errors {
+            let value = serde_json::to_value(&error).unwrap();
+            assert_eq!(value["code"], json!(error.code()));
+            assert_eq!(value["data"]["kind"], json!(error.kind().as_str()));
+            assert_eq!(
+                serde_json::from_value::<ProtocolError>(value).unwrap(),
+                error
+            );
+        }
+    }
+
+    #[test]
+    fn every_kind_rejects_unknown_data_members() {
+        for error in one_of_each_kind() {
+            let mut value = serde_json::to_value(&error).unwrap();
+            value["data"]["unexpectedMember"] = json!(1);
+            assert!(
+                serde_json::from_value::<ProtocolError>(value).is_err(),
+                "{} accepts an unknown member",
+                error.kind()
+            );
+        }
+    }
+
+    #[test]
+    fn fieldless_kinds_serialize_as_the_kind_alone() {
+        assert_eq!(
+            serde_json::to_value(ErrorData::NotInitialized {}).unwrap(),
+            json!({"kind": "notInitialized"})
+        );
+    }
+
+    #[test]
+    fn long_messages_are_cut_on_a_character_boundary() {
+        let error = ProtocolError::internal("\u{e9}".repeat(MAX_ERROR_MESSAGE_BYTES as usize));
+        assert!(error.message.len() <= MAX_ERROR_MESSAGE_BYTES as usize);
+        assert!(error.message.len() > MAX_ERROR_MESSAGE_BYTES as usize - 2);
+    }
 }
diff --git a/crates/environment-protocol/src/gateway.rs b/crates/environment-protocol/src/gateway.rs
deleted file mode 100644
index 93445e36f..000000000
--- a/crates/environment-protocol/src/gateway.rs
+++ /dev/null
@@ -1,8 +0,0 @@
-//! Stable environment gateway route paths.
-
-pub const ROUTE_PATH_PREFIX: &str = "/environment-gateway/routes";
-
-/// Appended to a provider controller base URL for Lightspeed-initiated data
-/// connections. The remainder is
-/// `/{universe}/{binding}/{environment}/{incarnation}/{target}`.
-pub const PROVIDER_DATA_PATH_PREFIX: &str = "/routes";
diff --git a/crates/environment-protocol/src/handshake.rs b/crates/environment-protocol/src/handshake.rs
new file mode 100644
index 000000000..ccc6ba291
--- /dev/null
+++ b/crates/environment-protocol/src/handshake.rs
@@ -0,0 +1,257 @@
+//! Values every handshake shares.
+
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use thiserror::Error;
+
+#[cfg(feature = "schema")]
+use crate::ids::NO_CONTROL_PATTERN;
+use crate::limits::MAX_IMPLEMENTATION_FIELD_BYTES;
+
+/// The plane a connection serves. Each `initialize` response names its
+/// plane, so a client that reached the wrong socket fails at the handshake.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase")]
+pub enum Plane {
+    /// envd's data plane, versioned by `ENVD_PROTOCOL_VERSION`.
+    Data,
+    /// A provider controller, versioned by `CONTROLLER_PROTOCOL_VERSION`.
+    Controller,
+    /// The registration channel between a daemon and the gateway, versioned
+    /// by `ENVD_PROTOCOL_VERSION`.
+    Registration,
+}
+
+impl Plane {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Data => "data",
+            Self::Controller => "controller",
+            Self::Registration => "registration",
+        }
+    }
+}
+
+impl std::fmt::Display for Plane {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter.write_str(self.as_str())
+    }
+}
+
+/// What a peer says about its own build: `clientInfo`, `serverInfo` and a
+/// daemon's registration `implementation`. Descriptive only; the protocol
+/// version alone decides whether two peers can talk, and nothing here
+/// selects, authenticates or gates. Every field is 1 to 256 bytes without control characters,
+/// checked on decode and by every constructor, so a value that would be
+/// refused can never be built or sent.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ImplementationInfo {
+    /// Product name, such as `lightspeed-envd`.
+    #[cfg_attr(
+        feature = "schema",
+        schemars(length(min = 1, max = 256), pattern(NO_CONTROL_PATTERN))
+    )]
+    name: String,
+    /// Release version, such as `0.5.0`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[cfg_attr(
+        feature = "schema",
+        schemars(length(min = 1, max = 256), pattern(NO_CONTROL_PATTERN))
+    )]
+    version: Option<String>,
+    /// Full or abbreviated git commit of the build.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[cfg_attr(
+        feature = "schema",
+        schemars(length(min = 1, max = 256), pattern(NO_CONTROL_PATTERN))
+    )]
+    git_sha: Option<String>,
+    /// Rust target triple of the build.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[cfg_attr(
+        feature = "schema",
+        schemars(length(min = 1, max = 256), pattern(NO_CONTROL_PATTERN))
+    )]
+    target: Option<String>,
+}
+
+/// The decoded shape before the bounds are checked.
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct ImplementationInfoFields {
+    name: String,
+    #[serde(default)]
+    version: Option<String>,
+    #[serde(default)]
+    git_sha: Option<String>,
+    #[serde(default)]
+    target: Option<String>,
+}
+
+impl ImplementationInfoFields {
+    fn into_info(self) -> Result<ImplementationInfo, ImplementationInfoError> {
+        let info = ImplementationInfo {
+            name: self.name,
+            version: self.version,
+            git_sha: self.git_sha,
+            target: self.target,
+        };
+        check_field("name", Some(&info.name))?;
+        check_field("version", info.version.as_deref())?;
+        check_field("gitSha", info.git_sha.as_deref())?;
+        check_field("target", info.target.as_deref())?;
+        Ok(info)
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Error)]
+#[error("{field} must be 1..={max} bytes without control characters", max = MAX_IMPLEMENTATION_FIELD_BYTES)]
+pub struct ImplementationInfoError {
+    /// Wire name of the offending member.
+    pub field: &'static str,
+}
+
+impl ImplementationInfo {
+    pub fn new(name: impl Into<String>) -> Result<Self, ImplementationInfoError> {
+        let name = name.into();
+        check_field("name", Some(&name))?;
+        Ok(Self {
+            name,
+            version: None,
+            git_sha: None,
+            target: None,
+        })
+    }
+
+    pub fn with_version(
+        mut self,
+        version: impl Into<String>,
+    ) -> Result<Self, ImplementationInfoError> {
+        let version = version.into();
+        check_field("version", Some(&version))?;
+        self.version = Some(version);
+        Ok(self)
+    }
+
+    pub fn with_git_sha(
+        mut self,
+        git_sha: impl Into<String>,
+    ) -> Result<Self, ImplementationInfoError> {
+        let git_sha = git_sha.into();
+        check_field("gitSha", Some(&git_sha))?;
+        self.git_sha = Some(git_sha);
+        Ok(self)
+    }
+
+    pub fn with_target(
+        mut self,
+        target: impl Into<String>,
+    ) -> Result<Self, ImplementationInfoError> {
+        let target = target.into();
+        check_field("target", Some(&target))?;
+        self.target = Some(target);
+        Ok(self)
+    }
+
+    pub fn name(&self) -> &str {
+        &self.name
+    }
+
+    pub fn version(&self) -> Option<&str> {
+        self.version.as_deref()
+    }
+
+    pub fn git_sha(&self) -> Option<&str> {
+        self.git_sha.as_deref()
+    }
+
+    pub fn target(&self) -> Option<&str> {
+        self.target.as_deref()
+    }
+
+    /// For a value that has the shape of an `ImplementationInfo` but breaks
+    /// its bounds, the offending member. `None` when the value decodes, or
+    /// when it does not even have the shape (a strict decode reports that).
+    pub fn bounds_violation(value: &Value) -> Option<ImplementationInfoError> {
+        ImplementationInfoFields::deserialize(value)
+            .ok()?
+            .into_info()
+            .err()
+    }
+}
+
+impl<'de> Deserialize<'de> for ImplementationInfo {
+    fn deserialize<D: serde::Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        ImplementationInfoFields::deserialize(deserializer)?
+            .into_info()
+            .map_err(serde::de::Error::custom)
+    }
+}
+
+fn check_field(field: &'static str, value: Option<&str>) -> Result<(), ImplementationInfoError> {
+    match value {
+        Some(value)
+            if value.is_empty()
+                || value.len() > MAX_IMPLEMENTATION_FIELD_BYTES as usize
+                || value.chars().any(char::is_control) =>
+        {
+            Err(ImplementationInfoError { field })
+        }
+        _ => Ok(()),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn implementation_info_is_bounded_on_decode() {
+        let ok = serde_json::json!({"name": "lightspeed-envd", "version": "0.5.0"});
+        assert!(serde_json::from_value::<ImplementationInfo>(ok).is_ok());
+        for bad in [
+            serde_json::json!({"name": ""}),
+            serde_json::json!({"name": "x", "version": "a\nb"}),
+            serde_json::json!({"name": "x", "gitSha": "a".repeat(257)}),
+            serde_json::json!({"name": "x", "extra": 1}),
+        ] {
+            assert!(serde_json::from_value::<ImplementationInfo>(bad).is_err());
+        }
+    }
+
+    #[test]
+    fn constructors_enforce_the_decode_bounds() {
+        let info = ImplementationInfo::new("lightspeed-envd")
+            .and_then(|info| info.with_version("0.5.0"))
+            .unwrap();
+        assert_eq!(info.version(), Some("0.5.0"));
+        assert_eq!(
+            ImplementationInfo::new(""),
+            Err(ImplementationInfoError { field: "name" })
+        );
+        assert_eq!(
+            info.with_git_sha("a\nb"),
+            Err(ImplementationInfoError { field: "gitSha" })
+        );
+    }
+
+    #[test]
+    fn bounds_violations_are_told_apart_from_shape_errors() {
+        let long = serde_json::json!({"name": "x", "version": "v".repeat(257)});
+        assert_eq!(
+            ImplementationInfo::bounds_violation(&long),
+            Some(ImplementationInfoError { field: "version" })
+        );
+        assert_eq!(
+            ImplementationInfo::bounds_violation(&serde_json::json!({"name": 1})),
+            None
+        );
+        assert_eq!(
+            ImplementationInfo::bounds_violation(&serde_json::json!({"name": "ok"})),
+            None
+        );
+    }
+}
diff --git a/crates/environment-protocol/src/ids.rs b/crates/environment-protocol/src/ids.rs
new file mode 100644
index 000000000..f94d60a61
--- /dev/null
+++ b/crates/environment-protocol/src/ids.rs
@@ -0,0 +1,334 @@
+//! Typed identifiers.
+//!
+//! Every id space has its own type with a private field and a validating
+//! decoder. Two grammars exist:
+//!
+//! - **General** (Lightspeed-assigned ids): 1 to 128 bytes, an ASCII letter
+//!   or digit first, then ASCII letters, digits, `_`, `-`, `.` or `:`.
+//! - **Opaque** (provider-assigned ids and daemon-minted tokens): 1 to 255
+//!   bytes without control characters. Container, Kubernetes and cloud ids
+//!   such as `default/pod-abc` or an ARN are valid as they are.
+//!
+//! [`JobName`] is a third, caller-chosen name space with its own rule.
+
+use std::{fmt, str::FromStr};
+
+use serde::{Deserialize, Deserializer, Serialize, Serializer, de::Error as _};
+use thiserror::Error;
+
+pub const GENERAL_ID_MAX_BYTES: u32 = 128;
+pub const OPAQUE_ID_MAX_BYTES: u32 = 255;
+pub const JOB_NAME_MAX_BYTES: u32 = 128;
+
+/// JSON Schema pattern of the general grammar.
+pub const GENERAL_ID_PATTERN: &str = "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$";
+/// JSON Schema pattern of a string without control characters (Unicode
+/// category Cc), the character rule of opaque ids and job names.
+pub const NO_CONTROL_PATTERN: &str = "^[^\\u0000-\\u001F\\u007F-\\u009F]+$";
+
+#[derive(Clone, Debug, PartialEq, Eq, Error)]
+pub enum IdError {
+    #[error("{kind} must not be empty")]
+    Empty { kind: &'static str },
+
+    #[error("{kind} is {actual} bytes; the maximum is {max}")]
+    TooLong {
+        kind: &'static str,
+        max: u32,
+        actual: usize,
+    },
+
+    #[error("{kind} must start with an ASCII letter or digit")]
+    InvalidStart { kind: &'static str },
+
+    #[error(
+        "{kind} contains {character:?} at byte {index}; allowed are ASCII letters, digits, '_', '-', '.', ':'"
+    )]
+    InvalidCharacter {
+        kind: &'static str,
+        index: usize,
+        character: char,
+    },
+
+    #[error("{kind} contains a control character at byte {index}")]
+    ControlCharacter { kind: &'static str, index: usize },
+}
+
+/// Check the general id grammar.
+pub fn validate_general_id(kind: &'static str, value: &str) -> Result<(), IdError> {
+    check_length(kind, value, GENERAL_ID_MAX_BYTES)?;
+    if !value.as_bytes()[0].is_ascii_alphanumeric() {
+        return Err(IdError::InvalidStart { kind });
+    }
+    if let Some((index, character)) = value
+        .char_indices()
+        .find(|(_, character)| !(character.is_ascii_alphanumeric() || "_-.:".contains(*character)))
+    {
+        return Err(IdError::InvalidCharacter {
+            kind,
+            index,
+            character,
+        });
+    }
+    Ok(())
+}
+
+/// Check the opaque id grammar.
+pub fn validate_opaque_id(kind: &'static str, value: &str) -> Result<(), IdError> {
+    check_length(kind, value, OPAQUE_ID_MAX_BYTES)?;
+    check_no_control(kind, value)
+}
+
+/// Check the job name rule: 1 to [`JOB_NAME_MAX_BYTES`] bytes without
+/// control characters.
+pub fn validate_job_name(kind: &'static str, value: &str) -> Result<(), IdError> {
+    check_length(kind, value, JOB_NAME_MAX_BYTES)?;
+    check_no_control(kind, value)
+}
+
+fn check_no_control(kind: &'static str, value: &str) -> Result<(), IdError> {
+    if let Some((index, _)) = value
+        .char_indices()
+        .find(|(_, character)| character.is_control())
+    {
+        return Err(IdError::ControlCharacter { kind, index });
+    }
+    Ok(())
+}
+
+fn check_length(kind: &'static str, value: &str, max: u32) -> Result<(), IdError> {
+    if value.is_empty() {
+        return Err(IdError::Empty { kind });
+    }
+    if value.len() > max as usize {
+        return Err(IdError::TooLong {
+            kind,
+            max,
+            actual: value.len(),
+        });
+    }
+    Ok(())
+}
+
+macro_rules! protocol_id {
+    ($(#[$doc:meta])* $name:ident, general) => {
+        protocol_id!(
+            $(#[$doc])* $name,
+            validate_general_id,
+            length(min = 1, max = 128),
+            pattern(GENERAL_ID_PATTERN)
+        );
+    };
+    ($(#[$doc:meta])* $name:ident, opaque) => {
+        protocol_id!(
+            $(#[$doc])* $name,
+            validate_opaque_id,
+            length(min = 1, max = 255),
+            pattern(NO_CONTROL_PATTERN)
+        );
+    };
+    ($(#[$doc:meta])* $name:ident, $validate:ident, $($schema:tt)*) => {
+        $(#[$doc])*
+        #[derive(Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
+        #[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+        pub struct $name(#[cfg_attr(feature = "schema", schemars($($schema)*))] String);
+
+        impl $name {
+            pub fn new(value: impl Into<String>) -> Result<Self, IdError> {
+                let value = value.into();
+                $validate(stringify!($name), &value)?;
+                Ok(Self(value))
+            }
+
+            pub fn as_str(&self) -> &str {
+                &self.0
+            }
+
+            pub fn into_string(self) -> String {
+                self.0
+            }
+        }
+
+        impl fmt::Display for $name {
+            fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+                self.0.fmt(formatter)
+            }
+        }
+
+        impl FromStr for $name {
+            type Err = IdError;
+
+            fn from_str(value: &str) -> Result<Self, Self::Err> {
+                Self::new(value)
+            }
+        }
+
+        impl TryFrom<String> for $name {
+            type Error = IdError;
+
+            fn try_from(value: String) -> Result<Self, Self::Error> {
+                Self::new(value)
+            }
+        }
+
+        impl TryFrom<&str> for $name {
+            type Error = IdError;
+
+            fn try_from(value: &str) -> Result<Self, Self::Error> {
+                Self::new(value)
+            }
+        }
+
+        impl AsRef<str> for $name {
+            fn as_ref(&self) -> &str {
+                &self.0
+            }
+        }
+
+        impl Serialize for $name {
+            fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+                serializer.serialize_str(&self.0)
+            }
+        }
+
+        impl<'de> Deserialize<'de> for $name {
+            fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+                let value = String::deserialize(deserializer)?;
+                Self::new(value).map_err(D::Error::custom)
+            }
+        }
+    };
+}
+
+protocol_id!(
+    /// `processId`: caller-chosen handle of a process on one daemon.
+    ProcessId,
+    general
+);
+protocol_id!(
+    /// `jobId`: caller-chosen name of one job run on one daemon.
+    JobId,
+    general
+);
+protocol_id!(
+    /// `requestId` of a `job/start` call. Part of each job's identity: a
+    /// retried start with the same request id and spec replays the job; any
+    /// other reuse of the job id is refused.
+    JobRequestId,
+    general
+);
+protocol_id!(
+    /// `queueKey`: jobs sharing a key run one at a time, in start order.
+    QueueKey,
+    general
+);
+protocol_id!(
+    /// `operationId` of one transfer operation.
+    TransferOperationId,
+    general
+);
+protocol_id!(
+    /// `daemonInstanceId`: random per daemon start. A change between two
+    /// connections means the daemon restarted and every process handle from
+    /// the earlier instance is gone.
+    DaemonInstanceId,
+    general
+);
+protocol_id!(
+    /// `universeId` of a Lightspeed universe.
+    UniverseId,
+    general
+);
+protocol_id!(
+    /// `bindingId` of a provider binding within a universe.
+    BindingId,
+    general
+);
+protocol_id!(
+    /// `environmentId` of a Lightspeed environment.
+    EnvironmentId,
+    general
+);
+protocol_id!(
+    /// `incarnationId` of one incarnation of an environment.
+    IncarnationId,
+    general
+);
+protocol_id!(
+    /// `daemonId` the gateway assigns to an admitted daemon identity.
+    DaemonId,
+    general
+);
+protocol_id!(
+    /// `controlConnectionId` the gateway assigns to one control connection.
+    ControlConnectionId,
+    general
+);
+protocol_id!(
+    /// `targetId`: the provider's own id for a target, opaque to Lightspeed.
+    ProviderTargetId,
+    opaque
+);
+protocol_id!(
+    /// `templateId`: the provider's own id for a template.
+    TemplateId,
+    opaque
+);
+protocol_id!(
+    /// `sourceTarget` of `target/adopt`: a provider-native reference to an
+    /// existing target, in a format the provider defines.
+    ProviderNativeRef,
+    opaque
+);
+protocol_id!(
+    /// `name` of a job and `dependsOn {kind: name}`: a caller-chosen name,
+    /// unique within one `job/start`, 1 to 128 bytes without control
+    /// characters.
+    JobName,
+    validate_job_name,
+    length(min = 1, max = 128),
+    pattern(NO_CONTROL_PATTERN)
+);
+protocol_id!(
+    /// `cursor` and `nextCursor` of `fs/readDirectory`: an opaque position
+    /// the daemon mints, echoed back unchanged.
+    DirectoryCursor,
+    opaque
+);
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn general_ids_validate_on_decode() {
+        assert!(serde_json::from_str::<JobId>("\"build.1:a-b_c\"").is_ok());
+        for bad in ["\"\"", "\"-lead\"", "\"has space\"", "\"é\""] {
+            assert!(serde_json::from_str::<ProcessId>(bad).is_err(), "{bad}");
+        }
+        let long = format!("\"{}\"", "a".repeat(GENERAL_ID_MAX_BYTES as usize + 1));
+        assert!(serde_json::from_str::<ProcessId>(&long).is_err());
+    }
+
+    #[test]
+    fn opaque_ids_accept_natural_provider_ids() {
+        for good in [
+            "default/pod-abc",
+            "arn:aws:ec2:eu-west-1:123:instance/i-0abc",
+            "ls-3f2a",
+        ] {
+            assert!(ProviderTargetId::new(good).is_ok(), "{good}");
+        }
+        assert!(ProviderTargetId::new("a\nb").is_err());
+        assert!(ProviderTargetId::new("").is_err());
+        assert!(ProviderTargetId::new("x".repeat(OPAQUE_ID_MAX_BYTES as usize + 1)).is_err());
+    }
+
+    #[test]
+    fn job_names_allow_spaces_but_not_control_characters() {
+        assert!(JobName::new("build & test").is_ok());
+        assert!(JobName::new("a\tb").is_err());
+        assert!(JobName::new("").is_err());
+        assert!(JobName::new("x".repeat(JOB_NAME_MAX_BYTES as usize + 1)).is_err());
+    }
+}
diff --git a/crates/environment-protocol/src/jsonrpc.rs b/crates/environment-protocol/src/jsonrpc.rs
new file mode 100644
index 000000000..617d17906
--- /dev/null
+++ b/crates/environment-protocol/src/jsonrpc.rs
@@ -0,0 +1,601 @@
+//! The JSON-RPC 2.0 envelope every socket uses: the data plane, the
+//! controller plane and the registration channel.
+//!
+//! Rules, applied by [`parse`] and the constructors here:
+//!
+//! - One message per WebSocket text frame, at most
+//!   [`MAX_MESSAGE_BYTES`]. Binary frames
+//!   are not part of any plane.
+//! - `jsonrpc` must be `"2.0"`.
+//! - Params are named: an object, or absent, which means `{}`.
+//! - A request has a string or integer `id`; a notification has none and is
+//!   never answered, not even with an error. A malformed frame that has a
+//!   string `method` and no `id` is a malformed notification: [`parse`]
+//!   rejects it, and a server drops it silently
+//!   ([`Rejection::into_response`] returns `None`).
+//! - Batches (JSON arrays) are not supported and are answered with one
+//!   `invalidRequest` error with a null id.
+//! - A frame that is not JSON is answered with `parseError` and a null id;
+//!   the connection stays open.
+//! - A server answers every other rejection, with the request's id when it
+//!   could be read and a null id otherwise; a client that rejects a frame
+//!   closes the connection.
+//! - Requests may be pipelined. Responses arrive in any order and are
+//!   matched by id.
+//! - [`CANCEL_REQUEST_METHOD`] asks the server to abort a pending request.
+
+use serde::{Deserialize, Serialize, de::DeserializeOwned};
+use serde_json::{Map, Value};
+use thiserror::Error;
+
+use crate::{
+    error::{ErrorObject, ProtocolError},
+    limits::MAX_MESSAGE_BYTES,
+};
+
+pub const JSONRPC_VERSION: &str = "2.0";
+
+/// Client-to-server notification asking the server to abort the request
+/// with this id. Read-only waits stop and answer `aborted` with reason
+/// `cancelled`; methods with side effects run to a consistent state and
+/// answer normally. An unknown or finished id is ignored.
+pub const CANCEL_REQUEST_METHOD: &str = "$/cancelRequest";
+
+/// A request id: an integer or a string, echoed in the response.
+#[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(untagged)]
+pub enum Id {
+    Number(i64),
+    String(String),
+}
+
+impl From<i64> for Id {
+    fn from(value: i64) -> Self {
+        Self::Number(value)
+    }
+}
+
+impl std::fmt::Display for Id {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::Number(number) => number.fmt(formatter),
+            Self::String(text) => text.fmt(formatter),
+        }
+    }
+}
+
+/// `$/cancelRequest` params.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct CancelRequestParams {
+    /// Id of the request to abort.
+    pub id: Id,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub struct Request {
+    pub id: Id,
+    pub method: String,
+    /// Always a JSON object.
+    pub params: Value,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub struct Notification {
+    pub method: String,
+    /// Always a JSON object.
+    pub params: Value,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub struct Response {
+    /// Absent (null on the wire) only when the request's id could not be
+    /// read.
+    pub id: Option<Id>,
+    pub result: Result<Value, ProtocolError>,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub enum Message {
+    Request(Request),
+    Notification(Notification),
+    Response(Response),
+}
+
+/// A frame that cannot be accepted, with the error to answer it with.
+///
+/// A server answers a rejection with [`into_response`](Self::into_response)
+/// unless the frame was a malformed notification, which is dropped
+/// silently. A client that rejects a frame closes the connection.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Rejection {
+    /// The rejected request's id; absent when it could not be read.
+    pub id: Option<Id>,
+    pub error: ProtocolError,
+    /// The frame had a string `method` and no `id`.
+    notification: bool,
+}
+
+impl Rejection {
+    fn of_frame(error: ProtocolError) -> Self {
+        Self {
+            id: None,
+            error,
+            notification: false,
+        }
+    }
+
+    /// True when the frame was a malformed notification: it must not be
+    /// answered.
+    pub fn is_notification(&self) -> bool {
+        self.notification
+    }
+
+    /// The error response a server sends for this rejection, or `None` for
+    /// a malformed notification, which is never answered.
+    pub fn into_response(self) -> Option<Response> {
+        (!self.notification).then_some(Response {
+            id: self.id,
+            result: Err(self.error),
+        })
+    }
+}
+
+/// Classify one text frame.
+pub fn parse(text: &str) -> Result<Message, Rejection> {
+    let value: Value = serde_json::from_str(text).map_err(|error| {
+        Rejection::of_frame(ProtocolError::parse_error(format!(
+            "frame is not JSON: {error}"
+        )))
+    })?;
+    parse_value(value)
+}
+
+/// Classify one decoded frame.
+pub fn parse_value(value: Value) -> Result<Message, Rejection> {
+    let mut object = match value {
+        Value::Object(object) => object,
+        Value::Array(_) => {
+            return Err(Rejection::of_frame(ProtocolError::invalid_request(
+                "batches are not supported",
+            )));
+        }
+        _ => {
+            return Err(Rejection::of_frame(ProtocolError::invalid_request(
+                "a message must be a JSON object",
+            )));
+        }
+    };
+    let notification =
+        !object.contains_key("id") && matches!(object.get("method"), Some(Value::String(_)));
+    let id = match object.remove("id") {
+        None => None,
+        Some(value) => match serde_json::from_value::<Id>(value.clone()) {
+            Ok(id) => Some(id),
+            Err(_) if value.is_null() && object.contains_key("error") => None,
+            Err(_) => {
+                return Err(Rejection::of_frame(ProtocolError::invalid_request(
+                    "id must be a string or an integer",
+                )));
+            }
+        },
+    };
+    let reject = |error: ProtocolError| Rejection {
+        id: id.clone(),
+        error,
+        notification,
+    };
+    match object.remove("jsonrpc") {
+        Some(Value::String(version)) if version == JSONRPC_VERSION => {}
+        _ => {
+            return Err(reject(ProtocolError::invalid_request(
+                "jsonrpc must be \"2.0\"",
+            )));
+        }
+    }
+
+    if let Some(method) = object.remove("method") {
+        let Value::String(method) = method else {
+            return Err(reject(ProtocolError::invalid_request(
+                "method must be a string",
+            )));
+        };
+        let params = match object.remove("params") {
+            None => Value::Object(Map::new()),
+            Some(params @ Value::Object(_)) => params,
+            Some(_) => {
+                return Err(reject(ProtocolError::invalid_params(
+                    "params must be an object",
+                )));
+            }
+        };
+        if let Some(member) = object.keys().next() {
+            return Err(reject(ProtocolError::invalid_request(format!(
+                "unknown member {member:?}"
+            ))));
+        }
+        return Ok(match id {
+            Some(id) => Message::Request(Request { id, method, params }),
+            None => Message::Notification(Notification { method, params }),
+        });
+    }
+
+    let result = match (object.remove("result"), object.remove("error")) {
+        (Some(result), None) => Ok(result),
+        (None, Some(error)) => Err(ProtocolError::from_error_value(&error)),
+        _ => {
+            return Err(reject(ProtocolError::invalid_request(
+                "a response carries exactly one of result and error",
+            )));
+        }
+    };
+    if let Some(member) = object.keys().next() {
+        return Err(reject(ProtocolError::invalid_request(format!(
+            "unknown member {member:?}"
+        ))));
+    }
+    if id.is_none() && result.is_ok() {
+        return Err(reject(ProtocolError::invalid_request(
+            "a result needs an id",
+        )));
+    }
+    Ok(Message::Response(Response { id, result }))
+}
+
+impl Request {
+    pub fn new<P: Serialize>(id: Id, method: &str, params: &P) -> Result<Self, ProtocolError> {
+        Ok(Self {
+            id,
+            method: method.to_owned(),
+            params: params_value(params)?,
+        })
+    }
+
+    /// Decode the params strictly; a failure is `invalidParams`.
+    pub fn params<T: DeserializeOwned>(&self) -> Result<T, ProtocolError> {
+        decode_params(&self.params)
+    }
+
+    pub fn to_value(&self) -> Value {
+        serde_json::json!({
+            "jsonrpc": JSONRPC_VERSION,
+            "id": self.id,
+            "method": self.method,
+            "params": self.params,
+        })
+    }
+
+    pub fn to_text(&self) -> String {
+        self.to_value().to_string()
+    }
+}
+
+impl Notification {
+    pub fn new<P: Serialize>(method: &str, params: &P) -> Result<Self, ProtocolError> {
+        Ok(Self {
+            method: method.to_owned(),
+            params: params_value(params)?,
+        })
+    }
+
+    /// Decode the params strictly; a failure is `invalidParams`.
+    pub fn params<T: DeserializeOwned>(&self) -> Result<T, ProtocolError> {
+        decode_params(&self.params)
+    }
+
+    pub fn to_value(&self) -> Value {
+        serde_json::json!({
+            "jsonrpc": JSONRPC_VERSION,
+            "method": self.method,
+            "params": self.params,
+        })
+    }
+
+    pub fn to_text(&self) -> String {
+        self.to_value().to_string()
+    }
+}
+
+impl Response {
+    pub fn success<T: Serialize>(id: Id, result: &T) -> Self {
+        let result = serde_json::to_value(result)
+            .map_err(|error| ProtocolError::internal(format!("encode result: {error}")));
+        Self {
+            id: Some(id),
+            result,
+        }
+    }
+
+    pub fn failure(id: Option<Id>, error: ProtocolError) -> Self {
+        Self {
+            id,
+            result: Err(error),
+        }
+    }
+
+    pub fn from_result<T: Serialize>(id: Id, result: Result<T, ProtocolError>) -> Self {
+        match result {
+            Ok(value) => Self::success(id, &value),
+            Err(error) => Self::failure(Some(id), error),
+        }
+    }
+
+    /// Decode a successful result strictly. The two failures stay apart: the
+    /// peer answered with an error ([`ResponseError::Failed`]), or its result
+    /// breaks the contract ([`ResponseError::Undecodable`]).
+    pub fn decode<T: DeserializeOwned>(self) -> Result<T, ResponseError> {
+        let value = self.result.map_err(ResponseError::Failed)?;
+        serde_path_to_error::deserialize(&value)
+            .map_err(|error| ResponseError::Undecodable(describe_path_error(&error)))
+    }
+
+    pub fn to_value(&self) -> Value {
+        let id = self.id.as_ref().map_or(Value::Null, |id| {
+            serde_json::to_value(id).unwrap_or(Value::Null)
+        });
+        match &self.result {
+            Ok(result) => {
+                serde_json::json!({"jsonrpc": JSONRPC_VERSION, "id": id, "result": result})
+            }
+            Err(error) => serde_json::json!({
+                "jsonrpc": JSONRPC_VERSION,
+                "id": id,
+                "error": ErrorObject::from(error.clone()),
+            }),
+        }
+    }
+
+    /// Encode for sending. A response larger than
+    /// [`MAX_MESSAGE_BYTES`] is replaced by a `payloadTooLarge` error for the
+    /// same id, so a server never sends a frame its peer must drop.
+    pub fn to_text(&self) -> String {
+        let text = self.to_value().to_string();
+        if (text.len() as u64) <= MAX_MESSAGE_BYTES {
+            return text;
+        }
+        Self::failure(
+            self.id.clone(),
+            ProtocolError::payload_too_large(
+                MAX_MESSAGE_BYTES,
+                format!("response of {} bytes exceeds the message limit", text.len()),
+            ),
+        )
+        .to_value()
+        .to_string()
+    }
+}
+
+/// Why a response yielded no typed result.
+#[derive(Clone, Debug, PartialEq, Error)]
+pub enum ResponseError {
+    /// The peer answered with this error.
+    #[error(transparent)]
+    Failed(ProtocolError),
+
+    /// The result does not decode as the method's response type: the peer
+    /// broke the contract.
+    #[error("result does not decode: {0}")]
+    Undecodable(String),
+}
+
+/// Check an encoded outgoing message against the message limit.
+pub fn check_message_size(text: &str) -> Result<(), ProtocolError> {
+    let length = text.len() as u64;
+    if length > MAX_MESSAGE_BYTES {
+        return Err(ProtocolError::payload_too_large(
+            MAX_MESSAGE_BYTES,
+            format!("message of {length} bytes exceeds the {MAX_MESSAGE_BYTES}-byte limit"),
+        ));
+    }
+    Ok(())
+}
+
+fn params_value<P: Serialize>(params: &P) -> Result<Value, ProtocolError> {
+    match serde_json::to_value(params) {
+        Ok(value @ Value::Object(_)) => Ok(value),
+        Ok(_) => Err(ProtocolError::internal(
+            "params must serialize as an object",
+        )),
+        Err(error) => Err(ProtocolError::internal(format!("encode params: {error}"))),
+    }
+}
+
+/// Strict decode; a failure is `invalidParams` naming the offending field by
+/// its wire path when the decoder knows it.
+pub fn decode_params<T: DeserializeOwned>(params: &Value) -> Result<T, ProtocolError> {
+    serde_path_to_error::deserialize(params).map_err(|error| {
+        let field = path_of(&error);
+        let message = describe_path_error(&error);
+        match field {
+            Some(field) => ProtocolError::invalid_field(field, message),
+            None => ProtocolError::invalid_params(message),
+        }
+    })
+}
+
+fn path_of(error: &serde_path_to_error::Error<serde_json::Error>) -> Option<String> {
+    let path = error.path();
+    path.iter().next().is_some().then(|| path.to_string())
+}
+
+fn describe_path_error(error: &serde_path_to_error::Error<serde_json::Error>) -> String {
+    match path_of(error) {
+        Some(path) => format!("{path}: {}", error.inner()),
+        None => error.inner().to_string(),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use serde_json::json;
+
+    use super::*;
+    use crate::error::{ErrorData, ProtocolErrorKind};
+
+    fn rejected(text: &str) -> Rejection {
+        parse(text).expect_err("rejected")
+    }
+
+    #[test]
+    fn missing_params_mean_an_empty_object() {
+        let Message::Request(request) =
+            parse(r#"{"jsonrpc":"2.0","id":1,"method":"env/getIdle"}"#).expect("request")
+        else {
+            panic!("expected a request");
+        };
+        assert_eq!(request.params, json!({}));
+        assert_eq!(request.id, Id::Number(1));
+    }
+
+    #[test]
+    fn framing_errors_use_reserved_kinds_and_null_ids() {
+        let parse_error = rejected("not json");
+        assert_eq!(parse_error.error.kind(), ProtocolErrorKind::ParseError);
+        assert_eq!(parse_error.id, None);
+        let batch = rejected(r#"[{"jsonrpc":"2.0","id":1,"method":"x"}]"#);
+        assert_eq!(batch.error.kind(), ProtocolErrorKind::InvalidRequest);
+        assert_eq!(batch.id, None);
+        let version = rejected(r#"{"jsonrpc":"1.0","id":7,"method":"x"}"#);
+        assert_eq!(version.error.kind(), ProtocolErrorKind::InvalidRequest);
+        assert_eq!(version.id, Some(Id::Number(7)));
+        let params = rejected(r#"{"jsonrpc":"2.0","id":"a","method":"x","params":[1]}"#);
+        assert_eq!(params.error.kind(), ProtocolErrorKind::InvalidParams);
+        let member = rejected(r#"{"jsonrpc":"2.0","id":1,"method":"x","extra":true}"#);
+        assert_eq!(member.error.kind(), ProtocolErrorKind::InvalidRequest);
+    }
+
+    #[test]
+    fn notifications_carry_no_id() {
+        let message = parse(r#"{"jsonrpc":"2.0","method":"$/cancelRequest","params":{"id":3}}"#)
+            .expect("notification");
+        let Message::Notification(notification) = message else {
+            panic!("expected a notification");
+        };
+        let params: CancelRequestParams = notification.params().expect("params");
+        assert_eq!(params.id, Id::Number(3));
+    }
+
+    #[test]
+    fn error_responses_round_trip_with_null_ids() {
+        let response = Response::failure(None, ProtocolError::parse_error("bad"));
+        let text = response.to_text();
+        let Message::Response(parsed) = parse(&text).expect("response") else {
+            panic!("expected a response");
+        };
+        assert_eq!(parsed, response);
+        assert_eq!(
+            serde_json::from_str::<Value>(&text).unwrap()["id"],
+            Value::Null
+        );
+    }
+
+    #[test]
+    fn oversized_responses_become_payload_too_large() {
+        let big = "x".repeat(MAX_MESSAGE_BYTES as usize + 1);
+        let text = Response::success(Id::Number(4), &json!({"data": big})).to_text();
+        let Message::Response(parsed) = parse(&text).expect("response") else {
+            panic!("expected a response");
+        };
+        assert_eq!(parsed.id, Some(Id::Number(4)));
+        assert_eq!(
+            parsed.result.unwrap_err().kind(),
+            ProtocolErrorKind::PayloadTooLarge
+        );
+    }
+
+    #[test]
+    fn params_decode_failures_are_invalid_params_naming_the_field() {
+        let request = Request::new(Id::Number(1), "x", &json!({"id": true})).unwrap();
+        let error = request.params::<CancelRequestParams>().unwrap_err();
+        assert_eq!(error.kind(), ProtocolErrorKind::InvalidParams);
+        assert!(matches!(
+            error.data,
+            ErrorData::InvalidParams { field: Some(ref field), .. } if field == "id"
+        ));
+    }
+
+    #[test]
+    fn malformed_notifications_are_never_answered() {
+        for text in [
+            r#"{"jsonrpc":"2.0","method":"$/cancelRequest","params":[3]}"#,
+            r#"{"jsonrpc":"2.0","method":"$/cancelRequest","params":{"id":3},"extra":1}"#,
+            r#"{"jsonrpc":"1.0","method":"$/cancelRequest","params":{"id":3}}"#,
+            r#"{"method":"$/cancelRequest"}"#,
+        ] {
+            let rejection = rejected(text);
+            assert!(rejection.is_notification(), "{text}");
+            assert_eq!(rejection.into_response(), None, "{text}");
+        }
+    }
+
+    #[test]
+    fn malformed_requests_and_frames_are_answered() {
+        for (text, id) in [
+            ("not json", None),
+            ("[]", None),
+            ("7", None),
+            (
+                r#"{"jsonrpc":"2.0","id":5,"method":"x","params":[1]}"#,
+                Some(Id::Number(5)),
+            ),
+            (r#"{"jsonrpc":"2.0","id":{},"method":"x"}"#, None),
+            (r#"{"jsonrpc":"2.0","method":7}"#, None),
+            (
+                r#"{"jsonrpc":"2.0","id":"r","result":1,"error":{}}"#,
+                Some(Id::String("r".to_owned())),
+            ),
+        ] {
+            let rejection = rejected(text);
+            assert!(!rejection.is_notification(), "{text}");
+            let response = rejection.into_response().expect("answered");
+            assert_eq!(response.id, id, "{text}");
+            assert!(response.result.is_err());
+        }
+    }
+
+    #[test]
+    fn responses_parse_strictly() {
+        let Message::Response(ok) =
+            parse(r#"{"jsonrpc":"2.0","id":1,"result":{"idleForMs":0}}"#).expect("response")
+        else {
+            panic!("expected a response");
+        };
+        assert_eq!(ok.id, Some(Id::Number(1)));
+        for bad in [
+            r#"{"jsonrpc":"2.0","id":null,"result":{}}"#,
+            r#"{"jsonrpc":"2.0","result":{}}"#,
+            r#"{"id":1,"result":{}}"#,
+            r#"{"jsonrpc":"2.0","id":1}"#,
+            r#"{"jsonrpc":"2.0","id":1,"result":{},"extra":true}"#,
+        ] {
+            assert!(parse(bad).is_err(), "{bad}");
+        }
+        let Message::Response(failed) = parse(
+            r#"{"jsonrpc":"2.0","id":null,"error":{"code":-32700,"message":"m","data":{"kind":"parseError"}}}"#,
+        )
+        .expect("error response") else {
+            panic!("expected a response");
+        };
+        assert_eq!(failed.id, None);
+        assert_eq!(
+            failed.result.unwrap_err().kind(),
+            ProtocolErrorKind::ParseError
+        );
+    }
+
+    #[test]
+    fn decode_tells_a_failed_call_from_a_broken_result() {
+        let failed = Response::failure(Some(Id::Number(1)), ProtocolError::internal("x"));
+        assert!(matches!(
+            failed.decode::<CancelRequestParams>(),
+            Err(ResponseError::Failed(_))
+        ));
+        let broken = Response::success(Id::Number(1), &json!({"id": [1]}));
+        assert!(matches!(
+            broken.decode::<CancelRequestParams>(),
+            Err(ResponseError::Undecodable(_))
+        ));
+    }
+}
diff --git a/crates/environment-protocol/src/lib.rs b/crates/environment-protocol/src/lib.rs
index 6882d6c69..a0cbca96f 100644
--- a/crates/environment-protocol/src/lib.rs
+++ b/crates/environment-protocol/src/lib.rs
@@ -1,12 +1,100 @@
-//! Protocol types for environment execution targets.
+//! Wire types of the environment protocol.
 //!
-//! This crate is intentionally transport-free. It defines the stable
-//! request/response records used by clients, provider controllers, and environment
-//! implementations.
+//! Three planes share one JSON-RPC 2.0 envelope ([`jsonrpc`]) and one error
+//! vocabulary ([`error`]):
+//!
+//! - the **data plane** ([`data`]): the runtime drives envd's filesystem,
+//!   processes and jobs; versioned by [`ENVD_PROTOCOL_VERSION`];
+//! - the **controller plane** ([`control`]): the runtime drives a provider
+//!   controller's targets; versioned by [`CONTROLLER_PROTOCOL_VERSION`];
+//! - the **registration channel** ([`registration`]): a daemon registers
+//!   with the gateway and is asked for reverse-dialed streams; versioned by
+//!   [`ENVD_PROTOCOL_VERSION`].
+//!
+//! [`manifest`] lists every method with its types. The crate is
+//! transport-free: it defines messages and the rules both sides follow,
+//! not sockets.
+//!
+//! # Conventions
+//!
+//! These rules hold for every plane; the frozen bootstrap surface
+//! ([`registration::ChallengeParams`], [`bootstrap`]) is the one exception
+//! to rule 13.
+//!
+//! 1. **Framing.** JSON-RPC 2.0 over WebSocket text frames; `initialize`
+//!    first on the data and controller planes; requests may be pipelined
+//!    and are matched by id.
+//! 2. **Errors.** Integer codes fixed by kind, `data.kind` authoritative,
+//!    typed fields instead of free-form details; [`error::ProtocolError`]
+//!    displays as `{kind}: {message}`.
+//! 3. **Methods.** `domain/verb[Object]` in lowerCamel with singular
+//!    domains, batch-ness in params, no plane prefix; every method is a
+//!    manifest entry; types are `<Verb><Object>Params` and
+//!    `<Verb><Object>Response`. One exception: methods of a family that
+//!    all act on one thing and answer its state share that state as their
+//!    response type, and share one params type when they name only that
+//!    thing (`TransferStatus` and `TransferOperationParams` for
+//!    `transfer/*`, `TargetResponse` for `target/*` and `ingress/*`).
+//! 4. **Fields.** camelCase; plural nouns for lists; `<qualifier><Noun>Count`
+//!    for counts, `<qualifier>Bytes` for sizes, `…Ms` for durations,
+//!    `…AtMs` for instants, `…Id`/`…Ids` for ids; payload bytes are always
+//!    `data`; one name per relation (`dependsOn`, `truncated`). Positions
+//!    name their unit: `nextOffset` (bytes of one file), `nextIndex`
+//!    (entries), `nextCursor` (opaque); an output page's `next` and `end`
+//!    are byte offsets into the handle's output stream.
+//! 5. **Optionality.** No `null` except JSON-RPC's own `id`; absent options
+//!    and empty collections are skipped; flags are `bool`, default false,
+//!    skipped when false; no `Option<bool>`, no empty-string sentinels.
+//! 6. **Numbers.** `u64` for bytes, offsets and durations; `u32` for counts,
+//!    indices and depths; `i64` for instants; no `usize` on the wire; every
+//!    value below 2^53.
+//! 7. **Unions.** Data unions are tagged `kind`; variant fields are renamed
+//!    only through enum-level `rename_all_fields`; operations are methods,
+//!    never tagged actions.
+//! 8. **Ids.** Validated newtypes ([`ids`]): the general grammar for
+//!    Lightspeed-assigned ids, the opaque rule for provider-assigned ids.
+//! 9. **Bytes.** Padded standard base64 for payloads; canonical lowercase
+//!    hex for fixed-size crypto values; [`paths::ContentDigest`] as
+//!    `sha256:<hex>`; opaque fingerprints carry their own prefix.
+//! 10. **Paths.** [`paths::EnvironmentPath`] (absolute) for endpoint paths,
+//!     [`paths::TreePath`] for relative tree entries.
+//! 11. **Limits.** Caller quotas are required per request; endpoint ceilings
+//!     are advertised in `initialize`; the message size is a protocol
+//!     constant ([`limits`]); out-of-range values are rejected, never
+//!     clamped. Ceilings are chosen so every response stays below the
+//!     message limit: payload ceilings fit after base64, lists have length
+//!     ceilings, walks stop at [`limits::MAX_RESULT_BYTES`], descriptive
+//!     strings are bounded. [`jsonrpc::Response::to_text`]'s
+//!     `payloadTooLarge` replacement is a defect backstop, not paging.
+//! 12. **Capabilities.** In each plane's handshake only, as instance facts
+//!     grouped by family; an absent family or fact is
+//!     `capabilityUnavailable`; an endpoint never silently ignores a
+//!     parameter.
+//! 13. **Decoding.** Strict on every plane: unknown members are rejected,
+//!     and defaults exist only for documented optional knobs.
+//! 14. **Docs and fixtures.** Doc comments use wire names; every params and
+//!     response type and every enum is documented; `fixtures/` holds one
+//!     params, response and error fixture per method.
+//! 15. **Boundaries.** Wire types are not persistence, workflow or
+//!     model-facing types; each layer maps at its own boundary.
 
+pub mod bootstrap;
+pub mod bytes;
+#[cfg(feature = "schema")]
+pub mod contract;
 pub mod control;
 pub mod data;
 pub mod error;
-pub mod gateway;
+pub mod handshake;
+pub mod ids;
+pub mod jsonrpc;
+pub mod limits;
+pub mod manifest;
+pub mod metadata;
+pub mod paths;
 pub mod registration;
-pub mod shared;
+pub mod routes;
+mod serde_util;
+mod version;
+
+pub use version::{CONTROLLER_PROTOCOL_VERSION, ENVD_PROTOCOL_VERSION};
diff --git a/crates/environment-protocol/src/limits.rs b/crates/environment-protocol/src/limits.rs
new file mode 100644
index 000000000..7f3767f10
--- /dev/null
+++ b/crates/environment-protocol/src/limits.rs
@@ -0,0 +1,80 @@
+//! Protocol constants: the limits every hop enforces without reading a
+//! handshake.
+//!
+//! Operational ceilings that a deployment configures (request concurrency,
+//! retention, wait, scan and transfer maxima) are not constants: the data
+//! plane advertises them in `initialize` as
+//! [`DataLimits`](crate::data::handshake::DataLimits). Caller quotas are
+//! required fields on each request, and a value above an advertised ceiling
+//! is refused with `invalidParams` naming the field, never clamped.
+
+/// Largest WebSocket message, and therefore frame, that any hop sends or
+/// accepts on any plane. Every reader and writer configures it explicitly,
+/// with the frame limit equal to the message limit. A sender that would
+/// exceed it fails with `payloadTooLarge` instead of sending.
+pub const MAX_MESSAGE_BYTES: u64 = 16 * 1024 * 1024;
+
+/// A peer waiting for a response sends a WebSocket ping at least this often
+/// while any request it sent is unanswered.
+pub const KEEPALIVE_INTERVAL_MS: u64 = 20_000;
+
+/// Intermediaries (gateways, relays, proxies) forward pings and pongs, count
+/// them as activity, and never close a connection for idleness sooner than
+/// this.
+pub const MIN_INTERMEDIARY_IDLE_MS: u64 = 60_000;
+
+/// Every data and controller server accepts at least this many requests in
+/// flight on one connection before it answers `busy`.
+pub const MIN_CONCURRENT_REQUESTS: u32 = 16;
+
+/// A registration-channel peer that receives no frame for this many
+/// `heartbeatIntervalMs` treats the connection as dead.
+pub const HEARTBEAT_MISSED_INTERVALS: u32 = 3;
+
+/// Longest [`EnvironmentPath`](crate::paths::EnvironmentPath) or
+/// [`TreePath`](crate::paths::TreePath) in bytes.
+pub const MAX_PATH_BYTES: u32 = 4096;
+
+/// Longest [`DescriptiveText`](crate::metadata::DescriptiveText) in bytes:
+/// a target's `message`, a template's `description`, a
+/// `registration/closed` message.
+pub const MAX_DESCRIPTIVE_TEXT_BYTES: u32 = 1024;
+
+/// Longest URL a peer advertises or reports (`routes.data`, an ingress
+/// `endpoint`), in bytes.
+pub const MAX_URL_BYTES: u32 = 2048;
+
+/// Longest error `message` in bytes. [`ProtocolError::new`] cuts longer
+/// messages on a character boundary; the message is never parsed.
+///
+/// [`ProtocolError::new`]: crate::error::ProtocolError::new
+pub const MAX_ERROR_MESSAGE_BYTES: u32 = 4096;
+
+/// Most chunks plus gaps in one `process/read` page, and across all entries
+/// of one `job/read` response. A page that reaches it ends early and loses
+/// nothing: `next` says where to continue.
+pub const MAX_PAGE_CHUNKS: u32 = 4096;
+
+/// Budget, in encoded bytes, for the variable part of a walk's result: the
+/// matches of `fs/searchText` and `fs/globFiles`, and the entries, skips
+/// and base64 content of all roots of one `fs/scan`. A walk stops (search
+/// and glob: `stopped: responseLimit`) or a scan root fails
+/// (`payloadTooLarge`) before its result would exceed it, so every response
+/// stays below [`MAX_MESSAGE_BYTES`] with room for its fixed members.
+pub const MAX_RESULT_BYTES: u64 = 12 * 1024 * 1024;
+
+/// Most skipped entries a scan root or transfer lists by path; the total is
+/// always counted in `skippedEntryCount`.
+pub const MAX_LISTED_SKIPS: u32 = 100;
+
+/// Most leftover processes a report lists; the rest are counted in
+/// `omittedProcessCount`.
+pub const MAX_LEFTOVER_PROCESSES: u32 = 64;
+
+/// Longest leftover `command` in bytes; longer command lines are cut on a
+/// character boundary.
+pub const MAX_LEFTOVER_COMMAND_BYTES: u32 = 1024;
+
+/// Longest field of an
+/// [`ImplementationInfo`](crate::handshake::ImplementationInfo) in bytes.
+pub const MAX_IMPLEMENTATION_FIELD_BYTES: u32 = 256;
diff --git a/crates/environment-protocol/src/manifest.rs b/crates/environment-protocol/src/manifest.rs
new file mode 100644
index 000000000..c894b09d9
--- /dev/null
+++ b/crates/environment-protocol/src/manifest.rs
@@ -0,0 +1,651 @@
+//! The method manifest: one table of every method on every plane, with its
+//! params and response types and the facts servers and clients act on.
+//!
+//! envd dispatch and idle classification, the client's typed calls, the
+//! contract export and the fixture tests all read this table, so a method
+//! exists exactly when it has an entry here. Each entry also has a marker
+//! type implementing [`RequestMethod`] or [`NotificationMethod`], which
+//! binds the method name to its Rust types:
+//!
+//! ```
+//! use environment_protocol::manifest::{ProcessRead, RequestMethod};
+//! assert_eq!(ProcessRead::NAME, "process/read");
+//! ```
+
+use serde::{Serialize, de::DeserializeOwned};
+use serde_json::Value;
+
+use crate::{
+    control::{
+        handshake::{ControllerInitializeParams, ControllerInitializeResponse},
+        ingress::{EnsureIngressParams, RemoveIngressParams},
+        target::{
+            AdoptTargetParams, CloseTargetParams, CreateTargetParams, GetTargetParams,
+            SetTargetPowerParams, TargetResponse,
+        },
+        template::{ListTemplatesParams, ListTemplatesResponse},
+    },
+    data::{
+        fs::{
+            CreateDirectoryParams, CreateDirectoryResponse, GetMetadataParams, GetMetadataResponse,
+            GlobFilesParams, GlobFilesResponse, ReadDirectoryParams, ReadDirectoryResponse,
+            ReadFileParams, ReadFileResponse, RemoveParams, RemoveResponse, RenameParams,
+            RenameResponse, SearchTextParams, SearchTextResponse, WriteFileParams,
+            WriteFileResponse,
+        },
+        handshake::{InitializeParams, InitializeResponse},
+        idle::{GetIdleParams, GetIdleResponse},
+        job::{
+            CancelJobsParams, CancelJobsResponse, ReadJobsParams, ReadJobsResponse,
+            StartJobsParams, StartJobsResponse,
+        },
+        process::{
+            ReadProcessParams, ReadProcessResponse, StartProcessParams, StartProcessResponse,
+            TerminateProcessParams, TerminateProcessResponse, WriteProcessParams,
+            WriteProcessResponse,
+        },
+        scan::{ScanParams, ScanResponse},
+        transfer::{
+            AppendTransferInventoryParams, BeginTransferParams, ListTransferMissingParams,
+            ListTransferMissingResponse, ReadTransferContentParams, ReadTransferContentResponse,
+            ReadTransferInventoryParams, ReadTransferInventoryResponse, TransferOperationParams,
+            TransferStatus, WriteTransferContentParams, WriteTransferContentResponse,
+        },
+    },
+    error::Capability,
+    handshake::Plane,
+    jsonrpc::CancelRequestParams,
+    registration::{
+        ChallengeParams, ClosedParams, GoodbyeParams, OpenStreamParams, OpenStreamResponse,
+        RegisterParams, RegisterResponse,
+    },
+};
+
+/// A request method: its name, plane and the types of its params and
+/// result.
+pub trait RequestMethod {
+    const NAME: &'static str;
+    const PLANE: Plane;
+    type Params: Serialize + DeserializeOwned + Send + Sync + 'static;
+    type Response: Serialize + DeserializeOwned + Send + Sync + 'static;
+}
+
+/// A notification method: never answered.
+pub trait NotificationMethod {
+    const NAME: &'static str;
+    const PLANE: Plane;
+    type Params: Serialize + DeserializeOwned + Send + Sync + 'static;
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub enum MessageKind {
+    Request,
+    Notification,
+}
+
+impl MessageKind {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Request => "request",
+            Self::Notification => "notification",
+        }
+    }
+}
+
+/// Who sends a method. The client is the peer that dialed: the runtime on
+/// the data and controller planes, the daemon on the registration channel.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub enum Direction {
+    ClientToServer,
+    ServerToClient,
+}
+
+impl Direction {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::ClientToServer => "clientToServer",
+            Self::ServerToClient => "serverToClient",
+        }
+    }
+}
+
+/// Method family: the method name's domain.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub enum Family {
+    Handshake,
+    Envelope,
+    Env,
+    Filesystem,
+    Transfer,
+    Process,
+    Job,
+    Template,
+    Target,
+    Ingress,
+    Registration,
+}
+
+impl Family {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Handshake => "handshake",
+            Self::Envelope => "envelope",
+            Self::Env => "env",
+            Self::Filesystem => "filesystem",
+            Self::Transfer => "transfer",
+            Self::Process => "process",
+            Self::Job => "job",
+            Self::Template => "template",
+            Self::Target => "target",
+            Self::Ingress => "ingress",
+            Self::Registration => "registration",
+        }
+    }
+}
+
+/// Whether a data-plane method counts toward the idle clock.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub enum Activity {
+    /// Real work: resets `idleForMs`.
+    Use,
+    /// Looking, not using: handshakes, idle reports, discovery scans.
+    Observation,
+}
+
+impl Activity {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Use => "use",
+            Self::Observation => "observation",
+        }
+    }
+}
+
+/// Schemas of one method, registered in a shared generator.
+#[cfg(feature = "schema")]
+pub struct MethodSchemas {
+    pub params: schemars::Schema,
+    pub response: Option<schemars::Schema>,
+}
+
+/// Re-encode a value through a wire type: decoding enforces the contract
+/// strictly, encoding yields the canonical form.
+pub type Normalize = fn(&Value) -> Result<Value, serde_json::Error>;
+
+/// One manifest entry.
+pub struct MethodSpec {
+    pub name: &'static str,
+    pub plane: Plane,
+    pub kind: MessageKind,
+    pub direction: Direction,
+    pub family: Family,
+    /// Data-plane methods only.
+    pub activity: Option<Activity>,
+    /// The capability a request needs; a server without it answers
+    /// `capabilityUnavailable` before doing anything.
+    pub capability: Option<Capability>,
+    /// `$/cancelRequest` aborts it: a read-only wait or walk. Every other
+    /// method runs to a consistent state.
+    pub abortable: bool,
+    pub params_type: &'static str,
+    /// Absent for notifications.
+    pub response_type: Option<&'static str>,
+    pub summary: &'static str,
+    pub normalize_params: Normalize,
+    pub normalize_response: Option<Normalize>,
+    #[cfg(feature = "schema")]
+    pub schemas: fn(&mut schemars::SchemaGenerator) -> MethodSchemas,
+}
+
+impl std::fmt::Debug for MethodSpec {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("MethodSpec")
+            .field("name", &self.name)
+            .field("plane", &self.plane)
+            .field("kind", &self.kind)
+            .finish_non_exhaustive()
+    }
+}
+
+fn normalize<T: Serialize + DeserializeOwned>(value: &Value) -> Result<Value, serde_json::Error> {
+    serde_json::to_value(T::deserialize(value)?)
+}
+
+macro_rules! requests {
+    ($(
+        $marker:ident = $name:literal {
+            plane: $plane:ident,
+            direction: $direction:ident,
+            family: $family:ident,
+            activity: $activity:expr,
+            capability: $capability:expr,
+            abortable: $abortable:expr,
+            params: $params:ty,
+            response: $response:ty,
+            summary: $summary:literal $(,)?
+        }
+    )+) => {
+        $(
+            #[doc = concat!("`", $name, "`: ", $summary)]
+            #[derive(Clone, Copy, Debug)]
+            pub struct $marker;
+
+            impl $marker {
+                pub const NAME: &'static str = $name;
+            }
+
+            impl RequestMethod for $marker {
+                const NAME: &'static str = $name;
+                const PLANE: Plane = Plane::$plane;
+                type Params = $params;
+                type Response = $response;
+            }
+        )+
+
+        /// Every request method.
+        pub static REQUESTS: &[MethodSpec] = &[
+            $(
+                MethodSpec {
+                    name: $name,
+                    plane: Plane::$plane,
+                    kind: MessageKind::Request,
+                    direction: Direction::$direction,
+                    family: Family::$family,
+                    activity: $activity,
+                    capability: $capability,
+                    abortable: $abortable,
+                    params_type: stringify!($params),
+                    response_type: Some(stringify!($response)),
+                    summary: $summary,
+                    normalize_params: normalize::<$params>,
+                    normalize_response: Some(normalize::<$response>),
+                    #[cfg(feature = "schema")]
+                    schemas: |generator| MethodSchemas {
+                        params: generator.subschema_for::<$params>(),
+                        response: Some(generator.subschema_for::<$response>()),
+                    },
+                },
+            )+
+        ];
+    };
+}
+
+macro_rules! notifications {
+    ($(
+        $marker:ident = $name:literal {
+            plane: $plane:ident,
+            direction: $direction:ident,
+            family: $family:ident,
+            activity: $activity:expr,
+            params: $params:ty,
+            summary: $summary:literal $(,)?
+        }
+    )+) => {
+        $(
+            #[doc = concat!("`", $name, "`: ", $summary)]
+            #[derive(Clone, Copy, Debug)]
+            pub struct $marker;
+
+            impl $marker {
+                pub const NAME: &'static str = $name;
+            }
+
+            impl NotificationMethod for $marker {
+                const NAME: &'static str = $name;
+                const PLANE: Plane = Plane::$plane;
+                type Params = $params;
+            }
+        )+
+
+        /// Every notification method.
+        pub static NOTIFICATIONS: &[MethodSpec] = &[
+            $(
+                MethodSpec {
+                    name: $name,
+                    plane: Plane::$plane,
+                    kind: MessageKind::Notification,
+                    direction: Direction::$direction,
+                    family: Family::$family,
+                    activity: $activity,
+                    capability: None,
+                    abortable: false,
+                    params_type: stringify!($params),
+                    response_type: None,
+                    summary: $summary,
+                    normalize_params: normalize::<$params>,
+                    normalize_response: None,
+                    #[cfg(feature = "schema")]
+                    schemas: |generator| MethodSchemas {
+                        params: generator.subschema_for::<$params>(),
+                        response: None,
+                    },
+                },
+            )+
+        ];
+    };
+}
+
+const USE: Option<Activity> = Some(Activity::Use);
+const OBSERVATION: Option<Activity> = Some(Activity::Observation);
+const FILESYSTEM: Option<Capability> = Some(Capability::Filesystem);
+const WRITE: Option<Capability> = Some(Capability::FilesystemWrite);
+const PROCESS: Option<Capability> = Some(Capability::Process);
+const JOB: Option<Capability> = Some(Capability::Job);
+
+requests! {
+    DataInitialize = "initialize" {
+        plane: Data, direction: ClientToServer, family: Handshake, activity: OBSERVATION,
+        capability: None, abortable: false,
+        params: InitializeParams, response: InitializeResponse,
+        summary: "Check the protocol version and read the daemon's instance id, capabilities and ceilings.",
+    }
+    EnvGetIdle = "env/getIdle" {
+        plane: Data, direction: ClientToServer, family: Env, activity: OBSERVATION,
+        capability: None, abortable: false,
+        params: GetIdleParams, response: GetIdleResponse,
+        summary: "Report how long the environment has been idle.",
+    }
+    FsReadFile = "fs/readFile" {
+        plane: Data, direction: ClientToServer, family: Filesystem, activity: USE,
+        capability: FILESYSTEM, abortable: false,
+        params: ReadFileParams, response: ReadFileResponse,
+        summary: "Read a byte range of a regular file.",
+    }
+    FsWriteFile = "fs/writeFile" {
+        plane: Data, direction: ClientToServer, family: Filesystem, activity: USE,
+        capability: WRITE, abortable: false,
+        params: WriteFileParams, response: WriteFileResponse,
+        summary: "Write a file atomically, optionally conditioned on its version.",
+    }
+    FsCreateDirectory = "fs/createDirectory" {
+        plane: Data, direction: ClientToServer, family: Filesystem, activity: USE,
+        capability: WRITE, abortable: false,
+        params: CreateDirectoryParams, response: CreateDirectoryResponse,
+        summary: "Create a directory.",
+    }
+    FsGetMetadata = "fs/getMetadata" {
+        plane: Data, direction: ClientToServer, family: Filesystem, activity: USE,
+        capability: FILESYSTEM, abortable: false,
+        params: GetMetadataParams, response: GetMetadataResponse,
+        summary: "Describe one entry.",
+    }
+    FsReadDirectory = "fs/readDirectory" {
+        plane: Data, direction: ClientToServer, family: Filesystem, activity: USE,
+        capability: FILESYSTEM, abortable: false,
+        params: ReadDirectoryParams, response: ReadDirectoryResponse,
+        summary: "List one page of a directory's entries.",
+    }
+    FsRemove = "fs/remove" {
+        plane: Data, direction: ClientToServer, family: Filesystem, activity: USE,
+        capability: WRITE, abortable: false,
+        params: RemoveParams, response: RemoveResponse,
+        summary: "Remove a file, symlink or directory.",
+    }
+    FsRename = "fs/rename" {
+        plane: Data, direction: ClientToServer, family: Filesystem, activity: USE,
+        capability: WRITE, abortable: false,
+        params: RenameParams, response: RenameResponse,
+        summary: "Rename an entry atomically.",
+    }
+    FsSearchText = "fs/searchText" {
+        plane: Data, direction: ClientToServer, family: Filesystem, activity: USE,
+        capability: FILESYSTEM, abortable: true,
+        params: SearchTextParams, response: SearchTextResponse,
+        summary: "Search file contents below a root with a regular expression.",
+    }
+    FsGlobFiles = "fs/globFiles" {
+        plane: Data, direction: ClientToServer, family: Filesystem, activity: USE,
+        capability: FILESYSTEM, abortable: true,
+        params: GlobFilesParams, response: GlobFilesResponse,
+        summary: "List files below a root that match patterns.",
+    }
+    FsScan = "fs/scan" {
+        plane: Data, direction: ClientToServer, family: Filesystem, activity: OBSERVATION,
+        capability: FILESYSTEM, abortable: true,
+        params: ScanParams, response: ScanResponse,
+        summary: "Observe small trees below several roots, each reported on its own.",
+    }
+    TransferBegin = "transfer/begin" {
+        plane: Data, direction: ClientToServer, family: Transfer, activity: USE,
+        capability: FILESYSTEM, abortable: false,
+        params: BeginTransferParams, response: TransferStatus,
+        summary: "Start or resume a transfer operation.",
+    }
+    TransferAdvance = "transfer/advance" {
+        plane: Data, direction: ClientToServer, family: Transfer, activity: USE,
+        capability: FILESYSTEM, abortable: false,
+        params: TransferOperationParams, response: TransferStatus,
+        summary: "Do a bounded step of scanning or staging work.",
+    }
+    TransferGetStatus = "transfer/getStatus" {
+        plane: Data, direction: ClientToServer, family: Transfer, activity: USE,
+        capability: FILESYSTEM, abortable: false,
+        params: TransferOperationParams, response: TransferStatus,
+        summary: "Read an operation's status or receipt.",
+    }
+    TransferReadInventory = "transfer/readInventory" {
+        plane: Data, direction: ClientToServer, family: Transfer, activity: USE,
+        capability: FILESYSTEM, abortable: false,
+        params: ReadTransferInventoryParams, response: ReadTransferInventoryResponse,
+        summary: "Read one page of a sealed inventory.",
+    }
+    TransferAppend = "transfer/append" {
+        plane: Data, direction: ClientToServer, family: Transfer, activity: USE,
+        capability: FILESYSTEM, abortable: false,
+        params: AppendTransferInventoryParams, response: TransferStatus,
+        summary: "Append incoming inventory entries.",
+    }
+    TransferListMissing = "transfer/listMissing" {
+        plane: Data, direction: ClientToServer, family: Transfer, activity: USE,
+        capability: FILESYSTEM, abortable: false,
+        params: ListTransferMissingParams, response: ListTransferMissingResponse,
+        summary: "List digests whose content the daemon still needs.",
+    }
+    TransferRead = "transfer/read" {
+        plane: Data, direction: ClientToServer, family: Transfer, activity: USE,
+        capability: FILESYSTEM, abortable: false,
+        params: ReadTransferContentParams, response: ReadTransferContentResponse,
+        summary: "Read captured content by digest.",
+    }
+    TransferWrite = "transfer/write" {
+        plane: Data, direction: ClientToServer, family: Transfer, activity: USE,
+        capability: FILESYSTEM, abortable: false,
+        params: WriteTransferContentParams, response: WriteTransferContentResponse,
+        summary: "Upload content for a missing digest.",
+    }
+    TransferCommit = "transfer/commit" {
+        plane: Data, direction: ClientToServer, family: Transfer, activity: USE,
+        capability: FILESYSTEM, abortable: false,
+        params: TransferOperationParams, response: TransferStatus,
+        summary: "Finish a ready operation: publish a staged tree, or release a capture.",
+    }
+    TransferAbort = "transfer/abort" {
+        plane: Data, direction: ClientToServer, family: Transfer, activity: USE,
+        capability: FILESYSTEM, abortable: false,
+        params: TransferOperationParams, response: TransferStatus,
+        summary: "Abandon an operation and discard its staging.",
+    }
+    ProcessStart = "process/start" {
+        plane: Data, direction: ClientToServer, family: Process, activity: USE,
+        capability: PROCESS, abortable: false,
+        params: StartProcessParams, response: StartProcessResponse,
+        summary: "Start a process under a caller-chosen handle.",
+    }
+    ProcessRead = "process/read" {
+        plane: Data, direction: ClientToServer, family: Process, activity: USE,
+        capability: PROCESS, abortable: true,
+        params: ReadProcessParams, response: ReadProcessResponse,
+        summary: "Wait for and read a page of a process's output and its state.",
+    }
+    ProcessWrite = "process/write" {
+        plane: Data, direction: ClientToServer, family: Process, activity: USE,
+        capability: PROCESS, abortable: false,
+        params: WriteProcessParams, response: WriteProcessResponse,
+        summary: "Queue bytes for a process's input pipe or PTY.",
+    }
+    ProcessTerminate = "process/terminate" {
+        plane: Data, direction: ClientToServer, family: Process, activity: USE,
+        capability: PROCESS, abortable: false,
+        params: TerminateProcessParams, response: TerminateProcessResponse,
+        summary: "Interrupt, terminate or kill a process's group.",
+    }
+    JobStart = "job/start" {
+        plane: Data, direction: ClientToServer, family: Job, activity: USE,
+        capability: JOB, abortable: false,
+        params: StartJobsParams, response: StartJobsResponse,
+        summary: "Start jobs, or replay an identical earlier start.",
+    }
+    JobRead = "job/read" {
+        plane: Data, direction: ClientToServer, family: Job, activity: OBSERVATION,
+        capability: JOB, abortable: true,
+        params: ReadJobsParams, response: ReadJobsResponse,
+        summary: "Wait for and read jobs' summaries and output pages.",
+    }
+    JobCancel = "job/cancel" {
+        plane: Data, direction: ClientToServer, family: Job, activity: USE,
+        capability: JOB, abortable: false,
+        params: CancelJobsParams, response: CancelJobsResponse,
+        summary: "Cancel jobs and optionally their dependents.",
+    }
+    ControllerInitialize = "initialize" {
+        plane: Controller, direction: ClientToServer, family: Handshake, activity: None,
+        capability: None, abortable: false,
+        params: ControllerInitializeParams, response: ControllerInitializeResponse,
+        summary: "Check the protocol version and read the controller's capabilities and routes.",
+    }
+    TemplateList = "template/list" {
+        plane: Controller, direction: ClientToServer, family: Template, activity: None,
+        capability: None, abortable: false,
+        params: ListTemplatesParams, response: ListTemplatesResponse,
+        summary: "List the templates a binding may create targets from.",
+    }
+    TargetCreate = "target/create" {
+        plane: Controller, direction: ClientToServer, family: Target, activity: None,
+        capability: None, abortable: false,
+        params: CreateTargetParams, response: TargetResponse,
+        summary: "Create the owner's target, or observe the one it has.",
+    }
+    TargetAdopt = "target/adopt" {
+        plane: Controller, direction: ClientToServer, family: Target, activity: None,
+        capability: Some(Capability::AdoptTarget), abortable: false,
+        params: AdoptTargetParams, response: TargetResponse,
+        summary: "Take ownership of an existing provider target.",
+    }
+    TargetGet = "target/get" {
+        plane: Controller, direction: ClientToServer, family: Target, activity: None,
+        capability: None, abortable: false,
+        params: GetTargetParams, response: TargetResponse,
+        summary: "Observe a target without changing it.",
+    }
+    TargetSetPower = "target/setPower" {
+        plane: Controller, direction: ClientToServer, family: Target, activity: None,
+        capability: None, abortable: false,
+        params: SetTargetPowerParams, response: TargetResponse,
+        summary: "Converge a target toward a power state.",
+    }
+    TargetClose = "target/close" {
+        plane: Controller, direction: ClientToServer, family: Target, activity: None,
+        capability: None, abortable: false,
+        params: CloseTargetParams, response: TargetResponse,
+        summary: "Destroy the owner's target and everything it holds.",
+    }
+    IngressEnsure = "ingress/ensure" {
+        plane: Controller, direction: ClientToServer, family: Ingress, activity: None,
+        capability: Some(Capability::Ingress), abortable: false,
+        params: EnsureIngressParams, response: TargetResponse,
+        summary: "Route public ingress to a target.",
+    }
+    IngressRemove = "ingress/remove" {
+        plane: Controller, direction: ClientToServer, family: Ingress, activity: None,
+        capability: Some(Capability::Ingress), abortable: false,
+        params: RemoveIngressParams, response: TargetResponse,
+        summary: "Stop routing public ingress to a target that stays.",
+    }
+    RegistrationRegister = "registration/register" {
+        plane: Registration, direction: ClientToServer, family: Registration, activity: None,
+        capability: None, abortable: false,
+        params: RegisterParams, response: RegisterResponse,
+        summary: "Prove the daemon identity and be admitted to its environment.",
+    }
+    RegistrationOpenStream = "registration/openStream" {
+        plane: Registration, direction: ServerToClient, family: Registration, activity: None,
+        capability: None, abortable: false,
+        params: OpenStreamParams, response: OpenStreamResponse,
+        summary: "Ask the daemon to dial one reverse stream.",
+    }
+}
+
+notifications! {
+    CancelRequest = "$/cancelRequest" {
+        plane: Data, direction: ClientToServer, family: Envelope, activity: OBSERVATION,
+        params: CancelRequestParams,
+        summary: "Abort a pending abortable request.",
+    }
+    RegistrationChallenge = "registration/challenge" {
+        plane: Registration, direction: ServerToClient, family: Registration, activity: None,
+        params: ChallengeParams,
+        summary: "The frozen first frame: the gateway's version and nonce.",
+    }
+    RegistrationGoodbye = "registration/goodbye" {
+        plane: Registration, direction: ClientToServer, family: Registration, activity: None,
+        params: GoodbyeParams,
+        summary: "The daemon is stopping deliberately.",
+    }
+    RegistrationClosed = "registration/closed" {
+        plane: Registration, direction: ServerToClient, family: Registration, activity: None,
+        params: ClosedParams,
+        summary: "The gateway ends the session for good.",
+    }
+}
+
+/// Every method of every plane: requests, then notifications.
+pub fn methods() -> impl Iterator<Item = &'static MethodSpec> {
+    REQUESTS.iter().chain(NOTIFICATIONS.iter())
+}
+
+/// Every method of one plane.
+pub fn plane_methods(plane: Plane) -> impl Iterator<Item = &'static MethodSpec> {
+    methods().filter(move |spec| spec.plane == plane)
+}
+
+/// The method of this name on this plane.
+pub fn find(plane: Plane, name: &str) -> Option<&'static MethodSpec> {
+    plane_methods(plane).find(|spec| spec.name == name)
+}
+
+#[cfg(test)]
+mod tests {
+    use std::collections::BTreeSet;
+
+    use super::*;
+
+    #[test]
+    fn method_names_are_unique_per_plane() {
+        let mut seen = BTreeSet::new();
+        for spec in methods() {
+            assert!(
+                seen.insert((spec.plane.as_str(), spec.name)),
+                "duplicate {} on {}",
+                spec.name,
+                spec.plane
+            );
+        }
+    }
+
+    #[test]
+    fn activity_is_declared_for_data_methods_only() {
+        for spec in methods() {
+            assert_eq!(
+                spec.activity.is_some(),
+                spec.plane == Plane::Data,
+                "{}",
+                spec.name
+            );
+        }
+        assert_eq!(
+            find(Plane::Data, FsScan::NAME).unwrap().activity,
+            Some(Activity::Observation)
+        );
+    }
+}
diff --git a/crates/environment-protocol/src/metadata.rs b/crates/environment-protocol/src/metadata.rs
new file mode 100644
index 000000000..918e60336
--- /dev/null
+++ b/crates/environment-protocol/src/metadata.rs
@@ -0,0 +1,400 @@
+//! Bounds on descriptive values: display names, correlation metadata and
+//! short human-readable texts.
+//!
+//! These values are descriptive: they never select, authenticate or gate.
+//! The same bounds apply wherever Lightspeed accepts them (daemon
+//! registration, provider observations and templates, environment and
+//! session metadata, profile documents), so a session and the environment it
+//! ran in accept the same keys. On the wire they are validated on decode by
+//! [`DisplayName`], [`Metadata`] and [`DescriptiveText`].
+
+use std::{collections::BTreeMap, fmt};
+
+use serde::{Deserialize, Deserializer, Serialize, Serializer, de::Error as _};
+use thiserror::Error;
+
+use crate::limits::MAX_DESCRIPTIVE_TEXT_BYTES;
+
+pub const MAX_DISPLAY_NAME_BYTES: u32 = 128;
+pub const MAX_METADATA_ENTRIES: u32 = 32;
+pub const MAX_METADATA_KEY_BYTES: u32 = 64;
+pub const MAX_METADATA_VALUE_BYTES: u32 = 256;
+/// Keys under this prefix are written by Lightspeed only.
+pub const RESERVED_METADATA_PREFIX: &str = "lightspeed.";
+
+/// JSON Schema pattern of [`DescriptiveText`]: no control characters except
+/// line feed and tab.
+pub const DESCRIPTIVE_TEXT_PATTERN: &str = "^[^\\u0000-\\u0008\\u000B-\\u001F\\u007F-\\u009F]+$";
+
+#[derive(Clone, Debug, PartialEq, Eq, Error)]
+pub enum MetadataError {
+    #[error("display name must be 1..={MAX_DISPLAY_NAME_BYTES} bytes without control characters")]
+    DisplayName,
+
+    #[error("metadata has more than {MAX_METADATA_ENTRIES} entries")]
+    TooManyEntries,
+
+    #[error("metadata key {key:?} must be 1..={MAX_METADATA_KEY_BYTES} bytes")]
+    KeyBytes { key: String },
+
+    #[error("metadata value for {key:?} must be 1..={MAX_METADATA_VALUE_BYTES} bytes")]
+    ValueBytes { key: String },
+
+    #[error("metadata entry {key:?} contains a control character")]
+    ControlCharacter { key: String },
+
+    #[error("metadata key {key:?} uses the reserved {RESERVED_METADATA_PREFIX} prefix")]
+    ReservedPrefix { key: String },
+
+    #[error(
+        "text must be 1..={MAX_DESCRIPTIVE_TEXT_BYTES} bytes without control characters other than line feed and tab"
+    )]
+    DescriptiveText,
+}
+
+pub fn validate_display_name(name: &str) -> Result<(), MetadataError> {
+    if name.is_empty()
+        || name.len() > MAX_DISPLAY_NAME_BYTES as usize
+        || name.chars().any(char::is_control)
+    {
+        return Err(MetadataError::DisplayName);
+    }
+    Ok(())
+}
+
+/// A metadata map a caller supplies: at most [`MAX_METADATA_ENTRIES`]
+/// bounded entries and no key under [`RESERVED_METADATA_PREFIX`].
+pub fn validate_caller_metadata(metadata: &BTreeMap<String, String>) -> Result<(), MetadataError> {
+    if metadata.len() > MAX_METADATA_ENTRIES as usize {
+        return Err(MetadataError::TooManyEntries);
+    }
+    for (key, value) in metadata {
+        validate_metadata_entry(key, value)?;
+        if key.starts_with(RESERVED_METADATA_PREFIX) {
+            return Err(MetadataError::ReservedPrefix { key: key.clone() });
+        }
+    }
+    Ok(())
+}
+
+/// A stored metadata map: caller keys obey [`validate_caller_metadata`]'s
+/// count, and Lightspeed's own reserved keys are bounded per entry but not
+/// counted.
+pub fn validate_stored_metadata(metadata: &BTreeMap<String, String>) -> Result<(), MetadataError> {
+    let caller_entries = metadata
+        .keys()
+        .filter(|key| !key.starts_with(RESERVED_METADATA_PREFIX))
+        .count();
+    if caller_entries > MAX_METADATA_ENTRIES as usize {
+        return Err(MetadataError::TooManyEntries);
+    }
+    for (key, value) in metadata {
+        validate_metadata_entry(key, value)?;
+    }
+    Ok(())
+}
+
+/// Key and value bytes and control characters of one entry.
+pub fn validate_metadata_entry(key: &str, value: &str) -> Result<(), MetadataError> {
+    if key.is_empty() || key.len() > MAX_METADATA_KEY_BYTES as usize {
+        return Err(MetadataError::KeyBytes {
+            key: key.to_owned(),
+        });
+    }
+    if value.is_empty() || value.len() > MAX_METADATA_VALUE_BYTES as usize {
+        return Err(MetadataError::ValueBytes {
+            key: key.to_owned(),
+        });
+    }
+    if key.chars().any(char::is_control) || value.chars().any(char::is_control) {
+        return Err(MetadataError::ControlCharacter {
+            key: key.to_owned(),
+        });
+    }
+    Ok(())
+}
+
+/// Check [`DescriptiveText`]'s rule.
+pub fn validate_descriptive_text(text: &str) -> Result<(), MetadataError> {
+    if text.is_empty()
+        || text.len() > MAX_DESCRIPTIVE_TEXT_BYTES as usize
+        || text.chars().any(is_disallowed_text_control)
+    {
+        return Err(MetadataError::DescriptiveText);
+    }
+    Ok(())
+}
+
+fn is_disallowed_text_control(character: char) -> bool {
+    character.is_control() && character != '\n' && character != '\t'
+}
+
+/// A display name: 1 to 128 bytes without control characters.
+#[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+pub struct DisplayName(
+    #[cfg_attr(
+        feature = "schema",
+        schemars(length(min = 1, max = 128), pattern(crate::ids::NO_CONTROL_PATTERN))
+    )]
+    String,
+);
+
+impl DisplayName {
+    pub fn new(name: impl Into<String>) -> Result<Self, MetadataError> {
+        let name = name.into();
+        validate_display_name(&name)?;
+        Ok(Self(name))
+    }
+
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+
+    pub fn into_string(self) -> String {
+        self.0
+    }
+}
+
+/// A short human-readable text: 1 to 1024 bytes without control characters
+/// other than line feed and tab. Never parsed.
+#[derive(Clone, Debug, PartialEq, Eq, Hash)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+pub struct DescriptiveText(
+    #[cfg_attr(
+        feature = "schema",
+        schemars(length(min = 1, max = 1024), pattern(DESCRIPTIVE_TEXT_PATTERN))
+    )]
+    String,
+);
+
+impl DescriptiveText {
+    pub fn new(text: impl Into<String>) -> Result<Self, MetadataError> {
+        let text = text.into();
+        validate_descriptive_text(&text)?;
+        Ok(Self(text))
+    }
+
+    /// Build a valid text from any string, for senders: disallowed control
+    /// characters become spaces and the text is cut to the bound on a
+    /// character boundary. `None` when nothing is left.
+    pub fn lossy(text: &str) -> Option<Self> {
+        let mut cleaned: String = text
+            .chars()
+            .map(|character| {
+                if is_disallowed_text_control(character) {
+                    ' '
+                } else {
+                    character
+                }
+            })
+            .collect();
+        let max = MAX_DESCRIPTIVE_TEXT_BYTES as usize;
+        if cleaned.len() > max {
+            let mut end = max;
+            while !cleaned.is_char_boundary(end) {
+                end -= 1;
+            }
+            cleaned.truncate(end);
+        }
+        (!cleaned.is_empty()).then_some(Self(cleaned))
+    }
+
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+
+    pub fn into_string(self) -> String {
+        self.0
+    }
+}
+
+macro_rules! text_impls {
+    ($name:ident, $error:ty) => {
+        impl fmt::Display for $name {
+            fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+                self.0.fmt(formatter)
+            }
+        }
+
+        impl TryFrom<String> for $name {
+            type Error = $error;
+
+            fn try_from(value: String) -> Result<Self, Self::Error> {
+                Self::new(value)
+            }
+        }
+
+        impl TryFrom<&str> for $name {
+            type Error = $error;
+
+            fn try_from(value: &str) -> Result<Self, Self::Error> {
+                Self::new(value)
+            }
+        }
+
+        impl Serialize for $name {
+            fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+                serializer.serialize_str(&self.0)
+            }
+        }
+
+        impl<'de> Deserialize<'de> for $name {
+            fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+                let value = String::deserialize(deserializer)?;
+                Self::new(value).map_err(D::Error::custom)
+            }
+        }
+    };
+}
+
+text_impls!(DisplayName, MetadataError);
+text_impls!(DescriptiveText, MetadataError);
+
+/// Caller-supplied metadata on the wire: at most [`MAX_METADATA_ENTRIES`]
+/// bounded entries and no key under [`RESERVED_METADATA_PREFIX`]
+/// ([`validate_caller_metadata`]), checked on decode. Serialized as a JSON
+/// object of strings.
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct Metadata(BTreeMap<String, String>);
+
+impl Metadata {
+    pub fn new(entries: BTreeMap<String, String>) -> Result<Self, MetadataError> {
+        validate_caller_metadata(&entries)?;
+        Ok(Self(entries))
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.0.is_empty()
+    }
+
+    pub fn len(&self) -> usize {
+        self.0.len()
+    }
+
+    pub fn get(&self, key: &str) -> Option<&str> {
+        self.0.get(key).map(String::as_str)
+    }
+
+    pub fn iter(&self) -> impl Iterator<Item = (&str, &str)> {
+        self.0
+            .iter()
+            .map(|(key, value)| (key.as_str(), value.as_str()))
+    }
+
+    pub fn as_map(&self) -> &BTreeMap<String, String> {
+        &self.0
+    }
+
+    pub fn into_map(self) -> BTreeMap<String, String> {
+        self.0
+    }
+}
+
+impl TryFrom<BTreeMap<String, String>> for Metadata {
+    type Error = MetadataError;
+
+    fn try_from(entries: BTreeMap<String, String>) -> Result<Self, Self::Error> {
+        Self::new(entries)
+    }
+}
+
+impl Serialize for Metadata {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        self.0.serialize(serializer)
+    }
+}
+
+impl<'de> Deserialize<'de> for Metadata {
+    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        let entries = BTreeMap::<String, String>::deserialize(deserializer)?;
+        Self::new(entries).map_err(D::Error::custom)
+    }
+}
+
+#[cfg(feature = "schema")]
+impl schemars::JsonSchema for Metadata {
+    fn schema_name() -> std::borrow::Cow<'static, str> {
+        "Metadata".into()
+    }
+
+    fn json_schema(_: &mut schemars::SchemaGenerator) -> schemars::Schema {
+        schemars::json_schema!({
+            "description": "Descriptive key-value metadata: at most 32 entries, keys 1 to 64 bytes outside the reserved `lightspeed.` prefix, values 1 to 256 bytes, no control characters.",
+            "type": "object",
+            "maxProperties": MAX_METADATA_ENTRIES,
+            "propertyNames": {
+                "minLength": 1,
+                "maxLength": MAX_METADATA_KEY_BYTES,
+                "pattern": crate::ids::NO_CONTROL_PATTERN,
+                "not": {"pattern": "^lightspeed\\."},
+            },
+            "additionalProperties": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": MAX_METADATA_VALUE_BYTES,
+                "pattern": crate::ids::NO_CONTROL_PATTERN,
+            },
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn caller_metadata_is_bounded_and_keeps_out_of_the_reserved_prefix() {
+        let mut metadata = BTreeMap::new();
+        metadata.insert("harbor.trialId".to_owned(), "trial-1".to_owned());
+        assert_eq!(validate_caller_metadata(&metadata), Ok(()));
+        metadata.insert("lightspeed.x".to_owned(), "y".to_owned());
+        assert_eq!(
+            validate_caller_metadata(&metadata),
+            Err(MetadataError::ReservedPrefix {
+                key: "lightspeed.x".to_owned()
+            })
+        );
+        assert_eq!(validate_stored_metadata(&metadata), Ok(()));
+        metadata.clear();
+        metadata.insert(
+            "k".to_owned(),
+            "a".repeat(MAX_METADATA_VALUE_BYTES as usize + 1),
+        );
+        assert!(matches!(
+            validate_caller_metadata(&metadata),
+            Err(MetadataError::ValueBytes { .. })
+        ));
+        assert_eq!(
+            validate_display_name("bad\nname"),
+            Err(MetadataError::DisplayName)
+        );
+        assert_eq!(validate_display_name(""), Err(MetadataError::DisplayName));
+    }
+
+    #[test]
+    fn stored_metadata_does_not_count_reserved_keys() {
+        let mut metadata: BTreeMap<String, String> = (0..MAX_METADATA_ENTRIES as usize)
+            .map(|index| (format!("k{index}"), "v".to_owned()))
+            .collect();
+        metadata.insert("lightspeed.envd.version".to_owned(), "0.5.0".to_owned());
+        assert_eq!(validate_stored_metadata(&metadata), Ok(()));
+        assert!(validate_caller_metadata(&metadata).is_err());
+    }
+
+    #[test]
+    fn wire_values_validate_on_decode() {
+        assert!(serde_json::from_str::<DisplayName>("\"runner 7\"").is_ok());
+        assert!(serde_json::from_str::<DisplayName>("\"\"").is_err());
+        assert!(serde_json::from_str::<Metadata>(r#"{"lightspeed.x": "y"}"#).is_err());
+        assert!(serde_json::from_str::<Metadata>(r#"{"k": "v"}"#).is_ok());
+        assert!(serde_json::from_str::<DescriptiveText>("\"line one\\nline two\"").is_ok());
+        assert!(serde_json::from_str::<DescriptiveText>("\"bell\\u0007\"").is_err());
+        let long = "x".repeat(MAX_DESCRIPTIVE_TEXT_BYTES as usize + 1);
+        assert!(DescriptiveText::new(long.clone()).is_err());
+        let cut = DescriptiveText::lossy(&format!("a\u{7}{long}")).unwrap();
+        assert_eq!(cut.as_str().len(), MAX_DESCRIPTIVE_TEXT_BYTES as usize);
+        assert!(cut.as_str().starts_with("a "));
+        assert!(DescriptiveText::lossy("").is_none());
+    }
+}
diff --git a/crates/environment-protocol/src/paths.rs b/crates/environment-protocol/src/paths.rs
new file mode 100644
index 000000000..27242259d
--- /dev/null
+++ b/crates/environment-protocol/src/paths.rs
@@ -0,0 +1,475 @@
+//! Path and digest values.
+//!
+//! **Path model.** A wire path is an absolute path in the environment's own
+//! filesystem namespace, the one its processes see, not a path relative to
+//! the daemon's filesystem root: with the root narrowed to `/workspace`,
+//! `/workspace/src` names that directory and `/etc` is outside the root.
+//! The root is not a chroot.
+//!
+//! **Confinement.** One rule for every data-plane method, a command's `cwd`
+//! included. A path that is not the filesystem root or below it is refused
+//! with `permissionDenied` (reason `outsideRoot`). Otherwise the daemon
+//! strips the root prefix and resolves the remaining segments one by one
+//! beneath the root's directory descriptor. A symlink met on the way is
+//! followed only while its target stays inside the root; a link that leaves
+//! it is refused the same way. No method addresses the daemon's state
+//! directory: a path that names it, lies inside it or (for removes, renames,
+//! writes and captures) contains it is refused with `permissionDenied`
+//! (reason `daemonState`), and walks prune it.
+//!
+//! **Names.** Paths are UTF-8 and POSIX: `/` is the only separator, and
+//! every other character except NUL, the backslash included, may appear in
+//! a name. An entry whose name is not UTF-8 is skipped and counted wherever
+//! a method enumerates entries, never returned lossily.
+
+use std::{fmt, str::FromStr};
+
+use serde::{Deserialize, Deserializer, Serialize, Serializer, de::Error as _};
+use thiserror::Error;
+
+use crate::{bytes::decode_hex_array, limits::MAX_PATH_BYTES};
+
+#[derive(Clone, Debug, PartialEq, Eq, Error)]
+pub enum PathError {
+    #[error("path is empty")]
+    Empty,
+
+    #[error("path is {actual} bytes; the maximum is {max}")]
+    TooLong { actual: usize, max: u32 },
+
+    #[error("path must be absolute: {path}")]
+    NotAbsolute { path: String },
+
+    #[error("path must be relative: {path}")]
+    NotRelative { path: String },
+
+    #[error("path contains a NUL byte")]
+    NulByte,
+
+    #[error("path has an empty, '.' or '..' segment or a trailing '/': {path}")]
+    NotNormalized { path: String },
+
+    #[error("entry name must be one segment other than '.' and '..': {name}")]
+    NotAName { name: String },
+}
+
+/// JSON Schema pattern of [`EnvironmentPath`].
+pub const ENVIRONMENT_PATH_PATTERN: &str = "^(/|(/(?!\\.\\.?(/|$))[^/\\u0000]+)+)$";
+/// JSON Schema pattern of [`TreePath`].
+pub const TREE_PATH_PATTERN: &str =
+    "^(\\.|(?!\\.\\.?(/|$))[^/\\u0000]+(/(?!\\.\\.?(/|$))[^/\\u0000]+)*)$";
+/// JSON Schema pattern of [`EntryName`].
+pub const ENTRY_NAME_PATTERN: &str = "^(?!\\.\\.?$)[^/\\u0000]+$";
+/// JSON Schema pattern of [`ContentDigest`].
+pub const CONTENT_DIGEST_PATTERN: &str = "^sha256:[0-9a-f]{64}$";
+
+/// An absolute, normalized POSIX path in the environment: `/`, or `/` and
+/// one or more segments joined by `/`. Empty, `.` and `..` segments and a
+/// trailing `/` are rejected, never rewritten. At most 4096 bytes.
+/// `defaultCwd`, `homeDirectory`, every `cwd` and every path parameter use
+/// this type; see the module's path model and confinement rule.
+#[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+pub struct EnvironmentPath(
+    #[cfg_attr(
+        feature = "schema",
+        schemars(length(min = 1, max = 4096), pattern(ENVIRONMENT_PATH_PATTERN))
+    )]
+    String,
+);
+
+impl EnvironmentPath {
+    pub fn new(path: impl Into<String>) -> Result<Self, PathError> {
+        let path = path.into();
+        check_common(&path)?;
+        if !path.starts_with('/') {
+            return Err(PathError::NotAbsolute { path });
+        }
+        if path != "/" && !segments_normalized(&path[1..]) {
+            return Err(PathError::NotNormalized { path });
+        }
+        Ok(Self(path))
+    }
+
+    pub fn root() -> Self {
+        Self("/".to_owned())
+    }
+
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+
+    pub fn is_root(&self) -> bool {
+        self.0 == "/"
+    }
+
+    /// Path segments below the root.
+    pub fn segments(&self) -> impl Iterator<Item = &str> {
+        self.0.split('/').filter(|segment| !segment.is_empty())
+    }
+
+    pub fn file_name(&self) -> Option<&str> {
+        self.segments().last()
+    }
+
+    pub fn parent(&self) -> Option<Self> {
+        if self.is_root() {
+            return None;
+        }
+        let index = self.0.rfind('/').unwrap_or(0);
+        Some(if index == 0 {
+            Self::root()
+        } else {
+            Self(self.0[..index].to_owned())
+        })
+    }
+
+    /// Append a tree path. An empty tree path returns `self`.
+    pub fn join(&self, tree: &TreePath) -> Result<Self, PathError> {
+        if tree.is_root() {
+            return Ok(self.clone());
+        }
+        let joined = if self.is_root() {
+            format!("/{}", tree.as_str())
+        } else {
+            format!("{}/{}", self.0, tree.as_str())
+        };
+        Self::new(joined)
+    }
+
+    /// True when `self` is `base` or lies below it.
+    pub fn starts_with(&self, base: &EnvironmentPath) -> bool {
+        base.is_root()
+            || self.0 == base.0
+            || (self.0.starts_with(&base.0) && self.0.as_bytes().get(base.0.len()) == Some(&b'/'))
+    }
+
+    /// The tree path of `self` below `base`, or `None` when it is outside.
+    pub fn relative_to(&self, base: &EnvironmentPath) -> Option<TreePath> {
+        if !self.starts_with(base) {
+            return None;
+        }
+        let rest = if base.is_root() {
+            &self.0[1..]
+        } else {
+            self.0[base.0.len()..].trim_start_matches('/')
+        };
+        Some(if rest.is_empty() {
+            TreePath::root()
+        } else {
+            TreePath(rest.to_owned())
+        })
+    }
+}
+
+/// A relative, normalized path below a selected root: segments joined by
+/// `/`, without empty, `.` or `..` segments. The single segment `.` names
+/// the root itself. At most 4096 bytes. Used for scan, inventory and
+/// transfer entries.
+#[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+pub struct TreePath(
+    #[cfg_attr(
+        feature = "schema",
+        schemars(length(min = 1, max = 4096), pattern(TREE_PATH_PATTERN))
+    )]
+    String,
+);
+
+impl Default for TreePath {
+    fn default() -> Self {
+        Self::root()
+    }
+}
+
+impl TreePath {
+    /// Wire spelling of the root.
+    pub const ROOT: &'static str = ".";
+
+    pub fn new(path: impl Into<String>) -> Result<Self, PathError> {
+        let path = path.into();
+        if path == Self::ROOT {
+            return Ok(Self(path));
+        }
+        check_common(&path)?;
+        if path.starts_with('/') {
+            return Err(PathError::NotRelative { path });
+        }
+        if !segments_normalized(&path) {
+            return Err(PathError::NotNormalized { path });
+        }
+        Ok(Self(path))
+    }
+
+    pub fn root() -> Self {
+        Self(Self::ROOT.to_owned())
+    }
+
+    /// The wire spelling: `.` for the root.
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+
+    pub fn is_root(&self) -> bool {
+        self.0 == Self::ROOT
+    }
+
+    /// Segments below the root; none for the root itself.
+    pub fn segments(&self) -> impl Iterator<Item = &str> {
+        let path = if self.is_root() { "" } else { self.0.as_str() };
+        path.split('/').filter(|segment| !segment.is_empty())
+    }
+
+    /// Number of segments: the root has depth 0, its direct children 1.
+    pub fn depth(&self) -> u32 {
+        self.segments().count() as u32
+    }
+
+    pub fn join(&self, segment: &str) -> Result<Self, PathError> {
+        if self.is_root() {
+            Self::new(segment)
+        } else {
+            Self::new(format!("{}/{segment}", self.0))
+        }
+    }
+}
+
+fn check_common(path: &str) -> Result<(), PathError> {
+    if path.is_empty() {
+        return Err(PathError::Empty);
+    }
+    if path.len() > MAX_PATH_BYTES as usize {
+        return Err(PathError::TooLong {
+            actual: path.len(),
+            max: MAX_PATH_BYTES,
+        });
+    }
+    if path.contains('\0') {
+        return Err(PathError::NulByte);
+    }
+    Ok(())
+}
+
+fn segments_normalized(path: &str) -> bool {
+    path.split('/')
+        .all(|segment| !matches!(segment, "" | "." | ".."))
+}
+
+macro_rules! path_string_impls {
+    ($name:ident) => {
+        impl fmt::Display for $name {
+            fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+                self.0.fmt(formatter)
+            }
+        }
+
+        impl FromStr for $name {
+            type Err = PathError;
+
+            fn from_str(value: &str) -> Result<Self, Self::Err> {
+                Self::new(value)
+            }
+        }
+
+        impl TryFrom<&str> for $name {
+            type Error = PathError;
+
+            fn try_from(value: &str) -> Result<Self, Self::Error> {
+                Self::new(value)
+            }
+        }
+
+        impl TryFrom<String> for $name {
+            type Error = PathError;
+
+            fn try_from(value: String) -> Result<Self, Self::Error> {
+                Self::new(value)
+            }
+        }
+
+        impl Serialize for $name {
+            fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+                serializer.serialize_str(&self.0)
+            }
+        }
+
+        impl<'de> Deserialize<'de> for $name {
+            fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+                let value = String::deserialize(deserializer)?;
+                Self::new(value).map_err(D::Error::custom)
+            }
+        }
+    };
+}
+
+/// One entry name: a single path segment, neither `.` nor `..`, without
+/// `/` or NUL, at most 4096 bytes. `fs/readDirectory` entries use it.
+#[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+pub struct EntryName(
+    #[cfg_attr(
+        feature = "schema",
+        schemars(length(min = 1, max = 4096), pattern(ENTRY_NAME_PATTERN))
+    )]
+    String,
+);
+
+impl EntryName {
+    pub fn new(name: impl Into<String>) -> Result<Self, PathError> {
+        let name = name.into();
+        check_common(&name)?;
+        if name.contains('/') || name == "." || name == ".." {
+            return Err(PathError::NotAName { name });
+        }
+        Ok(Self(name))
+    }
+
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+path_string_impls!(EnvironmentPath);
+path_string_impls!(TreePath);
+path_string_impls!(EntryName);
+
+/// `sha256:` followed by 64 lowercase hex digits: the digest of a file's raw
+/// bytes, independent of its path and mode.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+pub struct ContentDigest(
+    #[cfg_attr(
+        feature = "schema",
+        schemars(with = "String", pattern(CONTENT_DIGEST_PATTERN))
+    )]
+    [u8; 32],
+);
+
+#[derive(Clone, Debug, PartialEq, Eq, Error)]
+#[error("content digest must be sha256: followed by 64 lowercase hex digits")]
+pub struct DigestError;
+
+impl ContentDigest {
+    pub const PREFIX: &'static str = "sha256:";
+
+    pub fn from_sha256(bytes: [u8; 32]) -> Self {
+        Self(bytes)
+    }
+
+    pub fn sha256(&self) -> &[u8; 32] {
+        &self.0
+    }
+
+    /// The 64 lowercase hex digits without the prefix.
+    pub fn hex(&self) -> String {
+        crate::bytes::encode_hex(&self.0)
+    }
+
+    pub fn parse(value: &str) -> Result<Self, DigestError> {
+        let hex = value.strip_prefix(Self::PREFIX).ok_or(DigestError)?;
+        decode_hex_array::<32>(hex)
+            .map(Self)
+            .map_err(|_| DigestError)
+    }
+}
+
+impl fmt::Display for ContentDigest {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(formatter, "{}{}", Self::PREFIX, self.hex())
+    }
+}
+
+impl FromStr for ContentDigest {
+    type Err = DigestError;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        Self::parse(value)
+    }
+}
+
+impl Serialize for ContentDigest {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        serializer.collect_str(self)
+    }
+}
+
+impl<'de> Deserialize<'de> for ContentDigest {
+    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        let value = String::deserialize(deserializer)?;
+        Self::parse(&value).map_err(D::Error::custom)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn environment_paths_are_rejected_rather_than_rewritten() {
+        for good in ["/", "/workspace", "/a/b.c/d"] {
+            assert_eq!(EnvironmentPath::new(good).unwrap().as_str(), good);
+        }
+        for bad in ["", "relative", "/../etc", "/a/./b", "/a//b", "/a/", "/a\0b"] {
+            assert!(EnvironmentPath::new(bad).is_err(), "{bad:?}");
+        }
+    }
+
+    #[test]
+    fn backslashes_are_ordinary_name_bytes() {
+        assert_eq!(
+            EnvironmentPath::new("/a\\b").unwrap().file_name(),
+            Some("a\\b")
+        );
+        assert!(EntryName::new("a\\b").is_ok());
+        assert!(TreePath::new("dir/a\\b").is_ok());
+    }
+
+    #[test]
+    fn tree_paths_are_relative_and_normalized() {
+        let root = TreePath::new(".").unwrap();
+        assert!(root.is_root());
+        assert_eq!(root.depth(), 0);
+        assert_eq!(serde_json::to_value(TreePath::root()).unwrap(), ".");
+        assert_eq!(TreePath::root().join("a").unwrap().as_str(), "a");
+        assert_eq!(TreePath::new("a/b").unwrap().depth(), 2);
+        for bad in ["", "/a", "a/../b", "a//b", "./a", "a/", "a/."] {
+            assert!(TreePath::new(bad).is_err(), "{bad:?}");
+        }
+    }
+
+    #[test]
+    fn entry_names_are_one_segment() {
+        assert!(EntryName::new("notes.md").is_ok());
+        for bad in ["", ".", "..", "a/b"] {
+            assert!(EntryName::new(bad).is_err(), "{bad:?}");
+        }
+    }
+
+    #[test]
+    fn paths_join_and_relativize() {
+        let base = EnvironmentPath::new("/workspace").unwrap();
+        let tree = TreePath::new("src/lib.rs").unwrap();
+        let joined = base.join(&tree).unwrap();
+        assert_eq!(joined.as_str(), "/workspace/src/lib.rs");
+        assert_eq!(joined.relative_to(&base), Some(tree));
+        assert_eq!(base.relative_to(&base), Some(TreePath::root()));
+        assert_eq!(base.join(&TreePath::root()).unwrap(), base);
+        assert!(
+            EnvironmentPath::new("/workspace2")
+                .unwrap()
+                .relative_to(&base)
+                .is_none()
+        );
+        assert_eq!(joined.parent().unwrap().as_str(), "/workspace/src");
+        assert_eq!(base.parent().unwrap(), EnvironmentPath::root());
+    }
+
+    #[test]
+    fn digests_are_canonical_lowercase() {
+        let text = format!("sha256:{}", "ab".repeat(32));
+        let digest: ContentDigest = serde_json::from_value(serde_json::json!(text)).unwrap();
+        assert_eq!(digest.to_string(), text);
+        assert!(ContentDigest::parse(&format!("sha256:{}", "AB".repeat(32))).is_err());
+        assert!(ContentDigest::parse(&"ab".repeat(32)).is_err());
+    }
+}
diff --git a/crates/environment-protocol/src/registration.rs b/crates/environment-protocol/src/registration.rs
index 8ee167db9..ff7adf296 100644
--- a/crates/environment-protocol/src/registration.rs
+++ b/crates/environment-protocol/src/registration.rs
@@ -1,306 +1,471 @@
-//! Key-based outbound registration: the control-channel messages an `envd`
-//! exchanges with the environment gateway after dialing out.
+//! The registration channel: the control connection an envd dials to the
+//! gateway at [`CONNECT_PATH`](crate::routes::CONNECT_PATH) to register and
+//! to be asked for reverse-dialed streams. It runs the shared JSON-RPC
+//! envelope; the daemon is the client (it dialed), the gateway the server.
+//! Both directions carry requests and notifications. It never carries
+//! data-plane messages: every stream is a separate socket the daemon dials
+//! on request.
 //!
-//! The control connection carries registration, liveness, and requests to
-//! open data connections. It never carries environment-protocol frames:
-//! every worker route is served by a separate, reverse-dialed data socket
-//! that runs the ordinary data protocol.
+//! Sequence:
+//!
+//! 1. Gateway → daemon, notification [`registration/challenge`]: always the
+//!    first frame (see [`ChallengeParams`]).
+//! 2. Daemon → gateway, request `registration/register`: signs the nonce
+//!    bound to the gateway origin. The response carries the receipt and
+//!    `heartbeatIntervalMs`; an error refuses admission and the gateway
+//!    closes the socket.
+//! 3. Gateway → daemon, request `registration/openStream`, any number of
+//!    times: the daemon dials
+//!    [`gateway_stream_url`](crate::routes::gateway_stream_url) with the
+//!    token and answers once the stream socket is upgraded, or with an
+//!    error.
+//! 4. Daemon → gateway, notification `registration/goodbye` before a
+//!    deliberate shutdown; gateway → daemon, notification
+//!    `registration/closed` before the gateway ends the session for good.
+//!
+//! **Frame rules.**
+//!
+//! - Text frames only. The gateway answers a binary frame as the envelope
+//!   says (`invalidRequest`, null id); the daemon closes the connection on
+//!   one.
+//! - An unknown request is answered with `methodNotFound`; an unknown
+//!   notification is ignored and logged. A response to an id the receiver
+//!   never sent is ignored and logged.
+//! - Before admission the gateway accepts only `registration/register`:
+//!   any other request is answered with `notInitialized` and the gateway
+//!   closes the connection; any notification closes it without an answer.
+//!   A `registration/register` after admission is `invalidRequest`, and
+//!   the connection stays open.
+//! - Before it has the register response, the daemon accepts only the
+//!   challenge (first) and that response. Any request or other
+//!   notification from the gateway in that window is a protocol violation:
+//!   the daemon closes the connection and reconnects with backoff. The
+//!   gateway sends `registration/openStream` and `registration/closed` only
+//!   after it sent the register response.
+//!
+//! **Liveness.** The gateway pings every `heartbeatIntervalMs`; the daemon
+//! answers. A peer that receives no frame for
+//! [`HEARTBEAT_MISSED_INTERVALS`](crate::limits::HEARTBEAT_MISSED_INTERVALS)
+//! intervals treats the connection as dead and closes it; the daemon then
+//! reconnects with backoff.
+//!
+//! [`registration/challenge`]: CHALLENGE_METHOD
 
 use std::collections::BTreeMap;
 
 use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use sha2::{Digest as _, Sha256};
+use thiserror::Error;
 
-use crate::shared::{CURRENT_PROTOCOL_VERSION, ImplementationInfo, SecretString};
-
-/// Public route an `envd` dials to register and hold its control connection.
-pub const CONNECT_PATH: &str = "/environment-gateway/connect";
-
-/// Public route an `envd` dials, presenting a one-time token as a bearer
-/// header, to serve one worker route.
-pub const DATA_PATH: &str = "/environment-gateway/data";
+use crate::{
+    bytes::{SecretString, hex_value},
+    error::ProtocolError,
+    handshake::ImplementationInfo,
+    ids::{ControlConnectionId, DaemonId, EnvironmentId, IncarnationId},
+    jsonrpc::decode_params,
+    metadata::{
+        DescriptiveText, DisplayName, Metadata, validate_caller_metadata, validate_display_name,
+    },
+    routes::CanonicalOrigin,
+};
 
-/// Domain separator the daemon signs together with the gateway's nonce, so a
-/// signature over a nonce can never be confused with any other Ed25519 use
-/// of the same key.
-pub const REGISTRATION_SIGNATURE_DOMAIN: &[u8] = b"lightspeed-envd-registration/v1";
+/// Method name of the frozen first frame.
+pub const CHALLENGE_METHOD: &str = "registration/challenge";
 
-/// Bytes of the gateway's per-connection challenge nonce.
-pub const REGISTRATION_NONCE_BYTES: usize = 32;
+/// Domain separator of the signed registration message. Its suffix numbers
+/// the signed-message layout, not the protocol.
+pub const REGISTRATION_SIGNATURE_DOMAIN: &[u8] = b"lightspeed-envd-registration/v2";
 
-pub const MAX_DISPLAY_NAME_BYTES: usize = 128;
-pub const MAX_METADATA_ENTRIES: usize = 32;
-pub const MAX_METADATA_KEY_BYTES: usize = 64;
-pub const MAX_METADATA_VALUE_BYTES: usize = 256;
-/// Metadata keys under this prefix are written by Lightspeed only.
-pub const RESERVED_METADATA_PREFIX: &str = "lightspeed.";
+hex_value!(
+    /// `nonce`: the gateway's 32 random bytes for one control connection.
+    ChallengeNonce,
+    32,
+    "^[0-9a-f]{64}$"
+);
+hex_value!(
+    /// `daemonPublicKey`: a raw Ed25519 public key.
+    DaemonPublicKey,
+    32,
+    "^[0-9a-f]{64}$"
+);
+hex_value!(
+    /// `signature`: an Ed25519 signature over
+    /// [`signed_registration_message`].
+    Ed25519Signature,
+    64,
+    "^[0-9a-f]{128}$"
+);
 
-/// Messages the gateway sends on the control connection.
+/// `registration/challenge` params.
+///
+/// **Frozen.** This is the first frame of every control connection and the
+/// only frame a daemon of any version must parse to learn it is stale: it
+/// only ever gains fields, is decoded tolerantly (unknown members are
+/// ignored), and a receiver reads `protocolVersion` with
+/// [`challenge_protocol_version`] before decoding anything else. The whole
+/// frame is
+/// `{"jsonrpc":"2.0","method":"registration/challenge","params":{"protocolVersion":N,"nonce":"<64 hex>"}}`.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(
-    tag = "type",
-    rename_all = "camelCase",
-    rename_all_fields = "camelCase"
-)]
-pub enum GatewayControlMessage {
-    /// First frame after the upgrade. `nonce` is hex; the daemon signs
-    /// [`signed_registration_message`] of its raw bytes.
-    Challenge {
-        protocol_version: u32,
-        nonce: String,
-    },
-    /// The daemon is admitted; the receipt identifies the environment it
-    /// now serves. `heartbeatIntervalMs` tells the daemon how often the
-    /// gateway pings.
-    Accepted {
-        #[serde(flatten)]
-        receipt: RegistrationReceipt,
-        heartbeat_interval_ms: u64,
-    },
-    /// Registration failed. The gateway closes the socket after this frame.
-    Rejected {
-        code: RegistrationRejectionCode,
-        message: String,
-    },
-    /// A worker route is waiting: dial `dataUrl` with `token` as a bearer
-    /// header and run the data protocol on that socket.
-    OpenData {
-        token: SecretString,
-        data_url: String,
-    },
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase")]
+pub struct ChallengeParams {
+    /// The gateway's `ENVD_PROTOCOL_VERSION`.
+    pub protocol_version: u32,
+    pub nonce: ChallengeNonce,
 }
 
-/// Messages the daemon sends on the control connection.
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(
-    tag = "type",
-    rename_all = "camelCase",
-    rename_all_fields = "camelCase"
-)]
-pub enum DaemonControlMessage {
-    Register(RegisterParams),
+#[derive(Clone, Debug, PartialEq, Eq, Error)]
+pub enum BootstrapError {
+    #[error("first frame is not JSON")]
+    NotJson,
+    #[error("first frame is not a registration/challenge notification")]
+    NotChallenge,
+    #[error("challenge carries no integer protocolVersion")]
+    NoVersion,
+}
+
+/// Read the gateway's protocol version from a first frame without
+/// decoding anything else, so a daemon of any version can tell it is stale
+/// before it fails on fields it does not know.
+pub fn challenge_protocol_version(frame: &str) -> Result<u32, BootstrapError> {
+    let value: Value = serde_json::from_str(frame).map_err(|_| BootstrapError::NotJson)?;
+    if value.get("method").and_then(Value::as_str) != Some(CHALLENGE_METHOD) {
+        return Err(BootstrapError::NotChallenge);
+    }
+    value
+        .get("params")
+        .and_then(|params| params.get("protocolVersion"))
+        .and_then(Value::as_u64)
+        .and_then(|version| u32::try_from(version).ok())
+        .ok_or(BootstrapError::NoVersion)
 }
 
+/// `registration/register` params. `registrationKey`, `displayName` and
+/// `metadata` are read only at a daemon identity's first admission; a
+/// daemon sends the key until it is admitted once and never afterwards.
+///
+/// The gateway decodes them with [`RegisterParams::decode`]: build facts,
+/// a display name or metadata out of bounds refuse admission with
+/// `invalidRequest`; anything else that does not decode is
+/// `invalidParams`.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct RegisterParams {
-    #[serde(default = "default_protocol_version")]
+    /// The daemon's `ENVD_PROTOCOL_VERSION`.
     pub protocol_version: u32,
-    /// Required for a first-seen daemon public key; ignored for a known one.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub registration_key: Option<SecretString>,
-    /// Lowercase hex of the raw 32-byte Ed25519 public key.
-    pub daemon_public_key: String,
-    /// Lowercase hex of the 64-byte Ed25519 signature over
-    /// [`signed_registration_message`] of the challenge nonce.
-    pub signature: String,
+    pub daemon_public_key: DaemonPublicKey,
+    /// Over [`signed_registration_message`] of the challenge nonce and the
+    /// canonical origin of the URL the daemon dialed.
+    pub signature: Ed25519Signature,
     #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub display_name: Option<String>,
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    pub metadata: BTreeMap<String, String>,
+    pub display_name: Option<DisplayName>,
+    #[serde(default, skip_serializing_if = "Metadata::is_empty")]
+    pub metadata: Metadata,
     pub implementation: ImplementationInfo,
 }
 
+impl RegisterParams {
+    /// Decode `registration/register` params the way the gateway answers
+    /// them. Descriptive values that have the right shape but break their
+    /// bounds (`implementation`, `displayName`, `metadata`) are
+    /// `invalidRequest`, naming the member in the message: admission is
+    /// refused, never granted with the value dropped. Every other decode
+    /// failure is `invalidParams` naming the field.
+    pub fn decode(params: &Value) -> Result<Self, ProtocolError> {
+        if let Some(implementation) = params.get("implementation")
+            && let Some(error) = ImplementationInfo::bounds_violation(implementation)
+        {
+            return Err(ProtocolError::invalid_request(format!(
+                "implementation.{error}"
+            )));
+        }
+        if let Some(Value::String(name)) = params.get("displayName")
+            && let Err(error) = validate_display_name(name)
+        {
+            return Err(ProtocolError::invalid_request(format!(
+                "displayName: {error}"
+            )));
+        }
+        if let Some(metadata) = params.get("metadata")
+            && let Ok(entries) = BTreeMap::<String, String>::deserialize(metadata)
+            && let Err(error) = validate_caller_metadata(&entries)
+        {
+            return Err(ProtocolError::invalid_request(format!("metadata: {error}")));
+        }
+        decode_params(params)
+    }
+}
+
+/// `registration/register` response: the daemon is admitted.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct RegisterResponse {
+    pub receipt: RegistrationReceipt,
+    /// How often the gateway pings; see the liveness rule.
+    pub heartbeat_interval_ms: u64,
+}
+
 /// What the daemon learns about the environment it serves. Written to the
-/// receipt file and logged once; contains no secret material.
+/// receipt file as is; contains no secret.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct RegistrationReceipt {
-    pub environment_id: String,
-    pub incarnation_id: String,
-    pub daemon_id: String,
-    pub connection_id: String,
-    pub identity_mode: String,
+    pub environment_id: EnvironmentId,
+    pub incarnation_id: IncarnationId,
+    pub daemon_id: DaemonId,
+    /// The gateway's id for this control connection.
+    pub control_connection_id: ControlConnectionId,
+    pub identity_mode: RegistrationIdentityMode,
+    pub admission: Admission,
 }
 
-/// Why a registration was refused. Terminal codes mean the daemon must not
-/// retry with the same identity and configuration; the others are transient.
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+/// Registration-key policy for the daemon's environment.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
 #[serde(rename_all = "camelCase")]
-pub enum RegistrationRejectionCode {
-    UnsupportedProtocol,
-    InvalidRequest,
-    InvalidSignature,
-    InvalidRegistrationKey,
-    RegistrationKeyRevoked,
-    RegistrationKeyExpired,
-    /// A daemon identity the gateway has never seen presented no key.
-    UnknownDaemon,
-    /// The identity's environment was closed; the identity is spent.
-    EnvironmentClosed,
-    /// The identity is already bound in another universe.
-    IdentityInUse,
-    CapacityExhausted,
-    RateLimited,
-    Unavailable,
+pub enum RegistrationIdentityMode {
+    /// The environment outlives disconnects.
+    Persistent,
+    /// The environment closes after it stays disconnected past its grace.
+    Ephemeral,
 }
 
-impl RegistrationRejectionCode {
-    pub fn is_terminal(self) -> bool {
-        !matches!(
-            self,
-            Self::CapacityExhausted | Self::RateLimited | Self::Unavailable
-        )
-    }
+/// Whether this admission created the environment or rejoined it.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase")]
+pub enum Admission {
+    /// First admission of this daemon identity: a new environment.
+    Created,
+    /// A known identity reconnected to its environment.
+    Reconnected,
 }
 
-/// The bytes a daemon signs for one challenge.
-pub fn signed_registration_message(nonce: &[u8]) -> Vec<u8> {
-    let mut message = Vec::with_capacity(REGISTRATION_SIGNATURE_DOMAIN.len() + nonce.len());
-    message.extend_from_slice(REGISTRATION_SIGNATURE_DOMAIN);
-    message.extend_from_slice(nonce);
-    message
+/// `registration/openStream` params: the gateway asks the daemon to dial
+/// one stream.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct OpenStreamParams {
+    /// One-time bearer token for the stream dial; short-lived.
+    pub token: SecretString,
+    pub stream: StreamSpec,
 }
 
-/// Check the bounds on caller-supplied correlation metadata and display
-/// name. Metadata is descriptive only; it never selects or authenticates.
-/// Caller-supplied maps may not use the reserved prefix; stored records
-/// may, because Lightspeed annotates them itself (see
-/// [`validate_metadata_bounds`]). Sessions share this validator so a
-/// session and the environment it ran in accept the same keys.
-pub fn validate_registration_metadata(
-    display_name: Option<&str>,
-    metadata: &BTreeMap<String, String>,
-) -> Result<(), String> {
-    if let Some(name) = display_name
-        && (name.is_empty()
-            || name.len() > MAX_DISPLAY_NAME_BYTES
-            || name.chars().any(char::is_control))
-    {
-        return Err(format!(
-            "display name must be 1..={MAX_DISPLAY_NAME_BYTES} bytes without control characters"
-        ));
-    }
-    validate_metadata_bounds(metadata)?;
-    if let Some(key) = metadata
-        .keys()
-        .find(|key| key.starts_with(RESERVED_METADATA_PREFIX))
-    {
-        return Err(format!(
-            "metadata key {key:?} uses the reserved {RESERVED_METADATA_PREFIX} prefix"
-        ));
-    }
-    Ok(())
+/// What the dialed stream carries.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(
+    tag = "kind",
+    rename_all = "camelCase",
+    rename_all_fields = "camelCase",
+    deny_unknown_fields
+)]
+pub enum StreamSpec {
+    /// The data plane, served by the daemon as on any data connection.
+    DataProtocol {},
 }
 
-/// Entry count, key and value bytes, and control characters: the bounds
-/// every stored metadata map obeys, including the keys under the reserved
-/// prefix that Lightspeed writes itself.
-pub fn validate_metadata_bounds(metadata: &BTreeMap<String, String>) -> Result<(), String> {
-    if metadata.len() > MAX_METADATA_ENTRIES {
-        return Err(format!(
-            "metadata has more than {MAX_METADATA_ENTRIES} entries"
-        ));
-    }
-    for (key, value) in metadata {
-        validate_metadata_entry(key, value)?;
-    }
-    Ok(())
+/// `registration/openStream` response, sent once the stream socket is
+/// upgraded and served. A failed dial answers `unavailable`; the gateway
+/// fails the waiting route at once.
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct OpenStreamResponse {}
+
+/// `registration/goodbye` params: the daemon is stopping deliberately.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct GoodbyeParams {
+    pub reason: GoodbyeReason,
 }
 
-/// Key and value bytes and control characters for one entry, independent of
-/// how many entries a map may hold.
-pub fn validate_metadata_entry(key: &str, value: &str) -> Result<(), String> {
-    if key.is_empty() || key.len() > MAX_METADATA_KEY_BYTES || key.chars().any(char::is_control) {
-        return Err(format!(
-            "metadata key {key:?} must be 1..={MAX_METADATA_KEY_BYTES} bytes without control characters"
-        ));
-    }
-    if value.is_empty()
-        || value.len() > MAX_METADATA_VALUE_BYTES
-        || value.chars().any(char::is_control)
-    {
-        return Err(format!(
-            "metadata value for {key:?} must be 1..={MAX_METADATA_VALUE_BYTES} bytes without control characters"
-        ));
-    }
-    Ok(())
+/// Why the daemon is leaving.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase")]
+pub enum GoodbyeReason {
+    /// `SIGTERM` or `SIGINT`.
+    Shutdown,
 }
 
-pub fn encode_hex(bytes: &[u8]) -> String {
-    use std::fmt::Write as _;
-    let mut hex = String::with_capacity(bytes.len() * 2);
-    for byte in bytes {
-        let _ = write!(hex, "{byte:02x}");
-    }
-    hex
+/// `registration/closed` params: the gateway ends the session for good and
+/// closes the socket after this frame. The daemon exits and does not
+/// reconnect.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ClosedParams {
+    pub reason: ClosedReason,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub message: Option<DescriptiveText>,
 }
 
-pub fn decode_hex(value: &str) -> Option<Vec<u8>> {
-    if !value.len().is_multiple_of(2) {
-        return None;
-    }
-    (0..value.len())
-        .step_by(2)
-        .map(|index| u8::from_str_radix(&value[index..index + 2], 16).ok())
-        .collect()
+/// Why the gateway ended the session for good.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase")]
+pub enum ClosedReason {
+    /// Another process with this daemon identity connected; the newest
+    /// connection wins and this daemon exits with its own status naming the
+    /// shared identity.
+    Superseded,
+    /// The identity's environment was closed; the identity is spent.
+    EnvironmentClosed,
 }
 
-fn default_protocol_version() -> u32 {
-    CURRENT_PROTOCOL_VERSION
+/// The bytes a daemon signs for one challenge:
+/// [`REGISTRATION_SIGNATURE_DOMAIN`] ‖ nonce ‖ sha256(origin), where
+/// `origin` is the [`canonical_origin`](crate::routes::canonical_origin) of
+/// the gateway URL the daemon dialed; the gateway verifies against the
+/// canonical origin of each public URL it is configured with. Binding the
+/// origin stops a gateway the daemon was pointed at from relaying another
+/// gateway's nonce.
+pub fn signed_registration_message(nonce: &ChallengeNonce, origin: &CanonicalOrigin) -> Vec<u8> {
+    let origin_hash = Sha256::digest(origin.as_str().as_bytes());
+    let mut message = Vec::with_capacity(REGISTRATION_SIGNATURE_DOMAIN.len() + 32 + 32);
+    message.extend_from_slice(REGISTRATION_SIGNATURE_DOMAIN);
+    message.extend_from_slice(nonce.as_bytes());
+    message.extend_from_slice(&origin_hash);
+    message
 }
 
 #[cfg(test)]
 mod tests {
+    use serde_json::json;
+
     use super::*;
 
     #[test]
-    fn control_messages_are_tagged_and_flatten_the_receipt() {
-        let accepted = GatewayControlMessage::Accepted {
-            receipt: RegistrationReceipt {
-                environment_id: "environment_a".to_owned(),
-                incarnation_id: "incarnation_a".to_owned(),
-                daemon_id: "daemon_a".to_owned(),
-                connection_id: "connection_a".to_owned(),
-                identity_mode: "ephemeral".to_owned(),
-            },
-            heartbeat_interval_ms: 30_000,
+    fn the_challenge_version_is_read_before_anything_else() {
+        let future = json!({
+            "jsonrpc": "2.0",
+            "method": CHALLENGE_METHOD,
+            "params": {"protocolVersion": 9, "nonce": 7, "newField": {"x": 1}},
+        });
+        assert_eq!(challenge_protocol_version(&future.to_string()), Ok(9));
+        assert_eq!(
+            challenge_protocol_version("{\"method\":\"other\"}"),
+            Err(BootstrapError::NotChallenge)
+        );
+        assert_eq!(
+            challenge_protocol_version("garbage"),
+            Err(BootstrapError::NotJson)
+        );
+    }
+
+    #[test]
+    fn the_challenge_decodes_tolerantly() {
+        let params: ChallengeParams = serde_json::from_value(json!({
+            "protocolVersion": 3,
+            "nonce": "00".repeat(32),
+            "addedLater": true,
+        }))
+        .unwrap();
+        assert_eq!(params.protocol_version, 3);
+    }
+
+    #[test]
+    fn crypto_values_are_canonical_hex() {
+        let key = format!("\"{}\"", "ab".repeat(32));
+        assert!(serde_json::from_str::<DaemonPublicKey>(&key).is_ok());
+        for bad in [
+            format!("\"{}\"", "AB".repeat(32)),
+            format!("\"{}\"", "ab".repeat(31)),
+            format!("\"{}\u{e9}\"", "a".repeat(62)),
+        ] {
+            assert!(
+                serde_json::from_str::<DaemonPublicKey>(&bad).is_err(),
+                "{bad}"
+            );
+        }
+    }
+
+    #[test]
+    fn the_signed_message_binds_the_origin() {
+        let nonce = ChallengeNonce::from_bytes([9; 32]);
+        let origin = |url| crate::routes::canonical_origin(url).unwrap();
+        let first = signed_registration_message(&nonce, &origin("wss://a.example/x"));
+        let second = signed_registration_message(&nonce, &origin("wss://b.example"));
+        assert_eq!(
+            first,
+            signed_registration_message(&nonce, &origin("WSS://A.example:443/y"))
+        );
+        assert!(first.starts_with(REGISTRATION_SIGNATURE_DOMAIN));
+        assert_ne!(first, second);
+        assert_eq!(first.len(), REGISTRATION_SIGNATURE_DOMAIN.len() + 64);
+    }
+
+    #[test]
+    fn stream_tokens_are_redacted_in_debug_output() {
+        let params = OpenStreamParams {
+            token: SecretString::new("secret-token"),
+            stream: StreamSpec::DataProtocol {},
         };
-        let json = serde_json::to_value(&accepted).expect("serialize");
-        assert_eq!(json["type"], "accepted");
-        assert_eq!(json["environmentId"], "environment_a");
-        assert_eq!(json["heartbeatIntervalMs"], 30_000);
-        let parsed: GatewayControlMessage = serde_json::from_value(json).expect("parse");
-        assert_eq!(parsed, accepted);
-
-        let open = serde_json::json!({"type": "openData", "token": "t", "dataUrl": "wss://g/d"});
-        let parsed: GatewayControlMessage = serde_json::from_value(open).expect("parse");
-        assert!(matches!(parsed, GatewayControlMessage::OpenData { .. }));
-        assert!(!format!("{parsed:?}").contains("\"t\""));
+        assert!(!format!("{params:?}").contains("secret-token"));
+        assert_eq!(
+            serde_json::to_value(&params).unwrap(),
+            json!({"token": "secret-token", "stream": {"kind": "dataProtocol"}})
+        );
+    }
+
+    fn register_params() -> Value {
+        json!({
+            "protocolVersion": 3,
+            "daemonPublicKey": "ab".repeat(32),
+            "signature": "cd".repeat(64),
+            "implementation": {"name": "lightspeed-envd", "version": "0.5.0"},
+        })
     }
 
     #[test]
-    fn rejection_codes_split_terminal_from_retryable() {
-        assert!(RegistrationRejectionCode::EnvironmentClosed.is_terminal());
-        assert!(RegistrationRejectionCode::InvalidSignature.is_terminal());
-        assert!(RegistrationRejectionCode::RegistrationKeyRevoked.is_terminal());
-        assert!(!RegistrationRejectionCode::CapacityExhausted.is_terminal());
-        assert!(!RegistrationRejectionCode::RateLimited.is_terminal());
-        assert!(!RegistrationRejectionCode::Unavailable.is_terminal());
+    fn out_of_bounds_descriptive_values_refuse_admission() {
+        assert!(RegisterParams::decode(&register_params()).is_ok());
+        let mut implementation = register_params();
+        implementation["implementation"]["version"] = json!("v\u{7}");
+        let mut name = register_params();
+        name["displayName"] = json!("x".repeat(200));
+        let mut metadata = register_params();
+        metadata["metadata"] = json!({"lightspeed.daemon": "spoofed"});
+        for params in [implementation, name, metadata] {
+            assert_eq!(
+                RegisterParams::decode(&params).unwrap_err().kind(),
+                crate::error::ProtocolErrorKind::InvalidRequest,
+                "{params}"
+            );
+        }
     }
 
     #[test]
-    fn metadata_bounds_and_reserved_prefix_are_enforced() {
-        let mut metadata = BTreeMap::new();
-        metadata.insert("harbor.trialId".to_owned(), "trial-1".to_owned());
-        assert!(validate_registration_metadata(Some("worker"), &metadata).is_ok());
-        metadata.insert("lightspeed.x".to_owned(), "y".to_owned());
-        assert!(validate_registration_metadata(None, &metadata).is_err());
-        metadata.clear();
-        metadata.insert("k".to_owned(), "a".repeat(MAX_METADATA_VALUE_BYTES + 1));
-        assert!(validate_registration_metadata(None, &metadata).is_err());
-        assert!(validate_registration_metadata(Some("bad\nname"), &BTreeMap::new()).is_err());
-        assert!(validate_registration_metadata(Some(""), &BTreeMap::new()).is_err());
+    fn other_register_decode_failures_are_invalid_params() {
+        let mut key = register_params();
+        key["daemonPublicKey"] = json!("AB".repeat(32));
+        let mut extra = register_params();
+        extra["dataUrl"] = json!("wss://elsewhere");
+        let mut shape = register_params();
+        shape["implementation"] = json!({"name": 7});
+        for params in [key, extra, shape] {
+            assert_eq!(
+                RegisterParams::decode(&params).unwrap_err().kind(),
+                crate::error::ProtocolErrorKind::InvalidParams,
+                "{params}"
+            );
+        }
     }
 
     #[test]
-    fn hex_round_trips_and_signed_message_is_domain_separated() {
-        let bytes = [0u8, 1, 0xab, 0xff];
-        assert_eq!(encode_hex(&bytes), "0001abff");
-        assert_eq!(decode_hex("0001abff").as_deref(), Some(&bytes[..]));
-        assert_eq!(decode_hex("abc"), None);
-        assert_eq!(decode_hex("zz"), None);
-        let message = signed_registration_message(&[9u8; 4]);
-        assert!(message.starts_with(REGISTRATION_SIGNATURE_DOMAIN));
-        assert!(message.ends_with(&[9u8; 4]));
+    fn fieldless_stream_kinds_reject_unknown_members() {
+        assert!(serde_json::from_value::<StreamSpec>(json!({"kind": "dataProtocol"})).is_ok());
+        assert!(
+            serde_json::from_value::<StreamSpec>(json!({"kind": "dataProtocol", "x": 1})).is_err()
+        );
     }
 }
diff --git a/crates/environment-protocol/src/routes.rs b/crates/environment-protocol/src/routes.rs
new file mode 100644
index 000000000..70bef6aff
--- /dev/null
+++ b/crates/environment-protocol/src/routes.rs
@@ -0,0 +1,464 @@
+//! Public route paths and the URL rules both peers must compute the same
+//! way.
+
+use std::fmt;
+
+use serde::{Deserialize, Deserializer, Serialize, Serializer, de::Error as _};
+use thiserror::Error;
+
+use crate::{control::target::TargetOwner, ids::ProviderTargetId, limits::MAX_URL_BYTES};
+
+/// Gateway route an envd dials to register and hold its control connection.
+/// A gateway may be served under a path prefix (`wss://host/ls` plus this
+/// path); the daemon is configured with the full connect URL.
+pub const CONNECT_PATH: &str = "/environment-gateway/connect";
+
+/// Gateway route an envd dials, with a stream token as a bearer header, to
+/// serve one reverse-dialed stream. Always derived from the connect URL by
+/// replacing its [`CONNECT_PATH`] suffix ([`gateway_stream_url`]), so it
+/// shares the connect URL's origin and path prefix.
+pub const DATA_PATH: &str = "/environment-gateway/data";
+
+/// Gateway route serving the envd discovery document.
+pub const DISCOVERY_PATH: &str = "/.well-known/lightspeed-envd";
+
+/// JSON Schema pattern of [`DataRouteBase`].
+pub const DATA_ROUTE_BASE_PATTERN: &str = "^wss?://[^/?#@\\s]+(/[^?#\\s]*[^/?#\\s])?$";
+
+/// JSON Schema pattern of [`PublicUrl`].
+pub const PUBLIC_URL_PATTERN: &str = "^https?://[^/?#@\\s]+([/?][^#\\s]*)?$";
+
+#[derive(Clone, Debug, PartialEq, Eq, Error)]
+pub enum UrlError {
+    #[error("URL has an unsupported scheme: {0}")]
+    Scheme(String),
+
+    #[error("URL has no host: {0}")]
+    NoHost(String),
+
+    #[error("URL must not carry user information: {0}")]
+    UserInfo(String),
+
+    #[error("URL has an invalid port: {0}")]
+    Port(String),
+
+    #[error("URL must not carry a query or fragment: {0}")]
+    QueryOrFragment(String),
+
+    #[error("URL must not end with '/': {0}")]
+    TrailingSlash(String),
+
+    #[error("URL is longer than {MAX_URL_BYTES} bytes")]
+    TooLong,
+
+    #[error("URL contains whitespace or a control character: {0}")]
+    Character(String),
+
+    #[error("gateway connect URL path must end with {CONNECT_PATH}: {0}")]
+    NotConnectPath(String),
+
+    #[error("a controller reached over wss must advertise a wss data route: {0}")]
+    Downgrade(String),
+}
+
+/// The parts of an absolute URL the protocol's rules look at.
+struct UrlParts<'a> {
+    /// As written.
+    scheme: &'a str,
+    host: &'a str,
+    port: Option<u16>,
+    path: &'a str,
+    query: Option<&'a str>,
+    fragment: Option<&'a str>,
+}
+
+fn split_url(url: &str) -> Result<UrlParts<'_>, UrlError> {
+    if url.len() > MAX_URL_BYTES as usize {
+        return Err(UrlError::TooLong);
+    }
+    if url
+        .chars()
+        .any(|character| character.is_whitespace() || character.is_control())
+    {
+        return Err(UrlError::Character(url.to_owned()));
+    }
+    let (scheme, rest) = url
+        .split_once("://")
+        .ok_or_else(|| UrlError::Scheme(url.to_owned()))?;
+    let (rest, fragment) = match rest.split_once('#') {
+        Some((rest, fragment)) => (rest, Some(fragment)),
+        None => (rest, None),
+    };
+    let (rest, query) = match rest.split_once('?') {
+        Some((rest, query)) => (rest, Some(query)),
+        None => (rest, None),
+    };
+    let (authority, path) = match rest.find('/') {
+        Some(index) => rest.split_at(index),
+        None => (rest, ""),
+    };
+    if authority.contains('@') {
+        return Err(UrlError::UserInfo(url.to_owned()));
+    }
+    let (host, port) = split_host_port(authority).ok_or_else(|| UrlError::Port(url.to_owned()))?;
+    if host.is_empty() || host == "[]" {
+        return Err(UrlError::NoHost(url.to_owned()));
+    }
+    Ok(UrlParts {
+        scheme,
+        host,
+        port,
+        path,
+        query,
+        fragment,
+    })
+}
+
+/// The canonical WebSocket origin of a URL, the value the registration
+/// signature binds. Only [`canonical_origin`] builds one, so the daemon
+/// (from the URL it dialed) and the gateway (from its configured public
+/// URLs) cannot pass a raw URL where an origin belongs.
+#[derive(Clone, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
+pub struct CanonicalOrigin(String);
+
+impl CanonicalOrigin {
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+
+    /// True for a `wss` origin.
+    pub fn is_secure(&self) -> bool {
+        self.0.starts_with("wss://")
+    }
+}
+
+impl fmt::Display for CanonicalOrigin {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(&self.0)
+    }
+}
+
+/// The canonical WebSocket origin of a URL: `ws` or `wss` (`http` maps to
+/// `ws`, `https` to `wss`, any case), `://`, the lowercase host, and
+/// `:port` only when it is not the scheme's default. Path, query and
+/// fragment are dropped.
+pub fn canonical_origin(url: &str) -> Result<CanonicalOrigin, UrlError> {
+    let parts = split_url(url)?;
+    let (scheme, default_port) = match parts.scheme.to_ascii_lowercase().as_str() {
+        "ws" | "http" => ("ws", 80),
+        "wss" | "https" => ("wss", 443),
+        _ => return Err(UrlError::Scheme(url.to_owned())),
+    };
+    let host = parts.host.to_ascii_lowercase();
+    Ok(CanonicalOrigin(match parts.port {
+        Some(port) if port != default_port => format!("{scheme}://{host}:{port}"),
+        _ => format!("{scheme}://{host}"),
+    }))
+}
+
+/// The URL a daemon dials for a reverse-dialed stream: the canonical origin
+/// of its configured gateway connect URL, the connect URL's path with its
+/// [`CONNECT_PATH`] suffix replaced by [`DATA_PATH`]. A path prefix in front
+/// of the gateway routes is kept. The gateway never names this URL, so a
+/// stream can never be pointed at another host or a weaker scheme than the
+/// control connection. A connect URL whose path does not end with
+/// [`CONNECT_PATH`], or that carries a query or fragment, is refused.
+pub fn gateway_stream_url(gateway_connect_url: &str) -> Result<String, UrlError> {
+    let parts = split_url(gateway_connect_url)?;
+    if parts.query.is_some() || parts.fragment.is_some() {
+        return Err(UrlError::QueryOrFragment(gateway_connect_url.to_owned()));
+    }
+    let prefix = parts
+        .path
+        .strip_suffix(CONNECT_PATH)
+        .ok_or_else(|| UrlError::NotConnectPath(gateway_connect_url.to_owned()))?;
+    Ok(format!(
+        "{}{prefix}{DATA_PATH}",
+        canonical_origin(gateway_connect_url)?
+    ))
+}
+
+/// `routes.data` of a controller's `initialize`: the absolute `ws://` or
+/// `wss://` base URL of the provider's data routes, validated on decode and
+/// never rewritten. Lowercase scheme, a host and optional port, an optional
+/// path that does not end with `/`, no user information, query or
+/// fragment, at most 2048 bytes. A controller reached over `wss` must
+/// advertise a `wss` base, so the provider credential never travels in
+/// cleartext; the runtime checks it with
+/// [`DataRouteBase::check_for_controller`].
+#[derive(Clone, Debug, PartialEq, Eq, Hash)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+pub struct DataRouteBase(
+    #[cfg_attr(
+        feature = "schema",
+        schemars(length(min = 1, max = 2048), pattern(DATA_ROUTE_BASE_PATTERN))
+    )]
+    String,
+);
+
+impl DataRouteBase {
+    pub fn new(value: impl Into<String>) -> Result<Self, UrlError> {
+        let value = value.into();
+        let parts = split_url(&value)?;
+        if !matches!(parts.scheme, "ws" | "wss") {
+            return Err(UrlError::Scheme(value));
+        }
+        if parts.query.is_some() || parts.fragment.is_some() {
+            return Err(UrlError::QueryOrFragment(value));
+        }
+        if parts.path.ends_with('/') {
+            return Err(UrlError::TrailingSlash(value));
+        }
+        Ok(Self(value))
+    }
+
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+
+    pub fn is_secure(&self) -> bool {
+        self.0.starts_with("wss://")
+    }
+
+    /// The downgrade rule: a controller whose URL is `wss` (or `https`) may
+    /// only advertise a `wss` base. The runtime checks it at every
+    /// `initialize` before it records the base.
+    pub fn check_for_controller(&self, controller_url: &str) -> Result<(), UrlError> {
+        if canonical_origin(controller_url)?.is_secure() && !self.is_secure() {
+            return Err(UrlError::Downgrade(self.0.clone()));
+        }
+        Ok(())
+    }
+}
+
+/// A public `http://` or `https://` URL a provider reports, such as a
+/// target's ingress `endpoint`: lowercase scheme, a host and optional port,
+/// optional path and query, no user information or fragment, at most 2048
+/// bytes. Validated on decode.
+#[derive(Clone, Debug, PartialEq, Eq, Hash)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+pub struct PublicUrl(
+    #[cfg_attr(
+        feature = "schema",
+        schemars(length(min = 1, max = 2048), pattern(PUBLIC_URL_PATTERN))
+    )]
+    String,
+);
+
+impl PublicUrl {
+    pub fn new(value: impl Into<String>) -> Result<Self, UrlError> {
+        let value = value.into();
+        let parts = split_url(&value)?;
+        if !matches!(parts.scheme, "http" | "https") {
+            return Err(UrlError::Scheme(value));
+        }
+        if parts.fragment.is_some() {
+            return Err(UrlError::QueryOrFragment(value));
+        }
+        Ok(Self(value))
+    }
+
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+macro_rules! url_impls {
+    ($name:ident) => {
+        impl fmt::Display for $name {
+            fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+                formatter.write_str(&self.0)
+            }
+        }
+
+        impl std::str::FromStr for $name {
+            type Err = UrlError;
+
+            fn from_str(value: &str) -> Result<Self, Self::Err> {
+                Self::new(value)
+            }
+        }
+
+        impl Serialize for $name {
+            fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+                serializer.serialize_str(&self.0)
+            }
+        }
+
+        impl<'de> Deserialize<'de> for $name {
+            fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+                let value = String::deserialize(deserializer)?;
+                Self::new(value).map_err(D::Error::custom)
+            }
+        }
+    };
+}
+
+url_impls!(DataRouteBase);
+url_impls!(PublicUrl);
+
+/// A target's data route under a controller's advertised `routes.data`
+/// base: the base followed by
+/// `/{universeId}/{bindingId}/{environmentId}/{incarnationId}/{targetId}`,
+/// each segment percent-encoded.
+pub fn provider_data_route(
+    base: &DataRouteBase,
+    owner: &TargetOwner,
+    target_id: &ProviderTargetId,
+) -> String {
+    format!(
+        "{}/{}/{}/{}/{}/{}",
+        base.as_str(),
+        encode_path_segment(owner.universe_id.as_str()),
+        encode_path_segment(owner.binding_id.as_str()),
+        encode_path_segment(owner.environment_id.as_str()),
+        encode_path_segment(owner.incarnation_id.as_str()),
+        encode_path_segment(target_id.as_str()),
+    )
+}
+
+/// Percent-encode one URL path segment: everything except RFC 3986
+/// unreserved characters.
+pub fn encode_path_segment(segment: &str) -> String {
+    let mut encoded = String::with_capacity(segment.len());
+    for byte in segment.bytes() {
+        if byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'.' | b'_' | b'~') {
+            encoded.push(byte as char);
+        } else {
+            encoded.push_str(&format!("%{byte:02X}"));
+        }
+    }
+    encoded
+}
+
+fn split_host_port(authority: &str) -> Option<(&str, Option<u16>)> {
+    if let Some(rest) = authority.strip_prefix('[') {
+        let (host, after) = rest.split_once(']')?;
+        let host = &authority[..host.len() + 2];
+        return match after {
+            "" => Some((host, None)),
+            port => Some((host, Some(port.strip_prefix(':')?.parse().ok()?))),
+        };
+    }
+    match authority.rsplit_once(':') {
+        Some((host, port)) => Some((host, Some(port.parse().ok()?))),
+        None => Some((authority, None)),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn origins_are_canonical() {
+        for (url, origin) in [
+            (
+                "wss://GW.Example.com/environment-gateway/connect",
+                "wss://gw.example.com",
+            ),
+            ("wss://gw.example.com:443/x?y#z", "wss://gw.example.com"),
+            ("https://gw.example.com:8443", "wss://gw.example.com:8443"),
+            (
+                "ws://127.0.0.1:18080/environment-gateway/connect",
+                "ws://127.0.0.1:18080",
+            ),
+            ("http://[::1]:80/", "ws://[::1]"),
+        ] {
+            assert_eq!(canonical_origin(url).unwrap().as_str(), origin, "{url}");
+        }
+        for bad in [
+            "ftp://x",
+            "wss://",
+            "wss://user@host",
+            "wss://host:port",
+            "host",
+            "wss://host/a b",
+        ] {
+            assert!(canonical_origin(bad).is_err(), "{bad}");
+        }
+    }
+
+    #[test]
+    fn stream_urls_derive_from_the_connect_url() {
+        assert_eq!(
+            gateway_stream_url("wss://gw.example.com/environment-gateway/connect").unwrap(),
+            "wss://gw.example.com/environment-gateway/data"
+        );
+        assert_eq!(
+            gateway_stream_url("wss://GW.example.com:443/ls/environment-gateway/connect").unwrap(),
+            "wss://gw.example.com/ls/environment-gateway/data",
+            "a path prefix is kept"
+        );
+        assert!(matches!(
+            gateway_stream_url("wss://gw.example.com/connect"),
+            Err(UrlError::NotConnectPath(_))
+        ));
+        assert!(matches!(
+            gateway_stream_url("wss://gw.example.com/environment-gateway/connect?x=1"),
+            Err(UrlError::QueryOrFragment(_))
+        ));
+    }
+
+    #[test]
+    fn data_route_bases_are_validated_not_rewritten() {
+        for good in [
+            "wss://p.example/routes",
+            "ws://127.0.0.1:9000",
+            "wss://p.example",
+        ] {
+            assert_eq!(DataRouteBase::new(good).unwrap().as_str(), good);
+        }
+        for bad in [
+            "wss://p.example/routes/",
+            "wss://p.example/routes?x=1",
+            "WSS://p.example",
+            "https://p.example",
+            "wss://u@p.example",
+            "wss:///routes",
+        ] {
+            assert!(DataRouteBase::new(bad).is_err(), "{bad}");
+        }
+        assert!(serde_json::from_str::<DataRouteBase>("\"wss://p.example/\"").is_err());
+    }
+
+    #[test]
+    fn a_wss_controller_cannot_advertise_a_ws_data_route() {
+        let plain = DataRouteBase::new("ws://p.example/routes").unwrap();
+        assert!(matches!(
+            plain.check_for_controller("wss://p.example/control"),
+            Err(UrlError::Downgrade(_))
+        ));
+        assert!(plain.check_for_controller("ws://127.0.0.1/control").is_ok());
+        let secure = DataRouteBase::new("wss://p.example/routes").unwrap();
+        assert!(
+            secure
+                .check_for_controller("wss://p.example/control")
+                .is_ok()
+        );
+    }
+
+    #[test]
+    fn public_urls_allow_paths_and_queries() {
+        assert!(PublicUrl::new("https://app.example/x?y=1").is_ok());
+        for bad in ["ftp://x", "https://x/#f", "https://u@x", "wss://x"] {
+            assert!(PublicUrl::new(bad).is_err(), "{bad}");
+        }
+    }
+
+    #[test]
+    fn data_routes_encode_opaque_target_ids() {
+        let owner = TargetOwner {
+            universe_id: "u1".parse().unwrap(),
+            binding_id: "primary".parse().unwrap(),
+            environment_id: "env_1".parse().unwrap(),
+            incarnation_id: "inc_1".parse().unwrap(),
+        };
+        let target = ProviderTargetId::new("default/pod abc").unwrap();
+        let base = DataRouteBase::new("wss://p.example/routes").unwrap();
+        assert_eq!(
+            provider_data_route(&base, &owner, &target),
+            "wss://p.example/routes/u1/primary/env_1/inc_1/default%2Fpod%20abc"
+        );
+    }
+}
diff --git a/crates/environment-protocol/src/serde_util.rs b/crates/environment-protocol/src/serde_util.rs
new file mode 100644
index 000000000..659ebbc82
--- /dev/null
+++ b/crates/environment-protocol/src/serde_util.rs
@@ -0,0 +1,13 @@
+//! Serialization predicates shared by the wire types.
+
+pub(crate) fn is_false(value: &bool) -> bool {
+    !*value
+}
+
+pub(crate) fn is_zero_u32(value: &u32) -> bool {
+    *value == 0
+}
+
+pub(crate) fn is_zero_u64(value: &u64) -> bool {
+    *value == 0
+}
diff --git a/crates/environment-protocol/src/shared.rs b/crates/environment-protocol/src/shared.rs
deleted file mode 100644
index 3c6f1924d..000000000
--- a/crates/environment-protocol/src/shared.rs
+++ /dev/null
@@ -1,461 +0,0 @@
-//! Shared protocol primitives.
-
-use std::{fmt, str::FromStr};
-
-use base64::{Engine as _, engine::general_purpose::STANDARD as BASE64_STANDARD};
-use serde::{Deserialize, Deserializer, Serialize, Serializer, de::Error as SerdeError};
-use thiserror::Error;
-
-pub const CURRENT_PROTOCOL_VERSION: u32 = 2;
-
-macro_rules! string_id {
-    ($name:ident) => {
-        #[derive(Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize, Deserialize)]
-        #[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
-        #[serde(transparent)]
-        pub struct $name(pub String);
-
-        impl $name {
-            pub fn new(value: impl Into<String>) -> Self {
-                Self(value.into())
-            }
-
-            pub fn as_str(&self) -> &str {
-                &self.0
-            }
-        }
-
-        impl fmt::Display for $name {
-            fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-                self.0.fmt(formatter)
-            }
-        }
-
-        impl From<&str> for $name {
-            fn from(value: &str) -> Self {
-                Self::new(value)
-            }
-        }
-
-        impl From<String> for $name {
-            fn from(value: String) -> Self {
-                Self::new(value)
-            }
-        }
-    };
-}
-
-string_id!(ProviderTargetId);
-string_id!(EnvironmentConnectionId);
-string_id!(ProcessId);
-string_id!(JobId);
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(tag = "type", rename_all = "camelCase")]
-pub enum EnvironmentTransport {
-    WebSocket,
-    Http,
-    Stdio,
-    Ssh,
-    Provider {
-        #[serde(rename = "providerType")]
-        provider_type: String,
-    },
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct EnvironmentDataConnection {
-    pub target_id: ProviderTargetId,
-    pub endpoint: String,
-    pub transport: EnvironmentTransport,
-    pub scope: EnvironmentScope,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub default_cwd: Option<EnvironmentPath>,
-    pub capabilities: EnvironmentCapabilities,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(tag = "type", rename_all = "camelCase")]
-pub enum EnvironmentScope {
-    Default,
-    #[serde(rename_all = "camelCase")]
-    Session {
-        session_id: String,
-    },
-}
-
-#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct EnvironmentCapabilities {
-    #[serde(default)]
-    pub network: bool,
-    #[serde(default)]
-    pub filesystem_read: bool,
-    #[serde(default)]
-    pub filesystem_write: bool,
-    /// The environment endpoint implements the bounded `fs/searchText` operation natively, so
-    /// callers can avoid per-file transfer for recursive text search.
-    #[serde(default)]
-    pub filesystem_search: bool,
-    /// The environment endpoint implements the bounded `fs/globFiles` operation natively, so
-    /// callers can avoid per-directory transfer for recursive enumeration.
-    #[serde(default)]
-    pub filesystem_glob: bool,
-    /// The environment endpoint honors `offset`/`maxBytes` on `fs/readFile` and reports the
-    /// true file size, so oversized files are truncated at the source instead
-    /// of transferred in full.
-    #[serde(default)]
-    pub filesystem_ranged_read: bool,
-    /// Bounded inline capture; absent on older endpoints.
-    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
-    pub filesystem_capture: bool,
-    /// Paged transfer sessions with whole-file digests and bounded byte exchanges.
-    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
-    pub filesystem_transfer: bool,
-    /// Bounded filesystem inventory observations with conditional fingerprints.
-    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
-    pub filesystem_scan: bool,
-    /// Bounded staged materialization; false for read-only endpoints.
-    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
-    pub filesystem_materialize: bool,
-    #[serde(default)]
-    pub process_start: bool,
-    #[serde(default)]
-    pub process_stdin: bool,
-    #[serde(default)]
-    pub process_terminate: bool,
-    #[serde(default)]
-    pub process_output_polling: bool,
-    #[serde(default)]
-    pub process_output_notifications: bool,
-    #[serde(default)]
-    pub process_pty: bool,
-    #[serde(default)]
-    pub job_start: bool,
-    #[serde(default)]
-    pub job_list: bool,
-    #[serde(default)]
-    pub job_read: bool,
-    #[serde(default)]
-    pub job_cancel: bool,
-    #[serde(default)]
-    pub job_wait_hint: bool,
-    #[serde(default)]
-    pub job_dependencies: bool,
-    #[serde(default)]
-    pub job_queue_keys: bool,
-}
-
-impl EnvironmentCapabilities {
-    pub fn filesystem(read: bool, write: bool) -> Self {
-        Self {
-            filesystem_read: read,
-            filesystem_write: write,
-            ..Self::default()
-        }
-    }
-
-    pub fn with_filesystem_search(mut self) -> Self {
-        self.filesystem_search = true;
-        self
-    }
-
-    pub fn with_process(mut self) -> Self {
-        self.process_start = true;
-        self.process_stdin = true;
-        self.process_terminate = true;
-        self.process_output_polling = true;
-        self.process_output_notifications = true;
-        self
-    }
-
-    pub fn with_jobs(mut self) -> Self {
-        self.job_start = true;
-        self.job_list = true;
-        self.job_read = true;
-        self.job_cancel = true;
-        self.job_wait_hint = false;
-        self.job_dependencies = true;
-        self.job_queue_keys = true;
-        self
-    }
-}
-
-/// What an endpoint says about its own build. Descriptive only: the protocol
-/// version decides compatibility, and nothing here selects, authenticates,
-/// or gates. The gateway records these facts on the environment row so a
-/// deployment can see which build serves each environment.
-#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct ImplementationInfo {
-    pub name: String,
-    /// Release version of the build, for example `0.1.0`.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub version: Option<String>,
-    /// Full git commit the build was made from.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub git_sha: Option<String>,
-    /// Rust target triple the build runs on.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub target: Option<String>,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct ByteChunk(pub Vec<u8>);
-
-impl ByteChunk {
-    pub fn new(bytes: impl Into<Vec<u8>>) -> Self {
-        Self(bytes.into())
-    }
-
-    pub fn into_inner(self) -> Vec<u8> {
-        self.0
-    }
-
-    pub fn as_slice(&self) -> &[u8] {
-        &self.0
-    }
-}
-
-impl From<Vec<u8>> for ByteChunk {
-    fn from(value: Vec<u8>) -> Self {
-        Self(value)
-    }
-}
-
-impl From<&[u8]> for ByteChunk {
-    fn from(value: &[u8]) -> Self {
-        Self(value.to_vec())
-    }
-}
-
-impl Serialize for ByteChunk {
-    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
-    where
-        S: Serializer,
-    {
-        serializer.serialize_str(&BASE64_STANDARD.encode(&self.0))
-    }
-}
-
-impl<'de> Deserialize<'de> for ByteChunk {
-    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
-    where
-        D: Deserializer<'de>,
-    {
-        let encoded = String::deserialize(deserializer)?;
-        BASE64_STANDARD
-            .decode(encoded)
-            .map(Self)
-            .map_err(SerdeError::custom)
-    }
-}
-
-/// Secret string carried over the environment data protocol.
-///
-/// It serializes as a string because it is a wire value, but `Debug` is
-/// redacted so ordinary structured logging does not print plaintext.
-#[derive(Clone, PartialEq, Eq)]
-pub struct SecretString(String);
-
-impl SecretString {
-    pub fn new(value: impl Into<String>) -> Self {
-        Self(value.into())
-    }
-
-    pub fn expose(&self) -> &str {
-        &self.0
-    }
-
-    pub fn is_empty(&self) -> bool {
-        self.0.is_empty()
-    }
-}
-
-impl fmt::Debug for SecretString {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter.write_str("SecretString(<redacted>)")
-    }
-}
-
-impl From<String> for SecretString {
-    fn from(value: String) -> Self {
-        Self(value)
-    }
-}
-
-impl From<&str> for SecretString {
-    fn from(value: &str) -> Self {
-        Self(value.to_owned())
-    }
-}
-
-impl Serialize for SecretString {
-    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
-    where
-        S: Serializer,
-    {
-        serializer.serialize_str(&self.0)
-    }
-}
-
-impl<'de> Deserialize<'de> for SecretString {
-    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
-    where
-        D: Deserializer<'de>,
-    {
-        String::deserialize(deserializer).map(Self)
-    }
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)]
-#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
-#[cfg_attr(feature = "schema", schemars(with = "String"))]
-pub struct EnvironmentPath {
-    normalized: String,
-}
-
-impl EnvironmentPath {
-    pub fn new(path: impl AsRef<str>) -> Result<Self, EnvironmentPathError> {
-        normalize_path(path.as_ref()).map(|normalized| Self { normalized })
-    }
-
-    pub fn root() -> Self {
-        Self {
-            normalized: "/".to_owned(),
-        }
-    }
-
-    pub fn current_dir() -> Self {
-        Self {
-            normalized: ".".to_owned(),
-        }
-    }
-
-    pub fn as_str(&self) -> &str {
-        &self.normalized
-    }
-
-    pub fn is_absolute(&self) -> bool {
-        self.normalized.starts_with('/')
-    }
-}
-
-impl fmt::Display for EnvironmentPath {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        self.normalized.fmt(formatter)
-    }
-}
-
-impl FromStr for EnvironmentPath {
-    type Err = EnvironmentPathError;
-
-    fn from_str(value: &str) -> Result<Self, Self::Err> {
-        Self::new(value)
-    }
-}
-
-impl TryFrom<&str> for EnvironmentPath {
-    type Error = EnvironmentPathError;
-
-    fn try_from(value: &str) -> Result<Self, Self::Error> {
-        Self::new(value)
-    }
-}
-
-impl Serialize for EnvironmentPath {
-    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
-    where
-        S: Serializer,
-    {
-        serializer.serialize_str(self.as_str())
-    }
-}
-
-impl<'de> Deserialize<'de> for EnvironmentPath {
-    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
-    where
-        D: Deserializer<'de>,
-    {
-        let value = String::deserialize(deserializer)?;
-        Self::new(value).map_err(SerdeError::custom)
-    }
-}
-
-#[derive(Clone, Debug, Error, PartialEq, Eq)]
-pub enum EnvironmentPathError {
-    #[error("environment path is empty")]
-    Empty,
-
-    #[error("environment path contains a NUL byte")]
-    NulByte,
-
-    #[error("environment path must use '/' separators: {path}")]
-    NonUnixSeparator { path: String },
-}
-
-fn normalize_path(path: &str) -> Result<String, EnvironmentPathError> {
-    if path.is_empty() {
-        return Err(EnvironmentPathError::Empty);
-    }
-    if path.contains('\0') {
-        return Err(EnvironmentPathError::NulByte);
-    }
-    if path.contains('\\') {
-        return Err(EnvironmentPathError::NonUnixSeparator {
-            path: path.to_owned(),
-        });
-    }
-
-    let absolute = path.starts_with('/');
-    let mut segments = Vec::new();
-    for segment in path.split('/') {
-        match segment {
-            "" | "." => {}
-            ".." => {
-                if let Some(last) = segments.last()
-                    && *last != ".."
-                {
-                    segments.pop();
-                    continue;
-                }
-                if !absolute {
-                    segments.push("..");
-                }
-            }
-            segment => segments.push(segment),
-        }
-    }
-
-    if absolute {
-        if segments.is_empty() {
-            Ok("/".to_owned())
-        } else {
-            Ok(format!("/{}", segments.join("/")))
-        }
-    } else if segments.is_empty() {
-        Ok(".".to_owned())
-    } else {
-        Ok(segments.join("/"))
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn byte_chunk_serializes_as_base64_string() {
-        let value = serde_json::to_value(ByteChunk::from(b"hello".as_slice())).expect("serialize");
-
-        assert_eq!(value, serde_json::json!("aGVsbG8="));
-    }
-
-    #[test]
-    fn environment_path_normalizes_like_agent_fs_path() {
-        let path = EnvironmentPath::new("src//./lib/../main.rs").expect("path");
-
-        assert_eq!(path.as_str(), "src/main.rs");
-    }
-}
diff --git a/crates/environment-protocol/src/version.rs b/crates/environment-protocol/src/version.rs
new file mode 100644
index 000000000..00a8406a1
--- /dev/null
+++ b/crates/environment-protocol/src/version.rs
@@ -0,0 +1,17 @@
+//! Protocol version numbers.
+//!
+//! Each number is matched exactly: a peer that states any other number is
+//! refused with `versionMismatch`, and no range or negotiation exists. A
+//! change to a plane's wire shape or to the meaning of an existing field or
+//! method needs a new number for that plane. `release/metadata.env` carries
+//! the same numbers and `scripts/release/verify-metadata.sh` checks them.
+
+/// Version of the data plane and the registration channel.
+///
+/// Both share one number so a data-plane change also changes the number in
+/// the gateway's `registration/challenge`, which is what triggers a
+/// registered daemon's automatic upgrade.
+pub const ENVD_PROTOCOL_VERSION: u32 = 3;
+
+/// Version of the provider controller plane.
+pub const CONTROLLER_PROTOCOL_VERSION: u32 = 3;
diff --git a/crates/environment-protocol/tests/contract.rs b/crates/environment-protocol/tests/contract.rs
new file mode 100644
index 000000000..e772e0f1b
--- /dev/null
+++ b/crates/environment-protocol/tests/contract.rs
@@ -0,0 +1,47 @@
+//! The committed `contract/` documents match the current wire types. When
+//! this fails, regenerate with
+//! `cargo run -p environment-protocol --features schema --bin export-contract`
+//! and commit the result with the type change.
+
+use std::{fs, path::PathBuf};
+
+use serde_json::Value;
+
+#[test]
+fn committed_contract_is_current() {
+    let dir = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("contract");
+    for plane in environment_protocol::contract::export() {
+        for (name, current) in [
+            (plane.schema_file_name(), &plane.schema_bundle),
+            (plane.openrpc_file_name(), &plane.openrpc),
+        ] {
+            let path = dir.join(&name);
+            let text = fs::read_to_string(&path).unwrap_or_else(|error| {
+                panic!(
+                    "missing {}: {error}; run the export-contract binary",
+                    path.display()
+                )
+            });
+            let committed: Value = serde_json::from_str(&text).expect("contract parses");
+            assert_eq!(
+                &committed, current,
+                "{name} is stale; run the export-contract binary"
+            );
+        }
+    }
+}
+
+#[test]
+fn every_method_appears_in_its_plane_document() {
+    for plane in environment_protocol::contract::export() {
+        let names: Vec<&str> = plane.openrpc["methods"]
+            .as_array()
+            .expect("methods")
+            .iter()
+            .filter_map(|method| method["name"].as_str())
+            .collect();
+        for spec in environment_protocol::manifest::plane_methods(plane.plane) {
+            assert!(names.contains(&spec.name), "{} missing", spec.name);
+        }
+    }
+}
diff --git a/crates/environment-protocol/tests/fixtures.rs b/crates/environment-protocol/tests/fixtures.rs
new file mode 100644
index 000000000..60d3d7c8e
--- /dev/null
+++ b/crates/environment-protocol/tests/fixtures.rs
@@ -0,0 +1,203 @@
+//! One fixture per method: params, response and an error, round-tripped
+//! through the manifest's wire types under the strict decoding policy.
+
+use std::{collections::BTreeSet, fs, path::PathBuf};
+
+use environment_protocol::{
+    bootstrap::{BuildFacts, DiscoveryDocument},
+    error::ProtocolError,
+    handshake::Plane,
+    manifest::{MessageKind, MethodSpec, RegistrationChallenge, methods},
+};
+use serde::{Serialize, de::DeserializeOwned};
+use serde_json::{Value, json};
+
+fn fixtures_dir() -> PathBuf {
+    PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("fixtures")
+}
+
+fn fixture_file(spec: &MethodSpec) -> PathBuf {
+    let name = match spec.name.strip_prefix("$/") {
+        Some(rest) => format!("rpc/{rest}"),
+        None => spec.name.to_owned(),
+    };
+    fixtures_dir()
+        .join(spec.plane.as_str())
+        .join(format!("{}.json", name.replace('/', ".")))
+}
+
+fn load(path: &PathBuf) -> Value {
+    let text = fs::read_to_string(path)
+        .unwrap_or_else(|error| panic!("missing fixture {}: {error}", path.display()));
+    serde_json::from_str(&text).unwrap_or_else(|error| panic!("{}: {error}", path.display()))
+}
+
+fn round_trip<T: Serialize + DeserializeOwned>(value: &Value) -> Value {
+    serde_json::to_value(serde_json::from_value::<T>(value.clone()).expect("decode"))
+        .expect("encode")
+}
+
+#[test]
+fn every_method_has_fixtures_that_round_trip() {
+    for spec in methods() {
+        let path = fixture_file(spec);
+        let fixture = load(&path);
+        let params = &fixture["params"];
+        assert_eq!(
+            (spec.normalize_params)(params)
+                .unwrap_or_else(|error| panic!("{} params: {error}", spec.name)),
+            *params,
+            "{} params are not canonical",
+            spec.name
+        );
+        match spec.kind {
+            MessageKind::Request => {
+                let response = &fixture["response"];
+                let normalize = spec.normalize_response.expect("requests have responses");
+                assert_eq!(
+                    normalize(response)
+                        .unwrap_or_else(|error| panic!("{} response: {error}", spec.name)),
+                    *response,
+                    "{} response is not canonical",
+                    spec.name
+                );
+                let error = &fixture["error"];
+                let decoded: ProtocolError = serde_json::from_value(error.clone())
+                    .unwrap_or_else(|decode| panic!("{} error: {decode}", spec.name));
+                assert_eq!(
+                    error["code"],
+                    json!(decoded.code()),
+                    "{} error code does not match its kind",
+                    spec.name
+                );
+                assert_eq!(serde_json::to_value(&decoded).unwrap(), *error);
+            }
+            MessageKind::Notification => {
+                assert!(
+                    fixture.get("response").is_none() && fixture.get("error").is_none(),
+                    "notification {} is never answered",
+                    spec.name
+                );
+            }
+        }
+    }
+}
+
+#[test]
+fn every_fixture_belongs_to_a_method() {
+    let expected: BTreeSet<PathBuf> = methods().map(fixture_file).collect();
+    for plane in [Plane::Data, Plane::Controller, Plane::Registration] {
+        for entry in fs::read_dir(fixtures_dir().join(plane.as_str())).expect("fixture dir") {
+            let path = entry.expect("entry").path();
+            assert!(
+                expected.contains(&path),
+                "orphan fixture {}",
+                path.display()
+            );
+        }
+    }
+}
+
+/// Members whose values are free-form string maps rather than wire
+/// structs.
+const FREE_FORM_MAPS: &[&str] = &["metadata", "env", "secretEnv"];
+
+/// The path of every JSON object inside `value` that is a wire struct,
+/// `value` itself included.
+fn object_paths(value: &Value, path: &mut Vec<String>, paths: &mut Vec<Vec<String>>) {
+    match value {
+        Value::Object(map) => {
+            paths.push(path.clone());
+            for (key, child) in map {
+                if FREE_FORM_MAPS.contains(&key.as_str()) {
+                    continue;
+                }
+                path.push(key.clone());
+                object_paths(child, path, paths);
+                path.pop();
+            }
+        }
+        Value::Array(items) => {
+            for (index, child) in items.iter().enumerate() {
+                path.push(index.to_string());
+                object_paths(child, path, paths);
+                path.pop();
+            }
+        }
+        _ => {}
+    }
+}
+
+/// `value` with an unknown member added to the object at `path`.
+fn with_unknown_member(value: &Value, path: &[String]) -> Value {
+    let mut value = value.clone();
+    let mut target = &mut value;
+    for segment in path {
+        target = match target {
+            Value::Array(items) => &mut items[segment.parse::<usize>().expect("index")],
+            other => &mut other[segment.as_str()],
+        };
+    }
+    target["unexpectedMember"] = json!(true);
+    value
+}
+
+/// Every nested object of `value` refuses an unknown member under `decode`.
+fn assert_strict(name: &str, part: &str, value: &Value, decode: impl Fn(&Value) -> bool) {
+    let mut paths = Vec::new();
+    object_paths(value, &mut Vec::new(), &mut paths);
+    assert!(!paths.is_empty(), "{name} {part} has no object");
+    for path in paths {
+        assert!(
+            !decode(&with_unknown_member(value, &path)),
+            "{name} {part} accepts an unknown member at /{}",
+            path.join("/")
+        );
+    }
+}
+
+#[test]
+fn versioned_messages_reject_unknown_members_at_every_depth() {
+    for spec in methods() {
+        if spec.name == RegistrationChallenge::NAME {
+            continue;
+        }
+        let fixture = load(&fixture_file(spec));
+        assert_strict(spec.name, "params", &fixture["params"], |value| {
+            (spec.normalize_params)(value).is_ok()
+        });
+        if let Some(normalize) = spec.normalize_response {
+            assert_strict(spec.name, "response", &fixture["response"], |value| {
+                normalize(value).is_ok()
+            });
+            assert_strict(spec.name, "error", &fixture["error"], |value| {
+                serde_json::from_value::<ProtocolError>(value.clone()).is_ok()
+            });
+        }
+    }
+}
+
+#[test]
+fn the_frozen_challenge_tolerates_additions() {
+    let spec = methods()
+        .find(|spec| spec.name == RegistrationChallenge::NAME)
+        .expect("challenge");
+    let mut params = load(&fixture_file(spec))["params"].clone();
+    params["addedInALaterVersion"] = json!({"any": "shape"});
+    assert!((spec.normalize_params)(&params).is_ok());
+}
+
+#[test]
+fn bootstrap_documents_round_trip_and_tolerate_additions() {
+    let dir = fixtures_dir().join("bootstrap");
+    let discovery = load(&dir.join("discovery-document.json"));
+    assert_eq!(round_trip::<DiscoveryDocument>(&discovery), discovery);
+    let build = load(&dir.join("build-facts.json"));
+    assert_eq!(round_trip::<BuildFacts>(&build), build);
+
+    let mut extended = discovery.clone();
+    extended["addedLater"] = json!(1);
+    extended["artifacts"]["x86_64-unknown-linux-musl"]["url"] = Value::Null;
+    let decoded: DiscoveryDocument = serde_json::from_value(extended).expect("tolerant");
+    assert!(decoded.artifacts["x86_64-unknown-linux-musl"].url.is_none());
+}
diff --git a/crates/environment-protocol/tests/serde.rs b/crates/environment-protocol/tests/serde.rs
index 2223b5652..a49ad17db 100644
--- a/crates/environment-protocol/tests/serde.rs
+++ b/crates/environment-protocol/tests/serde.rs
@@ -1,416 +1,182 @@
-use std::collections::BTreeMap;
+//! Wire-shape rules that the per-method fixtures do not spell out.
 
 use environment_protocol::{
+    CONTROLLER_PROTOCOL_VERSION, ENVD_PROTOCOL_VERSION,
     control::{
         handshake::ControllerInitializeParams,
-        methods::{
-            CREATE_TARGET_METHOD, INITIALIZE_METHOD as CONTROL_INITIALIZE_METHOD,
-            LIST_TARGETS_METHOD, SET_TARGET_POWER_METHOD,
-        },
-        targets::{
-            CreateTargetParams, CreateTargetResponse, ListTargetsResponse, PowerState,
-            ProviderBindingContext, ProviderTargetStatus, ProviderTargetSummary,
-            SetTargetPowerParams,
-        },
+        target::{TargetObservation, TargetPhase, TargetResponse},
     },
     data::{
-        fs::ReadFileResponse,
-        handshake::InitializeParams,
-        idle::IdleResponse,
-        jobs::{
-            JobArtifact, JobDependency, JobDependencyPolicy, JobOutputChunk, JobOutputStream,
-            JobReadResult, JobStartSpec, JobStatus, JobSummary, ListJobsParams, ReadJobsResponse,
-            StartJobsParams,
-        },
-        methods::{
-            ENV_IDLE_METHOD, FS_READ_FILE_METHOD, INITIALIZE_METHOD, JOB_CANCEL_METHOD,
-            JOB_LIST_METHOD, JOB_READ_METHOD, JOB_START_METHOD, PROCESS_OUTPUT_METHOD,
-            PROCESS_START_METHOD,
-        },
-        process::{
-            LeftoverProcess, ProcessOutputChunk, ProcessOutputStream, ReadProcessResponse,
-            StartProcessParams,
-        },
-    },
-    shared::{
-        ByteChunk, CURRENT_PROTOCOL_VERSION, EnvironmentCapabilities, EnvironmentConnectionId,
-        EnvironmentScope, JobId, ProcessId, ProviderTargetId,
+        exec::{ExecInput, ExitStatus, GapReason, OutputPage},
+        handshake::{DataCapabilities, InitializeParams, InitializeResponse},
+        job::{JobDependency, JobReadEntry, JobStatus, ReadJobsResponse, StartJobsParams},
+        process::{ReadProcessParams, ReadProcessResponse},
+        scan::{ScanResponse, ScanRootResult},
     },
+    error::{NotFoundReason, ProtocolError, ProtocolErrorKind},
+    handshake::Plane,
+    manifest::{FsScan, ProcessRead, RequestMethod},
+    registration::{RegisterParams, RegisterResponse},
 };
-use serde::{Serialize, de::DeserializeOwned};
+use serde::de::DeserializeOwned;
 use serde_json::{Value, json};
 
-fn fixture(name: &str) -> Value {
-    serde_json::from_str(match name {
-        "data_initialize_params" => include_str!("../fixtures/data_initialize_params.json"),
-        "fs_read_file_response" => include_str!("../fixtures/fs_read_file_response.json"),
-        "process_start_params" => include_str!("../fixtures/process_start_params.json"),
-        "process_read_response" => include_str!("../fixtures/process_read_response.json"),
-        "job_start_params" => include_str!("../fixtures/job_start_params.json"),
-        "job_read_response" => include_str!("../fixtures/job_read_response.json"),
-        "controller_initialize_params" => {
-            include_str!("../fixtures/controller_initialize_params.json")
-        }
-        "controller_create_target_params" => {
-            include_str!("../fixtures/controller_create_target_params.json")
-        }
-        "controller_create_target_response" => {
-            include_str!("../fixtures/controller_create_target_response.json")
-        }
-        "controller_list_targets_response" => {
-            include_str!("../fixtures/controller_list_targets_response.json")
-        }
-        other => panic!("unknown fixture {other}"),
-    })
-    .expect("fixture JSON")
-}
-
-fn assert_round_trip<T>(value: T, expected: Value)
-where
-    T: Serialize + DeserializeOwned + PartialEq + std::fmt::Debug,
-{
-    let encoded = serde_json::to_value(&value).expect("serialize");
-    assert_eq!(encoded, expected);
-    let decoded: T = serde_json::from_value(encoded).expect("deserialize");
-    assert_eq!(decoded, value);
-}
-
-#[test]
-fn single_file_transfer_has_distinct_wire_semantics() {
-    use environment_protocol::{
-        data::transfer_session::TransferSelection, shared::EnvironmentPath,
-    };
-    assert_round_trip(
-        TransferSelection::WriteFile {
-            destination: EnvironmentPath::new("/workspace/output.bin").unwrap(),
-        },
-        json!({"direction":"writeFile","destination":"/workspace/output.bin"}),
-    );
-    let existing: TransferSelection =
-        serde_json::from_value(json!({"direction":"materialize","destination":"/workspace/tree"}))
-            .unwrap();
-    assert_eq!(
-        serde_json::to_value(existing).unwrap(),
-        json!({"direction":"materialize","destination":"/workspace/tree","onExisting":"replace"})
-    );
-}
-
-#[test]
-fn method_names_match_data_plane_contract() {
-    assert_eq!(INITIALIZE_METHOD, "initialize");
-    assert_eq!(FS_READ_FILE_METHOD, "fs/readFile");
-    assert_eq!(PROCESS_START_METHOD, "process/start");
-    assert_eq!(JOB_START_METHOD, "job/start");
-    assert_eq!(JOB_LIST_METHOD, "job/list");
-    assert_eq!(JOB_READ_METHOD, "job/read");
-    assert_eq!(JOB_CANCEL_METHOD, "job/cancel");
-    assert_eq!(PROCESS_OUTPUT_METHOD, "process/output");
+fn fixture(path: &str) -> Value {
+    let full = std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
+        .join("fixtures")
+        .join(path);
+    serde_json::from_str(&std::fs::read_to_string(&full).expect("fixture")).expect("JSON")
 }
 
-#[test]
-fn method_names_match_controller_plane_contract() {
-    assert_eq!(CONTROL_INITIALIZE_METHOD, "controller/initialize");
-    assert_eq!(LIST_TARGETS_METHOD, "controller/listTargets");
-    assert_eq!(CREATE_TARGET_METHOD, "controller/createTarget");
+fn decode<T: DeserializeOwned>(value: &Value) -> T {
+    serde_json::from_value(value.clone()).expect("decode")
 }
 
 #[test]
-fn initialize_params_match_fixture() {
-    assert_round_trip(
-        InitializeParams {
-            protocol_version: CURRENT_PROTOCOL_VERSION,
-            client_name: "lightspeed-test".to_owned(),
-            scope: EnvironmentScope::Session {
-                session_id: "sandbox-123".to_owned(),
-            },
-            resume_connection_id: Some(EnvironmentConnectionId::new("conn-prev")),
-        },
-        fixture("data_initialize_params"),
-    );
+fn both_numbers_are_three() {
+    assert_eq!(ENVD_PROTOCOL_VERSION, 3);
+    assert_eq!(CONTROLLER_PROTOCOL_VERSION, 3);
 }
 
 #[test]
-fn read_file_response_uses_base64_byte_chunk() {
-    assert_round_trip(
-        ReadFileResponse {
-            data: ByteChunk::from(b"hello\n".as_slice()),
-            file_size: None,
-            truncated: false,
-        },
-        fixture("fs_read_file_response"),
+fn handshakes_require_a_stated_protocol_version() {
+    let client_info = json!({"name": "x"});
+    assert!(
+        serde_json::from_value::<InitializeParams>(json!({"clientInfo": client_info})).is_err()
     );
-}
-
-#[test]
-fn process_start_params_match_fixture() {
-    assert_round_trip(
-        StartProcessParams {
-            process_id: ProcessId::new("proc-1"),
-            argv: vec!["sh".to_owned(), "-lc".to_owned(), "cat".to_owned()],
-            cwd: Some("/workspace".try_into().expect("cwd")),
-            env: BTreeMap::from([("RUST_LOG".to_owned(), "debug".to_owned())]),
-            secret_env: BTreeMap::new(),
-            stdin: Some(ByteChunk::from(b"input\n".as_slice())),
-            timeout_ms: Some(60_000),
-            tty: false,
-        },
-        fixture("process_start_params"),
+    assert!(
+        serde_json::from_value::<ControllerInitializeParams>(json!({"clientInfo": client_info}))
+            .is_err()
     );
+    let mut register = fixture("registration/registration.register.json")["params"].clone();
+    register.as_object_mut().unwrap().remove("protocolVersion");
+    assert!(serde_json::from_value::<RegisterParams>(register).is_err());
 }
 
 #[test]
-fn process_read_response_preserves_ordered_output_chunks() {
-    assert_round_trip(
-        ReadProcessResponse {
-            chunks: vec![
-                ProcessOutputChunk {
-                    seq: 1,
-                    stream: ProcessOutputStream::Stdout,
-                    chunk: ByteChunk::from(b"ok\n".as_slice()),
-                },
-                ProcessOutputChunk {
-                    seq: 2,
-                    stream: ProcessOutputStream::Stderr,
-                    chunk: ByteChunk::from(b"warn\n".as_slice()),
-                },
-            ],
-            next_seq: 3,
-            exited: true,
-            exit_code: Some(0),
-            closed: true,
-            failure: None,
-            termination: None,
-            pid: Some(90),
-            omitted_bytes: 0,
-            leftover_processes: vec![LeftoverProcess {
-                pid: 91,
-                command: "python -m http.server 8080".to_owned(),
-            }],
-        },
-        fixture("process_read_response"),
-    );
+fn initialize_names_the_plane_and_the_daemon_instance() {
+    let response: InitializeResponse = decode(&fixture("data/initialize.json")["response"]);
+    assert_eq!(response.plane, Plane::Data);
+    assert_eq!(response.daemon_instance_id.as_str(), "envd_01jb8x7k2m");
+    assert!(response.capabilities.filesystem.unwrap().write);
+    assert!(response.limits.max_concurrent_requests >= 16);
+    let absent: DataCapabilities = decode(&json!({}));
+    assert!(absent.process.is_none(), "an absent family is unavailable");
 }
 
 #[test]
-fn job_start_params_match_fixture() {
-    assert_round_trip(
-        StartJobsParams {
-            namespace: "session_1".to_owned(),
-            request_id: "request-1".to_owned(),
-            jobs: vec![JobStartSpec {
-                job_id: JobId::new("checkout"),
-                name: Some("checkout".to_owned()),
-                argv: vec!["git".to_owned(), "status".to_owned()],
-                cwd: Some("/workspace".try_into().expect("cwd")),
-                env: BTreeMap::from([("RUST_LOG".to_owned(), "debug".to_owned())]),
-                secret_env: BTreeMap::new(),
-                stdin: Some(ByteChunk::from(b"hello\n".as_slice())),
-                timeout_ms: Some(60_000),
-                depends_on: vec![JobDependency::name("setup")],
-                dependency_policy: JobDependencyPolicy::AllSucceeded,
-                queue_key: Some("repo".to_owned()),
-            }],
-        },
-        fixture("job_start_params"),
-    );
-}
+fn process_reads_require_bounded_waits_and_report_byte_gaps() {
+    let mut params = fixture("data/process.read.json")["params"].clone();
+    params.as_object_mut().unwrap().remove("waitMs");
+    assert!(serde_json::from_value::<ReadProcessParams>(params).is_err());
 
-#[test]
-fn job_read_response_matches_fixture() {
-    assert_round_trip(
-        ReadJobsResponse {
-            jobs: vec![JobReadResult {
-                summary: JobSummary {
-                    namespace: "session_1".to_owned(),
-                    job_id: JobId::new("tests"),
-                    name: Some("tests".to_owned()),
-                    status: JobStatus::Succeeded,
-                    dependencies: vec![JobId::new("checkout")],
-                    created_at_ms: 1,
-                    queued_at_ms: Some(2),
-                    started_at_ms: Some(3),
-                    finished_at_ms: Some(4),
-                    exit_code: Some(0),
-                    orphaned_descendants: true,
-                    failure: None,
-                    queue_key: Some("repo".to_owned()),
-                },
-                output_chunks: vec![JobOutputChunk {
-                    seq: 1,
-                    stream: JobOutputStream::Stdout,
-                    chunk: ByteChunk::from(b"ok\n".as_slice()),
-                }],
-                output_next_seq: 2,
-                artifacts: vec![JobArtifact {
-                    path: "/workspace/result.txt".try_into().expect("artifact path"),
-                    kind: Some("file".to_owned()),
-                    metadata: BTreeMap::from([("role".to_owned(), "report".to_owned())]),
-                }],
-            }],
-        },
-        fixture("job_read_response"),
-    );
+    let response: ReadProcessResponse = decode(&fixture("data/process.read.json")["response"]);
+    let OutputPage {
+        chunks,
+        gaps,
+        next,
+        end,
+    } = response.output;
+    let gap = gaps[0];
+    assert_eq!(gap.reason, GapReason::Overflow);
+    assert_eq!(chunks[0].offset + chunks[0].data.len() as u64, gap.offset);
+    assert_eq!(gap.offset + gap.omitted_bytes, chunks[1].offset);
+    assert_eq!(next, end);
+    assert!(matches!(
+        response.exit,
+        Some(ExitStatus::Signal {
+            core_dumped: true,
+            ..
+        })
+    ));
 }
 
 #[test]
-fn job_list_params_use_session_namespace_and_limit() {
-    assert_round_trip(
-        ListJobsParams {
-            namespace: "session_1".to_owned(),
-            limit: Some(25),
-        },
-        json!({
-            "namespace": "session_1",
-            "limit": 25
-        }),
-    );
-}
-
-#[test]
-fn byte_chunk_rejects_invalid_base64() {
-    assert!(serde_json::from_value::<ByteChunk>(json!("not base64 !!!")).is_err());
-}
-
-#[test]
-fn controller_initialize_params_match_fixture() {
-    assert_round_trip(
-        ControllerInitializeParams {
-            protocol_version: CURRENT_PROTOCOL_VERSION,
-            client_name: "lightspeed-test".to_owned(),
-        },
-        fixture("controller_initialize_params"),
-    );
-}
-
-#[test]
-fn create_target_params_match_provider_fixture() {
-    assert_round_trip(
-        CreateTargetParams {
-            request_id: "request-1".to_owned(),
-            environment_id: "environment-1".to_owned(),
-            incarnation_id: "incarnation-1".to_owned(),
-            binding: ProviderBindingContext {
-                universe_id: "universe-1".to_owned(),
-                binding_id: "primary".to_owned(),
-            },
-            template_id: "lightspeed-dev-v1".to_owned(),
-        },
-        fixture("controller_create_target_params"),
+fn job_entries_report_unknown_ids_as_errors() {
+    let response: ReadJobsResponse = decode(&fixture("data/job.read.json")["response"]);
+    let JobReadEntry::Error { job_id, error } = &response.jobs[2] else {
+        panic!("expected an error entry");
+    };
+    assert_eq!(job_id.as_str(), "gone");
+    assert_eq!(error.kind(), ProtocolErrorKind::NotFound);
+    let JobReadEntry::Job { summary, .. } = &response.jobs[0] else {
+        panic!("expected a job entry");
+    };
+    assert_eq!(summary.status, JobStatus::Failed);
+    assert!(summary.status.is_terminal());
+    assert!(!JobStatus::Queued.is_terminal());
+}
+
+#[test]
+fn job_dependencies_are_kind_tagged() {
+    let params: StartJobsParams = decode(&fixture("data/job.start.json")["params"]);
+    assert!(matches!(
+        &params.jobs[1].depends_on[0],
+        JobDependency::Name { name } if name.as_str() == "setup"
+    ));
+    assert!(
+        serde_json::from_value::<JobDependency>(
+            json!({"kind": "jobId", "jobId": "a", "name": "b"})
+        )
+        .is_err()
+    );
+    let mut job = fixture("data/job.start.json")["params"].clone();
+    job["jobs"][0]["namespace"] = json!("shared");
+    assert!(serde_json::from_value::<StartJobsParams>(job).is_err());
+    let pipe = json!({"argv": ["cat"], "input": {"kind": "pipe"}});
+    let spec: environment_protocol::data::exec::CommandSpec = decode(&pipe);
+    assert_eq!(spec.input, ExecInput::Pipe {});
+}
+
+#[test]
+fn scan_roots_are_reported_independently() {
+    let response: ScanResponse = decode(&fixture("data/fs.scan.json")["response"]);
+    assert_eq!(response.roots.len(), 3);
+    assert!(matches!(
+        response.roots[1],
+        ScanRootResult::Unchanged { .. }
+    ));
+    let ScanRootResult::Complete { skipped, .. } = &response.roots[2] else {
+        panic!("expected a complete root");
+    };
+    assert!(
+        skipped[1].path.is_none(),
+        "non-UTF-8 names are counted, not returned"
     );
+    assert_eq!(FsScan::PLANE, Plane::Data);
 }
 
 #[test]
-fn create_target_response_carries_only_provider_lifecycle_state() {
-    assert_round_trip(
-        CreateTargetResponse {
-            target: ready_target_summary(),
-        },
-        fixture("controller_create_target_response"),
-    );
+fn close_by_owner_answers_closed_without_a_target_id() {
+    let response: TargetResponse = decode(&fixture("controller/target.close.json")["response"]);
+    let TargetObservation {
+        target_id, state, ..
+    } = response.target;
+    assert!(target_id.is_none());
+    assert_eq!(state.phase, TargetPhase::Closed);
+    assert!(state.power.is_none());
 }
 
 #[test]
-fn list_targets_response_matches_fixture() {
-    assert_round_trip(
-        ListTargetsResponse {
-            targets: vec![ready_target_summary()],
-        },
-        fixture("controller_list_targets_response"),
-    );
-}
-
-fn ready_target_summary() -> ProviderTargetSummary {
-    ProviderTargetSummary {
-        target_id: ProviderTargetId::new("sandbox-123"),
-        display_name: Some("lightspeed dev".to_owned()),
-        status: ProviderTargetStatus::Ready,
-        scope: EnvironmentScope::Session {
-            session_id: "sandbox-123".to_owned(),
-        },
-        capabilities: remote_environment_capabilities(),
-        default_cwd: Some("/workspace".try_into().expect("cwd")),
-        power_states: Vec::new(),
-        metadata: BTreeMap::from([("provider".to_owned(), "smolvm".to_owned())]),
-    }
+fn the_receipt_is_nested_and_typed() {
+    let response: RegisterResponse =
+        decode(&fixture("registration/registration.register.json")["response"]);
+    assert_eq!(response.receipt.daemon_id.as_str(), "daemon_3b3b");
+    let mut flattened = fixture("registration/registration.register.json")["response"].clone();
+    flattened["environmentId"] = json!("env_1");
+    assert!(serde_json::from_value::<RegisterResponse>(flattened).is_err());
 }
 
 #[test]
-fn power_vocabulary_round_trips_and_maps_steady_states() {
-    assert_eq!(SET_TARGET_POWER_METHOD, "controller/setTargetPower");
-    assert_eq!(ENV_IDLE_METHOD, "env/idle");
-    let params = SetTargetPowerParams {
-        request_id: "power-1".to_owned(),
-        environment_id: "environment-1".to_owned(),
-        incarnation_id: "incarnation-1".to_owned(),
-        binding: ProviderBindingContext {
-            universe_id: "universe-1".to_owned(),
-            binding_id: "binding-1".to_owned(),
-        },
-        target_id: ProviderTargetId::new("sandbox-123"),
-        power: PowerState::Suspended,
-    };
-    assert_round_trip(
-        params,
-        json!({
-            "requestId": "power-1",
-            "environmentId": "environment-1",
-            "incarnationId": "incarnation-1",
-            "binding": {"universeId": "universe-1", "bindingId": "binding-1"},
-            "targetId": "sandbox-123",
-            "power": "suspended"
-        }),
-    );
-    let mut summary = ready_target_summary();
-    summary.status = ProviderTargetStatus::Paused;
-    summary.power_states = vec![PowerState::Running, PowerState::Paused];
-    let encoded = serde_json::to_value(&summary).expect("serialize");
-    assert_eq!(encoded["status"], json!("paused"));
-    assert_eq!(encoded["powerStates"], json!(["running", "paused"]));
-    // A summary from a provider that predates power control decodes with an
-    // empty state list.
-    let legacy: ProviderTargetSummary =
-        serde_json::from_value(serde_json::to_value(ready_target_summary()).unwrap()).unwrap();
-    assert!(legacy.power_states.is_empty());
-    assert_eq!(
-        ProviderTargetStatus::Suspended.power_state(),
-        Some(PowerState::Suspended)
-    );
-    assert_eq!(ProviderTargetStatus::Starting.power_state(), None);
-    assert_round_trip(
-        IdleResponse {
-            idle_for_ms: 1_500,
-            running_processes: 0,
-            running_jobs: 2,
-            leftover_process_groups: 0,
-        },
-        json!({"idleForMs": 1500, "runningProcesses": 0, "runningJobs": 2}),
-    );
-}
-
-fn remote_environment_capabilities() -> EnvironmentCapabilities {
-    EnvironmentCapabilities {
-        filesystem_read: true,
-        filesystem_write: true,
-        filesystem_search: true,
-        filesystem_glob: true,
-        filesystem_ranged_read: true,
-        filesystem_capture: false,
-        filesystem_transfer: false,
-        filesystem_scan: false,
-        filesystem_materialize: false,
-        process_start: true,
-        process_stdin: true,
-        process_terminate: true,
-        process_output_polling: true,
-        process_output_notifications: true,
-        process_pty: false,
-        job_start: true,
-        job_list: true,
-        job_read: true,
-        job_cancel: true,
-        job_wait_hint: false,
-        job_dependencies: true,
-        job_queue_keys: true,
-        network: true,
-    }
+fn errors_carry_typed_data() {
+    let error: ProtocolError = decode(&fixture("data/process.read.json")["error"]);
+    assert_eq!(error.kind(), ProtocolErrorKind::NotFound);
+    assert!(matches!(
+        error.data,
+        environment_protocol::error::ErrorData::NotFound {
+            reason: Some(NotFoundReason::Expired)
+        }
+    ));
+    assert!(!error.is_retryable());
+    assert_eq!(ProcessRead::NAME, "process/read");
 }
diff --git a/crates/environment-provider-incus/CLUSTER.md b/crates/environment-provider-incus/CLUSTER.md
index 99e2d752d..adcc873fb 100644
--- a/crates/environment-provider-incus/CLUSTER.md
+++ b/crates/environment-provider-incus/CLUSTER.md
@@ -49,7 +49,10 @@ incus cluster unset member-a scheduler.instance
 
 ## Verification
 
-The non-destructive live topology/reconciliation test is opt-in:
+The live tests are opt-in. The topology and reconciliation test is
+non-destructive; `the_controller_conforms_on_live_incus` runs the controller
+conformance suite and creates and deletes one VM in the universe
+`lightspeed-conformance`, binding `incus-live`:
 
 ```bash
 LIGHTSPEED_INCUS_PROVIDER_CONFIG=/absolute/path/provider.json \
diff --git a/crates/environment-provider-incus/Cargo.toml b/crates/environment-provider-incus/Cargo.toml
index 6ac582bff..db0ce284f 100644
--- a/crates/environment-provider-incus/Cargo.toml
+++ b/crates/environment-provider-incus/Cargo.toml
@@ -19,10 +19,15 @@ sha2 = "0.11"
 thiserror = "2"
 tokio = { version = "1", features = ["fs", "macros", "net", "rt-multi-thread", "signal", "sync", "time"] }
 tokio-tungstenite = { version = "0.30", default-features = false, features = ["connect", "handshake", "rustls-tls-webpki-roots"] }
-uuid = { version = "1", features = ["v4"] }
 
 [dev-dependencies]
+# The controller conformance suite runs against this server in unit tests
+# (with an in-memory backend) and against live Incus.
+environment-client = { path = "../environment-client", features = ["conformance"] }
 tempfile = "3"
+# The data conformance suite runs against a guest envd on live Incus.
+tools = { path = "../tools" }
+uuid = { version = "1", features = ["v4"] }
 
 [[bin]]
 name = "lightspeed-provider-incus"
diff --git a/crates/environment-provider-incus/README.md b/crates/environment-provider-incus/README.md
index 1f48afeea..144fe2c1f 100644
--- a/crates/environment-provider-incus/README.md
+++ b/crates/environment-provider-incus/README.md
@@ -1,16 +1,22 @@
 # Incus environment provider
 
-`lightspeed-provider-incus` is a stateless controller, passive data endpoint,
-optional application edge, and single-node/cluster Incus adapter. It depends
-on the public host
+`lightspeed-provider-incus` is a stateless controller, data-route relay,
+optional application edge, and single-node/cluster Incus adapter. It serves
+the controller plane of the environment protocol and depends on the public
 protocol crate, not Lightspeed's database, API implementation, harness, or
 Temporal runtime.
 
-Start from `config.example.json`. Application-level authentication for both
-the provider endpoint and private envd endpoint is intentionally deferred.
-Protect those listeners with the deployment network/transport boundary for
-now. The Incus client certificate and key remain deployment files mounted into
-the provider process.
+Start from `config.example.json`. The listener serves the controller on
+`/control` and the data routes under `/routes/...`. Both require the provider
+credential: `credentialFile` names a file holding a secret of at least 32
+bytes without whitespace (a trailing newline is ignored), which Lightspeed
+presents as `Authorization: Bearer` and the provider compares in constant
+time. A missing or wrong credential is refused with HTTP 401 before the
+WebSocket upgrade. `GET /health` needs no credential. Register the same
+credential with the provider in Lightspeed. The guest envd listener has no
+authentication of its own; keep guest networks private. The Incus client
+certificate and key remain deployment files mounted into the provider
+process.
 
 ## Incus topology
 
@@ -74,9 +80,15 @@ cargo run -p environment-provider-incus -- \
   --config crates/environment-provider-incus/config.example.json
 ```
 
-Register its controller as `ws://127.0.0.1:19090/control`. Lightspeed derives
-the sibling `/routes/...` endpoint and connects only while an environment is
-being used; the provider then dials private envd and reaps idle connections.
+Register its controller as `ws://127.0.0.1:19090/control` with the credential.
+`dataRouteBase` is advertised as `routes.data` in the controller's
+`initialize`: it must reach this listener's `/routes` from the environment
+gateway, and it must use `wss://` when Lightspeed reaches the controller over
+TLS. Lightspeed connects to a data route only while an environment is being
+used; the provider then dials private envd and relays frames unchanged. The
+relay forwards WebSocket pings, counts every frame as activity, and closes a
+connection only after `relayIdleSeconds` without frames, which cannot be set
+below 60.
 Registering the provider and creating an enabled binding in Lightspeed is
 sufficient to use it. Provider configuration contains no universe or binding
 allowlist. Every request carries a binding context, and the provider lazily
@@ -108,3 +120,57 @@ bodies, and WebSockets to the approved private guest port. The provider records
 the realized hostname and port in `user.lightspeed.*` Incus target metadata so
 route operations remain ownership-fenced and reconstructible without a
 provider database or configured universe list.
+
+## Controller behavior
+
+Every controller method answers within about five seconds with the target's
+current observation. Slow Incus work (an image pull, a boot, a graceful stop)
+runs as one background job per target, serialized per target; later calls
+report `provisioning` or `closing` while it runs, and a failed create reports
+`failed` with the Incus error as the target's `message`. Job state is in
+memory; Incus itself, read through the deterministic owner name, is the record
+of every target, so a provider restart loses nothing.
+
+- `target/create` looks up the owner's instance before applying any creation
+  policy, so deprecating a template never affects existing targets.
+- `target/get` only reads. A missing instance is `notFound`.
+- `target/close` resolves the instance by owner when no target id is given,
+  stops it gracefully for up to 30 seconds, then forces the stop and deletes
+  the instance, its disk, and its ingress metadata.
+- Templates report typed `resources`. `memory` and `disk` must be whole Incus
+  sizes such as `4GiB`; the provider converts them to bytes at startup.
+- Cloud-init sets `LIGHTSPEED_ENVD_STATE_DIR=/var/lib/lightspeed-envd`, so the
+  daemon key and job records live outside the agent's `/workspace`.
+- Incus API failures answer `unavailable`, which the runtime retries.
+- The provider advertises `adoptTarget`, and `ingress` when an `ingress` block
+  is configured.
+
+## Adoption
+
+`target/adopt` takes over an existing Incus VM as a managed environment. The
+`sourceTarget` is `instance` or `project/instance`; the project defaults to
+`default`. Project and instance names are 1 to 63 ASCII letters, digits, and
+hyphens, without a leading or trailing hyphen. Only persistent virtual
+machines that are not already Lightspeed-managed can be adopted; containers
+and ephemeral instances are refused with `notAdoptable`.
+
+Adoption moves the VM into the binding's project under the owner's
+deterministic name and records ownership metadata. It replaces the VM's
+profiles with the binding baseline, rewrites `eth0` onto the binding's managed
+network, and disables every other local NIC. A running source is stopped
+first. A later close destroys the adopted VM like any other target, so adopt
+only machines whose disk Lightspeed may delete.
+
+## Conformance
+
+The ignored live test `the_controller_conforms_on_live_incus` runs the
+environment client's controller conformance suite against this provider on a
+live Incus server or cluster. It creates and deletes one VM from the first
+non-deprecated template, using the fixed universe `lightspeed-conformance` and
+binding `incus-live`:
+
+```bash
+LIGHTSPEED_INCUS_PROVIDER_CONFIG=/absolute/path/provider.json \
+  cargo test -p environment-provider-incus --test incus_live \
+  the_controller_conforms_on_live_incus -- --ignored
+```
diff --git a/crates/environment-provider-incus/config.cluster.example.json b/crates/environment-provider-incus/config.cluster.example.json
index e0755c1ce..779c8b2d1 100644
--- a/crates/environment-provider-incus/config.cluster.example.json
+++ b/crates/environment-provider-incus/config.cluster.example.json
@@ -1,5 +1,7 @@
 {
   "controllerListen": "127.0.0.1:19090",
+  "credentialFile": "/run/secrets/lightspeed-provider-credential",
+  "dataRouteBase": "ws://127.0.0.1:19090/routes",
   "incus": {
     "mode": "cluster",
     "endpoints": [
diff --git a/crates/environment-provider-incus/config.example.json b/crates/environment-provider-incus/config.example.json
index 5fd78e2d0..8bfdedbb6 100644
--- a/crates/environment-provider-incus/config.example.json
+++ b/crates/environment-provider-incus/config.example.json
@@ -1,5 +1,7 @@
 {
   "controllerListen": "127.0.0.1:19090",
+  "credentialFile": "/run/secrets/lightspeed-provider-credential",
+  "dataRouteBase": "ws://127.0.0.1:19090/routes",
   "incus": {
     "mode": "single",
     "endpoints": ["https://hz02.example.ts.net:8443"],
diff --git a/crates/environment-provider-incus/src/config.rs b/crates/environment-provider-incus/src/config.rs
index b07e40ef2..d15ac86e4 100644
--- a/crates/environment-provider-incus/src/config.rs
+++ b/crates/environment-provider-incus/src/config.rs
@@ -2,7 +2,19 @@ use std::{collections::BTreeMap, net::SocketAddr, path::PathBuf, sync::Arc};
 
 use anyhow::{Context as _, bail};
 use clap::Parser;
+use environment_protocol::{
+    bytes::SecretString,
+    control::template::TemplateResources,
+    ids::TemplateId,
+    limits::MIN_INTERMEDIARY_IDLE_MS,
+    metadata::{DescriptiveText, DisplayName},
+    routes::DataRouteBase,
+};
 use serde::{Deserialize, Serialize};
+use sha2::{Digest as _, Sha256};
+
+/// Shortest provider credential accepted, in bytes.
+const MIN_CREDENTIAL_BYTES: usize = 32;
 
 #[derive(Parser, Debug)]
 #[command(name = "lightspeed-provider-incus", version = release_info::LONG_VERSION)]
@@ -15,6 +27,12 @@ pub struct ProviderArgs {
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 struct RawConfig {
     controller_listen: SocketAddr,
+    /// File holding the provider credential Lightspeed sends as
+    /// `Authorization: Bearer` on `/control` and every data route.
+    credential_file: PathBuf,
+    /// `routes.data` advertised in `initialize`: how Lightspeed reaches this
+    /// listener's `/routes`.
+    data_route_base: String,
     incus: IncusConfig,
     templates: Vec<TemplatePolicy>,
     #[serde(default)]
@@ -26,13 +44,15 @@ struct RawConfig {
 }
 
 #[derive(Clone, Debug)]
-pub struct Config(Arc<ConfigInner>);
+pub struct Config(pub(crate) Arc<ConfigInner>);
 
 #[derive(Debug)]
 pub struct ConfigInner {
     pub controller_listen: SocketAddr,
+    pub credential: ProviderCredential,
+    pub data_route_base: DataRouteBase,
     pub incus: IncusConfig,
-    pub templates: BTreeMap<String, TemplatePolicy>,
+    pub templates: BTreeMap<TemplateId, TemplatePolicy>,
     pub network: NetworkPolicy,
     pub relay_idle_seconds: u64,
     pub dial_timeout_seconds: u64,
@@ -74,12 +94,14 @@ pub struct NetworkPolicy {
 #[derive(Clone, Debug, Deserialize, Serialize)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct TemplatePolicy {
-    pub template_id: String,
-    pub display_name: String,
-    pub description: Option<String>,
+    pub template_id: TemplateId,
+    pub display_name: DisplayName,
+    pub description: Option<DescriptiveText>,
     pub image_fingerprint: String,
     pub cpu: u32,
+    /// Incus size string, such as `4GiB`.
     pub memory: String,
+    /// Incus size string, such as `40GiB`.
     pub disk: String,
     /// Optional native Incus cluster group used as the hard placement set.
     #[serde(default)]
@@ -90,6 +112,9 @@ pub struct TemplatePolicy {
     pub ingress_port: Option<u16>,
     #[serde(default)]
     pub deprecated: bool,
+    /// `cpu`, `memory` and `disk` in provider-neutral units, derived at load.
+    #[serde(skip)]
+    pub resources: TemplateResources,
 }
 
 #[derive(Clone, Debug, Deserialize)]
@@ -114,8 +139,21 @@ impl ProviderArgs {
         if raw.templates.is_empty() {
             bail!("provider must configure at least one template")
         }
+        let envd_port = raw.envd_port.unwrap_or(19091);
+        let relay_idle_seconds = raw
+            .relay_idle_seconds
+            .unwrap_or(MIN_INTERMEDIARY_IDLE_MS / 1000);
+        if relay_idle_seconds * 1000 < MIN_INTERMEDIARY_IDLE_MS {
+            bail!(
+                "relayIdleSeconds must be at least {}: relays never idle-close a data connection sooner",
+                MIN_INTERMEDIARY_IDLE_MS / 1000
+            )
+        }
+        let data_route_base = DataRouteBase::new(raw.data_route_base.clone())
+            .with_context(|| format!("dataRouteBase {}", raw.data_route_base))?;
+        let credential = ProviderCredential::load(&raw.credential_file).await?;
         let mut templates = BTreeMap::new();
-        for template in raw.templates {
+        for mut template in raw.templates {
             if template.cluster_group.is_some() && raw.incus.mode != IncusMode::Cluster {
                 bail!(
                     "template {} selects a clusterGroup in single mode",
@@ -133,10 +171,7 @@ impl ProviderArgs {
                 )
             }
             if let Some(port) = template.ingress_port {
-                if port == 0
-                    || port == raw.envd_port.unwrap_or(19091)
-                    || matches!(port, 22 | 2375 | 2376)
-                {
+                if port == 0 || port == envd_port || matches!(port, 22 | 2375 | 2376) {
                     bail!(
                         "template {} uses a reserved management port for ingress",
                         template.template_id
@@ -149,6 +184,17 @@ impl ProviderArgs {
                     )
                 }
             }
+            template.resources = TemplateResources {
+                vcpus: Some(template.cpu),
+                memory_bytes: Some(
+                    parse_incus_size(&template.memory)
+                        .with_context(|| format!("template {} memory", template.template_id))?,
+                ),
+                disk_bytes: Some(
+                    parse_incus_size(&template.disk)
+                        .with_context(|| format!("template {} disk", template.template_id))?,
+                ),
+            };
             let template_id = template.template_id.clone();
             if templates.insert(template_id.clone(), template).is_some() {
                 bail!("duplicate provider template: {template_id}")
@@ -170,12 +216,14 @@ impl ProviderArgs {
         }
         Ok(Config(Arc::new(ConfigInner {
             controller_listen: raw.controller_listen,
+            credential,
+            data_route_base,
             incus: raw.incus,
             templates,
             network: raw.network,
-            relay_idle_seconds: raw.relay_idle_seconds.unwrap_or(60).max(1),
+            relay_idle_seconds,
             dial_timeout_seconds: raw.dial_timeout_seconds.unwrap_or(10).max(1),
-            envd_port: raw.envd_port.unwrap_or(19091),
+            envd_port,
             ingress: raw.ingress,
         })))
     }
@@ -184,6 +232,92 @@ impl ProviderArgs {
     }
 }
 
+/// The provider credential: the bearer token Lightspeed presents on
+/// `/control` and on every data route. `Debug` is redacted.
+#[derive(Clone)]
+pub struct ProviderCredential(SecretString);
+
+impl ProviderCredential {
+    pub fn new(value: impl Into<String>) -> anyhow::Result<Self> {
+        let value = value.into();
+        if value.len() < MIN_CREDENTIAL_BYTES
+            || value
+                .chars()
+                .any(|character| character.is_whitespace() || character.is_control())
+        {
+            bail!(
+                "the provider credential must be at least {MIN_CREDENTIAL_BYTES} bytes without whitespace"
+            )
+        }
+        Ok(Self(SecretString::new(value)))
+    }
+
+    async fn load(path: &std::path::Path) -> anyhow::Result<Self> {
+        let contents = tokio::fs::read_to_string(path)
+            .await
+            .with_context(|| format!("read credentialFile {}", path.display()))?;
+        Self::new(contents.trim_end_matches(['\r', '\n']))
+            .with_context(|| format!("credentialFile {}", path.display()))
+    }
+
+    pub fn expose(&self) -> &str {
+        self.0.expose()
+    }
+
+    /// True when `presented` is this credential. Compares fixed-size digests
+    /// so the time taken reveals neither the credential's length nor how
+    /// much of it matched.
+    pub fn matches(&self, presented: &str) -> bool {
+        let expected = Sha256::digest(self.0.expose().as_bytes());
+        let presented = Sha256::digest(presented.as_bytes());
+        expected
+            .iter()
+            .zip(presented.iter())
+            .fold(0u8, |difference, (left, right)| difference | (left ^ right))
+            == 0
+    }
+}
+
+impl std::fmt::Debug for ProviderCredential {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter.write_str("ProviderCredential(<redacted>)")
+    }
+}
+
+/// Bytes of an Incus size string: a whole number with an optional unit
+/// (`B`, decimal `kB` to `EB`, binary `KiB` to `EiB`), as Incus accepts
+/// for `limits.memory` and disk `size`.
+fn parse_incus_size(value: &str) -> anyhow::Result<u64> {
+    const UNITS: [(&str, u64); 13] = [
+        ("EiB", 1 << 60),
+        ("PiB", 1 << 50),
+        ("TiB", 1 << 40),
+        ("GiB", 1 << 30),
+        ("MiB", 1 << 20),
+        ("KiB", 1 << 10),
+        ("EB", 1_000_000_000_000_000_000),
+        ("PB", 1_000_000_000_000_000),
+        ("TB", 1_000_000_000_000),
+        ("GB", 1_000_000_000),
+        ("MB", 1_000_000),
+        ("kB", 1_000),
+        ("B", 1),
+    ];
+    let (number, multiplier) = UNITS
+        .iter()
+        .find_map(|(unit, multiplier)| value.strip_suffix(unit).map(|number| (number, *multiplier)))
+        .unwrap_or((value, 1));
+    if number.is_empty() || !number.bytes().all(|byte| byte.is_ascii_digit()) {
+        bail!("must be a whole number of bytes with an optional Incus unit such as GiB: {value}")
+    }
+    number
+        .parse::<u64>()
+        .ok()
+        .and_then(|number| number.checked_mul(multiplier))
+        .filter(|bytes| *bytes > 0 && *bytes < (1 << 53))
+        .ok_or_else(|| anyhow::anyhow!("size is out of range: {value}"))
+}
+
 fn validate_incus(incus: &IncusConfig) -> anyhow::Result<()> {
     if incus.endpoints.is_empty() {
         bail!("incus.endpoints must contain at least one HTTPS endpoint")
@@ -256,13 +390,6 @@ impl std::ops::Deref for Config {
 }
 
 impl Config {
-    pub fn template(&self, template_id: &str) -> anyhow::Result<&TemplatePolicy> {
-        self.templates
-            .get(template_id)
-            .filter(|template| !template.deprecated)
-            .ok_or_else(|| anyhow::anyhow!("template is not offered by this provider"))
-    }
-
     pub fn incus_mode_name(&self) -> &'static str {
         match self.incus.mode {
             IncusMode::Single => "single",
@@ -275,88 +402,169 @@ impl Config {
 mod tests {
     use super::*;
 
-    #[tokio::test(flavor = "current_thread")]
-    async fn config_loads_provider_wide_templates_without_universe_bindings() {
-        let directory = tempfile::tempdir().expect("tempdir");
-        let path = directory.path().join("provider.json");
-        let document = serde_json::json!({
+    const CREDENTIAL: &str = "0123456789abcdef0123456789abcdef";
+
+    fn base() -> serde_json::Value {
+        serde_json::json!({
             "controllerListen":"127.0.0.1:0",
+            "dataRouteBase":"ws://127.0.0.1:19090/routes",
             "incus":{"mode":"single","endpoints":["https://incus.test"],"clientCertificatePem":"cert","clientPrivateKeyPem":"key","serverCaPem":"ca","storagePool":"default"},
             "network":{"deniedEgressCidrs":["100.64.0.0/10"]},
             "templates":[{"templateId":"dev-small-v1","displayName":"Small","imageFingerprint":"abc","cpu":2,"memory":"4GiB","disk":"40GiB"}]
-        });
+        })
+    }
+
+    /// Write `document` (with `credentialFile` pointing at a fresh file
+    /// holding `credential`) and load it.
+    async fn load(
+        directory: &tempfile::TempDir,
+        mut document: serde_json::Value,
+        credential: &str,
+    ) -> anyhow::Result<Config> {
+        let credential_path = directory.path().join("credential");
+        tokio::fs::write(&credential_path, format!("{credential}\n"))
+            .await
+            .unwrap();
+        document["credentialFile"] = serde_json::json!(credential_path);
+        let path = directory.path().join("provider.json");
         tokio::fs::write(&path, serde_json::to_vec(&document).unwrap())
             .await
             .unwrap();
-        let config = ProviderArgs {
-            config: path.clone(),
-        }
-        .load()
-        .await
-        .expect("config");
-        assert!(config.template("dev-small-v1").is_ok());
+        ProviderArgs { config: path }.load().await
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn config_loads_provider_wide_templates_without_universe_bindings() {
+        let directory = tempfile::tempdir().expect("tempdir");
+        let config = load(&directory, base(), CREDENTIAL).await.expect("config");
+        let template = &config.templates[&TemplateId::new("dev-small-v1").unwrap()];
+        assert_eq!(
+            template.resources,
+            TemplateResources {
+                vcpus: Some(2),
+                memory_bytes: Some(4 << 30),
+                disk_bytes: Some(40 << 30),
+            }
+        );
         assert_eq!(config.network.denied_egress_cidrs, ["100.64.0.0/10"]);
-        let mut duplicate = document;
+        assert_eq!(config.relay_idle_seconds, 60);
+        assert_eq!(
+            config.data_route_base.as_str(),
+            "ws://127.0.0.1:19090/routes"
+        );
+
+        let mut duplicate = base();
         let first_template = duplicate["templates"][0].clone();
         duplicate["templates"]
             .as_array_mut()
             .unwrap()
             .push(first_template);
-        tokio::fs::write(&path, serde_json::to_vec(&duplicate).unwrap())
-            .await
-            .unwrap();
-        assert!(ProviderArgs { config: path }.load().await.is_err());
+        assert!(load(&directory, duplicate, CREDENTIAL).await.is_err());
     }
 
     #[tokio::test(flavor = "current_thread")]
     async fn config_rejects_invalid_provider_network_cidr() {
         let directory = tempfile::tempdir().expect("tempdir");
-        let path = directory.path().join("provider.json");
-        let document = serde_json::json!({
-            "controllerListen":"127.0.0.1:0",
-            "incus":{"mode":"single","endpoints":["https://incus.test"],"clientCertificatePem":"cert","clientPrivateKeyPem":"key","serverCaPem":"ca","storagePool":"default"},
-            "network":{"deniedEgressCidrs":["not-a-cidr"]},
-            "templates":[{"templateId":"dev-small-v1","displayName":"Small","imageFingerprint":"abc","cpu":2,"memory":"4GiB","disk":"40GiB"}]
-        });
-        tokio::fs::write(&path, serde_json::to_vec(&document).unwrap())
-            .await
-            .unwrap();
-        assert!(ProviderArgs { config: path }.load().await.is_err());
+        let mut document = base();
+        document["network"]["deniedEgressCidrs"] = serde_json::json!(["not-a-cidr"]);
+        assert!(load(&directory, document, CREDENTIAL).await.is_err());
     }
 
     #[tokio::test(flavor = "current_thread")]
     async fn config_requires_explicit_valid_mode_topology() {
         let directory = tempfile::tempdir().expect("tempdir");
-        let path = directory.path().join("provider.json");
-        let base = serde_json::json!({
-            "controllerListen":"127.0.0.1:0",
-            "incus":{"mode":"single","endpoints":["https://one.test","https://two.test"],"clientCertificatePem":"cert","clientPrivateKeyPem":"key","serverCaPem":"ca","storagePool":"default"},
-            "network":{"deniedEgressCidrs":[]},
-            "templates":[{"templateId":"t","displayName":"T","imageFingerprint":"abc","cpu":1,"memory":"1GiB","disk":"10GiB"}]
-        });
-        tokio::fs::write(&path, serde_json::to_vec(&base).unwrap())
-            .await
-            .unwrap();
+        let mut document = base();
+        document["incus"]["endpoints"] =
+            serde_json::json!(["https://one.test", "https://two.test"]);
         assert!(
-            ProviderArgs {
-                config: path.clone()
-            }
-            .load()
-            .await
-            .is_err()
+            load(&directory, document.clone(), CREDENTIAL)
+                .await
+                .is_err()
         );
 
-        let mut clustered = base;
-        clustered["incus"]["mode"] = serde_json::json!("cluster");
-        clustered["incus"]["clusterNetworkUplink"] = serde_json::json!("UPLINK");
-        clustered["templates"][0]["clusterGroup"] = serde_json::json!("x86-production");
-        tokio::fs::write(&path, serde_json::to_vec(&clustered).unwrap())
-            .await
-            .unwrap();
-        let config = ProviderArgs { config: path }
-            .load()
+        document["incus"]["mode"] = serde_json::json!("cluster");
+        document["incus"]["clusterNetworkUplink"] = serde_json::json!("UPLINK");
+        document["templates"][0]["clusterGroup"] = serde_json::json!("x86-production");
+        let config = load(&directory, document, CREDENTIAL)
             .await
             .expect("cluster config");
         assert_eq!(config.incus_mode_name(), "cluster");
     }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn config_requires_a_strong_credential_and_a_valid_route_base() {
+        let directory = tempfile::tempdir().expect("tempdir");
+        assert!(load(&directory, base(), "short").await.is_err());
+        assert!(
+            load(&directory, base(), "0123456789abcdef 0123456789abcdef")
+                .await
+                .is_err()
+        );
+        let mut document = base();
+        document["dataRouteBase"] = serde_json::json!("http://127.0.0.1:19090/routes/");
+        assert!(load(&directory, document, CREDENTIAL).await.is_err());
+        let mut document = base();
+        document.as_object_mut().unwrap().remove("credentialFile");
+        document.as_object_mut().unwrap().remove("dataRouteBase");
+        let path = directory.path().join("missing.json");
+        tokio::fs::write(&path, serde_json::to_vec(&document).unwrap())
+            .await
+            .unwrap();
+        assert!(ProviderArgs { config: path }.load().await.is_err());
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn relays_never_idle_close_below_the_protocol_minimum() {
+        let directory = tempfile::tempdir().expect("tempdir");
+        let mut document = base();
+        document["relayIdleSeconds"] = serde_json::json!(59);
+        assert!(
+            load(&directory, document.clone(), CREDENTIAL)
+                .await
+                .is_err()
+        );
+        document["relayIdleSeconds"] = serde_json::json!(1900);
+        let config = load(&directory, document, CREDENTIAL)
+            .await
+            .expect("config");
+        assert_eq!(config.relay_idle_seconds, 1900);
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn template_sizes_and_descriptions_are_validated_at_load() {
+        let directory = tempfile::tempdir().expect("tempdir");
+        for (field, value) in [
+            ("memory", serde_json::json!("50%")),
+            ("disk", serde_json::json!("lots")),
+            ("displayName", serde_json::json!("")),
+            ("description", serde_json::json!("a\u{0}b")),
+            ("templateId", serde_json::json!("")),
+        ] {
+            let mut document = base();
+            document["templates"][0][field] = value;
+            assert!(
+                load(&directory, document, CREDENTIAL).await.is_err(),
+                "{field}"
+            );
+        }
+    }
+
+    #[test]
+    fn incus_sizes_parse_decimal_and_binary_units() {
+        assert_eq!(parse_incus_size("4GiB").unwrap(), 4 << 30);
+        assert_eq!(parse_incus_size("512MB").unwrap(), 512_000_000);
+        assert_eq!(parse_incus_size("1024").unwrap(), 1024);
+        assert!(parse_incus_size("GiB").is_err());
+        assert!(parse_incus_size("1.5GiB").is_err());
+        assert!(parse_incus_size("0").is_err());
+    }
+
+    #[test]
+    fn credential_comparison_needs_the_exact_value() {
+        let credential = ProviderCredential::new(CREDENTIAL).unwrap();
+        assert!(credential.matches(CREDENTIAL));
+        assert!(!credential.matches(&CREDENTIAL[1..]));
+        assert!(!credential.matches(""));
+        assert!(!format!("{credential:?}").contains(CREDENTIAL));
+    }
 }
diff --git a/crates/environment-provider-incus/src/edge.rs b/crates/environment-provider-incus/src/edge.rs
index e3812d70d..7a9bcb9e1 100644
--- a/crates/environment-provider-incus/src/edge.rs
+++ b/crates/environment-provider-incus/src/edge.rs
@@ -134,7 +134,7 @@ async fn resolve<B: IncusBackend>(
 fn resolve_targets(targets: Vec<crate::incus::OwnedTarget>, hostname: &str) -> Option<Route> {
     for target in targets {
         if target.ingress_hostname.as_deref() == Some(hostname)
-            && target.status == environment_protocol::control::targets::ProviderTargetStatus::Ready
+            && target.status == crate::incus::InstanceStatus::Running
             && let (Some(address), Some(port)) = (target.ipv4_address, target.ingress_port)
         {
             return Some(Route { address, port });
@@ -188,32 +188,20 @@ async fn proxy_websocket(mut client: WebSocket, endpoint: String) {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::incus::OwnedTarget;
+    use crate::incus::{InstanceStatus, OwnedTarget};
     use axum::{Router, extract::WebSocketUpgrade, routing::get};
-    use environment_protocol::{control::targets::ProviderTargetStatus, shared::ProviderTargetId};
     use std::time::Duration;
 
-    fn target(status: ProviderTargetStatus, hostname: Option<&str>) -> OwnedTarget {
+    fn target(status: InstanceStatus, hostname: Option<&str>) -> OwnedTarget {
         OwnedTarget {
-            target_id: ProviderTargetId::new("target-a"),
-            name: "target-a".to_owned(),
-            universe_id: "universe-a".to_owned(),
-            binding_id: "binding-a".to_owned(),
-            environment_id: "environment-a".to_owned(),
-            incarnation_id: "incarnation-a".to_owned(),
-            request_id: "request-a".to_owned(),
-            template_id: "template-a".to_owned(),
-            image_fingerprint: "fingerprint-a".to_owned(),
-            adoption_source: None,
             status,
-            ipv4_address: Some("10.0.0.2".to_owned()),
             ingress_hostname: hostname.map(ToOwned::to_owned),
             ingress_port: Some(8080),
-            location: None,
+            ..crate::ingress::tests::target()
         }
     }
 
-    #[tokio::test]
+    #[tokio::test(flavor = "current_thread")]
     async fn ingress_proxy_closes_upstream_when_client_disappears() {
         let upstream_listener = tokio::net::TcpListener::bind("127.0.0.1:0")
             .await
@@ -268,7 +256,7 @@ mod tests {
     fn authorization_resolves_only_the_exact_ready_ingress_hostname() {
         let hostname = "route.env.example.com";
         let route = resolve_targets(
-            vec![target(ProviderTargetStatus::Ready, Some(hostname))],
+            vec![target(InstanceStatus::Running, Some(hostname))],
             hostname,
         )
         .expect("ready route");
@@ -277,14 +265,14 @@ mod tests {
 
         assert!(
             resolve_targets(
-                vec![target(ProviderTargetStatus::Starting, Some(hostname))],
+                vec![target(InstanceStatus::Starting, Some(hostname))],
                 hostname,
             )
             .is_none()
         );
         assert!(
             resolve_targets(
-                vec![target(ProviderTargetStatus::Ready, Some(hostname))],
+                vec![target(InstanceStatus::Running, Some(hostname))],
                 "other.env.example.com",
             )
             .is_none()
diff --git a/crates/environment-provider-incus/src/incus.rs b/crates/environment-provider-incus/src/incus.rs
index 53a94f72f..d256a7091 100644
--- a/crates/environment-provider-incus/src/incus.rs
+++ b/crates/environment-provider-incus/src/incus.rs
@@ -15,11 +15,10 @@ use serde_json::{Value, json};
 use thiserror::Error;
 
 use environment_protocol::{
-    control::targets::{
-        AdoptTargetParams, CreateTargetParams, PowerState, ProviderBindingContext,
-        ProviderTargetStatus,
+    control::target::{BindingRef, PowerState, TargetOwner},
+    ids::{
+        BindingId, EnvironmentId, IncarnationId, ProviderNativeRef, ProviderTargetId, UniverseId,
     },
-    shared::ProviderTargetId,
 };
 
 use crate::{
@@ -27,19 +26,16 @@ use crate::{
     policy,
 };
 
+/// A Lightspeed-managed Incus instance, read from its ownership metadata.
 #[derive(Clone, Debug)]
 pub struct OwnedTarget {
+    /// The instance name, which is the deterministic name of `owner`.
     pub target_id: ProviderTargetId,
-    pub name: String,
-    pub universe_id: String,
-    pub binding_id: String,
-    pub environment_id: String,
-    pub incarnation_id: String,
-    pub request_id: String,
+    pub owner: TargetOwner,
     pub template_id: String,
     pub image_fingerprint: String,
     pub adoption_source: Option<String>,
-    pub status: ProviderTargetStatus,
+    pub status: InstanceStatus,
     pub ipv4_address: Option<String>,
     pub ingress_hostname: Option<String>,
     pub ingress_port: Option<u16>,
@@ -48,54 +44,94 @@ pub struct OwnedTarget {
     pub location: Option<String>,
 }
 
+impl OwnedTarget {
+    pub fn name(&self) -> &str {
+        self.target_id.as_str()
+    }
+
+    pub fn binding(&self) -> BindingRef {
+        policy::binding_of(&self.owner)
+    }
+}
+
+/// Incus instance status, reduced to what the provider acts on.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum InstanceStatus {
+    Running,
+    Starting,
+    Stopping,
+    Stopped,
+    /// `Frozen` or `Freezing`: a paused VM.
+    Frozen,
+    Error,
+    /// Any other status Incus reports.
+    Other,
+}
+
+impl InstanceStatus {
+    fn from_incus(status: &str) -> Self {
+        match status {
+            "Running" | "Thawed" => Self::Running,
+            "Starting" => Self::Starting,
+            "Stopping" => Self::Stopping,
+            "Stopped" => Self::Stopped,
+            "Frozen" | "Freezing" => Self::Frozen,
+            "Error" => Self::Error,
+            _ => Self::Other,
+        }
+    }
+}
+
+/// What an adoption source is, checked before any change is made.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum AdoptionSource {
+    Missing,
+    /// A stopped or running, persistent, unmanaged virtual machine.
+    Adoptable,
+    /// Already managed by Lightspeed, so it belongs to some owner.
+    Managed,
+    /// It exists but cannot be taken over; the text says why.
+    NotAdoptable(&'static str),
+}
+
+/// The Incus operations the controller needs. Mutations are slow (image
+/// pulls, boots, graceful shutdowns); the controller runs them in the
+/// background and observes the result with [`IncusBackend::get_owned`].
 #[async_trait]
 pub trait IncusBackend: Clone + Send + Sync + 'static {
     async fn topology(&self) -> anyhow::Result<IncusTopology>;
-    async fn reconcile_binding(&self, binding: &ProviderBindingContext) -> anyhow::Result<()>;
+    async fn reconcile_binding(&self, binding: &BindingRef) -> anyhow::Result<()>;
     async fn ensure_image(&self, fingerprint: &str) -> anyhow::Result<()>;
-    async fn list_owned(
-        &self,
-        binding: &ProviderBindingContext,
-    ) -> anyhow::Result<Vec<OwnedTarget>>;
     async fn list_all_owned(&self) -> anyhow::Result<Vec<OwnedTarget>>;
+    /// The managed instance `name` in the binding's project. `None` when the
+    /// project or instance does not exist, when `name` is not an Incus
+    /// instance name, or when the instance carries no valid ownership
+    /// metadata.
     async fn get_owned(
         &self,
-        binding: &ProviderBindingContext,
-        target_id: &ProviderTargetId,
+        binding: &BindingRef,
+        name: &str,
     ) -> anyhow::Result<Option<OwnedTarget>>;
-    async fn create_vm(
-        &self,
-        binding: &ProviderBindingContext,
-        template: &TemplatePolicy,
-        params: &CreateTargetParams,
-    ) -> anyhow::Result<OwnedTarget>;
-    async fn adopt_vm(
-        &self,
-        binding: &ProviderBindingContext,
-        params: &AdoptTargetParams,
-    ) -> anyhow::Result<OwnedTarget>;
-    async fn delete_vm(
-        &self,
-        binding: &ProviderBindingContext,
-        target: &OwnedTarget,
-        force: bool,
-    ) -> anyhow::Result<()>;
+    /// Create the owner's instance from the template and start it.
+    async fn create_vm(&self, owner: &TargetOwner, template: &TemplatePolicy)
+    -> anyhow::Result<()>;
+    async fn adoption_source(&self, source: &ProviderNativeRef) -> anyhow::Result<AdoptionSource>;
+    /// Move the source into the owner's project under the owner's name and
+    /// start it.
+    async fn adopt_vm(&self, owner: &TargetOwner, source: &ProviderNativeRef)
+    -> anyhow::Result<()>;
+    /// Destroy the instance: a graceful stop within 30 s, then a forced stop,
+    /// then delete. Its ingress metadata goes with it.
+    async fn delete_vm(&self, target: &OwnedTarget) -> anyhow::Result<()>;
+    /// Record (or with `None` clear) the realized ingress hostname and port.
     async fn set_ingress(
         &self,
-        binding: &ProviderBindingContext,
         target: &OwnedTarget,
-        hostname: Option<&str>,
-        port: Option<u16>,
-    ) -> anyhow::Result<OwnedTarget>;
-    /// Converge one owned instance toward `power`. Idempotent by inventory;
-    /// transitional instances are reported as observed and converged on a
-    /// later call.
-    async fn set_power(
-        &self,
-        binding: &ProviderBindingContext,
-        target: &OwnedTarget,
-        power: PowerState,
-    ) -> anyhow::Result<OwnedTarget>;
+        route: Option<(&str, u16)>,
+    ) -> anyhow::Result<()>;
+    /// Converge the instance toward `power`. A stopped VM asked to pause is
+    /// started; a later call freezes it.
+    async fn set_power(&self, target: &OwnedTarget, power: PowerState) -> anyhow::Result<()>;
 }
 
 /// Power states the Incus provider can move a VM to. Stateful stop
@@ -103,6 +139,16 @@ pub trait IncusBackend: Clone + Send + Sync + 'static {
 pub const SUPPORTED_POWER_STATES: [PowerState; 3] =
     [PowerState::Running, PowerState::Paused, PowerState::Stopped];
 
+/// envd's state directory inside every VM: outside the agent's working tree
+/// and writable by the service (`ReadWritePaths` in the image's unit).
+pub const ENVD_STATE_DIR: &str = "/var/lib/lightspeed-envd";
+
+/// Bound on one graceful Incus state action, in seconds.
+const STATE_ACTION_TIMEOUT_SECONDS: i64 = 30;
+
+/// `template` and `image` metadata of an adopted target.
+pub const ADOPTED: &str = "adopted";
+
 #[derive(Clone, Debug, serde::Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct IncusTopology {
@@ -444,6 +490,9 @@ impl IncusClient {
     }
 
     async fn instance(&self, project: &str, name: &str) -> anyhow::Result<Option<OwnedTarget>> {
+        if !policy::is_instance_name(name) {
+            return Ok(None);
+        }
         if !self
             .exists(&format!("/instances/{name}"), Some(project))
             .await?
@@ -467,13 +516,7 @@ impl IncusClient {
             )
             .await
             .unwrap_or_default();
-        owned_from_instance(instance, state).map(Some)
-    }
-
-    async fn observed_instance(&self, project: &str, name: &str) -> anyhow::Result<OwnedTarget> {
-        self.instance(project, name)
-            .await?
-            .ok_or_else(|| anyhow::anyhow!("Incus target disappeared during a power change"))
+        Ok(owned_from_instance(instance, state))
     }
 
     async fn instance_state_action(
@@ -481,7 +524,7 @@ impl IncusClient {
         project: &str,
         name: &str,
         action: &str,
-        timeout: u64,
+        timeout: i64,
         force: bool,
     ) -> anyhow::Result<()> {
         self.request_unit(
@@ -493,6 +536,44 @@ impl IncusClient {
         .await
     }
 
+    /// Run a state action; when it fails, accept it anyway if the instance
+    /// already reached a status in `reached` (a stale read, a transport
+    /// failure after Incus accepted the action, or a concurrent change).
+    async fn converge_state(
+        &self,
+        project: &str,
+        name: &str,
+        action: &str,
+        force: bool,
+        reached: &[InstanceStatus],
+    ) -> anyhow::Result<()> {
+        let Err(error) = self
+            .instance_state_action(project, name, action, STATE_ACTION_TIMEOUT_SECONDS, force)
+            .await
+        else {
+            return Ok(());
+        };
+        match self.instance(project, name).await? {
+            Some(target) if reached.contains(&target.status) => Ok(()),
+            None if action == "stop" => Ok(()),
+            _ => Err(error),
+        }
+    }
+
+    /// Incus can briefly report the pre-operation `Stopped` status right
+    /// after a start operation succeeds. Wait a few seconds for the first
+    /// post-start status so the next observation is not stale.
+    async fn settle_after_start(&self, project: &str, name: &str) -> anyhow::Result<()> {
+        for _ in 0..10 {
+            match self.instance(project, name).await? {
+                Some(target) if target.status != InstanceStatus::Stopped => return Ok(()),
+                None => anyhow::bail!("the Incus instance disappeared while starting"),
+                Some(_) => tokio::time::sleep(Duration::from_millis(500)).await,
+            }
+        }
+        Ok(())
+    }
+
     async fn raw_instance(&self, project: &str, name: &str) -> anyhow::Result<Option<Instance>> {
         if !self
             .exists(&format!("/instances/{name}"), Some(project))
@@ -516,7 +597,7 @@ impl IncusClient {
             .await?;
         let mut networks = Vec::new();
         for project in projects {
-            let Some(binding) = project.binding_context() else {
+            let Some(binding) = project.binding() else {
                 continue;
             };
             let network_name = policy::network_name(&binding);
@@ -651,12 +732,12 @@ impl IncusBackend for IncusClient {
         })
     }
 
-    async fn reconcile_binding(&self, binding: &ProviderBindingContext) -> anyhow::Result<()> {
+    async fn reconcile_binding(&self, binding: &BindingRef) -> anyhow::Result<()> {
         let _reconcile_guard = self.reconcile_lock.lock().await;
         let project = policy::project_name(binding);
         let isolated_project_networks = self.config.incus.mode == IncusMode::Cluster;
         let network_project = network_resource_project(self.config.incus.mode, &project);
-        self.ensure_resource(&format!("/projects/{project}"), "/projects", None, json!({"name":project,"description":"Lightspeed managed binding","config":{"features.images":"false","features.networks":isolated_project_networks.to_string(),"features.profiles":"true","restricted":"true","restricted.devices.nic":"managed","restricted.devices.disk":"managed","restricted.networks.access":policy::network_name(binding),"user.lightspeed.managed":"true","user.lightspeed.universe":binding.universe_id,"user.lightspeed.binding":binding.binding_id}})).await?;
+        self.ensure_resource(&format!("/projects/{project}"), "/projects", None, json!({"name":project,"description":"Lightspeed managed binding","config":{"features.images":"false","features.networks":isolated_project_networks.to_string(),"features.profiles":"true","restricted":"true","restricted.devices.nic":"managed","restricted.devices.disk":"managed","restricted.networks.access":policy::network_name(binding),"user.lightspeed.managed":"true","user.lightspeed.universe":binding.universe_id.as_str(),"user.lightspeed.binding":binding.binding_id.as_str()}})).await?;
         self.ensure_resource(&format!("/network-acls/{}", policy::acl_name(binding)), "/network-acls", network_project, json!({"name":policy::acl_name(binding),"description":"Lightspeed binding baseline","ingress":[],"egress":[],"config":{}})).await?;
         let network = match self.config.incus.mode {
             IncusMode::Single => {
@@ -693,35 +774,6 @@ impl IncusBackend for IncusClient {
         Ok(())
     }
 
-    async fn list_owned(
-        &self,
-        binding: &ProviderBindingContext,
-    ) -> anyhow::Result<Vec<OwnedTarget>> {
-        let project = policy::project_name(binding);
-        if !self.exists(&format!("/projects/{project}"), None).await? {
-            return Ok(Vec::new());
-        }
-        let instances: Vec<Instance> = self
-            .request(Method::GET, "/instances?recursion=1", Some(&project), None)
-            .await?;
-        let mut targets = Vec::new();
-        for instance in instances {
-            let state = self
-                .request(
-                    Method::GET,
-                    &format!("/instances/{}/state", instance.name),
-                    Some(&project),
-                    None,
-                )
-                .await
-                .unwrap_or_default();
-            if let Ok(target) = owned_from_instance(instance, state) {
-                targets.push(target);
-            }
-        }
-        Ok(targets)
-    }
-
     async fn list_all_owned(&self) -> anyhow::Result<Vec<OwnedTarget>> {
         let projects: Vec<Project> = self
             .request(Method::GET, "/projects?recursion=1", None, None)
@@ -746,14 +798,10 @@ impl IncusBackend for IncusClient {
                     )
                     .await
                     .unwrap_or_default();
-                if let Ok(target) = owned_from_instance(instance, state) {
-                    let binding = ProviderBindingContext {
-                        universe_id: target.universe_id.clone(),
-                        binding_id: target.binding_id.clone(),
-                    };
-                    if project.name == policy::project_name(&binding) {
-                        targets.push(target);
-                    }
+                if let Some(target) = owned_from_instance(instance, state)
+                    && project.name == policy::project_name(&target.binding())
+                {
+                    targets.push(target);
                 }
             }
         }
@@ -762,68 +810,52 @@ impl IncusBackend for IncusClient {
 
     async fn get_owned(
         &self,
-        binding: &ProviderBindingContext,
-        target_id: &ProviderTargetId,
+        binding: &BindingRef,
+        name: &str,
     ) -> anyhow::Result<Option<OwnedTarget>> {
-        self.instance(&policy::project_name(binding), target_id.as_str())
-            .await
+        if !policy::is_instance_name(name) {
+            return Ok(None);
+        }
+        let project = policy::project_name(binding);
+        if !self.exists(&format!("/projects/{project}"), None).await? {
+            return Ok(None);
+        }
+        Ok(self
+            .instance(&project, name)
+            .await?
+            .filter(|target| target.binding() == *binding))
     }
 
     async fn create_vm(
         &self,
-        binding: &ProviderBindingContext,
+        owner: &TargetOwner,
         template: &TemplatePolicy,
-        params: &CreateTargetParams,
-    ) -> anyhow::Result<OwnedTarget> {
-        let project = policy::project_name(binding);
-        let name = policy::instance_name(
-            &binding.universe_id,
-            &binding.binding_id,
-            &params.environment_id,
-            &params.incarnation_id,
-        );
+    ) -> anyhow::Result<()> {
+        let binding = policy::binding_of(owner);
+        let project = policy::project_name(&binding);
+        let name = policy::instance_name(owner);
         let created_at = std::time::SystemTime::now()
             .duration_since(std::time::UNIX_EPOCH)?
             .as_millis()
             .to_string();
         let cloud_init = format!(
-            "#cloud-config\nwrite_files:\n  - path: /etc/lightspeed-envd/provider.env\n    permissions: '0600'\n    content: |\n      LIGHTSPEED_ENVD_LISTEN=0.0.0.0:{}\n      LIGHTSPEED_ENVD_CWD=/workspace\n      LIGHTSPEED_ENVD_FS_ROOT=/\nruncmd:\n  - [mkdir, -p, /workspace]\n  - [systemctl, enable, --now, lightspeed-envd]\n",
-            self.config.envd_port
+            "#cloud-config\nwrite_files:\n  - path: /etc/lightspeed-envd/provider.env\n    permissions: '0600'\n    content: |\n      LIGHTSPEED_ENVD_LISTEN=0.0.0.0:{}\n      LIGHTSPEED_ENVD_CWD=/workspace\n      LIGHTSPEED_ENVD_FS_ROOT=/\n      LIGHTSPEED_ENVD_STATE_DIR={}\nruncmd:\n  - [mkdir, -p, /workspace]\n  - [systemctl, enable, --now, lightspeed-envd]\n",
+            self.config.envd_port, ENVD_STATE_DIR,
         );
-        let config = BTreeMap::from([
+        let mut config = ownership_config(owner);
+        config.extend([
             ("limits.cpu".to_owned(), template.cpu.to_string()),
             ("limits.memory".to_owned(), template.memory.clone()),
             ("cloud-init.user-data".to_owned(), cloud_init),
-            ("user.lightspeed.managed".to_owned(), "true".to_owned()),
-            (
-                "user.lightspeed.universe".to_owned(),
-                params.binding.universe_id.clone(),
-            ),
             (
-                "user.lightspeed.binding".to_owned(),
-                params.binding.binding_id.clone(),
-            ),
-            (
-                "user.lightspeed.environment".to_owned(),
-                params.environment_id.clone(),
-            ),
-            (
-                "user.lightspeed.incarnation".to_owned(),
-                params.incarnation_id.clone(),
-            ),
-            (
-                "user.lightspeed.request".to_owned(),
-                params.request_id.clone(),
-            ),
-            (
-                "user.lightspeed.template".to_owned(),
-                template.template_id.clone(),
+                format!("{}template", policy::META_PREFIX),
+                template.template_id.to_string(),
             ),
             (
-                "user.lightspeed.image".to_owned(),
+                format!("{}image", policy::META_PREFIX),
                 template.image_fingerprint.clone(),
             ),
-            ("user.lightspeed.created_at_ms".to_owned(), created_at),
+            (format!("{}created_at_ms", policy::META_PREFIX), created_at),
         ]);
         let path = if let Some(group) = &template.cluster_group {
             if !self
@@ -836,112 +868,65 @@ impl IncusBackend for IncusClient {
         } else {
             "/instances".to_owned()
         };
-        if let Err(create_error) = self.request_unit(Method::POST, &path, Some(&project), Some(json!({"name":name,"type":"virtual-machine","start":false,"profiles":[policy::profile_name(binding)],"source":{"type":"image","fingerprint":template.image_fingerprint},"config":config,"devices":{"root":{"type":"disk","pool":self.config.incus.storage_pool,"path":"/","size":template.disk}}}))).await {
+        if let Err(create_error) = self.request_unit(Method::POST, &path, Some(&project), Some(json!({"name":name,"type":"virtual-machine","start":false,"profiles":[policy::profile_name(&binding)],"source":{"type":"image","fingerprint":template.image_fingerprint},"config":config,"devices":{"root":{"type":"disk","pool":self.config.incus.storage_pool,"path":"/","size":template.disk}}}))).await
             // A transport can fail after Incus accepted the deterministic
             // create. Resolve that uncertainty before returning an error.
-            if let Some(target) = self.instance(&project, &name).await? {
-                return Ok(target);
-            }
-            return Err(create_error);
-        }
-        if let Err(error) = self
-            .request_unit(
-                Method::PUT,
-                &format!("/instances/{name}/state"),
-                Some(&project),
-                Some(json!({"action":"start","timeout":30,"force":false})),
-            )
-            .await
+            && self.instance(&project, &name).await?.is_none()
         {
-            let observed = self.instance(&project, &name).await?;
-            if !observed.as_ref().is_some_and(|target| {
-                matches!(
-                    target.status,
-                    ProviderTargetStatus::Starting | ProviderTargetStatus::Ready
-                )
-            }) {
-                return Err(error);
-            }
+            return Err(create_error);
         }
-        let target = self
-            .instance(&project, &name)
-            .await?
-            .ok_or_else(|| anyhow::anyhow!("created Incus instance disappeared"))?;
-        Ok(target_after_accepted_start(target))
+        start_instance(self, &project, &name).await
+    }
+
+    async fn adoption_source(&self, source: &ProviderNativeRef) -> anyhow::Result<AdoptionSource> {
+        let (source_project, source_name) = parse_source_target(source.as_str())?;
+        let Some(source) = self.raw_instance(source_project, source_name).await? else {
+            return Ok(AdoptionSource::Missing);
+        };
+        Ok(classify_adoption_source(&source))
     }
 
     async fn adopt_vm(
         &self,
-        binding: &ProviderBindingContext,
-        params: &AdoptTargetParams,
-    ) -> anyhow::Result<OwnedTarget> {
-        let project = policy::project_name(binding);
-        let destination = policy::instance_name(
-            &binding.universe_id,
-            &binding.binding_id,
-            &params.environment_id,
-            &params.incarnation_id,
-        );
-        if let Some(target) = self.instance(&project, &destination).await? {
-            verify_adopted_target(&target, params)?;
-            return ensure_instance_started(self, &project, &destination, target).await;
+        owner: &TargetOwner,
+        source_target: &ProviderNativeRef,
+    ) -> anyhow::Result<()> {
+        let binding = policy::binding_of(owner);
+        let project = policy::project_name(&binding);
+        let destination = policy::instance_name(owner);
+        if self.instance(&project, &destination).await?.is_some() {
+            return start_instance(self, &project, &destination).await;
         }
 
-        let (source_project, source_name) = parse_source_target(&params.source_target)?;
+        let (source_project, source_name) = parse_source_target(source_target.as_str())?;
         let source = self
             .raw_instance(source_project, source_name)
             .await?
             .ok_or_else(|| anyhow::anyhow!("Incus adoption source target not found"))?;
-        if source.kind != "virtual-machine" {
-            anyhow::bail!("only Incus virtual-machine instances can be adopted")
-        }
-        if source.ephemeral {
-            anyhow::bail!("ephemeral Incus instances cannot be adopted")
-        }
-        if source
-            .config
-            .get(&format!("{}managed", policy::META_PREFIX))
-            .is_some_and(|value| value == "true")
-        {
-            anyhow::bail!("Incus source target is already Lightspeed-managed")
+        match classify_adoption_source(&source) {
+            AdoptionSource::Adoptable => {}
+            AdoptionSource::Managed => {
+                anyhow::bail!("Incus source target is already Lightspeed-managed")
+            }
+            AdoptionSource::NotAdoptable(reason) => {
+                anyhow::bail!("Incus source target cannot be adopted: {reason}")
+            }
+            AdoptionSource::Missing => anyhow::bail!("Incus adoption source target not found"),
         }
 
         // Incus merges these overrides with the instance's existing local
         // configuration during a cross-project move. User configuration is
         // therefore preserved while ownership metadata is added.
-        let config = BTreeMap::from([
-            (format!("{}managed", policy::META_PREFIX), "true".to_owned()),
-            (
-                format!("{}universe", policy::META_PREFIX),
-                binding.universe_id.clone(),
-            ),
-            (
-                format!("{}binding", policy::META_PREFIX),
-                binding.binding_id.clone(),
-            ),
-            (
-                format!("{}environment", policy::META_PREFIX),
-                params.environment_id.clone(),
-            ),
-            (
-                format!("{}incarnation", policy::META_PREFIX),
-                params.incarnation_id.clone(),
-            ),
-            (
-                format!("{}request", policy::META_PREFIX),
-                params.request_id.clone(),
-            ),
+        let mut config = ownership_config(owner);
+        config.extend([
             (
                 format!("{}template", policy::META_PREFIX),
-                "adopted".to_owned(),
-            ),
-            (
-                format!("{}image", policy::META_PREFIX),
-                "adopted".to_owned(),
+                ADOPTED.to_owned(),
             ),
+            (format!("{}image", policy::META_PREFIX), ADOPTED.to_owned()),
             (
                 format!("{}adoption_source", policy::META_PREFIX),
-                params.source_target.clone(),
+                source_target.to_string(),
             ),
         ]);
 
@@ -957,7 +942,7 @@ impl IncusBackend for IncusClient {
             let replacement = if name == "eth0" {
                 json!({
                     "type":"nic",
-                    "network":policy::network_name(binding),
+                    "network":policy::network_name(&binding),
                     "security.port_isolation":"true",
                     "security.ipv4_filtering":"true"
                 })
@@ -972,7 +957,7 @@ impl IncusBackend for IncusClient {
                 Method::PUT,
                 &format!("/instances/{source_name}/state"),
                 Some(source_project),
-                Some(json!({"action":"stop","timeout":30,"force":true})),
+                Some(json!({"action":"stop","timeout":STATE_ACTION_TIMEOUT_SECONDS,"force":true})),
             )
             .await
             .context("stop Incus source target before adoption")?;
@@ -992,7 +977,7 @@ impl IncusBackend for IncusClient {
                     "instance_only":false,
                     "config":config,
                     "devices":devices,
-                    "profiles":[policy::profile_name(binding)]
+                    "profiles":[policy::profile_name(&binding)]
                 })),
             )
             .await
@@ -1004,158 +989,138 @@ impl IncusBackend for IncusClient {
             .instance(&project, &destination)
             .await?
             .ok_or_else(|| anyhow::anyhow!("adopted Incus target is not visible"))?;
-        verify_adopted_target(&target, params)?;
-        ensure_instance_started(self, &project, &destination, target).await
+        if target.owner != *owner
+            || target.adoption_source.as_deref() != Some(source_target.as_str())
+        {
+            anyhow::bail!("adopted Incus target carries unexpected ownership metadata")
+        }
+        start_instance(self, &project, &destination).await
     }
 
-    async fn delete_vm(
-        &self,
-        binding: &ProviderBindingContext,
-        target: &OwnedTarget,
-        force: bool,
-    ) -> anyhow::Result<()> {
-        let project = policy::project_name(binding);
-        if target.status != ProviderTargetStatus::Stopped {
-            let stop_result = self
-                .request_unit(
-                    Method::PUT,
-                    &format!("/instances/{}/state", target.name),
-                    Some(&project),
-                    Some(json!({
-                        "action":"stop",
-                        "timeout": if force { 0 } else { 30 },
-                        "force": force
-                    })),
-                )
+    async fn delete_vm(&self, target: &OwnedTarget) -> anyhow::Result<()> {
+        let project = policy::project_name(&target.binding());
+        let name = target.name();
+        if target.status != InstanceStatus::Stopped {
+            // Graceful first; a guest that ignores ACPI power-down (a hung
+            // kernel, an emergency shell) is then stopped by force, since its
+            // disk is destroyed either way.
+            let graceful = self
+                .converge_state(&project, name, "stop", false, &[InstanceStatus::Stopped])
                 .await;
-            if let Err(error) = stop_result {
-                let observed = self.instance(&project, &target.name).await?;
-                if observed
-                    .as_ref()
-                    .is_some_and(|target| target.status != ProviderTargetStatus::Stopped)
-                {
-                    return Err(error);
-                }
+            if graceful.is_err() {
+                self.converge_state(&project, name, "stop", true, &[InstanceStatus::Stopped])
+                    .await
+                    .context("force-stop Incus instance before delete")?;
             }
         }
         if let Err(error) = self
             .request_unit(
                 Method::DELETE,
-                &format!("/instances/{}", target.name),
+                &format!("/instances/{name}"),
                 Some(&project),
                 None,
             )
             .await
-            && self.instance(&project, &target.name).await?.is_some()
+            && self.instance(&project, name).await?.is_some()
         {
             return Err(error);
         }
         Ok(())
     }
 
-    async fn set_power(
-        &self,
-        binding: &ProviderBindingContext,
-        target: &OwnedTarget,
-        power: PowerState,
-    ) -> anyhow::Result<OwnedTarget> {
+    async fn set_power(&self, target: &OwnedTarget, power: PowerState) -> anyhow::Result<()> {
         if !SUPPORTED_POWER_STATES.contains(&power) {
             anyhow::bail!("Incus provider does not support power state {power}")
         }
-        let project = policy::project_name(binding);
-        let name = target.name.clone();
+        let project = policy::project_name(&target.binding());
+        let name = target.name();
         match (target.status, power) {
-            // Already there or already on the way: report the observation.
-            (ProviderTargetStatus::Ready | ProviderTargetStatus::Starting, PowerState::Running)
-            | (ProviderTargetStatus::Paused, PowerState::Paused)
-            | (ProviderTargetStatus::Stopped, PowerState::Stopped) => Ok(target.clone()),
-            (ProviderTargetStatus::Paused, PowerState::Running) => {
-                self.instance_state_action(&project, &name, "unfreeze", 30, false)
-                    .await?;
-                let observed = self.observed_instance(&project, &name).await?;
-                Ok(target_after_accepted_resume(observed))
+            // Already there or already on the way.
+            (InstanceStatus::Running | InstanceStatus::Starting, PowerState::Running)
+            | (InstanceStatus::Frozen, PowerState::Paused)
+            | (InstanceStatus::Stopped | InstanceStatus::Stopping, PowerState::Stopped) => Ok(()),
+            (InstanceStatus::Frozen, PowerState::Running) => {
+                self.converge_state(
+                    &project,
+                    name,
+                    "unfreeze",
+                    false,
+                    &[InstanceStatus::Running],
+                )
+                .await
             }
-            (ProviderTargetStatus::Stopped, PowerState::Running | PowerState::Paused) => {
+            (InstanceStatus::Stopped, PowerState::Running | PowerState::Paused) => {
                 // A stopped VM cannot be frozen directly; converge through
                 // running and let a later call freeze it.
-                ensure_instance_started(self, &project, &name, target.clone()).await
+                start_instance(self, &project, name).await
             }
-            (ProviderTargetStatus::Ready, PowerState::Paused) => {
-                self.instance_state_action(&project, &name, "freeze", 30, false)
-                    .await?;
-                let observed = self.observed_instance(&project, &name).await?;
-                Ok(target_after_accepted_freeze(observed))
+            (InstanceStatus::Running, PowerState::Paused) => {
+                self.converge_state(&project, name, "freeze", false, &[InstanceStatus::Frozen])
+                    .await
             }
-            (ProviderTargetStatus::Ready | ProviderTargetStatus::Paused, PowerState::Stopped) => {
-                if target.status == ProviderTargetStatus::Paused {
-                    self.instance_state_action(&project, &name, "unfreeze", 30, false)
-                        .await?;
+            (InstanceStatus::Running | InstanceStatus::Frozen, PowerState::Stopped) => {
+                if target.status == InstanceStatus::Frozen {
+                    self.converge_state(
+                        &project,
+                        name,
+                        "unfreeze",
+                        false,
+                        &[InstanceStatus::Running],
+                    )
+                    .await?;
                 }
-                if let Err(error) = self
-                    .instance_state_action(&project, &name, "stop", 30, false)
+                self.converge_state(&project, name, "stop", false, &[InstanceStatus::Stopped])
                     .await
-                {
-                    let observed = self.instance(&project, &name).await?;
-                    if !observed
-                        .as_ref()
-                        .is_some_and(|target| target.status == ProviderTargetStatus::Stopped)
-                    {
-                        return Err(error);
-                    }
-                }
-                let observed = self.observed_instance(&project, &name).await?;
-                Ok(target_after_accepted_stop(observed))
             }
-            // Starting/creating/closing/failed/unknown: nothing safe to do
-            // until the instance settles; the caller re-observes later.
-            (_, _) => Ok(target.clone()),
+            // Transitional, failed or unknown: nothing safe to do until the
+            // instance settles; the caller re-observes later.
+            _ => Ok(()),
         }
     }
 
     async fn set_ingress(
         &self,
-        binding: &ProviderBindingContext,
         target: &OwnedTarget,
-        hostname: Option<&str>,
-        port: Option<u16>,
-    ) -> anyhow::Result<OwnedTarget> {
-        if hostname.is_some() != port.is_some() {
-            anyhow::bail!("ingress hostname and port must be set together")
-        }
-        let project = policy::project_name(binding);
+        route: Option<(&str, u16)>,
+    ) -> anyhow::Result<()> {
+        let project = policy::project_name(&target.binding());
+        let name = target.name();
         let instance: Instance = self
             .request(
                 Method::GET,
-                &format!("/instances/{}", target.name),
+                &format!("/instances/{name}"),
                 Some(&project),
                 None,
             )
             .await?;
         let mut config = instance.config;
-        match (hostname, port) {
-            (Some(hostname), Some(port)) => {
-                config.insert(
-                    "user.lightspeed.ingress_hostname".to_owned(),
-                    hostname.to_owned(),
-                );
-                config.insert("user.lightspeed.ingress_port".to_owned(), port.to_string());
+        let hostname_key = format!("{}ingress_hostname", policy::META_PREFIX);
+        let port_key = format!("{}ingress_port", policy::META_PREFIX);
+        match route {
+            Some((hostname, port)) => {
+                config.insert(hostname_key, hostname.to_owned());
+                config.insert(port_key, port.to_string());
             }
-            _ => {
-                config.remove("user.lightspeed.ingress_hostname");
-                config.remove("user.lightspeed.ingress_port");
+            None => {
+                config.remove(&hostname_key);
+                config.remove(&port_key);
             }
         }
-        let update = self.request_unit(Method::PUT, &format!("/instances/{}", target.name), Some(&project), Some(json!({"config":config,"description":instance.description,"profiles":instance.profiles,"devices":instance.devices,"ephemeral":instance.ephemeral}))).await;
+        let update = self.request_unit(Method::PUT, &format!("/instances/{name}"), Some(&project), Some(json!({"config":config,"description":instance.description,"profiles":instance.profiles,"devices":instance.devices,"ephemeral":instance.ephemeral}))).await;
         let observed = self
-            .instance(&project, &target.name)
+            .instance(&project, name)
             .await?
             .ok_or_else(|| anyhow::anyhow!("target disappeared while updating ingress"))?;
-        if observed.ingress_hostname.as_deref() != hostname || observed.ingress_port != port {
+        let realized = observed
+            .ingress_hostname
+            .as_deref()
+            .zip(observed.ingress_port);
+        if realized != route {
             return Err(update.err().unwrap_or_else(|| {
                 anyhow::anyhow!("Incus did not realize the requested ingress metadata")
             }));
         }
-        Ok(observed)
+        Ok(())
     }
 }
 
@@ -1212,7 +1177,7 @@ struct Project {
 }
 
 impl Project {
-    fn binding_context(&self) -> Option<ProviderBindingContext> {
+    fn binding(&self) -> Option<BindingRef> {
         if self
             .config
             .get("user.lightspeed.managed")
@@ -1220,15 +1185,17 @@ impl Project {
         {
             return None;
         }
-        let binding = ProviderBindingContext {
-            universe_id: self.config.get("user.lightspeed.universe")?.clone(),
-            binding_id: self.config.get("user.lightspeed.binding")?.clone(),
+        let binding = BindingRef {
+            universe_id: UniverseId::new(self.config.get("user.lightspeed.universe")?.as_str())
+                .ok()?,
+            binding_id: BindingId::new(self.config.get("user.lightspeed.binding")?.as_str())
+                .ok()?,
         };
         (self.name == policy::project_name(&binding)).then_some(binding)
     }
 
     fn is_lightspeed_managed(&self) -> bool {
-        self.binding_context().is_some()
+        self.binding().is_some()
     }
 }
 
@@ -1338,7 +1305,7 @@ fn network_resource_project(mode: IncusMode, project: &str) -> Option<&str> {
     }
 }
 
-fn parse_source_target(value: &str) -> anyhow::Result<(&str, &str)> {
+pub(crate) fn parse_source_target(value: &str) -> anyhow::Result<(&str, &str)> {
     let (project, name) = value.split_once('/').unwrap_or(("default", value));
     if project.is_empty()
         || name.is_empty()
@@ -1357,165 +1324,106 @@ fn parse_source_target(value: &str) -> anyhow::Result<(&str, &str)> {
     Ok((project, name))
 }
 
-async fn ensure_instance_started(
-    client: &IncusClient,
-    project: &str,
-    name: &str,
-    target: OwnedTarget,
-) -> anyhow::Result<OwnedTarget> {
-    if matches!(
-        target.status,
-        ProviderTargetStatus::Ready | ProviderTargetStatus::Starting
-    ) {
-        return Ok(target);
-    }
-    if target.status == ProviderTargetStatus::Paused {
-        client
-            .instance_state_action(project, name, "unfreeze", 30, false)
-            .await?;
-        let observed = client.observed_instance(project, name).await?;
-        return Ok(target_after_accepted_resume(observed));
-    }
-    if let Err(error) = client
-        .request_unit(
-            Method::PUT,
-            &format!("/instances/{name}/state"),
-            Some(project),
-            Some(json!({"action":"start","timeout":30,"force":false})),
-        )
-        .await
-    {
-        let observed = client.instance(project, name).await?;
-        if !observed.as_ref().is_some_and(|target| {
-            matches!(
-                target.status,
-                ProviderTargetStatus::Starting | ProviderTargetStatus::Ready
-            )
-        }) {
-            return Err(error);
-        }
-    }
+/// Start a stopped instance or unfreeze a frozen one; a running or starting
+/// one needs nothing.
+async fn start_instance(client: &IncusClient, project: &str, name: &str) -> anyhow::Result<()> {
     let target = client
         .instance(project, name)
         .await?
-        .ok_or_else(|| anyhow::anyhow!("Incus target disappeared while starting"))?;
-    Ok(target_after_accepted_start(target))
-}
-
-/// Incus can briefly return the pre-operation `Stopped` state immediately
-/// after its asynchronous start operation succeeds. Keep the provisioning
-/// lifecycle pending until a later observation sees the actual running state.
-fn target_after_accepted_start(mut target: OwnedTarget) -> OwnedTarget {
-    target.status = status_after_accepted_start(target.status);
-    target
-}
-
-fn status_after_accepted_start(status: ProviderTargetStatus) -> ProviderTargetStatus {
-    match status {
-        ProviderTargetStatus::Stopped => ProviderTargetStatus::Starting,
-        status => status,
+        .ok_or_else(|| anyhow::anyhow!("the Incus instance disappeared before it started"))?;
+    match target.status {
+        InstanceStatus::Running | InstanceStatus::Starting => Ok(()),
+        InstanceStatus::Frozen => {
+            client
+                .converge_state(project, name, "unfreeze", false, &[InstanceStatus::Running])
+                .await
+        }
+        _ => {
+            client
+                .converge_state(
+                    project,
+                    name,
+                    "start",
+                    false,
+                    &[InstanceStatus::Running, InstanceStatus::Starting],
+                )
+                .await?;
+            client.settle_after_start(project, name).await
+        }
     }
 }
 
-/// After an accepted unfreeze, a stale `Frozen` read means "resuming", not
-/// "still paused".
-fn target_after_accepted_resume(mut target: OwnedTarget) -> OwnedTarget {
-    if target.status == ProviderTargetStatus::Paused {
-        target.status = ProviderTargetStatus::Starting;
-    }
-    target
+/// The `user.lightspeed.*` keys that make an instance the owner's.
+fn ownership_config(owner: &TargetOwner) -> BTreeMap<String, String> {
+    BTreeMap::from([
+        (format!("{}managed", policy::META_PREFIX), "true".to_owned()),
+        (
+            format!("{}universe", policy::META_PREFIX),
+            owner.universe_id.to_string(),
+        ),
+        (
+            format!("{}binding", policy::META_PREFIX),
+            owner.binding_id.to_string(),
+        ),
+        (
+            format!("{}environment", policy::META_PREFIX),
+            owner.environment_id.to_string(),
+        ),
+        (
+            format!("{}incarnation", policy::META_PREFIX),
+            owner.incarnation_id.to_string(),
+        ),
+    ])
 }
 
-/// After an accepted freeze, a stale `Running` read must not make the caller
-/// freeze again; report the requested steady state.
-fn target_after_accepted_freeze(mut target: OwnedTarget) -> OwnedTarget {
-    if target.status == ProviderTargetStatus::Ready {
-        target.status = ProviderTargetStatus::Paused;
+fn classify_adoption_source(source: &Instance) -> AdoptionSource {
+    if source
+        .config
+        .get(&format!("{}managed", policy::META_PREFIX))
+        .is_some_and(|value| value == "true")
+    {
+        return AdoptionSource::Managed;
     }
-    target
-}
-
-/// After an accepted stop, a stale `Running`/`Frozen` read is reported as
-/// stopped; a later observation corrects it if the stop did not stick.
-fn target_after_accepted_stop(mut target: OwnedTarget) -> OwnedTarget {
-    if matches!(
-        target.status,
-        ProviderTargetStatus::Ready | ProviderTargetStatus::Paused
-    ) {
-        target.status = ProviderTargetStatus::Stopped;
+    if source.kind != "virtual-machine" {
+        return AdoptionSource::NotAdoptable("only Incus virtual machines can be adopted");
     }
-    target
-}
-
-fn verify_adopted_target(target: &OwnedTarget, params: &AdoptTargetParams) -> anyhow::Result<()> {
-    if target.universe_id != params.binding.universe_id
-        || target.binding_id != params.binding.binding_id
-        || target.environment_id != params.environment_id
-        || target.incarnation_id != params.incarnation_id
-        || target.request_id != params.request_id
-        || target.template_id != "adopted"
-        || target.image_fingerprint != "adopted"
-        || target.adoption_source.as_deref() != Some(params.source_target.as_str())
-    {
-        anyhow::bail!("existing target metadata conflicts with adoption request")
+    if source.ephemeral {
+        return AdoptionSource::NotAdoptable("ephemeral Incus instances cannot be adopted");
     }
-    Ok(())
+    AdoptionSource::Adoptable
 }
 
-fn owned_from_instance(instance: Instance, state: InstanceState) -> anyhow::Result<OwnedTarget> {
-    let name = instance.name.clone();
+/// The owned target an instance describes, or `None` when its ownership
+/// metadata is missing, invalid or does not match its deterministic name.
+fn owned_from_instance(instance: Instance, state: InstanceState) -> Option<OwnedTarget> {
     let get = |key: &str| {
         instance
             .config
             .get(&format!("{}{}", policy::META_PREFIX, key))
             .cloned()
-            .ok_or_else(|| anyhow::anyhow!("instance {name} is not owned: missing {key}"))
     };
     if get("managed")? != "true" {
-        anyhow::bail!("instance is not Lightspeed-managed")
+        return None;
     }
-    let universe_id = get("universe")?;
-    let binding_id = get("binding")?;
-    let environment_id = get("environment")?;
-    let incarnation_id = get("incarnation")?;
-    if instance.name
-        != policy::instance_name(&universe_id, &binding_id, &environment_id, &incarnation_id)
-    {
-        anyhow::bail!("managed instance name does not match immutable ownership metadata")
+    let owner = TargetOwner {
+        universe_id: UniverseId::new(get("universe")?).ok()?,
+        binding_id: BindingId::new(get("binding")?).ok()?,
+        environment_id: EnvironmentId::new(get("environment")?).ok()?,
+        incarnation_id: IncarnationId::new(get("incarnation")?).ok()?,
+    };
+    if instance.name != policy::instance_name(&owner) {
+        return None;
     }
-    let ipv4_address = managed_ipv4_address(&state);
-    Ok(OwnedTarget {
-        target_id: ProviderTargetId::new(instance.name.clone()),
-        name: instance.name,
-        universe_id,
-        binding_id,
-        environment_id,
-        incarnation_id,
-        request_id: get("request")?,
+    Some(OwnedTarget {
+        target_id: ProviderTargetId::new(instance.name.clone()).ok()?,
+        owner,
         template_id: get("template")?,
         image_fingerprint: get("image")?,
-        adoption_source: instance
-            .config
-            .get(&format!("{}adoption_source", policy::META_PREFIX))
-            .cloned(),
-        status: match instance.status.as_str() {
-            "Running" => ProviderTargetStatus::Ready,
-            "Starting" => ProviderTargetStatus::Starting,
-            "Stopped" => ProviderTargetStatus::Stopped,
-            // Incus reports a frozen container or paused VM as `Frozen`.
-            "Frozen" | "Freezing" => ProviderTargetStatus::Paused,
-            "Error" => ProviderTargetStatus::Failed,
-            _ => ProviderTargetStatus::Unknown,
-        },
-        ipv4_address,
-        ingress_hostname: instance
-            .config
-            .get(&format!("{}ingress_hostname", policy::META_PREFIX))
-            .cloned(),
-        ingress_port: instance
-            .config
-            .get(&format!("{}ingress_port", policy::META_PREFIX))
-            .and_then(|value| value.parse().ok()),
+        adoption_source: get("adoption_source"),
+        status: InstanceStatus::from_incus(&instance.status),
+        ipv4_address: managed_ipv4_address(&state),
+        ingress_hostname: get("ingress_hostname"),
+        ingress_port: get("ingress_port").and_then(|value| value.parse().ok()),
         location: (!instance.location.is_empty()).then_some(instance.location),
     })
 }
@@ -1543,10 +1451,7 @@ mod tests {
 
     #[test]
     fn managed_projects_require_matching_binding_metadata() {
-        let binding = ProviderBindingContext {
-            universe_id: "u".to_owned(),
-            binding_id: "b".to_owned(),
-        };
+        let binding = policy::binding_of(&policy::tests::owner("u", "b", "e"));
         let project = Project {
             name: policy::project_name(&binding),
             config: BTreeMap::from([
@@ -1563,6 +1468,63 @@ mod tests {
         assert!(!spoofed.is_lightspeed_managed());
     }
 
+    fn instance(name: &str, config: BTreeMap<String, String>) -> Instance {
+        Instance {
+            name: name.to_owned(),
+            kind: "virtual-machine".to_owned(),
+            description: String::new(),
+            profiles: Vec::new(),
+            devices: BTreeMap::new(),
+            ephemeral: false,
+            status: "Running".to_owned(),
+            config,
+            location: String::new(),
+        }
+    }
+
+    #[test]
+    fn ownership_metadata_must_match_the_deterministic_name() {
+        let owner = policy::tests::owner("u", "b", "e");
+        let mut config = ownership_config(&owner);
+        config.insert("user.lightspeed.template".to_owned(), "t".to_owned());
+        config.insert("user.lightspeed.image".to_owned(), "f".to_owned());
+        let name = policy::instance_name(&owner);
+        let owned = owned_from_instance(instance(&name, config.clone()), InstanceState::default())
+            .expect("owned");
+        assert_eq!(owned.owner, owner);
+        assert_eq!(owned.status, InstanceStatus::Running);
+        assert!(
+            owned_from_instance(
+                instance("ls-other", config.clone()),
+                InstanceState::default()
+            )
+            .is_none()
+        );
+        config.insert("user.lightspeed.universe".to_owned(), "bad id!".to_owned());
+        assert!(owned_from_instance(instance(&name, config), InstanceState::default()).is_none());
+    }
+
+    #[test]
+    fn adoption_sources_are_classified_before_any_change() {
+        let mut source = instance("manual-vm", BTreeMap::new());
+        assert_eq!(classify_adoption_source(&source), AdoptionSource::Adoptable);
+        source.ephemeral = true;
+        assert!(matches!(
+            classify_adoption_source(&source),
+            AdoptionSource::NotAdoptable(_)
+        ));
+        source.ephemeral = false;
+        source.kind = "container".to_owned();
+        assert!(matches!(
+            classify_adoption_source(&source),
+            AdoptionSource::NotAdoptable(_)
+        ));
+        source
+            .config
+            .insert("user.lightspeed.managed".to_owned(), "true".to_owned());
+        assert_eq!(classify_adoption_source(&source), AdoptionSource::Managed);
+    }
+
     #[test]
     fn adoption_source_defaults_to_the_default_project() {
         assert_eq!(
@@ -1620,53 +1582,18 @@ mod tests {
     }
 
     #[test]
-    fn accepted_power_changes_do_not_report_stale_pre_operation_states() {
-        let target = |status| OwnedTarget {
-            target_id: "t".into(),
-            name: "t".to_owned(),
-            universe_id: "u".to_owned(),
-            binding_id: "b".to_owned(),
-            environment_id: "e".to_owned(),
-            incarnation_id: "i".to_owned(),
-            request_id: "r".to_owned(),
-            template_id: "tpl".to_owned(),
-            image_fingerprint: "img".to_owned(),
-            adoption_source: None,
-            status,
-            ipv4_address: None,
-            ingress_hostname: None,
-            ingress_port: None,
-            location: None,
-        };
-        assert_eq!(
-            target_after_accepted_freeze(target(ProviderTargetStatus::Ready)).status,
-            ProviderTargetStatus::Paused
-        );
-        assert_eq!(
-            target_after_accepted_resume(target(ProviderTargetStatus::Paused)).status,
-            ProviderTargetStatus::Starting
-        );
+    fn incus_statuses_reduce_to_provider_statuses() {
         assert_eq!(
-            target_after_accepted_resume(target(ProviderTargetStatus::Ready)).status,
-            ProviderTargetStatus::Ready
+            InstanceStatus::from_incus("Running"),
+            InstanceStatus::Running
         );
         assert_eq!(
-            target_after_accepted_stop(target(ProviderTargetStatus::Paused)).status,
-            ProviderTargetStatus::Stopped
+            InstanceStatus::from_incus("Freezing"),
+            InstanceStatus::Frozen
         );
+        assert_eq!(InstanceStatus::from_incus("Error"), InstanceStatus::Error);
+        assert_eq!(InstanceStatus::from_incus("Pending"), InstanceStatus::Other);
         assert!(SUPPORTED_POWER_STATES.contains(&PowerState::Paused));
         assert!(!SUPPORTED_POWER_STATES.contains(&PowerState::Suspended));
     }
-
-    #[test]
-    fn accepted_start_does_not_report_a_stale_stopped_state() {
-        assert_eq!(
-            status_after_accepted_start(ProviderTargetStatus::Stopped),
-            ProviderTargetStatus::Starting
-        );
-        assert_eq!(
-            status_after_accepted_start(ProviderTargetStatus::Ready),
-            ProviderTargetStatus::Ready
-        );
-    }
 }
diff --git a/crates/environment-provider-incus/src/ingress.rs b/crates/environment-provider-incus/src/ingress.rs
index 5373c1328..541e1e3d8 100644
--- a/crates/environment-provider-incus/src/ingress.rs
+++ b/crates/environment-provider-incus/src/ingress.rs
@@ -1,5 +1,7 @@
 //! Provider-owned public hostname allocation.
 
+use environment_protocol::routes::PublicUrl;
+
 use crate::{Config, incus::OwnedTarget, policy};
 
 pub fn hostname(target: &OwnedTarget, public_base_url: &str) -> anyhow::Result<String> {
@@ -10,15 +12,15 @@ pub fn hostname(target: &OwnedTarget, public_base_url: &str) -> anyhow::Result<S
     let label = policy::stable_component(
         "ingress",
         &[
-            &target.universe_id,
-            &target.binding_id,
-            &target.environment_id,
+            target.owner.universe_id.as_str(),
+            target.owner.binding_id.as_str(),
+            target.owner.environment_id.as_str(),
         ],
     );
     Ok(format!("{label}.{domain}"))
 }
 
-pub fn public_endpoint(config: &Config, hostname: &str) -> anyhow::Result<String> {
+pub fn public_endpoint(config: &Config, hostname: &str) -> anyhow::Result<PublicUrl> {
     let ingress = config
         .ingress
         .as_ref()
@@ -26,36 +28,32 @@ pub fn public_endpoint(config: &Config, hostname: &str) -> anyhow::Result<String
     let mut base = reqwest::Url::parse(&ingress.public_base_url)?;
     base.set_host(Some(hostname))
         .map_err(|_| anyhow::anyhow!("invalid ingress hostname"))?;
-    Ok(base.to_string().trim_end_matches('/').to_owned())
+    Ok(PublicUrl::new(base.to_string().trim_end_matches('/'))?)
 }
 
-pub fn endpoint(config: &Config, target: &OwnedTarget) -> anyhow::Result<(String, String)> {
+/// The hostname the provider allocates for the target.
+pub fn allocated_hostname(config: &Config, target: &OwnedTarget) -> anyhow::Result<String> {
     let ingress = config
         .ingress
         .as_ref()
         .ok_or_else(|| anyhow::anyhow!("provider ingress is not configured"))?;
-    let hostname = hostname(target, &ingress.public_base_url)?;
-    Ok((hostname.clone(), public_endpoint(config, &hostname)?))
+    hostname(target, &ingress.public_base_url)
 }
 
 #[cfg(test)]
-mod tests {
+pub(crate) mod tests {
     use super::*;
-    use environment_protocol::{control::targets::ProviderTargetStatus, shared::ProviderTargetId};
+    use crate::incus::InstanceStatus;
 
-    fn target() -> OwnedTarget {
+    pub(crate) fn target() -> OwnedTarget {
+        let owner = policy::tests::owner("universe-a", "binding-a", "environment-a");
         OwnedTarget {
-            target_id: ProviderTargetId::new("target-a"),
-            name: "target-a".to_owned(),
-            universe_id: "universe-a".to_owned(),
-            binding_id: "binding-a".to_owned(),
-            environment_id: "environment-a".to_owned(),
-            incarnation_id: "incarnation-a".to_owned(),
-            request_id: "request-a".to_owned(),
+            target_id: policy::instance_name(&owner).try_into().unwrap(),
+            owner,
             template_id: "template-a".to_owned(),
             image_fingerprint: "fingerprint-a".to_owned(),
             adoption_source: None,
-            status: ProviderTargetStatus::Ready,
+            status: InstanceStatus::Running,
             ipv4_address: Some("10.0.0.2".to_owned()),
             ingress_hostname: None,
             ingress_port: None,
diff --git a/crates/environment-provider-incus/src/policy.rs b/crates/environment-provider-incus/src/policy.rs
index e0bdfa7c8..6a7a8973a 100644
--- a/crates/environment-provider-incus/src/policy.rs
+++ b/crates/environment-provider-incus/src/policy.rs
@@ -1,9 +1,13 @@
 use sha2::{Digest as _, Sha256};
 
-use environment_protocol::control::targets::ProviderBindingContext;
+use environment_protocol::control::target::{BindingRef, TargetOwner};
 
 pub const META_PREFIX: &str = "user.lightspeed.";
 
+/// Longest Incus instance, project or network name component the provider
+/// addresses in an Incus API path.
+const MAX_INCUS_NAME_BYTES: usize = 63;
+
 pub fn stable_component(kind: &str, parts: &[&str]) -> String {
     let mut hash = Sha256::new();
     hash.update(kind.as_bytes());
@@ -14,42 +18,72 @@ pub fn stable_component(kind: &str, parts: &[&str]) -> String {
     hex(&hash.finalize()[..10])
 }
 
-pub fn project_name(binding: &ProviderBindingContext) -> String {
-    format!(
-        "ls-{}",
-        stable_component("binding", &[&binding.universe_id, &binding.binding_id])
+pub fn binding_of(owner: &TargetOwner) -> BindingRef {
+    BindingRef {
+        universe_id: owner.universe_id.clone(),
+        binding_id: owner.binding_id.clone(),
+    }
+}
+
+fn binding_component(binding: &BindingRef) -> String {
+    stable_component(
+        "binding",
+        &[binding.universe_id.as_str(), binding.binding_id.as_str()],
     )
 }
 
-pub fn network_name(binding: &ProviderBindingContext) -> String {
-    let component = stable_component("binding", &[&binding.universe_id, &binding.binding_id]);
+pub fn project_name(binding: &BindingRef) -> String {
+    format!("ls-{}", binding_component(binding))
+}
+
+pub fn network_name(binding: &BindingRef) -> String {
     // A managed bridge's Incus network name also becomes its Linux interface
     // name, whose hard limit is 15 bytes. Keep 48 bits of the scoped digest
     // while making the resource kind visible within that limit.
-    format!("ls{}n", &component[..12])
+    format!("ls{}n", &binding_component(binding)[..12])
 }
-pub fn profile_name(binding: &ProviderBindingContext) -> String {
+
+pub fn profile_name(binding: &BindingRef) -> String {
     format!("{}-vm", project_name(binding))
 }
-pub fn acl_name(binding: &ProviderBindingContext) -> String {
+
+pub fn acl_name(binding: &BindingRef) -> String {
     format!("{}-acl", project_name(binding))
 }
 
-pub fn instance_name(
-    universe_id: &str,
-    binding_id: &str,
-    environment_id: &str,
-    incarnation_id: &str,
-) -> String {
+/// The one instance name, and therefore `targetId`, an owner can hold. The
+/// provider's owner index is this deterministic name inside the binding's
+/// project, so create and adopt are idempotent per owner without any
+/// provider-side state.
+pub fn instance_name(owner: &TargetOwner) -> String {
     format!(
         "ls-{}",
         stable_component(
             "instance",
-            &[universe_id, binding_id, environment_id, incarnation_id]
+            &[
+                owner.universe_id.as_str(),
+                owner.binding_id.as_str(),
+                owner.environment_id.as_str(),
+                owner.incarnation_id.as_str(),
+            ]
         )
     )
 }
 
+/// True for a string the provider may place in an Incus API path as an
+/// instance name: 1 to 63 ASCII letters, digits or hyphens, not starting or
+/// ending with a hyphen. Every `targetId` this provider assigns qualifies;
+/// any other opaque id names nothing here.
+pub fn is_instance_name(value: &str) -> bool {
+    !value.is_empty()
+        && value.len() <= MAX_INCUS_NAME_BYTES
+        && !value.starts_with('-')
+        && !value.ends_with('-')
+        && value
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || byte == b'-')
+}
+
 fn hex(bytes: &[u8]) -> String {
     const TABLE: &[u8; 16] = b"0123456789abcdef";
     let mut output = String::with_capacity(bytes.len() * 2);
@@ -61,27 +95,50 @@ fn hex(bytes: &[u8]) -> String {
 }
 
 #[cfg(test)]
-mod tests {
+pub(crate) mod tests {
+    use environment_protocol::ids::{BindingId, EnvironmentId, IncarnationId, UniverseId};
+
     use super::*;
+
+    pub(crate) fn owner(universe: &str, binding: &str, environment: &str) -> TargetOwner {
+        TargetOwner {
+            universe_id: UniverseId::new(universe).unwrap(),
+            binding_id: BindingId::new(binding).unwrap(),
+            environment_id: EnvironmentId::new(environment).unwrap(),
+            incarnation_id: IncarnationId::new("i").unwrap(),
+        }
+    }
+
     #[test]
     fn names_are_stable_and_scoped() {
-        let a = instance_name("u", "b", "e", "i");
-        assert_eq!(a, instance_name("u", "b", "e", "i"));
-        assert_ne!(a, instance_name("u2", "b", "e", "i"));
+        let a = instance_name(&owner("u", "b", "e"));
+        assert_eq!(a, instance_name(&owner("u", "b", "e")));
+        assert_ne!(a, instance_name(&owner("u2", "b", "e")));
+        assert!(is_instance_name(&a));
     }
 
     #[test]
     fn binding_network_names_fit_the_linux_interface_limit() {
-        let binding = ProviderBindingContext {
-            universe_id: "0d3d9e5e-2428-4e60-b66e-8d4520f64e5d".to_owned(),
-            binding_id: "hz02-incus".to_owned(),
-        };
-        let other = ProviderBindingContext {
-            universe_id: "61092591-cd39-4504-b845-a817e3d9cb71".to_owned(),
-            binding_id: "hz02-incus".to_owned(),
-        };
+        let binding = binding_of(&owner(
+            "0d3d9e5e-2428-4e60-b66e-8d4520f64e5d",
+            "hz02-incus",
+            "e",
+        ));
+        let other = binding_of(&owner(
+            "61092591-cd39-4504-b845-a817e3d9cb71",
+            "hz02-incus",
+            "e",
+        ));
 
         assert_eq!(network_name(&binding).len(), 15);
         assert_ne!(network_name(&binding), network_name(&other));
     }
+
+    #[test]
+    fn only_incus_names_reach_an_api_path() {
+        assert!(is_instance_name("ls-0123456789abcdef0123"));
+        for value in ["", "-a", "a-", "a/b", "a?b", "default/pod", &"a".repeat(64)] {
+            assert!(!is_instance_name(value), "{value}");
+        }
+    }
 }
diff --git a/crates/environment-provider-incus/src/relay.rs b/crates/environment-provider-incus/src/relay.rs
index 6ac992bd1..ff177fb54 100644
--- a/crates/environment-provider-incus/src/relay.rs
+++ b/crates/environment-provider-incus/src/relay.rs
@@ -1,41 +1,83 @@
 //! On-demand provider data connections.
 //!
 //! Lightspeed opens one provider WebSocket for a specific current target. The
-//! provider validates ownership, dials the target's private envd, and proxies
-//! the connection until it closes or becomes idle. There is no provider-initiated
-//! connection and no provider route registry in Lightspeed.
+//! provider validates the credential and ownership, dials the target's private
+//! envd, and proxies the connection until it closes or becomes idle. There is
+//! no provider-initiated connection and no provider route registry in
+//! Lightspeed.
+//!
+//! The relay is an intermediary under the protocol's liveness rule: it
+//! forwards pings and pongs, counts every frame in either direction as
+//! activity, and never idle-closes sooner than `relayIdleSeconds`, which
+//! config loading keeps at or above the protocol minimum. Both legs carry the
+//! protocol's message and frame limit.
 
 use std::time::Duration;
 
 use anyhow::Context as _;
 use axum::extract::ws::{Message as AxumMessage, WebSocket};
+use environment_protocol::limits::MAX_MESSAGE_BYTES;
 use futures_util::{SinkExt as _, StreamExt as _};
 use tokio::net::TcpStream;
 use tokio_tungstenite::{
-    MaybeTlsStream, WebSocketStream, connect_async, tungstenite::Message as TungsteniteMessage,
+    MaybeTlsStream, WebSocketStream, connect_async_with_config,
+    tungstenite::{Message as TungsteniteMessage, protocol::WebSocketConfig},
 };
 
 use crate::{Config, incus::OwnedTarget};
 
 pub type GuestSocket = WebSocketStream<MaybeTlsStream<TcpStream>>;
 
+/// Bound on the readiness probe's dial, so an observation stays prompt while
+/// a guest boots.
+const PROBE_TIMEOUT: Duration = Duration::from_secs(3);
+
+/// The protocol's message limit, applied to both relay legs.
+pub fn websocket_config() -> WebSocketConfig {
+    WebSocketConfig::default()
+        .max_message_size(Some(MAX_MESSAGE_BYTES as usize))
+        .max_frame_size(Some(MAX_MESSAGE_BYTES as usize))
+}
+
 pub async fn dial_guest(config: &Config, target: &OwnedTarget) -> anyhow::Result<GuestSocket> {
+    dial_guest_within(
+        config,
+        target,
+        Duration::from_secs(config.dial_timeout_seconds),
+    )
+    .await
+}
+
+async fn dial_guest_within(
+    config: &Config,
+    target: &OwnedTarget,
+    timeout: Duration,
+) -> anyhow::Result<GuestSocket> {
     let address = target
         .ipv4_address
         .as_deref()
         .ok_or_else(|| anyhow::anyhow!("target has no private IPv4 address"))?;
     let endpoint = format!("ws://{address}:{}/", config.envd_port);
     let (socket, _) = tokio::time::timeout(
-        Duration::from_secs(config.dial_timeout_seconds),
-        connect_async(endpoint),
+        timeout,
+        connect_async_with_config(endpoint, Some(websocket_config()), true),
     )
     .await
     .context("envd dial timeout")??;
     Ok(socket)
 }
 
+/// The provider's own liveness probe of envd: a WebSocket upgrade on the
+/// guest's data listener, without `initialize`, so the provider never
+/// depends on envd's protocol version.
 pub async fn probe_guest(config: &Config, target: &OwnedTarget) -> bool {
-    match dial_guest(config, target).await {
+    match dial_guest_within(
+        config,
+        target,
+        PROBE_TIMEOUT.min(Duration::from_secs(config.dial_timeout_seconds)),
+    )
+    .await
+    {
         Ok(mut socket) => {
             let _ = socket.close(None).await;
             true
@@ -124,7 +166,7 @@ mod tests {
 
     use super::*;
 
-    #[tokio::test]
+    #[tokio::test(flavor = "current_thread")]
     async fn relay_closes_guest_when_lightspeed_disappears_without_a_close_frame() {
         let guest_listener = TcpListener::bind("127.0.0.1:0")
             .await
@@ -144,7 +186,7 @@ mod tests {
             }
             false
         });
-        let (guest, _) = connect_async(format!("ws://{guest_address}"))
+        let (guest, _) = tokio_tungstenite::connect_async(format!("ws://{guest_address}"))
             .await
             .expect("connect guest");
         let guest = Arc::new(Mutex::new(Some(guest)));
@@ -178,7 +220,7 @@ mod tests {
                 .expect("relay server")
         });
 
-        let (lightspeed, _) = connect_async(format!("ws://{relay_address}"))
+        let (lightspeed, _) = tokio_tungstenite::connect_async(format!("ws://{relay_address}"))
             .await
             .expect("connect lightspeed");
         drop(lightspeed);
@@ -190,4 +232,82 @@ mod tests {
         relay_server.abort();
         assert!(saw_close, "relay dropped guest without a close frame");
     }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn relay_forwards_pings_and_counts_them_as_activity() {
+        let guest_listener = TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("guest listener");
+        let guest_address = guest_listener.local_addr().expect("guest address");
+        let guest_observer = tokio::spawn(async move {
+            let (stream, _) = guest_listener.accept().await.expect("guest accept");
+            let mut socket = tokio_tungstenite::accept_async(stream)
+                .await
+                .expect("guest websocket");
+            let mut pings = 0;
+            while let Some(message) = socket.next().await {
+                match message {
+                    Ok(TungsteniteMessage::Ping(_)) => pings += 1,
+                    Ok(TungsteniteMessage::Text(text)) => return Some((pings, text.to_string())),
+                    Ok(_) => {}
+                    Err(_) => return None,
+                }
+            }
+            None
+        });
+        let (guest, _) = tokio_tungstenite::connect_async(format!("ws://{guest_address}"))
+            .await
+            .expect("connect guest");
+        let guest = Arc::new(Mutex::new(Some(guest)));
+        let relay_listener = TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("relay listener");
+        let relay_address = relay_listener.local_addr().expect("relay address");
+        let app = Router::new().route(
+            "/",
+            get(move |upgrade: WebSocketUpgrade| {
+                let guest = guest.clone();
+                async move {
+                    let mut guest = guest.lock().await.take().expect("one relay connection");
+                    upgrade
+                        .on_upgrade(move |mut socket| async move {
+                            proxy_with_idle(Duration::from_millis(300), &mut socket, &mut guest)
+                                .await;
+                        })
+                        .into_response()
+                }
+            }),
+        );
+        let relay_server = tokio::spawn(async move {
+            axum::serve(relay_listener, app)
+                .await
+                .expect("relay server")
+        });
+
+        let (mut lightspeed, _) = tokio_tungstenite::connect_async(format!("ws://{relay_address}"))
+            .await
+            .expect("connect lightspeed");
+        // Eight pings 100 ms apart keep the 300 ms idle timer from firing
+        // across 800 ms with no data frame.
+        for _ in 0..8 {
+            lightspeed
+                .send(TungsteniteMessage::Ping(vec![1].into()))
+                .await
+                .expect("ping");
+            tokio::time::sleep(Duration::from_millis(100)).await;
+        }
+        lightspeed
+            .send(TungsteniteMessage::Text("after pings".into()))
+            .await
+            .expect("text");
+
+        let observed = tokio::time::timeout(Duration::from_secs(2), guest_observer)
+            .await
+            .expect("guest timeout")
+            .expect("guest observer");
+        relay_server.abort();
+        let (pings, text) = observed.expect("the relay closed the guest leg while pings flowed");
+        assert_eq!(pings, 8);
+        assert_eq!(text, "after pings");
+    }
 }
diff --git a/crates/environment-provider-incus/src/server.rs b/crates/environment-provider-incus/src/server.rs
index f6090c2e3..7877d2e39 100644
--- a/crates/environment-provider-incus/src/server.rs
+++ b/crates/environment-provider-incus/src/server.rs
@@ -1,64 +1,153 @@
-use std::{collections::BTreeMap, sync::Arc};
+//! The provider's listener: the controller plane on `/control` and the data
+//! routes under `/routes`, both behind the provider credential.
+//!
+//! Every target method answers promptly with the current observation. Slow
+//! Incus work (an image pull, a boot, a graceful shutdown) runs as one
+//! background job per target, serialized per target, and later calls observe
+//! its progress: a running create reports `provisioning`, a running close
+//! `closing`, and a failed create `failed` with its error as the `message`.
+//! Job state is in memory; Incus itself, read through the deterministic owner
+//! name, is the record of every target.
+
+use std::{
+    collections::{BTreeMap, HashMap},
+    panic::AssertUnwindSafe,
+    sync::{
+        Arc, Mutex as StdMutex,
+        atomic::{AtomicU64, Ordering},
+    },
+    time::Duration,
+};
 
 use axum::{
     Json, Router,
     extract::{
         Path, State, WebSocketUpgrade,
-        ws::{Message, WebSocket},
+        ws::{Message, WebSocket, rejection::WebSocketUpgradeRejection},
     },
-    http::StatusCode,
+    http::{HeaderMap, StatusCode, header},
     response::{IntoResponse, Response},
     routing::get,
 };
 use environment_protocol::{
+    CONTROLLER_PROTOCOL_VERSION,
     control::{
         handshake::{
             ControllerCapabilities, ControllerInitializeParams, ControllerInitializeResponse,
+            ControllerRoutes,
         },
-        ingress::{
-            EnsureIngressParams, IngressResponse, ProviderIngressStatus, RemoveIngressParams,
+        ingress::{EnsureIngressParams, RemoveIngressParams},
+        target::{
+            AdoptTargetParams, CloseTargetParams, CreateTargetParams, GetTargetParams,
+            IngressObservation, PowerState, SetTargetPowerParams, TargetObservation, TargetOwner,
+            TargetPhase, TargetRef, TargetResponse, TargetState,
         },
-        methods::*,
-        targets::*,
+        template::{EnvironmentTemplate, ListTemplatesParams, ListTemplatesResponse},
     },
-    error::{EnvironmentProtocolError, EnvironmentProtocolErrorCode},
-    shared::{
-        CURRENT_PROTOCOL_VERSION, EnvironmentCapabilities, EnvironmentScope, ImplementationInfo,
+    error::{BusyReason, Capability, PreconditionReason, ProtocolError},
+    handshake::{ImplementationInfo, Plane},
+    ids::{BindingId, EnvironmentId, IncarnationId, ProviderTargetId, TemplateId, UniverseId},
+    jsonrpc::{self, Request, Response as RpcResponse},
+    limits::MAX_MESSAGE_BYTES,
+    manifest::{
+        self, ControllerInitialize, IngressEnsure, IngressRemove, MessageKind, TargetAdopt,
+        TargetClose, TargetCreate, TargetGet, TargetSetPower, TemplateList,
     },
+    metadata::{DescriptiveText, Metadata, validate_metadata_entry},
 };
-use futures_util::{StreamExt as _, stream};
-use serde::de::DeserializeOwned;
-use serde_json::{Value, json};
+use futures_util::{FutureExt as _, SinkExt as _, StreamExt as _, future::BoxFuture};
+use serde::Serialize;
+use serde_json::Value;
+use tokio::sync::{Mutex as AsyncMutex, Semaphore, mpsc, watch};
+
+use crate::{
+    Config, IncusBackend,
+    incus::{AdoptionSource, InstanceStatus, OwnedTarget, SUPPORTED_POWER_STATES},
+    ingress, policy, relay,
+};
+
+/// How long a mutation waits for its background job before it answers with
+/// the current observation.
+const PROMPT_WAIT: Duration = Duration::from_secs(5);
 
-use crate::{Config, IncusBackend, incus::OwnedTarget, ingress, policy, relay};
+/// Requests one controller connection may have in flight before `busy`.
+const MAX_CONCURRENT_REQUESTS: usize = 32;
 
-type BindingKey = (String, String);
-type BindingLock = Arc<tokio::sync::Mutex<()>>;
-type BindingLocks = Arc<tokio::sync::Mutex<BTreeMap<BindingKey, BindingLock>>>;
+const _: () = assert!(
+    MAX_CONCURRENT_REQUESTS >= environment_protocol::limits::MIN_CONCURRENT_REQUESTS as usize
+);
 
 #[derive(Clone)]
 struct App<B> {
     config: Config,
     backend: B,
-    binding_locks: BindingLocks,
+    work: Arc<Work>,
+    initialize: Arc<ControllerInitializeResponse>,
+}
+
+impl<B: IncusBackend> App<B> {
+    fn new(config: Config, backend: B) -> Self {
+        let initialize = ControllerInitializeResponse {
+            protocol_version: CONTROLLER_PROTOCOL_VERSION,
+            plane: Plane::Controller,
+            server_info: server_info(),
+            capabilities: ControllerCapabilities {
+                adopt_target: true,
+                ingress: config.ingress.is_some(),
+            },
+            routes: ControllerRoutes {
+                data: config.data_route_base.clone(),
+            },
+        };
+        Self {
+            config,
+            backend,
+            work: Arc::default(),
+            initialize: Arc::new(initialize),
+        }
+    }
+}
+
+fn server_info() -> ImplementationInfo {
+    let info = ImplementationInfo::new("lightspeed-provider-incus")
+        .expect("the provider name is a valid implementation name");
+    let info = info
+        .clone()
+        .with_version(release_info::VERSION)
+        .unwrap_or(info);
+    let info = info
+        .clone()
+        .with_git_sha(release_info::GIT_SHA)
+        .unwrap_or(info);
+    info.clone()
+        .with_target(release_info::TARGET)
+        .unwrap_or(info)
 }
 
 pub async fn serve<B: IncusBackend>(config: Config, backend: B) -> anyhow::Result<()> {
     let listener = tokio::net::TcpListener::bind(config.controller_listen).await?;
-    let app = Router::new()
+    serve_on(listener, config, backend).await
+}
+
+/// Serve on an already bound listener.
+pub async fn serve_on<B: IncusBackend>(
+    listener: tokio::net::TcpListener,
+    config: Config,
+    backend: B,
+) -> anyhow::Result<()> {
+    axum::serve(listener, router(config, backend)).await?;
+    Ok(())
+}
+
+fn router<B: IncusBackend>(config: Config, backend: B) -> Router {
+    Router::new()
         .route("/health", get(health::<B>))
-        .route("/control", get(upgrade::<B>))
+        .route("/control", get(control_upgrade::<B>))
         .route(
             "/routes/{universe}/{binding}/{environment}/{incarnation}/{target}",
             get(data_upgrade::<B>),
         )
-        .with_state(App {
-            config,
-            backend,
-            binding_locks: Arc::default(),
-        });
-    axum::serve(listener, app).await?;
-    Ok(())
+        .with_state(App::new(config, backend))
 }
 
 async fn health<B: IncusBackend>(State(app): State<App<B>>) -> Response {
@@ -68,151 +157,268 @@ async fn health<B: IncusBackend>(State(app): State<App<B>>) -> Response {
     }
 }
 
-async fn upgrade<B: IncusBackend>(
+/// True when the request carries the provider credential as a bearer token.
+fn authorized(config: &Config, headers: &HeaderMap) -> bool {
+    headers
+        .get(header::AUTHORIZATION)
+        .and_then(|value| value.to_str().ok())
+        .and_then(|value| value.strip_prefix("Bearer "))
+        .is_some_and(|token| config.credential.matches(token))
+}
+
+fn unauthorized() -> Response {
+    (
+        StatusCode::UNAUTHORIZED,
+        [(header::WWW_AUTHENTICATE, "Bearer")],
+    )
+        .into_response()
+}
+
+fn with_limits(upgrade: WebSocketUpgrade) -> WebSocketUpgrade {
+    upgrade
+        .max_message_size(MAX_MESSAGE_BYTES as usize)
+        .max_frame_size(MAX_MESSAGE_BYTES as usize)
+}
+
+async fn control_upgrade<B: IncusBackend>(
     State(app): State<App<B>>,
-    upgrade: WebSocketUpgrade,
+    headers: HeaderMap,
+    upgrade: Result<WebSocketUpgrade, WebSocketUpgradeRejection>,
 ) -> Response {
-    upgrade
-        .on_upgrade(move |socket| connection(app, socket))
-        .into_response()
+    if !authorized(&app.config, &headers) {
+        return unauthorized();
+    }
+    match upgrade {
+        Ok(upgrade) => with_limits(upgrade)
+            .on_upgrade(move |socket| connection(app, socket))
+            .into_response(),
+        Err(rejection) => rejection.into_response(),
+    }
 }
 
 async fn data_upgrade<B: IncusBackend>(
     State(app): State<App<B>>,
-    Path((universe, binding_id, environment, incarnation, target_id)): Path<(
+    Path((universe, binding, environment, incarnation, target_id)): Path<(
         String,
         String,
         String,
         String,
         String,
     )>,
-    upgrade: WebSocketUpgrade,
+    headers: HeaderMap,
+    upgrade: Result<WebSocketUpgrade, WebSocketUpgradeRejection>,
 ) -> Response {
-    let binding = ProviderBindingContext {
-        universe_id: universe.clone(),
-        binding_id: binding_id.clone(),
+    if !authorized(&app.config, &headers) {
+        return unauthorized();
+    }
+    let owner = match (
+        UniverseId::new(universe),
+        BindingId::new(binding),
+        EnvironmentId::new(environment),
+        IncarnationId::new(incarnation),
+    ) {
+        (Ok(universe_id), Ok(binding_id), Ok(environment_id), Ok(incarnation_id)) => TargetOwner {
+            universe_id,
+            binding_id,
+            environment_id,
+            incarnation_id,
+        },
+        _ => return StatusCode::NOT_FOUND.into_response(),
     };
-    let expected = policy::instance_name(&universe, &binding_id, &environment, &incarnation);
-    if expected != target_id {
-        return StatusCode::CONFLICT.into_response();
+    if target_id != policy::instance_name(&owner) {
+        return StatusCode::NOT_FOUND.into_response();
     }
-    let target_id = environment_protocol::shared::ProviderTargetId::new(target_id);
-    let target = match app.backend.get_owned(&binding, &target_id).await {
-        Ok(Some(target)) => target,
+    let target = match app
+        .backend
+        .get_owned(&policy::binding_of(&owner), &target_id)
+        .await
+    {
+        Ok(Some(target)) if target.owner == owner => target,
+        Ok(Some(_)) => return StatusCode::CONFLICT.into_response(),
         Ok(None) => return StatusCode::NOT_FOUND.into_response(),
         Err(_) => return StatusCode::BAD_GATEWAY.into_response(),
     };
-    if verify_binding(&target, &binding).is_err()
-        || target.environment_id != environment
-        || target.incarnation_id != incarnation
-    {
-        return StatusCode::CONFLICT.into_response();
-    }
+    let upgrade = match upgrade {
+        Ok(upgrade) => upgrade,
+        Err(rejection) => return rejection.into_response(),
+    };
     let guest = match relay::dial_guest(&app.config, &target).await {
         Ok(guest) => guest,
         Err(_) => return StatusCode::SERVICE_UNAVAILABLE.into_response(),
     };
     let config = app.config.clone();
-    upgrade
-        .max_message_size(64 * 1024 * 1024)
+    with_limits(upgrade)
         .on_upgrade(move |socket| relay::proxy(config, socket, guest))
         .into_response()
 }
 
-async fn connection<B: IncusBackend>(app: App<B>, mut socket: WebSocket) {
-    while let Some(Ok(message)) = socket.recv().await {
-        match message {
-            Message::Text(text) => {
-                let response = dispatch(&app, &text).await;
-                if socket
-                    .send(Message::Text(response.to_string().into()))
-                    .await
-                    .is_err()
-                {
+/// One controller connection: the JSON-RPC envelope, the `initialize`-first
+/// handshake, and pipelined requests answered in any order by one writer.
+async fn connection<B: IncusBackend>(app: App<B>, socket: WebSocket) {
+    let (mut sink, mut stream) = socket.split();
+    let (outgoing, mut queue) = mpsc::channel::<Message>(MAX_CONCURRENT_REQUESTS * 2);
+    let writer = tokio::spawn(async move {
+        while let Some(message) = queue.recv().await {
+            if sink.send(message).await.is_err() {
+                break;
+            }
+        }
+        let _ = sink.close().await;
+    });
+    let permits = Arc::new(Semaphore::new(MAX_CONCURRENT_REQUESTS));
+    let mut initialized = false;
+    while let Some(Ok(frame)) = stream.next().await {
+        let reply = match frame {
+            Message::Text(text) => match jsonrpc::parse(text.as_str()) {
+                Err(rejection) => rejection.into_response(),
+                Ok(jsonrpc::Message::Request(request)) => {
+                    if request.method == ControllerInitialize::NAME {
+                        Some(initialize(&app, &mut initialized, &request))
+                    } else if !initialized {
+                        Some(RpcResponse::failure(
+                            Some(request.id),
+                            ProtocolError::not_initialized(),
+                        ))
+                    } else {
+                        match permits.clone().try_acquire_owned() {
+                            Ok(permit) => {
+                                let app = app.clone();
+                                let outgoing = outgoing.clone();
+                                tokio::spawn(async move {
+                                    let response = handle(&app, request).await;
+                                    let _ = outgoing
+                                        .send(Message::Text(response.to_text().into()))
+                                        .await;
+                                    drop(permit);
+                                });
+                                None
+                            }
+                            Err(_) => Some(RpcResponse::failure(
+                                Some(request.id),
+                                ProtocolError::busy(
+                                    Some(BusyReason::RequestLimit),
+                                    None,
+                                    format!(
+                                        "more than {MAX_CONCURRENT_REQUESTS} requests in flight"
+                                    ),
+                                ),
+                            )),
+                        }
+                    }
+                }
+                // The controller plane defines no notifications, and this
+                // server sends no requests, so no response answers anything.
+                Ok(jsonrpc::Message::Notification(_) | jsonrpc::Message::Response(_)) => None,
+            },
+            Message::Binary(_) => Some(RpcResponse::failure(
+                None,
+                ProtocolError::invalid_request("binary frames are not part of any plane"),
+            )),
+            Message::Ping(payload) => {
+                if outgoing.send(Message::Pong(payload)).await.is_err() {
                     break;
                 }
+                None
             }
-            Message::Ping(bytes) => {
-                let _ = socket.send(Message::Pong(bytes)).await;
-            }
+            Message::Pong(_) => None,
             Message::Close(_) => break,
-            _ => {}
+        };
+        if let Some(reply) = reply
+            && outgoing
+                .send(Message::Text(reply.to_text().into()))
+                .await
+                .is_err()
+        {
+            break;
         }
     }
-    let _ = socket.send(Message::Close(None)).await;
+    drop(outgoing);
+    let _ = writer.await;
 }
 
-async fn dispatch<B: IncusBackend>(app: &App<B>, text: &str) -> Value {
-    let request: Value = match serde_json::from_str(text) {
-        Ok(value) => value,
-        Err(decode_error) => {
-            return error(
-                Value::Null,
-                EnvironmentProtocolErrorCode::InvalidRequest,
-                decode_error.to_string(),
-            );
+fn initialize<B>(app: &App<B>, initialized: &mut bool, request: &Request) -> RpcResponse {
+    let id = Some(request.id.clone());
+    if *initialized {
+        return RpcResponse::failure(
+            id,
+            ProtocolError::invalid_request("initialize was already called on this connection"),
+        );
+    }
+    // The version decides before the rest of the params: a peer of another
+    // version may send another shape.
+    if let Some(version) = request
+        .params
+        .get("protocolVersion")
+        .and_then(Value::as_u64)
+        && version != u64::from(CONTROLLER_PROTOCOL_VERSION)
+    {
+        return RpcResponse::failure(
+            id,
+            ProtocolError::version_mismatch(
+                CONTROLLER_PROTOCOL_VERSION,
+                u32::try_from(version).unwrap_or(u32::MAX),
+            ),
+        );
+    }
+    match request.params::<ControllerInitializeParams>() {
+        Ok(_) => {
+            *initialized = true;
+            RpcResponse::success(request.id.clone(), app.initialize.as_ref())
         }
+        Err(error) => RpcResponse::failure(id, error),
+    }
+}
+
+async fn handle<B: IncusBackend>(app: &App<B>, request: Request) -> RpcResponse {
+    let result = route(app, &request).await;
+    RpcResponse {
+        id: Some(request.id),
+        result,
+    }
+}
+
+async fn route<B: IncusBackend>(app: &App<B>, request: &Request) -> Result<Value, ProtocolError> {
+    let Some(spec) = manifest::find(Plane::Controller, &request.method)
+        .filter(|spec| spec.kind == MessageKind::Request)
+    else {
+        return Err(ProtocolError::method_not_found(&request.method));
     };
-    let id = request.get("id").cloned().unwrap_or(Value::Null);
-    let method = request
-        .get("method")
-        .and_then(Value::as_str)
-        .unwrap_or_default();
-    let params = request.get("params").cloned().unwrap_or_else(|| json!({}));
-    let result = match method {
-        INITIALIZE_METHOD => decode::<ControllerInitializeParams>(params)
-            .and_then(|params| {
-                if params.protocol_version != CURRENT_PROTOCOL_VERSION {
-                    anyhow::bail!("unsupported protocol version")
-                }
-                Ok(ControllerInitializeResponse {
-                    protocol_version: CURRENT_PROTOCOL_VERSION,
-                    capabilities: ControllerCapabilities {
-                        list_templates: true,
-                        list_targets: true,
-                        create_target: true,
-                        adopt_target: true,
-                        get_target: true,
-                        close_target: true,
-                        set_target_power: true,
-                        ingress: app.config.ingress.is_some(),
-                    },
-                    implementation: ImplementationInfo {
-                        name: "lightspeed-provider-incus".to_owned(),
-                        version: Some(release_info::VERSION.to_owned()),
-                        git_sha: Some(release_info::GIT_SHA.to_owned()),
-                        target: Some(release_info::TARGET.to_owned()),
-                    },
-                })
-            })
-            .and_then(encode),
-        LIST_TEMPLATES_METHOD => list_templates(app, decode(params)).await.and_then(encode),
-        LIST_TARGETS_METHOD => list_targets(app, decode(params)).await.and_then(encode),
-        CREATE_TARGET_METHOD => create_target(app, decode(params)).await.and_then(encode),
-        ADOPT_TARGET_METHOD => adopt_target(app, decode(params)).await.and_then(encode),
-        GET_TARGET_METHOD => get_target(app, decode(params)).await.and_then(encode),
-        CLOSE_TARGET_METHOD => close_target(app, decode(params)).await.and_then(encode),
-        SET_TARGET_POWER_METHOD => set_target_power(app, decode(params)).await.and_then(encode),
-        ENSURE_INGRESS_METHOD => ensure_ingress(app, decode(params)).await.and_then(encode),
-        REMOVE_INGRESS_METHOD => remove_ingress(app, decode(params)).await.and_then(encode),
-        _ => Err(anyhow::anyhow!("unknown controller method: {method}")),
-    };
-    match result {
-        Ok(result) => json!({"jsonrpc":"2.0","id":id,"result":result}),
-        Err(error_value) => error(
-            id,
-            EnvironmentProtocolErrorCode::Internal,
-            error_value.to_string(),
-        ),
+    let capabilities = &app.initialize.capabilities;
+    match spec.capability {
+        Some(Capability::AdoptTarget) if !capabilities.adopt_target => {
+            return Err(ProtocolError::capability_unavailable(
+                Capability::AdoptTarget,
+                "this provider does not adopt targets",
+            ));
+        }
+        Some(Capability::Ingress) if !capabilities.ingress => {
+            return Err(ProtocolError::capability_unavailable(
+                Capability::Ingress,
+                "this provider has no public ingress configured",
+            ));
+        }
+        _ => {}
+    }
+    match request.method.as_str() {
+        TemplateList::NAME => encode(list_templates(app, request.params()?)),
+        TargetCreate::NAME => encode(create_target(app, request.params()?).await?),
+        TargetAdopt::NAME => encode(adopt_target(app, request.params()?).await?),
+        TargetGet::NAME => encode(get_target(app, request.params()?).await?),
+        TargetSetPower::NAME => encode(set_target_power(app, request.params()?).await?),
+        TargetClose::NAME => encode(close_target(app, request.params()?).await?),
+        IngressEnsure::NAME => encode(ensure_ingress(app, request.params()?).await?),
+        IngressRemove::NAME => encode(remove_ingress(app, request.params()?).await?),
+        _ => Err(ProtocolError::method_not_found(&request.method)),
     }
 }
 
-async fn list_templates<B: IncusBackend>(
-    app: &App<B>,
-    params: anyhow::Result<ListTemplatesParams>,
-) -> anyhow::Result<ListTemplatesResponse> {
-    let _params = params?;
-    Ok(ListTemplatesResponse {
+fn encode<T: Serialize>(value: T) -> Result<Value, ProtocolError> {
+    serde_json::to_value(value)
+        .map_err(|error| ProtocolError::internal(format!("encode result: {error}")))
+}
+
+fn list_templates<B>(app: &App<B>, _params: ListTemplatesParams) -> ListTemplatesResponse {
+    ListTemplatesResponse {
         templates: app
             .config
             .templates
@@ -223,463 +429,1368 @@ async fn list_templates<B: IncusBackend>(
                 description: template.description.clone(),
                 public_ingress: template.public_ingress,
                 deprecated: template.deprecated,
-                metadata: BTreeMap::from([
-                    (
-                        "imageFingerprint".to_owned(),
-                        template.image_fingerprint.clone(),
-                    ),
-                    ("cpu".to_owned(), template.cpu.to_string()),
-                    ("memory".to_owned(), template.memory.clone()),
-                    ("disk".to_owned(), template.disk.clone()),
-                ]),
+                resources: Some(template.resources.clone()),
+                metadata: display_metadata([(
+                    "imageFingerprint",
+                    template.image_fingerprint.as_str(),
+                )]),
             })
             .collect(),
-    })
+    }
 }
 
-async fn list_targets<B: IncusBackend>(
+async fn get_target<B: IncusBackend>(
     app: &App<B>,
-    params: anyhow::Result<ListTargetsParams>,
-) -> anyhow::Result<ListTargetsResponse> {
-    let params = params?;
-    let binding = &params.binding;
-    let config = app.config.clone();
-    let mut targets = stream::iter(app.backend.list_owned(binding).await?)
-        .map(move |mut target| {
-            let config = config.clone();
-            async move {
-                observe_daemon_readiness(&config, &mut target).await;
-                target
-            }
-        })
-        .buffer_unordered(16)
-        .collect::<Vec<_>>()
-        .await;
-    if let Some(status) = params.status {
-        targets.retain(|target| target.status == status);
-    }
-    Ok(ListTargetsResponse {
-        targets: targets.into_iter().map(summary).collect(),
-    })
+    params: GetTargetParams,
+) -> Result<TargetResponse, ProtocolError> {
+    let owner = &params.target.owner;
+    let name = resolve(app, &params.target).await?;
+    let observed = observe(app, owner, &name).await?;
+    observation(app, owner, &name, &observed, true)
+        .await
+        .map(|target| TargetResponse { target })
+        .ok_or_else(|| ProtocolError::not_found(format!("no target exists for owner {name}")))
 }
 
-async fn get_target<B: IncusBackend>(
+async fn create_target<B: IncusBackend>(
     app: &App<B>,
-    params: anyhow::Result<GetTargetParams>,
-) -> anyhow::Result<GetTargetResponse> {
-    let params = params?;
-    let binding = &params.binding;
-    let mut target = app
-        .backend
-        .get_owned(binding, &params.target_id)
+    params: CreateTargetParams,
+) -> Result<TargetResponse, ProtocolError> {
+    let owner = params.owner;
+    let name = policy::instance_name(&owner);
+    let observed = observe(app, &owner, &name).await?;
+    if observed.holds_target() {
+        // Idempotent per owner: an owner that holds a target gets it back,
+        // and no creation policy runs again.
+        return observed_response(app, &owner, &name, &observed).await;
+    }
+    let template = app
+        .config
+        .templates
+        .get(&params.template_id)
+        .ok_or_else(|| {
+            ProtocolError::not_found(format!(
+                "template {} is not offered by this provider",
+                params.template_id
+            ))
+        })?;
+    if template.deprecated {
+        return Err(ProtocolError::failed_precondition(
+            PreconditionReason::TemplateDeprecated,
+            format!(
+                "template {} is deprecated and creates no new targets",
+                template.template_id
+            ),
+        ));
+    }
+    let template = template.clone();
+    let backend = app.backend.clone();
+    let job_owner = owner.clone();
+    let job_name = name.clone();
+    let job = async move {
+        let binding = policy::binding_of(&job_owner);
+        if backend.get_owned(&binding, &job_name).await?.is_some() {
+            return Ok(());
+        }
+        backend.reconcile_binding(&binding).await?;
+        backend.ensure_image(&template.image_fingerprint).await?;
+        backend.create_vm(&job_owner, &template).await
+    };
+    let target = mutate(app, &owner, &name, WorkKind::Create, job.boxed())
         .await?
-        .ok_or_else(|| anyhow::anyhow!("target not found"))?;
-    verify_binding(&target, binding)?;
-    observe_daemon_readiness(&app.config, &mut target).await;
-    Ok(GetTargetResponse {
-        target: summary(target),
-    })
+        .ok_or_else(|| ProtocolError::unavailable("the created Incus instance is not visible"))?;
+    Ok(TargetResponse { target })
 }
 
-async fn create_target<B: IncusBackend>(
+async fn adopt_target<B: IncusBackend>(
     app: &App<B>,
-    params: anyhow::Result<CreateTargetParams>,
-) -> anyhow::Result<CreateTargetResponse> {
-    let params = params?;
-    let binding = params.binding.clone();
-    let binding_lock = {
-        let mut locks = app.binding_locks.lock().await;
-        locks
-            .entry((
-                params.binding.universe_id.clone(),
-                params.binding.binding_id.clone(),
-            ))
-            .or_default()
-            .clone()
+    params: AdoptTargetParams,
+) -> Result<TargetResponse, ProtocolError> {
+    let owner = params.owner;
+    let source = params.source_target;
+    let name = policy::instance_name(&owner);
+    let observed = observe(app, &owner, &name).await?;
+    let adopting_this = match (&observed.instance, &observed.slot) {
+        (_, Some(slot)) if slot.running() && slot.kind == WorkKind::Close => true,
+        (Some(instance), _) => instance.adoption_source.as_deref() == Some(source.as_str()),
+        (None, Some(slot)) if slot.running() => slot.kind == WorkKind::Adopt,
+        (None, _) => {
+            crate::incus::parse_source_target(source.as_str())
+                .map_err(|error| ProtocolError::invalid_field("sourceTarget", error.to_string()))?;
+            match app
+                .backend
+                .adoption_source(&source)
+                .await
+                .map_err(unavailable)?
+            {
+                AdoptionSource::Adoptable => {}
+                AdoptionSource::Missing => {
+                    return Err(ProtocolError::not_found(format!(
+                        "adoption source {source} does not exist"
+                    )));
+                }
+                AdoptionSource::Managed => {
+                    return Err(ProtocolError::failed_precondition(
+                        PreconditionReason::OwnerMismatch,
+                        format!("adoption source {source} already belongs to an owner"),
+                    ));
+                }
+                AdoptionSource::NotAdoptable(reason) => {
+                    return Err(ProtocolError::failed_precondition(
+                        PreconditionReason::NotAdoptable,
+                        format!("adoption source {source}: {reason}"),
+                    ));
+                }
+            }
+            let backend = app.backend.clone();
+            let job_owner = owner.clone();
+            let job_name = name.clone();
+            let job = async move {
+                let binding = policy::binding_of(&job_owner);
+                if backend.get_owned(&binding, &job_name).await?.is_some() {
+                    return Ok(());
+                }
+                backend.reconcile_binding(&binding).await?;
+                backend.adopt_vm(&job_owner, &source).await
+            };
+            let target = mutate(app, &owner, &name, WorkKind::Adopt, job.boxed())
+                .await?
+                .ok_or_else(|| {
+                    ProtocolError::unavailable("the adopted Incus instance is not visible")
+                })?;
+            return Ok(TargetResponse { target });
+        }
     };
-    let _binding_guard = binding_lock.lock().await;
-    let template = app.config.template(&params.template_id)?;
-    app.backend.reconcile_binding(&binding).await?;
-    app.backend
-        .ensure_image(&template.image_fingerprint)
-        .await?;
-    let expected_target_id = policy::instance_name(
-        &params.binding.universe_id,
-        &params.binding.binding_id,
-        &params.environment_id,
-        &params.incarnation_id,
-    );
-    if let Some(mut target) = app
-        .backend
-        .get_owned(&binding, &expected_target_id.clone().into())
+    if !adopting_this {
+        return Err(ProtocolError::failed_precondition(
+            PreconditionReason::OwnerMismatch,
+            "the owner already holds a different target",
+        ));
+    }
+    observed_response(app, &owner, &name, &observed).await
+}
+
+async fn set_target_power<B: IncusBackend>(
+    app: &App<B>,
+    params: SetTargetPowerParams,
+) -> Result<TargetResponse, ProtocolError> {
+    let power = params.power;
+    if !SUPPORTED_POWER_STATES.contains(&power) {
+        return Err(ProtocolError::invalid_field(
+            "power",
+            format!("this provider cannot move a target to {power}"),
+        ));
+    }
+    let owner = &params.target.owner;
+    let name = resolve(app, &params.target).await?;
+    let observed = observe(app, owner, &name).await?;
+    let current = observation(app, owner, &name, &observed, false)
+        .await
+        .ok_or_else(|| ProtocolError::not_found(format!("target {name} does not exist")))?;
+    if current.state.phase != TargetPhase::Active {
+        return Err(ProtocolError::failed_precondition(
+            PreconditionReason::TargetNotActive,
+            format!("target {name} is {:?}, not active", current.state.phase),
+        ));
+    }
+    if current.state.power == Some(power) && !observed.slot.as_ref().is_some_and(Slot::running) {
+        return observed_response(app, owner, &name, &observed).await;
+    }
+    let backend = app.backend.clone();
+    let binding = policy::binding_of(owner);
+    let job_name = name.clone();
+    let job = async move {
+        let target = backend
+            .get_owned(&binding, &job_name)
+            .await?
+            .ok_or_else(|| anyhow::anyhow!("the Incus instance disappeared"))?;
+        backend.set_power(&target, power).await
+    };
+    let target = mutate(app, owner, &name, WorkKind::Power(power), job.boxed())
         .await?
-    {
-        verify_create(&target, &params, template)?;
-        observe_daemon_readiness(&app.config, &mut target).await;
-        return Ok(CreateTargetResponse {
-            target: summary(target),
+        .ok_or_else(|| ProtocolError::not_found(format!("target {name} disappeared")))?;
+    Ok(TargetResponse { target })
+}
+
+async fn close_target<B: IncusBackend>(
+    app: &App<B>,
+    params: CloseTargetParams,
+) -> Result<TargetResponse, ProtocolError> {
+    let owner = &params.target.owner;
+    let name = resolve(app, &params.target).await?;
+    let observed = observe(app, owner, &name).await?;
+    if !observed.holds_target() {
+        app.work.forget(&name);
+        return Ok(TargetResponse {
+            target: closed(owner),
         });
     }
-    let existing = app.backend.list_owned(&binding).await?;
-    if let Some(target) = existing
-        .iter()
-        .find(|target| target.request_id == params.request_id)
-    {
-        verify_create(target, &params, template)?;
-        let mut target = target.clone();
-        observe_daemon_readiness(&app.config, &mut target).await;
-        return Ok(CreateTargetResponse {
-            target: summary(target),
+    let backend = app.backend.clone();
+    let binding = policy::binding_of(owner);
+    let job_name = name.clone();
+    let job = async move {
+        match backend.get_owned(&binding, &job_name).await? {
+            Some(target) => backend.delete_vm(&target).await,
+            None => Ok(()),
+        }
+    };
+    app.work.start(&name, WorkKind::Close, job.boxed());
+    wait_for_work(app, &name).await;
+    let observed = observe(app, owner, &name).await?;
+    if !observed.holds_target() {
+        return Ok(TargetResponse {
+            target: closed(owner),
         });
     }
-    let mut target = app.backend.create_vm(&binding, template, &params).await?;
-    verify_create(&target, &params, template)?;
-    observe_daemon_readiness(&app.config, &mut target).await;
-    Ok(CreateTargetResponse {
-        target: summary(target),
-    })
+    let mut target = observation(app, owner, &name, &observed, false)
+        .await
+        .unwrap_or_else(|| closed(owner));
+    // Until the instance is gone, a close answers closing, with the error of
+    // a failed attempt as its message; the next close tries again.
+    target.state = TargetState {
+        phase: TargetPhase::Closing,
+        power: None,
+        daemon_ready: false,
+        message: target.state.message,
+    };
+    target.supported_power_states.clear();
+    Ok(TargetResponse { target })
 }
 
-async fn adopt_target<B: IncusBackend>(
+async fn ensure_ingress<B: IncusBackend>(
     app: &App<B>,
-    params: anyhow::Result<AdoptTargetParams>,
-) -> anyhow::Result<AdoptTargetResponse> {
-    let params = params?;
-    let binding = params.binding.clone();
-    let binding_lock = {
-        let mut locks = app.binding_locks.lock().await;
-        locks
-            .entry((binding.universe_id.clone(), binding.binding_id.clone()))
-            .or_default()
-            .clone()
+    params: EnsureIngressParams,
+) -> Result<TargetResponse, ProtocolError> {
+    let owner = &params.target.owner;
+    let name = resolve(app, &params.target).await?;
+    let observed = observe(app, owner, &name).await?;
+    let Some(instance) = ingress_subject(app, owner, &name, &observed).await? else {
+        return observed_response(app, owner, &name, &observed).await;
     };
-    let _binding_guard = binding_lock.lock().await;
-    app.backend.reconcile_binding(&binding).await?;
-    let mut target = app.backend.adopt_vm(&binding, &params).await?;
-    verify_adoption(&target, &params)?;
-    observe_daemon_readiness(&app.config, &mut target).await;
-    Ok(AdoptTargetResponse {
-        target: summary(target),
-    })
+    let port = TemplateId::new(instance.template_id.as_str())
+        .ok()
+        .and_then(|template_id| app.config.templates.get(&template_id))
+        .and_then(|template| template.ingress_port)
+        .ok_or_else(|| {
+            ProtocolError::failed_precondition(
+                PreconditionReason::IngressUnsupported,
+                format!("the template of target {name} has no public ingress"),
+            )
+        })?;
+    let hostname = ingress::allocated_hostname(&app.config, &instance).map_err(|error| {
+        ProtocolError::internal(format!("allocate ingress hostname: {error:#}"))
+    })?;
+    if instance.ingress_hostname.as_deref() == Some(hostname.as_str())
+        && instance.ingress_port == Some(port)
+    {
+        return observed_response(app, owner, &name, &observed).await;
+    }
+    let backend = app.backend.clone();
+    let binding = policy::binding_of(owner);
+    let job_name = name.clone();
+    let job = async move {
+        let target = backend
+            .get_owned(&binding, &job_name)
+            .await?
+            .ok_or_else(|| anyhow::anyhow!("the Incus instance disappeared"))?;
+        backend.set_ingress(&target, Some((&hostname, port))).await
+    };
+    let target = mutate(
+        app,
+        owner,
+        &name,
+        WorkKind::Ingress { enabled: true },
+        job.boxed(),
+    )
+    .await?
+    .ok_or_else(|| ProtocolError::not_found(format!("target {name} disappeared")))?;
+    Ok(TargetResponse { target })
 }
 
-async fn close_target<B: IncusBackend>(
+async fn remove_ingress<B: IncusBackend>(
     app: &App<B>,
-    params: anyhow::Result<CloseTargetParams>,
-) -> anyhow::Result<CloseTargetResponse> {
-    let params = params?;
-    let binding = &params.binding;
-    let expected_target_id = policy::instance_name(
-        &params.binding.universe_id,
-        &params.binding.binding_id,
-        &params.environment_id,
-        &params.incarnation_id,
-    );
-    if params.target_id.as_str() != expected_target_id {
-        anyhow::bail!("target handle does not match deterministic ownership identity")
-    }
-    let Some(target) = app.backend.get_owned(binding, &params.target_id).await? else {
-        return Ok(CloseTargetResponse {
-            target_id: params.target_id,
-            status: ProviderTargetStatus::Closed,
-        });
+    params: RemoveIngressParams,
+) -> Result<TargetResponse, ProtocolError> {
+    let owner = &params.target.owner;
+    let name = resolve(app, &params.target).await?;
+    let observed = observe(app, owner, &name).await?;
+    let Some(instance) = ingress_subject(app, owner, &name, &observed).await? else {
+        return observed_response(app, owner, &name, &observed).await;
     };
-    verify_binding(&target, binding)?;
-    if target.environment_id != params.environment_id
-        || target.incarnation_id != params.incarnation_id
-    {
-        anyhow::bail!("target ownership does not match close request")
-    }
-    app.backend
-        .delete_vm(binding, &target, params.force)
-        .await?;
-    Ok(CloseTargetResponse {
-        target_id: params.target_id,
-        status: ProviderTargetStatus::Closed,
+    if instance.ingress_hostname.is_none() && instance.ingress_port.is_none() {
+        return observed_response(app, owner, &name, &observed).await;
+    }
+    let backend = app.backend.clone();
+    let binding = policy::binding_of(owner);
+    let job_name = name.clone();
+    let job = async move {
+        let target = backend
+            .get_owned(&binding, &job_name)
+            .await?
+            .ok_or_else(|| anyhow::anyhow!("the Incus instance disappeared"))?;
+        backend.set_ingress(&target, None).await
+    };
+    let target = mutate(
+        app,
+        owner,
+        &name,
+        WorkKind::Ingress { enabled: false },
+        job.boxed(),
+    )
+    .await?
+    .ok_or_else(|| ProtocolError::not_found(format!("target {name} disappeared")))?;
+    Ok(TargetResponse { target })
+}
+
+/// The instance whose ingress may change, `None` when the target is closing
+/// (the caller answers with the observation), or an error when there is no
+/// instance yet or at all.
+async fn ingress_subject<B: IncusBackend>(
+    app: &App<B>,
+    owner: &TargetOwner,
+    name: &str,
+    observed: &Observed,
+) -> Result<Option<OwnedTarget>, ProtocolError> {
+    let current = observation(app, owner, name, observed, false)
+        .await
+        .ok_or_else(|| ProtocolError::not_found(format!("target {name} does not exist")))?;
+    if current.state.phase == TargetPhase::Closing {
+        return Ok(None);
+    }
+    observed.instance.clone().map(Some).ok_or_else(|| {
+        ProtocolError::failed_precondition(
+            PreconditionReason::TargetNotActive,
+            format!("target {name} has no instance yet"),
+        )
     })
 }
 
-async fn set_target_power<B: IncusBackend>(
+/// The instance name a reference resolves to. The provider assigns exactly
+/// one name per owner; a `targetId` naming any other instance is another
+/// owner's target or none at all.
+async fn resolve<B: IncusBackend>(
     app: &App<B>,
-    params: anyhow::Result<SetTargetPowerParams>,
-) -> anyhow::Result<SetTargetPowerResponse> {
-    let params = params?;
-    let binding = &params.binding;
-    let expected_target_id = policy::instance_name(
-        &params.binding.universe_id,
-        &params.binding.binding_id,
-        &params.environment_id,
-        &params.incarnation_id,
-    );
-    if params.target_id.as_str() != expected_target_id {
-        anyhow::bail!("target handle does not match deterministic ownership identity")
-    }
-    let target = app
-        .backend
-        .get_owned(binding, &params.target_id)
-        .await?
-        .ok_or_else(|| anyhow::anyhow!("target not found"))?;
-    verify_binding(&target, binding)?;
-    if target.environment_id != params.environment_id
-        || target.incarnation_id != params.incarnation_id
+    target: &TargetRef,
+) -> Result<String, ProtocolError> {
+    let name = policy::instance_name(&target.owner);
+    if let Some(target_id) = &target.target_id
+        && target_id.as_str() != name
     {
-        anyhow::bail!("target ownership does not match power request")
+        // A target being created is known by its job before its instance
+        // exists.
+        let foreign = app.work.view(target_id.as_str()).is_some()
+            || app
+                .backend
+                .get_owned(&policy::binding_of(&target.owner), target_id.as_str())
+                .await
+                .map_err(unavailable)?
+                .is_some();
+        return Err(if foreign {
+            owner_mismatch(target_id.as_str())
+        } else {
+            ProtocolError::not_found(format!("target {target_id} does not exist"))
+        });
     }
-    let mut target = app
-        .backend
-        .set_power(binding, &target, params.power)
-        .await?;
-    observe_daemon_readiness(&app.config, &mut target).await;
-    Ok(SetTargetPowerResponse {
-        target: summary(target),
-    })
+    Ok(name)
 }
 
-async fn ensure_ingress<B: IncusBackend>(
+/// What the provider knows about one owner's target.
+struct Observed {
+    instance: Option<OwnedTarget>,
+    slot: Option<Slot>,
+}
+
+impl Observed {
+    /// The owner holds something: an instance or work in progress.
+    fn holds_target(&self) -> bool {
+        self.instance.is_some() || self.slot.as_ref().is_some_and(Slot::running)
+    }
+}
+
+async fn observe<B: IncusBackend>(
     app: &App<B>,
-    params: anyhow::Result<EnsureIngressParams>,
-) -> anyhow::Result<IngressResponse> {
-    let params = params?;
-    let binding = &params.binding;
-    let mut target = app
-        .backend
-        .get_owned(binding, &params.target_id)
-        .await?
-        .ok_or_else(|| anyhow::anyhow!("target not found"))?;
-    verify_ingress_target(
-        &target,
-        binding,
-        &params.environment_id,
-        &params.incarnation_id,
-    )?;
-    let template = app
-        .config
-        .templates
-        .get(&target.template_id)
-        .ok_or_else(|| anyhow::anyhow!("target template is no longer configured"))?;
-    let port = template
-        .ingress_port
-        .ok_or_else(|| anyhow::anyhow!("template does not permit public ingress"))?;
-    let (hostname, endpoint) = ingress::endpoint(&app.config, &target)?;
-    target = app
+    owner: &TargetOwner,
+    name: &str,
+) -> Result<Observed, ProtocolError> {
+    let instance = app
         .backend
-        .set_ingress(binding, &target, Some(&hostname), Some(port))
-        .await?;
-    verify_ingress_target(
-        &target,
-        binding,
-        &params.environment_id,
-        &params.incarnation_id,
-    )?;
-    Ok(IngressResponse {
-        status: ProviderIngressStatus::Ready,
-        public_endpoint: Some(endpoint),
+        .get_owned(&policy::binding_of(owner), name)
+        .await
+        .map_err(unavailable)?;
+    if let Some(instance) = &instance
+        && instance.owner != *owner
+    {
+        return Err(owner_mismatch(name));
+    }
+    Ok(Observed {
+        instance,
+        slot: app.work.view(name),
     })
 }
 
-async fn remove_ingress<B: IncusBackend>(
+async fn observed_response<B: IncusBackend>(
+    app: &App<B>,
+    owner: &TargetOwner,
+    name: &str,
+    observed: &Observed,
+) -> Result<TargetResponse, ProtocolError> {
+    observation(app, owner, name, observed, true)
+        .await
+        .map(|target| TargetResponse { target })
+        .ok_or_else(|| ProtocolError::not_found(format!("target {name} does not exist")))
+}
+
+/// The observation of a target, or `None` when the owner holds nothing.
+/// `probe` runs the envd liveness probe for a running instance.
+///
+/// `targetId` is reported only once the Incus instance exists. Until then
+/// the runtime keeps sending the idempotent `target/create` (or
+/// `target/adopt`), which starts the job again when it failed or was lost
+/// with a provider restart; a failed attempt is reported as `provisioning`
+/// with its error as `message`, so the runtime retries it until its
+/// provisioning deadline instead of failing at the first Incus hiccup.
+async fn observation<B: IncusBackend>(
     app: &App<B>,
-    params: anyhow::Result<RemoveIngressParams>,
-) -> anyhow::Result<IngressResponse> {
-    let params = params?;
-    let binding = &params.binding;
-    let Some(target) = app.backend.get_owned(binding, &params.target_id).await? else {
-        return Ok(IngressResponse {
-            status: ProviderIngressStatus::Disabled,
-            public_endpoint: None,
+    owner: &TargetOwner,
+    name: &str,
+    observed: &Observed,
+    probe: bool,
+) -> Option<TargetObservation> {
+    let failure = observed.slot.as_ref().and_then(Slot::failure);
+    let running = observed
+        .slot
+        .as_ref()
+        .filter(|slot| slot.running())
+        .map(|slot| slot.kind);
+    let failed_creation = observed
+        .slot
+        .as_ref()
+        .filter(|slot| !slot.running())
+        .and_then(|slot| match slot.kind {
+            WorkKind::Create => Some("target/create"),
+            WorkKind::Adopt => Some("target/adopt"),
+            _ => None,
         });
+    let state = match (running, &observed.instance) {
+        (Some(WorkKind::Close), _) => {
+            phase_state(TargetPhase::Closing, None, "closing the Incus instance")
+        }
+        (Some(WorkKind::Create), _) => phase_state(
+            TargetPhase::Provisioning,
+            None,
+            "creating and starting the Incus instance",
+        ),
+        (Some(WorkKind::Adopt), _) => phase_state(
+            TargetPhase::Provisioning,
+            None,
+            "adopting the Incus instance",
+        ),
+        (_, Some(instance)) => {
+            let mut state = instance_state(instance);
+            if probe && instance.status == InstanceStatus::Running {
+                state.daemon_ready = relay::probe_guest(&app.config, instance).await;
+            }
+            if state.message.is_none() {
+                state.message = failure.and_then(DescriptiveText::lossy);
+            }
+            state
+        }
+        (_, None) => {
+            let retried_by = failed_creation?;
+            phase_state(
+                TargetPhase::Provisioning,
+                None,
+                &format!(
+                    "the last attempt failed and the next {retried_by} retries it: {}",
+                    failure.unwrap_or("unknown error")
+                ),
+            )
+        }
+    };
+    let target_id = match &observed.instance {
+        Some(_) => Some(ProviderTargetId::new(name).ok()?),
+        None => None,
     };
-    verify_ingress_target(
-        &target,
-        binding,
-        &params.environment_id,
-        &params.incarnation_id,
-    )?;
-    app.backend
-        .set_ingress(binding, &target, None, None)
-        .await?;
-    Ok(IngressResponse {
-        status: ProviderIngressStatus::Disabled,
-        public_endpoint: None,
+    let instance = observed.instance.as_ref();
+    let ingress = instance
+        .and_then(|instance| instance.ingress_hostname.as_deref())
+        .and_then(|hostname| ingress::public_endpoint(&app.config, hostname).ok())
+        .map(|endpoint| IngressObservation { endpoint });
+    let metadata = instance.map_or_else(Metadata::default, |instance| {
+        display_metadata([
+            ("templateId", instance.template_id.as_str()),
+            ("imageFingerprint", instance.image_fingerprint.as_str()),
+            (
+                "incusMember",
+                instance.location.as_deref().unwrap_or_default(),
+            ),
+        ])
+    });
+    let supported_power_states = if state.phase == TargetPhase::Closing {
+        Vec::new()
+    } else {
+        SUPPORTED_POWER_STATES.to_vec()
+    };
+    Some(TargetObservation {
+        target_id,
+        owner: owner.clone(),
+        display_name: None,
+        state,
+        supported_power_states,
+        ingress,
+        metadata,
     })
 }
 
-fn verify_ingress_target(
-    target: &OwnedTarget,
-    binding: &ProviderBindingContext,
-    environment: &str,
-    incarnation: &str,
-) -> anyhow::Result<()> {
-    verify_binding(target, binding)?;
-    if target.environment_id != environment || target.incarnation_id != incarnation {
-        anyhow::bail!("target ownership does not match ingress request")
+fn phase_state(phase: TargetPhase, power: Option<PowerState>, message: &str) -> TargetState {
+    TargetState {
+        phase,
+        power,
+        daemon_ready: false,
+        message: DescriptiveText::lossy(message),
     }
-    Ok(())
 }
 
-fn verify_binding(target: &OwnedTarget, binding: &ProviderBindingContext) -> anyhow::Result<()> {
-    if target.universe_id != binding.universe_id || target.binding_id != binding.binding_id {
-        anyhow::bail!("target belongs to another binding")
+/// The two-axis state an Incus instance status maps to. A starting VM is
+/// reported running and a stopping one stopped: `power` names where the
+/// target is going, and `daemonReady` says whether envd answers yet.
+fn instance_state(instance: &OwnedTarget) -> TargetState {
+    let active = |power| TargetState {
+        phase: TargetPhase::Active,
+        power: Some(power),
+        daemon_ready: false,
+        message: None,
+    };
+    match instance.status {
+        InstanceStatus::Running | InstanceStatus::Starting => active(PowerState::Running),
+        InstanceStatus::Frozen => active(PowerState::Paused),
+        InstanceStatus::Stopped | InstanceStatus::Stopping => active(PowerState::Stopped),
+        InstanceStatus::Error => phase_state(
+            TargetPhase::Failed,
+            None,
+            "Incus reports the instance in the Error state",
+        ),
+        InstanceStatus::Other => phase_state(
+            TargetPhase::Unknown,
+            None,
+            "Incus reports an instance status this provider does not recognize",
+        ),
     }
-    Ok(())
 }
-fn verify_create(
-    target: &OwnedTarget,
-    params: &CreateTargetParams,
-    template: &crate::config::TemplatePolicy,
-) -> anyhow::Result<()> {
-    if target.universe_id != params.binding.universe_id
-        || target.binding_id != params.binding.binding_id
-        || target.environment_id != params.environment_id
-        || target.incarnation_id != params.incarnation_id
-        || target.request_id != params.request_id
-        || target.template_id != template.template_id
-        || target.image_fingerprint != template.image_fingerprint
-    {
-        anyhow::bail!("existing target metadata conflicts with provision request")
+
+fn closed(owner: &TargetOwner) -> TargetObservation {
+    TargetObservation {
+        target_id: None,
+        owner: owner.clone(),
+        display_name: None,
+        state: TargetState {
+            phase: TargetPhase::Closed,
+            power: None,
+            daemon_ready: false,
+            message: None,
+        },
+        supported_power_states: Vec::new(),
+        ingress: None,
+        metadata: Metadata::default(),
     }
-    Ok(())
 }
 
-fn verify_adoption(target: &OwnedTarget, params: &AdoptTargetParams) -> anyhow::Result<()> {
-    if target.universe_id != params.binding.universe_id
-        || target.binding_id != params.binding.binding_id
-        || target.environment_id != params.environment_id
-        || target.incarnation_id != params.incarnation_id
-        || target.request_id != params.request_id
-        || target.template_id != "adopted"
-        || target.image_fingerprint != "adopted"
-        || target.adoption_source.as_deref() != Some(params.source_target.as_str())
-    {
-        anyhow::bail!("existing target metadata conflicts with adoption request")
+/// Provider display facts; entries outside the metadata bounds are left out.
+fn display_metadata<'a>(entries: impl IntoIterator<Item = (&'a str, &'a str)>) -> Metadata {
+    let entries: BTreeMap<String, String> = entries
+        .into_iter()
+        .filter(|(key, value)| validate_metadata_entry(key, value).is_ok())
+        .map(|(key, value)| (key.to_owned(), value.to_owned()))
+        .collect();
+    Metadata::new(entries).unwrap_or_default()
+}
+
+fn unavailable(error: anyhow::Error) -> ProtocolError {
+    ProtocolError::unavailable(format!("Incus: {error:#}"))
+}
+
+fn owner_mismatch(target_id: &str) -> ProtocolError {
+    ProtocolError::failed_precondition(
+        PreconditionReason::OwnerMismatch,
+        format!("target {target_id} belongs to another owner"),
+    )
+}
+
+/// Start `job` for the target and wait up to the prompt bound, then
+/// observe.
+async fn mutate<B: IncusBackend>(
+    app: &App<B>,
+    owner: &TargetOwner,
+    name: &str,
+    kind: WorkKind,
+    job: BoxFuture<'static, anyhow::Result<()>>,
+) -> Result<Option<TargetObservation>, ProtocolError> {
+    app.work.start(name, kind, job);
+    wait_for_work(app, name).await;
+    let observed = observe(app, owner, name).await?;
+    Ok(observation(app, owner, name, &observed, true).await)
+}
+
+async fn wait_for_work<B>(app: &App<B>, name: &str) {
+    if let Some(mut done) = app.work.done(name) {
+        let _ = tokio::time::timeout(PROMPT_WAIT, done.wait_for(|finished| *finished)).await;
     }
-    Ok(())
 }
-async fn observe_daemon_readiness(config: &Config, target: &mut OwnedTarget) {
-    if target.status == ProviderTargetStatus::Ready && !relay::probe_guest(config, target).await {
-        target.status = ProviderTargetStatus::Starting;
-    }
-}
-fn summary(target: OwnedTarget) -> ProviderTargetSummary {
-    let mut metadata = BTreeMap::from([
-        ("templateId".to_owned(), target.template_id),
-        ("imageFingerprint".to_owned(), target.image_fingerprint),
-    ]);
-    if let Some(location) = target.location {
-        metadata.insert("incusMember".to_owned(), location);
-    }
-    let mut capabilities = EnvironmentCapabilities::filesystem(true, true)
-        .with_filesystem_search()
-        .with_process()
-        .with_jobs();
-    // Keep the controller-plane summary aligned with the envd handshake. The
-    // runtime consumes this summary before opening the data-plane connection.
-    capabilities.network = true;
-    capabilities.filesystem_glob = true;
-    capabilities.filesystem_ranged_read = true;
-    capabilities.process_output_notifications = false;
-    capabilities.process_pty = true;
-    ProviderTargetSummary {
-        target_id: target.target_id,
-        display_name: Some(target.environment_id),
-        status: target.status,
-        scope: EnvironmentScope::Default,
-        capabilities,
-        default_cwd: None,
-        power_states: crate::incus::SUPPORTED_POWER_STATES.to_vec(),
-        metadata,
+
+/// The background job kinds; at most one job per target is current.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum WorkKind {
+    Create,
+    Adopt,
+    Power(PowerState),
+    Ingress { enabled: bool },
+    Close,
+}
+
+#[derive(Clone, Debug)]
+enum SlotState {
+    Running,
+    Failed(String),
+}
+
+/// The current job of one target: running, or failed with its error. A job
+/// that succeeds leaves no slot, because Incus then holds the truth.
+#[derive(Clone, Debug)]
+struct Slot {
+    id: u64,
+    kind: WorkKind,
+    state: SlotState,
+    done: watch::Receiver<bool>,
+}
+
+impl Slot {
+    fn running(&self) -> bool {
+        matches!(self.state, SlotState::Running)
+    }
+
+    fn failure(&self) -> Option<&str> {
+        match &self.state {
+            SlotState::Failed(message) => Some(message),
+            SlotState::Running => None,
+        }
     }
 }
-fn decode<T: DeserializeOwned>(value: Value) -> anyhow::Result<T> {
-    Ok(serde_json::from_value(value)?)
+
+/// Background jobs by instance name. Jobs of one target run one at a time
+/// under that target's lock; a newer request of another kind replaces the
+/// current slot (a close supersedes a running create) and its job runs once
+/// the earlier one finished.
+#[derive(Default)]
+struct Work {
+    next_id: AtomicU64,
+    inner: StdMutex<WorkInner>,
 }
-fn encode<T: serde::Serialize>(value: T) -> anyhow::Result<Value> {
-    Ok(serde_json::to_value(value)?)
+
+#[derive(Default)]
+struct WorkInner {
+    slots: HashMap<String, Slot>,
+    locks: HashMap<String, Arc<AsyncMutex<()>>>,
 }
-fn error(id: Value, code: EnvironmentProtocolErrorCode, message: String) -> Value {
-    json!({"jsonrpc":"2.0","id":id,"error":EnvironmentProtocolError::new(code,message)})
+
+impl Work {
+    fn lock(&self) -> std::sync::MutexGuard<'_, WorkInner> {
+        self.inner
+            .lock()
+            .unwrap_or_else(|poisoned| poisoned.into_inner())
+    }
+
+    /// Run `job` as the target's current job unless a job of the same kind
+    /// is already running.
+    fn start(
+        self: &Arc<Self>,
+        name: &str,
+        kind: WorkKind,
+        job: BoxFuture<'static, anyhow::Result<()>>,
+    ) {
+        let mut inner = self.lock();
+        if inner
+            .slots
+            .get(name)
+            .is_some_and(|slot| slot.kind == kind && slot.running())
+        {
+            return;
+        }
+        let id = self.next_id.fetch_add(1, Ordering::Relaxed);
+        let (finished, done) = watch::channel(false);
+        let lock = inner.locks.entry(name.to_owned()).or_default().clone();
+        inner.slots.insert(
+            name.to_owned(),
+            Slot {
+                id,
+                kind,
+                state: SlotState::Running,
+                done,
+            },
+        );
+        drop(inner);
+        let work = Arc::clone(self);
+        let name = name.to_owned();
+        tokio::spawn(async move {
+            let outcome = {
+                let _guard = lock.lock().await;
+                AssertUnwindSafe(job)
+                    .catch_unwind()
+                    .await
+                    .unwrap_or_else(|_| Err(anyhow::anyhow!("the background job panicked")))
+            };
+            drop(lock);
+            work.finish(&name, id, outcome);
+            let _ = finished.send(true);
+        });
+    }
+
+    fn finish(&self, name: &str, id: u64, outcome: anyhow::Result<()>) {
+        let mut inner = self.lock();
+        if inner.slots.get(name).is_some_and(|slot| slot.id == id) {
+            match outcome {
+                Ok(()) => {
+                    inner.slots.remove(name);
+                }
+                Err(error) => {
+                    if let Some(slot) = inner.slots.get_mut(name) {
+                        slot.state = SlotState::Failed(format!("{error:#}"));
+                    }
+                }
+            }
+        }
+        Self::release_lock(&mut inner, name);
+    }
+
+    /// Drop the target's remembered failure once it holds nothing.
+    fn forget(&self, name: &str) {
+        let mut inner = self.lock();
+        if inner.slots.get(name).is_some_and(|slot| !slot.running()) {
+            inner.slots.remove(name);
+        }
+        Self::release_lock(&mut inner, name);
+    }
+
+    fn release_lock(inner: &mut WorkInner, name: &str) {
+        if !inner.slots.contains_key(name)
+            && inner
+                .locks
+                .get(name)
+                .is_some_and(|lock| Arc::strong_count(lock) == 1)
+        {
+            inner.locks.remove(name);
+        }
+    }
+
+    fn view(&self, name: &str) -> Option<Slot> {
+        self.lock().slots.get(name).cloned()
+    }
+
+    fn done(&self, name: &str) -> Option<watch::Receiver<bool>> {
+        self.lock()
+            .slots
+            .get(name)
+            .filter(|slot| slot.running())
+            .map(|slot| slot.done.clone())
+    }
 }
 
 #[cfg(test)]
 mod tests {
+    use std::sync::atomic::AtomicUsize;
+
+    use async_trait::async_trait;
+    use environment_protocol::{
+        control::target::BindingRef,
+        error::{ErrorData, ProtocolErrorKind},
+        ids::ProviderNativeRef,
+        jsonrpc::Id,
+        routes::DataRouteBase,
+    };
+
     use super::*;
+    use crate::{
+        IncusTopology,
+        config::{
+            ConfigInner, IncusConfig, IncusMode, NetworkPolicy, ProviderCredential, TemplatePolicy,
+        },
+        incus::IncusMemberStatus,
+        policy::tests::owner,
+    };
 
-    fn target() -> OwnedTarget {
-        OwnedTarget {
-            target_id: "target-a".into(),
-            name: "target-a".to_owned(),
-            universe_id: "u-a".to_owned(),
-            binding_id: "b-a".to_owned(),
-            environment_id: "e-a".to_owned(),
-            incarnation_id: "i-a".to_owned(),
-            request_id: "r-a".to_owned(),
-            template_id: "dev-small-v1".to_owned(),
-            image_fingerprint: "fingerprint-a".to_owned(),
-            adoption_source: None,
-            status: ProviderTargetStatus::Ready,
-            ipv4_address: Some("10.0.0.2".to_owned()),
-            ingress_hostname: None,
-            ingress_port: None,
-            location: Some("member-a".to_owned()),
+    const CREDENTIAL: &str = "0123456789abcdef0123456789abcdef";
+
+    /// An in-memory Incus: instances by name, every mutation instant.
+    #[derive(Clone, Default)]
+    struct FakeBackend {
+        instances: Arc<StdMutex<BTreeMap<String, OwnedTarget>>>,
+        creates: Arc<AtomicUsize>,
+        deletes: Arc<AtomicUsize>,
+    }
+
+    impl FakeBackend {
+        fn insert(&self, owner: &TargetOwner, template_id: &str, status: InstanceStatus) {
+            let name = policy::instance_name(owner);
+            self.instances.lock().unwrap().insert(
+                name.clone(),
+                OwnedTarget {
+                    target_id: ProviderTargetId::new(name).unwrap(),
+                    owner: owner.clone(),
+                    template_id: template_id.to_owned(),
+                    image_fingerprint: "fingerprint".to_owned(),
+                    adoption_source: None,
+                    status,
+                    ipv4_address: None,
+                    ingress_hostname: None,
+                    ingress_port: None,
+                    location: None,
+                },
+            );
         }
     }
 
-    #[test]
-    fn ownership_checks_fence_cross_binding_and_changed_image_adoption() {
-        let binding = ProviderBindingContext {
-            universe_id: "u-a".to_owned(),
-            binding_id: "b-a".to_owned(),
-        };
-        assert!(verify_binding(&target(), &binding).is_ok());
-        let other = ProviderBindingContext {
-            universe_id: "u-b".to_owned(),
-            ..binding.clone()
-        };
-        assert!(verify_binding(&target(), &other).is_err());
-        let params = CreateTargetParams {
-            request_id: "r-a".to_owned(),
-            environment_id: "e-a".to_owned(),
-            incarnation_id: "i-a".to_owned(),
-            binding: ProviderBindingContext {
-                universe_id: "u-a".to_owned(),
-                binding_id: "b-a".to_owned(),
-            },
-            template_id: "dev-small-v1".to_owned(),
-        };
-        let mut template = crate::config::TemplatePolicy {
-            template_id: "dev-small-v1".to_owned(),
-            display_name: "Small".to_owned(),
+    #[async_trait]
+    impl IncusBackend for FakeBackend {
+        async fn topology(&self) -> anyhow::Result<IncusTopology> {
+            Ok(IncusTopology {
+                mode: "single",
+                members: vec![IncusMemberStatus {
+                    name: "standalone".to_owned(),
+                    status: "Online".to_owned(),
+                    schedulable: true,
+                }],
+            })
+        }
+
+        async fn reconcile_binding(&self, _binding: &BindingRef) -> anyhow::Result<()> {
+            Ok(())
+        }
+
+        async fn ensure_image(&self, _fingerprint: &str) -> anyhow::Result<()> {
+            Ok(())
+        }
+
+        async fn list_all_owned(&self) -> anyhow::Result<Vec<OwnedTarget>> {
+            Ok(self.instances.lock().unwrap().values().cloned().collect())
+        }
+
+        async fn get_owned(
+            &self,
+            binding: &BindingRef,
+            name: &str,
+        ) -> anyhow::Result<Option<OwnedTarget>> {
+            Ok(self
+                .instances
+                .lock()
+                .unwrap()
+                .get(name)
+                .filter(|target| target.binding() == *binding)
+                .cloned())
+        }
+
+        async fn create_vm(
+            &self,
+            owner: &TargetOwner,
+            template: &TemplatePolicy,
+        ) -> anyhow::Result<()> {
+            self.creates.fetch_add(1, Ordering::SeqCst);
+            self.insert(
+                owner,
+                template.template_id.as_str(),
+                InstanceStatus::Running,
+            );
+            Ok(())
+        }
+
+        async fn adoption_source(
+            &self,
+            _source: &ProviderNativeRef,
+        ) -> anyhow::Result<AdoptionSource> {
+            Ok(AdoptionSource::Missing)
+        }
+
+        async fn adopt_vm(
+            &self,
+            _owner: &TargetOwner,
+            _source: &ProviderNativeRef,
+        ) -> anyhow::Result<()> {
+            anyhow::bail!("the fake backend adopts nothing")
+        }
+
+        async fn delete_vm(&self, target: &OwnedTarget) -> anyhow::Result<()> {
+            self.deletes.fetch_add(1, Ordering::SeqCst);
+            self.instances.lock().unwrap().remove(target.name());
+            Ok(())
+        }
+
+        async fn set_ingress(
+            &self,
+            target: &OwnedTarget,
+            route: Option<(&str, u16)>,
+        ) -> anyhow::Result<()> {
+            if let Some(instance) = self.instances.lock().unwrap().get_mut(target.name()) {
+                instance.ingress_hostname = route.map(|(hostname, _)| hostname.to_owned());
+                instance.ingress_port = route.map(|(_, port)| port);
+            }
+            Ok(())
+        }
+
+        async fn set_power(&self, target: &OwnedTarget, power: PowerState) -> anyhow::Result<()> {
+            if let Some(instance) = self.instances.lock().unwrap().get_mut(target.name()) {
+                instance.status = match power {
+                    PowerState::Running => InstanceStatus::Running,
+                    PowerState::Paused => InstanceStatus::Frozen,
+                    _ => InstanceStatus::Stopped,
+                };
+            }
+            Ok(())
+        }
+    }
+
+    fn template(id: &str, deprecated: bool) -> TemplatePolicy {
+        TemplatePolicy {
+            template_id: TemplateId::new(id).unwrap(),
+            display_name: environment_protocol::metadata::DisplayName::new("Small").unwrap(),
             description: None,
-            image_fingerprint: "fingerprint-a".to_owned(),
+            image_fingerprint: "fingerprint".to_owned(),
             cpu: 2,
             memory: "4GiB".to_owned(),
             disk: "40GiB".to_owned(),
             cluster_group: None,
             public_ingress: false,
             ingress_port: None,
-            deprecated: false,
-        };
-        assert!(verify_create(&target(), &params, &template).is_ok());
-        template.image_fingerprint = "fingerprint-b".to_owned();
-        assert!(verify_create(&target(), &params, &template).is_err());
+            deprecated,
+            resources: Default::default(),
+        }
+    }
+
+    fn config() -> Config {
+        let templates = [template("small", false), template("retired", true)]
+            .into_iter()
+            .map(|template| (template.template_id.clone(), template))
+            .collect();
+        Config(Arc::new(ConfigInner {
+            controller_listen: "127.0.0.1:0".parse().unwrap(),
+            credential: ProviderCredential::new(CREDENTIAL).unwrap(),
+            data_route_base: DataRouteBase::new("ws://127.0.0.1:19090/routes").unwrap(),
+            incus: IncusConfig {
+                mode: IncusMode::Single,
+                endpoints: vec!["https://incus.test".to_owned()],
+                client_certificate_pem: "cert".into(),
+                client_private_key_pem: "key".into(),
+                server_ca_pem: "ca".into(),
+                storage_pool: "default".to_owned(),
+                cluster_network_uplink: None,
+                image_server_url: None,
+            },
+            templates,
+            network: NetworkPolicy::default(),
+            relay_idle_seconds: 60,
+            dial_timeout_seconds: 1,
+            envd_port: 19091,
+            ingress: None,
+        }))
+    }
+
+    fn app() -> (App<FakeBackend>, FakeBackend) {
+        let backend = FakeBackend::default();
+        (App::new(config(), backend.clone()), backend)
+    }
+
+    async fn call<P: Serialize>(
+        app: &App<FakeBackend>,
+        method: &str,
+        params: &P,
+    ) -> Result<TargetObservation, ProtocolError> {
+        let request = Request::new(Id::Number(1), method, params).unwrap();
+        let value = route(app, &request).await?;
+        Ok(serde_json::from_value::<TargetResponse>(value)
+            .unwrap()
+            .target)
+    }
+
+    fn by_owner(owner: &TargetOwner) -> TargetRef {
+        TargetRef {
+            owner: owner.clone(),
+            target_id: None,
+        }
+    }
+
+    fn reason(error: &ProtocolError) -> Option<PreconditionReason> {
+        match error.data {
+            ErrorData::FailedPrecondition { reason } => Some(reason),
+            _ => None,
+        }
     }
 
     #[test]
-    fn summary_reports_member_without_changing_target_identity() {
-        let summary = summary(target());
-        assert_eq!(summary.target_id.as_str(), "target-a");
+    fn initialize_enforces_version_and_runs_once() {
+        let (app, _) = app();
+        let mut initialized = false;
+        let params = |version: u32| serde_json::json!({"protocolVersion": version, "clientInfo": {"name": "test"}});
+        let request = Request::new(Id::Number(1), "initialize", &params(4)).unwrap();
+        let mismatch = initialize(&app, &mut initialized, &request)
+            .result
+            .unwrap_err();
+        assert_eq!(
+            mismatch.data,
+            ErrorData::VersionMismatch {
+                expected: CONTROLLER_PROTOCOL_VERSION,
+                received: 4
+            }
+        );
+        assert!(!initialized);
+
+        let request = Request::new(Id::Number(2), "initialize", &params(3)).unwrap();
+        let response: ControllerInitializeResponse = initialize(&app, &mut initialized, &request)
+            .decode()
+            .unwrap();
+        assert!(initialized);
+        assert_eq!(response.plane, Plane::Controller);
+        assert!(response.capabilities.adopt_target);
+        assert!(!response.capabilities.ingress);
+        assert_eq!(response.routes.data.as_str(), "ws://127.0.0.1:19090/routes");
+
+        let repeat = initialize(&app, &mut initialized, &request)
+            .result
+            .unwrap_err();
+        assert_eq!(repeat.kind(), ProtocolErrorKind::InvalidRequest);
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn unknown_and_unadvertised_methods_are_typed_errors() {
+        let (app, _) = app();
+        let unknown = call(&app, "controller/listTargets", &serde_json::json!({}))
+            .await
+            .unwrap_err();
+        assert_eq!(unknown.kind(), ProtocolErrorKind::MethodNotFound);
+        let ingress = call(
+            &app,
+            IngressEnsure::NAME,
+            &EnsureIngressParams {
+                target: by_owner(&owner("u", "b", "e")),
+            },
+        )
+        .await
+        .unwrap_err();
         assert_eq!(
-            summary.metadata.get("incusMember").map(String::as_str),
-            Some("member-a")
+            ingress.data,
+            ErrorData::CapabilityUnavailable {
+                capability: Capability::Ingress
+            }
         );
-        assert!(summary.capabilities.network);
-        assert!(summary.capabilities.filesystem_glob);
-        assert!(summary.capabilities.filesystem_ranged_read);
-        assert!(summary.capabilities.process_pty);
-        assert!(!summary.capabilities.process_output_notifications);
+        let undecodable = call(&app, TargetGet::NAME, &serde_json::json!({"target": 7}))
+            .await
+            .unwrap_err();
+        assert_eq!(undecodable.kind(), ProtocolErrorKind::InvalidParams);
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn get_never_creates_and_answers_not_found() {
+        let (app, backend) = app();
+        let owner = owner("u", "b", "e");
+        for _ in 0..2 {
+            let error = call(
+                &app,
+                TargetGet::NAME,
+                &GetTargetParams {
+                    target: by_owner(&owner),
+                },
+            )
+            .await
+            .unwrap_err();
+            assert_eq!(error.kind(), ProtocolErrorKind::NotFound);
+        }
+        let unknown = call(
+            &app,
+            TargetGet::NAME,
+            &GetTargetParams {
+                target: TargetRef {
+                    owner: owner.clone(),
+                    target_id: Some(ProviderTargetId::new("default/pod-abc").unwrap()),
+                },
+            },
+        )
+        .await
+        .unwrap_err();
+        assert_eq!(unknown.kind(), ProtocolErrorKind::NotFound);
+        assert_eq!(backend.creates.load(Ordering::SeqCst), 0);
+        assert!(backend.instances.lock().unwrap().is_empty());
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn create_is_idempotent_per_owner_and_applies_policy_only_once() {
+        let (app, backend) = app();
+        let owner = owner("u", "b", "e");
+        let params = CreateTargetParams {
+            owner: owner.clone(),
+            template_id: TemplateId::new("small").unwrap(),
+        };
+        let first = call(&app, TargetCreate::NAME, &params).await.unwrap();
+        let second = call(&app, TargetCreate::NAME, &params).await.unwrap();
+        assert_eq!(first.owner, owner);
+        assert_eq!(first.target_id, second.target_id);
         assert_eq!(
-            summary.power_states,
-            vec![PowerState::Running, PowerState::Paused, PowerState::Stopped]
+            first.target_id.as_ref().map(ProviderTargetId::as_str),
+            Some(policy::instance_name(&owner).as_str())
+        );
+        assert_eq!(second.state.phase, TargetPhase::Active);
+        assert_eq!(second.state.power, Some(PowerState::Running));
+        assert_eq!(backend.creates.load(Ordering::SeqCst), 1);
+
+        // A target that already exists comes back even when its template
+        // has been deprecated since: observation applies no creation policy.
+        let existing = crate::policy::tests::owner("u", "b", "old");
+        backend.insert(&existing, "retired", InstanceStatus::Stopped);
+        let observed = call(
+            &app,
+            TargetCreate::NAME,
+            &CreateTargetParams {
+                owner: existing.clone(),
+                template_id: TemplateId::new("retired").unwrap(),
+            },
+        )
+        .await
+        .unwrap();
+        assert_eq!(observed.state.power, Some(PowerState::Stopped));
+        assert_eq!(backend.creates.load(Ordering::SeqCst), 1);
+
+        let refused = call(
+            &app,
+            TargetCreate::NAME,
+            &CreateTargetParams {
+                owner: crate::policy::tests::owner("u", "b", "new"),
+                template_id: TemplateId::new("retired").unwrap(),
+            },
+        )
+        .await
+        .unwrap_err();
+        assert_eq!(
+            reason(&refused),
+            Some(PreconditionReason::TemplateDeprecated)
+        );
+        let missing = call(
+            &app,
+            TargetCreate::NAME,
+            &CreateTargetParams {
+                owner: crate::policy::tests::owner("u", "b", "new"),
+                template_id: TemplateId::new("absent").unwrap(),
+            },
+        )
+        .await
+        .unwrap_err();
+        assert_eq!(missing.kind(), ProtocolErrorKind::NotFound);
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn a_foreign_target_id_is_an_owner_mismatch() {
+        let (app, backend) = app();
+        let holder = owner("u", "b", "holder");
+        backend.insert(&holder, "small", InstanceStatus::Running);
+        let error = call(
+            &app,
+            TargetGet::NAME,
+            &GetTargetParams {
+                target: TargetRef {
+                    owner: owner("u", "b", "other"),
+                    target_id: Some(ProviderTargetId::new(policy::instance_name(&holder)).unwrap()),
+                },
+            },
+        )
+        .await
+        .unwrap_err();
+        assert_eq!(reason(&error), Some(PreconditionReason::OwnerMismatch));
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn close_by_owner_destroys_and_is_idempotent() {
+        let (app, backend) = app();
+        let owner = owner("u", "b", "e");
+        backend.insert(&owner, "small", InstanceStatus::Running);
+        let closed = call(
+            &app,
+            TargetClose::NAME,
+            &CloseTargetParams {
+                target: by_owner(&owner),
+            },
+        )
+        .await
+        .unwrap();
+        assert_eq!(closed.state.phase, TargetPhase::Closed);
+        assert_eq!(closed.target_id, None);
+        assert_eq!(closed.owner, owner);
+        let again = call(
+            &app,
+            TargetClose::NAME,
+            &CloseTargetParams {
+                target: by_owner(&owner),
+            },
+        )
+        .await
+        .unwrap();
+        assert_eq!(again.state.phase, TargetPhase::Closed);
+        assert_eq!(backend.deletes.load(Ordering::SeqCst), 1);
+        let gone = call(
+            &app,
+            TargetGet::NAME,
+            &GetTargetParams {
+                target: by_owner(&owner),
+            },
+        )
+        .await
+        .unwrap_err();
+        assert_eq!(gone.kind(), ProtocolErrorKind::NotFound);
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn power_changes_need_an_active_target_and_a_supported_state() {
+        let (app, backend) = app();
+        let owner = owner("u", "b", "e");
+        let set = |power| SetTargetPowerParams {
+            target: by_owner(&owner),
+            power,
+        };
+        let missing = call(&app, TargetSetPower::NAME, &set(PowerState::Paused))
+            .await
+            .unwrap_err();
+        assert_eq!(missing.kind(), ProtocolErrorKind::NotFound);
+
+        backend.insert(&owner, "small", InstanceStatus::Running);
+        let unsupported = call(&app, TargetSetPower::NAME, &set(PowerState::Suspended))
+            .await
+            .unwrap_err();
+        assert_eq!(unsupported.kind(), ProtocolErrorKind::InvalidParams);
+        let paused = call(&app, TargetSetPower::NAME, &set(PowerState::Paused))
+            .await
+            .unwrap();
+        assert_eq!(paused.state.power, Some(PowerState::Paused));
+
+        backend.insert(&owner, "small", InstanceStatus::Error);
+        let failed = call(&app, TargetSetPower::NAME, &set(PowerState::Running))
+            .await
+            .unwrap_err();
+        assert_eq!(reason(&failed), Some(PreconditionReason::TargetNotActive));
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn a_failed_create_is_provisioning_without_an_id_and_retried_by_create() {
+        let (app, backend) = app();
+        let owner = owner("u", "b", "e");
+        let name = policy::instance_name(&owner);
+        app.work.start(
+            &name,
+            WorkKind::Create,
+            async { Err(anyhow::anyhow!("image server unreachable")) }.boxed(),
+        );
+        wait_for_work(&app, &name).await;
+        let observed = call(
+            &app,
+            TargetGet::NAME,
+            &GetTargetParams {
+                target: by_owner(&owner),
+            },
+        )
+        .await
+        .unwrap();
+        // No instance exists, so no id is handed out and the runtime keeps
+        // sending target/create.
+        assert_eq!(observed.state.phase, TargetPhase::Provisioning);
+        assert_eq!(observed.target_id, None);
+        assert!(
+            observed
+                .state
+                .message
+                .as_ref()
+                .is_some_and(|message| message.as_str().contains("image server unreachable"))
+        );
+        let created = call(
+            &app,
+            TargetCreate::NAME,
+            &CreateTargetParams {
+                owner: owner.clone(),
+                template_id: TemplateId::new("small").unwrap(),
+            },
+        )
+        .await
+        .unwrap();
+        assert_eq!(created.state.phase, TargetPhase::Active);
+        assert_eq!(
+            created.target_id.as_ref().map(ProviderTargetId::as_str),
+            Some(name.as_str())
+        );
+        assert_eq!(backend.creates.load(Ordering::SeqCst), 1);
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn closing_an_owner_whose_create_failed_forgets_the_failure() {
+        let (app, _) = app();
+        let owner = owner("u", "b", "e");
+        let name = policy::instance_name(&owner);
+        app.work.start(
+            &name,
+            WorkKind::Create,
+            async { Err(anyhow::anyhow!("image pull failed")) }.boxed(),
+        );
+        wait_for_work(&app, &name).await;
+        // Closing an owner whose create failed before any instance existed
+        // holds nothing, so it closes at once and forgets the failure.
+        let closed = call(
+            &app,
+            TargetClose::NAME,
+            &CloseTargetParams {
+                target: by_owner(&owner),
+            },
+        )
+        .await
+        .unwrap();
+        assert_eq!(closed.state.phase, TargetPhase::Closed);
+        assert!(app.work.view(&name).is_none());
+    }
+
+    #[test]
+    fn only_the_exact_bearer_credential_is_authorized() {
+        let config = config();
+        let mut headers = HeaderMap::new();
+        assert!(!authorized(&config, &headers));
+        headers.insert(header::AUTHORIZATION, "Bearer wrong".parse().unwrap());
+        assert!(!authorized(&config, &headers));
+        headers.insert(header::AUTHORIZATION, CREDENTIAL.parse().unwrap());
+        assert!(!authorized(&config, &headers));
+        headers.insert(
+            header::AUTHORIZATION,
+            format!("Bearer {CREDENTIAL}").parse().unwrap(),
+        );
+        assert!(authorized(&config, &headers));
+    }
+
+    /// The client's controller conformance suite against this server over
+    /// a real WebSocket, with the in-memory backend standing in for Incus.
+    #[tokio::test(flavor = "current_thread")]
+    async fn the_controller_passes_the_conformance_suite() {
+        use environment_client::{
+            ConnectOptions,
+            conformance::controller::{ControllerConformance, run},
+        };
+
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let address = listener.local_addr().unwrap();
+        let server = tokio::spawn(serve_on(listener, config(), FakeBackend::default()));
+        let options = ConnectOptions::new(ImplementationInfo::new("conformance").unwrap())
+            .with_bearer_token(CREDENTIAL);
+        let counter = Arc::new(AtomicUsize::new(0));
+        let owner_factory: Arc<dyn Fn() -> TargetOwner + Send + Sync> = Arc::new(move || {
+            let environment = format!("env-{}", counter.fetch_add(1, Ordering::SeqCst));
+            owner("conformance", "fake", &environment)
+        });
+        let mut suite = ControllerConformance::new(
+            format!("ws://{address}/control"),
+            options,
+            TemplateId::new("small").unwrap(),
+            owner_factory,
         );
+        suite.poll_interval = Duration::from_millis(10);
+        suite.settle_timeout = Duration::from_secs(10);
+        let report = run(&suite).await;
+        server.abort();
+        report.into_result().expect("the controller conforms");
     }
 }
diff --git a/crates/environment-provider-incus/tests/incus_live.rs b/crates/environment-provider-incus/tests/incus_live.rs
index 72c46323d..f4a4b116b 100644
--- a/crates/environment-provider-incus/tests/incus_live.rs
+++ b/crates/environment-provider-incus/tests/incus_live.rs
@@ -1,19 +1,42 @@
-use std::path::PathBuf;
+use std::{
+    path::PathBuf,
+    sync::Arc,
+    time::{Duration, Instant},
+};
 
-use environment_provider_incus::{IncusBackend as _, IncusClient, ProviderArgs};
+use environment_client::{
+    ConnectOptions, ControllerClient, DataClient,
+    conformance::controller::{ControllerConformance, run},
+};
+use environment_protocol::{
+    control::target::{
+        CloseTargetParams, CreateTargetParams, GetTargetParams, PowerState, TargetOwner,
+        TargetPhase, TargetRef,
+    },
+    handshake::ImplementationInfo,
+    ids::{BindingId, EnvironmentId, IncarnationId, ProviderTargetId, TemplateId, UniverseId},
+    paths::EnvironmentPath,
+    routes::provider_data_route,
+};
+use environment_provider_incus::{Config, IncusBackend as _, IncusClient, ProviderArgs, server};
+use tools::environment_protocol::conformance::{self as data_conformance, DataConformance};
 
-#[tokio::test(flavor = "current_thread")]
-#[ignore = "requires a reachable standalone Incus server or Incus cluster"]
-async fn configured_topology_and_owned_inventory_are_live() {
+async fn live_config() -> Config {
     let config_path = std::env::var("LIGHTSPEED_INCUS_PROVIDER_CONFIG")
         .map(PathBuf::from)
         .expect("LIGHTSPEED_INCUS_PROVIDER_CONFIG must name a live provider config");
-    let config = ProviderArgs {
+    ProviderArgs {
         config: config_path,
     }
     .load()
     .await
-    .expect("load live provider config");
+    .expect("load live provider config")
+}
+
+#[tokio::test(flavor = "current_thread")]
+#[ignore = "requires a reachable standalone Incus server or Incus cluster"]
+async fn configured_topology_and_owned_inventory_are_live() {
+    let config = live_config().await;
     let backend = IncusClient::new(config.clone())
         .await
         .expect("connect and validate live Incus topology");
@@ -31,3 +54,190 @@ async fn configured_topology_and_owned_inventory_are_live() {
         }
     }
 }
+
+/// One owner in the fixed conformance universe and binding.
+fn conformance_owner() -> TargetOwner {
+    TargetOwner {
+        universe_id: UniverseId::new("lightspeed-conformance").expect("universe id"),
+        binding_id: BindingId::new("incus-live").expect("binding id"),
+        environment_id: EnvironmentId::new(uuid::Uuid::new_v4().to_string())
+            .expect("environment id"),
+        incarnation_id: IncarnationId::new(uuid::Uuid::new_v4().to_string())
+            .expect("incarnation id"),
+    }
+}
+
+fn first_template(config: &Config) -> TemplateId {
+    config
+        .templates
+        .values()
+        .find(|template| !template.deprecated)
+        .map(|template| template.template_id.clone())
+        .expect("the live config offers a template")
+}
+
+/// Create a target for `owner` the way the runtime does: `target/create`
+/// until the observation carries a `targetId`, then `target/get` until the
+/// provider's own probe reaches envd.
+async fn create_until_daemon_ready(
+    controller: &ControllerClient,
+    owner: &TargetOwner,
+    template_id: &TemplateId,
+    timeout: Duration,
+) -> anyhow::Result<ProviderTargetId> {
+    let deadline = Instant::now() + timeout;
+    let params = CreateTargetParams {
+        owner: owner.clone(),
+        template_id: template_id.clone(),
+    };
+    let mut observation = controller.create_target(&params).await?.target;
+    loop {
+        if observation.state.phase == TargetPhase::Failed {
+            anyhow::bail!("the target failed: {:?}", observation.state.message);
+        }
+        if observation.state.phase == TargetPhase::Active
+            && observation.state.power == Some(PowerState::Running)
+            && observation.state.daemon_ready
+            && let Some(target_id) = observation.target_id.clone()
+        {
+            return Ok(target_id);
+        }
+        if Instant::now() >= deadline {
+            anyhow::bail!(
+                "envd did not come up within {timeout:?}: {:?}",
+                observation.state
+            );
+        }
+        tokio::time::sleep(Duration::from_secs(2)).await;
+        observation = match &observation.target_id {
+            Some(target_id) => {
+                controller
+                    .get_target(&GetTargetParams {
+                        target: TargetRef {
+                            owner: owner.clone(),
+                            target_id: Some(target_id.clone()),
+                        },
+                    })
+                    .await?
+                    .target
+            }
+            None => controller.create_target(&params).await?.target,
+        };
+    }
+}
+
+/// Close by owner until the provider answers `closed`.
+async fn close_until_closed(
+    controller: &ControllerClient,
+    owner: &TargetOwner,
+    timeout: Duration,
+) -> anyhow::Result<()> {
+    let deadline = Instant::now() + timeout;
+    loop {
+        let observation = controller
+            .close_target(&CloseTargetParams {
+                target: TargetRef {
+                    owner: owner.clone(),
+                    target_id: None,
+                },
+            })
+            .await?
+            .target;
+        if observation.state.phase == TargetPhase::Closed {
+            return Ok(());
+        }
+        if Instant::now() >= deadline {
+            anyhow::bail!("the target did not close within {timeout:?}");
+        }
+        tokio::time::sleep(Duration::from_secs(2)).await;
+    }
+}
+
+/// The tools' data conformance suite against envd inside a live Incus VM,
+/// reached through this provider's data route and relay with the provider
+/// credential, exactly as the runtime reaches it. Creates one VM and
+/// closes it.
+#[tokio::test(flavor = "current_thread")]
+#[ignore = "requires a reachable standalone Incus server or Incus cluster; creates and deletes one VM"]
+async fn the_guest_envd_conforms_on_live_incus() {
+    let config = live_config().await;
+    let template_id = first_template(&config);
+    let credential = config.credential.expose().to_owned();
+    let backend = IncusClient::new(config.clone())
+        .await
+        .expect("connect and validate live Incus topology");
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("bind the controller listener");
+    let address = listener.local_addr().expect("listener address");
+    let server = tokio::spawn(server::serve_on(listener, config, backend));
+
+    let options = ConnectOptions::new(
+        ImplementationInfo::new("environment-provider-incus-live").expect("client info"),
+    )
+    .with_bearer_token(credential);
+    let (controller, initialized) =
+        ControllerClient::connect_initialized(&format!("ws://{address}/control"), options.clone())
+            .await
+            .expect("controller handshake");
+    let owner = conformance_owner();
+    let outcome = async {
+        let target_id =
+            create_until_daemon_ready(&controller, &owner, &template_id, Duration::from_secs(900))
+                .await?;
+        let route = provider_data_route(&initialized.routes.data, &owner, &target_id);
+        let (client, _) = DataClient::connect_initialized(&route, options.clone()).await?;
+        let suite = DataConformance::new(
+            client.clone(),
+            EnvironmentPath::new("/workspace").expect("work directory"),
+        );
+        let report = data_conformance::run(&suite).await;
+        let _ = client.close().await;
+        report
+            .into_result()
+            .map(|_| ())
+            .map_err(anyhow::Error::from)
+    }
+    .await;
+    let closed = close_until_closed(&controller, &owner, Duration::from_secs(300)).await;
+    let _ = controller.close().await;
+    server.abort();
+    outcome.expect("the guest envd conforms");
+    closed.expect("the conformance target closes");
+}
+
+/// The client's controller conformance suite against this provider on live
+/// Incus. It creates one VM from the first offered template and closes it;
+/// every owner lives in one fixed conformance universe and binding, so
+/// repeated runs reuse one Incus project and network.
+#[tokio::test(flavor = "current_thread")]
+#[ignore = "requires a reachable standalone Incus server or Incus cluster; creates and deletes one VM"]
+async fn the_controller_conforms_on_live_incus() {
+    let config = live_config().await;
+    let template_id = first_template(&config);
+    let credential = config.credential.expose().to_owned();
+    let backend = IncusClient::new(config.clone())
+        .await
+        .expect("connect and validate live Incus topology");
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("bind the controller listener");
+    let address = listener.local_addr().expect("listener address");
+    let server = tokio::spawn(server::serve_on(listener, config, backend));
+
+    let options = ConnectOptions::new(
+        ImplementationInfo::new("environment-provider-incus-live").expect("client info"),
+    )
+    .with_bearer_token(credential);
+    let owner = Arc::new(conformance_owner);
+    let mut suite = ControllerConformance::new(
+        format!("ws://{address}/control"),
+        options,
+        template_id,
+        owner,
+    );
+    suite.settle_timeout = Duration::from_secs(900);
+    let report = run(&suite).await;
+    server.abort();
+    report.into_result().expect("the Incus controller conforms");
+}
diff --git a/crates/environments/src/endpoint.rs b/crates/environments/src/endpoint.rs
new file mode 100644
index 000000000..ff711fa1f
--- /dev/null
+++ b/crates/environments/src/endpoint.rs
@@ -0,0 +1,270 @@
+//! Environment endpoints: where Lightspeed dials a provider controller or an
+//! environment's data plane.
+//!
+//! An endpoint is one validated URL whose scheme selects the dialer from a
+//! closed set; there is no separate transport enum. Every scheme carries
+//! WebSocket text frames running the environment protocol's JSON-RPC
+//! envelope:
+//!
+//! - `ws://host[:port][/path]` and `wss://host[:port][/path]`: TCP, plain or
+//!   TLS.
+//! - `unix:///absolute/socket/path`: a local Unix socket (envd's Unix
+//!   listener). The dialer connects to the socket and performs the
+//!   WebSocket upgrade with request target `/` and host `localhost`.
+
+use std::{fmt, str::FromStr};
+
+use serde::{Deserialize, Deserializer, Serialize, Serializer, de};
+use thiserror::Error;
+
+/// Longest endpoint URL in bytes.
+pub const MAX_ENDPOINT_BYTES: usize = 2048;
+
+/// The dialer an endpoint selects.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub enum EndpointScheme {
+    Ws,
+    Wss,
+    Unix,
+}
+
+impl EndpointScheme {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Ws => "ws",
+            Self::Wss => "wss",
+            Self::Unix => "unix",
+        }
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Error)]
+pub enum EndpointError {
+    #[error("endpoint is empty")]
+    Empty,
+
+    #[error("endpoint is longer than {MAX_ENDPOINT_BYTES} bytes")]
+    TooLong,
+
+    #[error("endpoint must not contain whitespace or control characters: {0}")]
+    InvalidCharacter(String),
+
+    #[error("endpoint scheme must be ws://, wss:// or unix://: {0}")]
+    Scheme(String),
+
+    #[error("endpoint has no host: {0}")]
+    NoHost(String),
+
+    #[error("endpoint must not carry user information: {0}")]
+    UserInfo(String),
+
+    #[error("endpoint must not carry a fragment: {0}")]
+    Fragment(String),
+
+    #[error("endpoint has an invalid port: {0}")]
+    Port(String),
+
+    #[error("unix endpoint must name an absolute socket path without query: {0}")]
+    UnixPath(String),
+}
+
+/// A validated endpoint URL. Serializes as the URL string.
+#[derive(Clone, Debug, PartialEq, Eq, Hash)]
+pub struct EnvironmentEndpoint {
+    url: String,
+    scheme: EndpointScheme,
+}
+
+impl EnvironmentEndpoint {
+    pub fn parse(value: &str) -> Result<Self, EndpointError> {
+        if value.is_empty() {
+            return Err(EndpointError::Empty);
+        }
+        if value.len() > MAX_ENDPOINT_BYTES {
+            return Err(EndpointError::TooLong);
+        }
+        if value
+            .chars()
+            .any(|character| character.is_whitespace() || character.is_control())
+        {
+            return Err(EndpointError::InvalidCharacter(value.to_owned()));
+        }
+        let (scheme, rest) = value
+            .split_once("://")
+            .ok_or_else(|| EndpointError::Scheme(value.to_owned()))?;
+        let scheme = match scheme {
+            "ws" => EndpointScheme::Ws,
+            "wss" => EndpointScheme::Wss,
+            "unix" => EndpointScheme::Unix,
+            _ => return Err(EndpointError::Scheme(value.to_owned())),
+        };
+        if rest.contains('#') {
+            return Err(EndpointError::Fragment(value.to_owned()));
+        }
+        match scheme {
+            EndpointScheme::Unix => {
+                if !rest.starts_with('/') || rest.len() == 1 || rest.contains('?') {
+                    return Err(EndpointError::UnixPath(value.to_owned()));
+                }
+            }
+            EndpointScheme::Ws | EndpointScheme::Wss => {
+                let authority = rest.split(['/', '?']).next().unwrap_or_default();
+                if authority.contains('@') {
+                    return Err(EndpointError::UserInfo(value.to_owned()));
+                }
+                let host =
+                    host_of(authority).ok_or_else(|| EndpointError::Port(value.to_owned()))?;
+                if host.is_empty() || host == "[]" {
+                    return Err(EndpointError::NoHost(value.to_owned()));
+                }
+            }
+        }
+        Ok(Self {
+            url: value.to_owned(),
+            scheme,
+        })
+    }
+
+    pub fn as_str(&self) -> &str {
+        &self.url
+    }
+
+    pub fn scheme(&self) -> EndpointScheme {
+        self.scheme
+    }
+
+    /// The socket path of a `unix://` endpoint.
+    pub fn unix_socket_path(&self) -> Option<&str> {
+        match self.scheme {
+            EndpointScheme::Unix => self.url.strip_prefix("unix://"),
+            EndpointScheme::Ws | EndpointScheme::Wss => None,
+        }
+    }
+
+    /// The host of a `ws://` or `wss://` endpoint, brackets kept for IPv6.
+    pub fn host(&self) -> Option<&str> {
+        let rest = match self.scheme {
+            EndpointScheme::Ws => self.url.strip_prefix("ws://")?,
+            EndpointScheme::Wss => self.url.strip_prefix("wss://")?,
+            EndpointScheme::Unix => return None,
+        };
+        host_of(rest.split(['/', '?']).next().unwrap_or_default())
+    }
+
+    /// True for a Unix socket or a `localhost` or loopback-address host:
+    /// endpoints whose traffic never leaves the machine.
+    pub fn is_local(&self) -> bool {
+        match self.scheme {
+            EndpointScheme::Unix => true,
+            EndpointScheme::Ws | EndpointScheme::Wss => self.host().is_some_and(|host| {
+                let host = host.trim_start_matches('[').trim_end_matches(']');
+                host.eq_ignore_ascii_case("localhost")
+                    || host
+                        .parse::<std::net::IpAddr>()
+                        .is_ok_and(|address| address.is_loopback())
+            }),
+        }
+    }
+}
+
+fn host_of(authority: &str) -> Option<&str> {
+    if let Some(rest) = authority.strip_prefix('[') {
+        let (address, after) = rest.split_once(']')?;
+        if !after.is_empty() {
+            after.strip_prefix(':')?.parse::<u16>().ok()?;
+        }
+        return Some(&authority[..address.len() + 2]);
+    }
+    match authority.rsplit_once(':') {
+        Some((host, port)) => {
+            port.parse::<u16>().ok()?;
+            Some(host)
+        }
+        None => Some(authority),
+    }
+}
+
+impl fmt::Display for EnvironmentEndpoint {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        self.url.fmt(formatter)
+    }
+}
+
+impl FromStr for EnvironmentEndpoint {
+    type Err = EndpointError;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        Self::parse(value)
+    }
+}
+
+impl Serialize for EnvironmentEndpoint {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        serializer.serialize_str(&self.url)
+    }
+}
+
+impl<'de> Deserialize<'de> for EnvironmentEndpoint {
+    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        let value = String::deserialize(deserializer)?;
+        Self::parse(&value).map_err(de::Error::custom)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn the_scheme_selects_the_dialer() {
+        let tcp = EnvironmentEndpoint::parse("wss://incus.example.com:19090/control").unwrap();
+        assert_eq!(tcp.scheme(), EndpointScheme::Wss);
+        assert_eq!(tcp.host(), Some("incus.example.com"));
+        assert!(!tcp.is_local());
+        let local =
+            EnvironmentEndpoint::parse("ws://127.0.0.1:18080/environment-gateway/routes/u/e/i")
+                .unwrap();
+        assert!(local.is_local());
+        let unix = EnvironmentEndpoint::parse("unix:///run/lightspeed/envd.sock").unwrap();
+        assert_eq!(unix.scheme(), EndpointScheme::Unix);
+        assert_eq!(unix.unix_socket_path(), Some("/run/lightspeed/envd.sock"));
+        assert!(unix.is_local());
+        assert!(
+            EnvironmentEndpoint::parse("ws://[::1]:9/x")
+                .unwrap()
+                .is_local()
+        );
+    }
+
+    #[test]
+    fn other_schemes_and_malformed_urls_are_rejected() {
+        for bad in [
+            "",
+            "http://host/control",
+            "ssh://host",
+            "stdio",
+            "ws://",
+            "ws://user@host",
+            "ws://host:port",
+            "ws://host/a b",
+            "ws://host/#frag",
+            "unix://relative.sock",
+            "unix:///",
+        ] {
+            assert!(EnvironmentEndpoint::parse(bad).is_err(), "{bad:?}");
+        }
+    }
+
+    #[test]
+    fn endpoints_serialize_as_strings_and_validate_on_decode() {
+        let endpoint: EnvironmentEndpoint =
+            serde_json::from_value(serde_json::json!("wss://gw.example.com/x")).unwrap();
+        assert_eq!(
+            serde_json::to_value(&endpoint).unwrap(),
+            "wss://gw.example.com/x"
+        );
+        assert!(
+            serde_json::from_value::<EnvironmentEndpoint>(serde_json::json!("http://x")).is_err()
+        );
+    }
+}
diff --git a/crates/environments/src/lib.rs b/crates/environments/src/lib.rs
index 85001130d..7a10c655e 100644
--- a/crates/environments/src/lib.rs
+++ b/crates/environments/src/lib.rs
@@ -8,10 +8,13 @@ use std::{collections::BTreeMap, fmt, str::FromStr};
 
 use async_trait::async_trait;
 use auth::{AuthGrantId, AuthProviderId, SecretId, SecretValue};
-pub use environment_protocol::control::targets::PowerState;
+pub use environment_protocol::control::target::PowerState;
 use environment_protocol::{
-    control::targets::EnvironmentTemplate,
-    shared::{EnvironmentTransport, ProviderTargetId},
+    control::template::EnvironmentTemplate,
+    handshake::ImplementationInfo,
+    ids::{ProviderTargetId, validate_opaque_id},
+    metadata::{DescriptiveText, validate_descriptive_text, validate_stored_metadata},
+    routes::DataRouteBase,
 };
 pub use harness::EnvironmentId;
 use harness::{StringIdError, validate_general_string_id};
@@ -186,31 +189,32 @@ pub enum EnvironmentRegistryError {
     Store { message: String },
 }
 
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct EnvironmentConnectionSpec {
-    pub endpoint: String,
-    pub transport: EnvironmentTransport,
-}
-
-impl EnvironmentConnectionSpec {
-    pub fn new(endpoint: impl Into<String>, transport: EnvironmentTransport) -> Self {
-        Self {
-            endpoint: endpoint.into(),
-            transport,
-        }
-    }
-
-    pub fn validate(&self) -> Result<(), EnvironmentRegistryError> {
-        validate_endpoint("provider controller endpoint", &self.endpoint)
-    }
+/// Optional controller methods a provider's controller advertised in its
+/// last successful `initialize`. Calls and API requests that need an absent
+/// feature are refused before they reach the provider.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ControllerFeatures {
+    /// `target/adopt` is served.
+    pub adopt_target: bool,
+    /// `ingress/ensure` and `ingress/remove` are served.
+    pub ingress: bool,
 }
 
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub struct EnvironmentProviderRecord {
     pub provider_id: EnvironmentProviderId,
     pub display_name: Option<String>,
-    pub controller_connection: EnvironmentConnectionSpec,
+    /// Where Lightspeed dials the provider's controller.
+    pub controller_endpoint: EnvironmentEndpoint,
     pub metadata: BTreeMap<String, String>,
+    /// Recorded at the controller's last successful `initialize`, together
+    /// with `data_route_base`; absent until then and after the endpoint
+    /// changes.
+    pub controller_features: Option<ControllerFeatures>,
+    /// Base URL of the provider's data routes as its controller advertised
+    /// it (`routes.data`). The gateway builds every target's data route from
+    /// it; it is never derived from the controller endpoint.
+    pub data_route_base: Option<DataRouteBase>,
     pub created_at_ms: i64,
     pub updated_at_ms: i64,
 }
@@ -218,38 +222,93 @@ pub struct EnvironmentProviderRecord {
 impl EnvironmentProviderRecord {
     pub fn validate(&self) -> Result<(), EnvironmentRegistryError> {
         validate_nonempty_optional("display_name", self.display_name.as_deref())?;
-        self.controller_connection.validate()?;
         validate_metadata(&self.metadata)?;
         validate_timestamps(self.created_at_ms, self.updated_at_ms)?;
+        if self.controller_features.is_some() != self.data_route_base.is_some() {
+            return invalid("controller features and data route base are recorded together");
+        }
         Ok(())
     }
 }
 
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+/// Register or replace a provider. The provider credential is write-only:
+/// the store keeps it sealed and hands it out only through
+/// [`EnvironmentProviderStore::read_provider_credential`].
+#[derive(Clone, Debug, PartialEq, Eq)]
 pub struct PutEnvironmentProvider {
     pub provider_id: EnvironmentProviderId,
     pub display_name: Option<String>,
-    pub controller_connection: EnvironmentConnectionSpec,
+    pub controller_endpoint: EnvironmentEndpoint,
     pub metadata: BTreeMap<String, String>,
+    /// The bearer credential Lightspeed presents on the controller and data
+    /// routes. Required for a new provider; `None` keeps the stored one.
+    pub credential: Option<SecretValue>,
     pub updated_at_ms: i64,
 }
 
 impl PutEnvironmentProvider {
-    pub fn into_record(self) -> Result<EnvironmentProviderRecord, EnvironmentRegistryError> {
+    /// The record this put writes for a provider whose current record is
+    /// `existing`: the creation time is kept, and the recorded controller
+    /// facts survive only while the endpoint stays the same.
+    pub fn into_record(
+        self,
+        existing: Option<&EnvironmentProviderRecord>,
+    ) -> Result<EnvironmentProviderRecord, EnvironmentRegistryError> {
         validate_nonnegative_i64(self.updated_at_ms, "updated_at_ms")?;
+        if let Some(credential) = &self.credential {
+            validate_provider_credential(credential)?;
+        } else if existing.is_none() {
+            return invalid("a new environment provider requires a credential");
+        }
+        let kept = existing.filter(|record| record.controller_endpoint == self.controller_endpoint);
+        let created_at_ms = existing.map_or(self.updated_at_ms, |record| record.created_at_ms);
         let record = EnvironmentProviderRecord {
             provider_id: self.provider_id,
             display_name: self.display_name,
-            controller_connection: self.controller_connection,
+            controller_endpoint: self.controller_endpoint,
             metadata: self.metadata,
-            created_at_ms: self.updated_at_ms,
-            updated_at_ms: self.updated_at_ms,
+            controller_features: kept.and_then(|record| record.controller_features),
+            data_route_base: kept.and_then(|record| record.data_route_base.clone()),
+            created_at_ms,
+            updated_at_ms: self.updated_at_ms.max(created_at_ms),
         };
         record.validate()?;
         Ok(record)
     }
 }
 
+/// Longest accepted provider credential, in bytes.
+pub const PROVIDER_CREDENTIAL_MAX_BYTES: usize = 4096;
+
+/// A provider credential travels as an HTTP bearer token: 1 to
+/// [`PROVIDER_CREDENTIAL_MAX_BYTES`] bytes of visible ASCII.
+pub fn validate_provider_credential(
+    credential: &SecretValue,
+) -> Result<(), EnvironmentRegistryError> {
+    let value = credential.expose();
+    if value.is_empty()
+        || value.len() > PROVIDER_CREDENTIAL_MAX_BYTES
+        || !value.bytes().all(|byte| byte.is_ascii_graphic())
+    {
+        return invalid(format!(
+            "provider credential must be 1..={PROVIDER_CREDENTIAL_MAX_BYTES} bytes of visible ASCII"
+        ));
+    }
+    Ok(())
+}
+
+/// What a controller advertised at a successful `initialize`. Written only
+/// while the provider is still registered at `controller_endpoint`, so an
+/// `initialize` against an endpoint the operator has since replaced cannot
+/// overwrite the new endpoint's facts.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct RecordProviderController {
+    pub provider_id: EnvironmentProviderId,
+    pub controller_endpoint: EnvironmentEndpoint,
+    pub features: ControllerFeatures,
+    pub data_route_base: DataRouteBase,
+}
+
 #[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
 pub struct ListEnvironmentProviders {}
 
@@ -330,9 +389,8 @@ pub enum EnvironmentSource {
         provider_id: EnvironmentProviderId,
         binding_id: EnvironmentProviderBindingId,
     },
-    External {
-        connection: EnvironmentConnectionSpec,
-    },
+    /// An `envd` Lightspeed dials directly at a fixed endpoint.
+    External { endpoint: EnvironmentEndpoint },
     /// An `envd` that dialed the gateway outbound and was admitted by a
     /// registration key. The daemon public key is the identity: one key
     /// maps to at most one environment in the deployment, ever, so a closed
@@ -421,6 +479,12 @@ impl EnvironmentStatus {
     pub fn is_powered_down(self) -> bool {
         matches!(self, Self::Paused | Self::Suspended | Self::Offline)
     }
+
+    /// True once a close was accepted: no observation may change the status
+    /// any more except the close's own completion.
+    pub fn is_closing_or_closed(self) -> bool {
+        matches!(self, Self::Closing | Self::Closed)
+    }
 }
 
 /// Staged idle policy: each threshold is measured against the daemon's
@@ -546,17 +610,65 @@ pub struct EnvironmentRecord {
     /// daemon's idle report.
     pub idle_policy: Option<EnvironmentIdlePolicy>,
     pub incarnation: EnvironmentIncarnationRecord,
+    /// Lightspeed-owned public ingress intent. The lifecycle reconciler
+    /// converges the provider target toward it while the environment is
+    /// ready; the realized endpoint is `public_endpoint`.
     pub public_ingress_enabled: bool,
+    /// The public endpoint the provider last reported realized. It can lag
+    /// the intent in either direction while the reconciler converges.
     pub public_endpoint: Option<String>,
     pub metadata: BTreeMap<String, String>,
     /// Registered environments only: when the gateway last saw the daemon's
     /// control connection (connect, heartbeat). A stale stamp under `Ready`
     /// means the gateway stopped without recording the disconnect.
     pub last_seen_at_ms: Option<i64>,
+    /// Why the environment failed, or the latest error while its lifecycle
+    /// keeps retrying. Cleared once an observation reaches a steady state.
+    pub lifecycle_error: Option<EnvironmentLifecycleError>,
     pub created_at_ms: i64,
     pub updated_at_ms: i64,
 }
 
+/// The latest lifecycle error of an environment and how long errors have
+/// persisted.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct EnvironmentLifecycleError {
+    /// 1 to 1024 bytes without control characters other than line feed and
+    /// tab.
+    pub message: String,
+    /// When the current run of errors began: the first error recorded since
+    /// the environment was last steady.
+    pub first_at_ms: i64,
+    /// When `message` was recorded.
+    pub last_at_ms: i64,
+}
+
+impl EnvironmentLifecycleError {
+    /// The error recorded at `at_ms`, continuing the run of `previous`.
+    /// `message` is cleaned and cut to the stored bound.
+    pub fn record(previous: Option<&Self>, message: &str, at_ms: i64) -> Self {
+        let message = DescriptiveText::lossy(message)
+            .map(DescriptiveText::into_string)
+            .unwrap_or_else(|| "unspecified lifecycle error".to_owned());
+        let first_at_ms = previous.map_or(at_ms, |previous| previous.first_at_ms.min(at_ms));
+        Self {
+            message,
+            first_at_ms,
+            last_at_ms: at_ms.max(first_at_ms),
+        }
+    }
+
+    pub fn validate(&self) -> Result<(), EnvironmentRegistryError> {
+        validate_descriptive_text(&self.message)
+            .map_err(|error| invalid_error(format!("lifecycle error message: {error}")))?;
+        validate_nonnegative_i64(self.first_at_ms, "lifecycle_error.first_at_ms")?;
+        if self.last_at_ms < self.first_at_ms {
+            return invalid("lifecycle_error.last_at_ms must be >= first_at_ms");
+        }
+        Ok(())
+    }
+}
+
 impl EnvironmentRecord {
     pub fn registration_key_id(&self) -> Option<&EnvironmentRegistrationKeyId> {
         self.source.registration_key_id()
@@ -591,6 +703,36 @@ impl EnvironmentRecord {
                 .is_some_and(|observed| observed != self.desired_power)
     }
 
+    /// True for a ready provisioned environment whose realized public
+    /// endpoint does not match its ingress intent yet.
+    pub fn ingress_diverges(&self) -> bool {
+        matches!(self.source, EnvironmentSource::Provisioned { .. })
+            && self.status == EnvironmentStatus::Ready
+            && self.public_ingress_enabled != self.public_endpoint.is_some()
+    }
+
+    /// True for a provisioned environment at rest in a power state whose
+    /// provider target is recorded: only a periodic observation notices a
+    /// target that changed or vanished out of band.
+    pub fn is_steady_provisioned(&self) -> bool {
+        matches!(self.source, EnvironmentSource::Provisioned { .. })
+            && self.status.power_state().is_some()
+            && self.incarnation.provider_target_id.is_some()
+    }
+
+    /// Whether a reconcile pass of `scope` visits this environment.
+    pub fn needs_reconcile(&self, scope: ReconcileScope) -> bool {
+        matches!(
+            self.status,
+            EnvironmentStatus::Provisioning
+                | EnvironmentStatus::Booting
+                | EnvironmentStatus::Closing
+                | EnvironmentStatus::Unknown
+        ) || self.power_diverges()
+            || self.ingress_diverges()
+            || (scope == ReconcileScope::WithSteady && self.is_steady_provisioned())
+    }
+
     pub fn provider_id(&self) -> Option<&EnvironmentProviderId> {
         self.source.provider_id()
     }
@@ -615,10 +757,7 @@ impl EnvironmentRecord {
         if let Some(policy) = &self.idle_policy {
             policy.validate()?;
         }
-        if self.public_ingress_enabled != self.public_endpoint.is_some() {
-            return invalid("public ingress requires exactly one public endpoint when enabled");
-        }
-        if self.public_ingress_enabled
+        if (self.public_ingress_enabled || self.public_endpoint.is_some())
             && !matches!(self.source, EnvironmentSource::Provisioned { .. })
         {
             return invalid("only provisioned environments can have provider-managed ingress");
@@ -629,8 +768,8 @@ impl EnvironmentRecord {
         if let Some(seen) = self.last_seen_at_ms {
             validate_nonnegative_i64(seen, "last_seen_at_ms")?;
         }
-        if let Some(target_id) = &self.incarnation.provider_target_id {
-            validate_provider_target_id(target_id)?;
+        if let Some(error) = &self.lifecycle_error {
+            error.validate()?;
         }
         match &self.source {
             EnvironmentSource::Provisioned { .. } => {
@@ -644,18 +783,11 @@ impl EnvironmentRecord {
                         "provisioned incarnation requires exactly one template or adoption source",
                     );
                 }
-                if let Some(source) = self.incarnation.adoption_source_target.as_deref()
-                    && (source.is_empty()
-                        || source.len() > 255
-                        || source.chars().any(char::is_control))
-                {
-                    return invalid(
-                        "adoption_source_target must be non-empty, at most 255 bytes, and contain no control characters",
-                    );
+                if let Some(source) = self.incarnation.adoption_source_target.as_deref() {
+                    validate_adoption_source(source)?;
                 }
             }
-            EnvironmentSource::External { connection } => {
-                connection.validate()?;
+            EnvironmentSource::External { .. } => {
                 self.validate_no_provider_linkage("external")?;
             }
             EnvironmentSource::Registered {
@@ -663,10 +795,8 @@ impl EnvironmentRecord {
                 daemon_public_key,
                 ..
             } => {
-                validate_daemon_public_key(daemon_public_key)?;
-                if daemon_id
-                    != &EnvironmentDaemonId::from_public_key(&decode_hex(daemon_public_key)?)
-                {
+                let public_key = parse_daemon_public_key(daemon_public_key)?;
+                if daemon_id != &EnvironmentDaemonId::from_public_key(public_key.as_bytes()) {
                     return invalid("registered daemon id does not match its public key");
                 }
                 if self.request_id != EnvironmentProvisionRequestId::for_daemon(daemon_id) {
@@ -931,10 +1061,8 @@ pub struct CreateRegisteredEnvironment {
 
 impl CreateRegisteredEnvironment {
     pub fn daemon_id(&self) -> Result<EnvironmentDaemonId, EnvironmentRegistryError> {
-        validate_daemon_public_key(&self.daemon_public_key)?;
-        Ok(EnvironmentDaemonId::from_public_key(&decode_hex(
-            &self.daemon_public_key,
-        )?))
+        let public_key = parse_daemon_public_key(&self.daemon_public_key)?;
+        Ok(EnvironmentDaemonId::from_public_key(public_key.as_bytes()))
     }
 }
 
@@ -963,32 +1091,30 @@ pub struct ObserveRegisteredEnvironment {
     pub metadata: BTreeMap<String, String>,
 }
 
-/// Metadata keys the gateway writes about the daemon serving a registered
-/// environment. They carry the reserved prefix, so a daemon cannot set them.
+/// Metadata keys Lightspeed writes about the daemon serving an environment.
+/// They carry the reserved prefix, so a caller cannot set them.
 pub const ENVD_VERSION_METADATA_KEY: &str = "lightspeed.envd.version";
 pub const ENVD_GIT_SHA_METADATA_KEY: &str = "lightspeed.envd.gitSha";
 pub const ENVD_PROTOCOL_VERSION_METADATA_KEY: &str = "lightspeed.envd.protocolVersion";
 
-/// What the gateway learned about a daemon's build when it registered or
-/// reconnected. Recorded on the environment row at every admission so an
-/// operator sees which build serves the environment. Never consulted for
-/// admission: the protocol version alone decides that, and this only
-/// records which number the admitted daemon spoke.
+/// What Lightspeed learned about the daemon serving an environment: from
+/// `registration/register` for a registered daemon, from the data-plane
+/// `initialize` at the Ready transition for a provisioned one. Recorded on
+/// the environment row so an operator sees which build serves it, and which
+/// protocol version a mismatched daemon spoke. Never consulted for
+/// admission: the protocol version alone decides that.
 #[derive(Clone, Debug, PartialEq, Eq)]
-pub struct RegisteredDaemonBuild {
+pub struct DaemonBuild {
     pub version: Option<String>,
     pub git_sha: Option<String>,
     pub protocol_version: u32,
 }
 
-impl RegisteredDaemonBuild {
-    pub fn from_registration(
-        implementation: &environment_protocol::shared::ImplementationInfo,
-        protocol_version: u32,
-    ) -> Self {
+impl DaemonBuild {
+    pub fn from_implementation(implementation: &ImplementationInfo, protocol_version: u32) -> Self {
         Self {
-            version: implementation.version.clone(),
-            git_sha: implementation.git_sha.clone(),
+            version: implementation.version().map(str::to_owned),
+            git_sha: implementation.git_sha().map(str::to_owned),
             protocol_version,
         }
     }
@@ -1041,12 +1167,185 @@ pub struct CreateExternalEnvironment {
     pub request_id: EnvironmentProvisionRequestId,
     pub environment_id: EnvironmentId,
     pub incarnation_id: EnvironmentIncarnationId,
-    pub connection: EnvironmentConnectionSpec,
+    pub endpoint: EnvironmentEndpoint,
     pub display_name: Option<String>,
     pub metadata: BTreeMap<String, String>,
     pub created_at_ms: i64,
 }
 
+impl CreateEnvironment {
+    /// The validated record this create inserts for a binding of
+    /// `provider_id`.
+    pub fn record(
+        &self,
+        provider_id: EnvironmentProviderId,
+    ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
+        let record = new_record(
+            self.environment_id.clone(),
+            self.request_id.clone(),
+            EnvironmentSource::Provisioned {
+                provider_id,
+                binding_id: self.binding_id.clone(),
+            },
+            self.display_name.clone(),
+            EnvironmentStatus::Provisioning,
+            EnvironmentIncarnationRecord {
+                provision_request_id: Some(self.request_id.clone()),
+                template_id: Some(self.template_id.clone()),
+                ..new_incarnation(self.incarnation_id.clone(), self.created_at_ms)
+            },
+            self.metadata.clone(),
+            self.created_at_ms,
+        );
+        let record = EnvironmentRecord {
+            idle_policy: self.idle_policy.clone(),
+            ..record
+        };
+        record.validate()?;
+        Ok(record)
+    }
+}
+
+impl AdoptEnvironment {
+    /// The validated record this adoption inserts for a binding of
+    /// `provider_id`.
+    pub fn record(
+        &self,
+        provider_id: EnvironmentProviderId,
+    ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
+        validate_adoption_source(&self.source_target)?;
+        let record = new_record(
+            self.environment_id.clone(),
+            self.request_id.clone(),
+            EnvironmentSource::Provisioned {
+                provider_id,
+                binding_id: self.binding_id.clone(),
+            },
+            self.display_name.clone(),
+            EnvironmentStatus::Provisioning,
+            EnvironmentIncarnationRecord {
+                provision_request_id: Some(self.request_id.clone()),
+                adoption_source_target: Some(self.source_target.clone()),
+                ..new_incarnation(self.incarnation_id.clone(), self.created_at_ms)
+            },
+            self.metadata.clone(),
+            self.created_at_ms,
+        );
+        record.validate()?;
+        Ok(record)
+    }
+}
+
+impl CreateExternalEnvironment {
+    /// The validated record this create inserts.
+    pub fn record(&self) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
+        let record = new_record(
+            self.environment_id.clone(),
+            self.request_id.clone(),
+            EnvironmentSource::External {
+                endpoint: self.endpoint.clone(),
+            },
+            self.display_name.clone(),
+            EnvironmentStatus::Ready,
+            new_incarnation(self.incarnation_id.clone(), self.created_at_ms),
+            self.metadata.clone(),
+            self.created_at_ms,
+        );
+        record.validate()?;
+        Ok(record)
+    }
+}
+
+impl CreateRegisteredEnvironment {
+    /// The validated record this admission inserts under `key`.
+    pub fn record(
+        &self,
+        key: &EnvironmentRegistrationKeyRecord,
+    ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
+        let daemon_id = self.daemon_id()?;
+        let record = new_record(
+            self.environment_id.clone(),
+            EnvironmentProvisionRequestId::for_daemon(&daemon_id),
+            EnvironmentSource::Registered {
+                registration_key_id: key.registration_key_id.clone(),
+                daemon_id,
+                daemon_public_key: self.daemon_public_key.clone(),
+                identity_mode: key.identity_mode,
+            },
+            self.display_name.clone(),
+            EnvironmentStatus::Ready,
+            new_incarnation(self.incarnation_id.clone(), self.created_at_ms),
+            self.metadata.clone(),
+            self.created_at_ms,
+        );
+        let record = EnvironmentRecord {
+            last_seen_at_ms: Some(self.created_at_ms),
+            ..record
+        };
+        record.validate()?;
+        Ok(record)
+    }
+}
+
+fn new_incarnation(
+    incarnation_id: EnvironmentIncarnationId,
+    created_at_ms: i64,
+) -> EnvironmentIncarnationRecord {
+    EnvironmentIncarnationRecord {
+        incarnation_id,
+        provision_request_id: None,
+        provider_target_id: None,
+        template_id: None,
+        adoption_source_target: None,
+        power_states: Vec::new(),
+        created_at_ms,
+        updated_at_ms: created_at_ms,
+    }
+}
+
+#[allow(clippy::too_many_arguments)]
+fn new_record(
+    environment_id: EnvironmentId,
+    request_id: EnvironmentProvisionRequestId,
+    source: EnvironmentSource,
+    display_name: Option<String>,
+    status: EnvironmentStatus,
+    incarnation: EnvironmentIncarnationRecord,
+    metadata: BTreeMap<String, String>,
+    created_at_ms: i64,
+) -> EnvironmentRecord {
+    EnvironmentRecord {
+        environment_id,
+        request_id,
+        source,
+        display_name,
+        status,
+        desired_power: PowerState::Running,
+        idle_policy: None,
+        incarnation,
+        public_ingress_enabled: false,
+        public_endpoint: None,
+        metadata,
+        last_seen_at_ms: None,
+        lifecycle_error: None,
+        created_at_ms,
+        updated_at_ms: created_at_ms,
+    }
+}
+
+/// Which environments a lifecycle reconcile pass visits.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum ReconcileScope {
+    /// Environments with convergence pending: provisioning, booting,
+    /// closing or unknown, a power state that diverges from the intent, or
+    /// a ready environment whose public endpoint does not match its
+    /// ingress intent.
+    Converging,
+    /// Those plus every steady provisioned environment with a recorded
+    /// target, observed on a slower cadence.
+    WithSteady,
+}
+
 #[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
 pub struct ListEnvironments {
     pub provider_id: Option<EnvironmentProviderId>,
@@ -1059,16 +1358,66 @@ pub struct ListEnvironments {
     pub metadata: BTreeMap<String, String>,
 }
 
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+/// A provider observation of a provisioned environment's target. The target
+/// id and power states are recorded whatever the environment's status, so a
+/// close that raced the first create can still address the target. The
+/// status, the daemon build and the clearing of `lifecycle_error` apply only
+/// while the environment is not closing or closed: a close is never
+/// overwritten by an observation that was in flight when it was accepted.
+#[derive(Clone, Debug, PartialEq, Eq)]
 pub struct ObserveProvisionedEnvironment {
     pub environment_id: EnvironmentId,
-    pub provider_target_id: ProviderTargetId,
+    /// Recorded when present; absent while an asynchronous provider has not
+    /// assigned one yet, which keeps the recorded id. A different id than
+    /// the recorded one is refused.
+    pub provider_target_id: Option<ProviderTargetId>,
     pub status: EnvironmentStatus,
     /// Provider-reported supported power states for this target.
     pub power_states: Vec<PowerState>,
+    /// The daemon found by the data-plane `initialize` of a Ready
+    /// transition.
+    pub daemon_build: Option<DaemonBuild>,
     pub observed_at_ms: i64,
 }
 
+impl ObserveProvisionedEnvironment {
+    /// Apply this observation to `record`. Stale observations (older than
+    /// the incarnation's last update) leave it unchanged.
+    pub fn apply(&self, record: &mut EnvironmentRecord) -> Result<(), EnvironmentRegistryError> {
+        validate_nonnegative_i64(self.observed_at_ms, "observed_at_ms")?;
+        if !matches!(record.source, EnvironmentSource::Provisioned { .. }) {
+            return invalid("provider observations apply only to provisioned environments");
+        }
+        if self.observed_at_ms < record.incarnation.updated_at_ms {
+            return Ok(());
+        }
+        if let (Some(recorded), Some(observed)) = (
+            record.incarnation.provider_target_id.as_ref(),
+            self.provider_target_id.as_ref(),
+        ) && recorded != observed
+        {
+            return invalid("provider target conflicts with current incarnation");
+        }
+        if let Some(target_id) = &self.provider_target_id {
+            record.incarnation.provider_target_id = Some(target_id.clone());
+        }
+        record.incarnation.power_states = self.power_states.clone();
+        record.incarnation.updated_at_ms = self.observed_at_ms;
+        if record.status.is_closing_or_closed() {
+            return Ok(());
+        }
+        record.status = self.status;
+        if let Some(build) = &self.daemon_build {
+            record.metadata.extend(build.metadata());
+        }
+        if self.status.power_state().is_some() {
+            record.lifecycle_error = None;
+        }
+        record.updated_at_ms = record.updated_at_ms.max(self.observed_at_ms);
+        Ok(())
+    }
+}
+
 /// Set the Lightspeed-owned power intent. Rejected for external, closing,
 /// closed, and failed environments; the caller validates provider support.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
@@ -1086,13 +1435,66 @@ pub struct SetEnvironmentIdlePolicy {
     pub updated_at_ms: i64,
 }
 
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+/// Move an environment to `failed` with `message` as its lifecycle error.
+/// A closing or closed environment is left as it is.
+#[derive(Clone, Debug, PartialEq, Eq)]
 pub struct FailEnvironmentLifecycle {
+    pub environment_id: EnvironmentId,
+    pub message: String,
+    /// The daemon whose build made the environment unusable, such as one
+    /// that speaks another protocol version.
+    pub daemon_build: Option<DaemonBuild>,
+    pub observed_at_ms: i64,
+}
+
+impl FailEnvironmentLifecycle {
+    pub fn apply(&self, record: &mut EnvironmentRecord) -> Result<(), EnvironmentRegistryError> {
+        validate_nonnegative_i64(self.observed_at_ms, "observed_at_ms")?;
+        if record.status.is_closing_or_closed() {
+            return Ok(());
+        }
+        record.status = EnvironmentStatus::Failed;
+        record.lifecycle_error = Some(EnvironmentLifecycleError::record(
+            record.lifecycle_error.as_ref(),
+            &self.message,
+            self.observed_at_ms,
+        ));
+        if let Some(build) = &self.daemon_build {
+            record.metadata.extend(build.metadata());
+        }
+        record.incarnation.updated_at_ms =
+            record.incarnation.updated_at_ms.max(self.observed_at_ms);
+        record.updated_at_ms = record.updated_at_ms.max(self.observed_at_ms);
+        Ok(())
+    }
+}
+
+/// Record a lifecycle error the reconciler will retry past, without
+/// changing the environment's status. A closed environment is left as it
+/// is.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct RecordEnvironmentLifecycleError {
     pub environment_id: EnvironmentId,
     pub message: String,
     pub observed_at_ms: i64,
 }
 
+impl RecordEnvironmentLifecycleError {
+    pub fn apply(&self, record: &mut EnvironmentRecord) -> Result<(), EnvironmentRegistryError> {
+        validate_nonnegative_i64(self.observed_at_ms, "observed_at_ms")?;
+        if record.status == EnvironmentStatus::Closed {
+            return Ok(());
+        }
+        record.lifecycle_error = Some(EnvironmentLifecycleError::record(
+            record.lifecycle_error.as_ref(),
+            &self.message,
+            self.observed_at_ms,
+        ));
+        record.updated_at_ms = record.updated_at_ms.max(self.observed_at_ms);
+        Ok(())
+    }
+}
+
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub struct BeginCloseEnvironment {
     pub environment_id: EnvironmentId,
@@ -1105,14 +1507,42 @@ pub struct FinishCloseEnvironment {
     pub observed_at_ms: i64,
 }
 
+/// Record the public ingress intent of a provisioned environment; the
+/// lifecycle reconciler converges the provider toward it. Enabling is
+/// refused for a closing or closed environment.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub struct SetEnvironmentIngress {
     pub environment_id: EnvironmentId,
     pub enabled: bool,
-    pub public_endpoint: Option<String>,
     pub updated_at_ms: i64,
 }
 
+/// Record the public endpoint a provider observation reports realized,
+/// `None` when the target has no public ingress. A closing or closed
+/// environment is left as it is.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct RecordEnvironmentIngress {
+    pub environment_id: EnvironmentId,
+    pub public_endpoint: Option<String>,
+    pub observed_at_ms: i64,
+}
+
+impl RecordEnvironmentIngress {
+    pub fn apply(&self, record: &mut EnvironmentRecord) -> Result<(), EnvironmentRegistryError> {
+        validate_nonnegative_i64(self.observed_at_ms, "observed_at_ms")?;
+        validate_nonempty_optional("public_endpoint", self.public_endpoint.as_deref())?;
+        if !matches!(record.source, EnvironmentSource::Provisioned { .. }) {
+            return invalid("provider-managed ingress requires a provisioned environment");
+        }
+        if record.status.is_closing_or_closed() {
+            return Ok(());
+        }
+        record.public_endpoint = self.public_endpoint.clone();
+        record.updated_at_ms = record.updated_at_ms.max(self.observed_at_ms);
+        Ok(())
+    }
+}
+
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub struct EnvironmentCredentialRecord {
     pub environment_id: EnvironmentId,
@@ -1172,6 +1602,18 @@ pub trait EnvironmentProviderStore: Send + Sync {
         &self,
         provider_id: &EnvironmentProviderId,
     ) -> Result<EnvironmentProviderRecord, EnvironmentRegistryError>;
+    /// The provider's bearer credential, unsealed.
+    async fn read_provider_credential(
+        &self,
+        provider_id: &EnvironmentProviderId,
+    ) -> Result<SecretValue, EnvironmentRegistryError>;
+    /// Record what the controller advertised at a successful `initialize`.
+    /// Returns the record unchanged when the provider has moved to another
+    /// endpoint since.
+    async fn record_provider_controller(
+        &self,
+        request: RecordProviderController,
+    ) -> Result<EnvironmentProviderRecord, EnvironmentRegistryError>;
     async fn list_providers(
         &self,
         request: ListEnvironmentProviders,
@@ -1246,12 +1688,17 @@ pub trait EnvironmentStore: Send + Sync {
         &self,
         request_id: &EnvironmentProvisionRequestId,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError>;
+    /// Rows that no longer decode are left out and logged by the store, so
+    /// one bad row never hides the others; every list method does the same.
     async fn list_environments(
         &self,
         request: ListEnvironments,
     ) -> Result<Vec<EnvironmentRecord>, EnvironmentRegistryError>;
+    /// The environments a reconcile pass of `scope` visits; see
+    /// [`EnvironmentRecord::needs_reconcile`].
     async fn list_environments_needing_reconcile(
         &self,
+        scope: ReconcileScope,
     ) -> Result<Vec<EnvironmentRecord>, EnvironmentRegistryError>;
     async fn observe_provisioned_environment(
         &self,
@@ -1261,6 +1708,10 @@ pub trait EnvironmentStore: Send + Sync {
         &self,
         request: FailEnvironmentLifecycle,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError>;
+    async fn record_environment_lifecycle_error(
+        &self,
+        request: RecordEnvironmentLifecycleError,
+    ) -> Result<EnvironmentRecord, EnvironmentRegistryError>;
     async fn begin_close_environment(
         &self,
         request: BeginCloseEnvironment,
@@ -1273,6 +1724,10 @@ pub trait EnvironmentStore: Send + Sync {
         &self,
         request: SetEnvironmentIngress,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError>;
+    async fn record_environment_ingress(
+        &self,
+        request: RecordEnvironmentIngress,
+    ) -> Result<EnvironmentRecord, EnvironmentRegistryError>;
     async fn set_environment_power(
         &self,
         request: SetEnvironmentPower,
@@ -1309,7 +1764,7 @@ pub fn template_record(
     value: &EnvironmentTemplate,
 ) -> Result<EnvironmentTemplateId, EnvironmentRegistryError> {
     let template_id =
-        EnvironmentTemplateId::try_new(value.template_id.clone()).map_err(|error| {
+        EnvironmentTemplateId::try_new(value.template_id.as_str()).map_err(|error| {
             EnvironmentRegistryError::InvalidInput {
                 message: format!("invalid template id: {error}"),
             }
@@ -1317,6 +1772,8 @@ pub fn template_record(
     Ok(template_id)
 }
 
+pub mod endpoint;
+pub use endpoint::{EndpointError, EndpointScheme, EnvironmentEndpoint};
 mod memory;
 pub use memory::{InMemoryEnvironmentRegistryStore, apply_registered_observation};
 
@@ -1338,20 +1795,11 @@ fn validate_timestamps(
     Ok(())
 }
 
-fn validate_endpoint(name: &'static str, value: &str) -> Result<(), EnvironmentRegistryError> {
-    validate_nonempty_string(name, value)?;
-    if value.chars().any(char::is_whitespace) {
-        return invalid(format!("{name} must not contain whitespace"));
-    }
-    Ok(())
-}
-
-fn validate_provider_target_id(value: &ProviderTargetId) -> Result<(), EnvironmentRegistryError> {
-    validate_general_string_id("target_id", value.as_str()).map_err(|error| {
-        EnvironmentRegistryError::InvalidInput {
-            message: error.to_string(),
-        }
-    })
+/// An adoption source is a provider-native reference under the protocol's
+/// opaque rule: 1 to 255 bytes without control characters.
+pub fn validate_adoption_source(value: &str) -> Result<(), EnvironmentRegistryError> {
+    validate_opaque_id("adoption_source_target", value)
+        .map_err(|error| invalid_error(error.to_string()))
 }
 
 fn validate_registration_display_name(value: &str) -> Result<(), EnvironmentRegistryError> {
@@ -1369,27 +1817,14 @@ fn validate_registration_display_name(value: &str) -> Result<(), EnvironmentRegi
 
 /// A daemon public key is the raw 32-byte Ed25519 key as lowercase hex.
 pub fn validate_daemon_public_key(value: &str) -> Result<(), EnvironmentRegistryError> {
-    if value.len() != 64
-        || !value
-            .bytes()
-            .all(|b| matches!(b, b'0'..=b'9' | b'a'..=b'f'))
-    {
-        return invalid("daemon public key must be 64 lowercase hex characters");
-    }
-    Ok(())
+    parse_daemon_public_key(value).map(|_| ())
 }
 
-fn decode_hex(value: &str) -> Result<Vec<u8>, EnvironmentRegistryError> {
-    if !value.len().is_multiple_of(2) {
-        return invalid("hex value has odd length");
-    }
-    (0..value.len())
-        .step_by(2)
-        .map(|index| {
-            u8::from_str_radix(&value[index..index + 2], 16)
-                .map_err(|_| invalid_error("hex value contains a non-hex character"))
-        })
-        .collect()
+fn parse_daemon_public_key(
+    value: &str,
+) -> Result<environment_protocol::registration::DaemonPublicKey, EnvironmentRegistryError> {
+    environment_protocol::registration::DaemonPublicKey::parse(value)
+        .map_err(|_| invalid_error("daemon public key must be 64 lowercase hex characters"))
 }
 
 fn invalid_error(message: impl Into<String>) -> EnvironmentRegistryError {
@@ -1398,29 +1833,12 @@ fn invalid_error(message: impl Into<String>) -> EnvironmentRegistryError {
     }
 }
 
-/// Stored records obey the registration handshake's bounds (entry count,
-/// key and value bytes, no control characters). The reserved-prefix check
-/// applies to caller input at the API boundary, not here: Lightspeed itself
-/// annotates records under that prefix, and those entries sit on top of a
-/// caller's full allowance rather than eating into it, so the entry count
-/// applies to the caller's keys alone.
+/// Stored records obey the descriptive metadata bounds. The reserved-prefix
+/// check applies to caller input at the API boundary, not here: Lightspeed
+/// itself annotates records under that prefix, and those entries sit on top
+/// of a caller's full allowance rather than eating into it.
 fn validate_metadata(value: &BTreeMap<String, String>) -> Result<(), EnvironmentRegistryError> {
-    use environment_protocol::registration::{
-        MAX_METADATA_ENTRIES, RESERVED_METADATA_PREFIX, validate_metadata_entry,
-    };
-    let caller_entries = value
-        .keys()
-        .filter(|key| !key.starts_with(RESERVED_METADATA_PREFIX))
-        .count();
-    if caller_entries > MAX_METADATA_ENTRIES {
-        return Err(invalid_error(format!(
-            "metadata has more than {MAX_METADATA_ENTRIES} caller entries"
-        )));
-    }
-    for (key, entry) in value {
-        validate_metadata_entry(key, entry).map_err(invalid_error)?;
-    }
-    Ok(())
+    validate_stored_metadata(value).map_err(|error| invalid_error(error.to_string()))
 }
 
 fn validate_nonempty_optional(
diff --git a/crates/environments/src/memory.rs b/crates/environments/src/memory.rs
index fe9693f2e..4b9c28c5b 100644
--- a/crates/environments/src/memory.rs
+++ b/crates/environments/src/memory.rs
@@ -16,6 +16,7 @@ struct StoredRegistrationKey {
 #[derive(Default)]
 struct RegistryState {
     providers: BTreeMap<EnvironmentProviderId, EnvironmentProviderRecord>,
+    provider_credentials: BTreeMap<EnvironmentProviderId, SecretValue>,
     bindings: BTreeMap<BindingKey, EnvironmentProviderBindingRecord>,
     environments: BTreeMap<EnvironmentId, EnvironmentRecord>,
     requests: BTreeMap<EnvironmentProvisionRequestId, EnvironmentId>,
@@ -77,10 +78,14 @@ impl EnvironmentProviderStore for InMemoryEnvironmentRegistryStore {
         &self,
         request: PutEnvironmentProvider,
     ) -> Result<EnvironmentProviderRecord, EnvironmentRegistryError> {
-        let mut record = request.into_record()?;
         let mut state = self.write_state()?;
-        if let Some(existing) = state.providers.get(&record.provider_id) {
-            record.created_at_ms = existing.created_at_ms;
+        let credential = request.credential.clone();
+        let existing = state.providers.get(&request.provider_id).cloned();
+        let record = request.into_record(existing.as_ref())?;
+        if let Some(credential) = credential {
+            state
+                .provider_credentials
+                .insert(record.provider_id.clone(), credential);
         }
         state
             .providers
@@ -88,6 +93,33 @@ impl EnvironmentProviderStore for InMemoryEnvironmentRegistryStore {
         Ok(record)
     }
 
+    async fn read_provider_credential(
+        &self,
+        provider_id: &EnvironmentProviderId,
+    ) -> Result<SecretValue, EnvironmentRegistryError> {
+        self.read_state()?
+            .provider_credentials
+            .get(provider_id)
+            .cloned()
+            .ok_or_else(|| not_found("environment_provider", provider_id))
+    }
+
+    async fn record_provider_controller(
+        &self,
+        request: RecordProviderController,
+    ) -> Result<EnvironmentProviderRecord, EnvironmentRegistryError> {
+        let mut state = self.write_state()?;
+        let record = state
+            .providers
+            .get_mut(&request.provider_id)
+            .ok_or_else(|| not_found("environment_provider", &request.provider_id))?;
+        if record.controller_endpoint == request.controller_endpoint {
+            record.controller_features = Some(request.features);
+            record.data_route_base = Some(request.data_route_base);
+        }
+        Ok(record.clone())
+    }
+
     async fn read_provider(
         &self,
         provider_id: &EnvironmentProviderId,
@@ -118,10 +150,12 @@ impl EnvironmentProviderStore for InMemoryEnvironmentRegistryStore {
         {
             return invalid("environment provider is referenced by a universe binding");
         }
-        state
+        let record = state
             .providers
             .remove(provider_id)
-            .ok_or_else(|| not_found("environment_provider", provider_id))
+            .ok_or_else(|| not_found("environment_provider", provider_id))?;
+        state.provider_credentials.remove(provider_id);
+        Ok(record)
     }
 }
 
@@ -250,35 +284,7 @@ impl EnvironmentStore for InMemoryEnvironmentRegistryStore {
                 id: request.environment_id.to_string(),
             });
         }
-        let record = EnvironmentRecord {
-            environment_id: request.environment_id.clone(),
-            request_id: request.request_id.clone(),
-            source: EnvironmentSource::Provisioned {
-                provider_id: binding.provider_id,
-                binding_id: request.binding_id,
-            },
-            display_name: request.display_name,
-            status: EnvironmentStatus::Provisioning,
-            desired_power: PowerState::Running,
-            idle_policy: request.idle_policy,
-            incarnation: EnvironmentIncarnationRecord {
-                incarnation_id: request.incarnation_id,
-                provision_request_id: Some(request.request_id.clone()),
-                provider_target_id: None,
-                template_id: Some(request.template_id),
-                adoption_source_target: None,
-                power_states: Vec::new(),
-                created_at_ms: request.created_at_ms,
-                updated_at_ms: request.created_at_ms,
-            },
-            public_ingress_enabled: false,
-            public_endpoint: None,
-            metadata: request.metadata,
-            last_seen_at_ms: None,
-            created_at_ms: request.created_at_ms,
-            updated_at_ms: request.created_at_ms,
-        };
-        record.validate()?;
+        let record = request.record(binding.provider_id)?;
         state
             .requests
             .insert(request.request_id, request.environment_id.clone());
@@ -293,14 +299,6 @@ impl EnvironmentStore for InMemoryEnvironmentRegistryStore {
         request: AdoptEnvironment,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
         validate_nonnegative_i64(request.created_at_ms, "created_at_ms")?;
-        if request.source_target.is_empty()
-            || request.source_target.len() > 255
-            || request.source_target.chars().any(char::is_control)
-        {
-            return invalid(
-                "adoption source must be non-empty, at most 255 bytes, and contain no control characters",
-            );
-        }
         let mut state = self.write_state()?;
         if let Some(environment_id) = state.requests.get(&request.request_id) {
             return state
@@ -323,35 +321,7 @@ impl EnvironmentStore for InMemoryEnvironmentRegistryStore {
                 id: request.environment_id.to_string(),
             });
         }
-        let record = EnvironmentRecord {
-            environment_id: request.environment_id.clone(),
-            request_id: request.request_id.clone(),
-            source: EnvironmentSource::Provisioned {
-                provider_id: binding.provider_id,
-                binding_id: request.binding_id,
-            },
-            display_name: request.display_name,
-            status: EnvironmentStatus::Provisioning,
-            desired_power: PowerState::Running,
-            idle_policy: None,
-            incarnation: EnvironmentIncarnationRecord {
-                incarnation_id: request.incarnation_id,
-                provision_request_id: Some(request.request_id.clone()),
-                provider_target_id: None,
-                template_id: None,
-                adoption_source_target: Some(request.source_target),
-                power_states: Vec::new(),
-                created_at_ms: request.created_at_ms,
-                updated_at_ms: request.created_at_ms,
-            },
-            public_ingress_enabled: false,
-            public_endpoint: None,
-            metadata: request.metadata,
-            last_seen_at_ms: None,
-            created_at_ms: request.created_at_ms,
-            updated_at_ms: request.created_at_ms,
-        };
-        record.validate()?;
+        let record = request.record(binding.provider_id)?;
         state
             .requests
             .insert(request.request_id, request.environment_id.clone());
@@ -366,7 +336,6 @@ impl EnvironmentStore for InMemoryEnvironmentRegistryStore {
         request: CreateExternalEnvironment,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
         validate_nonnegative_i64(request.created_at_ms, "created_at_ms")?;
-        request.connection.validate()?;
         let mut state = self.write_state()?;
         if let Some(environment_id) = state.requests.get(&request.request_id) {
             return state
@@ -381,34 +350,7 @@ impl EnvironmentStore for InMemoryEnvironmentRegistryStore {
                 id: request.environment_id.to_string(),
             });
         }
-        let record = EnvironmentRecord {
-            environment_id: request.environment_id.clone(),
-            request_id: request.request_id.clone(),
-            source: EnvironmentSource::External {
-                connection: request.connection,
-            },
-            display_name: request.display_name,
-            status: EnvironmentStatus::Ready,
-            desired_power: PowerState::Running,
-            idle_policy: None,
-            incarnation: EnvironmentIncarnationRecord {
-                incarnation_id: request.incarnation_id,
-                provision_request_id: None,
-                provider_target_id: None,
-                template_id: None,
-                adoption_source_target: None,
-                power_states: Vec::new(),
-                created_at_ms: request.created_at_ms,
-                updated_at_ms: request.created_at_ms,
-            },
-            public_ingress_enabled: false,
-            public_endpoint: None,
-            metadata: request.metadata,
-            last_seen_at_ms: None,
-            created_at_ms: request.created_at_ms,
-            updated_at_ms: request.created_at_ms,
-        };
-        record.validate()?;
+        let record = request.record()?;
         state
             .requests
             .insert(request.request_id, request.environment_id.clone());
@@ -472,37 +414,7 @@ impl EnvironmentStore for InMemoryEnvironmentRegistryStore {
                 id: request.environment_id.to_string(),
             });
         }
-        let record = EnvironmentRecord {
-            environment_id: request.environment_id.clone(),
-            request_id: request_id.clone(),
-            source: EnvironmentSource::Registered {
-                registration_key_id: key.registration_key_id,
-                daemon_id,
-                daemon_public_key: request.daemon_public_key,
-                identity_mode: key.identity_mode,
-            },
-            display_name: request.display_name,
-            status: EnvironmentStatus::Ready,
-            desired_power: PowerState::Running,
-            idle_policy: None,
-            incarnation: EnvironmentIncarnationRecord {
-                incarnation_id: request.incarnation_id,
-                provision_request_id: None,
-                provider_target_id: None,
-                template_id: None,
-                adoption_source_target: None,
-                power_states: Vec::new(),
-                created_at_ms: request.created_at_ms,
-                updated_at_ms: request.created_at_ms,
-            },
-            public_ingress_enabled: false,
-            public_endpoint: None,
-            metadata: request.metadata,
-            last_seen_at_ms: Some(request.created_at_ms),
-            created_at_ms: request.created_at_ms,
-            updated_at_ms: request.created_at_ms,
-        };
-        record.validate()?;
+        let record = request.record(&key)?;
         state
             .requests
             .insert(request_id, request.environment_id.clone());
@@ -533,18 +445,14 @@ impl EnvironmentStore for InMemoryEnvironmentRegistryStore {
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
         validate_nonnegative_i64(request.observed_at_ms, "observed_at_ms")?;
         let mut state = self.write_state()?;
-        let record = state
-            .environments
-            .get_mut(&request.environment_id)
-            .ok_or_else(|| not_found("environment", &request.environment_id))?;
-        apply_registered_observation(
-            record,
-            request.observation,
-            request.observed_at_ms,
-            request.metadata,
-        )?;
-        record.validate()?;
-        Ok(record.clone())
+        update_environment(&mut state, &request.environment_id, |record| {
+            apply_registered_observation(
+                record,
+                request.observation,
+                request.observed_at_ms,
+                request.metadata,
+            )
+        })
     }
 
     async fn list_open_registered_environments(
@@ -628,20 +536,13 @@ impl EnvironmentStore for InMemoryEnvironmentRegistryStore {
 
     async fn list_environments_needing_reconcile(
         &self,
+        scope: ReconcileScope,
     ) -> Result<Vec<EnvironmentRecord>, EnvironmentRegistryError> {
         Ok(self
             .read_state()?
             .environments
             .values()
-            .filter(|record| {
-                matches!(
-                    record.status,
-                    EnvironmentStatus::Provisioning
-                        | EnvironmentStatus::Booting
-                        | EnvironmentStatus::Closing
-                        | EnvironmentStatus::Unknown
-                ) || record.power_diverges()
-            })
+            .filter(|record| record.needs_reconcile(scope))
             .cloned()
             .collect())
     }
@@ -665,28 +566,9 @@ impl EnvironmentStore for InMemoryEnvironmentRegistryStore {
         request: ObserveProvisionedEnvironment,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
         let mut state = self.write_state()?;
-        let record = state
-            .environments
-            .get_mut(&request.environment_id)
-            .ok_or_else(|| not_found("environment", &request.environment_id))?;
-        if request.observed_at_ms < record.incarnation.updated_at_ms {
-            return Ok(record.clone());
-        }
-        if record
-            .incarnation
-            .provider_target_id
-            .as_ref()
-            .is_some_and(|existing| existing != &request.provider_target_id)
-        {
-            return invalid("provider target conflicts with current incarnation");
-        }
-        record.incarnation.provider_target_id = Some(request.provider_target_id);
-        record.incarnation.power_states = request.power_states;
-        record.incarnation.updated_at_ms = request.observed_at_ms;
-        record.updated_at_ms = request.observed_at_ms;
-        record.status = request.status;
-        record.validate()?;
-        Ok(record.clone())
+        update_environment(&mut state, &request.environment_id, |record| {
+            request.apply(record)
+        })
     }
 
     async fn fail_environment_lifecycle(
@@ -694,17 +576,19 @@ impl EnvironmentStore for InMemoryEnvironmentRegistryStore {
         request: FailEnvironmentLifecycle,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
         let mut state = self.write_state()?;
-        let record = state
-            .environments
-            .get_mut(&request.environment_id)
-            .ok_or_else(|| not_found("environment", &request.environment_id))?;
-        record.status = EnvironmentStatus::Failed;
-        record
-            .metadata
-            .insert("lifecycleError".to_owned(), request.message);
-        record.incarnation.updated_at_ms = request.observed_at_ms;
-        record.updated_at_ms = request.observed_at_ms;
-        Ok(record.clone())
+        update_environment(&mut state, &request.environment_id, |record| {
+            request.apply(record)
+        })
+    }
+
+    async fn record_environment_lifecycle_error(
+        &self,
+        request: RecordEnvironmentLifecycleError,
+    ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
+        let mut state = self.write_state()?;
+        update_environment(&mut state, &request.environment_id, |record| {
+            request.apply(record)
+        })
     }
 
     async fn begin_close_environment(
@@ -712,15 +596,13 @@ impl EnvironmentStore for InMemoryEnvironmentRegistryStore {
         request: BeginCloseEnvironment,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
         let mut state = self.write_state()?;
-        let record = state
-            .environments
-            .get_mut(&request.environment_id)
-            .ok_or_else(|| not_found("environment", &request.environment_id))?;
-        if record.status != EnvironmentStatus::Closed {
-            record.status = EnvironmentStatus::Closing;
-            record.updated_at_ms = request.updated_at_ms;
-        }
-        Ok(record.clone())
+        update_environment(&mut state, &request.environment_id, |record| {
+            if record.status != EnvironmentStatus::Closed {
+                record.status = EnvironmentStatus::Closing;
+                record.updated_at_ms = record.updated_at_ms.max(request.updated_at_ms);
+            }
+            Ok(())
+        })
     }
 
     async fn finish_close_environment(
@@ -728,16 +610,15 @@ impl EnvironmentStore for InMemoryEnvironmentRegistryStore {
         request: FinishCloseEnvironment,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
         let mut state = self.write_state()?;
-        let record = state
-            .environments
-            .get_mut(&request.environment_id)
-            .ok_or_else(|| not_found("environment", &request.environment_id))?;
-        record.status = EnvironmentStatus::Closed;
-        record.public_ingress_enabled = false;
-        record.public_endpoint = None;
-        record.incarnation.updated_at_ms = request.observed_at_ms;
-        record.updated_at_ms = request.observed_at_ms;
-        Ok(record.clone())
+        update_environment(&mut state, &request.environment_id, |record| {
+            record.status = EnvironmentStatus::Closed;
+            record.public_ingress_enabled = false;
+            record.public_endpoint = None;
+            record.incarnation.updated_at_ms =
+                record.incarnation.updated_at_ms.max(request.observed_at_ms);
+            record.updated_at_ms = record.updated_at_ms.max(request.observed_at_ms);
+            Ok(())
+        })
     }
 
     async fn set_environment_ingress(
@@ -746,30 +627,27 @@ impl EnvironmentStore for InMemoryEnvironmentRegistryStore {
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
         validate_nonnegative_i64(request.updated_at_ms, "updated_at_ms")?;
         let mut state = self.write_state()?;
-        let record = state
-            .environments
-            .get_mut(&request.environment_id)
-            .ok_or_else(|| not_found("environment", &request.environment_id))?;
-        if !matches!(record.source, EnvironmentSource::Provisioned { .. }) {
-            return invalid("provider-managed ingress requires a provisioned environment");
-        }
-        if matches!(
-            record.status,
-            EnvironmentStatus::Closing | EnvironmentStatus::Closed
-        ) && request.enabled
-        {
-            return invalid("cannot enable ingress for a closing environment");
-        }
-        if request.enabled != request.public_endpoint.is_some() {
-            return invalid(
-                "enabled ingress requires a public endpoint and disabled ingress forbids one",
-            );
-        }
-        record.public_ingress_enabled = request.enabled;
-        record.public_endpoint = request.public_endpoint;
-        record.updated_at_ms = record.updated_at_ms.max(request.updated_at_ms);
-        record.validate()?;
-        Ok(record.clone())
+        update_environment(&mut state, &request.environment_id, |record| {
+            if !matches!(record.source, EnvironmentSource::Provisioned { .. }) {
+                return invalid("provider-managed ingress requires a provisioned environment");
+            }
+            if record.status.is_closing_or_closed() && request.enabled {
+                return invalid("cannot enable ingress for a closing environment");
+            }
+            record.public_ingress_enabled = request.enabled;
+            record.updated_at_ms = record.updated_at_ms.max(request.updated_at_ms);
+            Ok(())
+        })
+    }
+
+    async fn record_environment_ingress(
+        &self,
+        request: RecordEnvironmentIngress,
+    ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
+        let mut state = self.write_state()?;
+        update_environment(&mut state, &request.environment_id, |record| {
+            request.apply(record)
+        })
     }
 
     async fn set_environment_power(
@@ -778,15 +656,12 @@ impl EnvironmentStore for InMemoryEnvironmentRegistryStore {
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
         validate_nonnegative_i64(request.updated_at_ms, "updated_at_ms")?;
         let mut state = self.write_state()?;
-        let record = state
-            .environments
-            .get_mut(&request.environment_id)
-            .ok_or_else(|| not_found("environment", &request.environment_id))?;
-        check_power_mutable(record)?;
-        record.desired_power = request.desired_power;
-        record.updated_at_ms = record.updated_at_ms.max(request.updated_at_ms);
-        record.validate()?;
-        Ok(record.clone())
+        update_environment(&mut state, &request.environment_id, |record| {
+            check_power_mutable(record)?;
+            record.desired_power = request.desired_power;
+            record.updated_at_ms = record.updated_at_ms.max(request.updated_at_ms);
+            Ok(())
+        })
     }
 
     async fn set_environment_idle_policy(
@@ -798,18 +673,34 @@ impl EnvironmentStore for InMemoryEnvironmentRegistryStore {
             policy.validate()?;
         }
         let mut state = self.write_state()?;
-        let record = state
-            .environments
-            .get_mut(&request.environment_id)
-            .ok_or_else(|| not_found("environment", &request.environment_id))?;
-        check_power_mutable(record)?;
-        record.idle_policy = request.idle_policy;
-        record.updated_at_ms = record.updated_at_ms.max(request.updated_at_ms);
-        record.validate()?;
-        Ok(record.clone())
+        update_environment(&mut state, &request.environment_id, |record| {
+            check_power_mutable(record)?;
+            record.idle_policy = request.idle_policy;
+            record.updated_at_ms = record.updated_at_ms.max(request.updated_at_ms);
+            Ok(())
+        })
     }
 }
 
+/// Change one environment through `change` on a copy, validate the result,
+/// and store it only when it is valid: a refused change leaves the stored
+/// record untouched.
+fn update_environment(
+    state: &mut RegistryState,
+    environment_id: &EnvironmentId,
+    change: impl FnOnce(&mut EnvironmentRecord) -> Result<(), EnvironmentRegistryError>,
+) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
+    let stored = state
+        .environments
+        .get_mut(environment_id)
+        .ok_or_else(|| not_found("environment", environment_id))?;
+    let mut candidate = stored.clone();
+    change(&mut candidate)?;
+    candidate.validate()?;
+    *stored = candidate.clone();
+    Ok(candidate)
+}
+
 /// Apply a gateway connection observation to a registered environment.
 /// Closing and closed environments keep their state: a late heartbeat must
 /// not resurrect them.
@@ -822,10 +713,7 @@ pub fn apply_registered_observation(
     if !record.is_registered() {
         return invalid("connection observations apply only to registered environments");
     }
-    if matches!(
-        record.status,
-        EnvironmentStatus::Closing | EnvironmentStatus::Closed
-    ) {
+    if record.status.is_closing_or_closed() {
         return Ok(());
     }
     record.metadata.extend(metadata);
diff --git a/crates/environments/src/tests.rs b/crates/environments/src/tests.rs
index 605df8215..d89568621 100644
--- a/crates/environments/src/tests.rs
+++ b/crates/environments/src/tests.rs
@@ -1,23 +1,45 @@
 use std::collections::BTreeMap;
 
-use environment_protocol::shared::{EnvironmentTransport, ProviderTargetId};
+use environment_protocol::{ids::ProviderTargetId, metadata::MAX_METADATA_ENTRIES};
 use uuid::Uuid;
 
 use super::*;
 
+fn endpoint(value: &str) -> EnvironmentEndpoint {
+    EnvironmentEndpoint::parse(value).expect("endpoint")
+}
+
+fn target(value: &str) -> ProviderTargetId {
+    ProviderTargetId::new(value).expect("target id")
+}
+
 fn provider() -> PutEnvironmentProvider {
     PutEnvironmentProvider {
         provider_id: EnvironmentProviderId::new("incus-local"),
         display_name: Some("Local Incus".to_owned()),
-        controller_connection: EnvironmentConnectionSpec::new(
-            "ws://127.0.0.1:19090/control",
-            EnvironmentTransport::WebSocket,
-        ),
+        controller_endpoint: endpoint("ws://127.0.0.1:19090/control"),
         metadata: BTreeMap::new(),
+        credential: Some(SecretValue::new("provider-secret")),
         updated_at_ms: 1_000,
     }
 }
 
+fn observe(
+    environment_id: &EnvironmentId,
+    target_id: Option<&str>,
+    status: EnvironmentStatus,
+    at: i64,
+) -> ObserveProvisionedEnvironment {
+    ObserveProvisionedEnvironment {
+        environment_id: environment_id.clone(),
+        provider_target_id: target_id.map(target),
+        status,
+        power_states: vec![PowerState::Running, PowerState::Paused],
+        daemon_build: None,
+        observed_at_ms: at,
+    }
+}
+
 fn binding(universe_id: Uuid, expected_revision: Option<u64>) -> PutEnvironmentProviderBinding {
     PutEnvironmentProviderBinding {
         universe_id,
@@ -200,6 +222,7 @@ async fn lightspeed_does_not_enforce_provider_quota() {
         .fail_environment_lifecycle(FailEnvironmentLifecycle {
             environment_id: first.environment_id.clone(),
             message: "provider failed".to_owned(),
+            daemon_build: None,
             observed_at_ms: 3_000,
         })
         .await
@@ -217,15 +240,14 @@ async fn provider_observation_populates_only_the_current_incarnation() {
         .create_environment(create("request-1", "environment-1", "incarnation-1", 2_000))
         .await
         .expect("create");
-    let target_id = ProviderTargetId::new("target-1");
+    let target_id = target("target-1");
     let observed = store
-        .observe_provisioned_environment(ObserveProvisionedEnvironment {
-            environment_id: environment.environment_id.clone(),
-            provider_target_id: target_id.clone(),
-            status: EnvironmentStatus::Ready,
-            power_states: vec![PowerState::Running, PowerState::Paused],
-            observed_at_ms: 3_000,
-        })
+        .observe_provisioned_environment(observe(
+            &environment.environment_id,
+            Some("target-1"),
+            EnvironmentStatus::Ready,
+            3_000,
+        ))
         .await
         .expect("observe");
     assert_eq!(observed.status, EnvironmentStatus::Ready);
@@ -241,37 +263,76 @@ async fn provider_observation_populates_only_the_current_incarnation() {
 }
 
 #[tokio::test(flavor = "current_thread")]
-async fn public_ingress_is_a_realized_environment_facet() {
+async fn public_ingress_intent_and_realized_endpoint_are_recorded_apart() {
     let (_, store) = store().await;
     let environment = store
         .create_environment(create("request-1", "environment-1", "incarnation-1", 2_000))
         .await
         .expect("create");
+    store
+        .observe_provisioned_environment(observe(
+            &environment.environment_id,
+            Some("target-1"),
+            EnvironmentStatus::Ready,
+            2_500,
+        ))
+        .await
+        .expect("observe");
     let enabled = store
         .set_environment_ingress(SetEnvironmentIngress {
             environment_id: environment.environment_id.clone(),
             enabled: true,
-            public_endpoint: Some("https://opaque.env.example".to_owned()),
             updated_at_ms: 3_000,
         })
         .await
         .expect("enable ingress");
     assert!(enabled.public_ingress_enabled);
+    assert_eq!(enabled.public_endpoint, None);
+    // The intent is pending until the provider reports an endpoint.
+    assert!(enabled.ingress_diverges());
+    assert_eq!(
+        store
+            .list_environments_needing_reconcile(ReconcileScope::Converging)
+            .await
+            .unwrap()
+            .len(),
+        1
+    );
+    let realized = store
+        .record_environment_ingress(RecordEnvironmentIngress {
+            environment_id: environment.environment_id.clone(),
+            public_endpoint: Some("https://opaque.env.example".to_owned()),
+            observed_at_ms: 3_500,
+        })
+        .await
+        .expect("record realized ingress");
     assert_eq!(
-        enabled.public_endpoint.as_deref(),
+        realized.public_endpoint.as_deref(),
         Some("https://opaque.env.example")
     );
+    assert!(!realized.ingress_diverges());
     let disabled = store
         .set_environment_ingress(SetEnvironmentIngress {
-            environment_id: environment.environment_id,
+            environment_id: environment.environment_id.clone(),
             enabled: false,
-            public_endpoint: None,
             updated_at_ms: 4_000,
         })
         .await
         .expect("disable ingress");
     assert!(!disabled.public_ingress_enabled);
-    assert_eq!(disabled.public_endpoint, None);
+    // The endpoint stays recorded until the provider removed it.
+    assert!(disabled.public_endpoint.is_some());
+    assert!(disabled.ingress_diverges());
+    let removed = store
+        .record_environment_ingress(RecordEnvironmentIngress {
+            environment_id: environment.environment_id,
+            public_endpoint: None,
+            observed_at_ms: 4_500,
+        })
+        .await
+        .expect("record removed ingress");
+    assert_eq!(removed.public_endpoint, None);
+    assert!(!removed.ingress_diverges());
 }
 
 #[tokio::test(flavor = "current_thread")]
@@ -282,10 +343,7 @@ async fn external_environment_cannot_enable_provider_managed_ingress() {
             request_id: EnvironmentProvisionRequestId::new("external-request"),
             environment_id: EnvironmentId::new("external-environment"),
             incarnation_id: EnvironmentIncarnationId::new("external-incarnation"),
-            connection: EnvironmentConnectionSpec::new(
-                "ws://envd.example",
-                EnvironmentTransport::WebSocket,
-            ),
+            endpoint: endpoint("ws://envd.example"),
             display_name: None,
             metadata: BTreeMap::new(),
             created_at_ms: 1_000,
@@ -297,7 +355,6 @@ async fn external_environment_cannot_enable_provider_managed_ingress() {
             .set_environment_ingress(SetEnvironmentIngress {
                 environment_id: environment.environment_id,
                 enabled: true,
-                public_endpoint: Some("https://invalid.example".to_owned()),
                 updated_at_ms: 2_000,
             })
             .await,
@@ -306,27 +363,24 @@ async fn external_environment_cannot_enable_provider_managed_ingress() {
 }
 
 #[tokio::test(flavor = "current_thread")]
-async fn external_environment_persists_a_typed_connection() {
+async fn external_environment_persists_its_endpoint() {
     let store = InMemoryEnvironmentRegistryStore::new();
     let environment = store
         .create_external_environment(CreateExternalEnvironment {
             request_id: EnvironmentProvisionRequestId::new("external-request"),
             environment_id: EnvironmentId::new("external-environment"),
             incarnation_id: EnvironmentIncarnationId::new("external-incarnation"),
-            connection: EnvironmentConnectionSpec::new(
-                "ws://envd.example:19091",
-                EnvironmentTransport::WebSocket,
-            ),
+            endpoint: endpoint("unix:///run/lightspeed/envd.sock"),
             display_name: None,
             metadata: BTreeMap::new(),
             created_at_ms: 1_000,
         })
         .await
         .expect("create external environment");
-    let EnvironmentSource::External { connection } = environment.source else {
+    let EnvironmentSource::External { endpoint } = environment.source else {
         panic!("external source")
     };
-    assert_eq!(connection.endpoint, "ws://envd.example:19091");
+    assert_eq!(endpoint.as_str(), "unix:///run/lightspeed/envd.sock");
 }
 
 #[tokio::test(flavor = "current_thread")]
@@ -450,23 +504,31 @@ async fn power_intent_and_idle_policy_are_provisioned_only_and_drive_reconcile_l
     assert!(environment.idle_policy.is_none());
 
     store
-        .observe_provisioned_environment(ObserveProvisionedEnvironment {
-            environment_id: environment.environment_id.clone(),
-            provider_target_id: ProviderTargetId::new("target-1"),
-            status: EnvironmentStatus::Ready,
-            power_states: vec![PowerState::Running, PowerState::Paused],
-            observed_at_ms: 3_000,
-        })
+        .observe_provisioned_environment(observe(
+            &environment.environment_id,
+            Some("target-1"),
+            EnvironmentStatus::Ready,
+            3_000,
+        ))
         .await
         .expect("observe");
-    // Ready and converged: nothing to reconcile.
+    // Ready and converged: nothing to reconcile, but a steady pass still
+    // observes the target.
     assert!(
         store
-            .list_environments_needing_reconcile()
+            .list_environments_needing_reconcile(ReconcileScope::Converging)
             .await
             .unwrap()
             .is_empty()
     );
+    assert_eq!(
+        store
+            .list_environments_needing_reconcile(ReconcileScope::WithSteady)
+            .await
+            .unwrap()
+            .len(),
+        1
+    );
     let paused = store
         .set_environment_power(SetEnvironmentPower {
             environment_id: environment.environment_id.clone(),
@@ -477,23 +539,25 @@ async fn power_intent_and_idle_policy_are_provisioned_only_and_drive_reconcile_l
         .expect("set power");
     assert_eq!(paused.desired_power, PowerState::Paused);
     assert!(paused.power_diverges());
-    let pending = store.list_environments_needing_reconcile().await.unwrap();
+    let pending = store
+        .list_environments_needing_reconcile(ReconcileScope::Converging)
+        .await
+        .unwrap();
     assert_eq!(pending.len(), 1);
 
     // Observed paused: converged again.
     store
-        .observe_provisioned_environment(ObserveProvisionedEnvironment {
-            environment_id: environment.environment_id.clone(),
-            provider_target_id: ProviderTargetId::new("target-1"),
-            status: EnvironmentStatus::Paused,
-            power_states: vec![PowerState::Running, PowerState::Paused],
-            observed_at_ms: 5_000,
-        })
+        .observe_provisioned_environment(observe(
+            &environment.environment_id,
+            Some("target-1"),
+            EnvironmentStatus::Paused,
+            5_000,
+        ))
         .await
         .expect("observe paused");
     assert!(
         store
-            .list_environments_needing_reconcile()
+            .list_environments_needing_reconcile(ReconcileScope::Converging)
             .await
             .unwrap()
             .is_empty()
@@ -520,13 +584,12 @@ async fn power_intent_and_idle_policy_are_provisioned_only_and_drive_reconcile_l
             .is_empty()
     );
     store
-        .observe_provisioned_environment(ObserveProvisionedEnvironment {
-            environment_id: environment.environment_id.clone(),
-            provider_target_id: ProviderTargetId::new("target-1"),
-            status: EnvironmentStatus::Ready,
-            power_states: vec![PowerState::Running, PowerState::Paused],
-            observed_at_ms: 7_000,
-        })
+        .observe_provisioned_environment(observe(
+            &environment.environment_id,
+            Some("target-1"),
+            EnvironmentStatus::Ready,
+            7_000,
+        ))
         .await
         .expect("observe ready");
     let candidates = store.list_environments_with_idle_policy().await.unwrap();
@@ -539,10 +602,7 @@ async fn power_intent_and_idle_policy_are_provisioned_only_and_drive_reconcile_l
             request_id: EnvironmentProvisionRequestId::new("external-1"),
             environment_id: EnvironmentId::new("external-env"),
             incarnation_id: EnvironmentIncarnationId::new("external-inc"),
-            connection: EnvironmentConnectionSpec::new(
-                "ws://envd.test:9000",
-                environment_protocol::shared::EnvironmentTransport::WebSocket,
-            ),
+            endpoint: endpoint("ws://envd.test:9000"),
             display_name: None,
             metadata: BTreeMap::new(),
             created_at_ms: 8_000,
@@ -752,7 +812,7 @@ async fn registered_admission_is_keyed_by_daemon_identity() {
             environment_id: created.environment_id.clone(),
             observation: RegisteredConnectionObservation::Connected,
             observed_at_ms: 4_000,
-            metadata: RegisteredDaemonBuild {
+            metadata: DaemonBuild {
                 version: Some("0.2.0".to_owned()),
                 git_sha: Some("bbbb".to_owned()),
                 protocol_version: 3,
@@ -994,8 +1054,6 @@ async fn registered_environments_list_by_key() {
 /// itself stays enforced on the caller's keys.
 #[tokio::test(flavor = "current_thread")]
 async fn reserved_metadata_sits_on_top_of_the_caller_allowance() {
-    use environment_protocol::registration::MAX_METADATA_ENTRIES;
-
     let (_universe_id, store) = store().await;
     minted_key(
         &store,
@@ -1003,7 +1061,7 @@ async fn reserved_metadata_sits_on_top_of_the_caller_allowance() {
         registration_policy(RegisteredIdentityMode::Persistent),
     )
     .await;
-    let reserved = RegisteredDaemonBuild {
+    let reserved = DaemonBuild {
         version: Some("0.1.0".to_owned()),
         git_sha: Some("a".repeat(40)),
         protocol_version: 2,
@@ -1011,7 +1069,7 @@ async fn reserved_metadata_sits_on_top_of_the_caller_allowance() {
     .metadata();
 
     let mut full = register("rk-meta", "env-meta", &daemon_key(0x31), 1_000);
-    full.metadata = (0..MAX_METADATA_ENTRIES)
+    full.metadata = (0..MAX_METADATA_ENTRIES as usize)
         .map(|index| (format!("caller.key{index}"), "v".to_owned()))
         .collect();
     full.metadata.extend(reserved.clone());
@@ -1021,11 +1079,11 @@ async fn reserved_metadata_sits_on_top_of_the_caller_allowance() {
         .expect("full caller allowance plus reserved entries");
     assert_eq!(
         created.metadata.len(),
-        MAX_METADATA_ENTRIES + reserved.len()
+        MAX_METADATA_ENTRIES as usize + reserved.len()
     );
 
     let mut over = register("rk-meta", "env-over", &daemon_key(0x32), 1_000);
-    over.metadata = (0..=MAX_METADATA_ENTRIES)
+    over.metadata = (0..=MAX_METADATA_ENTRIES as usize)
         .map(|index| (format!("caller.key{index}"), "v".to_owned()))
         .collect();
     assert!(matches!(
@@ -1033,3 +1091,278 @@ async fn reserved_metadata_sits_on_top_of_the_caller_allowance() {
         Err(EnvironmentRegistryError::InvalidInput { .. })
     ));
 }
+
+#[tokio::test(flavor = "current_thread")]
+async fn provider_credentials_are_required_once_and_kept_across_puts() {
+    let store = InMemoryEnvironmentRegistryStore::new();
+    let provider_id = EnvironmentProviderId::new("incus-local");
+    let mut without = provider();
+    without.credential = None;
+    assert!(matches!(
+        store.put_provider(without.clone()).await,
+        Err(EnvironmentRegistryError::InvalidInput { .. })
+    ));
+    let mut unprintable = provider();
+    unprintable.credential = Some(SecretValue::new("two words"));
+    assert!(matches!(
+        store.put_provider(unprintable).await,
+        Err(EnvironmentRegistryError::InvalidInput { .. })
+    ));
+
+    store.put_provider(provider()).await.expect("create");
+    without.updated_at_ms = 2_000;
+    let replaced = store.put_provider(without).await.expect("replace");
+    assert_eq!(replaced.created_at_ms, 1_000);
+    assert_eq!(
+        store
+            .read_provider_credential(&provider_id)
+            .await
+            .expect("credential")
+            .expose(),
+        "provider-secret"
+    );
+    let debug = format!("{:?}", provider());
+    assert!(!debug.contains("provider-secret"));
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn controller_facts_follow_the_registered_endpoint() {
+    let store = InMemoryEnvironmentRegistryStore::new();
+    let provider_id = EnvironmentProviderId::new("incus-local");
+    let created = store.put_provider(provider()).await.expect("create");
+    assert_eq!(created.controller_features, None);
+    assert_eq!(created.data_route_base, None);
+
+    let base = DataRouteBase::new("ws://127.0.0.1:19090/data").expect("base");
+    let features = ControllerFeatures {
+        adopt_target: true,
+        ingress: false,
+    };
+    let recorded = store
+        .record_provider_controller(RecordProviderController {
+            provider_id: provider_id.clone(),
+            controller_endpoint: created.controller_endpoint.clone(),
+            features,
+            data_route_base: base.clone(),
+        })
+        .await
+        .expect("record");
+    assert_eq!(recorded.controller_features, Some(features));
+    assert_eq!(recorded.data_route_base, Some(base.clone()));
+
+    // A put that keeps the endpoint keeps the facts.
+    let mut same = provider();
+    same.credential = None;
+    same.display_name = Some("Renamed".to_owned());
+    let kept = store.put_provider(same).await.expect("rename");
+    assert_eq!(kept.data_route_base, Some(base.clone()));
+
+    // A new endpoint clears them, and an initialize that raced the change
+    // cannot write facts of the old endpoint back.
+    let mut moved = provider();
+    moved.credential = None;
+    moved.controller_endpoint = endpoint("wss://incus.example.com/control");
+    let moved = store.put_provider(moved).await.expect("move");
+    assert_eq!(moved.controller_features, None);
+    assert_eq!(moved.data_route_base, None);
+    let stale = store
+        .record_provider_controller(RecordProviderController {
+            provider_id,
+            controller_endpoint: created.controller_endpoint,
+            features,
+            data_route_base: base,
+        })
+        .await
+        .expect("stale record");
+    assert_eq!(stale.data_route_base, None);
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn a_racing_observation_never_overwrites_a_close() {
+    let (_, store) = store().await;
+    let environment = store
+        .create_environment(create("request-1", "environment-1", "incarnation-1", 2_000))
+        .await
+        .expect("create");
+    store
+        .begin_close_environment(BeginCloseEnvironment {
+            environment_id: environment.environment_id.clone(),
+            updated_at_ms: 2_500,
+        })
+        .await
+        .expect("begin close");
+
+    // The create that was in flight when the close arrived answers: the
+    // target id is still recorded so the close can address it, but the
+    // status stays closing.
+    let observed = store
+        .observe_provisioned_environment(observe(
+            &environment.environment_id,
+            Some("ls-3f2a"),
+            EnvironmentStatus::Ready,
+            3_000,
+        ))
+        .await
+        .expect("observe");
+    assert_eq!(observed.status, EnvironmentStatus::Closing);
+    assert_eq!(
+        observed.incarnation.provider_target_id,
+        Some(target("ls-3f2a"))
+    );
+
+    let failed = store
+        .fail_environment_lifecycle(FailEnvironmentLifecycle {
+            environment_id: environment.environment_id.clone(),
+            message: "power change failed".to_owned(),
+            daemon_build: None,
+            observed_at_ms: 3_500,
+        })
+        .await
+        .expect("fail");
+    assert_eq!(failed.status, EnvironmentStatus::Closing);
+    assert_eq!(failed.lifecycle_error, None);
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn observations_without_a_target_id_keep_the_recorded_one() {
+    let (_, store) = store().await;
+    let environment = store
+        .create_environment(create("request-1", "environment-1", "incarnation-1", 2_000))
+        .await
+        .expect("create");
+    let pending = store
+        .observe_provisioned_environment(observe(
+            &environment.environment_id,
+            None,
+            EnvironmentStatus::Provisioning,
+            2_500,
+        ))
+        .await
+        .expect("no id yet");
+    assert_eq!(pending.incarnation.provider_target_id, None);
+    // Natural provider ids are opaque: slashes and colons are fine.
+    let natural = "arn:aws:ec2:eu-west-1:123456789012:instance/i-0abc";
+    store
+        .observe_provisioned_environment(observe(
+            &environment.environment_id,
+            Some(natural),
+            EnvironmentStatus::Booting,
+            3_000,
+        ))
+        .await
+        .expect("id assigned");
+    let kept = store
+        .observe_provisioned_environment(observe(
+            &environment.environment_id,
+            None,
+            EnvironmentStatus::Booting,
+            3_500,
+        ))
+        .await
+        .expect("id kept");
+    assert_eq!(kept.incarnation.provider_target_id, Some(target(natural)));
+    assert!(matches!(
+        store
+            .observe_provisioned_environment(observe(
+                &environment.environment_id,
+                Some("another-target"),
+                EnvironmentStatus::Ready,
+                4_000,
+            ))
+            .await,
+        Err(EnvironmentRegistryError::InvalidInput { .. })
+    ));
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn lifecycle_errors_accumulate_until_a_steady_observation() {
+    let (_, store) = store().await;
+    let environment = store
+        .create_environment(create("request-1", "environment-1", "incarnation-1", 2_000))
+        .await
+        .expect("create");
+    let first = store
+        .record_environment_lifecycle_error(RecordEnvironmentLifecycleError {
+            environment_id: environment.environment_id.clone(),
+            message: "controller unavailable".to_owned(),
+            observed_at_ms: 3_000,
+        })
+        .await
+        .expect("first error");
+    assert_eq!(first.status, EnvironmentStatus::Provisioning);
+    let second = store
+        .record_environment_lifecycle_error(RecordEnvironmentLifecycleError {
+            environment_id: environment.environment_id.clone(),
+            message: format!("connect failed\u{7}{}", "x".repeat(2_000)),
+            observed_at_ms: 4_000,
+        })
+        .await
+        .expect("second error");
+    let error = second.lifecycle_error.expect("recorded");
+    assert_eq!(error.first_at_ms, 3_000);
+    assert_eq!(error.last_at_ms, 4_000);
+    assert!(error.message.len() <= 1024);
+    assert!(!error.message.contains('\u{7}'));
+
+    let ready = store
+        .observe_provisioned_environment(ObserveProvisionedEnvironment {
+            daemon_build: Some(DaemonBuild {
+                version: Some("0.5.0".to_owned()),
+                git_sha: None,
+                protocol_version: 3,
+            }),
+            ..observe(
+                &environment.environment_id,
+                Some("target-1"),
+                EnvironmentStatus::Ready,
+                5_000,
+            )
+        })
+        .await
+        .expect("ready");
+    assert_eq!(ready.lifecycle_error, None);
+    assert_eq!(
+        ready
+            .metadata
+            .get(ENVD_PROTOCOL_VERSION_METADATA_KEY)
+            .map(String::as_str),
+        Some("3")
+    );
+}
+
+/// A change whose result fails validation must leave the stored record as
+/// it was, so a bad value can never become durable.
+#[tokio::test(flavor = "current_thread")]
+async fn refused_changes_leave_the_stored_record_untouched() {
+    let (_universe_id, store) = store().await;
+    minted_key(
+        &store,
+        "rk-poison",
+        registration_policy(RegisteredIdentityMode::Persistent),
+    )
+    .await;
+    let created = store
+        .create_registered_environment(register("rk-poison", "env-p", &daemon_key(0x41), 1_000))
+        .await
+        .expect("register");
+    let refused = store
+        .observe_registered_environment(ObserveRegisteredEnvironment {
+            environment_id: created.environment_id.clone(),
+            observation: RegisteredConnectionObservation::Connected,
+            observed_at_ms: 2_000,
+            metadata: BTreeMap::from([(
+                ENVD_VERSION_METADATA_KEY.to_owned(),
+                "bad\u{0}version".to_owned(),
+            )]),
+        })
+        .await;
+    assert!(matches!(
+        refused,
+        Err(EnvironmentRegistryError::InvalidInput { .. })
+    ));
+    let stored = store
+        .read_environment(&created.environment_id)
+        .await
+        .expect("still readable");
+    assert_eq!(stored, created);
+}
diff --git a/crates/harness/src/storage/blobs.rs b/crates/harness/src/storage/blobs.rs
index 25f9fdd2f..580488ed3 100644
--- a/crates/harness/src/storage/blobs.rs
+++ b/crates/harness/src/storage/blobs.rs
@@ -126,19 +126,26 @@ pub trait BlobSource: Send {
     async fn read_chunk(&mut self, max_bytes: usize) -> Result<Vec<u8>, BlobStoreError>;
 }
 
+/// Largest range one [`BlobStore::read_blob_range`] call may request; stores
+/// refuse larger ranges, so callers moving bigger chunks read several ranges.
+pub const MAX_BLOB_RANGE_BYTES: usize = 1024 * 1024;
+
 #[async_trait]
 pub trait BlobStore: Send + Sync {
     async fn put_bytes(&self, bytes: Vec<u8>) -> Result<BlobRef, BlobStoreError>;
 
-    /// Bounded range access for transfer. Ranges are verified by the receiving whole-file
-    /// hasher. The fallback deliberately rejects large blobs instead of buffering them.
+    /// Bounded range access for transfer, at most [`MAX_BLOB_RANGE_BYTES`] per call. Ranges
+    /// are verified by the receiving whole-file hasher. The fallback deliberately rejects
+    /// large blobs instead of buffering them.
     async fn read_blob_range(
         &self,
         blob_ref: &BlobRef,
         offset: u64,
         max_bytes: usize,
     ) -> Result<Vec<u8>, BlobStoreError> {
-        if max_bytes > 1024 * 1024 || self.stat_blob(blob_ref).await?.byte_len > 8 * 1024 * 1024 {
+        if max_bytes > MAX_BLOB_RANGE_BYTES
+            || self.stat_blob(blob_ref).await?.byte_len > 8 * 1024 * 1024
+        {
             return Err(BlobStoreError::Store {
                 message: "streaming blob reads unsupported by this store".into(),
             });
diff --git a/crates/harness/src/storage/mod.rs b/crates/harness/src/storage/mod.rs
index 983605a77..486021833 100644
--- a/crates/harness/src/storage/mod.rs
+++ b/crates/harness/src/storage/mod.rs
@@ -14,7 +14,8 @@ pub use crate::session::{
 pub use blobs::{
     BlobCacheLimits, BlobCacheStats, BlobEdge, BlobGraphStore, BlobInfo, BlobSource, BlobStore,
     BlobStoreError, CachedBlobStore, ENGINE_BLOB_CONTENTS, InMemoryBlobCache, InMemoryBlobStore,
-    collect_blob_refs, ensure_harness_blobs, harness_blob_refs, record_contains_edges,
+    MAX_BLOB_RANGE_BYTES, collect_blob_refs, ensure_harness_blobs, harness_blob_refs,
+    record_contains_edges,
 };
 pub use session::{
     AdvanceSessionCheckpoint, AppendSessionEvents, AppendSessionEventsResult, CreateClonedSession,
diff --git a/crates/llm-runtime/tests/fixtures/builtin_catalogs.json b/crates/llm-runtime/tests/fixtures/builtin_catalogs.json
index fdb51e733..65234b66b 100644
--- a/crates/llm-runtime/tests/fixtures/builtin_catalogs.json
+++ b/crates/llm-runtime/tests/fixtures/builtin_catalogs.json
@@ -3304,7 +3304,7 @@
                       "type": "object"
                     },
                     "job_id": {
-                      "description": "Your name for the job (for example \"build\"). It keys the job's promise in the result and identifies the job to job_read.",
+                      "description": "Your name for this run of the job (for example \"build\"). It keys the job's promise in the result and identifies the job to job_read. An id names one run: to run a command again, choose a new id.",
                       "pattern": "^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$",
                       "type": "string"
                     },
@@ -6672,7 +6672,7 @@
                       "type": "object"
                     },
                     "job_id": {
-                      "description": "Your name for the job (for example \"build\"). It keys the job's promise in the result and identifies the job to job_read.",
+                      "description": "Your name for this run of the job (for example \"build\"). It keys the job's promise in the result and identifies the job to job_read. An id names one run: to run a command again, choose a new id.",
                       "pattern": "^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$",
                       "type": "string"
                     },
@@ -10112,7 +10112,7 @@
                         "type": "object"
                       },
                       "job_id": {
-                        "description": "Your name for the job (for example \"build\"). It keys the job's promise in the result and identifies the job to job_read.",
+                        "description": "Your name for this run of the job (for example \"build\"). It keys the job's promise in the result and identifies the job to job_read. An id names one run: to run a command again, choose a new id.",
                         "pattern": "^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$",
                         "type": "string"
                       },
diff --git a/crates/profiles/src/lib.rs b/crates/profiles/src/lib.rs
index 0b88113b7..9e9c9f8ea 100644
--- a/crates/profiles/src/lib.rs
+++ b/crates/profiles/src/lib.rs
@@ -161,10 +161,11 @@ impl ProfileSourceExt for ProfileSource {
 }
 
 pub fn validate_profile_document(document: &ProfileDocument) -> Result<(), ProfileError> {
-    environment_protocol::registration::validate_registration_metadata(None, &document.metadata)
-        .map_err(|message| ProfileError::InvalidInput {
-            message: format!("invalid metadata: {message}"),
-        })?;
+    environment_protocol::metadata::validate_caller_metadata(&document.metadata).map_err(
+        |error| ProfileError::InvalidInput {
+            message: format!("invalid metadata: {error}"),
+        },
+    )?;
     if let Some(value) = document
         .retention
         .as_ref()
diff --git a/crates/store-fs/src/blob.rs b/crates/store-fs/src/blob.rs
index 0023d17f7..a1c91a93f 100644
--- a/crates/store-fs/src/blob.rs
+++ b/crates/store-fs/src/blob.rs
@@ -93,7 +93,7 @@ impl BlobStore for FsBlobStore {
         max_bytes: usize,
     ) -> Result<Vec<u8>, BlobStoreError> {
         use tokio::io::{AsyncReadExt, AsyncSeekExt};
-        if max_bytes > 1024 * 1024 {
+        if max_bytes > harness::storage::MAX_BLOB_RANGE_BYTES {
             return Err(BlobStoreError::Store {
                 message: "blob range limit exceeded".into(),
             });
diff --git a/crates/store-pg/migrations/012_environment_endpoints.sql b/crates/store-pg/migrations/012_environment_endpoints.sql
new file mode 100644
index 000000000..1b39a1663
--- /dev/null
+++ b/crates/store-pg/migrations/012_environment_endpoints.sql
@@ -0,0 +1,138 @@
+-- Environment protocol v3 storage.
+--
+-- Design notes:
+-- - Providers and external environments are reached at one validated
+--   endpoint URL (ws://, wss:// or unix://) whose scheme selects the dialer;
+--   the transport JSON documents are gone.
+-- - The provider credential is the bearer token Lightspeed presents on the
+--   controller and data routes. It is sealed with AES-256-GCM by the store
+--   adapter, exactly like auth_secrets, and never stored in plaintext.
+-- - controller_adopt_target, controller_ingress and data_route_base are what
+--   the controller advertised at its last successful initialize: all three
+--   or none.
+-- - lifecycle_error records why an environment failed, or the latest error
+--   its lifecycle is retrying past, instead of a caller metadata entry.
+-- - Provider target ids follow the protocol's opaque rule.
+-- - public_ingress_enabled is the ingress intent and public_endpoint what
+--   the provider last reported realized; the reconciler converges the
+--   endpoint toward the intent, so either may lead the other for a while.
+--
+-- Rows written in the earlier shape are not converted: purge providers and
+-- external environments before migrating a database that has them.
+
+ALTER TABLE environment_providers
+    DROP CONSTRAINT environment_providers_json_objects;
+
+ALTER TABLE environment_providers
+    DROP COLUMN controller_connection_json,
+    ADD COLUMN controller_endpoint text NOT NULL,
+    ADD COLUMN credential_key_id text NOT NULL,
+    ADD COLUMN credential_nonce bytea NOT NULL,
+    ADD COLUMN credential_ciphertext bytea NOT NULL,
+    ADD COLUMN controller_adopt_target boolean,
+    ADD COLUMN controller_ingress boolean,
+    ADD COLUMN data_route_base text,
+    ADD CONSTRAINT environment_providers_metadata_object
+        CHECK (jsonb_typeof(metadata_json) = 'object'),
+    ADD CONSTRAINT environment_providers_controller_endpoint_format CHECK (
+        controller_endpoint ~ '^(wss?|unix)://[^[:space:][:cntrl:]]+$'
+        AND octet_length(controller_endpoint) <= 2048
+    ),
+    ADD CONSTRAINT environment_providers_credential_sealed CHECK (
+        credential_key_id <> '' AND octet_length(credential_nonce) = 12
+    ),
+    ADD CONSTRAINT environment_providers_controller_facts CHECK (
+        (controller_adopt_target IS NULL) = (controller_ingress IS NULL)
+        AND (controller_ingress IS NULL) = (data_route_base IS NULL)
+    ),
+    ADD CONSTRAINT environment_providers_data_route_base_format CHECK (
+        data_route_base IS NULL
+        OR (data_route_base ~ '^wss?://' AND octet_length(data_route_base) <= 2048)
+    );
+
+ALTER TABLE environments
+    DROP CONSTRAINT environments_source_fields,
+    DROP CONSTRAINT environments_public_ingress_fields;
+
+ALTER TABLE environments
+    DROP COLUMN daemon_connection_json,
+    ADD COLUMN daemon_endpoint text,
+    ADD COLUMN lifecycle_error text,
+    ADD COLUMN lifecycle_error_first_at_ms bigint,
+    ADD COLUMN lifecycle_error_last_at_ms bigint,
+    ADD CONSTRAINT environments_source_fields CHECK (
+        (
+            source_kind = 'provisioned'
+            AND provider_id IS NOT NULL AND binding_id IS NOT NULL
+            AND daemon_endpoint IS NULL
+            AND registration_key_id IS NULL AND daemon_id IS NULL
+            AND daemon_public_key IS NULL AND identity_mode IS NULL
+            AND last_seen_at_ms IS NULL
+        )
+        OR (
+            source_kind = 'external'
+            AND provider_id IS NULL AND binding_id IS NULL
+            AND daemon_endpoint ~ '^(wss?|unix)://[^[:space:][:cntrl:]]+$'
+            AND octet_length(daemon_endpoint) <= 2048
+            AND registration_key_id IS NULL AND daemon_id IS NULL
+            AND daemon_public_key IS NULL AND identity_mode IS NULL
+            AND last_seen_at_ms IS NULL
+        )
+        OR (
+            source_kind = 'registered'
+            AND provider_id IS NULL AND binding_id IS NULL
+            AND daemon_endpoint IS NULL
+            AND registration_key_id IS NOT NULL
+            AND daemon_id ~ '^daemon_[0-9a-f]{64}$'
+            AND daemon_public_key ~ '^[0-9a-f]{64}$'
+            AND identity_mode IN ('persistent', 'ephemeral')
+            AND (last_seen_at_ms IS NULL OR last_seen_at_ms >= 0)
+        )
+    ),
+    ADD CONSTRAINT environments_public_ingress_fields CHECK (
+        (NOT public_ingress_enabled AND public_endpoint IS NULL)
+        OR (
+            source_kind = 'provisioned'
+            AND (public_endpoint IS NULL OR public_endpoint <> '')
+        )
+    ),
+    ADD CONSTRAINT environments_lifecycle_error_fields CHECK (
+        (
+            lifecycle_error IS NULL
+            AND lifecycle_error_first_at_ms IS NULL
+            AND lifecycle_error_last_at_ms IS NULL
+        )
+        OR (
+            octet_length(lifecycle_error) BETWEEN 1 AND 1024
+            AND lifecycle_error_first_at_ms >= 0
+            AND lifecycle_error_last_at_ms >= lifecycle_error_first_at_ms
+        )
+    );
+
+ALTER TABLE environment_incarnations
+    ADD CONSTRAINT environment_incarnations_provider_target_id_opaque CHECK (
+        provider_target_id IS NULL
+        OR (
+            octet_length(provider_target_id) BETWEEN 1 AND 255
+            AND provider_target_id !~ '[[:cntrl:]]'
+        )
+    );
+
+COMMENT ON TABLE environment_providers IS
+    'Operator-registered provider identity, controller endpoint and sealed credential, plus the controller facts observed at its last initialize.';
+COMMENT ON COLUMN environment_providers.controller_endpoint IS
+    'Validated ws://, wss:// or unix:// URL of the provider controller; the scheme selects the dialer.';
+COMMENT ON COLUMN environment_providers.credential_ciphertext IS
+    'AES-256-GCM sealed bearer credential for the controller and data routes; AAD binds it to the provider id.';
+COMMENT ON COLUMN environment_providers.data_route_base IS
+    'Data route base (routes.data) the controller advertised at its last successful initialize; target data routes are built from it.';
+COMMENT ON TABLE environments IS
+    'Universe-owned logical environments. External environments store a Lightspeed-reachable envd endpoint URL; provisioned environments retain provider routing linkage.';
+COMMENT ON COLUMN environments.public_ingress_enabled IS
+    'Lightspeed-owned public ingress intent; the lifecycle reconciler converges the provider target toward it.';
+COMMENT ON COLUMN environments.public_endpoint IS
+    'Public endpoint the provider last reported realized; may lag public_ingress_enabled while the reconciler converges.';
+COMMENT ON COLUMN environments.lifecycle_error IS
+    'Why the environment failed, or the latest lifecycle error being retried; first/last instants bound the current run of errors.';
+COMMENT ON COLUMN environment_incarnations.provider_target_id IS
+    'Opaque provider-scoped target handle (1-255 bytes, no control characters); interpreted with the environment provider identity.';
diff --git a/crates/store-pg/src/auth.rs b/crates/store-pg/src/auth.rs
index f97f23b03..7462f4205 100644
--- a/crates/store-pg/src/auth.rs
+++ b/crates/store-pg/src/auth.rs
@@ -21,11 +21,11 @@ use sqlx::Row;
 
 use crate::PgStore;
 
-const LOCAL_KEY_ID: &str = "local-v1";
+pub(crate) const LOCAL_KEY_ID: &str = "local-v1";
 const NONCE_LEN: usize = 12;
 
 impl PgStore {
-    fn secrets_cipher(&self) -> Result<(Aes256Gcm, &'static str), AuthRegistryError> {
+    pub(crate) fn secrets_cipher(&self) -> Result<(Aes256Gcm, &'static str), AuthRegistryError> {
         let Some(key) = &self.config.secrets_master_key else {
             return Err(AuthRegistryError::Store {
                 message: "secrets master key is not configured; set LIGHTSPEED_SECRETS_MASTER_KEY"
@@ -49,7 +49,7 @@ impl PgStore {
     }
 }
 
-fn seal_secret(
+pub(crate) fn seal_secret(
     cipher: &Aes256Gcm,
     aad: &[u8],
     value: &SecretValue,
@@ -72,7 +72,7 @@ fn seal_secret(
     Ok((nonce.to_vec(), ciphertext))
 }
 
-fn open_secret(
+pub(crate) fn open_secret(
     cipher: &Aes256Gcm,
     aad: &[u8],
     nonce: &[u8],
diff --git a/crates/store-pg/src/blob.rs b/crates/store-pg/src/blob.rs
index 6b2863b53..1d62008c0 100644
--- a/crates/store-pg/src/blob.rs
+++ b/crates/store-pg/src/blob.rs
@@ -214,7 +214,7 @@ impl BlobStore for PgStore {
         max_bytes: usize,
     ) -> Result<Vec<u8>, BlobStoreError> {
         use object_store::ObjectStoreExt;
-        if max_bytes > 1024 * 1024 {
+        if max_bytes > harness::storage::MAX_BLOB_RANGE_BYTES {
             return Err(BlobStoreError::Store {
                 message: "blob range limit exceeded".into(),
             });
diff --git a/crates/store-pg/src/environment.rs b/crates/store-pg/src/environment.rs
index 61d20da40..8f60050a8 100644
--- a/crates/store-pg/src/environment.rs
+++ b/crates/store-pg/src/environment.rs
@@ -1,12 +1,13 @@
 // Formatted SQL uses internal schema fragments; request values use bind parameters.
 use async_trait::async_trait;
-use auth::{AuthGrantId, AuthProviderId, SecretId};
-use environment_protocol::shared::ProviderTargetId;
+use auth::{AuthGrantId, AuthProviderId, SecretId, SecretValue};
+use environment_protocol::{ids::ProviderTargetId, routes::DataRouteBase};
 use environments::{
-    AdoptEnvironment, BeginCloseEnvironment, CreateEnvironment, CreateExternalEnvironment,
-    CreateRegisteredEnvironment, EnvironmentCredentialRecord, EnvironmentCredentialSource,
-    EnvironmentCredentialStore, EnvironmentDaemonId, EnvironmentId, EnvironmentIncarnationId,
-    EnvironmentIncarnationRecord, EnvironmentProviderBindingId, EnvironmentProviderBindingRecord,
+    AdoptEnvironment, BeginCloseEnvironment, ControllerFeatures, CreateEnvironment,
+    CreateExternalEnvironment, CreateRegisteredEnvironment, EnvironmentCredentialRecord,
+    EnvironmentCredentialSource, EnvironmentCredentialStore, EnvironmentDaemonId,
+    EnvironmentEndpoint, EnvironmentId, EnvironmentIncarnationId, EnvironmentIncarnationRecord,
+    EnvironmentLifecycleError, EnvironmentProviderBindingId, EnvironmentProviderBindingRecord,
     EnvironmentProviderBindingStatus, EnvironmentProviderBindingStore, EnvironmentProviderId,
     EnvironmentProviderRecord, EnvironmentProviderStore, EnvironmentProvisionRequestId,
     EnvironmentRecord, EnvironmentRegistrationKeyId, EnvironmentRegistryError, EnvironmentSource,
@@ -14,16 +15,22 @@ use environments::{
     FinishCloseEnvironment, ListEnvironmentCredentials, ListEnvironmentProviders, ListEnvironments,
     ObserveProvisionedEnvironment, ObserveRegisteredEnvironment, PowerState,
     PutEnvironmentCredential, PutEnvironmentProvider, PutEnvironmentProviderBinding,
-    RegisteredConnectionObservation, RegisteredIdentityMode, SetEnvironmentIdlePolicy,
-    SetEnvironmentIngress, SetEnvironmentPower,
+    ReconcileScope, RecordEnvironmentIngress, RecordEnvironmentLifecycleError,
+    RecordProviderController, RegisteredConnectionObservation, RegisteredIdentityMode,
+    SetEnvironmentIdlePolicy, SetEnvironmentIngress, SetEnvironmentPower,
+    apply_registered_observation,
 };
 use sqlx::{Postgres, Row, Transaction};
 use uuid::Uuid;
 
-use crate::PgStore;
+use crate::{
+    PgStore,
+    auth::{LOCAL_KEY_ID, open_secret, seal_secret},
+};
 
 const PROVIDER_COLUMNS: &str = r#"
-    provider_id, display_name, controller_connection_json, metadata_json,
+    provider_id, display_name, controller_endpoint, metadata_json,
+    controller_adopt_target, controller_ingress, data_route_base,
     created_at_ms, updated_at_ms
 "#;
 
@@ -33,10 +40,11 @@ const BINDING_COLUMNS: &str = r#"
 "#;
 
 const ENVIRONMENT_COLUMNS: &str = r#"
-    e.environment_id, e.request_id, e.source_kind, e.provider_id, e.binding_id, e.daemon_connection_json,
+    e.environment_id, e.request_id, e.source_kind, e.provider_id, e.binding_id, e.daemon_endpoint,
     e.registration_key_id, e.daemon_id, e.daemon_public_key, e.identity_mode, e.last_seen_at_ms,
     e.display_name, e.status, e.desired_power, e.idle_policy_json,
     e.public_ingress_enabled, e.public_endpoint, e.metadata_json,
+    e.lifecycle_error, e.lifecycle_error_first_at_ms, e.lifecycle_error_last_at_ms,
     e.created_at_ms, e.updated_at_ms,
     i.incarnation_id, i.provision_request_id, i.provider_target_id,
     i.template_id, i.adoption_source_target, i.power_states_json,
@@ -46,13 +54,23 @@ const ENVIRONMENT_COLUMNS: &str = r#"
 
 /// SQL predicate: the observed steady power state differs from the desired
 /// one, so the lifecycle reconciler has power work to do.
-const POWER_DIVERGES_SQL: &str = r#"(
-    e.source_kind = 'provisioned' AND (
+/// `EnvironmentRecord::needs_reconcile` over `environments e` without the
+/// steady clause: convergence pending (status, power or ingress).
+pub(crate) const CONVERGING_SQL: &str = r#"(
+    e.status IN ('provisioning','booting','closing','unknown')
+    OR (e.source_kind = 'provisioned' AND (
         (e.status = 'ready' AND e.desired_power <> 'running')
         OR (e.status = 'paused' AND e.desired_power <> 'paused')
         OR (e.status = 'suspended' AND e.desired_power <> 'suspended')
         OR (e.status = 'offline' AND e.desired_power <> 'stopped')
-    )
+        OR (e.status = 'ready' AND e.public_ingress_enabled <> (e.public_endpoint IS NOT NULL))
+    ))
+)"#;
+
+/// Steady provisioned environments, over `environments e`; with the
+/// incarnation join the recorded target is required too.
+pub(crate) const STEADY_SQL: &str = r#"(
+    e.source_kind = 'provisioned' AND e.status IN ('ready','offline','paused','suspended')
 )"#;
 
 const ENVIRONMENT_JOIN: &str = r#"
@@ -74,34 +92,101 @@ impl EnvironmentProviderStore for PgStore {
         &self,
         request: PutEnvironmentProvider,
     ) -> Result<EnvironmentProviderRecord, EnvironmentRegistryError> {
-        let record = request.into_record()?;
+        let mut tx = self
+            .pool
+            .begin()
+            .await
+            .map_err(|error| sql_error("begin environment provider put", error))?;
         let query = format!(
-            r#"
-            INSERT INTO environment_providers (
-                provider_id, display_name, controller_connection_json,
-                metadata_json, created_at_ms, updated_at_ms
-            ) VALUES ($1,$2,$3,$4,$5,$6)
-            ON CONFLICT (provider_id) DO UPDATE SET
-                display_name = EXCLUDED.display_name,
-                controller_connection_json = EXCLUDED.controller_connection_json,
-                metadata_json = EXCLUDED.metadata_json,
-                updated_at_ms = EXCLUDED.updated_at_ms
-            RETURNING {PROVIDER_COLUMNS}
-        "#
+            "SELECT {PROVIDER_COLUMNS} FROM environment_providers WHERE provider_id = $1 FOR UPDATE"
         );
-        let row = sqlx::query(sqlx::AssertSqlSafe(query))
-            .bind(record.provider_id.as_str())
-            .bind(record.display_name.as_deref())
-            .bind(json_value(
-                "encode provider controller connection",
-                &record.controller_connection,
-            )?)
-            .bind(json_value("encode provider metadata", &record.metadata)?)
-            .bind(record.created_at_ms)
-            .bind(record.updated_at_ms)
-            .fetch_one(&self.pool)
+        // A row that no longer decodes is replaced as if it were absent, so
+        // an operator can repair it with a put that carries a credential.
+        let existing = sqlx::query(sqlx::AssertSqlSafe(query))
+            .bind(request.provider_id.as_str())
+            .fetch_optional(&mut *tx)
+            .await
+            .map_err(|error| sql_error("lock environment provider", error))?
+            .and_then(|row| decoded_or_logged(provider_from_row(&row), "environment provider"));
+        let credential = request.credential.clone();
+        let record = request.into_record(existing.as_ref())?;
+        let features = record.controller_features;
+        let row = match credential {
+            Some(credential) => {
+                let (key_id, nonce, ciphertext) =
+                    self.seal_provider_credential(&record.provider_id, &credential)?;
+                let query = format!(
+                    r#"
+                    INSERT INTO environment_providers (
+                        provider_id, display_name, controller_endpoint, metadata_json,
+                        controller_adopt_target, controller_ingress, data_route_base,
+                        credential_key_id, credential_nonce, credential_ciphertext,
+                        created_at_ms, updated_at_ms
+                    ) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12)
+                    ON CONFLICT (provider_id) DO UPDATE SET
+                        display_name = EXCLUDED.display_name,
+                        controller_endpoint = EXCLUDED.controller_endpoint,
+                        metadata_json = EXCLUDED.metadata_json,
+                        controller_adopt_target = EXCLUDED.controller_adopt_target,
+                        controller_ingress = EXCLUDED.controller_ingress,
+                        data_route_base = EXCLUDED.data_route_base,
+                        credential_key_id = EXCLUDED.credential_key_id,
+                        credential_nonce = EXCLUDED.credential_nonce,
+                        credential_ciphertext = EXCLUDED.credential_ciphertext,
+                        created_at_ms = EXCLUDED.created_at_ms,
+                        updated_at_ms = EXCLUDED.updated_at_ms
+                    RETURNING {PROVIDER_COLUMNS}
+                "#
+                );
+                sqlx::query(sqlx::AssertSqlSafe(query))
+                    .bind(record.provider_id.as_str())
+                    .bind(record.display_name.as_deref())
+                    .bind(record.controller_endpoint.as_str())
+                    .bind(json_value("encode provider metadata", &record.metadata)?)
+                    .bind(features.map(|features| features.adopt_target))
+                    .bind(features.map(|features| features.ingress))
+                    .bind(record.data_route_base.as_ref().map(DataRouteBase::as_str))
+                    .bind(key_id)
+                    .bind(nonce)
+                    .bind(ciphertext)
+                    .bind(record.created_at_ms)
+                    .bind(record.updated_at_ms)
+                    .fetch_one(&mut *tx)
+                    .await
+                    .map_err(|error| sql_error("put environment provider", error))?
+            }
+            None => {
+                let query = format!(
+                    r#"
+                    UPDATE environment_providers SET
+                        display_name = $2, controller_endpoint = $3, metadata_json = $4,
+                        controller_adopt_target = $5, controller_ingress = $6,
+                        data_route_base = $7, created_at_ms = $8, updated_at_ms = $9
+                    WHERE provider_id = $1
+                    RETURNING {PROVIDER_COLUMNS}
+                "#
+                );
+                sqlx::query(sqlx::AssertSqlSafe(query))
+                    .bind(record.provider_id.as_str())
+                    .bind(record.display_name.as_deref())
+                    .bind(record.controller_endpoint.as_str())
+                    .bind(json_value("encode provider metadata", &record.metadata)?)
+                    .bind(features.map(|features| features.adopt_target))
+                    .bind(features.map(|features| features.ingress))
+                    .bind(record.data_route_base.as_ref().map(DataRouteBase::as_str))
+                    .bind(record.created_at_ms)
+                    .bind(record.updated_at_ms)
+                    .fetch_optional(&mut *tx)
+                    .await
+                    .map_err(|error| sql_error("update environment provider", error))?
+                    .ok_or_else(|| {
+                        invalid_error("a new environment provider requires a credential")
+                    })?
+            }
+        };
+        tx.commit()
             .await
-            .map_err(|error| sql_error("put environment provider", error))?;
+            .map_err(|error| sql_error("commit environment provider put", error))?;
         provider_from_row(&row)
     }
 
@@ -120,6 +205,66 @@ impl EnvironmentProviderStore for PgStore {
         provider_from_row(&row)
     }
 
+    async fn read_provider_credential(
+        &self,
+        provider_id: &EnvironmentProviderId,
+    ) -> Result<SecretValue, EnvironmentRegistryError> {
+        let row = sqlx::query(
+            "SELECT credential_key_id, credential_nonce, credential_ciphertext FROM environment_providers WHERE provider_id = $1",
+        )
+        .bind(provider_id.as_str())
+        .fetch_optional(&self.pool)
+        .await
+        .map_err(|error| sql_error("read environment provider credential", error))?
+        .ok_or_else(|| not_found("environment_provider", provider_id))?;
+        let key_id: String = row
+            .try_get("credential_key_id")
+            .map_err(|error| sql_error("decode provider credential key id", error))?;
+        if key_id != LOCAL_KEY_ID {
+            return Err(store_message(format!(
+                "unsupported provider credential key id '{key_id}'"
+            )));
+        }
+        let nonce: Vec<u8> = row
+            .try_get("credential_nonce")
+            .map_err(|error| sql_error("decode provider credential nonce", error))?;
+        let ciphertext: Vec<u8> = row
+            .try_get("credential_ciphertext")
+            .map_err(|error| sql_error("decode provider credential", error))?;
+        let (cipher, _) = self
+            .secrets_cipher()
+            .map_err(|error| store_message(error.to_string()))?;
+        open_secret(
+            &cipher,
+            &provider_credential_aad(provider_id),
+            &nonce,
+            &ciphertext,
+        )
+        .map_err(|error| store_message(format!("open provider credential: {error}")))
+    }
+
+    async fn record_provider_controller(
+        &self,
+        request: RecordProviderController,
+    ) -> Result<EnvironmentProviderRecord, EnvironmentRegistryError> {
+        sqlx::query(
+            r#"
+            UPDATE environment_providers SET
+                controller_adopt_target = $3, controller_ingress = $4, data_route_base = $5
+            WHERE provider_id = $1 AND controller_endpoint = $2
+            "#,
+        )
+        .bind(request.provider_id.as_str())
+        .bind(request.controller_endpoint.as_str())
+        .bind(request.features.adopt_target)
+        .bind(request.features.ingress)
+        .bind(request.data_route_base.as_str())
+        .execute(&self.pool)
+        .await
+        .map_err(|error| sql_error("record environment provider controller", error))?;
+        self.read_provider(&request.provider_id).await
+    }
+
     async fn list_providers(
         &self,
         _request: ListEnvironmentProviders,
@@ -130,7 +275,11 @@ impl EnvironmentProviderStore for PgStore {
             .fetch_all(&self.pool)
             .await
             .map_err(|error| sql_error("list environment providers", error))?;
-        rows.iter().map(provider_from_row).collect()
+        Ok(decode_rows(
+            &rows,
+            provider_from_row,
+            "environment provider",
+        ))
     }
 
     async fn delete_provider(
@@ -160,6 +309,28 @@ impl EnvironmentProviderStore for PgStore {
     }
 }
 
+impl PgStore {
+    fn seal_provider_credential(
+        &self,
+        provider_id: &EnvironmentProviderId,
+        credential: &SecretValue,
+    ) -> Result<(&'static str, Vec<u8>, Vec<u8>), EnvironmentRegistryError> {
+        let (cipher, key_id) = self
+            .secrets_cipher()
+            .map_err(|error| store_message(error.to_string()))?;
+        let (nonce, ciphertext) =
+            seal_secret(&cipher, &provider_credential_aad(provider_id), credential)
+                .map_err(|error| store_message(format!("seal provider credential: {error}")))?;
+        Ok((key_id, nonce, ciphertext))
+    }
+}
+
+/// Binds a sealed provider credential to its provider, so ciphertexts
+/// cannot be moved between provider rows.
+fn provider_credential_aad(provider_id: &EnvironmentProviderId) -> Vec<u8> {
+    format!("environment-provider/{}/credential", provider_id.as_str()).into_bytes()
+}
+
 #[async_trait]
 impl EnvironmentProviderBindingStore for PgStore {
     async fn put_provider_binding(
@@ -264,7 +435,11 @@ impl EnvironmentProviderBindingStore for PgStore {
             .fetch_all(&self.pool)
             .await
             .map_err(|error| sql_error("list provider bindings", error))?;
-        rows.iter().map(binding_from_row).collect()
+        Ok(decode_rows(
+            &rows,
+            binding_from_row,
+            "environment provider binding",
+        ))
     }
 
     async fn delete_provider_binding(
@@ -340,6 +515,7 @@ impl EnvironmentStore for PgStore {
         if binding.status != EnvironmentProviderBindingStatus::Enabled {
             return invalid("environment provider binding is disabled");
         }
+        request.record(binding.provider_id.clone())?;
         sqlx::query(
             r#"
             INSERT INTO environments (
@@ -404,14 +580,6 @@ impl EnvironmentStore for PgStore {
         if request.created_at_ms < 0 {
             return invalid("environment timestamp must be nonnegative");
         }
-        if request.source_target.is_empty()
-            || request.source_target.len() > 255
-            || request.source_target.chars().any(char::is_control)
-        {
-            return invalid(
-                "adoption source must be non-empty, at most 255 bytes, and contain no control characters",
-            );
-        }
         let mut tx = self
             .pool
             .begin()
@@ -447,6 +615,7 @@ impl EnvironmentStore for PgStore {
         if binding.status != EnvironmentProviderBindingStatus::Enabled {
             return invalid("environment provider binding is disabled");
         }
+        request.record(binding.provider_id.clone())?;
         sqlx::query(
             r#"
             INSERT INTO environments (
@@ -504,34 +673,7 @@ impl EnvironmentStore for PgStore {
         if request.created_at_ms < 0 {
             return invalid("environment timestamp must be nonnegative");
         }
-        let candidate = EnvironmentRecord {
-            environment_id: request.environment_id.clone(),
-            request_id: request.request_id.clone(),
-            source: EnvironmentSource::External {
-                connection: request.connection.clone(),
-            },
-            display_name: request.display_name.clone(),
-            status: EnvironmentStatus::Ready,
-            desired_power: PowerState::Running,
-            idle_policy: None,
-            incarnation: EnvironmentIncarnationRecord {
-                incarnation_id: request.incarnation_id.clone(),
-                provision_request_id: None,
-                provider_target_id: None,
-                template_id: None,
-                adoption_source_target: None,
-                power_states: Vec::new(),
-                created_at_ms: request.created_at_ms,
-                updated_at_ms: request.created_at_ms,
-            },
-            public_ingress_enabled: false,
-            public_endpoint: None,
-            metadata: request.metadata.clone(),
-            last_seen_at_ms: None,
-            created_at_ms: request.created_at_ms,
-            updated_at_ms: request.created_at_ms,
-        };
-        candidate.validate()?;
+        request.record()?;
         let mut tx = self
             .pool
             .begin()
@@ -556,7 +698,7 @@ impl EnvironmentStore for PgStore {
         sqlx::query(
             r#"
             INSERT INTO environments (
-                universe_id, environment_id, request_id, source_kind, daemon_connection_json,
+                universe_id, environment_id, request_id, source_kind, daemon_endpoint,
                 display_name, status, current_incarnation_id, metadata_json,
                 created_at_ms, updated_at_ms
             ) VALUES ($1,$2,$3,'external',$4,$5,'ready',$6,$7,$8,$8)
@@ -565,7 +707,7 @@ impl EnvironmentStore for PgStore {
         .bind(self.config.universe_id)
         .bind(request.environment_id.as_str())
         .bind(request.request_id.as_str())
-        .bind(json_value("encode daemon connection", &request.connection)?)
+        .bind(request.endpoint.as_str())
         .bind(request.display_name.as_deref())
         .bind(request.incarnation_id.as_str())
         .bind(json_value(
@@ -654,6 +796,7 @@ impl EnvironmentStore for PgStore {
                 });
             }
         }
+        request.record(&key)?;
         sqlx::query(
             r#"
             INSERT INTO environments (
@@ -725,9 +868,17 @@ impl EnvironmentStore for PgStore {
             return invalid("observed_at_ms must be nonnegative");
         }
         let current = self.read_environment(&request.environment_id).await?;
-        if !current.is_registered() {
-            return invalid("connection observations apply only to registered environments");
-        }
+        // Validate the merged result before anything becomes durable: a
+        // build fact that breaks the record's bounds is refused here rather
+        // than poisoning the row for every later read.
+        let mut candidate = current.clone();
+        apply_registered_observation(
+            &mut candidate,
+            request.observation,
+            request.observed_at_ms,
+            request.metadata.clone(),
+        )?;
+        candidate.validate()?;
         // One conditional statement rather than read-modify-write: a close
         // that lands between a read and a write must never be overwritten
         // by a late connect or disconnect observation.
@@ -782,7 +933,7 @@ impl EnvironmentStore for PgStore {
             .fetch_all(&self.pool)
             .await
             .map_err(|error| sql_error("list open registered environments", error))?;
-        rows.iter().map(environment_from_row).collect()
+        Ok(decode_rows(&rows, environment_from_row, "environment"))
     }
 
     async fn read_environment(
@@ -861,21 +1012,27 @@ impl EnvironmentStore for PgStore {
             .fetch_all(&self.pool)
             .await
             .map_err(|error| sql_error("list environments", error))?;
-        rows.iter().map(environment_from_row).collect()
+        Ok(decode_rows(&rows, environment_from_row, "environment"))
     }
 
     async fn list_environments_needing_reconcile(
         &self,
+        scope: ReconcileScope,
     ) -> Result<Vec<EnvironmentRecord>, EnvironmentRegistryError> {
-        let query = format!(
-            "SELECT {ENVIRONMENT_COLUMNS} {ENVIRONMENT_JOIN} WHERE e.universe_id = $1 AND (e.status IN ('provisioning','booting','closing','unknown') OR {POWER_DIVERGES_SQL}) ORDER BY e.updated_at_ms, e.environment_id"
-        );
+        let query = match scope {
+            ReconcileScope::Converging => format!(
+                "SELECT {ENVIRONMENT_COLUMNS} {ENVIRONMENT_JOIN} WHERE e.universe_id = $1 AND {CONVERGING_SQL} ORDER BY e.updated_at_ms, e.environment_id"
+            ),
+            ReconcileScope::WithSteady => format!(
+                "SELECT {ENVIRONMENT_COLUMNS} {ENVIRONMENT_JOIN} WHERE e.universe_id = $1 AND ({CONVERGING_SQL} OR ({STEADY_SQL} AND i.provider_target_id IS NOT NULL)) ORDER BY e.updated_at_ms, e.environment_id"
+            ),
+        };
         let rows = sqlx::query(sqlx::AssertSqlSafe(query))
             .bind(self.config.universe_id)
             .fetch_all(&self.pool)
             .await
             .map_err(|error| sql_error("list environments needing reconcile", error))?;
-        rows.iter().map(environment_from_row).collect()
+        Ok(decode_rows(&rows, environment_from_row, "environment"))
     }
 
     async fn list_environments_with_idle_policy(
@@ -889,7 +1046,7 @@ impl EnvironmentStore for PgStore {
             .fetch_all(&self.pool)
             .await
             .map_err(|error| sql_error("list environments with idle policy", error))?;
-        rows.iter().map(environment_from_row).collect()
+        Ok(decode_rows(&rows, environment_from_row, "environment"))
     }
 
     async fn observe_provisioned_environment(
@@ -897,26 +1054,81 @@ impl EnvironmentStore for PgStore {
         request: ObserveProvisionedEnvironment,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
         let current = self.read_environment(&request.environment_id).await?;
-        if request.observed_at_ms < current.incarnation.updated_at_ms {
+        let mut candidate = current.clone();
+        request.apply(&mut candidate)?;
+        candidate.validate()?;
+        if candidate == current {
             return Ok(current);
         }
-        if current
-            .incarnation
-            .provider_target_id
-            .as_ref()
-            .is_some_and(|id| id != &request.provider_target_id)
-        {
-            return invalid("provider target conflicts with current incarnation");
-        }
-        sqlx::query("UPDATE environment_incarnations SET provider_target_id=$4, power_states_json=$5, updated_at_ms=$6 WHERE universe_id=$1 AND environment_id=$2 AND incarnation_id=$3")
-            .bind(self.config.universe_id).bind(request.environment_id.as_str()).bind(current.incarnation.incarnation_id.as_str())
-            .bind(request.provider_target_id.as_str())
-            .bind(json_value("encode power states", &request.power_states)?)
-            .bind(request.observed_at_ms)
-            .execute(&self.pool).await.map_err(|error| sql_error("observe environment incarnation", error))?;
-        sqlx::query("UPDATE environments SET status=$3, updated_at_ms=$4 WHERE universe_id=$1 AND environment_id=$2")
-            .bind(self.config.universe_id).bind(request.environment_id.as_str()).bind(environment_status_to_str(request.status)).bind(request.observed_at_ms)
-            .execute(&self.pool).await.map_err(|error| sql_error("observe environment", error))?;
+        let mut tx = self
+            .pool
+            .begin()
+            .await
+            .map_err(|error| sql_error("begin environment observation", error))?;
+        // The target id and power states are recorded whatever the status,
+        // so a close that raced the first create can still address the
+        // target; the predicates refuse stale and conflicting observations
+        // that raced this one.
+        sqlx::query(
+            r#"
+            UPDATE environment_incarnations SET
+                provider_target_id = COALESCE($4, provider_target_id),
+                power_states_json = $5,
+                updated_at_ms = $6
+            WHERE universe_id = $1 AND environment_id = $2 AND incarnation_id = $3
+              AND updated_at_ms <= $6
+              AND ($4::text IS NULL OR provider_target_id IS NULL OR provider_target_id = $4)
+            "#,
+        )
+        .bind(self.config.universe_id)
+        .bind(request.environment_id.as_str())
+        .bind(current.incarnation.incarnation_id.as_str())
+        .bind(
+            request
+                .provider_target_id
+                .as_ref()
+                .map(ProviderTargetId::as_str),
+        )
+        .bind(json_value("encode power states", &request.power_states)?)
+        .bind(request.observed_at_ms)
+        .execute(&mut *tx)
+        .await
+        .map_err(|error| sql_error("observe environment incarnation", error))?;
+        // A close accepted while this observation was in flight wins.
+        sqlx::query(
+            r#"
+            UPDATE environments SET
+                status = $3,
+                metadata_json = metadata_json || $4,
+                lifecycle_error = CASE WHEN $5 THEN NULL ELSE lifecycle_error END,
+                lifecycle_error_first_at_ms =
+                    CASE WHEN $5 THEN NULL ELSE lifecycle_error_first_at_ms END,
+                lifecycle_error_last_at_ms =
+                    CASE WHEN $5 THEN NULL ELSE lifecycle_error_last_at_ms END,
+                updated_at_ms = GREATEST(updated_at_ms, $6)
+            WHERE universe_id = $1 AND environment_id = $2
+              AND status NOT IN ('closing', 'closed')
+            "#,
+        )
+        .bind(self.config.universe_id)
+        .bind(request.environment_id.as_str())
+        .bind(environment_status_to_str(request.status))
+        .bind(json_value(
+            "encode daemon build metadata",
+            &request
+                .daemon_build
+                .as_ref()
+                .map(|build| build.metadata())
+                .unwrap_or_default(),
+        )?)
+        .bind(request.status.power_state().is_some())
+        .bind(request.observed_at_ms)
+        .execute(&mut *tx)
+        .await
+        .map_err(|error| sql_error("observe environment", error))?;
+        tx.commit()
+            .await
+            .map_err(|error| sql_error("commit environment observation", error))?;
         self.read_environment(&request.environment_id).await
     }
 
@@ -924,14 +1136,101 @@ impl EnvironmentStore for PgStore {
         &self,
         request: FailEnvironmentLifecycle,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
-        let mut metadata = self
-            .read_environment(&request.environment_id)
-            .await?
-            .metadata;
-        metadata.insert("lifecycleError".to_owned(), request.message);
-        sqlx::query("UPDATE environments SET status='failed', metadata_json=$3, updated_at_ms=$4 WHERE universe_id=$1 AND environment_id=$2")
-            .bind(self.config.universe_id).bind(request.environment_id.as_str()).bind(json_value("encode environment metadata", &metadata)?).bind(request.observed_at_ms)
-            .execute(&self.pool).await.map_err(|error| sql_error("fail environment", error))?;
+        let current = self.read_environment(&request.environment_id).await?;
+        let mut candidate = current.clone();
+        request.apply(&mut candidate)?;
+        candidate.validate()?;
+        let Some(error) = candidate
+            .lifecycle_error
+            .as_ref()
+            .filter(|_| candidate != current)
+        else {
+            return Ok(current);
+        };
+        let mut tx = self
+            .pool
+            .begin()
+            .await
+            .map_err(|error| sql_error("begin environment failure", error))?;
+        let failed = sqlx::query(
+            r#"
+            UPDATE environments SET
+                status = 'failed',
+                lifecycle_error = $3,
+                lifecycle_error_first_at_ms = LEAST(COALESCE(lifecycle_error_first_at_ms, $4), $4),
+                lifecycle_error_last_at_ms = $4,
+                metadata_json = metadata_json || $5,
+                updated_at_ms = GREATEST(updated_at_ms, $4)
+            WHERE universe_id = $1 AND environment_id = $2
+              AND status NOT IN ('closing', 'closed')
+            "#,
+        )
+        .bind(self.config.universe_id)
+        .bind(request.environment_id.as_str())
+        .bind(&error.message)
+        .bind(request.observed_at_ms)
+        .bind(json_value(
+            "encode daemon build metadata",
+            &request
+                .daemon_build
+                .as_ref()
+                .map(|build| build.metadata())
+                .unwrap_or_default(),
+        )?)
+        .execute(&mut *tx)
+        .await
+        .map_err(|error| sql_error("fail environment", error))?;
+        if failed.rows_affected() == 1 {
+            // Observations older than the failure are stale from now on.
+            sqlx::query(
+                "UPDATE environment_incarnations SET updated_at_ms = GREATEST(updated_at_ms, $4) WHERE universe_id = $1 AND environment_id = $2 AND incarnation_id = $3",
+            )
+            .bind(self.config.universe_id)
+            .bind(request.environment_id.as_str())
+            .bind(current.incarnation.incarnation_id.as_str())
+            .bind(request.observed_at_ms)
+            .execute(&mut *tx)
+            .await
+            .map_err(|error| sql_error("fail environment incarnation", error))?;
+        }
+        tx.commit()
+            .await
+            .map_err(|error| sql_error("commit environment failure", error))?;
+        self.read_environment(&request.environment_id).await
+    }
+
+    async fn record_environment_lifecycle_error(
+        &self,
+        request: RecordEnvironmentLifecycleError,
+    ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
+        let current = self.read_environment(&request.environment_id).await?;
+        let mut candidate = current.clone();
+        request.apply(&mut candidate)?;
+        candidate.validate()?;
+        let Some(error) = candidate
+            .lifecycle_error
+            .as_ref()
+            .filter(|_| candidate != current)
+        else {
+            return Ok(current);
+        };
+        sqlx::query(
+            r#"
+            UPDATE environments SET
+                lifecycle_error = $3,
+                lifecycle_error_first_at_ms = LEAST(COALESCE(lifecycle_error_first_at_ms, $4), $4),
+                lifecycle_error_last_at_ms = $4,
+                updated_at_ms = GREATEST(updated_at_ms, $4)
+            WHERE universe_id = $1 AND environment_id = $2 AND status <> 'closed'
+            "#,
+        )
+        .bind(self.config.universe_id)
+        .bind(request.environment_id.as_str())
+        .bind(&error.message)
+        .bind(request.observed_at_ms)
+        .execute(&self.pool)
+        .await
+        .map_err(|error| sql_error("record environment lifecycle error", error))?;
         self.read_environment(&request.environment_id).await
     }
 
@@ -976,29 +1275,45 @@ impl EnvironmentStore for PgStore {
         if !matches!(environment.source, EnvironmentSource::Provisioned { .. }) {
             return invalid_store("provider-managed ingress requires a provisioned environment");
         }
-        if request.enabled
-            && matches!(
-                environment.status,
-                EnvironmentStatus::Closing | EnvironmentStatus::Closed
-            )
-        {
+        if request.enabled && environment.status.is_closing_or_closed() {
             return invalid_store("cannot enable ingress for a closing environment");
         }
-        if request.enabled != request.public_endpoint.is_some() {
-            return invalid_store(
-                "enabled ingress requires a public endpoint and disabled ingress forbids one",
-            );
+        EnvironmentRecord {
+            public_ingress_enabled: request.enabled,
+            ..environment
         }
-        sqlx::query("UPDATE environments SET public_ingress_enabled=$3, public_endpoint=$4, updated_at_ms=GREATEST(updated_at_ms,$5) WHERE universe_id=$1 AND environment_id=$2")
+        .validate()?;
+        // Enabling never revives a close accepted in the meantime.
+        sqlx::query("UPDATE environments SET public_ingress_enabled=$3, updated_at_ms=GREATEST(updated_at_ms,$4) WHERE universe_id=$1 AND environment_id=$2 AND (NOT $3 OR status NOT IN ('closing','closed'))")
             .bind(self.config.universe_id)
             .bind(request.environment_id.as_str())
             .bind(request.enabled)
-            .bind(request.public_endpoint)
             .bind(request.updated_at_ms)
             .execute(&self.pool).await.map_err(|error| sql_error("set environment ingress", error))?;
         self.read_environment(&request.environment_id).await
     }
 
+    async fn record_environment_ingress(
+        &self,
+        request: RecordEnvironmentIngress,
+    ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
+        let current = self.read_environment(&request.environment_id).await?;
+        let mut candidate = current.clone();
+        request.apply(&mut candidate)?;
+        candidate.validate()?;
+        if candidate == current {
+            return Ok(current);
+        }
+        // A close accepted while this observation was in flight wins.
+        sqlx::query("UPDATE environments SET public_endpoint=$3, updated_at_ms=GREATEST(updated_at_ms,$4) WHERE universe_id=$1 AND environment_id=$2 AND status NOT IN ('closing','closed')")
+            .bind(self.config.universe_id)
+            .bind(request.environment_id.as_str())
+            .bind(request.public_endpoint)
+            .bind(request.observed_at_ms)
+            .execute(&self.pool).await.map_err(|error| sql_error("record environment ingress", error))?;
+        self.read_environment(&request.environment_id).await
+    }
+
     async fn set_environment_power(
         &self,
         request: SetEnvironmentPower,
@@ -1006,6 +1321,11 @@ impl EnvironmentStore for PgStore {
         validate_ingress_request_time(request.updated_at_ms)?;
         let environment = self.read_environment(&request.environment_id).await?;
         check_power_mutable(&environment)?;
+        EnvironmentRecord {
+            desired_power: request.desired_power,
+            ..environment
+        }
+        .validate()?;
         sqlx::query("UPDATE environments SET desired_power=$3, updated_at_ms=GREATEST(updated_at_ms,$4) WHERE universe_id=$1 AND environment_id=$2")
             .bind(self.config.universe_id)
             .bind(request.environment_id.as_str())
@@ -1025,6 +1345,11 @@ impl EnvironmentStore for PgStore {
         }
         let environment = self.read_environment(&request.environment_id).await?;
         check_power_mutable(&environment)?;
+        EnvironmentRecord {
+            idle_policy: request.idle_policy.clone(),
+            ..environment
+        }
+        .validate()?;
         sqlx::query("UPDATE environments SET idle_policy_json=$3, updated_at_ms=GREATEST(updated_at_ms,$4) WHERE universe_id=$1 AND environment_id=$2")
             .bind(self.config.universe_id)
             .bind(request.environment_id.as_str())
@@ -1045,10 +1370,7 @@ fn check_power_mutable(record: &EnvironmentRecord) -> Result<(), EnvironmentRegi
     if !matches!(record.source, EnvironmentSource::Provisioned { .. }) {
         return invalid_store("only provisioned environments have power control");
     }
-    if matches!(
-        record.status,
-        EnvironmentStatus::Closing | EnvironmentStatus::Closed | EnvironmentStatus::Failed
-    ) {
+    if record.status.is_closing_or_closed() || record.status == EnvironmentStatus::Failed {
         return invalid_store("cannot change power of a closing, closed, or failed environment");
     }
     Ok(())
@@ -1101,7 +1423,11 @@ impl EnvironmentCredentialStore for PgStore {
             .fetch_all(&self.pool)
             .await
             .map_err(|error| sql_error("list environment credentials", error))?;
-        rows.iter().map(credential_from_row).collect()
+        Ok(decode_rows(
+            &rows,
+            credential_from_row,
+            "environment credential",
+        ))
     }
 
     async fn unbind_credential(
@@ -1153,15 +1479,31 @@ fn provider_from_row(
     row: &sqlx::postgres::PgRow,
 ) -> Result<EnvironmentProviderRecord, EnvironmentRegistryError> {
     let provider_id = parse_id(row, "provider_id", EnvironmentProviderId::try_new)?;
-    let connection: environments::EnvironmentConnectionSpec =
-        json_column(row, "controller_connection_json")?;
+    let adopt_target: Option<bool> = row
+        .try_get("controller_adopt_target")
+        .map_err(|e| sql_error("decode provider controller adoptTarget", e))?;
+    let ingress: Option<bool> = row
+        .try_get("controller_ingress")
+        .map_err(|e| sql_error("decode provider controller ingress", e))?;
+    let controller_features = match (adopt_target, ingress) {
+        (Some(adopt_target), Some(ingress)) => Some(ControllerFeatures {
+            adopt_target,
+            ingress,
+        }),
+        (None, None) => None,
+        _ => return Err(store_message("provider controller features are incomplete")),
+    };
     let record = EnvironmentProviderRecord {
         provider_id,
         display_name: row
             .try_get("display_name")
             .map_err(|e| sql_error("decode provider display_name", e))?,
-        controller_connection: connection,
+        controller_endpoint: parse_id(row, "controller_endpoint", |value| {
+            EnvironmentEndpoint::parse(&value)
+        })?,
         metadata: json_column(row, "metadata_json")?,
+        controller_features,
+        data_route_base: optional_id(row, "data_route_base", DataRouteBase::new)?,
         created_at_ms: scalar(row, "created_at_ms")?,
         updated_at_ms: scalar(row, "updated_at_ms")?,
     };
@@ -1210,7 +1552,9 @@ fn environment_from_row(
             .map_err(|e| store_message(format!("decode binding id: {e}")))?,
         },
         "external" => EnvironmentSource::External {
-            connection: json_column(row, "daemon_connection_json")?,
+            endpoint: parse_id(row, "daemon_endpoint", |value| {
+                EnvironmentEndpoint::parse(&value)
+            })?,
         },
         "registered" => EnvironmentSource::Registered {
             registration_key_id: parse_id(
@@ -1228,9 +1572,22 @@ fn environment_from_row(
             )));
         }
     };
-    let target: Option<String> = row
-        .try_get("provider_target_id")
-        .map_err(|e| sql_error("decode provider target", e))?;
+    let lifecycle_error = match (
+        row.try_get::<Option<String>, _>("lifecycle_error")
+            .map_err(|e| sql_error("decode lifecycle error", e))?,
+        row.try_get::<Option<i64>, _>("lifecycle_error_first_at_ms")
+            .map_err(|e| sql_error("decode lifecycle error start", e))?,
+        row.try_get::<Option<i64>, _>("lifecycle_error_last_at_ms")
+            .map_err(|e| sql_error("decode lifecycle error time", e))?,
+    ) {
+        (Some(message), Some(first_at_ms), Some(last_at_ms)) => Some(EnvironmentLifecycleError {
+            message,
+            first_at_ms,
+            last_at_ms,
+        }),
+        (None, None, None) => None,
+        _ => return Err(store_message("environment lifecycle error is incomplete")),
+    };
     let record = EnvironmentRecord {
         environment_id: parse_id(row, "environment_id", EnvironmentId::try_new)?,
         request_id: parse_id(row, "request_id", EnvironmentProvisionRequestId::try_new)?,
@@ -1248,7 +1605,7 @@ fn environment_from_row(
                 "provision_request_id",
                 EnvironmentProvisionRequestId::try_new,
             )?,
-            provider_target_id: target.map(ProviderTargetId::new),
+            provider_target_id: optional_id(row, "provider_target_id", ProviderTargetId::new)?,
             template_id: optional_id(row, "template_id", EnvironmentTemplateId::try_new)?,
             adoption_source_target: row
                 .try_get("adoption_source_target")
@@ -1267,6 +1624,7 @@ fn environment_from_row(
         last_seen_at_ms: row
             .try_get("last_seen_at_ms")
             .map_err(|e| sql_error("decode last seen", e))?,
+        lifecycle_error,
         created_at_ms: scalar(row, "created_at_ms")?,
         updated_at_ms: scalar(row, "updated_at_ms")?,
     };
@@ -1550,6 +1908,28 @@ fn map_provider_delete_error(error: sqlx::Error) -> EnvironmentRegistryError {
 #[allow(dead_code)]
 async fn _transaction_marker(_: &mut Transaction<'_, Postgres>) {}
 
+/// Decode every row that still decodes. A row that does not is left out
+/// and logged, so one bad row never hides the rest of a listing or stalls
+/// a reconciler pass over them.
+pub(crate) fn decode_rows<T>(
+    rows: &[sqlx::postgres::PgRow],
+    decode: impl Fn(&sqlx::postgres::PgRow) -> Result<T, EnvironmentRegistryError>,
+    kind: &'static str,
+) -> Vec<T> {
+    rows.iter()
+        .filter_map(|row| decoded_or_logged(decode(row), kind))
+        .collect()
+}
+
+fn decoded_or_logged<T>(
+    result: Result<T, EnvironmentRegistryError>,
+    kind: &'static str,
+) -> Option<T> {
+    result
+        .inspect_err(|error| tracing::error!(%error, kind, "skipping undecodable registry row"))
+        .ok()
+}
+
 /// A string map as the jsonb object the `@>` containment filter compares
 /// against; building the value directly cannot fail.
 fn metadata_filter_json(
diff --git a/crates/store-pg/src/environment_registration.rs b/crates/store-pg/src/environment_registration.rs
index 0aa704097..eb0d568c7 100644
--- a/crates/store-pg/src/environment_registration.rs
+++ b/crates/store-pg/src/environment_registration.rs
@@ -15,7 +15,9 @@ use uuid::Uuid;
 
 use crate::{
     PgStore, PgStoreError,
-    environment::{identity_mode_from_str, invalid, not_found, sql_error, store_message},
+    environment::{
+        decode_rows, identity_mode_from_str, invalid, not_found, sql_error, store_message,
+    },
 };
 
 const KEY_COLUMNS: &str = r#"
@@ -99,7 +101,11 @@ impl EnvironmentRegistrationKeyStore for PgStore {
             .fetch_all(&self.pool)
             .await
             .map_err(|error| sql_error("list registration keys", error))?;
-        rows.iter().map(key_from_row).collect()
+        Ok(decode_rows(
+            &rows,
+            key_from_row,
+            "environment registration key",
+        ))
     }
 
     async fn revoke_registration_key(
diff --git a/crates/store-pg/src/lib.rs b/crates/store-pg/src/lib.rs
index 8a2b44a43..b944ffbc5 100644
--- a/crates/store-pg/src/lib.rs
+++ b/crates/store-pg/src/lib.rs
@@ -388,21 +388,24 @@ pub async fn list_universes(pool: &PgPool) -> Result<Vec<(Uuid, Option<String>)>
 /// Universes with lifecycle intents requiring provider reconciliation.
 pub async fn list_universes_with_pending_environments(
     pool: &PgPool,
+    scope: environments::ReconcileScope,
 ) -> Result<Vec<Uuid>, PgStoreError> {
-    // Include pending provider work and registered-environment heartbeat repair.
-    let rows: Vec<(Uuid,)> = sqlx::query_as(
+    // Pending provider work, registered-environment heartbeat repair and,
+    // for a steady pass, every steady provisioned environment.
+    let converging = environment::CONVERGING_SQL;
+    let steady = match scope {
+        environments::ReconcileScope::Converging => String::new(),
+        environments::ReconcileScope::WithSteady => format!(" OR {}", environment::STEADY_SQL),
+    };
+    let query = format!(
         "SELECT DISTINCT e.universe_id FROM environments e \
-         WHERE e.status IN ('provisioning','booting','closing','unknown') \
-            OR (e.source_kind = 'registered' AND e.status NOT IN ('closing','closed')) \
-            OR (e.source_kind = 'provisioned' AND ( \
-                (e.status = 'ready' AND e.desired_power <> 'running') \
-                OR (e.status = 'paused' AND e.desired_power <> 'paused') \
-                OR (e.status = 'suspended' AND e.desired_power <> 'suspended') \
-                OR (e.status = 'offline' AND e.desired_power <> 'stopped'))) \
-         ORDER BY e.universe_id",
-    )
-    .fetch_all(pool)
-    .await?;
+         WHERE {converging} \
+            OR (e.source_kind = 'registered' AND e.status NOT IN ('closing','closed')){steady} \
+         ORDER BY e.universe_id"
+    );
+    let rows: Vec<(Uuid,)> = sqlx::query_as(sqlx::AssertSqlSafe(query))
+        .fetch_all(pool)
+        .await?;
     Ok(rows.into_iter().map(|(universe_id,)| universe_id).collect())
 }
 
diff --git a/crates/store-pg/src/migrations.rs b/crates/store-pg/src/migrations.rs
index d0f3bf499..63eafdc32 100644
--- a/crates/store-pg/src/migrations.rs
+++ b/crates/store-pg/src/migrations.rs
@@ -113,9 +113,14 @@ pub const MIGRATIONS: &[EmbeddedMigration] = &[
         name: "session_deletion",
         sql: include_str!("../migrations/011_session_deletion.sql"),
     },
+    EmbeddedMigration {
+        version: 12,
+        name: "environment_endpoints",
+        sql: include_str!("../migrations/012_environment_endpoints.sql"),
+    },
 ];
 
-pub const REQUIRED_SCHEMA_REVISION: i64 = 11;
+pub const REQUIRED_SCHEMA_REVISION: i64 = 12;
 
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub struct SchemaStatus {
diff --git a/crates/store-pg/tests/store_pg_live.rs b/crates/store-pg/tests/store_pg_live.rs
index 763041077..654475bf0 100644
--- a/crates/store-pg/tests/store_pg_live.rs
+++ b/crates/store-pg/tests/store_pg_live.rs
@@ -7,14 +7,14 @@ use auth::{
     OAuthClientStore, PutSecretRecord, SECRET_KIND_STATIC_BEARER, SecretId, SecretStore,
     SecretValue, TokenEndpointAuthMethod, state_hash,
 };
-use environment_protocol::shared::{EnvironmentTransport, ProviderTargetId};
+use environment_protocol::{ids::ProviderTargetId, routes::DataRouteBase};
 use environments::{
-    BeginCloseEnvironment, CreateEnvironment, EnvironmentConnectionSpec, EnvironmentId,
-    EnvironmentIncarnationId, EnvironmentProviderBindingId, EnvironmentProviderBindingStatus,
-    EnvironmentProviderBindingStore, EnvironmentProviderId, EnvironmentProviderStore,
-    EnvironmentProvisionRequestId, EnvironmentStatus, EnvironmentStore, EnvironmentTemplateId,
-    ListEnvironmentProviders, ListEnvironments, ObserveProvisionedEnvironment,
-    PutEnvironmentProvider, PutEnvironmentProviderBinding,
+    BeginCloseEnvironment, ControllerFeatures, CreateEnvironment, EnvironmentEndpoint,
+    EnvironmentId, EnvironmentIncarnationId, EnvironmentProviderBindingId,
+    EnvironmentProviderBindingStatus, EnvironmentProviderBindingStore, EnvironmentProviderId,
+    EnvironmentProviderStore, EnvironmentProvisionRequestId, EnvironmentStatus, EnvironmentStore,
+    EnvironmentTemplateId, ListEnvironmentProviders, ListEnvironments,
+    ObserveProvisionedEnvironment, PutEnvironmentProvider, PutEnvironmentProviderBinding,
 };
 use harness::{
     BlobRef, CORE_AGENT_LIFECYCLE_CLOSED_EVENT_KIND,
@@ -2009,7 +2009,7 @@ async fn pg_live_universe_environments_are_independent_of_sessions() {
         );
     }
     let provider_id = EnvironmentProviderId::new("bridge-local");
-    let target_id = ProviderTargetId::new("local-host");
+    let target_id = ProviderTargetId::new("local-host").expect("target id");
     let environment_id = EnvironmentId::new("instance-local");
     let session_id = SessionId::new("session-env");
 
@@ -2017,11 +2017,10 @@ async fn pg_live_universe_environments_are_independent_of_sessions() {
         .put_provider(PutEnvironmentProvider {
             provider_id: provider_id.clone(),
             display_name: Some("Local bridge".to_owned()),
-            controller_connection: EnvironmentConnectionSpec::new(
-                "ws://127.0.0.1:9000/controller",
-                EnvironmentTransport::WebSocket,
-            ),
+            controller_endpoint: EnvironmentEndpoint::parse("ws://127.0.0.1:9000/controller")
+                .expect("endpoint"),
             metadata: Default::default(),
+            credential: Some(SecretValue::new("bridge-credential")),
             updated_at_ms: 10,
         })
         .await
@@ -2072,7 +2071,8 @@ async fn pg_live_universe_environments_are_independent_of_sessions() {
     let instance = store
         .observe_provisioned_environment(ObserveProvisionedEnvironment {
             environment_id: environment_id.clone(),
-            provider_target_id: target_id.clone(),
+            provider_target_id: Some(target_id.clone()),
+            daemon_build: None,
             status: EnvironmentStatus::Offline,
             power_states: vec![
                 environments::PowerState::Running,
@@ -2104,7 +2104,7 @@ async fn pg_live_universe_environments_are_independent_of_sessions() {
     // Offline while desired running: the reconciler must pick it up.
     assert!(
         store
-            .list_environments_needing_reconcile()
+            .list_environments_needing_reconcile(environments::ReconcileScope::Converging)
             .await
             .expect("needing reconcile")
             .iter()
@@ -2132,7 +2132,16 @@ async fn pg_live_universe_environments_are_independent_of_sessions() {
     );
     assert!(
         !store
-            .list_environments_needing_reconcile()
+            .list_environments_needing_reconcile(environments::ReconcileScope::Converging)
+            .await
+            .expect("needing reconcile")
+            .iter()
+            .any(|record| record.environment_id == environment_id)
+    );
+    // A steady pass observes it anyway.
+    assert!(
+        store
+            .list_environments_needing_reconcile(environments::ReconcileScope::WithSteady)
             .await
             .expect("needing reconcile")
             .iter()
@@ -2141,7 +2150,8 @@ async fn pg_live_universe_environments_are_independent_of_sessions() {
     let ready = store
         .observe_provisioned_environment(ObserveProvisionedEnvironment {
             environment_id: environment_id.clone(),
-            provider_target_id: target_id.clone(),
+            provider_target_id: Some(target_id.clone()),
+            daemon_build: None,
             status: EnvironmentStatus::Ready,
             power_states: vec![environments::PowerState::Running],
             observed_at_ms: 32,
@@ -2175,7 +2185,8 @@ async fn pg_live_universe_environments_are_independent_of_sessions() {
     let instance = store
         .observe_provisioned_environment(ObserveProvisionedEnvironment {
             environment_id: environment_id.clone(),
-            provider_target_id: target_id.clone(),
+            provider_target_id: Some(target_id.clone()),
+            daemon_build: None,
             status: EnvironmentStatus::Offline,
             power_states: vec![environments::PowerState::Running],
             observed_at_ms: 35,
@@ -2785,6 +2796,211 @@ fn create_oauth_client_record(client_id: &OAuthClientId) -> CreateOAuthClientRec
     }
 }
 
+#[tokio::test(flavor = "current_thread")]
+#[ignore = "requires ./dev.sh infra or compatible Postgres + MinIO env"]
+async fn pg_live_environment_lifecycle_guards_and_provider_facts() {
+    use environments::{
+        FailEnvironmentLifecycle, RecordEnvironmentLifecycleError, RecordProviderController,
+    };
+
+    let store = live_store("environment-guards", 1024).await;
+    let suffix = Uuid::new_v4().simple().to_string();
+    let provider_id = EnvironmentProviderId::new(format!("guard-provider-{suffix}"));
+    let endpoint = EnvironmentEndpoint::parse("ws://127.0.0.1:9100/control").expect("endpoint");
+
+    // The credential is required for a new provider, sealed at rest, and
+    // kept by a later put that omits it.
+    let refused = store
+        .put_provider(PutEnvironmentProvider {
+            provider_id: provider_id.clone(),
+            display_name: None,
+            controller_endpoint: endpoint.clone(),
+            metadata: Default::default(),
+            credential: None,
+            updated_at_ms: 1,
+        })
+        .await;
+    assert!(matches!(
+        refused,
+        Err(environments::EnvironmentRegistryError::InvalidInput { .. })
+    ));
+    store
+        .put_provider(PutEnvironmentProvider {
+            provider_id: provider_id.clone(),
+            display_name: None,
+            controller_endpoint: endpoint.clone(),
+            metadata: Default::default(),
+            credential: Some(SecretValue::new("guard-bearer-secret")),
+            updated_at_ms: 1,
+        })
+        .await
+        .expect("register provider");
+    let ciphertext: Vec<u8> = sqlx::query_scalar(
+        "SELECT credential_ciphertext FROM environment_providers WHERE provider_id = $1",
+    )
+    .bind(provider_id.as_str())
+    .fetch_one(store.pool())
+    .await
+    .expect("read sealed credential");
+    assert!(
+        !ciphertext
+            .windows(b"guard-bearer-secret".len())
+            .any(|window| window == b"guard-bearer-secret")
+    );
+    let base = DataRouteBase::new("ws://127.0.0.1:9100/data").expect("base");
+    let recorded = store
+        .record_provider_controller(RecordProviderController {
+            provider_id: provider_id.clone(),
+            controller_endpoint: endpoint.clone(),
+            features: ControllerFeatures {
+                adopt_target: false,
+                ingress: true,
+            },
+            data_route_base: base.clone(),
+        })
+        .await
+        .expect("record controller");
+    assert_eq!(recorded.data_route_base, Some(base));
+    let renamed = store
+        .put_provider(PutEnvironmentProvider {
+            provider_id: provider_id.clone(),
+            display_name: Some("Guard".to_owned()),
+            controller_endpoint: endpoint.clone(),
+            metadata: Default::default(),
+            credential: None,
+            updated_at_ms: 2,
+        })
+        .await
+        .expect("rename provider");
+    assert_eq!(renamed.controller_features, recorded.controller_features);
+    assert_eq!(
+        store
+            .read_provider_credential(&provider_id)
+            .await
+            .expect("credential")
+            .expose(),
+        "guard-bearer-secret"
+    );
+
+    store
+        .put_provider_binding(PutEnvironmentProviderBinding {
+            universe_id: store.config().universe_id,
+            binding_id: EnvironmentProviderBindingId::new("primary"),
+            provider_id: provider_id.clone(),
+            status: EnvironmentProviderBindingStatus::Enabled,
+            metadata: Default::default(),
+            expected_revision: None,
+            updated_at_ms: 3,
+        })
+        .await
+        .expect("provider binding");
+    let create = |request: &str, environment: &str| CreateEnvironment {
+        request_id: EnvironmentProvisionRequestId::new(request),
+        environment_id: EnvironmentId::new(environment),
+        incarnation_id: EnvironmentIncarnationId::new(format!("{environment}-inc")),
+        binding_id: EnvironmentProviderBindingId::new("primary"),
+        template_id: EnvironmentTemplateId::new("rust-v1"),
+        display_name: None,
+        metadata: Default::default(),
+        idle_policy: None,
+        created_at_ms: 10,
+    };
+
+    // A close accepted while a create was in flight wins over its answer,
+    // and the target id is still recorded so the close can address it.
+    let closing = store
+        .create_environment(create("guard-request", "guard-env"))
+        .await
+        .expect("create");
+    store
+        .begin_close_environment(BeginCloseEnvironment {
+            environment_id: closing.environment_id.clone(),
+            updated_at_ms: 11,
+        })
+        .await
+        .expect("begin close");
+    let natural = ProviderTargetId::new("default/pod-abc").expect("opaque target id");
+    let observed = store
+        .observe_provisioned_environment(ObserveProvisionedEnvironment {
+            environment_id: closing.environment_id.clone(),
+            provider_target_id: Some(natural.clone()),
+            status: EnvironmentStatus::Ready,
+            power_states: vec![environments::PowerState::Running],
+            daemon_build: None,
+            observed_at_ms: 12,
+        })
+        .await
+        .expect("observe");
+    assert_eq!(observed.status, EnvironmentStatus::Closing);
+    assert_eq!(observed.incarnation.provider_target_id, Some(natural));
+    let failed = store
+        .fail_environment_lifecycle(FailEnvironmentLifecycle {
+            environment_id: closing.environment_id.clone(),
+            message: "late failure".to_owned(),
+            daemon_build: None,
+            observed_at_ms: 13,
+        })
+        .await
+        .expect("fail");
+    assert_eq!(failed.status, EnvironmentStatus::Closing);
+
+    // Lifecycle errors keep the start of their run and leave the status.
+    let erroring = store
+        .create_environment(create("guard-request-2", "guard-env-2"))
+        .await
+        .expect("create second");
+    for at in [20, 30] {
+        store
+            .record_environment_lifecycle_error(RecordEnvironmentLifecycleError {
+                environment_id: erroring.environment_id.clone(),
+                message: format!("controller unavailable at {at}"),
+                observed_at_ms: at,
+            })
+            .await
+            .expect("record error");
+    }
+    let still = store
+        .read_environment(&erroring.environment_id)
+        .await
+        .expect("read");
+    assert_eq!(still.status, EnvironmentStatus::Provisioning);
+    let error = still.lifecycle_error.expect("lifecycle error");
+    assert_eq!((error.first_at_ms, error.last_at_ms), (20, 30));
+
+    // A row that no longer decodes is skipped by listings instead of
+    // failing them.
+    let poisoned = store
+        .create_environment(create("guard-request-3", "guard-env-3"))
+        .await
+        .expect("create third");
+    let oversized: serde_json::Map<String, serde_json::Value> = (0..40)
+        .map(|index| (format!("key{index}"), serde_json::json!("v")))
+        .collect();
+    sqlx::query(
+        "UPDATE environments SET metadata_json = $3 WHERE universe_id = $1 AND environment_id = $2",
+    )
+    .bind(store.config().universe_id)
+    .bind(poisoned.environment_id.as_str())
+    .bind(serde_json::Value::Object(oversized))
+    .execute(store.pool())
+    .await
+    .expect("poison row");
+    let listed = store
+        .list_environments(ListEnvironments::default())
+        .await
+        .expect("list despite a bad row");
+    assert!(
+        listed
+            .iter()
+            .all(|record| record.environment_id != poisoned.environment_id)
+    );
+    assert!(
+        listed
+            .iter()
+            .any(|record| record.environment_id == erroring.environment_id)
+    );
+}
+
 #[tokio::test(flavor = "current_thread")]
 #[ignore = "requires ./dev.sh infra or compatible Postgres env"]
 async fn pg_live_environment_credentials_round_trip() {
@@ -2800,11 +3016,10 @@ async fn pg_live_environment_credentials_round_trip() {
         .put_provider(PutEnvironmentProvider {
             provider_id: provider_id.clone(),
             display_name: None,
-            controller_connection: EnvironmentConnectionSpec::new(
-                "ws://127.0.0.1:9000/controller",
-                EnvironmentTransport::WebSocket,
-            ),
+            controller_endpoint: EnvironmentEndpoint::parse("ws://127.0.0.1:9000/controller")
+                .expect("endpoint"),
             metadata: Default::default(),
+            credential: Some(SecretValue::new("cred-provider-credential")),
             updated_at_ms: 1,
         })
         .await
diff --git a/crates/temporal-runtime/Cargo.toml b/crates/temporal-runtime/Cargo.toml
index 32c74dd9c..c6ffa87fc 100644
--- a/crates/temporal-runtime/Cargo.toml
+++ b/crates/temporal-runtime/Cargo.toml
@@ -63,6 +63,7 @@ url = "2"
 
 [dev-dependencies]
 test-support = { path = "../test-support" }
+environment-client = { path = "../environment-client", features = ["conformance"] }
 dotenvy = "0.15"
 environment-daemon = { path = "../environment-daemon" }
 futures-util = "0.3"
diff --git a/crates/temporal-runtime/src/bots/fires.rs b/crates/temporal-runtime/src/bots/fires.rs
index 48d5aa120..e34cd051b 100644
--- a/crates/temporal-runtime/src/bots/fires.rs
+++ b/crates/temporal-runtime/src/bots/fires.rs
@@ -363,10 +363,7 @@ pub(crate) fn exec_request_id(trigger_id: &BotTriggerId, scheduled_at_ms: i64) -
 pub(crate) fn is_terminal_job_status(status: SessionJobStatusView) -> bool {
     !matches!(
         status,
-        SessionJobStatusView::Accepted
-            | SessionJobStatusView::Queued
-            | SessionJobStatusView::Running
-            | SessionJobStatusView::CancelRequested
+        SessionJobStatusView::Queued | SessionJobStatusView::Running
     )
 }
 
@@ -808,16 +805,16 @@ async fn fetch_exec_payload(
     };
     let deadline =
         Instant::now() + Duration::from_millis(budget_ms.saturating_add(EXEC_DEADLINE_SLACK_MS));
-    let mut after_seq = None;
+    let mut after = None;
     let mut stdout: Vec<u8> = Vec::new();
     let mut stderr_tail: Vec<u8> = Vec::new();
     loop {
         let read = api
             .read_environment_jobs(EnvironmentJobReadParams {
                 jobs: vec![handle.clone()],
-                output_bytes: None,
-                after_seq,
-                include_artifacts: false,
+                max_bytes: None,
+                after,
+                tail_bytes: None,
             })
             .await
             .map_err(|error| map_job_api_error("read poll command", error))?;
@@ -842,11 +839,13 @@ async fn fetch_exec_payload(
                 }
             }
         }
-        if stdout.len() > MAX_POLL_PAYLOAD_BYTES {
+        // A gap means the environment dropped output it could not retain,
+        // so stdout can no longer be a complete payload.
+        if stdout.len() > MAX_POLL_PAYLOAD_BYTES || !entry.output_gaps.is_empty() {
             cancel_job(api, &handle).await;
             return Err(payload_too_large("stdout"));
         }
-        after_seq = Some(entry.output_next_seq);
+        after = Some(entry.output_next);
         if let Some(summary) = entry.summary
             && is_terminal_job_status(summary.status)
         {
@@ -1172,12 +1171,7 @@ mod tests {
 
     #[test]
     fn job_statuses_split_into_running_and_terminal() {
-        for status in [
-            SessionJobStatusView::Accepted,
-            SessionJobStatusView::Queued,
-            SessionJobStatusView::Running,
-            SessionJobStatusView::CancelRequested,
-        ] {
+        for status in [SessionJobStatusView::Queued, SessionJobStatusView::Running] {
             assert!(!is_terminal_job_status(status), "{status:?}");
         }
         for status in [
@@ -1187,7 +1181,6 @@ mod tests {
             SessionJobStatusView::TimedOut,
             SessionJobStatusView::DependencyFailed,
             SessionJobStatusView::Interrupted,
-            SessionJobStatusView::Lost,
         ] {
             assert!(is_terminal_job_status(status), "{status:?}");
         }
diff --git a/crates/temporal-runtime/src/config.rs b/crates/temporal-runtime/src/config.rs
index 930632c73..9ee9f059f 100644
--- a/crates/temporal-runtime/src/config.rs
+++ b/crates/temporal-runtime/src/config.rs
@@ -41,24 +41,6 @@ pub enum GatewayAuthMode {
     Authenticated,
 }
 
-/// Optional base URL outbound daemons are told to dial for data connections
-/// when it differs from the general public base URL (for example a dedicated
-/// hostname in front of the environment gateway).
-pub fn environment_public_url_from_env() -> anyhow::Result<Option<String>> {
-    let Some(value) = optional_env("LIGHTSPEED_ENVIRONMENT_PUBLIC_URL") else {
-        return Ok(None);
-    };
-    if !["https://", "http://", "wss://", "ws://"]
-        .iter()
-        .any(|scheme| value.starts_with(scheme))
-    {
-        anyhow::bail!(
-            "LIGHTSPEED_ENVIRONMENT_PUBLIC_URL must be an http(s) or ws(s) URL, got {value:?}"
-        );
-    }
-    Ok(Some(value.trim_end_matches('/').to_owned()))
-}
-
 pub fn gateway_auth_mode_from_env() -> anyhow::Result<GatewayAuthMode> {
     if optional_env("LIGHTSPEED_UNIVERSE_AUTO_CREATE").is_some() {
         anyhow::bail!(
diff --git a/crates/temporal-runtime/src/credential_injection.rs b/crates/temporal-runtime/src/credential_injection.rs
index a12c20ad4..593b11513 100644
--- a/crates/temporal-runtime/src/credential_injection.rs
+++ b/crates/temporal-runtime/src/credential_injection.rs
@@ -8,8 +8,14 @@ use auth::{
     RegistryTokenBroker, SecretStore, TokenAudience,
 };
 use environment_protocol::{
-    data::jobs::{StartJobsParams, StartJobsResponse},
-    shared::SecretString,
+    bytes::SecretString,
+    data::{
+        handshake::JobLimits,
+        job::{
+            CancelJobsParams, CancelJobsResponse, ReadJobsParams, ReadJobsResponse,
+            StartJobsParams, StartJobsResponse,
+        },
+    },
 };
 use environments::{
     EnvironmentCredentialSource, EnvironmentCredentialStore, EnvironmentId,
@@ -245,33 +251,29 @@ struct CredentialInjectingJobExecutor {
 
 #[async_trait]
 impl JobExecutor for CredentialInjectingJobExecutor {
+    fn limits(&self) -> Option<JobLimits> {
+        self.inner.limits()
+    }
+
     async fn start_jobs(&self, mut request: StartJobsParams) -> JobExecResult<StartJobsResponse> {
         for job in &mut request.jobs {
             let secret_env = self
                 .resolver
-                .resolve_secret_env(&self.environment_id, &job.env)
+                .resolve_secret_env(&self.environment_id, &job.command.env)
                 .await
                 .map_err(|error| JobError::InvalidRequest {
                     message: error.to_string(),
                 })?;
-            for (name, value) in secret_env {
-                job.secret_env.insert(name, value);
-            }
+            job.command.secret_env.extend(secret_env);
         }
         self.inner.start_jobs(request).await
     }
 
-    async fn read_jobs(
-        &self,
-        request: environment_protocol::data::jobs::ReadJobsParams,
-    ) -> JobExecResult<environment_protocol::data::jobs::ReadJobsResponse> {
+    async fn read_jobs(&self, request: ReadJobsParams) -> JobExecResult<ReadJobsResponse> {
         self.inner.read_jobs(request).await
     }
 
-    async fn cancel_jobs(
-        &self,
-        request: environment_protocol::data::jobs::CancelJobsParams,
-    ) -> JobExecResult<environment_protocol::data::jobs::CancelJobsResponse> {
+    async fn cancel_jobs(&self, request: CancelJobsParams) -> JobExecResult<CancelJobsResponse> {
         self.inner.cancel_jobs(request).await
     }
 }
@@ -411,6 +413,114 @@ mod tests {
         assert_eq!(resolved["GH_TOKEN"].expose(), "environment-token");
     }
 
+    #[derive(Default)]
+    struct RecordingJobExecutor {
+        started: std::sync::Mutex<Vec<StartJobsParams>>,
+    }
+
+    #[async_trait]
+    impl JobExecutor for RecordingJobExecutor {
+        fn limits(&self) -> Option<JobLimits> {
+            Some(JobLimits {
+                max_read_bytes: 1024,
+                max_request_jobs: 4,
+                max_retained_output_bytes: 2048,
+                record_retention_ms: 1,
+                cancel_grace_ms: 1,
+            })
+        }
+
+        async fn start_jobs(&self, request: StartJobsParams) -> JobExecResult<StartJobsResponse> {
+            self.started.lock().unwrap().push(request);
+            Err(JobError::Failed {
+                message: "recorded".to_owned(),
+            })
+        }
+
+        async fn read_jobs(&self, _request: ReadJobsParams) -> JobExecResult<ReadJobsResponse> {
+            unreachable!("not read")
+        }
+
+        async fn cancel_jobs(
+            &self,
+            _request: CancelJobsParams,
+        ) -> JobExecResult<CancelJobsResponse> {
+            unreachable!("not cancelled")
+        }
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn job_wrapper_injects_credentials_into_each_command_and_keeps_limits() {
+        let environment_id = EnvironmentId::new("environment_1");
+        let secret_id = SecretId::new("secret_1");
+        let secrets = Arc::new(InMemorySecretStore::new());
+        secrets
+            .put_secret(PutSecretRecord {
+                secret_id: secret_id.clone(),
+                secret_kind: SECRET_KIND_STATIC_BEARER.to_owned(),
+                value: SecretValue::new("environment-token"),
+                created_at_ms: 1,
+            })
+            .await
+            .expect("store secret");
+        let resolver = EnvironmentCredentialResolver::new(
+            Arc::new(FixedCredentialStore {
+                credentials: vec![EnvironmentCredentialRecord {
+                    environment_id: environment_id.clone(),
+                    env_name: "GH_TOKEN".to_owned(),
+                    source: EnvironmentCredentialSource::DirectSecret { secret_id },
+                    created_at_ms: 1,
+                    updated_at_ms: 1,
+                }],
+            }),
+            Arc::new(InMemoryAuthGrantStore::new()),
+            Arc::new(InMemoryAuthProviderStore::new()),
+            secrets,
+            None,
+        );
+        let inner = Arc::new(RecordingJobExecutor::default());
+        let wrapper = CredentialInjectingJobExecutor {
+            inner: inner.clone(),
+            resolver,
+            environment_id,
+        };
+        assert_eq!(
+            wrapper.limits().map(|limits| limits.max_request_jobs),
+            Some(4)
+        );
+
+        let job = |job_id: &str| environment_protocol::data::job::JobSpec {
+            job_id: environment_protocol::ids::JobId::new(job_id).unwrap(),
+            name: None,
+            command: environment_protocol::data::exec::CommandSpec {
+                argv: vec!["true".to_owned()],
+                cwd: None,
+                env: BTreeMap::from([("CI".to_owned(), "1".to_owned())]),
+                secret_env: BTreeMap::new(),
+                input: Default::default(),
+                timeout_ms: None,
+            },
+            depends_on: Vec::new(),
+            dependency_policy: Default::default(),
+            queue_key: None,
+        };
+        let _ = wrapper
+            .start_jobs(StartJobsParams {
+                request_id: environment_protocol::ids::JobRequestId::new("req-1").unwrap(),
+                jobs: vec![job("a"), job("b")],
+            })
+            .await;
+
+        let started = inner.started.lock().unwrap();
+        for job in &started[0].jobs {
+            assert_eq!(
+                job.command.secret_env["GH_TOKEN"].expose(),
+                "environment-token"
+            );
+            assert_eq!(job.command.env["CI"], "1");
+        }
+    }
+
     #[test]
     fn default_grant_audience_is_environment_scoped() {
         let grant = AuthGrantRecord {
diff --git a/crates/temporal-runtime/src/environments/fake_controller.rs b/crates/temporal-runtime/src/environments/fake_controller.rs
new file mode 100644
index 000000000..4879a081d
--- /dev/null
+++ b/crates/temporal-runtime/src/environments/fake_controller.rs
@@ -0,0 +1,754 @@
+//! An in-memory provider controller for tests.
+//!
+//! It serves the controller plane on `/control` and a minimal data plane on
+//! `/routes/{universeId}/{bindingId}/{environmentId}/{incarnationId}/{targetId}`
+//! over a loopback WebSocket listener, and checks the provider credential
+//! as a bearer token on both, exactly as a real provider must. Nothing
+//! registers it: a test starts one and registers its controller URL and
+//! credential like any provider's.
+//!
+//! Targets come up at once: `target/create` answers an `active`, `running`
+//! target whose daemon is ready, and power changes and closes complete
+//! before they answer. The data route answers `initialize` only, as an envd
+//! with no capability families, which is enough for the runtime's
+//! data-plane handshake at the Ready transition.
+
+use std::{
+    collections::BTreeMap,
+    hash::{DefaultHasher, Hash, Hasher},
+    sync::Arc,
+};
+
+use axum::{
+    Router,
+    extract::{
+        Path, State,
+        ws::{Message, WebSocket, WebSocketUpgrade},
+    },
+    http::{HeaderMap, StatusCode, header},
+    response::{IntoResponse, Response},
+    routing::get,
+};
+use environment_protocol::{
+    CONTROLLER_PROTOCOL_VERSION, ENVD_PROTOCOL_VERSION,
+    control::{
+        handshake::{
+            ControllerCapabilities, ControllerInitializeParams, ControllerInitializeResponse,
+            ControllerRoutes,
+        },
+        ingress::{EnsureIngressParams, RemoveIngressParams},
+        target::{
+            AdoptTargetParams, CloseTargetParams, CreateTargetParams, GetTargetParams,
+            IngressObservation, PowerState, SetTargetPowerParams, TargetObservation, TargetOwner,
+            TargetPhase, TargetRef, TargetResponse, TargetState,
+        },
+        template::{EnvironmentTemplate, ListTemplatesResponse, TemplateResources},
+    },
+    data::handshake::{
+        DataCapabilities, DataLimits, FilesystemLimits, GlobCeilings, InitializeParams,
+        InitializeResponse, JobLimits, ProcessLimits, ScanCeilings, SearchCeilings,
+        TransferCeilings,
+    },
+    error::{Capability, PreconditionReason, ProtocolError, ProtocolErrorKind},
+    handshake::{ImplementationInfo, Plane},
+    ids::{
+        BindingId, DaemonInstanceId, EnvironmentId, IncarnationId, ProviderTargetId, TemplateId,
+        UniverseId,
+    },
+    jsonrpc::{self, Request, Response as RpcResponse},
+    limits::{MAX_MESSAGE_BYTES, MIN_CONCURRENT_REQUESTS},
+    manifest::{
+        ControllerInitialize, IngressEnsure, IngressRemove, RequestMethod, TargetAdopt,
+        TargetClose, TargetCreate, TargetGet, TargetSetPower, TemplateList,
+    },
+    metadata::{DescriptiveText, DisplayName, Metadata},
+    paths::EnvironmentPath,
+    routes::{DataRouteBase, PublicUrl},
+};
+use futures_util::{SinkExt, StreamExt};
+use serde::{Serialize, de::DeserializeOwned};
+use serde_json::Value;
+use tokio::{net::TcpListener, sync::Mutex, task::JoinHandle};
+
+/// The one template the fake controller offers.
+pub const FAKE_TEMPLATE_ID: &str = "rust-v1";
+
+/// Public endpoint the fake controller reports for enabled ingress.
+pub const FAKE_INGRESS_ENDPOINT: &str = "https://fake.env.test";
+
+/// Power states the fake controller supports. Suspended is included so the
+/// suspend path has coverage.
+pub const FAKE_POWER_STATES: [PowerState; 4] = [
+    PowerState::Running,
+    PowerState::Paused,
+    PowerState::Suspended,
+    PowerState::Stopped,
+];
+
+/// What the fake controller advertises.
+#[derive(Clone, Debug)]
+pub struct FakeControllerOptions {
+    /// `capabilities.adoptTarget`.
+    pub adopt_target: bool,
+    /// `capabilities.ingress`.
+    pub ingress: bool,
+    /// The protocol version the fake envd behind every data route speaks.
+    pub daemon_protocol_version: u32,
+}
+
+impl Default for FakeControllerOptions {
+    fn default() -> Self {
+        Self {
+            adopt_target: true,
+            ingress: true,
+            daemon_protocol_version: ENVD_PROTOCOL_VERSION,
+        }
+    }
+}
+
+/// A running fake controller. Dropping it stops the listener.
+pub struct FakeController {
+    controller_url: String,
+    credential: String,
+    task: JoinHandle<()>,
+}
+
+impl FakeController {
+    /// Serve a fake controller with the default options on a loopback port.
+    pub async fn start() -> std::io::Result<Self> {
+        Self::start_with(FakeControllerOptions::default()).await
+    }
+
+    pub async fn start_with(options: FakeControllerOptions) -> std::io::Result<Self> {
+        let listener = TcpListener::bind("127.0.0.1:0").await?;
+        let address = listener.local_addr()?;
+        let credential = format!("fake-credential-{}", uuid::Uuid::new_v4().simple());
+        let data = DataRouteBase::new(format!("ws://{address}/routes"))
+            .map_err(|error| std::io::Error::other(error.to_string()))?;
+        let initialize = ControllerInitializeResponse {
+            protocol_version: CONTROLLER_PROTOCOL_VERSION,
+            plane: Plane::Controller,
+            server_info: implementation("lightspeed-fake-controller"),
+            capabilities: ControllerCapabilities {
+                adopt_target: options.adopt_target,
+                ingress: options.ingress,
+            },
+            routes: ControllerRoutes { data },
+        };
+        let app = Arc::new(App {
+            credential: credential.clone(),
+            options,
+            initialize,
+            targets: Mutex::new(Targets::default()),
+        });
+        let router = Router::new()
+            .route("/control", get(control_upgrade))
+            .route(
+                "/routes/{universe}/{binding}/{environment}/{incarnation}/{target}",
+                get(data_upgrade),
+            )
+            .with_state(app);
+        let task = tokio::spawn(async move {
+            let _ = axum::serve(listener, router).await;
+        });
+        Ok(Self {
+            controller_url: format!("ws://{address}/control"),
+            credential,
+            task,
+        })
+    }
+
+    /// The controller URL to register the provider with.
+    pub fn controller_url(&self) -> &str {
+        &self.controller_url
+    }
+
+    /// The provider credential the controller and its data routes accept.
+    pub fn credential(&self) -> &str {
+        &self.credential
+    }
+}
+
+impl Drop for FakeController {
+    fn drop(&mut self) {
+        self.task.abort();
+    }
+}
+
+struct App {
+    credential: String,
+    options: FakeControllerOptions,
+    initialize: ControllerInitializeResponse,
+    targets: Mutex<Targets>,
+}
+
+#[derive(Default)]
+struct Targets {
+    by_id: BTreeMap<ProviderTargetId, FakeTarget>,
+    by_owner: BTreeMap<TargetOwner, ProviderTargetId>,
+}
+
+#[derive(Clone)]
+struct FakeTarget {
+    target_id: ProviderTargetId,
+    owner: TargetOwner,
+    power: PowerState,
+    ingress: bool,
+    metadata: Metadata,
+}
+
+impl FakeTarget {
+    fn observation(&self) -> TargetObservation {
+        TargetObservation {
+            target_id: Some(self.target_id.clone()),
+            owner: self.owner.clone(),
+            display_name: DisplayName::new(self.owner.environment_id.as_str()).ok(),
+            state: TargetState {
+                phase: TargetPhase::Active,
+                power: Some(self.power),
+                daemon_ready: self.power == PowerState::Running,
+                message: None,
+            },
+            supported_power_states: FAKE_POWER_STATES.to_vec(),
+            ingress: self.ingress.then(|| IngressObservation {
+                endpoint: PublicUrl::new(FAKE_INGRESS_ENDPOINT).expect("valid fake endpoint"),
+            }),
+            metadata: self.metadata.clone(),
+        }
+    }
+}
+
+fn implementation(name: &str) -> ImplementationInfo {
+    ImplementationInfo::new(name)
+        .and_then(|info| info.with_version(env!("CARGO_PKG_VERSION")))
+        .expect("fake implementation info is within bounds")
+}
+
+fn authorized(app: &App, headers: &HeaderMap) -> bool {
+    headers
+        .get(header::AUTHORIZATION)
+        .and_then(|value| value.to_str().ok())
+        .and_then(|value| value.strip_prefix("Bearer "))
+        .is_some_and(|token| constant_time_eq(token.as_bytes(), app.credential.as_bytes()))
+}
+
+fn constant_time_eq(left: &[u8], right: &[u8]) -> bool {
+    left.len() == right.len()
+        && left
+            .iter()
+            .zip(right)
+            .fold(0_u8, |difference, (left, right)| {
+                difference | (left ^ right)
+            })
+            == 0
+}
+
+fn unauthorized() -> Response {
+    (
+        StatusCode::UNAUTHORIZED,
+        [(header::WWW_AUTHENTICATE, "Bearer")],
+    )
+        .into_response()
+}
+
+fn with_limits(upgrade: WebSocketUpgrade) -> WebSocketUpgrade {
+    upgrade
+        .max_message_size(MAX_MESSAGE_BYTES as usize)
+        .max_frame_size(MAX_MESSAGE_BYTES as usize)
+}
+
+async fn control_upgrade(
+    State(app): State<Arc<App>>,
+    headers: HeaderMap,
+    upgrade: WebSocketUpgrade,
+) -> Response {
+    if !authorized(&app, &headers) {
+        return unauthorized();
+    }
+    with_limits(upgrade)
+        .on_upgrade(move |socket| serve(socket, Plane::Controller, app))
+        .into_response()
+}
+
+async fn data_upgrade(
+    State(app): State<Arc<App>>,
+    Path((universe, binding, environment, incarnation, target_id)): Path<(
+        String,
+        String,
+        String,
+        String,
+        String,
+    )>,
+    headers: HeaderMap,
+    upgrade: WebSocketUpgrade,
+) -> Response {
+    if !authorized(&app, &headers) {
+        return unauthorized();
+    }
+    let (Ok(universe_id), Ok(binding_id), Ok(environment_id), Ok(incarnation_id), Ok(target_id)) = (
+        UniverseId::new(universe),
+        BindingId::new(binding),
+        EnvironmentId::new(environment),
+        IncarnationId::new(incarnation),
+        ProviderTargetId::new(target_id),
+    ) else {
+        return StatusCode::NOT_FOUND.into_response();
+    };
+    let owner = TargetOwner {
+        universe_id,
+        binding_id,
+        environment_id,
+        incarnation_id,
+    };
+    match app.targets.lock().await.by_id.get(&target_id) {
+        Some(target) if target.owner != owner => return StatusCode::NOT_FOUND.into_response(),
+        Some(target) if target.power != PowerState::Running => {
+            return StatusCode::SERVICE_UNAVAILABLE.into_response();
+        }
+        Some(_) => {}
+        None => return StatusCode::NOT_FOUND.into_response(),
+    }
+    with_limits(upgrade)
+        .on_upgrade(move |socket| serve(socket, Plane::Data, app))
+        .into_response()
+}
+
+/// One connection: the envelope and the `initialize`-first handshake,
+/// requests answered in order.
+async fn serve(socket: WebSocket, plane: Plane, app: Arc<App>) {
+    let (mut sink, mut stream) = socket.split();
+    let mut initialized = false;
+    while let Some(Ok(frame)) = stream.next().await {
+        let reply = match frame {
+            Message::Text(text) => match jsonrpc::parse(text.as_str()) {
+                Err(rejection) => rejection.into_response(),
+                Ok(jsonrpc::Message::Request(request)) => {
+                    Some(if request.method == ControllerInitialize::NAME {
+                        initialize(&app, plane, &mut initialized, &request)
+                    } else if !initialized {
+                        RpcResponse::failure(Some(request.id), ProtocolError::not_initialized())
+                    } else {
+                        let result = match plane {
+                            Plane::Controller => controller_call(&app, &request).await,
+                            _ => Err(ProtocolError::method_not_found(&request.method)),
+                        };
+                        RpcResponse {
+                            id: Some(request.id),
+                            result,
+                        }
+                    })
+                }
+                Ok(jsonrpc::Message::Notification(_) | jsonrpc::Message::Response(_)) => None,
+            },
+            Message::Binary(_) => Some(RpcResponse::failure(
+                None,
+                ProtocolError::invalid_request("binary frames are not part of any plane"),
+            )),
+            Message::Ping(payload) => {
+                if sink.send(Message::Pong(payload)).await.is_err() {
+                    break;
+                }
+                None
+            }
+            Message::Pong(_) => None,
+            Message::Close(_) => break,
+        };
+        if let Some(reply) = reply
+            && sink
+                .send(Message::Text(reply.to_text().into()))
+                .await
+                .is_err()
+        {
+            break;
+        }
+    }
+    let _ = sink.close().await;
+}
+
+fn initialize(app: &App, plane: Plane, initialized: &mut bool, request: &Request) -> RpcResponse {
+    let id = Some(request.id.clone());
+    if *initialized {
+        return RpcResponse::failure(
+            id,
+            ProtocolError::invalid_request("initialize was already called on this connection"),
+        );
+    }
+    let expected = match plane {
+        Plane::Controller => CONTROLLER_PROTOCOL_VERSION,
+        _ => app.options.daemon_protocol_version,
+    };
+    if let Some(version) = request
+        .params
+        .get("protocolVersion")
+        .and_then(Value::as_u64)
+        && version != u64::from(expected)
+    {
+        return RpcResponse::failure(
+            id,
+            ProtocolError::version_mismatch(expected, u32::try_from(version).unwrap_or(u32::MAX)),
+        );
+    }
+    let result = match plane {
+        Plane::Controller => request
+            .params::<ControllerInitializeParams>()
+            .and_then(|_| encode(&app.initialize)),
+        _ => request
+            .params::<InitializeParams>()
+            .and_then(|_| encode(&data_initialize(expected))),
+    };
+    if result.is_ok() {
+        *initialized = true;
+    }
+    RpcResponse { id, result }
+}
+
+/// The fake envd's handshake: no capability families, so a client that
+/// needs one is refused before calling anything.
+fn data_initialize(protocol_version: u32) -> InitializeResponse {
+    InitializeResponse {
+        protocol_version,
+        plane: Plane::Data,
+        daemon_instance_id: DaemonInstanceId::new(format!(
+            "envd_{}",
+            uuid::Uuid::new_v4().simple()
+        ))
+        .expect("valid daemon instance id"),
+        server_info: implementation("lightspeed-fake-envd"),
+        capabilities: DataCapabilities::default(),
+        limits: DataLimits {
+            max_concurrent_requests: MIN_CONCURRENT_REQUESTS,
+            max_wait_ms: 60_000,
+            process: ProcessLimits {
+                max_read_bytes: 1 << 20,
+                max_retained_output_bytes: 1 << 20,
+                retention_after_exit_ms: 60_000,
+                unread_retention_ms: 60_000,
+                max_exited_retained_bytes: 1 << 20,
+                terminate_grace_ms: 1_000,
+                max_input_queue_bytes: 1 << 20,
+            },
+            job: JobLimits {
+                max_read_bytes: 1 << 20,
+                max_request_jobs: 1,
+                max_retained_output_bytes: 1 << 20,
+                record_retention_ms: 60_000,
+                cancel_grace_ms: 1_000,
+            },
+            filesystem: FilesystemLimits {
+                max_read_file_bytes: 1 << 20,
+                max_write_file_bytes: 1 << 20,
+                max_directory_entries: 1,
+                search: SearchCeilings {
+                    max_matches: 1,
+                    max_files: 1,
+                    max_bytes: 1,
+                    max_duration_ms: 1_000,
+                    max_line_bytes: 1,
+                },
+                glob: GlobCeilings {
+                    max_matches: 1,
+                    max_files: 1,
+                    max_duration_ms: 1_000,
+                },
+                scan: ScanCeilings {
+                    max_roots: 1,
+                    max_patterns: 1,
+                    max_entries: 1,
+                    max_file_bytes: 1,
+                    max_total_bytes: 1,
+                    max_duration_ms: 1_000,
+                },
+                transfer: TransferCeilings {
+                    max_active_operations: 1,
+                    max_content_chunk_bytes: 1,
+                    max_inventory_page_entries: 1,
+                    receipt_retention_ms: 60_000,
+                    max_entries: 1,
+                    max_depth: 1,
+                    max_file_bytes: 1,
+                    max_total_bytes: 1,
+                    max_manifest_bytes: 1,
+                    max_duration_ms: 1_000,
+                },
+            },
+        },
+        default_cwd: EnvironmentPath::new("/").expect("root path"),
+        home_directory: None,
+    }
+}
+
+fn encode<T: Serialize>(value: &T) -> Result<Value, ProtocolError> {
+    serde_json::to_value(value).map_err(|error| ProtocolError::internal(error.to_string()))
+}
+
+fn params<M: RequestMethod>(request: &Request) -> Result<M::Params, ProtocolError>
+where
+    M::Params: DeserializeOwned,
+{
+    request.params::<M::Params>()
+}
+
+async fn controller_call(app: &App, request: &Request) -> Result<Value, ProtocolError> {
+    let method = request.method.as_str();
+    if method == TemplateList::NAME {
+        params::<TemplateList>(request)?;
+        return encode(&list_templates());
+    }
+    if (method == IngressEnsure::NAME || method == IngressRemove::NAME) && !app.options.ingress {
+        return Err(ProtocolError::capability_unavailable(
+            Capability::Ingress,
+            "the fake controller was started without ingress",
+        ));
+    }
+    if method == TargetAdopt::NAME && !app.options.adopt_target {
+        return Err(ProtocolError::capability_unavailable(
+            Capability::AdoptTarget,
+            "the fake controller was started without adoption",
+        ));
+    }
+    let mut targets = app.targets.lock().await;
+    let observation = match method {
+        TargetCreate::NAME => targets.create(params::<TargetCreate>(request)?)?,
+        TargetAdopt::NAME => targets.adopt(params::<TargetAdopt>(request)?)?,
+        TargetGet::NAME => {
+            let GetTargetParams { target } = params::<TargetGet>(request)?;
+            targets.resolve(&target)?.observation()
+        }
+        TargetSetPower::NAME => targets.set_power(params::<TargetSetPower>(request)?)?,
+        TargetClose::NAME => targets.close(params::<TargetClose>(request)?)?,
+        IngressEnsure::NAME => {
+            let EnsureIngressParams { target } = params::<IngressEnsure>(request)?;
+            targets.set_ingress(&target, true)?
+        }
+        IngressRemove::NAME => {
+            let RemoveIngressParams { target } = params::<IngressRemove>(request)?;
+            targets.set_ingress(&target, false)?
+        }
+        other => return Err(ProtocolError::method_not_found(other)),
+    };
+    encode(&TargetResponse {
+        target: observation,
+    })
+}
+
+fn list_templates() -> ListTemplatesResponse {
+    ListTemplatesResponse {
+        templates: vec![EnvironmentTemplate {
+            template_id: TemplateId::new(FAKE_TEMPLATE_ID).expect("valid template id"),
+            display_name: DisplayName::new("Rust development").expect("valid display name"),
+            description: DescriptiveText::new("Deterministic fake provider template").ok(),
+            public_ingress: true,
+            deprecated: false,
+            resources: Some(TemplateResources {
+                vcpus: Some(2),
+                memory_bytes: Some(4 << 30),
+                disk_bytes: Some(20 << 30),
+            }),
+            metadata: Metadata::default(),
+        }],
+    }
+}
+
+fn owner_mismatch() -> ProtocolError {
+    ProtocolError::failed_precondition(
+        PreconditionReason::OwnerMismatch,
+        "the target belongs to another owner",
+    )
+}
+
+impl Targets {
+    /// The owner's target, or the named one after the ownership fence.
+    fn resolve(&self, target: &TargetRef) -> Result<&FakeTarget, ProtocolError> {
+        let target_id = match &target.target_id {
+            Some(target_id) => target_id,
+            None => self
+                .by_owner
+                .get(&target.owner)
+                .ok_or_else(|| ProtocolError::not_found("the owner holds no target"))?,
+        };
+        let found = self
+            .by_id
+            .get(target_id)
+            .ok_or_else(|| ProtocolError::not_found(format!("unknown target: {target_id}")))?;
+        if found.owner != target.owner {
+            return Err(owner_mismatch());
+        }
+        Ok(found)
+    }
+
+    fn insert(&mut self, owner: TargetOwner, metadata: Metadata) -> TargetObservation {
+        let mut identity = DefaultHasher::new();
+        owner.hash(&mut identity);
+        let target_id = ProviderTargetId::new(format!("fake-{:016x}", identity.finish()))
+            .expect("valid fake target id");
+        let target = FakeTarget {
+            target_id: target_id.clone(),
+            owner: owner.clone(),
+            power: PowerState::Running,
+            ingress: false,
+            metadata,
+        };
+        let observation = target.observation();
+        self.by_owner.insert(owner, target_id.clone());
+        self.by_id.insert(target_id, target);
+        observation
+    }
+
+    fn create(&mut self, params: CreateTargetParams) -> Result<TargetObservation, ProtocolError> {
+        if let Some(target_id) = self.by_owner.get(&params.owner) {
+            return Ok(self.by_id[target_id].observation());
+        }
+        if params.template_id.as_str() != FAKE_TEMPLATE_ID {
+            return Err(ProtocolError::not_found(format!(
+                "unknown template: {}",
+                params.template_id
+            )));
+        }
+        let metadata = Metadata::new(BTreeMap::from([(
+            "imageFingerprint".to_owned(),
+            format!("fake:{}", params.template_id),
+        )]))
+        .expect("valid fake metadata");
+        Ok(self.insert(params.owner, metadata))
+    }
+
+    fn adopt(&mut self, params: AdoptTargetParams) -> Result<TargetObservation, ProtocolError> {
+        let fingerprint = format!("fake:adopted:{}", params.source_target);
+        if let Some(target_id) = self.by_owner.get(&params.owner) {
+            let target = &self.by_id[target_id];
+            return if target.metadata.get("imageFingerprint") == Some(fingerprint.as_str()) {
+                Ok(target.observation())
+            } else {
+                Err(owner_mismatch())
+            };
+        }
+        if self
+            .by_id
+            .values()
+            .any(|target| target.metadata.get("imageFingerprint") == Some(fingerprint.as_str()))
+        {
+            return Err(owner_mismatch());
+        }
+        let metadata = Metadata::new(BTreeMap::from([(
+            "imageFingerprint".to_owned(),
+            fingerprint,
+        )]))
+        .map_err(|error| ProtocolError::invalid_params(error.to_string()))?;
+        Ok(self.insert(params.owner, metadata))
+    }
+
+    fn set_power(
+        &mut self,
+        params: SetTargetPowerParams,
+    ) -> Result<TargetObservation, ProtocolError> {
+        if !FAKE_POWER_STATES.contains(&params.power) {
+            return Err(ProtocolError::invalid_field(
+                "power",
+                format!("unsupported power state {}", params.power),
+            ));
+        }
+        let target_id = self.resolve(&params.target)?.target_id.clone();
+        let target = self.by_id.get_mut(&target_id).expect("resolved target");
+        target.power = params.power;
+        Ok(target.observation())
+    }
+
+    fn close(&mut self, params: CloseTargetParams) -> Result<TargetObservation, ProtocolError> {
+        let closed = |target_id| TargetObservation {
+            target_id,
+            owner: params.target.owner.clone(),
+            display_name: None,
+            state: TargetState {
+                phase: TargetPhase::Closed,
+                power: None,
+                daemon_ready: false,
+                message: None,
+            },
+            supported_power_states: Vec::new(),
+            ingress: None,
+            metadata: Metadata::default(),
+        };
+        let target_id = match self.resolve(&params.target) {
+            Ok(target) => target.target_id.clone(),
+            Err(error) if error.kind() == ProtocolErrorKind::NotFound => {
+                return Ok(closed(None));
+            }
+            Err(error) => return Err(error),
+        };
+        if let Some(target) = self.by_id.remove(&target_id) {
+            self.by_owner.remove(&target.owner);
+        }
+        Ok(closed(Some(target_id)))
+    }
+
+    fn set_ingress(
+        &mut self,
+        target: &TargetRef,
+        enabled: bool,
+    ) -> Result<TargetObservation, ProtocolError> {
+        let target_id = self.resolve(target)?.target_id.clone();
+        let target = self.by_id.get_mut(&target_id).expect("resolved target");
+        target.ingress = enabled;
+        Ok(target.observation())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::environments::gateway::runtime_client_info;
+    use environment_client::{
+        ConnectOptions,
+        conformance::controller::{ControllerConformance, run},
+    };
+    use std::{
+        sync::atomic::{AtomicU64, Ordering},
+        time::Duration,
+    };
+
+    fn owner_factory() -> Arc<dyn Fn() -> TargetOwner + Send + Sync> {
+        let next = Arc::new(AtomicU64::new(0));
+        let universe = uuid::Uuid::new_v4().to_string();
+        Arc::new(move || {
+            let n = next.fetch_add(1, Ordering::SeqCst);
+            TargetOwner {
+                universe_id: UniverseId::new(universe.clone()).unwrap(),
+                binding_id: BindingId::new("conformance").unwrap(),
+                environment_id: EnvironmentId::new(format!("environment_{n}")).unwrap(),
+                incarnation_id: IncarnationId::new(format!("incarnation_{n}")).unwrap(),
+            }
+        })
+    }
+
+    async fn conformance(options: FakeControllerOptions) {
+        let controller = FakeController::start_with(options).await.unwrap();
+        let mut suite = ControllerConformance::new(
+            controller.controller_url(),
+            ConnectOptions::new(runtime_client_info()).with_bearer_token(controller.credential()),
+            TemplateId::new(FAKE_TEMPLATE_ID).unwrap(),
+            owner_factory(),
+        );
+        suite.prompt_bound = Duration::from_secs(5);
+        suite.settle_timeout = Duration::from_secs(10);
+        suite.poll_interval = Duration::from_millis(50);
+        run(&suite)
+            .await
+            .into_result()
+            .expect("the fake controller conforms");
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn the_fake_controller_conforms() {
+        conformance(FakeControllerOptions::default()).await;
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn the_fake_controller_without_optional_features_conforms() {
+        conformance(FakeControllerOptions {
+            adopt_target: false,
+            ingress: false,
+            ..FakeControllerOptions::default()
+        })
+        .await;
+    }
+}
diff --git a/crates/temporal-runtime/src/environments/gateway.rs b/crates/temporal-runtime/src/environments/gateway.rs
index 21980c4e2..bae09af3f 100644
--- a/crates/temporal-runtime/src/environments/gateway.rs
+++ b/crates/temporal-runtime/src/environments/gateway.rs
@@ -1,11 +1,22 @@
-use std::sync::Arc;
+use std::{sync::Arc, time::Duration};
 
-use environment_protocol::shared::{
-    EnvironmentCapabilities, EnvironmentDataConnection, EnvironmentScope, EnvironmentTransport,
-    ProviderTargetId,
-};
+use environment_client::{ClientError, ConnectOptions, DataClient};
+use environment_protocol::{data::handshake::InitializeResponse, handshake::ImplementationInfo};
 use uuid::Uuid;
 
+/// Path prefix of the worker routes the environment gateway serves:
+/// `{prefix}/{universe}/{environment}/{incarnation}`. Runtime-internal: only
+/// Lightspeed's own workers dial it, with the deployment token.
+pub const ROUTE_PATH_PREFIX: &str = "/environment-gateway/routes";
+
+/// Connect bound (TCP, TLS and upgrade) of a worker route. The gateway
+/// answers a registered environment's upgrade only once the reverse
+/// stream is paired, which takes up to its stream-open bound; the worker
+/// waits a little longer so that the gateway's typed refusal, not the
+/// client's own timeout, reaches the caller.
+pub const WORKER_ROUTE_CONNECT_TIMEOUT: Duration =
+    Duration::from_secs(crate::gateway::registration::STREAM_OPEN_TIMEOUT.as_secs() + 5);
+
 #[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord)]
 pub struct RouteKey {
     pub universe_id: Uuid,
@@ -61,41 +72,59 @@ impl EnvironmentGatewayClientConfig {
         }
     }
 
-    pub fn connection(&self, key: &RouteKey) -> EnvironmentDataConnection {
-        let base = websocket_base(&self.base_url);
-        EnvironmentDataConnection {
-            target_id: ProviderTargetId::new(key.environment_id.clone()),
-            endpoint: format!(
-                "{base}/environment-gateway/routes/{}/{}/{}",
-                key.universe_id, key.environment_id, key.incarnation_id
-            ),
-            transport: EnvironmentTransport::WebSocket,
-            scope: EnvironmentScope::Default,
-            default_cwd: None,
-            capabilities: EnvironmentCapabilities::default(),
-        }
+    /// The worker route of one environment incarnation: a data-plane
+    /// endpoint whatever the environment's source.
+    pub fn endpoint(&self, key: &RouteKey) -> String {
+        format!(
+            "{}{ROUTE_PATH_PREFIX}/{}/{}/{}",
+            websocket_base(&self.base_url),
+            key.universe_id,
+            environment_protocol::routes::encode_path_segment(&key.environment_id),
+            environment_protocol::routes::encode_path_segment(&key.incarnation_id),
+        )
     }
 
-    pub fn connection_for(
+    pub fn endpoint_for(
         &self,
         universe_id: Uuid,
         environment: &environments::EnvironmentRecord,
-    ) -> EnvironmentDataConnection {
-        self.connection(&self.route_key(universe_id, environment))
+    ) -> String {
+        self.endpoint(&self.route_key(universe_id, environment))
+    }
+
+    /// Data-plane connect options for a worker route: `clientInfo` names
+    /// the runtime build, `user_agent` the caller, and the deployment token
+    /// is the bearer, and the connect bound is
+    /// [`WORKER_ROUTE_CONNECT_TIMEOUT`]. Callers on background paths add a
+    /// request timeout.
+    pub fn connect_options(&self, user_agent: impl Into<String>) -> ConnectOptions {
+        let mut options = ConnectOptions::new(runtime_client_info())
+            .with_bearer_token((*self.deployment_token).clone())
+            .with_user_agent(user_agent);
+        options.connect_timeout = WORKER_ROUTE_CONNECT_TIMEOUT;
+        options
     }
 
-    pub fn connect_options(
+    /// Dial the worker route of `key` and complete the data-plane
+    /// handshake.
+    pub async fn connect(
         &self,
-        user_agent: impl Into<String>,
-    ) -> environment_client::WebSocketConnectOptions {
-        environment_client::WebSocketConnectOptions {
-            bearer_token: Some((*self.deployment_token).clone()),
-            user_agent: Some(user_agent.into()),
-            headers: Vec::new(),
-        }
+        key: &RouteKey,
+        options: ConnectOptions,
+    ) -> Result<(DataClient, InitializeResponse), ClientError> {
+        DataClient::connect_initialized(&self.endpoint(key), options).await
     }
 }
 
+/// `clientInfo` of every data and controller connection this runtime
+/// opens.
+pub fn runtime_client_info() -> ImplementationInfo {
+    ImplementationInfo::new("lightspeed-runtime")
+        .and_then(|info| info.with_version(release_info::VERSION))
+        .and_then(|info| info.with_git_sha(release_info::GIT_SHA))
+        .expect("the runtime's build facts are valid implementation info")
+}
+
 pub fn bearer_matches(headers: &axum::http::HeaderMap, expected: &str) -> bool {
     headers
         .get(axum::http::header::AUTHORIZATION)
@@ -111,7 +140,7 @@ pub fn close_message(reason: &'static str) -> axum::extract::ws::Message {
     }))
 }
 
-pub(crate) fn websocket_base(url: &str) -> String {
+fn websocket_base(url: &str) -> String {
     if let Some(rest) = url.strip_prefix("https://") {
         format!("wss://{rest}")
     } else if let Some(rest) = url.strip_prefix("http://") {
@@ -145,13 +174,43 @@ mod tests {
     }
 
     #[test]
-    fn gateway_connection_is_stable_and_has_no_cached_capabilities() {
-        let config = EnvironmentGatewayClientConfig::new("https://gateway.test", "secret");
-        let connection = config.connection(&key());
+    fn worker_routes_are_stable_websocket_urls() {
+        let config = EnvironmentGatewayClientConfig::new("https://gateway.test/", "secret");
         assert_eq!(
-            connection.endpoint,
+            config.endpoint(&key()),
             "wss://gateway.test/environment-gateway/routes/00000000-0000-0000-0000-000000000000/environment-a/incarnation-a"
         );
-        assert_eq!(connection.capabilities, EnvironmentCapabilities::default());
+        let local = EnvironmentGatewayClientConfig::new("http://127.0.0.1:18080", "secret");
+        assert!(
+            local
+                .endpoint(&key())
+                .starts_with("ws://127.0.0.1:18080/environment-gateway/routes/")
+        );
+    }
+
+    #[test]
+    fn connect_options_carry_the_deployment_token_and_runtime_build() {
+        let config = EnvironmentGatewayClientConfig::new("https://gateway.test", "secret");
+        let options = config.connect_options("lightspeed-test");
+        assert_eq!(
+            options.bearer_token.as_ref().map(|token| token.expose()),
+            Some("secret")
+        );
+        assert_eq!(options.user_agent.as_deref(), Some("lightspeed-test"));
+        assert_eq!(options.client_info.name(), "lightspeed-runtime");
+        assert_eq!(options.client_info.version(), Some(release_info::VERSION));
+        assert_eq!(options.connect_timeout, WORKER_ROUTE_CONNECT_TIMEOUT);
+    }
+
+    #[test]
+    fn bearer_tokens_compare_exactly() {
+        let mut headers = axum::http::HeaderMap::new();
+        headers.insert(
+            axum::http::header::AUTHORIZATION,
+            "Bearer secret".parse().unwrap(),
+        );
+        assert!(bearer_matches(&headers, "secret"));
+        assert!(!bearer_matches(&headers, "secre"));
+        assert!(!bearer_matches(&axum::http::HeaderMap::new(), "secret"));
     }
 }
diff --git a/crates/temporal-runtime/src/environments/lifecycle.rs b/crates/temporal-runtime/src/environments/lifecycle.rs
index e7f7c8f54..34ef4fd4b 100644
--- a/crates/temporal-runtime/src/environments/lifecycle.rs
+++ b/crates/temporal-runtime/src/environments/lifecycle.rs
@@ -1,45 +1,218 @@
+use super::provider_controllers::{
+    ControllerDisposition, ControllerError, ControllerFeature, ProviderController, ProviderPass,
+    provider_connect_options,
+};
 use super::providers::{
-    binding_context, environment_view, map_environments_error,
-    parse_environment_provider_binding_id, registry_idle_policy, registry_lifecycle_status,
-    registry_power_state,
+    environment_view, map_environments_error, parse_environment_provider_binding_id,
+    registry_idle_policy, registry_lifecycle_status, registry_power_state,
 };
 use super::*;
 
 use ::environments::{
-    BeginCloseEnvironment, CreateEnvironment, CreateExternalEnvironment, EnvironmentId,
-    EnvironmentIncarnationId, EnvironmentProviderBindingStore, EnvironmentProvisionRequestId,
-    EnvironmentRecord, EnvironmentSource, EnvironmentStatus, EnvironmentStore,
+    BeginCloseEnvironment, CreateEnvironment, CreateExternalEnvironment, DaemonBuild,
+    EnvironmentEndpoint, EnvironmentId, EnvironmentIncarnationId, EnvironmentLifecycleError,
+    EnvironmentProviderId, EnvironmentProvisionRequestId, EnvironmentRecord,
+    EnvironmentRegistryError, EnvironmentSource, EnvironmentStatus, EnvironmentStore,
     EnvironmentTemplateId, FailEnvironmentLifecycle, FinishCloseEnvironment, ListEnvironments,
-    ObserveProvisionedEnvironment, PowerState, SetEnvironmentIdlePolicy, SetEnvironmentPower,
-};
-use environment_protocol::control::ingress::{
-    EnsureIngressParams, ProviderIngressStatus, RemoveIngressParams,
+    ObserveProvisionedEnvironment, PowerState, ReconcileScope, RecordEnvironmentIngress,
+    RecordEnvironmentLifecycleError, SetEnvironmentIdlePolicy, SetEnvironmentIngress,
+    SetEnvironmentPower,
 };
-use environment_protocol::control::targets::{
-    AdoptTargetParams, CloseTargetParams, CreateTargetParams, ProviderTargetStatus,
-    ProviderTargetSummary, SetTargetPowerParams,
+use auth::SecretValue;
+use environment_client::{ClientError, DataClient};
+use environment_protocol::{
+    control::{
+        ingress::{EnsureIngressParams, RemoveIngressParams},
+        target::{
+            AdoptTargetParams, CloseTargetParams, CreateTargetParams, GetTargetParams,
+            SetTargetPowerParams, TargetObservation, TargetOwner, TargetPhase, TargetRef,
+            TargetState,
+        },
+    },
+    error::PreconditionReason,
+    ids::{BindingId, IncarnationId, ProviderNativeRef, TemplateId, UniverseId},
+    routes::provider_data_route,
 };
 
-/// Map a provider target observation to the logical lifecycle status. A
-/// passive provider reports Ready only after its private envd is reachable;
-/// no provider presence has to register separately.
-pub(crate) fn lifecycle_status_from_target(status: ProviderTargetStatus) -> EnvironmentStatus {
-    match status {
-        ProviderTargetStatus::Ready => EnvironmentStatus::Ready,
-        ProviderTargetStatus::Creating | ProviderTargetStatus::Starting => {
-            EnvironmentStatus::Booting
-        }
-        ProviderTargetStatus::Paused => EnvironmentStatus::Paused,
-        ProviderTargetStatus::Suspended => EnvironmentStatus::Suspended,
-        ProviderTargetStatus::Stopped => EnvironmentStatus::Offline,
-        ProviderTargetStatus::Closing => EnvironmentStatus::Closing,
-        ProviderTargetStatus::Closed => EnvironmentStatus::Closed,
-        ProviderTargetStatus::Failed => EnvironmentStatus::Failed,
-        ProviderTargetStatus::Unknown => EnvironmentStatus::Unknown,
+/// How long a provisioning, booting or unknown environment may go without
+/// converging (transient errors such as an unreachable provider, or
+/// observations that make no progress, such as a guest whose envd never
+/// answers) before it is failed with the last error.
+pub(crate) const PROVISIONING_DEADLINE_MS: i64 = 30 * 60 * 1000;
+
+/// How often a reconcile pass also observes steady provisioned
+/// environments with `target/get`, so a target deleted or changed out of
+/// band is noticed and ingress converges.
+pub(crate) const STEADY_OBSERVATION_INTERVAL: std::time::Duration =
+    std::time::Duration::from_secs(120);
+
+/// A repeated transient error is written again only after this long, so a
+/// provider that stays down does not rewrite every row on every pass.
+const LIFECYCLE_ERROR_REFRESH_MS: i64 = 30 * 1000;
+
+/// What one target observation means for its environment.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) enum TargetVerdict {
+    /// Record this status.
+    Status(EnvironmentStatus),
+    /// Running, and the provider's own probe reached envd: Ready once the
+    /// runtime's data-plane handshake succeeds.
+    DaemonReady,
+    /// Broken or gone for good.
+    Failed(String),
+    /// The provider cannot tell; retried like a transient error.
+    Unknown(String),
+}
+
+/// Map a target's two-axis state to the environment lifecycle. A target
+/// that closes while its environment is not closing was closed out of band.
+pub(crate) fn target_verdict(state: &TargetState) -> TargetVerdict {
+    let message = state.message.as_ref().map(|message| message.as_str());
+    match state.phase {
+        TargetPhase::Provisioning => TargetVerdict::Status(EnvironmentStatus::Provisioning),
+        TargetPhase::Active => match state.power {
+            Some(PowerState::Running) if state.daemon_ready => TargetVerdict::DaemonReady,
+            Some(PowerState::Running) => TargetVerdict::Status(EnvironmentStatus::Booting),
+            Some(PowerState::Paused) => TargetVerdict::Status(EnvironmentStatus::Paused),
+            Some(PowerState::Suspended) => TargetVerdict::Status(EnvironmentStatus::Suspended),
+            Some(PowerState::Stopped) => TargetVerdict::Status(EnvironmentStatus::Offline),
+            None => TargetVerdict::Unknown(
+                "the provider reported an active target without a power state".to_owned(),
+            ),
+        },
+        TargetPhase::Closing => {
+            TargetVerdict::Failed("the provider is closing the environment's target".to_owned())
+        }
+        TargetPhase::Closed => {
+            TargetVerdict::Failed("the provider closed the environment's target".to_owned())
+        }
+        TargetPhase::Failed => TargetVerdict::Failed(
+            message
+                .unwrap_or("the provider reported the target failed")
+                .to_owned(),
+        ),
+        TargetPhase::Unknown => TargetVerdict::Unknown(
+            message
+                .unwrap_or("the provider cannot tell the target's state")
+                .to_owned(),
+        ),
     }
 }
 
+/// The lifecycle note for an observation that leaves a converging
+/// environment where it was: recorded like a transient error, so the
+/// provisioning deadline runs while nothing progresses.
+pub(crate) fn waiting_note(status: EnvironmentStatus, state: &TargetState) -> String {
+    let waiting = match status {
+        EnvironmentStatus::Booting => "waiting for envd to answer on the target",
+        _ => "waiting for the provider to provision the target",
+    };
+    match &state.message {
+        Some(message) => format!("{waiting}: {}", message.as_str()),
+        None => waiting.to_owned(),
+    }
+}
+
+/// True once transient errors or stalled observations have persisted past
+/// the provisioning deadline.
+pub(crate) fn provisioning_deadline_passed(
+    error: Option<&EnvironmentLifecycleError>,
+    now_ms: i64,
+) -> bool {
+    error.is_some_and(|error| now_ms.saturating_sub(error.first_at_ms) >= PROVISIONING_DEADLINE_MS)
+}
+
+/// True when `message` at `now_ms` is worth a write over `recorded`.
+fn lifecycle_error_is_news(
+    recorded: Option<&EnvironmentLifecycleError>,
+    message: &str,
+    now_ms: i64,
+) -> bool {
+    let cleaned = EnvironmentLifecycleError::record(None, message, now_ms).message;
+    recorded.is_none_or(|recorded| {
+        recorded.message != cleaned
+            || now_ms.saturating_sub(recorded.last_at_ms) >= LIFECYCLE_ERROR_REFRESH_MS
+    })
+}
+
+/// The outcome of the data-plane handshake at the Ready transition.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) enum DaemonProbe {
+    Ready(DaemonBuild),
+    /// envd speaks another protocol version and can never serve this
+    /// runtime.
+    Mismatch {
+        local: u32,
+        remote: u32,
+    },
+    /// envd did not complete the handshake; retried.
+    Unreachable(String),
+}
+
+/// Run `initialize` against a target's data route, with the provider
+/// credential, and close the connection again.
+pub(crate) async fn probe_daemon(endpoint: &str, credential: &SecretValue) -> DaemonProbe {
+    match DataClient::connect_initialized(endpoint, provider_connect_options(credential)).await {
+        Ok((client, initialized)) => {
+            let _ = client.close().await;
+            DaemonProbe::Ready(DaemonBuild::from_implementation(
+                &initialized.server_info,
+                initialized.protocol_version,
+            ))
+        }
+        Err(ClientError::VersionMismatch { local, remote, .. }) => {
+            DaemonProbe::Mismatch { local, remote }
+        }
+        Err(error) => DaemonProbe::Unreachable(format!(
+            "envd did not complete the data-plane handshake: {error}"
+        )),
+    }
+}
+
+/// The controller-plane owner of an environment's current incarnation.
+pub(crate) fn target_owner(
+    universe_id: uuid::Uuid,
+    environment: &EnvironmentRecord,
+) -> Result<TargetOwner, ControllerError> {
+    let binding_id = environment
+        .binding_id()
+        .ok_or_else(|| invalid_registry("only provisioned environments have a provider target"))?;
+    let invalid = |error: environment_protocol::ids::IdError| {
+        invalid_registry(format!(
+            "environment ids do not fit the controller protocol: {error}"
+        ))
+    };
+    Ok(TargetOwner {
+        universe_id: UniverseId::new(universe_id.to_string()).map_err(invalid)?,
+        binding_id: BindingId::new(binding_id.as_str()).map_err(invalid)?,
+        environment_id: environment_protocol::ids::EnvironmentId::new(
+            environment.environment_id.as_str(),
+        )
+        .map_err(invalid)?,
+        incarnation_id: IncarnationId::new(environment.incarnation.incarnation_id.as_str())
+            .map_err(invalid)?,
+    })
+}
+
+/// Wall-clock milliseconds for reconciler writes.
+fn clock_ms() -> i64 {
+    std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|elapsed| i64::try_from(elapsed.as_millis()).unwrap_or(i64::MAX))
+        .unwrap_or(0)
+}
+
+fn invalid_registry(message: impl Into<String>) -> ControllerError {
+    ControllerError::Registry(EnvironmentRegistryError::InvalidInput {
+        message: message.into(),
+    })
+}
+
 impl EnvironmentService {
+    /// `environments/ingress/put`: record the public ingress intent. The
+    /// reconciler converges the provider toward it while the environment is
+    /// ready and records the realized endpoint. Enabling is refused up front
+    /// when the provider does not offer ingress.
     pub(crate) async fn put_environment_ingress_record(
         &self,
         params: EnvironmentIngressPutParams,
@@ -48,90 +221,28 @@ impl EnvironmentService {
         let environment = EnvironmentStore::read_environment(self.store.as_ref(), &environment_id)
             .await
             .map_err(map_environments_error)?;
-        if !matches!(
+        if matches!(
             environment.status,
-            EnvironmentStatus::Ready
-                | EnvironmentStatus::Offline
-                | EnvironmentStatus::Paused
-                | EnvironmentStatus::Suspended
+            EnvironmentStatus::Closing | EnvironmentStatus::Closed | EnvironmentStatus::Failed
         ) {
             return Err(AgentApiError::rejected(
-                "public ingress requires a ready or powered-down environment",
+                "public ingress requires an environment that is not closing, closed or failed",
             ));
         }
-        let EnvironmentSource::Provisioned {
-            provider_id,
-            binding_id,
-        } = &environment.source
-        else {
+        let EnvironmentSource::Provisioned { provider_id, .. } = &environment.source else {
             return Err(AgentApiError::rejected(
                 "provider-managed ingress is unavailable for external environments",
             ));
         };
-        let target_id = environment
-            .incarnation
-            .provider_target_id
-            .clone()
-            .ok_or_else(|| AgentApiError::rejected("environment has no provider target"))?;
-        let provider = self.read_environment_provider(provider_id).await?;
-        let binding = EnvironmentProviderBindingStore::read_provider_binding(
-            self.store.as_ref(),
-            self.store.config().universe_id,
-            binding_id,
-        )
-        .await
-        .map_err(map_environments_error)?;
-        let mut controller = self
-            .provider_controller_connector
-            .connect(&provider.controller_connection)
-            .await?;
-        let public_endpoint = async {
-            if params.enabled {
-                let response = controller
-                    .ensure_ingress(&EnsureIngressParams {
-                        request_id: format!("ingress-enable:{}", environment.request_id),
-                        environment_id: environment.environment_id.to_string(),
-                        incarnation_id: environment.incarnation.incarnation_id.to_string(),
-                        binding: binding_context(&binding),
-                        target_id,
-                    })
-                    .await?;
-                if response.status != ProviderIngressStatus::Ready {
-                    return Err(AgentApiError::rejected(
-                        "provider did not realize public ingress",
-                    ));
-                }
-                Ok(Some(response.public_endpoint.ok_or_else(|| {
-                    AgentApiError::rejected(
-                        "provider returned ready ingress without a public endpoint",
-                    )
-                })?))
-            } else {
-                let response = controller
-                    .remove_ingress(&RemoveIngressParams {
-                        request_id: format!("ingress-disable:{}", environment.request_id),
-                        environment_id: environment.environment_id.to_string(),
-                        incarnation_id: environment.incarnation.incarnation_id.to_string(),
-                        binding: binding_context(&binding),
-                        target_id,
-                    })
-                    .await?;
-                if response.status != ProviderIngressStatus::Disabled {
-                    return Err(AgentApiError::rejected(
-                        "provider did not remove public ingress",
-                    ));
-                }
-                Ok(None)
-            }
+        if params.enabled {
+            self.require_controller_feature(provider_id, ControllerFeature::Ingress)
+                .await?;
         }
-        .await;
-        let public_endpoint = finish_provider_controller(controller, public_endpoint).await?;
         let environment = EnvironmentStore::set_environment_ingress(
             self.store.as_ref(),
-            ::environments::SetEnvironmentIngress {
+            SetEnvironmentIngress {
                 environment_id,
                 enabled: params.enabled,
-                public_endpoint,
                 updated_at_ms: now_ms()?,
             },
         )
@@ -150,14 +261,16 @@ impl EnvironmentService {
             EnvironmentProvisionRequestId::try_new(params.request_id).map_err(|error| {
                 AgentApiError::invalid_request(format!("invalid environment request id: {error}"))
             })?;
-        let connection = external_connection_from_api(params.connection)?;
+        let endpoint = EnvironmentEndpoint::parse(&params.endpoint).map_err(|error| {
+            AgentApiError::invalid_request(format!("invalid environment endpoint: {error}"))
+        })?;
         let environment = EnvironmentStore::create_external_environment(
             self.store.as_ref(),
             CreateExternalEnvironment {
                 request_id,
                 environment_id: allocate_environment_id(),
                 incarnation_id: allocate_incarnation_id(),
-                connection,
+                endpoint,
                 display_name: params.display_name,
                 metadata: validated_caller_metadata(params.metadata)?,
                 created_at_ms: now_ms()?,
@@ -169,6 +282,7 @@ impl EnvironmentService {
             environment: environment_view(&environment),
         })
     }
+
     pub(crate) async fn create_environment_record(
         &self,
         params: EnvironmentCreateParams,
@@ -320,7 +434,7 @@ impl EnvironmentService {
                 metadata: params.metadata,
                 provider_id: params
                     .provider_id
-                    .map(parse_environment_provider_id)
+                    .map(super::providers::parse_environment_provider_id)
                     .transpose()?,
                 binding_id: params
                     .binding_id
@@ -362,70 +476,76 @@ impl EnvironmentService {
     /// Public entry point for one reconciliation pass; used by acceptance
     /// tests that drive the reconciler deterministically instead of running
     /// the background loop.
+    /// The pass includes steady environments.
     pub async fn reconcile_environments_once(&self) -> Result<usize, AgentApiError> {
-        self.reconcile_environment_lifecycle_once().await
+        let mut pass = ProviderPass::default();
+        let result = self
+            .reconcile_environment_lifecycle_pass(&mut pass, ReconcileScope::WithSteady)
+            .await;
+        pass.close().await;
+        result
+    }
+
+    /// Reconcile this universe once, sharing `pass`'s controller
+    /// connections and unhealthy-provider skips with the rest of the
+    /// deployment pass. The registered sweep and the provisioned pass run
+    /// independently: an error in one never stops the other, and one
+    /// environment's error never stops the rest.
+    pub(crate) async fn reconcile_environment_lifecycle_pass(
+        &self,
+        pass: &mut ProviderPass,
+        scope: ReconcileScope,
+    ) -> Result<usize, AgentApiError> {
+        let registered = self.reconcile_registered_once().await;
+        let provisioned = self.reconcile_provisioned_once(pass, scope).await;
+        match (registered, provisioned) {
+            (Ok(registered), Ok(provisioned)) => Ok(registered + provisioned),
+            (Err(error), Ok(_)) => Err(AgentApiError {
+                message: format!("registered environments: {}", error.message),
+                ..error
+            }),
+            (Ok(_), Err(error)) => Err(error),
+            (Err(registered), Err(provisioned)) => Err(AgentApiError {
+                message: format!(
+                    "registered environments: {}; {}",
+                    registered.message, provisioned.message
+                ),
+                ..provisioned
+            }),
+        }
     }
 
-    /// Reconcile every pending environment in this universe once. Calls are
-    /// stable and idempotent; a crash after controller I/O is recovered by a
-    /// later pass issuing the same IDs again.
-    pub(crate) async fn reconcile_environment_lifecycle_once(
+    /// One pass over every environment `scope` selects. Calls are
+    /// idempotent per owner, so a crash after controller I/O is recovered
+    /// by a later pass making the same calls again.
+    async fn reconcile_provisioned_once(
         &self,
+        pass: &mut ProviderPass,
+        scope: ReconcileScope,
     ) -> Result<usize, AgentApiError> {
-        let mut changed = self.reconcile_registered_once().await?;
         let environments =
-            EnvironmentStore::list_environments_needing_reconcile(self.store.as_ref())
+            EnvironmentStore::list_environments_needing_reconcile(self.store.as_ref(), scope)
                 .await
                 .map_err(map_environments_error)?;
-        // One unreachable provider must not stall every other environment in
-        // the universe: per-environment failures are remembered and the pass
-        // continues; the first failure is reported once the pass is complete.
+        let mut changed = 0;
         let mut first_error: Option<AgentApiError> = None;
         for environment in environments {
-            let outcome = match environment.status {
-                EnvironmentStatus::Closing => self.reconcile_environment_close(&environment).await,
-                EnvironmentStatus::Ready
-                | EnvironmentStatus::Paused
-                | EnvironmentStatus::Suspended
-                | EnvironmentStatus::Offline
-                    if environment.power_diverges() =>
-                {
-                    self.reconcile_environment_power(&environment).await
-                }
-                EnvironmentStatus::Provisioning
-                | EnvironmentStatus::Booting
-                | EnvironmentStatus::Unknown => {
-                    match self.reconcile_environment_create(&environment).await {
-                        Err(error) if error.kind == api::AgentApiErrorKind::Rejected => {
-                            EnvironmentStore::fail_environment_lifecycle(
-                                self.store.as_ref(),
-                                FailEnvironmentLifecycle {
-                                    environment_id: environment.environment_id.clone(),
-                                    message: error.message,
-                                    observed_at_ms: now_ms()?,
-                                },
-                            )
-                            .await
-                            .map_err(map_environments_error)
-                            .map(|_| true)
-                        }
-                        other => other,
-                    }
-                }
-                _ => Ok(false),
-            };
-            match outcome {
+            match self.reconcile_environment(pass, &environment).await {
                 Ok(did_change) => changed += usize::from(did_change),
                 Err(error) => {
-                    if first_error.is_none() {
-                        first_error = Some(AgentApiError {
-                            message: format!(
-                                "environment {}: {}",
-                                environment.environment_id, error.message
-                            ),
-                            ..error
-                        });
-                    }
+                    tracing::debug!(
+                        target: "temporal_runtime",
+                        environment_id = %environment.environment_id,
+                        %error,
+                        "environment reconcile step failed"
+                    );
+                    first_error.get_or_insert(AgentApiError {
+                        message: format!(
+                            "environment {}: {}",
+                            environment.environment_id, error.message
+                        ),
+                        ..error
+                    });
                 }
             }
         }
@@ -435,235 +555,711 @@ impl EnvironmentService {
         }
     }
 
-    async fn reconcile_environment_create(
+    async fn reconcile_environment(
         &self,
-        environment: &::environments::EnvironmentRecord,
+        pass: &mut ProviderPass,
+        environment: &EnvironmentRecord,
     ) -> Result<bool, AgentApiError> {
-        let EnvironmentSource::Provisioned {
-            provider_id,
-            binding_id,
-        } = &environment.source
-        else {
+        let EnvironmentSource::Provisioned { provider_id, .. } = &environment.source else {
+            // External and registered environments hold no provider target.
+            if environment.status == EnvironmentStatus::Closing {
+                self.finish_close(environment)
+                    .await
+                    .map_err(map_environments_error)?;
+                return Ok(true);
+            }
             return Ok(false);
         };
-        let provider = self.read_environment_provider(provider_id).await?;
-        let binding = EnvironmentProviderBindingStore::read_provider_binding(
-            self.store.as_ref(),
-            self.store.config().universe_id,
-            binding_id,
-        )
-        .await
-        .map_err(map_environments_error)?;
-        let mut controller = self
-            .provider_controller_connector
-            .connect(&provider.controller_connection)
-            .await?;
-        let target = async {
-            match (
-                environment.incarnation.template_id.as_ref(),
-                environment.incarnation.adoption_source_target.as_ref(),
-            ) {
-                (Some(template_id), None) => Ok(controller
-                    .create_target(&CreateTargetParams {
-                        request_id: environment.request_id.to_string(),
-                        environment_id: environment.environment_id.to_string(),
-                        incarnation_id: environment.incarnation.incarnation_id.to_string(),
-                        binding: binding_context(&binding),
-                        template_id: template_id.to_string(),
-                    })
-                    .await?
-                    .target),
-                (None, Some(source_target)) => Ok(controller
-                    .adopt_target(&AdoptTargetParams {
-                        request_id: environment.request_id.to_string(),
-                        environment_id: environment.environment_id.to_string(),
-                        incarnation_id: environment.incarnation.incarnation_id.to_string(),
-                        binding: binding_context(&binding),
-                        source_target: source_target.clone(),
-                    })
-                    .await?
-                    .target),
-                _ => Err(AgentApiError::internal(
-                    "provisioned incarnation has invalid realization",
-                )),
+        let step = match environment.status {
+            EnvironmentStatus::Closing => self.close_target(pass, environment, provider_id).await,
+            EnvironmentStatus::Provisioning
+            | EnvironmentStatus::Booting
+            | EnvironmentStatus::Unknown => {
+                self.observe_target(pass, environment, provider_id).await
+            }
+            _ if environment.power_diverges() => {
+                self.converge_power(pass, environment, provider_id).await
+            }
+            // Steady targets (and ready ones whose ingress diverges) are
+            // observed with `target/get`: a vanished target fails the
+            // environment, and ingress converges from the observation.
+            _ if environment.is_steady_provisioned() => {
+                self.observe_target(pass, environment, provider_id).await
+            }
+            _ => return Ok(false),
+        };
+        match step {
+            Ok(changed) => Ok(changed),
+            Err(error) => {
+                pass.observe_failure(&error).await;
+                self.controller_failure(environment, error).await
             }
         }
-        .await;
-        let target = finish_provider_controller(controller, target).await?;
-        self.record_target_observation(environment, target).await
     }
 
-    /// Persist a provider observation when it changes the record: status,
-    /// target id, or the provider-reported power states.
-    async fn record_target_observation(
+    /// Decide what a failed controller interaction does to the environment.
+    async fn controller_failure(
         &self,
-        environment: &::environments::EnvironmentRecord,
-        target: ProviderTargetSummary,
+        environment: &EnvironmentRecord,
+        error: ControllerError,
     ) -> Result<bool, AgentApiError> {
-        let status = lifecycle_status_from_target(target.status);
-        let changed = environment.status != status
-            || environment.incarnation.provider_target_id.as_ref() != Some(&target.target_id)
-            || environment.incarnation.power_states != target.power_states;
-        if changed {
-            EnvironmentStore::observe_provisioned_environment(
-                self.store.as_ref(),
-                ObserveProvisionedEnvironment {
-                    environment_id: environment.environment_id.clone(),
-                    provider_target_id: target.target_id,
-                    status,
-                    power_states: target.power_states,
-                    observed_at_ms: now_ms()?,
-                },
-            )
+        if let ControllerError::Registry(error) = error {
+            return Err(map_environments_error(error));
+        }
+        let converging = matches!(
+            environment.status,
+            EnvironmentStatus::Closing
+                | EnvironmentStatus::Provisioning
+                | EnvironmentStatus::Booting
+                | EnvironmentStatus::Unknown
+        );
+        if !converging && error.disposition() != ControllerDisposition::Gone {
+            // A steady environment whose power change failed keeps serving
+            // in its current state. The error is reported with the pass
+            // instead of recorded, so it cannot start a provisioning
+            // deadline that a later wake would inherit.
+            return Err(error.into_api_error());
+        }
+        self.decide_controller_failure(environment, error)
             .await
-            .map_err(map_environments_error)?;
+            .map_err(map_environments_error)
+    }
+
+    async fn decide_controller_failure(
+        &self,
+        environment: &EnvironmentRecord,
+        error: ControllerError,
+    ) -> Result<bool, EnvironmentRegistryError> {
+        let error = match error {
+            ControllerError::Registry(error) => return Err(error),
+            error => error,
+        };
+        let message = error.to_string();
+        let disposition = error.disposition();
+        match environment.status {
+            EnvironmentStatus::Closing if disposition == ControllerDisposition::Gone => {
+                self.finish_close(environment).await?;
+                Ok(true)
+            }
+            EnvironmentStatus::Closing => self.record_lifecycle_error(environment, &message).await,
+            EnvironmentStatus::Provisioning
+            | EnvironmentStatus::Booting
+            | EnvironmentStatus::Unknown => match disposition {
+                ControllerDisposition::Transient => {
+                    self.transient_failure(environment, &message).await
+                }
+                ControllerDisposition::Refused => self.fail(environment, &message, None).await,
+                ControllerDisposition::Gone => {
+                    let message = if environment.incarnation.provider_target_id.is_some() {
+                        format!("provider target disappeared: {message}")
+                    } else {
+                        message
+                    };
+                    self.fail(environment, &message, None).await
+                }
+            },
+            // Only a vanished target reaches here for a steady environment.
+            _ => {
+                self.fail(
+                    environment,
+                    &format!("provider target disappeared: {message}"),
+                    None,
+                )
+                .await
+            }
         }
-        Ok(changed)
     }
 
-    /// Converge a steady-state provisioned environment toward its desired
-    /// power. One idempotent `setTargetPower` per pass; the observed
-    /// summary is recorded like any other observation, so a transitional
-    /// answer (`Starting`) flows back through the create/observe path.
-    async fn reconcile_environment_power(
+    /// Keep the status and record the error; fail once errors persisted
+    /// past the provisioning deadline.
+    async fn transient_failure(
         &self,
-        environment: &::environments::EnvironmentRecord,
-    ) -> Result<bool, AgentApiError> {
-        let EnvironmentSource::Provisioned {
-            provider_id,
-            binding_id,
-        } = &environment.source
-        else {
+        environment: &EnvironmentRecord,
+        message: &str,
+    ) -> Result<bool, EnvironmentRegistryError> {
+        let now = clock_ms();
+        if provisioning_deadline_passed(environment.lifecycle_error.as_ref(), now) {
+            return self
+                .fail(
+                    environment,
+                    &format!(
+                        "provisioning did not finish within {} minutes; last error: {message}",
+                        PROVISIONING_DEADLINE_MS / 60_000
+                    ),
+                    None,
+                )
+                .await;
+        }
+        self.record_lifecycle_error(environment, message).await
+    }
+
+    async fn record_lifecycle_error(
+        &self,
+        environment: &EnvironmentRecord,
+        message: &str,
+    ) -> Result<bool, EnvironmentRegistryError> {
+        let now = clock_ms();
+        if !lifecycle_error_is_news(environment.lifecycle_error.as_ref(), message, now) {
             return Ok(false);
+        }
+        EnvironmentStore::record_environment_lifecycle_error(
+            self.store.as_ref(),
+            RecordEnvironmentLifecycleError {
+                environment_id: environment.environment_id.clone(),
+                message: message.to_owned(),
+                observed_at_ms: now,
+            },
+        )
+        .await?;
+        Ok(true)
+    }
+
+    async fn fail(
+        &self,
+        environment: &EnvironmentRecord,
+        message: &str,
+        daemon_build: Option<DaemonBuild>,
+    ) -> Result<bool, EnvironmentRegistryError> {
+        EnvironmentStore::fail_environment_lifecycle(
+            self.store.as_ref(),
+            FailEnvironmentLifecycle {
+                environment_id: environment.environment_id.clone(),
+                message: message.to_owned(),
+                daemon_build,
+                observed_at_ms: clock_ms(),
+            },
+        )
+        .await?;
+        Ok(true)
+    }
+
+    async fn finish_close(
+        &self,
+        environment: &EnvironmentRecord,
+    ) -> Result<(), EnvironmentRegistryError> {
+        EnvironmentStore::finish_close_environment(
+            self.store.as_ref(),
+            FinishCloseEnvironment {
+                environment_id: environment.environment_id.clone(),
+                observed_at_ms: clock_ms(),
+            },
+        )
+        .await?;
+        Ok(())
+    }
+
+    /// Converging and steady environments: create (or adopt) while no
+    /// target id is recorded, observe with `target/get` once one is.
+    /// Creation is never re-sent for a known target.
+    async fn observe_target(
+        &self,
+        pass: &mut ProviderPass,
+        environment: &EnvironmentRecord,
+        provider_id: &EnvironmentProviderId,
+    ) -> Result<bool, ControllerError> {
+        let controller = pass
+            .controller(
+                self.store.as_ref(),
+                self.provider_controller_connector.as_ref(),
+                provider_id,
+            )
+            .await?;
+        let owner = target_owner(self.store.config().universe_id, environment)?;
+        let response = match (
+            &environment.incarnation.provider_target_id,
+            &environment.incarnation.template_id,
+            &environment.incarnation.adoption_source_target,
+        ) {
+            (Some(target_id), _, _) => {
+                controller
+                    .client
+                    .get_target(&GetTargetParams {
+                        target: TargetRef {
+                            owner: owner.clone(),
+                            target_id: Some(target_id.clone()),
+                        },
+                    })
+                    .await
+            }
+            (None, Some(template_id), None) => {
+                let template_id = TemplateId::new(template_id.as_str()).map_err(|error| {
+                    invalid_registry(format!("template id does not fit the protocol: {error}"))
+                })?;
+                controller
+                    .client
+                    .create_target(&CreateTargetParams {
+                        owner: owner.clone(),
+                        template_id,
+                    })
+                    .await
+            }
+            (None, None, Some(source_target)) => {
+                controller.require(ControllerFeature::AdoptTarget)?;
+                let source_target =
+                    ProviderNativeRef::new(source_target.as_str()).map_err(|error| {
+                        invalid_registry(format!("adoption source is not valid: {error}"))
+                    })?;
+                controller
+                    .client
+                    .adopt_target(&AdoptTargetParams {
+                        owner: owner.clone(),
+                        source_target,
+                    })
+                    .await
+            }
+            _ => {
+                return Err(invalid_registry(
+                    "provisioned incarnation has neither a template nor an adoption source",
+                ));
+            }
         };
+        let observation = response
+            .map_err(|error| controller.call_error(error))?
+            .target;
+        self.apply_observation(&controller, environment, &owner, observation)
+            .await
+    }
+
+    /// Steady environments whose power diverges from the intent: one
+    /// idempotent `target/setPower` per pass. A target that is not active
+    /// is observed instead.
+    async fn converge_power(
+        &self,
+        pass: &mut ProviderPass,
+        environment: &EnvironmentRecord,
+        provider_id: &EnvironmentProviderId,
+    ) -> Result<bool, ControllerError> {
         let Some(target_id) = environment.incarnation.provider_target_id.clone() else {
-            return Ok(false);
+            return self.observe_target(pass, environment, provider_id).await;
         };
-        let provider = self.read_environment_provider(provider_id).await?;
-        let binding = EnvironmentProviderBindingStore::read_provider_binding(
-            self.store.as_ref(),
-            self.store.config().universe_id,
-            binding_id,
-        )
-        .await
-        .map_err(map_environments_error)?;
-        let mut controller = self
-            .provider_controller_connector
-            .connect(&provider.controller_connection)
+        let controller = pass
+            .controller(
+                self.store.as_ref(),
+                self.provider_controller_connector.as_ref(),
+                provider_id,
+            )
             .await?;
-        let response = controller
+        let owner = target_owner(self.store.config().universe_id, environment)?;
+        let target = TargetRef {
+            owner: owner.clone(),
+            target_id: Some(target_id),
+        };
+        let observation = match controller
+            .client
             .set_target_power(&SetTargetPowerParams {
-                request_id: format!(
-                    "power:{}:{}",
-                    environment.request_id, environment.desired_power
-                ),
-                environment_id: environment.environment_id.to_string(),
-                incarnation_id: environment.incarnation.incarnation_id.to_string(),
-                binding: binding_context(&binding),
-                target_id,
+                target: target.clone(),
                 power: environment.desired_power,
             })
-            .await;
-        let response = finish_provider_controller(controller, response).await?;
-        self.record_target_observation(environment, response.target)
+            .await
+        {
+            Ok(response) => response.target,
+            Err(error) => {
+                let error = controller.call_error(error);
+                if error.precondition() != Some(PreconditionReason::TargetNotActive) {
+                    return Err(error);
+                }
+                controller
+                    .client
+                    .get_target(&GetTargetParams { target })
+                    .await
+                    .map_err(|error| controller.call_error(error))?
+                    .target
+            }
+        };
+        self.apply_observation(&controller, environment, &owner, observation)
             .await
     }
 
-    async fn reconcile_environment_close(
+    /// Close by owner, with the target id when one is recorded: the provider
+    /// destroys whatever the owner holds, ingress included, and answers
+    /// `closed` once nothing is left. A closing target is closed again on
+    /// later passes (close is idempotent).
+    async fn close_target(
         &self,
-        environment: &::environments::EnvironmentRecord,
-    ) -> Result<bool, AgentApiError> {
-        let Some(target_id) = environment.incarnation.provider_target_id.clone() else {
-            EnvironmentStore::finish_close_environment(
+        pass: &mut ProviderPass,
+        environment: &EnvironmentRecord,
+        provider_id: &EnvironmentProviderId,
+    ) -> Result<bool, ControllerError> {
+        let controller = match pass
+            .controller(
                 self.store.as_ref(),
-                FinishCloseEnvironment {
-                    environment_id: environment.environment_id.clone(),
-                    observed_at_ms: now_ms()?,
-                },
+                self.provider_controller_connector.as_ref(),
+                provider_id,
             )
             .await
-            .map_err(map_environments_error)?;
-            return Ok(true);
-        };
-        let EnvironmentSource::Provisioned {
-            provider_id,
-            binding_id,
-        } = &environment.source
-        else {
-            return Ok(false);
+        {
+            Err(ControllerError::Registry(EnvironmentRegistryError::NotFound { .. })) => {
+                // The provider record is gone, so nothing can reach its
+                // targets any more.
+                tracing::warn!(
+                    target: "temporal_runtime",
+                    environment_id = %environment.environment_id,
+                    %provider_id,
+                    "closing an environment whose provider is no longer registered"
+                );
+                self.finish_close(environment).await?;
+                return Ok(true);
+            }
+            other => other?,
         };
-        let provider = self.read_environment_provider(provider_id).await?;
-        let binding = EnvironmentProviderBindingStore::read_provider_binding(
+        let owner = target_owner(self.store.config().universe_id, environment)?;
+        let observation = controller
+            .client
+            .close_target(&CloseTargetParams {
+                target: TargetRef {
+                    owner,
+                    target_id: environment.incarnation.provider_target_id.clone(),
+                },
+            })
+            .await
+            .map_err(|error| controller.call_error(error))?
+            .target;
+        if observation.state.phase == TargetPhase::Closed {
+            self.finish_close(environment).await?;
+            return Ok(true);
+        }
+        let (_, changed) = self
+            .record_observation(environment, &observation, environment.status, None)
+            .await?;
+        Ok(changed)
+    }
+
+    /// Record an observation and act on it: the Ready transition runs the
+    /// data-plane handshake first, and ingress converges against the
+    /// recorded intent on running targets.
+    async fn apply_observation(
+        &self,
+        controller: &ProviderController,
+        environment: &EnvironmentRecord,
+        owner: &TargetOwner,
+        observation: TargetObservation,
+    ) -> Result<bool, ControllerError> {
+        if observation.owner != *owner {
+            return Err(controller.call_error(ClientError::Decode(
+                "the provider answered with another owner's target".to_owned(),
+            )));
+        }
+        match target_verdict(&observation.state) {
+            // A ready environment became ready through the runtime's own
+            // data-plane handshake; the provider's liveness probe alone does
+            // not demote it.
+            TargetVerdict::Status(EnvironmentStatus::Booting)
+                if environment.status == EnvironmentStatus::Ready =>
+            {
+                let (recorded, changed) = self
+                    .record_observation(environment, &observation, EnvironmentStatus::Ready, None)
+                    .await?;
+                let converged = self
+                    .converge_ingress(controller, &recorded, owner, &observation)
+                    .await;
+                Ok(changed || converged)
+            }
+            TargetVerdict::Status(status) => {
+                let (recorded, changed) = self
+                    .record_observation(environment, &observation, status, None)
+                    .await?;
+                let stalled = environment.status == status
+                    && matches!(
+                        status,
+                        EnvironmentStatus::Provisioning | EnvironmentStatus::Booting
+                    );
+                if !stalled {
+                    return Ok(changed);
+                }
+                let noted = self
+                    .transient_failure(&recorded, &waiting_note(status, &observation.state))
+                    .await?;
+                Ok(changed || noted)
+            }
+            TargetVerdict::Failed(message) => {
+                self.record_observation(environment, &observation, environment.status, None)
+                    .await?;
+                Ok(self.fail(environment, &message, None).await?)
+            }
+            TargetVerdict::Unknown(message) => {
+                let (recorded, _) = self
+                    .record_observation(environment, &observation, EnvironmentStatus::Unknown, None)
+                    .await?;
+                self.transient_failure(&recorded, &message).await?;
+                Ok(true)
+            }
+            TargetVerdict::DaemonReady if environment.status == EnvironmentStatus::Ready => {
+                let (recorded, changed) = self
+                    .record_observation(environment, &observation, EnvironmentStatus::Ready, None)
+                    .await?;
+                let converged = self
+                    .converge_ingress(controller, &recorded, owner, &observation)
+                    .await;
+                Ok(changed || converged)
+            }
+            TargetVerdict::DaemonReady => {
+                let Some(target_id) = &observation.target_id else {
+                    let (recorded, _) = self
+                        .record_observation(
+                            environment,
+                            &observation,
+                            EnvironmentStatus::Booting,
+                            None,
+                        )
+                        .await?;
+                    self.transient_failure(
+                        &recorded,
+                        "the provider reported a running target without a targetId",
+                    )
+                    .await?;
+                    return Ok(true);
+                };
+                let endpoint = provider_data_route(&controller.data_route_base, owner, target_id);
+                match probe_daemon(&endpoint, &controller.credential).await {
+                    DaemonProbe::Ready(build) => {
+                        let (recorded, _) = self
+                            .record_observation(
+                                environment,
+                                &observation,
+                                EnvironmentStatus::Ready,
+                                Some(build),
+                            )
+                            .await?;
+                        self.converge_ingress(controller, &recorded, owner, &observation)
+                            .await;
+                        Ok(true)
+                    }
+                    DaemonProbe::Mismatch { local, remote } => {
+                        self.record_observation(
+                            environment,
+                            &observation,
+                            environment.status,
+                            None,
+                        )
+                        .await?;
+                        self.fail(
+                            environment,
+                            &format!(
+                                "the environment's envd speaks protocol version {remote}; this runtime requires {local}"
+                            ),
+                            Some(DaemonBuild {
+                                version: None,
+                                git_sha: None,
+                                protocol_version: remote,
+                            }),
+                        )
+                        .await
+                        .map_err(ControllerError::from)
+                    }
+                    DaemonProbe::Unreachable(message) => {
+                        let (recorded, _) = self
+                            .record_observation(
+                                environment,
+                                &observation,
+                                EnvironmentStatus::Booting,
+                                None,
+                            )
+                            .await?;
+                        self.transient_failure(&recorded, &message).await?;
+                        Ok(true)
+                    }
+                }
+            }
+        }
+    }
+
+    /// Persist an observation when it changes the record: status, target
+    /// id, power states or the daemon build. Returns the current record.
+    async fn record_observation(
+        &self,
+        environment: &EnvironmentRecord,
+        observation: &TargetObservation,
+        status: EnvironmentStatus,
+        daemon_build: Option<DaemonBuild>,
+    ) -> Result<(EnvironmentRecord, bool), ControllerError> {
+        let target_changed = observation.target_id.is_some()
+            && environment.incarnation.provider_target_id != observation.target_id;
+        let changed = environment.status != status
+            || target_changed
+            || environment.incarnation.power_states != observation.supported_power_states
+            || daemon_build.is_some();
+        if !changed {
+            return Ok((environment.clone(), false));
+        }
+        let recorded = EnvironmentStore::observe_provisioned_environment(
             self.store.as_ref(),
-            self.store.config().universe_id,
-            binding_id,
+            ObserveProvisionedEnvironment {
+                environment_id: environment.environment_id.clone(),
+                provider_target_id: observation.target_id.clone(),
+                status,
+                power_states: observation.supported_power_states.clone(),
+                daemon_build,
+                observed_at_ms: clock_ms(),
+            },
         )
-        .await
-        .map_err(map_environments_error)?;
-        let mut controller = self
-            .provider_controller_connector
-            .connect(&provider.controller_connection)
-            .await?;
-        let response = async {
-            let ingress_response = controller
-                .remove_ingress(&RemoveIngressParams {
-                    request_id: format!("ingress-close:{}", environment.request_id),
-                    environment_id: environment.environment_id.to_string(),
-                    incarnation_id: environment.incarnation.incarnation_id.to_string(),
-                    binding: binding_context(&binding),
-                    target_id: target_id.clone(),
-                })
-                .await?;
-            if ingress_response.status != ProviderIngressStatus::Disabled {
-                return Err(AgentApiError::rejected(
-                    "provider did not remove ingress before target close",
-                ));
+        .await?;
+        Ok((recorded, true))
+    }
+
+    /// Converge a running target's ingress toward the recorded intent. The
+    /// recorded endpoint always mirrors what the provider last reported.
+    /// Ingress methods answer promptly and may continue in the background,
+    /// so an answer that has not converged yet is pending: the intent stays
+    /// and a later observation checks again. Only a typed refusal of
+    /// `ingress/ensure` drops the intent. Ingress failures never fail the
+    /// environment and are never recorded as lifecycle errors, so they
+    /// cannot start a provisioning deadline. Returns whether the record
+    /// changed.
+    async fn converge_ingress(
+        &self,
+        controller: &ProviderController,
+        environment: &EnvironmentRecord,
+        owner: &TargetOwner,
+        observation: &TargetObservation,
+    ) -> bool {
+        let realized = realized_ingress(observation);
+        let mut changed = self
+            .record_realized_ingress(
+                environment,
+                environment.public_endpoint.as_deref(),
+                &realized,
+            )
+            .await;
+        let mut recorded = realized;
+        if environment.public_ingress_enabled == recorded.is_some() {
+            return changed;
+        }
+        let enabling = environment.public_ingress_enabled;
+        if !controller.features.ingress {
+            if enabling {
+                tracing::warn!(
+                    target: "temporal_runtime",
+                    environment_id = %environment.environment_id,
+                    provider_id = %controller.provider_id,
+                    "the provider no longer offers public ingress; the ingress intent is dropped"
+                );
+                changed |= self.drop_ingress_intent(environment).await;
             }
+            return changed;
+        }
+        let target = TargetRef {
+            owner: owner.clone(),
+            target_id: observation.target_id.clone(),
+        };
+        let answer = if enabling {
             controller
-                .close_target(&CloseTargetParams {
-                    request_id: format!("close:{}", environment.request_id),
-                    environment_id: environment.environment_id.to_string(),
-                    incarnation_id: environment.incarnation.incarnation_id.to_string(),
-                    binding: binding_context(&binding),
-                    target_id,
-                    force: false,
-                })
+                .client
+                .ensure_ingress(&EnsureIngressParams { target })
                 .await
+        } else {
+            controller
+                .client
+                .remove_ingress(&RemoveIngressParams { target })
+                .await
+        };
+        match answer.map_err(|error| controller.call_error(error)) {
+            Ok(response) => {
+                let answered = realized_ingress(&response.target);
+                changed |= self
+                    .record_realized_ingress(environment, recorded.as_deref(), &answered)
+                    .await;
+                recorded = answered;
+                if environment.public_ingress_enabled != recorded.is_some() {
+                    tracing::debug!(
+                        target: "temporal_runtime",
+                        environment_id = %environment.environment_id,
+                        enabling,
+                        "public ingress change is still in progress at the provider"
+                    );
+                }
+            }
+            Err(error) if enabling && error.disposition() == ControllerDisposition::Refused => {
+                tracing::warn!(
+                    target: "temporal_runtime",
+                    environment_id = %environment.environment_id,
+                    %error,
+                    "the provider refused public ingress; the ingress intent is dropped"
+                );
+                changed |= self.drop_ingress_intent(environment).await;
+            }
+            Err(error) => {
+                tracing::warn!(
+                    target: "temporal_runtime",
+                    environment_id = %environment.environment_id,
+                    %error,
+                    "{}; retried at the next observation",
+                    if enabling {
+                        "enabling public ingress failed"
+                    } else {
+                        "removing public ingress failed"
+                    }
+                );
+            }
         }
+        changed
+    }
+
+    /// Record `realized` as the environment's public endpoint when it
+    /// differs from `recorded`.
+    async fn record_realized_ingress(
+        &self,
+        environment: &EnvironmentRecord,
+        recorded: Option<&str>,
+        realized: &Option<String>,
+    ) -> bool {
+        if recorded == realized.as_deref() {
+            return false;
+        }
+        let written = EnvironmentStore::record_environment_ingress(
+            self.store.as_ref(),
+            RecordEnvironmentIngress {
+                environment_id: environment.environment_id.clone(),
+                public_endpoint: realized.clone(),
+                observed_at_ms: clock_ms(),
+            },
+        )
         .await;
-        let response = finish_provider_controller(controller, response).await?;
-        if response.status == ProviderTargetStatus::Closed {
-            EnvironmentStore::finish_close_environment(
-                self.store.as_ref(),
-                FinishCloseEnvironment {
-                    environment_id: environment.environment_id.clone(),
-                    observed_at_ms: now_ms()?,
-                },
-            )
-            .await
-            .map_err(map_environments_error)?;
+        match written {
+            Ok(_) => true,
+            Err(error) => {
+                tracing::warn!(
+                    target: "temporal_runtime",
+                    environment_id = %environment.environment_id,
+                    %error,
+                    "recording the realized public ingress failed"
+                );
+                false
+            }
         }
-        Ok(true)
     }
-}
 
-fn external_connection_from_api(
-    value: EnvironmentConnectionView,
-) -> Result<::environments::EnvironmentConnectionSpec, AgentApiError> {
-    let transport = match value.transport {
-        EnvironmentConnectionTransportView::WebSocket => {
-            environment_protocol::shared::EnvironmentTransport::WebSocket
-        }
-        _ => {
-            return Err(AgentApiError::invalid_request(
-                "external environment connections currently require webSocket transport",
-            ));
+    /// Clear an ingress intent the provider cannot realize.
+    async fn drop_ingress_intent(&self, environment: &EnvironmentRecord) -> bool {
+        let written = EnvironmentStore::set_environment_ingress(
+            self.store.as_ref(),
+            SetEnvironmentIngress {
+                environment_id: environment.environment_id.clone(),
+                enabled: false,
+                updated_at_ms: clock_ms(),
+            },
+        )
+        .await;
+        match written {
+            Ok(_) => true,
+            Err(error) => {
+                tracing::warn!(
+                    target: "temporal_runtime",
+                    environment_id = %environment.environment_id,
+                    %error,
+                    "dropping the public ingress intent failed"
+                );
+                false
+            }
         }
-    };
-    Ok(::environments::EnvironmentConnectionSpec {
-        endpoint: value.endpoint,
-        transport,
-    })
+    }
+}
+
+/// The public endpoint an observation reports realized.
+fn realized_ingress(observation: &TargetObservation) -> Option<String> {
+    observation
+        .ingress
+        .as_ref()
+        .map(|ingress| ingress.endpoint.as_str().to_owned())
 }
 
 /// Rate-limits repeated reconcile-pass failures per universe so a provider
@@ -728,3 +1324,214 @@ fn validated_caller_metadata(
     super::validate_caller_metadata(&metadata)?;
     Ok(metadata)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::environments::fake_controller::{FakeController, FakeControllerOptions};
+    use environment_protocol::{
+        ENVD_PROTOCOL_VERSION, control::target::TargetRef as Ref, metadata::DescriptiveText,
+        routes::DataRouteBase,
+    };
+
+    fn state(
+        phase: TargetPhase,
+        power: Option<PowerState>,
+        daemon_ready: bool,
+        message: Option<&str>,
+    ) -> TargetState {
+        TargetState {
+            phase,
+            power,
+            daemon_ready,
+            message: message.and_then(DescriptiveText::lossy),
+        }
+    }
+
+    #[test]
+    fn target_states_map_to_lifecycle_verdicts() {
+        use TargetPhase::*;
+        assert_eq!(
+            target_verdict(&state(Provisioning, None, false, None)),
+            TargetVerdict::Status(EnvironmentStatus::Provisioning)
+        );
+        assert_eq!(
+            target_verdict(&state(Active, Some(PowerState::Running), false, None)),
+            TargetVerdict::Status(EnvironmentStatus::Booting)
+        );
+        assert_eq!(
+            target_verdict(&state(Active, Some(PowerState::Running), true, None)),
+            TargetVerdict::DaemonReady
+        );
+        assert_eq!(
+            target_verdict(&state(Active, Some(PowerState::Stopped), false, None)),
+            TargetVerdict::Status(EnvironmentStatus::Offline)
+        );
+        assert_eq!(
+            target_verdict(&state(Failed, None, false, Some("disk full"))),
+            TargetVerdict::Failed("disk full".to_owned())
+        );
+        assert!(matches!(
+            target_verdict(&state(Closed, None, false, None)),
+            TargetVerdict::Failed(_)
+        ));
+        assert!(matches!(
+            target_verdict(&state(Unknown, None, false, None)),
+            TargetVerdict::Unknown(_)
+        ));
+        assert!(matches!(
+            target_verdict(&state(Active, None, false, None)),
+            TargetVerdict::Unknown(_)
+        ));
+    }
+
+    #[test]
+    fn the_provisioning_deadline_counts_from_the_first_error_or_stall() {
+        let error = EnvironmentLifecycleError::record(None, "provider unreachable", 1_000);
+        assert!(!provisioning_deadline_passed(None, i64::MAX));
+        assert!(!provisioning_deadline_passed(
+            Some(&error),
+            1_000 + PROVISIONING_DEADLINE_MS - 1
+        ));
+        let later = EnvironmentLifecycleError::record(Some(&error), "still unreachable", 50_000);
+        assert_eq!(later.first_at_ms, 1_000);
+        assert!(provisioning_deadline_passed(
+            Some(&later),
+            1_000 + PROVISIONING_DEADLINE_MS
+        ));
+    }
+
+    #[test]
+    fn stalled_observations_carry_the_provider_message_into_the_deadline() {
+        let booting = waiting_note(
+            EnvironmentStatus::Booting,
+            &state(
+                TargetPhase::Active,
+                Some(PowerState::Running),
+                false,
+                Some("guest agent not up"),
+            ),
+        );
+        assert_eq!(
+            booting,
+            "waiting for envd to answer on the target: guest agent not up"
+        );
+        let provisioning = waiting_note(
+            EnvironmentStatus::Provisioning,
+            &state(TargetPhase::Provisioning, None, false, None),
+        );
+        assert_eq!(
+            provisioning,
+            "waiting for the provider to provision the target"
+        );
+        // A stalled observation starts the deadline like a transient error:
+        // the run of notes keeps its first instant.
+        let first = EnvironmentLifecycleError::record(None, &booting, 1_000);
+        let repeated = EnvironmentLifecycleError::record(Some(&first), &booting, 900_000);
+        assert!(provisioning_deadline_passed(
+            Some(&repeated),
+            1_000 + PROVISIONING_DEADLINE_MS
+        ));
+    }
+
+    #[test]
+    fn repeated_errors_are_rewritten_only_when_new_or_stale() {
+        let recorded = EnvironmentLifecycleError::record(None, "provider unreachable", 1_000);
+        assert!(lifecycle_error_is_news(None, "provider unreachable", 1_000));
+        assert!(!lifecycle_error_is_news(
+            Some(&recorded),
+            "provider unreachable",
+            2_000
+        ));
+        assert!(lifecycle_error_is_news(
+            Some(&recorded),
+            "provider refused",
+            2_000
+        ));
+        assert!(lifecycle_error_is_news(
+            Some(&recorded),
+            "provider unreachable",
+            1_000 + LIFECYCLE_ERROR_REFRESH_MS
+        ));
+    }
+
+    async fn created_target(controller: &FakeController) -> (TargetOwner, String, SecretValue) {
+        let credential = SecretValue::new(controller.credential());
+        let (client, initialized) = environment_client::ControllerClient::connect_initialized(
+            controller.controller_url(),
+            provider_connect_options(&credential),
+        )
+        .await
+        .expect("controller handshake");
+        let owner = TargetOwner {
+            universe_id: UniverseId::new(uuid::Uuid::new_v4().to_string()).unwrap(),
+            binding_id: BindingId::new("primary").unwrap(),
+            environment_id: environment_protocol::ids::EnvironmentId::new("environment_1").unwrap(),
+            incarnation_id: IncarnationId::new("incarnation_1").unwrap(),
+        };
+        let observation = client
+            .create_target(&CreateTargetParams {
+                owner: owner.clone(),
+                template_id: TemplateId::new(
+                    crate::environments::fake_controller::FAKE_TEMPLATE_ID,
+                )
+                .unwrap(),
+            })
+            .await
+            .expect("create")
+            .target;
+        let target_id = observation.target_id.expect("target id");
+        let base: DataRouteBase = initialized.routes.data;
+        let endpoint = provider_data_route(&base, &owner, &target_id);
+        // Observation is a pure read of the same target.
+        let observed = client
+            .get_target(&GetTargetParams {
+                target: Ref {
+                    owner: owner.clone(),
+                    target_id: Some(target_id.clone()),
+                },
+            })
+            .await
+            .expect("get")
+            .target;
+        assert_eq!(observed.target_id, Some(target_id));
+        let _ = client.close().await;
+        (owner, endpoint, credential)
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn the_ready_transition_handshake_records_the_daemon_build() {
+        let controller = FakeController::start().await.unwrap();
+        let (_, endpoint, credential) = created_target(&controller).await;
+        match probe_daemon(&endpoint, &credential).await {
+            DaemonProbe::Ready(build) => {
+                assert_eq!(build.protocol_version, ENVD_PROTOCOL_VERSION);
+                assert!(build.version.is_some());
+            }
+            other => panic!("expected a ready daemon, got {other:?}"),
+        }
+        // Without the provider credential the data route is refused.
+        assert!(matches!(
+            probe_daemon(&endpoint, &SecretValue::new("wrong")).await,
+            DaemonProbe::Unreachable(_)
+        ));
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn a_daemon_of_another_protocol_version_is_a_mismatch_naming_both() {
+        let controller = FakeController::start_with(FakeControllerOptions {
+            daemon_protocol_version: ENVD_PROTOCOL_VERSION + 1,
+            ..FakeControllerOptions::default()
+        })
+        .await
+        .unwrap();
+        let (_, endpoint, credential) = created_target(&controller).await;
+        assert_eq!(
+            probe_daemon(&endpoint, &credential).await,
+            DaemonProbe::Mismatch {
+                local: ENVD_PROTOCOL_VERSION,
+                remote: ENVD_PROTOCOL_VERSION + 1,
+            }
+        );
+    }
+}
diff --git a/crates/temporal-runtime/src/environments/mod.rs b/crates/temporal-runtime/src/environments/mod.rs
index 6164bdca0..6d952e7a1 100644
--- a/crates/temporal-runtime/src/environments/mod.rs
+++ b/crates/temporal-runtime/src/environments/mod.rs
@@ -2,11 +2,12 @@
 use crate::environments::gateway::EnvironmentGatewayClientConfig;
 use api::*;
 use lifecycle::parse_registry_environment_id;
-use provider_controllers::{ProviderControllerConnector, finish_provider_controller};
-use providers::{map_environments_error, parse_environment_provider_id};
+use provider_controllers::ProviderControllerConnector;
+use providers::map_environments_error;
 use std::{collections::BTreeMap, sync::Arc};
 use store_pg::PgStore;
 pub(crate) mod credentials;
+pub mod fake_controller;
 pub(crate) mod lifecycle;
 pub(crate) mod power;
 pub(crate) mod provider_controllers;
@@ -37,6 +38,6 @@ fn now_ms() -> Result<i64, AgentApiError> {
 }
 
 fn validate_caller_metadata(metadata: &BTreeMap<String, String>) -> Result<(), AgentApiError> {
-    environment_protocol::registration::validate_registration_metadata(None, metadata)
-        .map_err(|message| AgentApiError::invalid_request(format!("invalid metadata: {message}")))
+    environment_protocol::metadata::validate_caller_metadata(metadata)
+        .map_err(|error| AgentApiError::invalid_request(format!("invalid metadata: {error}")))
 }
diff --git a/crates/temporal-runtime/src/environments/power.rs b/crates/temporal-runtime/src/environments/power.rs
index 1932f8816..7701ee00c 100644
--- a/crates/temporal-runtime/src/environments/power.rs
+++ b/crates/temporal-runtime/src/environments/power.rs
@@ -10,17 +10,19 @@ use super::providers::map_environments_error;
 use super::*;
 
 use ::environments::{
-    BeginCloseEnvironment, EnvironmentRecord, EnvironmentStore, IdleAction, PowerState,
-    SetEnvironmentPower,
-};
-use environment_client::EnvironmentDataClient;
-use environment_protocol::{
-    data::{
-        handshake::{InitializeParams, InitializedParams},
-        idle::{IdleParams, IdleResponse},
-    },
-    shared::CURRENT_PROTOCOL_VERSION,
+    BeginCloseEnvironment, EnvironmentProviderId, EnvironmentRecord, EnvironmentStore, IdleAction,
+    PowerState, SetEnvironmentPower,
 };
+use environment_client::{ClientError, DataClient};
+use environment_protocol::data::idle::{GetIdleParams, GetIdleResponse};
+use std::{collections::HashSet, time::Duration};
+
+/// `clientInfo.name` of the reaper's data-plane connections.
+const POWER_REAPER_CLIENT: &str = "lightspeed-power-reaper";
+
+/// Deadline of one `env/getIdle`, on top of the connect and `initialize`
+/// bounds.
+const IDLE_REPORT_TIMEOUT: Duration = Duration::from_secs(10);
 
 /// Outcome of one reaper pass for reporting/tests.
 #[derive(Clone, Debug, Default, PartialEq, Eq)]
@@ -32,15 +34,20 @@ pub struct PowerReaperStats {
     pub closed: usize,
 }
 
+/// No process or job is running.
+fn is_quiescent(report: &GetIdleResponse) -> bool {
+    report.running_process_count == 0 && report.running_job_count == 0
+}
+
 /// Decide the idle action for one environment from the daemon's report.
 /// Pure so it can be tested without a daemon: nothing is due while work
 /// runs, while a power change is already pending, or before the first
 /// supported stage threshold.
 pub(crate) fn decide_idle_action(
     environment: &EnvironmentRecord,
-    report: &IdleResponse,
+    report: &GetIdleResponse,
 ) -> Option<IdleAction> {
-    if !report.is_quiescent() {
+    if !is_quiescent(report) {
         return None;
     }
     if environment.desired_power != PowerState::Running {
@@ -50,15 +57,27 @@ pub(crate) fn decide_idle_action(
     policy.due_action(report.idle_for_ms, &environment.incarnation.power_states)
 }
 
+/// Why an idle report could not be read.
+enum IdleReportFailure {
+    /// The daemon did not answer within its deadlines: its provider's
+    /// remaining environments are skipped for the rest of the pass.
+    TimedOut,
+    Unavailable,
+}
+
 impl EnvironmentService {
     /// Public entry point for one reaper pass; used by acceptance tests that
     /// drive the reaper deterministically instead of running the loop.
     pub async fn reap_idle_environments_once(&self) -> Result<PowerReaperStats, AgentApiError> {
-        self.reconcile_idle_power_once().await
+        self.reconcile_idle_power_pass(&mut HashSet::new()).await
     }
 
-    pub(crate) async fn reconcile_idle_power_once(
+    /// One reaper pass over this universe. `unhealthy` names providers
+    /// whose daemons timed out earlier in the deployment pass; their
+    /// environments are left for the next pass.
+    pub(crate) async fn reconcile_idle_power_pass(
         &self,
+        unhealthy: &mut HashSet<EnvironmentProviderId>,
     ) -> Result<PowerReaperStats, AgentApiError> {
         let candidates = EnvironmentStore::list_environments_with_idle_policy(self.store.as_ref())
             .await
@@ -69,15 +88,27 @@ impl EnvironmentService {
         };
         let universe_id = self.store.config().universe_id;
         for environment in candidates {
+            let provider_id = environment.provider_id().cloned();
+            if provider_id
+                .as_ref()
+                .is_some_and(|provider_id| unhealthy.contains(provider_id))
+            {
+                stats.unreachable += 1;
+                continue;
+            }
             let report = match self.read_idle_report(universe_id, &environment).await {
-                Some(report) => report,
-                None => {
+                Ok(report) => report,
+                Err(failure) => {
+                    if let (IdleReportFailure::TimedOut, Some(provider_id)) = (failure, provider_id)
+                    {
+                        unhealthy.insert(provider_id);
+                    }
                     stats.unreachable += 1;
                     continue;
                 }
             };
             let Some(action) = decide_idle_action(&environment, &report) else {
-                if !report.is_quiescent() {
+                if !is_quiescent(&report) {
                     stats.busy += 1;
                 }
                 continue;
@@ -132,37 +163,33 @@ impl EnvironmentService {
     }
 
     /// Ask the environment's daemon for its idle report through the ordinary
-    /// on-demand route. `None` when the daemon is unreachable or predates
-    /// `env/idle`; the reaper then leaves the environment alone.
+    /// on-demand route, within the connect, `initialize` and report
+    /// deadlines, and close the connection again. The handshake and the
+    /// report are observations: reading them never resets the idle clock.
     async fn read_idle_report(
         &self,
         universe_id: uuid::Uuid,
         environment: &EnvironmentRecord,
-    ) -> Option<IdleResponse> {
-        let connection = self
+    ) -> Result<GetIdleResponse, IdleReportFailure> {
+        let endpoint = self
+            .environment_gateway
+            .endpoint_for(universe_id, environment);
+        let options = self
             .environment_gateway
-            .connection_for(universe_id, environment);
-        let mut client = EnvironmentDataClient::connect(
-            &connection.endpoint,
-            self.environment_gateway
-                .connect_options("lightspeed-power-reaper"),
-        )
-        .await
-        .ok()?;
-        let response = client
-            .initialize(&InitializeParams {
-                protocol_version: CURRENT_PROTOCOL_VERSION,
-                client_name: "lightspeed-power-reaper".to_owned(),
-                scope: connection.scope.clone(),
-                resume_connection_id: None,
-            })
+            .connect_options(POWER_REAPER_CLIENT)
+            .with_request_timeout(IDLE_REPORT_TIMEOUT);
+        let failure = |error: &ClientError| match error {
+            ClientError::ConnectTimeout { .. } | ClientError::DeadlineExceeded { .. } => {
+                IdleReportFailure::TimedOut
+            }
+            _ => IdleReportFailure::Unavailable,
+        };
+        let (client, _) = DataClient::connect_initialized(&endpoint, options)
             .await
-            .ok()?;
-        if response.protocol_version != CURRENT_PROTOCOL_VERSION {
-            return None;
-        }
-        client.initialized(&InitializedParams {}).await.ok()?;
-        client.idle(&IdleParams {}).await.ok()
+            .map_err(|error| failure(&error))?;
+        let report = client.get_idle(&GetIdleParams {}).await;
+        let _ = client.close().await;
+        report.map_err(|error| failure(&error))
     }
 }
 
@@ -196,7 +223,9 @@ mod tests {
             incarnation: EnvironmentIncarnationRecord {
                 incarnation_id: EnvironmentIncarnationId::new("incarnation-1"),
                 provision_request_id: Some(EnvironmentProvisionRequestId::new("request-1")),
-                provider_target_id: Some("target-1".into()),
+                provider_target_id: Some(
+                    environment_protocol::ids::ProviderTargetId::new("target-1").unwrap(),
+                ),
                 template_id: Some(EnvironmentTemplateId::new("dev")),
                 adoption_source_target: None,
                 power_states,
@@ -207,17 +236,18 @@ mod tests {
             public_endpoint: None,
             metadata: BTreeMap::new(),
             last_seen_at_ms: None,
+            lifecycle_error: None,
             created_at_ms: 1,
             updated_at_ms: 1,
         }
     }
 
-    fn report(idle_for_ms: u64, running_processes: u32, running_jobs: u32) -> IdleResponse {
-        IdleResponse {
+    fn report(idle_for_ms: u64, running_processes: u32, running_jobs: u32) -> GetIdleResponse {
+        GetIdleResponse {
             idle_for_ms,
-            running_processes,
-            running_jobs,
-            leftover_process_groups: 0,
+            running_process_count: running_processes,
+            running_job_count: running_jobs,
+            leftover_process_group_count: 0,
         }
     }
 
@@ -238,6 +268,13 @@ mod tests {
         );
         // Running work blocks every stage regardless of the clock.
         assert_eq!(decide_idle_action(&env, &report(10_000, 1, 0)), None);
+        // Leftover process groups are services left behind, not running work.
+        let mut leftovers = report(1_500, 0, 0);
+        leftovers.leftover_process_group_count = 3;
+        assert_eq!(
+            decide_idle_action(&env, &leftovers),
+            Some(IdleAction::Pause)
+        );
         assert_eq!(decide_idle_action(&env, &report(10_000, 0, 2)), None);
         // Suspend is due but unsupported by Incus: pause remains.
         assert_eq!(
diff --git a/crates/temporal-runtime/src/environments/prompts.rs b/crates/temporal-runtime/src/environments/prompts.rs
index f87168c1c..7dc62bd2a 100644
--- a/crates/temporal-runtime/src/environments/prompts.rs
+++ b/crates/temporal-runtime/src/environments/prompts.rs
@@ -20,17 +20,17 @@ pub(crate) async fn refresh(
         let connection = discovery.connection().await?;
         let query = tools::environment::sources::scan_query(
             source.roots.as_deref(),
-            &connection.cwd,
-            connection.initialized.home_directory.as_deref(),
+            connection.cwd.as_str(),
+            connection
+                .initialized
+                .home_directory
+                .as_ref()
+                .map(|home| home.as_str()),
             "prompts",
         )?;
         let scan = {
             let _timer = PhaseTimer::new("prompts_scan");
-            connection
-                .client
-                .scan(&query)
-                .await
-                .map_err(|e| e.to_string())?
+            connection.scan(query).await?
         };
         tools::prompts::environment::assemble(&scan)
     };
@@ -53,10 +53,23 @@ mod tests {
         ENVIRONMENT_PROMPT_CONTEXT_KEY, EnvironmentPromptReport, assemble, publication,
     };
 
+    fn daemon(root: &std::path::Path, cwd: &std::path::Path) -> environment_daemon::DaemonRuntime {
+        environment_daemon::DaemonRuntime::new(environment_daemon::config::DaemonConfig {
+            listen: None,
+            cwd: cwd.to_owned(),
+            fs_root: root.to_owned(),
+            state_dir: root.parent().unwrap().join("state"),
+            read_only_fs: true,
+            registration: None,
+            scrubbed_env: Vec::new(),
+        })
+        .unwrap()
+    }
+
     #[tokio::test(flavor = "current_thread")]
     async fn local_environment_prompts_scan_in_order_and_replace_on_failure() {
         let directory = tempfile::tempdir().unwrap();
-        let root = directory.path().canonicalize().unwrap();
+        let root = directory.path().canonicalize().unwrap().join("root");
         let cwd = root.join("project");
         let home = root.join("home");
         std::fs::create_dir_all(cwd.join(".agents/prompts")).unwrap();
@@ -85,8 +98,7 @@ mod tests {
         )
         .unwrap();
         std::fs::write(cwd.join(".agents/prompts/notes.json"), "Must not load").unwrap();
-        let fs =
-            environment_daemon::filesystem::LocalFileSystem::new(root.clone(), cwd.clone(), true);
+        let runtime = daemon(&root, &cwd);
         let query = tools::environment::sources::scan_query(
             None,
             cwd.to_str().unwrap(),
@@ -94,15 +106,23 @@ mod tests {
             "prompts",
         )
         .unwrap();
-        let scan = fs.scan(query).await.unwrap();
-        let (text, paths) = assemble(&scan).unwrap();
+        let scan = runtime
+            .filesystem()
+            .scan(
+                &environment_daemon::dispatch::RequestContext::detached(),
+                query,
+            )
+            .await
+            .unwrap();
+        let observation = assemble(&scan).unwrap();
         assert_eq!(
-            text,
+            observation.text,
             "First instructions\n\nLast instructions\n\nBase instructions"
         );
-        assert_eq!(paths.len(), 3);
+        assert_eq!(observation.paths.len(), 3);
+        assert!(observation.warnings.is_empty());
         let blobs = InMemoryBlobStore::new();
-        let entries = publication(&blobs, "machine", Ok((text, paths)))
+        let entries = publication(&blobs, "machine", Ok(observation.clone()))
             .await
             .unwrap();
         let entry = &entries[&ContextEntryKey::new(ENVIRONMENT_PROMPT_CONTEXT_KEY)];
@@ -114,10 +134,36 @@ mod tests {
         )
         .unwrap();
         assert!(report.available);
-        let mut incomplete = scan.clone();
-        incomplete.complete = false;
-        assert!(assemble(&incomplete).is_err());
-        let failed = publication(&blobs, "other-machine", assemble(&incomplete))
+        // A root that cannot be scanned is a warning naming it; the other
+        // roots' prompts still load.
+        let mut partial = scan.clone();
+        let failed_root = environment_protocol::paths::EnvironmentPath::new(
+            home.join(".agents/prompts").to_str().unwrap(),
+        )
+        .unwrap();
+        partial
+            .roots
+            .push(environment_protocol::data::scan::ScanRootResult::Failed {
+                path: failed_root.clone(),
+                error: environment_protocol::error::ProtocolError::deadline_exceeded("slow"),
+            });
+        let degraded = assemble(&partial).unwrap();
+        assert_eq!(degraded.text, observation.text);
+        assert_eq!(degraded.warnings.len(), 1);
+        assert!(degraded.warnings[0].starts_with(failed_root.as_str()));
+        // Prompts need a full observation of every root.
+        let mut unchanged = scan.clone();
+        unchanged.roots.push(
+            environment_protocol::data::scan::ScanRootResult::Unchanged {
+                path: failed_root,
+                fingerprint: environment_protocol::data::scan::ScanFingerprint::new(format!(
+                    "scan:v1:{}",
+                    "0".repeat(64)
+                ))
+                .unwrap(),
+            },
+        );
+        let failed = publication(&blobs, "other-machine", assemble(&unchanged))
             .await
             .unwrap();
         let failed = &failed[&ContextEntryKey::new(ENVIRONMENT_PROMPT_CONTEXT_KEY)];
@@ -130,10 +176,14 @@ mod tests {
         assert!(text.contains("unavailable"));
         assert!(!text.contains("Base instructions"));
         assert!(
-            publication(&blobs, "machine", Ok((String::new(), vec![])))
-                .await
-                .unwrap()
-                .is_empty()
+            publication(
+                &blobs,
+                "machine",
+                Ok(tools::prompts::environment::PromptObservation::default())
+            )
+            .await
+            .unwrap()
+            .is_empty()
         );
         let feature = EnvironmentsFeature {
             skills: Some(Default::default()),
diff --git a/crates/temporal-runtime/src/environments/provider_controllers.rs b/crates/temporal-runtime/src/environments/provider_controllers.rs
index dd91f8b39..d9050e271 100644
--- a/crates/temporal-runtime/src/environments/provider_controllers.rs
+++ b/crates/temporal-runtime/src/environments/provider_controllers.rs
@@ -1,701 +1,851 @@
+//! Provider controllers: dialing a provider's controller with its
+//! credential, recording what its `initialize` advertises, and classifying
+//! what goes wrong.
+//!
+//! Every connection runs the controller handshake through
+//! [`ControllerClient::connect_initialized`]. At each successful handshake
+//! the advertised `routes.data` passes the downgrade rule and, together with
+//! the optional features, is recorded on the provider record; the gateway's
+//! provider data proxy and the reconciler's data-plane handshake build
+//! every target's data route from that recorded base, never from the
+//! controller URL.
+
 use super::*;
 
-use ::environments::EnvironmentConnectionSpec;
-use async_trait::async_trait;
-use environment_client::{
-    EnvironmentClientError, EnvironmentProviderClient, WebSocketConnectOptions,
+use ::environments::{
+    ControllerFeatures, EndpointScheme, EnvironmentEndpoint, EnvironmentProviderId,
+    EnvironmentProviderStore, EnvironmentRegistryError, ListEnvironmentProviders,
+    RecordProviderController,
 };
+use async_trait::async_trait;
+use auth::SecretValue;
+use environment_client::{ClientError, ConnectOptions, ControllerClient};
 use environment_protocol::{
-    control::{
-        handshake::{ControllerInitializeParams, ControllerInitializeResponse},
-        ingress::{
-            EnsureIngressParams, IngressResponse, ProviderIngressStatus, RemoveIngressParams,
-        },
-        targets::{
-            AdoptTargetParams, AdoptTargetResponse, CloseTargetParams, CloseTargetResponse,
-            CreateTargetParams, CreateTargetResponse, EnvironmentTemplate, ListTemplatesParams,
-            ListTemplatesResponse, PowerState, ProviderTargetStatus, ProviderTargetSummary,
-            SetTargetPowerParams, SetTargetPowerResponse,
-        },
-    },
-    shared::{
-        CURRENT_PROTOCOL_VERSION, EnvironmentCapabilities, EnvironmentScope, EnvironmentTransport,
-        ImplementationInfo, ProviderTargetId,
-    },
+    control::handshake::ControllerInitializeResponse,
+    error::{ErrorData, PreconditionReason, ProtocolErrorKind},
+    routes::{DataRouteBase, UrlError},
 };
-
 use std::{
-    collections::{BTreeMap, hash_map::DefaultHasher},
-    hash::{Hash, Hasher},
-    sync::Arc,
+    collections::HashMap,
+    time::{Duration, Instant},
 };
-
-#[async_trait]
-pub(crate) trait ProviderController: Send {
-    async fn close(&mut self) -> Result<(), AgentApiError> {
-        Ok(())
-    }
-
-    async fn initialize(
-        &mut self,
-        params: &ControllerInitializeParams,
-    ) -> Result<ControllerInitializeResponse, AgentApiError>;
-
-    async fn create_target(
-        &mut self,
-        params: &CreateTargetParams,
-    ) -> Result<CreateTargetResponse, AgentApiError>;
-
-    async fn adopt_target(
-        &mut self,
-        params: &AdoptTargetParams,
-    ) -> Result<AdoptTargetResponse, AgentApiError>;
-
-    async fn list_templates(
-        &mut self,
-        params: &ListTemplatesParams,
-    ) -> Result<ListTemplatesResponse, AgentApiError>;
-
-    async fn close_target(
-        &mut self,
-        params: &CloseTargetParams,
-    ) -> Result<CloseTargetResponse, AgentApiError>;
-    async fn set_target_power(
-        &mut self,
-        params: &SetTargetPowerParams,
-    ) -> Result<SetTargetPowerResponse, AgentApiError>;
-    async fn ensure_ingress(
-        &mut self,
-        params: &EnsureIngressParams,
-    ) -> Result<IngressResponse, AgentApiError>;
-    async fn remove_ingress(
-        &mut self,
-        params: &RemoveIngressParams,
-    ) -> Result<IngressResponse, AgentApiError>;
+use thiserror::Error;
+
+/// Deadline of every controller call. Controllers answer target methods
+/// promptly and continue slow work in the background, so this bounds a
+/// hung controller, not a slow create.
+pub(crate) const CONTROLLER_REQUEST_TIMEOUT: Duration = Duration::from_secs(120);
+
+/// Options for one controller or provider data-route connection: the
+/// provider credential as the bearer token, the default connect and
+/// `initialize` bounds, and [`CONTROLLER_REQUEST_TIMEOUT`] on every call.
+pub(crate) fn provider_connect_options(credential: &SecretValue) -> ConnectOptions {
+    ConnectOptions::new(super::gateway::runtime_client_info())
+        .with_bearer_token(credential.expose())
+        .with_request_timeout(CONTROLLER_REQUEST_TIMEOUT)
 }
 
+/// Dials a provider controller and runs its handshake. Tests substitute an
+/// in-process client.
 #[async_trait]
 pub(crate) trait ProviderControllerConnector: Send + Sync {
     async fn connect(
         &self,
-        connection: &EnvironmentConnectionSpec,
-    ) -> Result<Box<dyn ProviderController>, AgentApiError>;
+        endpoint: &EnvironmentEndpoint,
+        options: ConnectOptions,
+    ) -> Result<ControllerClient, ClientError>;
 }
 
-#[derive(Default)]
-pub(crate) struct WebSocketProviderControllerConnector {
-    fake_backend: Arc<tokio::sync::Mutex<FakeBackend>>,
-}
+/// The production connector: `ws://`, `wss://` and `unix://` controller
+/// URLs through [`ControllerClient::connect_initialized`].
+#[derive(Clone, Copy, Debug, Default)]
+pub(crate) struct WebSocketProviderControllerConnector;
 
 #[async_trait]
 impl ProviderControllerConnector for WebSocketProviderControllerConnector {
     async fn connect(
         &self,
-        connection: &EnvironmentConnectionSpec,
-    ) -> Result<Box<dyn ProviderController>, AgentApiError> {
-        let mut controller: Box<dyn ProviderController> = match &connection.transport {
-            EnvironmentTransport::WebSocket => {
-                let client = EnvironmentProviderClient::connect(
-                    &connection.endpoint,
-                    WebSocketConnectOptions {
-                        bearer_token: None,
-                        user_agent: Some("lightspeed-temporal-runtime".to_owned()),
-                        headers: Vec::new(),
-                    },
-                )
-                .await
-                .map_err(map_environment_client_error)?;
-                Box::new(client)
-            }
-            EnvironmentTransport::Http => return Err(unsupported_transport("http")),
-            EnvironmentTransport::Stdio => return Err(unsupported_transport("stdio")),
-            EnvironmentTransport::Ssh => return Err(unsupported_transport("ssh")),
-            EnvironmentTransport::Provider { provider_type } => {
-                if provider_type == "fake" {
-                    Box::new(FakeProviderController {
-                        backend: self.fake_backend.clone(),
-                    })
-                } else {
-                    return Err(unsupported_transport(format!("provider:{provider_type}")));
-                }
-            }
-        };
-        let initialized = controller
-            .initialize(&ControllerInitializeParams {
-                protocol_version: CURRENT_PROTOCOL_VERSION,
-                client_name: "lightspeed-temporal-runtime".to_owned(),
-            })
-            .await;
-        let initialized = match initialized {
-            Ok(initialized) => initialized,
-            Err(error) => {
-                let _ = controller.close().await;
-                return Err(error);
-            }
-        };
-        if initialized.protocol_version != CURRENT_PROTOCOL_VERSION {
-            let _ = controller.close().await;
-            return Err(AgentApiError::rejected(format!(
-                "environment provider protocol version {} is incompatible with {}",
-                initialized.protocol_version, CURRENT_PROTOCOL_VERSION,
-            )));
-        }
-        Ok(controller)
+        endpoint: &EnvironmentEndpoint,
+        options: ConnectOptions,
+    ) -> Result<ControllerClient, ClientError> {
+        ControllerClient::connect_initialized(endpoint.as_str(), options)
+            .await
+            .map(|(client, _)| client)
     }
 }
 
-/// Power states the in-process fake provider advertises. Suspended is
-/// deliberately included so the Firecracker-shaped path has coverage.
-const FAKE_POWER_STATES: [PowerState; 4] = [
-    PowerState::Running,
-    PowerState::Paused,
-    PowerState::Suspended,
-    PowerState::Stopped,
-];
+/// The facts a controller's `initialize` advertises, checked: the data
+/// route base must not downgrade a `wss` controller to `ws`. A controller
+/// on a Unix socket is local, so any base passes.
+pub(crate) fn controller_facts(
+    endpoint: &EnvironmentEndpoint,
+    initialize: &ControllerInitializeResponse,
+) -> Result<(ControllerFeatures, DataRouteBase), UrlError> {
+    if endpoint.scheme() != EndpointScheme::Unix {
+        initialize
+            .routes
+            .data
+            .check_for_controller(endpoint.as_str())?;
+    }
+    Ok((
+        ControllerFeatures {
+            adopt_target: initialize.capabilities.adopt_target,
+            ingress: initialize.capabilities.ingress,
+        },
+        initialize.routes.data.clone(),
+    ))
+}
 
-#[derive(Default)]
-struct FakeBackend {
-    targets: BTreeMap<String, FakeTarget>,
-    requests: BTreeMap<(String, String, String), String>,
+/// An optional controller feature the runtime gates calls on.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum ControllerFeature {
+    AdoptTarget,
+    Ingress,
 }
 
-#[derive(Clone)]
-struct FakeTarget {
-    universe_id: String,
-    binding_id: String,
-    environment_id: String,
-    incarnation_id: String,
-    response: CreateTargetResponse,
+impl ControllerFeature {
+    pub(crate) fn as_str(self) -> &'static str {
+        match self {
+            Self::AdoptTarget => "target adoption",
+            Self::Ingress => "public ingress",
+        }
+    }
+
+    pub(crate) fn in_features(self, features: &ControllerFeatures) -> bool {
+        match self {
+            Self::AdoptTarget => features.adopt_target,
+            Self::Ingress => features.ingress,
+        }
+    }
 }
 
-struct FakeProviderController {
-    backend: Arc<tokio::sync::Mutex<FakeBackend>>,
+/// One initialized controller connection and what its handshake advertised.
+#[derive(Clone)]
+pub(crate) struct ProviderController {
+    pub(crate) provider_id: EnvironmentProviderId,
+    pub(crate) client: ControllerClient,
+    pub(crate) features: ControllerFeatures,
+    pub(crate) data_route_base: DataRouteBase,
+    /// The provider credential, presented on its data routes too.
+    pub(crate) credential: SecretValue,
 }
 
-#[async_trait]
-impl ProviderController for FakeProviderController {
-    async fn initialize(
-        &mut self,
-        _params: &ControllerInitializeParams,
-    ) -> Result<ControllerInitializeResponse, AgentApiError> {
-        Ok(ControllerInitializeResponse {
-            protocol_version: CURRENT_PROTOCOL_VERSION,
-            capabilities: environment_protocol::control::handshake::ControllerCapabilities {
-                list_templates: true,
-                list_targets: true,
-                create_target: true,
-                adopt_target: true,
-                get_target: true,
-                close_target: true,
-                set_target_power: true,
-                ingress: true,
-            },
-            implementation: ImplementationInfo {
-                name: "lightspeed-fake-environment-provider".to_owned(),
-                version: Some(env!("CARGO_PKG_VERSION").to_owned()),
-                ..Default::default()
-            },
-        })
+impl ProviderController {
+    /// Refuse a call that needs an optional feature the controller did not
+    /// advertise, before anything is sent.
+    pub(crate) fn require(&self, feature: ControllerFeature) -> Result<(), ControllerError> {
+        if feature.in_features(&self.features) {
+            Ok(())
+        } else {
+            Err(ControllerError::FeatureUnavailable {
+                provider_id: self.provider_id.to_string(),
+                feature,
+            })
+        }
     }
 
-    async fn list_templates(
-        &mut self,
-        _params: &ListTemplatesParams,
-    ) -> Result<ListTemplatesResponse, AgentApiError> {
-        Ok(ListTemplatesResponse {
-            templates: vec![EnvironmentTemplate {
-                template_id: "rust-v1".to_owned(),
-                display_name: "Rust development".to_owned(),
-                description: Some("Deterministic fake provider template".to_owned()),
-                public_ingress: false,
-                deprecated: false,
-                metadata: BTreeMap::new(),
-            }],
-        })
-    }
-
-    async fn create_target(
-        &mut self,
-        params: &CreateTargetParams,
-    ) -> Result<CreateTargetResponse, AgentApiError> {
-        if params.template_id != "rust-v1" && !params.template_id.starts_with("adopted:") {
-            return Err(AgentApiError::rejected(
-                "fake provider policy rejected the template",
-            ));
-        }
-        let key = (
-            params.binding.universe_id.clone(),
-            params.binding.binding_id.clone(),
-            params.request_id.clone(),
-        );
-        let mut backend = self.backend.lock().await;
-        if let Some(target_id) = backend.requests.get(&key) {
-            return Ok(backend
-                .targets
-                .get(target_id)
-                .expect("fake request index target")
-                .response
-                .clone());
+    /// Wrap a failed call of this controller.
+    pub(crate) fn call_error(&self, source: ClientError) -> ControllerError {
+        ControllerError::Call {
+            provider_id: self.provider_id.to_string(),
+            source,
         }
-        if backend.targets.values().any(|target| {
-            target.universe_id == params.binding.universe_id
-                && target.binding_id == params.binding.binding_id
-                && target.response.target.status != ProviderTargetStatus::Closed
-        }) {
-            return Err(AgentApiError::rejected(
-                "fake provider policy allows one active target per binding",
-            ));
-        }
-        let mut identity = DefaultHasher::new();
-        params.binding.universe_id.hash(&mut identity);
-        params.binding.binding_id.hash(&mut identity);
-        params.incarnation_id.hash(&mut identity);
-        let target_id = format!("fake-{:016x}", identity.finish());
-        let provider_target_id = ProviderTargetId::new(target_id.clone());
-        let capabilities = EnvironmentCapabilities::filesystem(true, true).with_process();
-        let response = CreateTargetResponse {
-            target: ProviderTargetSummary {
-                target_id: provider_target_id.clone(),
-                display_name: Some(params.environment_id.clone()),
-                status: ProviderTargetStatus::Ready,
-                scope: EnvironmentScope::Default,
-                capabilities: capabilities.clone(),
-                default_cwd: None,
-                power_states: FAKE_POWER_STATES.to_vec(),
-                metadata: BTreeMap::from([(
-                    "imageFingerprint".to_owned(),
-                    format!("fake:{}", params.template_id),
-                )]),
-            },
-        };
-        backend.requests.insert(key, target_id.clone());
-        backend.targets.insert(
-            target_id,
-            FakeTarget {
-                universe_id: params.binding.universe_id.clone(),
-                binding_id: params.binding.binding_id.clone(),
-                environment_id: params.environment_id.clone(),
-                incarnation_id: params.incarnation_id.clone(),
-                response: response.clone(),
-            },
-        );
-        Ok(response)
     }
 
-    async fn adopt_target(
-        &mut self,
-        params: &AdoptTargetParams,
-    ) -> Result<AdoptTargetResponse, AgentApiError> {
-        let create = CreateTargetParams {
-            request_id: params.request_id.clone(),
-            environment_id: params.environment_id.clone(),
-            incarnation_id: params.incarnation_id.clone(),
-            binding: params.binding.clone(),
-            template_id: format!("adopted:{}", params.source_target),
-        };
-        let response = self.create_target(&create).await?;
-        Ok(AdoptTargetResponse {
-            target: response.target,
-        })
+    pub(crate) async fn close(&self) {
+        let _ = self.client.close().await;
     }
+}
 
-    async fn close_target(
-        &mut self,
-        params: &CloseTargetParams,
-    ) -> Result<CloseTargetResponse, AgentApiError> {
-        let mut backend = self.backend.lock().await;
-        let target = backend
-            .targets
-            .get_mut(params.target_id.as_str())
-            .ok_or_else(|| {
-                AgentApiError::not_found(format!("fake target not found: {}", params.target_id))
-            })?;
-        if target.universe_id != params.binding.universe_id
-            || target.binding_id != params.binding.binding_id
-            || target.environment_id != params.environment_id
-            || target.incarnation_id != params.incarnation_id
-        {
-            return Err(AgentApiError::rejected(
-                "fake target ownership metadata does not match close request",
-            ));
+/// Connect to a provider's controller with its stored credential, check the
+/// advertised facts and record them on the provider record when they
+/// changed.
+pub(crate) async fn connect_provider_controller(
+    store: &dyn EnvironmentProviderStore,
+    connector: &dyn ProviderControllerConnector,
+    provider_id: &EnvironmentProviderId,
+) -> Result<ProviderController, ControllerError> {
+    let provider = store.read_provider(provider_id).await?;
+    let credential = store.read_provider_credential(provider_id).await?;
+    let client = connector
+        .connect(
+            &provider.controller_endpoint,
+            provider_connect_options(&credential),
+        )
+        .await
+        .map_err(|source| ControllerError::Connect {
+            provider_id: provider_id.to_string(),
+            source,
+        })?;
+    let (features, data_route_base) =
+        match controller_facts(&provider.controller_endpoint, client.initialize_response()) {
+            Ok(facts) => facts,
+            Err(source) => {
+                let _ = client.close().await;
+                return Err(ControllerError::Routes {
+                    provider_id: provider_id.to_string(),
+                    source,
+                });
+            }
+        };
+    if provider.controller_features != Some(features)
+        || provider.data_route_base.as_ref() != Some(&data_route_base)
+    {
+        let recorded = store
+            .record_provider_controller(RecordProviderController {
+                provider_id: provider_id.clone(),
+                controller_endpoint: provider.controller_endpoint.clone(),
+                features,
+                data_route_base: data_route_base.clone(),
+            })
+            .await;
+        if let Err(error) = recorded {
+            let _ = client.close().await;
+            return Err(error.into());
         }
-        target.response.target.status = ProviderTargetStatus::Closed;
-        Ok(CloseTargetResponse {
-            target_id: params.target_id.clone(),
-            status: ProviderTargetStatus::Closed,
-        })
     }
+    Ok(ProviderController {
+        provider_id: provider_id.clone(),
+        client,
+        features,
+        data_route_base,
+        credential,
+    })
+}
 
-    /// The fake provider converges instantly: the requested steady state is
-    /// the observed state on return.
-    async fn set_target_power(
-        &mut self,
-        params: &SetTargetPowerParams,
-    ) -> Result<SetTargetPowerResponse, AgentApiError> {
-        if !FAKE_POWER_STATES.contains(&params.power) {
-            return Err(AgentApiError::rejected(format!(
-                "fake provider does not support power state {}",
-                params.power
-            )));
-        }
-        let mut backend = self.backend.lock().await;
-        let target = backend
-            .targets
-            .get_mut(params.target_id.as_str())
-            .ok_or_else(|| {
-                AgentApiError::not_found(format!("fake target not found: {}", params.target_id))
-            })?;
-        if target.universe_id != params.binding.universe_id
-            || target.binding_id != params.binding.binding_id
-            || target.environment_id != params.environment_id
-            || target.incarnation_id != params.incarnation_id
-        {
-            return Err(AgentApiError::rejected(
-                "fake target ownership metadata does not match power request",
-            ));
+/// Check a controller endpoint at provider registration. A controller that
+/// answers definitively wrong (an HTTP refusal such as 404 for a URL that
+/// names no controller or 401 for a wrong credential, another plane, or a
+/// data route base that fails the downgrade rule) is refused, so a
+/// mis-registered provider never provisions anything. One that cannot be
+/// reached right now is accepted; its facts are recorded at the first
+/// successful handshake.
+pub(crate) async fn probe_controller(
+    connector: &dyn ProviderControllerConnector,
+    endpoint: &EnvironmentEndpoint,
+    credential: &SecretValue,
+) -> Result<Option<(ControllerFeatures, DataRouteBase)>, AgentApiError> {
+    match connector
+        .connect(endpoint, provider_connect_options(credential))
+        .await
+    {
+        Ok(client) => {
+            let facts = controller_facts(endpoint, client.initialize_response());
+            let _ = client.close().await;
+            facts.map(Some).map_err(|error| {
+                AgentApiError::invalid_request(format!(
+                    "the provider controller advertised an unusable data route: {error}"
+                ))
+            })
         }
-        if target.response.target.status == ProviderTargetStatus::Closed {
-            return Err(AgentApiError::rejected("fake target is closed"));
+        Err(error) if refuses_registration(&error) => Err(AgentApiError::invalid_request(format!(
+            "the provider controller at {endpoint} refused the handshake: {error}"
+        ))),
+        Err(error) => {
+            tracing::warn!(
+                target: "temporal_runtime",
+                %endpoint,
+                %error,
+                "provider controller is not reachable at registration; its features are recorded at the first successful handshake"
+            );
+            Ok(None)
         }
-        target.response.target.status = match params.power {
-            PowerState::Running => ProviderTargetStatus::Ready,
-            PowerState::Paused => ProviderTargetStatus::Paused,
-            PowerState::Suspended => ProviderTargetStatus::Suspended,
-            PowerState::Stopped => ProviderTargetStatus::Stopped,
-        };
-        Ok(SetTargetPowerResponse {
-            target: target.response.target.clone(),
-        })
     }
+}
 
-    async fn ensure_ingress(
-        &mut self,
-        _params: &EnsureIngressParams,
-    ) -> Result<IngressResponse, AgentApiError> {
-        Ok(IngressResponse {
-            status: ProviderIngressStatus::Ready,
-            public_endpoint: Some("https://fake.env.test".to_owned()),
-        })
+/// Handshake failures that prove the registration wrong rather than the
+/// controller temporarily unavailable.
+fn refuses_registration(error: &ClientError) -> bool {
+    match error {
+        ClientError::UpgradeRejected { status } => {
+            (400..500).contains(status) && !matches!(status, 408 | 429)
+        }
+        ClientError::WrongPlane { .. } | ClientError::Configuration { .. } => true,
+        _ => false,
     }
+}
 
-    async fn remove_ingress(
-        &mut self,
-        _params: &RemoveIngressParams,
-    ) -> Result<IngressResponse, AgentApiError> {
-        Ok(IngressResponse {
-            status: ProviderIngressStatus::Disabled,
-            public_endpoint: None,
-        })
-    }
+/// How the reconciler treats a failed controller interaction.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum ControllerDisposition {
+    /// May succeed later unchanged: keep the status, record the error and
+    /// retry next pass, until the provisioning deadline.
+    Transient,
+    /// The provider refused the request; repeating it cannot help.
+    Refused,
+    /// The provider holds no such target.
+    Gone,
 }
 
-#[async_trait]
-impl<T> ProviderController for EnvironmentProviderClient<T>
-where
-    T: environment_client::JsonRpcTransport + Send,
-{
-    async fn close(&mut self) -> Result<(), AgentApiError> {
-        EnvironmentProviderClient::close(self)
-            .await
-            .map_err(map_environment_client_error)
+#[derive(Debug, Error)]
+pub(crate) enum ControllerError {
+    /// Dialing the controller or its `initialize` failed, a version or
+    /// plane mismatch included. Always transient: a provider restart or a
+    /// rollout that upgrades the runtime first must not fail environments.
+    #[error("provider controller {provider_id} is unreachable: {source}")]
+    Connect {
+        provider_id: String,
+        #[source]
+        source: ClientError,
+    },
+
+    /// The controller advertised a data route base that fails the
+    /// downgrade rule; treated like a failed `initialize`.
+    #[error("provider controller {provider_id} advertised an unusable data route: {source}")]
+    Routes {
+        provider_id: String,
+        #[source]
+        source: UrlError,
+    },
+
+    /// A call on an initialized connection failed.
+    #[error("provider controller {provider_id}: {source}")]
+    Call {
+        provider_id: String,
+        #[source]
+        source: ClientError,
+    },
+
+    /// The call needs an optional feature the controller did not
+    /// advertise; nothing was sent.
+    #[error("provider {provider_id} does not offer {}", feature.as_str())]
+    FeatureUnavailable {
+        provider_id: String,
+        feature: ControllerFeature,
+    },
+
+    /// An earlier failure in this reconcile pass marked the provider
+    /// unhealthy; its remaining environments are not attempted.
+    #[error("provider controller {provider_id} is skipped for this pass: {message}")]
+    Skipped {
+        provider_id: String,
+        message: String,
+    },
+
+    #[error(transparent)]
+    Registry(#[from] EnvironmentRegistryError),
+}
+
+impl ControllerError {
+    /// Refusals are the controller's typed answers that no retry changes.
+    /// Connection failures, deadlines, undecodable answers and retryable or
+    /// `internal` answers are transient; `notFound` means the target is
+    /// gone. Registry failures are the runtime's own and transient.
+    pub(crate) fn disposition(&self) -> ControllerDisposition {
+        match self {
+            Self::Call { source, .. } => call_disposition(source),
+            Self::FeatureUnavailable { .. } => ControllerDisposition::Refused,
+            Self::Connect { .. } | Self::Routes { .. } | Self::Skipped { .. } => {
+                ControllerDisposition::Transient
+            }
+            Self::Registry(_) => ControllerDisposition::Transient,
+        }
     }
 
-    async fn initialize(
-        &mut self,
-        params: &ControllerInitializeParams,
-    ) -> Result<ControllerInitializeResponse, AgentApiError> {
-        EnvironmentProviderClient::initialize(self, params)
-            .await
-            .map_err(map_environment_client_error)
+    /// True when the controller connection itself failed (a dial, a
+    /// deadline, a dropped socket): the provider's remaining environments
+    /// are skipped for the rest of the pass, so one hung provider costs one
+    /// deadline per pass instead of one per environment.
+    pub(crate) fn is_connection_failure(&self) -> bool {
+        match self {
+            Self::Connect { .. } | Self::Routes { .. } | Self::Skipped { .. } => true,
+            Self::Call { source, .. } => !matches!(
+                source,
+                ClientError::Protocol(_) | ClientError::Decode(_) | ClientError::Encode(_)
+            ),
+            Self::FeatureUnavailable { .. } | Self::Registry(_) => false,
+        }
     }
 
-    async fn create_target(
-        &mut self,
-        params: &CreateTargetParams,
-    ) -> Result<CreateTargetResponse, AgentApiError> {
-        EnvironmentProviderClient::create_target(self, params)
-            .await
-            .map_err(map_environment_client_error)
+    /// The precondition a refusal named, if any.
+    pub(crate) fn precondition(&self) -> Option<PreconditionReason> {
+        match self {
+            Self::Call {
+                source: ClientError::Protocol(error),
+                ..
+            } => match error.data {
+                ErrorData::FailedPrecondition { reason } => Some(reason),
+                _ => None,
+            },
+            _ => None,
+        }
     }
 
-    async fn adopt_target(
-        &mut self,
-        params: &AdoptTargetParams,
-    ) -> Result<AdoptTargetResponse, AgentApiError> {
-        EnvironmentProviderClient::adopt_target(self, params)
-            .await
-            .map_err(map_environment_client_error)
+    pub(crate) fn provider_id(&self) -> Option<&str> {
+        match self {
+            Self::Connect { provider_id, .. }
+            | Self::Routes { provider_id, .. }
+            | Self::Call { provider_id, .. }
+            | Self::FeatureUnavailable { provider_id, .. }
+            | Self::Skipped { provider_id, .. } => Some(provider_id),
+            Self::Registry(_) => None,
+        }
     }
 
-    async fn list_templates(
-        &mut self,
-        params: &ListTemplatesParams,
-    ) -> Result<ListTemplatesResponse, AgentApiError> {
-        EnvironmentProviderClient::list_templates(self, params)
-            .await
-            .map_err(map_environment_client_error)
+    /// The API error for a caller waiting on this controller interaction.
+    pub(crate) fn into_api_error(self) -> AgentApiError {
+        match self {
+            Self::Registry(error) => super::providers::map_environments_error(error),
+            other => match other.disposition() {
+                ControllerDisposition::Refused => AgentApiError::rejected(other.to_string()),
+                ControllerDisposition::Gone => AgentApiError::not_found(other.to_string()),
+                ControllerDisposition::Transient => AgentApiError::internal(other.to_string()),
+            },
+        }
     }
+}
 
-    async fn close_target(
-        &mut self,
-        params: &CloseTargetParams,
-    ) -> Result<CloseTargetResponse, AgentApiError> {
-        EnvironmentProviderClient::close_target(self, params)
-            .await
-            .map_err(map_environment_client_error)
+/// The disposition of a failed call on an initialized connection.
+pub(crate) fn call_disposition(error: &ClientError) -> ControllerDisposition {
+    match error {
+        ClientError::Protocol(error) => match error.kind() {
+            ProtocolErrorKind::NotFound => ControllerDisposition::Gone,
+            ProtocolErrorKind::Internal => ControllerDisposition::Transient,
+            kind if kind.is_retryable() => ControllerDisposition::Transient,
+            _ => ControllerDisposition::Refused,
+        },
+        _ => ControllerDisposition::Transient,
     }
+}
 
-    async fn set_target_power(
+/// The controllers one reconcile pass talks to: each provider is dialed at
+/// most once per pass, and a provider whose connection failed is skipped
+/// for the rest of the pass.
+#[derive(Default)]
+pub(crate) struct ProviderPass {
+    controllers: HashMap<EnvironmentProviderId, PassController>,
+}
+
+enum PassController {
+    Connected(ProviderController),
+    Unhealthy(String),
+}
+
+impl ProviderPass {
+    pub(crate) async fn controller(
         &mut self,
-        params: &SetTargetPowerParams,
-    ) -> Result<SetTargetPowerResponse, AgentApiError> {
-        EnvironmentProviderClient::set_target_power(self, params)
-            .await
-            .map_err(map_environment_client_error)
+        store: &dyn EnvironmentProviderStore,
+        connector: &dyn ProviderControllerConnector,
+        provider_id: &EnvironmentProviderId,
+    ) -> Result<ProviderController, ControllerError> {
+        match self.controllers.get(provider_id) {
+            Some(PassController::Connected(controller)) => return Ok(controller.clone()),
+            Some(PassController::Unhealthy(message)) => {
+                return Err(ControllerError::Skipped {
+                    provider_id: provider_id.to_string(),
+                    message: message.clone(),
+                });
+            }
+            None => {}
+        }
+        match connect_provider_controller(store, connector, provider_id).await {
+            Ok(controller) => {
+                self.controllers.insert(
+                    provider_id.clone(),
+                    PassController::Connected(controller.clone()),
+                );
+                Ok(controller)
+            }
+            Err(error) => {
+                if error.is_connection_failure() {
+                    self.controllers.insert(
+                        provider_id.clone(),
+                        PassController::Unhealthy(error.to_string()),
+                    );
+                }
+                Err(error)
+            }
+        }
     }
 
-    async fn ensure_ingress(
-        &mut self,
-        params: &EnsureIngressParams,
-    ) -> Result<IngressResponse, AgentApiError> {
-        EnvironmentProviderClient::ensure_ingress(self, params)
-            .await
-            .map_err(map_environment_client_error)
+    /// Record a failure of `error`'s provider: a connection failure skips
+    /// the provider for the rest of the pass.
+    pub(crate) async fn observe_failure(&mut self, error: &ControllerError) {
+        if !error.is_connection_failure() {
+            return;
+        }
+        let Some(provider_id) = error.provider_id() else {
+            return;
+        };
+        let Ok(provider_id) = EnvironmentProviderId::try_new(provider_id) else {
+            return;
+        };
+        if let Some(PassController::Connected(controller)) = self
+            .controllers
+            .insert(provider_id, PassController::Unhealthy(error.to_string()))
+        {
+            controller.close().await;
+        }
     }
 
-    async fn remove_ingress(
-        &mut self,
-        params: &RemoveIngressParams,
-    ) -> Result<IngressResponse, AgentApiError> {
-        EnvironmentProviderClient::remove_ingress(self, params)
-            .await
-            .map_err(map_environment_client_error)
+    pub(crate) async fn close(self) {
+        for controller in self.controllers.into_values() {
+            if let PassController::Connected(controller) = controller {
+                controller.close().await;
+            }
+        }
     }
 }
 
-/// Finish one scoped provider-controller operation and close its transport on
-/// both success and failure. A close error does not replace the operation's
-/// result: controller calls are already complete when this runs.
-pub(crate) async fn finish_provider_controller<T>(
-    mut controller: Box<dyn ProviderController>,
-    result: Result<T, AgentApiError>,
-) -> Result<T, AgentApiError> {
-    let _ = controller.close().await;
-    result
+/// Dials providers whose controller facts are not recorded yet (never
+/// reached, or their endpoint changed and the registration probe could not
+/// reach the new one), so the gateway's data proxy gets a data route base
+/// even when none of the provider's environments needs convergence. Failed
+/// attempts back off per provider.
+#[derive(Default)]
+pub(crate) struct ProviderFactsRefresh {
+    listed_at: Option<Instant>,
+    retry: HashMap<EnvironmentProviderId, (Instant, Duration)>,
 }
 
-pub(crate) fn map_environment_client_error(error: EnvironmentClientError) -> AgentApiError {
-    match error {
-        EnvironmentClientError::Protocol(error) => {
-            AgentApiError::rejected(format!("provider controller error: {}", error.message))
-        }
-        EnvironmentClientError::TransportClosed => {
-            AgentApiError::rejected("provider controller disconnected")
-        }
-        EnvironmentClientError::Serialize(error) => {
-            AgentApiError::rejected(format!("provider controller call failed: {error}"))
+impl ProviderFactsRefresh {
+    /// How often the provider list is read.
+    const LIST_INTERVAL: Duration = Duration::from_secs(5);
+    const FIRST_RETRY: Duration = Duration::from_secs(5);
+    const MAX_RETRY: Duration = Duration::from_secs(300);
+
+    /// One refresh step of a deployment pass; connections stay in `pass`.
+    pub(crate) async fn run(
+        &mut self,
+        pass: &mut ProviderPass,
+        store: &dyn EnvironmentProviderStore,
+        connector: &dyn ProviderControllerConnector,
+    ) {
+        let now = Instant::now();
+        if self
+            .listed_at
+            .is_some_and(|listed| now.duration_since(listed) < Self::LIST_INTERVAL)
+        {
+            return;
         }
-        EnvironmentClientError::Transport(message)
-        | EnvironmentClientError::InvalidMessage(message) => {
-            AgentApiError::rejected(format!("provider controller call failed: {message}"))
+        self.listed_at = Some(now);
+        let providers = match store
+            .list_providers(ListEnvironmentProviders::default())
+            .await
+        {
+            Ok(providers) => providers,
+            Err(error) => {
+                tracing::warn!(target: "temporal_runtime", %error, "listing providers for a controller handshake failed");
+                return;
+            }
+        };
+        let unrecorded: Vec<EnvironmentProviderId> = providers
+            .into_iter()
+            .filter(|provider| provider.data_route_base.is_none())
+            .map(|provider| provider.provider_id)
+            .collect();
+        self.retry
+            .retain(|provider_id, _| unrecorded.contains(provider_id));
+        for provider_id in unrecorded {
+            if self
+                .retry
+                .get(&provider_id)
+                .is_some_and(|(next, _)| now < *next)
+            {
+                continue;
+            }
+            match pass.controller(store, connector, &provider_id).await {
+                Ok(_) => {
+                    self.retry.remove(&provider_id);
+                }
+                Err(error) => {
+                    let backoff = self
+                        .retry
+                        .get(&provider_id)
+                        .map_or(Self::FIRST_RETRY, |(_, backoff)| {
+                            (*backoff * 2).min(Self::MAX_RETRY)
+                        });
+                    tracing::debug!(
+                        target: "temporal_runtime",
+                        %provider_id,
+                        %error,
+                        retry_in_s = backoff.as_secs(),
+                        "provider controller handshake failed; its data route base stays unrecorded"
+                    );
+                    self.retry.insert(provider_id, (now + backoff, backoff));
+                }
+            }
         }
     }
 }
 
-fn unsupported_transport(transport: impl std::fmt::Display) -> AgentApiError {
-    AgentApiError::invalid_request(format!(
-        "provider controller transport is not supported by this gateway: {transport}"
-    ))
+impl EnvironmentService {
+    /// A controller connection for one API request; the caller closes it.
+    pub(crate) async fn connect_provider_controller(
+        &self,
+        provider_id: &EnvironmentProviderId,
+    ) -> Result<ProviderController, ControllerError> {
+        connect_provider_controller(
+            self.store.as_ref(),
+            self.provider_controller_connector.as_ref(),
+            provider_id,
+        )
+        .await
+    }
+
+    /// Refuse an API request that needs an optional controller feature the
+    /// provider does not offer. Features recorded at the last handshake
+    /// decide; a provider not reached yet is dialed once to learn them.
+    pub(crate) async fn require_controller_feature(
+        &self,
+        provider_id: &EnvironmentProviderId,
+        feature: ControllerFeature,
+    ) -> Result<(), AgentApiError> {
+        let provider = self.read_environment_provider(provider_id).await?;
+        let features = match provider.controller_features {
+            Some(features) => features,
+            None => {
+                let controller = self
+                    .connect_provider_controller(provider_id)
+                    .await
+                    .map_err(ControllerError::into_api_error)?;
+                controller.close().await;
+                controller.features
+            }
+        };
+        if feature.in_features(&features) {
+            Ok(())
+        } else {
+            Err(AgentApiError::rejected(format!(
+                "provider {provider_id} does not offer {}",
+                feature.as_str()
+            )))
+        }
+    }
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
-    use ::environments::EnvironmentConnectionSpec;
-    use environment_client::{EnvironmentClientResult, JsonRpcTransport};
-    use environment_protocol::control::targets::ProviderBindingContext;
-    use serde_json::Value;
-    use std::sync::atomic::{AtomicBool, Ordering};
-
-    struct CloseTrackingTransport {
-        closed: Arc<AtomicBool>,
+    use environment_protocol::{
+        CONTROLLER_PROTOCOL_VERSION,
+        control::handshake::{ControllerCapabilities, ControllerRoutes},
+        error::ProtocolError,
+        handshake::{ImplementationInfo, Plane},
+    };
+
+    fn initialize(data: &str) -> ControllerInitializeResponse {
+        ControllerInitializeResponse {
+            protocol_version: CONTROLLER_PROTOCOL_VERSION,
+            plane: Plane::Controller,
+            server_info: ImplementationInfo::new("controller").unwrap(),
+            capabilities: ControllerCapabilities {
+                adopt_target: true,
+                ingress: false,
+            },
+            routes: ControllerRoutes {
+                data: DataRouteBase::new(data).unwrap(),
+            },
+        }
     }
 
-    #[async_trait]
-    impl JsonRpcTransport for CloseTrackingTransport {
-        async fn send(&mut self, _message: Value) -> EnvironmentClientResult<()> {
-            Ok(())
+    fn call(source: ClientError) -> ControllerError {
+        ControllerError::Call {
+            provider_id: "provider".into(),
+            source,
         }
+    }
 
-        async fn recv(&mut self) -> EnvironmentClientResult<Option<Value>> {
-            Ok(None)
+    #[test]
+    fn connection_failures_and_contract_breaches_are_transient() {
+        for source in [
+            ClientError::Closed {
+                code: None,
+                reason: None,
+            },
+            ClientError::Transport("reset".into()),
+            ClientError::DeadlineExceeded {
+                elapsed_ms: 120_000,
+            },
+            ClientError::Decode("missing field".into()),
+            ClientError::InvalidMessage("binary frame".into()),
+            ClientError::Protocol(ProtocolError::internal("bug")),
+            ClientError::Protocol(ProtocolError::unavailable("incus api down")),
+        ] {
+            assert_eq!(
+                call(source.clone()).disposition(),
+                ControllerDisposition::Transient,
+                "{source}"
+            );
         }
-
-        async fn close(&mut self) -> EnvironmentClientResult<()> {
-            self.closed.store(true, Ordering::SeqCst);
-            Ok(())
+        // Every handshake failure is transient, a version mismatch included.
+        for source in [
+            ClientError::VersionMismatch {
+                plane: Plane::Controller,
+                local: 3,
+                remote: 4,
+            },
+            ClientError::UpgradeRejected { status: 404 },
+            ClientError::ConnectTimeout {
+                endpoint: "ws://provider".into(),
+            },
+        ] {
+            let error = ControllerError::Connect {
+                provider_id: "provider".into(),
+                source,
+            };
+            assert_eq!(error.disposition(), ControllerDisposition::Transient);
+            assert!(error.is_connection_failure());
         }
     }
 
-    fn connection() -> EnvironmentConnectionSpec {
-        EnvironmentConnectionSpec::new(
-            "in-process",
-            EnvironmentTransport::Provider {
-                provider_type: "fake".to_owned(),
-            },
-        )
+    #[test]
+    fn typed_refusals_and_missing_targets_are_final() {
+        let refused = call(ClientError::Protocol(ProtocolError::failed_precondition(
+            PreconditionReason::TemplateDeprecated,
+            "deprecated",
+        )));
+        assert_eq!(refused.disposition(), ControllerDisposition::Refused);
+        assert_eq!(
+            refused.precondition(),
+            Some(PreconditionReason::TemplateDeprecated)
+        );
+        assert!(!refused.is_connection_failure());
+        let gone = call(ClientError::Protocol(ProtocolError::not_found("no target")));
+        assert_eq!(gone.disposition(), ControllerDisposition::Gone);
+        let unadvertised = ControllerError::FeatureUnavailable {
+            provider_id: "provider".into(),
+            feature: ControllerFeature::AdoptTarget,
+        };
+        assert_eq!(unadvertised.disposition(), ControllerDisposition::Refused);
+        // A deadline or a dropped socket skips the provider for the pass.
+        assert!(call(ClientError::DeadlineExceeded { elapsed_ms: 1 }).is_connection_failure());
+        assert!(!call(ClientError::Decode("bad".into())).is_connection_failure());
     }
 
-    fn create(
-        universe: &str,
-        binding: &str,
-        request: &str,
-        environment: &str,
-    ) -> CreateTargetParams {
-        CreateTargetParams {
-            request_id: request.to_owned(),
-            environment_id: environment.to_owned(),
-            incarnation_id: format!("incarnation-{environment}"),
-            binding: ProviderBindingContext {
-                universe_id: universe.to_owned(),
-                binding_id: binding.to_owned(),
+    #[test]
+    fn registration_refuses_only_definitive_handshake_failures() {
+        for refused in [
+            ClientError::UpgradeRejected { status: 404 },
+            ClientError::UpgradeRejected { status: 401 },
+            ClientError::WrongPlane {
+                expected: Plane::Controller,
+                actual: Plane::Data,
             },
-            template_id: "rust-v1".to_owned(),
+        ] {
+            assert!(refuses_registration(&refused), "{refused}");
+        }
+        for accepted in [
+            ClientError::UpgradeRejected { status: 503 },
+            ClientError::UpgradeRejected { status: 429 },
+            ClientError::Connect {
+                endpoint: "ws://provider".into(),
+                message: "refused".into(),
+            },
+            ClientError::VersionMismatch {
+                plane: Plane::Controller,
+                local: 3,
+                remote: 4,
+            },
+        ] {
+            assert!(!refuses_registration(&accepted), "{accepted}");
         }
     }
 
-    #[tokio::test(flavor = "current_thread")]
-    async fn finishing_a_provider_operation_closes_its_transport() {
-        let closed = Arc::new(AtomicBool::new(false));
-        let controller: Box<dyn ProviderController> =
-            Box::new(EnvironmentProviderClient::new(CloseTrackingTransport {
-                closed: closed.clone(),
-            }));
-
-        let value = finish_provider_controller(controller, Ok::<_, AgentApiError>(42))
-            .await
-            .expect("operation result");
-
-        assert_eq!(value, 42);
-        assert!(closed.load(Ordering::SeqCst));
+    /// A connector whose every dial fails, counting the attempts.
+    #[derive(Default)]
+    struct UnreachableConnector {
+        attempts: std::sync::atomic::AtomicUsize,
     }
 
-    #[tokio::test(flavor = "current_thread")]
-    async fn fake_provider_adopts_retries_and_isolates_bindings() {
-        let connector = WebSocketProviderControllerConnector::default();
-        let mut first = connector.connect(&connection()).await.expect("connect");
-        let created = first
-            .create_target(&create(
-                "universe-a",
-                "binding-a",
-                "request-1",
-                "environment-1",
-            ))
-            .await
-            .expect("create");
-        drop(first);
-
-        let mut after_restart = connector.connect(&connection()).await.expect("reconnect");
-        let adopted = after_restart
-            .create_target(&create(
-                "universe-a",
-                "binding-a",
-                "request-1",
-                "different-environment",
-            ))
-            .await
-            .expect("adopt");
-        assert_eq!(adopted.target.target_id, created.target.target_id);
-
-        let isolated = after_restart
-            .create_target(&create(
-                "universe-b",
-                "binding-b",
-                "request-1",
-                "environment-2",
-            ))
-            .await
-            .expect("isolated create");
-        assert_ne!(isolated.target.target_id, created.target.target_id);
-
-        let imported = after_restart
-            .adopt_target(&AdoptTargetParams {
-                request_id: "adopt-request-1".to_owned(),
-                environment_id: "environment-imported".to_owned(),
-                incarnation_id: "incarnation-imported".to_owned(),
-                binding: ProviderBindingContext {
-                    universe_id: "universe-c".to_owned(),
-                    binding_id: "binding-c".to_owned(),
-                },
-                source_target: "legacy/hand-built-vm".to_owned(),
+    #[async_trait]
+    impl ProviderControllerConnector for UnreachableConnector {
+        async fn connect(
+            &self,
+            endpoint: &EnvironmentEndpoint,
+            _options: ConnectOptions,
+        ) -> Result<ControllerClient, ClientError> {
+            self.attempts
+                .fetch_add(1, std::sync::atomic::Ordering::SeqCst);
+            Err(ClientError::Connect {
+                endpoint: endpoint.to_string(),
+                message: "refused".into(),
             })
-            .await
-            .expect("explicit adoption");
-        assert_eq!(
-            imported.target.metadata.get("imageFingerprint"),
-            Some(&"fake:adopted:legacy/hand-built-vm".to_owned())
-        );
+        }
+    }
 
-        let wrong_owner = after_restart
-            .close_target(&CloseTargetParams {
-                request_id: "close-1".to_owned(),
-                environment_id: "environment-1".to_owned(),
-                incarnation_id: "incarnation-environment-1".to_owned(),
-                binding: ProviderBindingContext {
-                    universe_id: "universe-b".to_owned(),
-                    binding_id: "binding-b".to_owned(),
-                },
-                target_id: created.target.target_id.clone(),
-                force: false,
+    async fn provider_store(
+        endpoint: &str,
+        credential: &str,
+    ) -> ::environments::InMemoryEnvironmentRegistryStore {
+        let store = ::environments::InMemoryEnvironmentRegistryStore::new();
+        store
+            .put_provider(::environments::PutEnvironmentProvider {
+                provider_id: EnvironmentProviderId::new("provider"),
+                display_name: None,
+                controller_endpoint: EnvironmentEndpoint::parse(endpoint).unwrap(),
+                metadata: Default::default(),
+                credential: Some(SecretValue::new(credential)),
+                updated_at_ms: 1,
             })
             .await
-            .expect_err("ownership mismatch");
-        assert_eq!(wrong_owner.kind, AgentApiErrorKind::Rejected);
-
-        let power = |power: PowerState| SetTargetPowerParams {
-            request_id: format!("power-{power}"),
-            environment_id: "environment-1".to_owned(),
-            incarnation_id: "incarnation-environment-1".to_owned(),
-            binding: ProviderBindingContext {
-                universe_id: "universe-a".to_owned(),
-                binding_id: "binding-a".to_owned(),
-            },
-            target_id: created.target.target_id.clone(),
-            power,
-        };
-        assert_eq!(created.target.power_states, FAKE_POWER_STATES.to_vec());
-        let paused = after_restart
-            .set_target_power(&power(PowerState::Paused))
-            .await
-            .expect("pause");
-        assert_eq!(paused.target.status, ProviderTargetStatus::Paused);
-        let resumed = after_restart
-            .set_target_power(&power(PowerState::Running))
-            .await
-            .expect("resume");
-        assert_eq!(resumed.target.status, ProviderTargetStatus::Ready);
-        assert_eq!(resumed.target.target_id, created.target.target_id);
-
-        let closed = after_restart
-            .close_target(&CloseTargetParams {
-                request_id: "close-1".to_owned(),
-                environment_id: "environment-1".to_owned(),
-                incarnation_id: "incarnation-environment-1".to_owned(),
-                binding: ProviderBindingContext {
-                    universe_id: "universe-a".to_owned(),
-                    binding_id: "binding-a".to_owned(),
-                },
-                target_id: created.target.target_id.clone(),
-                force: false,
-            })
+            .unwrap();
+        store
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn the_refresh_records_facts_of_a_provider_never_reached() {
+        let controller = crate::environments::fake_controller::FakeController::start()
             .await
-            .expect("close");
-        assert_eq!(closed.status, ProviderTargetStatus::Closed);
+            .unwrap();
+        let store = provider_store(controller.controller_url(), controller.credential()).await;
+        let provider_id = EnvironmentProviderId::new("provider");
         assert!(
-            after_restart
-                .set_target_power(&power(PowerState::Running))
+            store
+                .read_provider(&provider_id)
                 .await
-                .is_err()
+                .unwrap()
+                .data_route_base
+                .is_none()
+        );
+        let mut pass = ProviderPass::default();
+        ProviderFactsRefresh::default()
+            .run(&mut pass, &store, &WebSocketProviderControllerConnector)
+            .await;
+        pass.close().await;
+        let provider = store.read_provider(&provider_id).await.unwrap();
+        assert!(provider.data_route_base.is_some());
+        assert!(provider.controller_features.is_some());
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn an_unreachable_provider_is_retried_with_backoff() {
+        let store = provider_store("ws://127.0.0.1:9/control", "credential").await;
+        let connector = UnreachableConnector::default();
+        let mut refresh = ProviderFactsRefresh::default();
+        let mut pass = ProviderPass::default();
+        refresh.run(&mut pass, &store, &connector).await;
+        assert_eq!(
+            connector.attempts.load(std::sync::atomic::Ordering::SeqCst),
+            1
         );
+        // The next listing still finds it unrecorded, but its retry is not
+        // due yet.
+        refresh.listed_at = None;
+        let mut pass = ProviderPass::default();
+        refresh.run(&mut pass, &store, &connector).await;
+        assert_eq!(
+            connector.attempts.load(std::sync::atomic::Ordering::SeqCst),
+            1
+        );
+        let (_, backoff) = refresh.retry[&EnvironmentProviderId::new("provider")];
+        assert_eq!(backoff, ProviderFactsRefresh::FIRST_RETRY);
+    }
+
+    #[test]
+    fn controller_facts_enforce_the_downgrade_rule() {
+        let secure = EnvironmentEndpoint::parse("wss://provider.test/control").unwrap();
+        assert!(matches!(
+            controller_facts(&secure, &initialize("ws://provider.test/routes")),
+            Err(UrlError::Downgrade(_))
+        ));
+        let (features, base) =
+            controller_facts(&secure, &initialize("wss://provider.test/routes")).unwrap();
+        assert!(features.adopt_target && !features.ingress);
+        assert_eq!(base.as_str(), "wss://provider.test/routes");
+        let plain = EnvironmentEndpoint::parse("ws://127.0.0.1:9/control").unwrap();
+        assert!(controller_facts(&plain, &initialize("ws://127.0.0.1:9/routes")).is_ok());
+        let local = EnvironmentEndpoint::parse("unix:///run/provider.sock").unwrap();
+        assert!(controller_facts(&local, &initialize("ws://localhost/routes")).is_ok());
     }
 }
diff --git a/crates/temporal-runtime/src/environments/providers.rs b/crates/temporal-runtime/src/environments/providers.rs
index 21204d8c7..0e891459e 100644
--- a/crates/temporal-runtime/src/environments/providers.rs
+++ b/crates/temporal-runtime/src/environments/providers.rs
@@ -1,3 +1,4 @@
+use super::provider_controllers::ControllerError;
 use super::*;
 
 use ::environments::{
@@ -5,8 +6,12 @@ use ::environments::{
     EnvironmentProviderBindingStatus, EnvironmentProviderId, EnvironmentProviderRecord,
     EnvironmentRecord, EnvironmentRegistryError, EnvironmentSource, EnvironmentStatus,
 };
-use environment_protocol::control::targets::{
-    EnvironmentTemplate, ListTemplatesParams, ProviderBindingContext,
+use environment_protocol::{
+    control::{
+        target::BindingRef,
+        template::{EnvironmentTemplate, ListTemplatesParams},
+    },
+    ids::{BindingId, UniverseId},
 };
 
 impl EnvironmentService {
@@ -76,17 +81,20 @@ impl EnvironmentService {
             .into_iter()
             .filter(|binding| binding.status == EnvironmentProviderBindingStatus::Enabled)
         {
-            let provider = self.read_environment_provider(&binding.provider_id).await?;
-            let mut controller = self
-                .provider_controller_connector
-                .connect(&provider.controller_connection)
-                .await?;
-            let response = controller
-                .list_templates(&ListTemplatesParams {
-                    binding: binding_context(&binding),
-                })
-                .await;
-            let response = finish_provider_controller(controller, response).await?;
+            let controller = self
+                .connect_provider_controller(&binding.provider_id)
+                .await
+                .map_err(ControllerError::into_api_error)?;
+            let response = match binding_ref(&binding) {
+                Ok(binding) => controller
+                    .client
+                    .list_templates(&ListTemplatesParams { binding })
+                    .await
+                    .map_err(|error| controller.call_error(error).into_api_error()),
+                Err(error) => Err(error),
+            };
+            controller.close().await;
+            let response = response?;
             templates.extend(
                 response
                     .templates
@@ -130,11 +138,19 @@ impl EnvironmentService {
     }
 }
 
-pub(crate) fn binding_context(record: &EnvironmentProviderBindingRecord) -> ProviderBindingContext {
-    ProviderBindingContext {
-        universe_id: record.universe_id.to_string(),
-        binding_id: record.binding_id.to_string(),
-    }
+/// The controller-plane reference to a binding.
+pub(crate) fn binding_ref(
+    record: &EnvironmentProviderBindingRecord,
+) -> Result<BindingRef, AgentApiError> {
+    let invalid = |error: environment_protocol::ids::IdError| {
+        AgentApiError::internal(format!(
+            "binding ids do not fit the controller protocol: {error}"
+        ))
+    };
+    Ok(BindingRef {
+        universe_id: UniverseId::new(record.universe_id.to_string()).map_err(invalid)?,
+        binding_id: BindingId::new(record.binding_id.as_str()).map_err(invalid)?,
+    })
 }
 
 pub(crate) fn parse_environment_provider_id(
@@ -178,14 +194,25 @@ pub(crate) fn environment_template_view(
     template: &EnvironmentTemplate,
 ) -> EnvironmentTemplateView {
     EnvironmentTemplateView {
-        template_id: template.template_id.clone(),
+        template_id: template.template_id.to_string(),
         provider_id: binding.provider_id.to_string(),
         binding_id: binding.binding_id.to_string(),
-        display_name: template.display_name.clone(),
-        description: template.description.clone(),
+        display_name: template.display_name.to_string(),
+        description: template
+            .description
+            .as_ref()
+            .map(|description| description.to_string()),
         public_ingress: template.public_ingress,
         deprecated: template.deprecated,
-        metadata: template.metadata.clone(),
+        resources: template
+            .resources
+            .as_ref()
+            .map(|resources| EnvironmentTemplateResourcesView {
+                vcpus: resources.vcpus,
+                memory_bytes: resources.memory_bytes,
+                disk_bytes: resources.disk_bytes,
+            }),
+        metadata: template.metadata.as_map().clone(),
     }
 }
 
@@ -201,29 +228,8 @@ pub(crate) fn environment_view(record: &EnvironmentRecord) -> EnvironmentView {
                 provider_id: provider_id.to_string(),
                 binding_id: binding_id.to_string(),
             },
-            EnvironmentSource::External { connection } => EnvironmentSourceView::External {
-                connection: EnvironmentConnectionView {
-                    endpoint: connection.endpoint.clone(),
-                    transport: match &connection.transport {
-                        environment_protocol::shared::EnvironmentTransport::WebSocket => {
-                            EnvironmentConnectionTransportView::WebSocket
-                        }
-                        environment_protocol::shared::EnvironmentTransport::Http => {
-                            EnvironmentConnectionTransportView::Http
-                        }
-                        environment_protocol::shared::EnvironmentTransport::Stdio => {
-                            EnvironmentConnectionTransportView::Stdio
-                        }
-                        environment_protocol::shared::EnvironmentTransport::Ssh => {
-                            EnvironmentConnectionTransportView::Ssh
-                        }
-                        environment_protocol::shared::EnvironmentTransport::Provider {
-                            provider_type,
-                        } => EnvironmentConnectionTransportView::Provider {
-                            provider_type: provider_type.clone(),
-                        },
-                    },
-                },
+            EnvironmentSource::External { endpoint } => EnvironmentSourceView::External {
+                endpoint: endpoint.as_str().to_owned(),
             },
             EnvironmentSource::Registered {
                 registration_key_id,
@@ -271,6 +277,13 @@ pub(crate) fn environment_view(record: &EnvironmentRecord) -> EnvironmentView {
         public_endpoint: record.public_endpoint.clone(),
         metadata: record.metadata.clone(),
         last_seen_at_ms: record.last_seen_at_ms,
+        lifecycle_error: record.lifecycle_error.as_ref().map(|error| {
+            EnvironmentLifecycleErrorView {
+                message: error.message.clone(),
+                first_at_ms: error.first_at_ms,
+                last_at_ms: error.last_at_ms,
+            }
+        }),
         created_at_ms: record.created_at_ms,
         updated_at_ms: record.updated_at_ms,
     }
diff --git a/crates/temporal-runtime/src/environments/registration.rs b/crates/temporal-runtime/src/environments/registration.rs
index 9317b8276..82a12b9ee 100644
--- a/crates/temporal-runtime/src/environments/registration.rs
+++ b/crates/temporal-runtime/src/environments/registration.rs
@@ -7,17 +7,21 @@ use std::collections::BTreeMap;
 use ::environments::{
     BeginCloseEnvironment, CreateEnvironmentRegistrationKey, EnvironmentRecord,
     EnvironmentRegistrationKeyRecord, EnvironmentRegistrationKeyStatus,
-    EnvironmentRegistrationKeyStore, EnvironmentStatus, EnvironmentStore, ListEnvironments,
-    ObserveRegisteredEnvironment, RegisteredConnectionObservation, RegisteredIdentityMode,
-    RegistrationKeyPolicy, RevokeEnvironmentRegistrationKey, mint_registration_key,
+    EnvironmentRegistrationKeyStore, EnvironmentSource, EnvironmentStatus, EnvironmentStore,
+    ListEnvironments, ObserveRegisteredEnvironment, RegisteredConnectionObservation,
+    RegisteredIdentityMode, RegistrationKeyPolicy, RevokeEnvironmentRegistrationKey,
+    mint_registration_key,
 };
 
 /// A registered environment whose heartbeat stamp is older than this is
 /// treated as disconnected even if its row still says `Ready`: the gateway
 /// that held its control connection stopped without recording the
-/// disconnect. Three missed heartbeats leaves room for one slow pong.
+/// disconnect. The registration channel's liveness rule: the same number
+/// of missed heartbeats after which either peer declares the connection
+/// dead.
 pub(crate) const REGISTERED_STALE_AFTER_MS: i64 =
-    3 * crate::gateway::registration::HEARTBEAT_INTERVAL.as_millis() as i64;
+    environment_protocol::limits::HEARTBEAT_MISSED_INTERVALS as i64
+        * crate::gateway::registration::HEARTBEAT_INTERVAL.as_millis() as i64;
 
 /// What the reconciler does with one open registered environment.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
@@ -53,6 +57,21 @@ pub(crate) fn registered_sweep_action(
     None
 }
 
+/// Whether a daemon's `registration/goodbye` ends its environment. An
+/// ephemeral environment closes at once: its daemon stopped on purpose,
+/// so waiting out the disconnect grace would only keep a finished sandbox
+/// `Offline` and counted against its key's limit. A persistent one stays
+/// `Offline` until its daemon returns or someone closes it.
+pub(crate) fn departure_closes(environment: &EnvironmentRecord) -> bool {
+    matches!(
+        environment.source,
+        EnvironmentSource::Registered {
+            identity_mode: RegisteredIdentityMode::Ephemeral,
+            ..
+        }
+    )
+}
+
 use super::*;
 use super::{
     lifecycle::parse_registration_key_id,
@@ -190,6 +209,7 @@ impl EnvironmentService {
 
     /// One pass over open registered environments: repair stale `Ready`
     /// rows and close ephemeral environments past their disconnect grace.
+    /// One environment's failure is logged and never stops the pass.
     /// Returns how many rows changed.
     pub(crate) async fn reconcile_registered_once(&self) -> Result<usize, AgentApiError> {
         let environments = EnvironmentStore::list_open_registered_environments(self.store.as_ref())
@@ -202,66 +222,89 @@ impl EnvironmentService {
         let mut keys: BTreeMap<String, EnvironmentRegistrationKeyRecord> = BTreeMap::new();
         let mut changed = 0;
         for environment in environments {
-            let Some(key_id) = environment.registration_key_id() else {
-                continue;
-            };
-            let key = match keys.get(key_id.as_str()) {
-                Some(key) => key.clone(),
-                None => {
-                    let key = EnvironmentRegistrationKeyStore::read_registration_key(
-                        self.store.as_ref(),
-                        key_id,
-                    )
-                    .await
-                    .map_err(map_environments_error)?;
-                    keys.insert(key_id.to_string(), key.clone());
-                    key
-                }
-            };
-            match registered_sweep_action(&environment, &key, now) {
-                None => {}
-                Some(RegisteredSweepAction::MarkOffline) => {
-                    tracing::info!(
-                        target: "temporal_runtime",
-                        environment = %environment.environment_id,
-                        "registered environment heartbeat is stale; marking offline"
-                    );
-                    EnvironmentStore::observe_registered_environment(
-                        self.store.as_ref(),
-                        ObserveRegisteredEnvironment {
-                            environment_id: environment.environment_id.clone(),
-                            observation: RegisteredConnectionObservation::Disconnected,
-                            observed_at_ms: now,
-                            metadata: BTreeMap::new(),
-                        },
-                    )
-                    .await
-                    .map_err(map_environments_error)?;
-                    changed += 1;
-                }
-                Some(RegisteredSweepAction::Close) => {
-                    tracing::info!(
-                        target: "temporal_runtime",
-                        environment = %environment.environment_id,
-                        registration_key_id = %key.registration_key_id,
-                        "ephemeral registered environment exceeded its disconnect grace; closing"
-                    );
-                    EnvironmentStore::begin_close_environment(
-                        self.store.as_ref(),
-                        BeginCloseEnvironment {
-                            environment_id: environment.environment_id.clone(),
-                            updated_at_ms: now,
-                        },
-                    )
-                    .await
-                    .map_err(map_environments_error)?;
-                    changed += 1;
-                }
+            match self
+                .reconcile_registered_environment(&environment, &mut keys, now)
+                .await
+            {
+                Ok(true) => changed += 1,
+                Ok(false) => {}
+                Err(error) => tracing::warn!(
+                    target: "temporal_runtime",
+                    environment = %environment.environment_id,
+                    error = %error.message,
+                    "registered environment sweep failed; continuing with the next"
+                ),
             }
         }
         Ok(changed)
     }
 
+    /// Apply the sweep decision to one registered environment; true when
+    /// its row changed.
+    async fn reconcile_registered_environment(
+        &self,
+        environment: &EnvironmentRecord,
+        keys: &mut BTreeMap<String, EnvironmentRegistrationKeyRecord>,
+        now: i64,
+    ) -> Result<bool, AgentApiError> {
+        let Some(key_id) = environment.registration_key_id() else {
+            return Ok(false);
+        };
+        let key = match keys.get(key_id.as_str()) {
+            Some(key) => key.clone(),
+            None => {
+                let key = EnvironmentRegistrationKeyStore::read_registration_key(
+                    self.store.as_ref(),
+                    key_id,
+                )
+                .await
+                .map_err(map_environments_error)?;
+                keys.insert(key_id.to_string(), key.clone());
+                key
+            }
+        };
+        match registered_sweep_action(environment, &key, now) {
+            None => Ok(false),
+            Some(RegisteredSweepAction::MarkOffline) => {
+                tracing::info!(
+                    target: "temporal_runtime",
+                    environment = %environment.environment_id,
+                    "registered environment heartbeat is stale; marking offline"
+                );
+                EnvironmentStore::observe_registered_environment(
+                    self.store.as_ref(),
+                    ObserveRegisteredEnvironment {
+                        environment_id: environment.environment_id.clone(),
+                        observation: RegisteredConnectionObservation::Disconnected,
+                        observed_at_ms: now,
+                        metadata: BTreeMap::new(),
+                    },
+                )
+                .await
+                .map_err(map_environments_error)?;
+                Ok(true)
+            }
+            Some(RegisteredSweepAction::Close) => {
+                tracing::info!(
+                    target: "temporal_runtime",
+                    environment = %environment.environment_id,
+                    registration_key_id = %key.registration_key_id,
+                    "ephemeral registered environment exceeded its disconnect grace; closing"
+                );
+                EnvironmentStore::begin_close_environment(
+                    self.store.as_ref(),
+                    BeginCloseEnvironment {
+                        environment_id: environment.environment_id.clone(),
+                        updated_at_ms: now,
+                    },
+                )
+                .await
+                .map_err(map_environments_error)?;
+                Ok(true)
+            }
+        }
+    }
+
     async fn registration_key_view(
         &self,
         record: &EnvironmentRegistrationKeyRecord,
@@ -314,7 +357,7 @@ mod tests {
 
     use ::environments::{
         EnvironmentDaemonId, EnvironmentId, EnvironmentIncarnationId, EnvironmentIncarnationRecord,
-        EnvironmentProvisionRequestId, EnvironmentRegistrationKeyId, EnvironmentSource, PowerState,
+        EnvironmentProvisionRequestId, EnvironmentRegistrationKeyId, PowerState,
     };
 
     use super::*;
@@ -337,6 +380,14 @@ mod tests {
     }
 
     fn environment(status: EnvironmentStatus, last_seen_at_ms: Option<i64>) -> EnvironmentRecord {
+        environment_in_mode(status, last_seen_at_ms, RegisteredIdentityMode::Ephemeral)
+    }
+
+    fn environment_in_mode(
+        status: EnvironmentStatus,
+        last_seen_at_ms: Option<i64>,
+        identity_mode: RegisteredIdentityMode,
+    ) -> EnvironmentRecord {
         let public_key = "ab".repeat(32);
         let daemon_id = EnvironmentDaemonId::from_public_key(&[0xab; 32]);
         EnvironmentRecord {
@@ -346,7 +397,7 @@ mod tests {
                 registration_key_id: EnvironmentRegistrationKeyId::new("rk"),
                 daemon_id,
                 daemon_public_key: public_key,
-                identity_mode: RegisteredIdentityMode::Ephemeral,
+                identity_mode,
             },
             display_name: None,
             status,
@@ -366,6 +417,7 @@ mod tests {
             public_endpoint: None,
             metadata: BTreeMap::new(),
             last_seen_at_ms,
+            lifecycle_error: None,
             created_at_ms: 0,
             updated_at_ms: 0,
         }
@@ -438,4 +490,16 @@ mod tests {
             Some(RegisteredSweepAction::Close)
         );
     }
+
+    #[test]
+    fn only_ephemeral_environments_close_on_departure() {
+        let ephemeral = environment(EnvironmentStatus::Ready, Some(1_000));
+        assert!(departure_closes(&ephemeral));
+        let persistent = environment_in_mode(
+            EnvironmentStatus::Ready,
+            Some(1_000),
+            RegisteredIdentityMode::Persistent,
+        );
+        assert!(!departure_closes(&persistent));
+    }
 }
diff --git a/crates/temporal-runtime/src/environments/resolver.rs b/crates/temporal-runtime/src/environments/resolver.rs
index 9b9f24a18..85d3b6a99 100644
--- a/crates/temporal-runtime/src/environments/resolver.rs
+++ b/crates/temporal-runtime/src/environments/resolver.rs
@@ -4,6 +4,7 @@
 
 use std::sync::Arc;
 
+use environment_client::{ClientError, DataClient};
 use environments::{
     EnvironmentId, EnvironmentProviderStore, EnvironmentRecord, EnvironmentRegistryError,
     EnvironmentSource, EnvironmentStatus, EnvironmentStore, PowerState, SetEnvironmentPower,
@@ -70,9 +71,9 @@ impl EnvironmentResolver {
             EnvironmentStatus::Failed => Err(EnvironmentResolveError::Failed {
                 environment_id: environment.environment_id.to_string(),
                 message: environment
-                    .metadata
-                    .get(LIFECYCLE_ERROR_METADATA_KEY)
-                    .cloned()
+                    .lifecycle_error
+                    .as_ref()
+                    .map(|error| error.message.clone())
                     .unwrap_or_else(|| "environment provisioning failed".to_owned()),
             }),
             EnvironmentStatus::Closing | EnvironmentStatus::Closed => {
@@ -85,29 +86,43 @@ impl EnvironmentResolver {
     }
 
     /// Check readiness for actual use, requesting wake-up where supported and
-    /// probing the data route. Selection itself uses only registry validation.
+    /// running the data-plane handshake over the route. A daemon of another
+    /// protocol version is a typed blocker, never a Ready environment whose
+    /// calls all fail. Selection itself uses only registry validation.
     pub(crate) async fn ready_for_use(
         &self,
         environment_id: &EnvironmentId,
         now_ms: i64,
     ) -> Result<EnvironmentRecord, EnvironmentResolveError> {
         let environment = self.resolve_for_connection(environment_id, now_ms).await?;
-        if let Some(gateway) = &self.gateway {
-            let connection = gateway.connection_for(self.universe_id, &environment);
-            if let Ok(mut client) = environment_client::EnvironmentDataClient::connect(
-                &connection.endpoint,
-                gateway.connect_options("lightspeed-environment-readiness"),
-            )
+        let unavailable = |status: String| EnvironmentResolveError::EnvironmentUnavailable {
+            environment_id: environment.environment_id.as_str().to_owned(),
+            status,
+        };
+        let Some(gateway) = &self.gateway else {
+            return Err(unavailable(
+                "environment endpoint is not reachable".to_owned(),
+            ));
+        };
+        let endpoint = gateway.endpoint_for(self.universe_id, &environment);
+        match DataClient::connect_initialized(&endpoint, gateway.connect_options(READINESS_CLIENT))
             .await
-            {
+        {
+            Ok((client, _)) => {
                 let _ = client.close().await;
-                return Ok(environment);
+                Ok(environment)
             }
+            Err(ClientError::VersionMismatch { local, remote, .. }) => {
+                Err(EnvironmentResolveError::VersionMismatch {
+                    environment_id: environment.environment_id.as_str().to_owned(),
+                    local,
+                    remote,
+                })
+            }
+            Err(error) => Err(unavailable(format!(
+                "environment endpoint is not reachable: {error}"
+            ))),
         }
-        Err(EnvironmentResolveError::EnvironmentUnavailable {
-            environment_id: environment.environment_id.as_str().to_owned(),
-            status: "environment endpoint is not reachable".to_owned(),
-        })
     }
 
     /// Validate lifecycle and policy immediately before opening a real
@@ -198,11 +213,21 @@ pub(crate) enum EnvironmentResolveError {
 
     #[error("environment is closed: {environment_id}")]
     Closed { environment_id: String },
+
+    /// The environment's envd speaks another data-plane protocol version;
+    /// it cannot serve this runtime until it is replaced or upgraded.
+    #[error(
+        "environment {environment_id} runs envd protocol version {remote}; this runtime requires {local}"
+    )]
+    VersionMismatch {
+        environment_id: String,
+        local: u32,
+        remote: u32,
+    },
 }
 
-/// Metadata key under which the lifecycle reconciler records the provider's
-/// failure message on a `failed` environment.
-pub(crate) const LIFECYCLE_ERROR_METADATA_KEY: &str = "lifecycleError";
+/// `clientInfo.name` of readiness handshakes.
+const READINESS_CLIENT: &str = "lightspeed-environment-readiness";
 
 /// A powered-down provisioned environment wakes on use when its provider
 /// reported that it can be moved back to `running`. External environments and
@@ -220,9 +245,10 @@ pub(crate) fn wake_on_use_applies(environment: &EnvironmentRecord) -> bool {
 mod tests {
     use std::collections::BTreeMap;
 
-    use environment_protocol::shared::{EnvironmentTransport, ProviderTargetId};
+    use auth::SecretValue;
+    use environment_protocol::ids::ProviderTargetId;
     use environments::{
-        CreateEnvironment, EnvironmentConnectionSpec, EnvironmentIncarnationId,
+        CreateEnvironment, EnvironmentEndpoint, EnvironmentIncarnationId,
         EnvironmentProviderBindingId, EnvironmentProviderBindingStatus,
         EnvironmentProviderBindingStore, EnvironmentProviderId, EnvironmentProvisionRequestId,
         EnvironmentStatus, EnvironmentTemplateId, ObserveProvisionedEnvironment,
@@ -231,6 +257,26 @@ mod tests {
 
     use super::*;
 
+    fn target_id() -> Option<ProviderTargetId> {
+        Some(ProviderTargetId::new("target-1").unwrap())
+    }
+
+    fn observation(
+        environment_id: &EnvironmentId,
+        status: EnvironmentStatus,
+        power_states: Vec<PowerState>,
+        observed_at_ms: i64,
+    ) -> ObserveProvisionedEnvironment {
+        ObserveProvisionedEnvironment {
+            environment_id: environment_id.clone(),
+            provider_target_id: target_id(),
+            status,
+            power_states,
+            daemon_build: None,
+            observed_at_ms,
+        }
+    }
+
     async fn resolver() -> (EnvironmentResolver, EnvironmentId) {
         let store = Arc::new(environments::InMemoryEnvironmentRegistryStore::new());
         let provider_id = EnvironmentProviderId::new("allowed");
@@ -238,11 +284,10 @@ mod tests {
             .put_provider(PutEnvironmentProvider {
                 provider_id: provider_id.clone(),
                 display_name: None,
-                controller_connection: EnvironmentConnectionSpec::new(
-                    "http://controller.test",
-                    EnvironmentTransport::Http,
-                ),
+                controller_endpoint: EnvironmentEndpoint::parse("ws://controller.test/control")
+                    .unwrap(),
                 metadata: BTreeMap::new(),
+                credential: Some(SecretValue::new("provider-credential")),
                 updated_at_ms: 10,
             })
             .await
@@ -260,7 +305,6 @@ mod tests {
             .await
             .expect("binding");
         let environment_id = EnvironmentId::new("environment-1");
-        let target_id = ProviderTargetId::new("target-1");
         store
             .create_environment(CreateEnvironment {
                 request_id: EnvironmentProvisionRequestId::new("request-1"),
@@ -270,20 +314,18 @@ mod tests {
                 template_id: EnvironmentTemplateId::new("test-template"),
                 display_name: None,
                 metadata: BTreeMap::new(),
-
                 idle_policy: None,
                 created_at_ms: 10,
             })
             .await
             .expect("create environment");
         store
-            .observe_provisioned_environment(ObserveProvisionedEnvironment {
-                environment_id: environment_id.clone(),
-                provider_target_id: target_id.clone(),
-                status: EnvironmentStatus::Offline,
-                power_states: Vec::new(),
-                observed_at_ms: 10,
-            })
+            .observe_provisioned_environment(observation(
+                &environment_id,
+                EnvironmentStatus::Offline,
+                Vec::new(),
+                10,
+            ))
             .await
             .expect("environment");
         (
@@ -292,146 +334,161 @@ mod tests {
         )
     }
 
+    /// Counters and switches of the fake gateway route below.
+    #[derive(Clone, Default)]
+    struct Route {
+        connections: Arc<std::sync::atomic::AtomicUsize>,
+        initializations: Arc<std::sync::atomic::AtomicUsize>,
+        scans: Arc<std::sync::atomic::AtomicUsize>,
+        unchanged_roots: Arc<std::sync::atomic::AtomicUsize>,
+        stall_skills: Arc<std::sync::atomic::AtomicBool>,
+        stall: Arc<std::sync::atomic::AtomicBool>,
+        unsupported: Arc<std::sync::atomic::AtomicBool>,
+    }
+
+    impl Route {
+        fn counts(&self) -> (usize, usize, usize) {
+            use std::sync::atomic::Ordering::SeqCst;
+            (
+                self.connections.load(SeqCst),
+                self.initializations.load(SeqCst),
+                self.scans.load(SeqCst),
+            )
+        }
+    }
+
+    /// Serve a gateway data route that answers with a real envd's handlers
+    /// over `root`, counting connections, handshakes and scans.
+    async fn serve_route(
+        root: std::path::PathBuf,
+        state_dir: std::path::PathBuf,
+        route: Route,
+    ) -> (String, tokio::task::JoinHandle<()>) {
+        use environment_protocol::{data::scan::ScanResponse, jsonrpc, paths::EnvironmentPath};
+        use futures_util::{SinkExt, StreamExt};
+        use std::sync::atomic::Ordering::SeqCst;
+        let runtime =
+            environment_daemon::DaemonRuntime::new(environment_daemon::config::DaemonConfig {
+                listen: None,
+                cwd: root.clone(),
+                fs_root: root.clone(),
+                state_dir,
+                read_only_fs: true,
+                registration: None,
+                scrubbed_env: Vec::new(),
+            })
+            .unwrap();
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let base_url = format!("http://{}", listener.local_addr().unwrap());
+        let task = tokio::spawn(async move {
+            let mut clients = tokio::task::JoinSet::new();
+            loop {
+                let (socket, _) = listener.accept().await.unwrap();
+                route.connections.fetch_add(1, SeqCst);
+                while let Some(result) = clients.try_join_next() {
+                    result.unwrap();
+                }
+                let route = route.clone();
+                let runtime = runtime.clone();
+                let root = root.clone();
+                clients.spawn(async move {
+                    let mut socket = tokio_tungstenite::accept_async(socket).await.unwrap();
+                    let context = environment_daemon::dispatch::RequestContext::detached();
+                    while let Some(Ok(message)) = socket.next().await {
+                        let Ok(text) = message.to_text() else {
+                            continue;
+                        };
+                        let Ok(jsonrpc::Message::Request(request)) = jsonrpc::parse(text) else {
+                            continue;
+                        };
+                        if route.stall.load(SeqCst) {
+                            std::future::pending::<()>().await;
+                        }
+                        let response = if request.method == "initialize" {
+                            route.initializations.fetch_add(1, SeqCst);
+                            let mut initialized = runtime.initialize_response();
+                            initialized.home_directory =
+                                Some(EnvironmentPath::new(root.to_str().unwrap()).unwrap());
+                            if route.unsupported.load(SeqCst) {
+                                initialized.capabilities.filesystem = None;
+                            }
+                            jsonrpc::Response::success(request.id, &initialized)
+                        } else {
+                            if request.method == "fs/scan" {
+                                route.scans.fetch_add(1, SeqCst);
+                                let skills = request.params["filter"]["include"]
+                                    .as_array()
+                                    .is_some_and(|include| include.iter().any(|p| p == "SKILL.md"));
+                                if skills && route.stall_skills.load(SeqCst) {
+                                    std::future::pending::<()>().await;
+                                }
+                            }
+                            let result = environment_daemon::dispatch::handle_request(
+                                &runtime,
+                                &context,
+                                &request.method,
+                                request.params.clone(),
+                            )
+                            .await
+                            .map(|reply| reply.value);
+                            if let Ok(value) = &result
+                                && let Ok(scan) = serde_json::from_value::<ScanResponse>(value.clone())
+                            {
+                                let unchanged = scan
+                                    .roots
+                                    .iter()
+                                    .filter(|root| {
+                                        matches!(
+                                            root,
+                                            environment_protocol::data::scan::ScanRootResult::Unchanged { .. }
+                                        )
+                                    })
+                                    .count();
+                                route.unchanged_roots.fetch_add(unchanged, SeqCst);
+                            }
+                            jsonrpc::Response::from_result(request.id, result)
+                        };
+                        if socket
+                            .send(tokio_tungstenite::tungstenite::Message::Text(
+                                response.to_text().into(),
+                            ))
+                            .await
+                            .is_err()
+                        {
+                            break;
+                        }
+                    }
+                });
+            }
+        });
+        (base_url, task)
+    }
+
     #[tokio::test(flavor = "current_thread")]
     async fn environment_discovery_shares_connection_preserves_freshness_and_never_wakes() {
-        use futures_util::{SinkExt, StreamExt};
         use harness::{
             CoreAgentCommand,
             storage::{BlobStore, InMemoryBlobStore},
         };
-        use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
+        use std::sync::atomic::Ordering::SeqCst;
         use tools::skills::environment::{EnvironmentSkillAvailability, EnvironmentSkillCatalog};
         let (resolver, environment_id) = resolver().await;
         let store = resolver.environments.clone();
         let temp = tempfile::tempdir().unwrap();
-        let root = temp.path().canonicalize().unwrap();
+        let root = temp.path().canonicalize().unwrap().join("root");
         std::fs::create_dir_all(root.join(".agents/skills/review")).unwrap();
         let doc = "---\nname: review\ndescription: Review code.\n---\nbody";
         let skill_path = root.join(".agents/skills/review/SKILL.md");
         std::fs::write(&skill_path, doc).unwrap();
-        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
-        let gateway = crate::environments::gateway::EnvironmentGatewayClientConfig::new(
-            format!("http://{}", listener.local_addr().unwrap()),
-            "test",
-        );
-        let connections = Arc::new(AtomicUsize::new(0));
-        let initializations = Arc::new(AtomicUsize::new(0));
-        let metadata_reads = Arc::new(AtomicUsize::new(0));
-        let stall_skills = Arc::new(AtomicBool::new(false));
-        let scans = Arc::new(AtomicUsize::new(0));
-        let unchanged = Arc::new(AtomicUsize::new(0));
-        let supported = Arc::new(AtomicBool::new(true));
-        let stall = Arc::new(AtomicBool::new(false));
-        let task = {
-            let connections = connections.clone();
-            let initializations = initializations.clone();
-            let metadata_reads = metadata_reads.clone();
-            let stall_skills = stall_skills.clone();
-            let scans = scans.clone();
-            let unchanged = unchanged.clone();
-            let supported = supported.clone();
-            let stall = stall.clone();
-            let root = root.clone();
-            tokio::spawn(async move {
-                let mut clients = tokio::task::JoinSet::new();
-                loop {
-                    let (socket, _) = listener.accept().await.unwrap();
-                    connections.fetch_add(1, Ordering::SeqCst);
-                    while let Some(result) = clients.try_join_next() {
-                        result.unwrap();
-                    }
-                    let initializations = initializations.clone();
-                    let metadata_reads = metadata_reads.clone();
-                    let stall_skills = stall_skills.clone();
-                    let scans = scans.clone();
-                    let unchanged = unchanged.clone();
-                    let supported = supported.clone();
-                    let stall = stall.clone();
-                    let root = root.clone();
-                    clients.spawn(async move {
-                        let mut socket = tokio_tungstenite::accept_async(socket).await.unwrap();
-                        while let Some(Ok(message)) = socket.next().await {
-                            let Ok(text) = message.to_text() else {
-                                continue;
-                            };
-                            let Ok(request) = serde_json::from_str::<serde_json::Value>(text) else {
-                                continue;
-                            };
-                            let Some(id) = request.get("id") else {
-                                continue;
-                            };
-                            if stall.load(Ordering::SeqCst) {
-                                std::future::pending::<()>().await;
-                            }
-                            let result = match request["method"].as_str().unwrap() {
-                                "initialize" => {
-                                    initializations.fetch_add(1, Ordering::SeqCst);
-                                    serde_json::json!({ "protocolVersion": environment_protocol::shared::CURRENT_PROTOCOL_VERSION, "connectionId": "test", "capabilities": {"filesystemRead": true, "filesystemScan": supported.load(Ordering::SeqCst)}, "defaultCwd": root, "homeDirectory": root, "implementation": {"name": "test", "version": "1"} })
-                                }
-                                "fs/getMetadata" => {
-                                    metadata_reads.fetch_add(1, Ordering::SeqCst);
-                                    let fs = environment_daemon::filesystem::LocalFileSystem::new(
-                                        root.clone(),
-                                        root.clone(),
-                                        false,
-                                    );
-                                    serde_json::to_value(
-                                        fs.get_metadata(
-                                            serde_json::from_value(request["params"].clone()).unwrap(),
-                                        )
-                                        .await
-                                        .unwrap(),
-                                    )
-                                    .unwrap()
-                                }
-                                "fs/scan" => {
-                                    scans.fetch_add(1, Ordering::SeqCst);
-                                    if stall_skills.load(Ordering::SeqCst)
-                                        && request["params"]["includePatterns"].as_array().unwrap().iter().any(|p| p == "SKILL.md") {
-                                        std::future::pending::<()>().await;
-                                    }
-                                    let fs = environment_daemon::filesystem::LocalFileSystem::new(
-                                        root.clone(),
-                                        root.clone(),
-                                        false,
-                                    );
-                                    let result = fs
-                                        .scan(
-                                            serde_json::from_value(request["params"].clone()).unwrap(),
-                                        )
-                                        .await
-                                        .unwrap();
-                                    if result.unchanged {
-                                        unchanged.fetch_add(1, Ordering::SeqCst);
-                                    }
-                                    serde_json::to_value(result).unwrap()
-                                }
-                                other => panic!("unexpected discovery RPC: {other}"),
-                            };
-                            if socket
-                                .send(tokio_tungstenite::tungstenite::Message::Text(
-                                    serde_json::json!({"jsonrpc":"2.0", "id":id, "result":result})
-                                        .to_string()
-                                        .into(),
-                                ))
-                                .await
-                                .is_err()
-                            {
-                                break;
-                            }
-                        }
-                    });
-                }
-            })
-        };
-        let counts = || {
-            (
-                connections.load(Ordering::SeqCst),
-                initializations.load(Ordering::SeqCst),
-                metadata_reads.load(Ordering::SeqCst),
-                scans.load(Ordering::SeqCst),
-            )
-        };
+        let route = Route::default();
+        let (base_url, task) = serve_route(
+            root.clone(),
+            temp.path().canonicalize().unwrap().join("state"),
+            route.clone(),
+        )
+        .await;
+        let gateway =
+            crate::environments::gateway::EnvironmentGatewayClientConfig::new(base_url, "test");
         let blobs = InMemoryBlobStore::new();
         let session_id = harness::SessionId::new(uuid::Uuid::new_v4().to_string());
         let feature = harness::EnvironmentsFeature {
@@ -461,40 +518,46 @@ mod tests {
             Some(CoreAgentCommand::UpsertContext { entry, .. }) => entry,
             other => panic!("expected publication: {other:?}"),
         };
+        let catalog_of = async |entry: &harness::ContextEntryInput| -> EnvironmentSkillCatalog {
+            serde_json::from_slice(
+                &blobs
+                    .read_bytes(entry.provenance_ref.as_ref().unwrap())
+                    .await
+                    .unwrap(),
+            )
+            .unwrap()
+        };
         // Offline inspection never changes desired power and never opens a data route.
         let before = store.read_environment(&environment_id).await.unwrap();
         let unavailable = entry(refresh(None).await.unwrap());
-        assert_eq!(scans.load(Ordering::SeqCst), 0);
+        assert_eq!(route.counts(), (0, 0, 0));
         assert_eq!(
             store.read_environment(&environment_id).await.unwrap(),
             before
         );
         assert!(refresh(Some(&unavailable)).await.unwrap().is_none());
         store
-            .observe_provisioned_environment(ObserveProvisionedEnvironment {
-                environment_id: environment_id.clone(),
-                provider_target_id: ProviderTargetId::new("target-1"),
-                status: EnvironmentStatus::Ready,
-                power_states: vec![PowerState::Running, PowerState::Paused],
-                observed_at_ms: 20,
-            })
+            .observe_provisioned_environment(observation(
+                &environment_id,
+                EnvironmentStatus::Ready,
+                vec![PowerState::Running, PowerState::Paused],
+                20,
+            ))
             .await
             .unwrap();
         let available = entry(refresh(Some(&unavailable)).await.unwrap());
-        let catalog: EnvironmentSkillCatalog = serde_json::from_slice(
-            &blobs
-                .read_bytes(available.provenance_ref.as_ref().unwrap())
-                .await
-                .unwrap(),
-        )
-        .unwrap();
+        let catalog = catalog_of(&available).await;
         assert_eq!(
             catalog.availability,
             EnvironmentSkillAvailability::Available
         );
         assert_eq!(catalog.skills.len(), 1);
+        // The working directory is proven by the scan's probe root, not by
+        // a separate metadata call: one connection, one handshake, one scan.
+        assert_eq!(route.counts(), (1, 1, 1));
+        // An unchanged root answers by fingerprint and reuses the cached skills.
         assert!(refresh(Some(&available)).await.unwrap().is_none());
-        assert_eq!(unchanged.load(Ordering::SeqCst), 1);
+        assert_eq!(route.unchanged_roots.load(SeqCst), 1);
         std::fs::write(&skill_path, doc.replace("body", "edit")).unwrap();
         assert!(
             refresh(Some(&available)).await.unwrap().is_none(),
@@ -526,13 +589,10 @@ mod tests {
         };
         for text in ["First instructions", "Updated instructions"] {
             std::fs::write(&prompt_path, text).unwrap();
-            let before = counts();
+            let before = route.counts();
             let result = refresh_sources(&both, Some(&edited)).await;
             assert!(result.skill_command.is_none());
-            assert_eq!(
-                counts(),
-                (before.0 + 1, before.1 + 1, before.2 + 1, before.3 + 2)
-            );
+            assert_eq!(route.counts(), (before.0 + 1, before.1 + 1, before.2 + 2));
             assert_eq!(
                 blobs
                     .read_bytes(&result.prompt_entries[&prompt_key].content.content_ref)
@@ -541,7 +601,7 @@ mod tests {
                 text.as_bytes()
             );
         }
-        let before = counts();
+        let before = route.counts();
         let prompts_only = harness::EnvironmentsFeature {
             prompts: Some(Default::default()),
             environments: feature.environments.clone(),
@@ -550,12 +610,9 @@ mod tests {
         let result = refresh_sources(&prompts_only, None).await;
         assert!(result.skill_command.is_none());
         assert!(result.prompt_entries.contains_key(&prompt_key));
-        assert_eq!(
-            counts(),
-            (before.0 + 1, before.1 + 1, before.2 + 1, before.3 + 1)
-        );
+        assert_eq!(route.counts(), (before.0 + 1, before.1 + 1, before.2 + 1));
 
-        let before = counts();
+        let before = route.counts();
         let disabled_feature = harness::EnvironmentsFeature::default();
         let disabled = refresh_sources(&disabled_feature, None).await;
         assert!(disabled.skill_command.is_none());
@@ -569,30 +626,22 @@ mod tests {
                 .is_none()
         );
         assert_eq!(
-            counts(),
+            route.counts(),
             before,
             "disabled and controller-owned sources need no connection"
         );
         let result = refresh_sources(&both, Some(&controller_owned)).await;
         assert!(result.skill_command.is_none());
         assert!(result.prompt_entries.contains_key(&prompt_key));
-        assert_eq!(
-            counts(),
-            (before.0 + 1, before.1 + 1, before.2 + 1, before.3 + 1)
-        );
+        assert_eq!(route.counts(), (before.0 + 1, before.1 + 1, before.2 + 1));
 
-        // A timed-out skill RPC must not poison the prompt scan with an unread response.
-        stall_skills.store(true, Ordering::SeqCst);
-        let before = counts();
+        // A timed-out skill scan does not delay the prompt scan, which runs
+        // on a fresh connection.
+        route.stall_skills.store(true, SeqCst);
+        let before = route.counts();
         let result = refresh_sources(&both, Some(&edited)).await;
         let failed_skills = entry(result.skill_command);
-        let failed_catalog: EnvironmentSkillCatalog = serde_json::from_slice(
-            &blobs
-                .read_bytes(failed_skills.provenance_ref.as_ref().unwrap())
-                .await
-                .unwrap(),
-        )
-        .unwrap();
+        let failed_catalog = catalog_of(&failed_skills).await;
         assert_eq!(
             failed_catalog.availability,
             EnvironmentSkillAvailability::Stale
@@ -606,79 +655,58 @@ mod tests {
                 .unwrap(),
             b"Updated instructions"
         );
-        assert_eq!(
-            counts(),
-            (before.0 + 2, before.1 + 2, before.2 + 2, before.3 + 2)
-        );
-        stall_skills.store(false, Ordering::SeqCst);
+        assert_eq!(route.counts(), (before.0 + 2, before.1 + 2, before.2 + 2));
+        route.stall_skills.store(false, SeqCst);
 
-        // An incomplete scan retains the last observation without appending a menu.
-        std::fs::write(&skill_path, vec![b'x'; 65537]).unwrap();
-        let stale = entry(refresh(Some(&edited)).await.unwrap());
-        let catalog: EnvironmentSkillCatalog = serde_json::from_slice(
-            &blobs
-                .read_bytes(stale.provenance_ref.as_ref().unwrap())
-                .await
-                .unwrap(),
+        // One oversized skill is skipped and reported under its root; the
+        // root's other skills are still listed.
+        std::fs::create_dir_all(root.join(".agents/skills/other")).unwrap();
+        std::fs::write(
+            root.join(".agents/skills/other/SKILL.md"),
+            "---\nname: other\ndescription: Other skill.\n---\nbody",
         )
         .unwrap();
-        assert_eq!(catalog.availability, EnvironmentSkillAvailability::Stale);
-        assert_eq!(catalog.skills.len(), 1);
-        assert_eq!(stale.content, edited.content);
-        assert!(refresh(Some(&stale)).await.unwrap().is_none());
-        let result = refresh_sources(&both, Some(&edited)).await;
-        assert!(result.skill_command.is_some());
+        std::fs::write(&skill_path, vec![b'x'; 65537]).unwrap();
+        let degraded = entry(refresh(Some(&edited)).await.unwrap());
+        let catalog = catalog_of(&degraded).await;
         assert_eq!(
-            blobs
-                .read_bytes(&result.prompt_entries[&prompt_key].content.content_ref)
-                .await
-                .unwrap(),
-            b"Updated instructions"
+            catalog.availability,
+            EnvironmentSkillAvailability::Available
         );
+        assert_eq!(
+            catalog
+                .skills
+                .iter()
+                .map(|skill| skill.name.as_str())
+                .collect::<Vec<_>>(),
+            vec!["other"]
+        );
+        let skills_root = root.join(".agents/skills");
+        assert!(
+            catalog
+                .warnings
+                .iter()
+                .any(|warning| warning.starts_with(skills_root.to_str().unwrap())),
+            "{:?}",
+            catalog.warnings
+        );
+        std::fs::remove_dir_all(root.join(".agents/skills/other")).unwrap();
         std::fs::write(&skill_path, doc).unwrap();
-        std::fs::write(&prompt_path, vec![b'x'; 65537]).unwrap();
-        let result = refresh_sources(&both, Some(&stale)).await;
-        let recovered = entry(result.skill_command);
-        let recovered_catalog: EnvironmentSkillCatalog = serde_json::from_slice(
-            &blobs
-                .read_bytes(recovered.provenance_ref.as_ref().unwrap())
-                .await
-                .unwrap(),
-        )
-        .unwrap();
+
+        // Without the filesystem family discovery is explicitly
+        // unavailable, with no scan.
+        route.unsupported.store(true, SeqCst);
+        let before = route.counts().2;
+        let unsupported = entry(refresh(Some(&degraded)).await.unwrap());
+        assert_eq!(route.counts().2, before);
         assert_eq!(
-            recovered_catalog.availability,
-            EnvironmentSkillAvailability::Available
+            catalog_of(&unsupported).await.availability,
+            EnvironmentSkillAvailability::Stale
         );
-        let prompt_report: tools::prompts::environment::EnvironmentPromptReport =
-            serde_json::from_slice(
-                &blobs
-                    .read_bytes(
-                        result.prompt_entries[&prompt_key]
-                            .provenance_ref
-                            .as_ref()
-                            .unwrap(),
-                    )
-                    .await
-                    .unwrap(),
-            )
-            .unwrap();
-        assert!(!prompt_report.available);
-        // Missing fs/scan is explicit unavailable discovery, with no RPC fallback.
-        supported.store(false, Ordering::SeqCst);
-        let before = scans.load(Ordering::SeqCst);
-        assert!(refresh(Some(&stale)).await.unwrap().is_none());
-        assert_eq!(scans.load(Ordering::SeqCst), before);
-        supported.store(true, Ordering::SeqCst);
+        route.unsupported.store(false, SeqCst);
         std::fs::remove_file(&skill_path).unwrap();
-        let empty = entry(refresh(Some(&stale)).await.unwrap());
-        let catalog: EnvironmentSkillCatalog = serde_json::from_slice(
-            &blobs
-                .read_bytes(empty.provenance_ref.as_ref().unwrap())
-                .await
-                .unwrap(),
-        )
-        .unwrap();
+        let empty = entry(refresh(Some(&unsupported)).await.unwrap());
+        let catalog = catalog_of(&empty).await;
         assert!(catalog.skills.is_empty());
         assert_eq!(
             catalog.availability,
@@ -715,13 +743,7 @@ mod tests {
             .unwrap()
             .skill_command,
         );
-        let denied_catalog: EnvironmentSkillCatalog = serde_json::from_slice(
-            &blobs
-                .read_bytes(denied_entry.provenance_ref.as_ref().unwrap())
-                .await
-                .unwrap(),
-        )
-        .unwrap();
+        let denied_catalog = catalog_of(&denied_entry).await;
         assert_eq!(
             denied_catalog.availability,
             EnvironmentSkillAvailability::Unavailable
@@ -730,22 +752,15 @@ mod tests {
             denied_catalog.skills.is_empty(),
             "a revoked domain grant cannot retain advertised paths"
         );
-        stall.store(true, Ordering::SeqCst);
+        route.stall.store(true, SeqCst);
         let start = std::time::Instant::now();
         let timed_out = entry(refresh(Some(&available)).await.unwrap());
         assert!(
             start.elapsed() < std::time::Duration::from_secs(6),
             "unresponsive endpoint must remain bounded"
         );
-        let timed_out_catalog: EnvironmentSkillCatalog = serde_json::from_slice(
-            &blobs
-                .read_bytes(timed_out.provenance_ref.as_ref().unwrap())
-                .await
-                .unwrap(),
-        )
-        .unwrap();
         assert_eq!(
-            timed_out_catalog.availability,
+            catalog_of(&timed_out).await.availability,
             EnvironmentSkillAvailability::Stale
         );
         assert_eq!(timed_out.content, available.content);
@@ -769,6 +784,65 @@ mod tests {
         ));
     }
 
+    #[tokio::test(flavor = "current_thread")]
+    async fn readiness_reports_a_daemon_of_another_protocol_version() {
+        use environment_protocol::{error::ProtocolError, jsonrpc};
+        use futures_util::{SinkExt, StreamExt};
+        let (resolver, environment_id) = resolver().await;
+        resolver
+            .environments
+            .observe_provisioned_environment(observation(
+                &environment_id,
+                EnvironmentStatus::Ready,
+                vec![PowerState::Running],
+                20,
+            ))
+            .await
+            .unwrap();
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let base_url = format!("http://{}", listener.local_addr().unwrap());
+        let remote = environment_protocol::ENVD_PROTOCOL_VERSION + 1;
+        let task = tokio::spawn(async move {
+            let (socket, _) = listener.accept().await.unwrap();
+            let mut socket = tokio_tungstenite::accept_async(socket).await.unwrap();
+            while let Some(Ok(message)) = socket.next().await {
+                let Ok(text) = message.to_text() else {
+                    continue;
+                };
+                let Ok(jsonrpc::Message::Request(request)) = jsonrpc::parse(text) else {
+                    continue;
+                };
+                let response = jsonrpc::Response::failure(
+                    Some(request.id),
+                    ProtocolError::version_mismatch(
+                        remote,
+                        environment_protocol::ENVD_PROTOCOL_VERSION,
+                    ),
+                );
+                let _ = socket
+                    .send(tokio_tungstenite::tungstenite::Message::Text(
+                        response.to_text().into(),
+                    ))
+                    .await;
+            }
+        });
+        let resolver = resolver.with_gateway(
+            crate::environments::gateway::EnvironmentGatewayClientConfig::new(base_url, "test"),
+        );
+        match resolver.ready_for_use(&environment_id, 30).await {
+            Err(EnvironmentResolveError::VersionMismatch {
+                local,
+                remote: reported,
+                ..
+            }) => {
+                assert_eq!(local, environment_protocol::ENVD_PROTOCOL_VERSION);
+                assert_eq!(reported, remote);
+            }
+            other => panic!("expected a version mismatch, got {other:?}"),
+        }
+        task.abort();
+    }
+
     #[tokio::test(flavor = "current_thread")]
     async fn selection_preserves_power_and_needs_no_gateway_in_any_nonterminal_state() {
         let (resolver, environment_id) = resolver().await;
@@ -791,13 +865,12 @@ mod tests {
             EnvironmentStatus::Unknown,
         ] {
             store
-                .observe_provisioned_environment(ObserveProvisionedEnvironment {
-                    environment_id: environment_id.clone(),
-                    provider_target_id: ProviderTargetId::new("target-1"),
+                .observe_provisioned_environment(observation(
+                    &environment_id,
                     status,
-                    power_states: vec![PowerState::Running, PowerState::Paused],
-                    observed_at_ms: 30,
-                })
+                    vec![PowerState::Running, PowerState::Paused],
+                    30,
+                ))
                 .await
                 .unwrap();
             let before = store.read_environment(&environment_id).await.unwrap();
@@ -830,6 +903,7 @@ mod tests {
             .fail_environment_lifecycle(environments::FailEnvironmentLifecycle {
                 environment_id: environment_id.clone(),
                 message: "no capacity".into(),
+                daemon_build: None,
                 observed_at_ms: 40,
             })
             .await
@@ -856,13 +930,12 @@ mod tests {
         let (resolver, environment_id) = resolver().await;
         let store = resolver.environments.clone();
         store
-            .observe_provisioned_environment(ObserveProvisionedEnvironment {
-                environment_id: environment_id.clone(),
-                provider_target_id: ProviderTargetId::new("target-1"),
-                status: EnvironmentStatus::Ready,
-                power_states: vec![PowerState::Running, PowerState::Paused],
-                observed_at_ms: 20,
-            })
+            .observe_provisioned_environment(observation(
+                &environment_id,
+                EnvironmentStatus::Ready,
+                vec![PowerState::Running, PowerState::Paused],
+                20,
+            ))
             .await
             .expect("observe");
         // The reaper decided to pause; the reconciler has not acted yet.
@@ -896,13 +969,12 @@ mod tests {
             let environment_id = environment_id.clone();
             async move {
                 store
-                    .observe_provisioned_environment(ObserveProvisionedEnvironment {
-                        environment_id,
-                        provider_target_id: ProviderTargetId::new("target-1"),
+                    .observe_provisioned_environment(observation(
+                        &environment_id,
                         status,
-                        power_states: vec![PowerState::Running, PowerState::Paused],
-                        observed_at_ms: at,
-                    })
+                        vec![PowerState::Running, PowerState::Paused],
+                        at,
+                    ))
                     .await
                     .expect("observe");
             }
@@ -948,13 +1020,12 @@ mod tests {
         // A stopped environment whose provider offers no power control keeps
         // the old behaviour: no wake, plain unavailability.
         store
-            .observe_provisioned_environment(ObserveProvisionedEnvironment {
-                environment_id: environment_id.clone(),
-                provider_target_id: ProviderTargetId::new("target-1"),
-                status: EnvironmentStatus::Offline,
-                power_states: Vec::new(),
-                observed_at_ms: 60,
-            })
+            .observe_provisioned_environment(observation(
+                &environment_id,
+                EnvironmentStatus::Offline,
+                Vec::new(),
+                60,
+            ))
             .await
             .expect("observe offline without power control");
         assert!(matches!(
@@ -980,13 +1051,12 @@ mod tests {
             let environment_id = environment_id.clone();
             async move {
                 store
-                    .observe_provisioned_environment(ObserveProvisionedEnvironment {
-                        environment_id,
-                        provider_target_id: ProviderTargetId::new("target-1"),
+                    .observe_provisioned_environment(observation(
+                        &environment_id,
                         status,
-                        power_states: Vec::new(),
-                        observed_at_ms: 20,
-                    })
+                        Vec::new(),
+                        20,
+                    ))
                     .await
                     .expect("observe");
             }
@@ -1020,6 +1090,7 @@ mod tests {
             .fail_environment_lifecycle(environments::FailEnvironmentLifecycle {
                 environment_id: environment_id.clone(),
                 message: "no capacity".to_owned(),
+                daemon_build: None,
                 observed_at_ms: 40,
             })
             .await
diff --git a/crates/temporal-runtime/src/environments/runtime.rs b/crates/temporal-runtime/src/environments/runtime.rs
index cd453e6de..db785bbf1 100644
--- a/crates/temporal-runtime/src/environments/runtime.rs
+++ b/crates/temporal-runtime/src/environments/runtime.rs
@@ -2,7 +2,6 @@
 
 use std::collections::BTreeMap;
 
-use environment_client::WebSocketTransport;
 use environments::EnvironmentRecord;
 use tools::{
     environment::EnvironmentToolContext, environment_protocol::RemoteEnvironmentConnection,
@@ -12,7 +11,7 @@ use tools::{
 pub struct RuntimeEnvironment {
     resource: EnvironmentRecord,
     tool_context: EnvironmentToolContext,
-    remote_connection: Option<RemoteEnvironmentConnection<WebSocketTransport>>,
+    remote_connection: Option<RemoteEnvironmentConnection>,
 }
 
 impl RuntimeEnvironment {
@@ -34,10 +33,7 @@ impl RuntimeEnvironment {
         }
     }
 
-    pub fn with_remote_connection(
-        mut self,
-        connection: RemoteEnvironmentConnection<WebSocketTransport>,
-    ) -> Self {
+    pub fn with_remote_connection(mut self, connection: RemoteEnvironmentConnection) -> Self {
         self.remote_connection = Some(connection);
         self
     }
@@ -143,7 +139,7 @@ impl SessionEnvironmentManager {
 mod tests {
     use std::{collections::BTreeMap, sync::Arc};
 
-    use environment_protocol::shared::ProviderTargetId;
+    use environment_protocol::ids::ProviderTargetId;
     use environments::{
         EnvironmentIncarnationId, EnvironmentIncarnationRecord, EnvironmentProviderBindingId,
         EnvironmentProviderId, EnvironmentProvisionRequestId, EnvironmentSource, EnvironmentStatus,
@@ -155,7 +151,7 @@ mod tests {
     use super::*;
 
     fn resource() -> EnvironmentRecord {
-        let target_id = ProviderTargetId::new("target-a");
+        let target_id = ProviderTargetId::new("target-a").unwrap();
         EnvironmentRecord {
             environment_id: harness::EnvironmentId::new("environment-a"),
             request_id: EnvironmentProvisionRequestId::new("request-a"),
@@ -181,6 +177,7 @@ mod tests {
             public_endpoint: None,
             metadata: BTreeMap::from([("fsRoot".to_owned(), "/sandbox".to_owned())]),
             last_seen_at_ms: None,
+            lifecycle_error: None,
             created_at_ms: 1,
             updated_at_ms: 1,
         }
diff --git a/crates/temporal-runtime/src/environments/skills.rs b/crates/temporal-runtime/src/environments/skills.rs
index a9037fa40..69f0303ee 100644
--- a/crates/temporal-runtime/src/environments/skills.rs
+++ b/crates/temporal-runtime/src/environments/skills.rs
@@ -11,15 +11,11 @@ use std::{
 };
 use tools::skills::environment::*;
 
-#[derive(Clone)]
-struct CachedObservation {
-    fingerprint: String,
-    catalog: EnvironmentSkillCatalog,
-}
-// An optimization only: losing/evicting this cache forces a complete scan. The
-// cached catalog is reused only after the environment confirms its fingerprint.
-static OBSERVATIONS: OnceLock<Mutex<BTreeMap<String, CachedObservation>>> = OnceLock::new();
-fn observations() -> &'static Mutex<BTreeMap<String, CachedObservation>> {
+// An optimization only: losing/evicting this cache forces a full scan. A
+// cached catalog contributes only the roots the environment confirms
+// unchanged by their fingerprints.
+static OBSERVATIONS: OnceLock<Mutex<BTreeMap<String, EnvironmentSkillCatalog>>> = OnceLock::new();
+fn observations() -> &'static Mutex<BTreeMap<String, EnvironmentSkillCatalog>> {
     OBSERVATIONS.get_or_init(Default::default)
 }
 
@@ -56,10 +52,14 @@ pub(crate) async fn refresh(
     .expect("serialize discovery scope");
     let attempt = async {
         let connection = discovery.connection().await?;
-        let mut query = environment_skill_scan_query(
+        let query = environment_skill_scan_query(
             config,
-            Some(&connection.cwd),
-            connection.initialized.home_directory.as_deref(),
+            Some(connection.cwd.as_str()),
+            connection
+                .initialized
+                .home_directory
+                .as_ref()
+                .map(|home| home.as_str()),
         )?;
         let cache_key = serde_json::to_string(&(
             session_id,
@@ -74,42 +74,30 @@ pub(crate) async fn refresh(
             .expect("observation lock")
             .get(&cache_key)
             .cloned();
-        query.if_none_match = cached.as_ref().map(|c| c.fingerprint.clone());
-        let scan = {
+        let catalog = {
             let _timer = PhaseTimer::new("skills_scan");
-            connection
-                .client
-                .scan(&query)
-                .await
-                .map_err(|e| e.to_string())?
-        };
-        if !scan.complete {
-            return Err(format!(
-                "incomplete environment discovery: {:?}",
-                scan.diagnostics
-            ));
-        }
-        if scan.unchanged {
-            return cached
-                .filter(|cached| scan.fingerprint.as_ref() == Some(&cached.fingerprint))
-                .map(|cached| cached.catalog)
-                .ok_or("unexpected unchanged scan without matching observation".to_owned());
-        }
-        let catalog = environment_skill_catalog(environment_id.as_str(), &scan)?;
-        if let Some(fingerprint) = scan.fingerprint {
-            let mut cache = observations().lock().expect("observation lock");
-            if cache.len() >= 128 {
-                cache.clear();
+            let mut cached_query = query.clone();
+            if let Some(previous) = &cached {
+                apply_cached_fingerprints(&mut cached_query, previous);
             }
-            cache.insert(
-                cache_key,
-                CachedObservation {
-                    fingerprint,
-                    catalog: catalog.clone(),
-                },
-            );
+            let scan = connection.scan(cached_query).await?;
+            match environment_skill_catalog(environment_id.as_str(), &scan, cached.as_ref()) {
+                Ok(catalog) => catalog,
+                // A root answered unchanged against an observation the
+                // catalog cannot reuse: observe every root in full.
+                Err(_) if cached.is_some() => {
+                    let scan = connection.scan(query).await?;
+                    environment_skill_catalog(environment_id.as_str(), &scan, None)?
+                }
+                Err(error) => return Err(error),
+            }
+        };
+        let mut cache = observations().lock().expect("observation lock");
+        if cache.len() >= 128 {
+            cache.clear();
         }
-        Ok(catalog)
+        cache.insert(cache_key, catalog.clone());
+        Ok::<_, String>(catalog)
     };
     let mut catalog = match tokio::time::timeout(Duration::from_secs(4), attempt).await {
         Ok(Ok(catalog)) => catalog,
@@ -166,6 +154,7 @@ mod tests {
         catalog.availability = EnvironmentSkillAvailability::Available;
         catalog.discovery_scope = Some("configured roots".into());
         catalog.skills.push(EnvironmentSkill {
+            root: "/skills".into(),
             skill_id: tools::skills::SkillId::new("internal-id"),
             name: "review".into(),
             description: "Review changes".into(),
diff --git a/crates/temporal-runtime/src/environments/sources.rs b/crates/temporal-runtime/src/environments/sources.rs
index 8de5fd1e9..9f66bdbaf 100644
--- a/crates/temporal-runtime/src/environments/sources.rs
+++ b/crates/temporal-runtime/src/environments/sources.rs
@@ -3,13 +3,13 @@ use crate::{
     environments::gateway::EnvironmentGatewayClientConfig,
     environments::resolver::EnvironmentResolver,
 };
-use environment_client::{EnvironmentDataClient, JsonRpcTransport, WebSocketTransport};
+use environment_client::DataClient;
 use environment_protocol::{
     data::{
-        fs::GetMetadataParams,
-        handshake::{InitializeParams, InitializeResponse, InitializedParams},
+        handshake::InitializeResponse,
+        scan::{ScanParams, ScanResponse, ScanRootResult},
     },
-    shared::{CURRENT_PROTOCOL_VERSION, EnvironmentPath},
+    paths::EnvironmentPath,
 };
 use harness::{
     ContextEntryInput, ContextEntryKey, CoreAgentCommand, EnvironmentId, EnvironmentsFeature,
@@ -21,30 +21,25 @@ use std::{
     time::{Duration, Instant},
 };
 
-pub(crate) async fn working_directory<T: JsonRpcTransport>(
-    client: &mut EnvironmentDataClient<T>,
+/// `clientInfo.name` of discovery connections.
+const SOURCE_DISCOVERY_CLIENT: &str = "lightspeed-source-discovery";
+
+/// The working directory discovery resolves sources against: the
+/// attachment's configured directory, else the daemon's `defaultCwd`. It is
+/// proven to exist by the probe root of each discovery scan, not by a
+/// separate call.
+pub(crate) fn working_directory(
     configured: Option<&str>,
-    default: Option<&str>,
-) -> Result<String, String> {
-    let value = configured
-        .or(default)
-        .ok_or("environment does not advertise a default working directory")?;
+    default: &EnvironmentPath,
+) -> Result<EnvironmentPath, String> {
+    let Some(value) = configured else {
+        return Ok(default.clone());
+    };
     if !value.starts_with('/') {
         return Err("environment working directory must be absolute".into());
     }
-    let cwd = tools::environment::sources::absolute(std::path::Path::new("/"), value)?
-        .to_string_lossy()
-        .into_owned();
-    let metadata = client
-        .get_metadata(&GetMetadataParams {
-            path: EnvironmentPath::new(&cwd).map_err(|e| e.to_string())?,
-        })
-        .await
-        .map_err(|e| format!("working directory {cwd}: {e}"))?;
-    if !metadata.is_directory {
-        return Err(format!("working directory is not a directory: {cwd}"));
-    }
-    Ok(cwd)
+    let cwd = tools::environment::sources::absolute(std::path::Path::new("/"), value)?;
+    EnvironmentPath::new(cwd.to_string_lossy()).map_err(|error| error.to_string())
 }
 
 pub(crate) struct Discovery<'a> {
@@ -56,13 +51,37 @@ pub(crate) struct Discovery<'a> {
 }
 
 pub(crate) struct SourceConnection {
-    pub client: EnvironmentDataClient<WebSocketTransport>,
+    pub client: DataClient,
     pub initialized: InitializeResponse,
-    pub cwd: String,
+    pub cwd: EnvironmentPath,
     // Includes universe and incarnation so cached observations cannot cross routes.
     pub identity: String,
 }
 
+impl SourceConnection {
+    /// Run a discovery scan with the working-directory probe appended, check
+    /// that probe, and return the response without it. `fs/scan` is an
+    /// observation, so discovery never resets the idle clock.
+    pub async fn scan(&self, mut query: ScanParams) -> Result<ScanResponse, String> {
+        tools::environment::sources::with_working_directory_probe(&mut query, &self.cwd);
+        let mut scan = self
+            .client
+            .scan(&query)
+            .await
+            .map_err(|error| error.to_string())?;
+        match scan.roots.pop() {
+            Some(ScanRootResult::Complete { .. } | ScanRootResult::Unchanged { .. }) => Ok(scan),
+            Some(ScanRootResult::Missing { .. }) => {
+                Err(format!("working directory {} does not exist", self.cwd))
+            }
+            Some(ScanRootResult::Failed { error, .. }) => {
+                Err(format!("working directory {}: {error}", self.cwd))
+            }
+            None => Err("discovery scan answered without its working directory probe".into()),
+        }
+    }
+}
+
 impl Discovery<'_> {
     pub async fn connection(&mut self) -> Result<&mut SourceConnection, String> {
         if self.connection.is_none() {
@@ -84,8 +103,13 @@ impl Discovery<'_> {
     }
 
     pub fn discard_connection(&mut self) {
-        // A cancelled RPC can leave an unread response. Never reuse that stream.
-        self.connection = None;
+        // Abandoned scans were cancelled by the multiplexed client; a fresh
+        // connection keeps a failed attempt from affecting the next source.
+        if let Some(connection) = self.connection.take() {
+            tokio::spawn(async move {
+                let _ = connection.client.close().await;
+            });
+        }
     }
 }
 
@@ -123,7 +147,7 @@ pub(crate) async fn refresh(
         })
     }
     .await;
-    if let Some(mut connection) = discovery.connection.take() {
+    if let Some(connection) = discovery.connection.take() {
         let _close = PhaseTimer::new("close");
         let _ = tokio::time::timeout(Duration::from_secs(1), connection.client.close()).await;
     }
@@ -171,49 +195,32 @@ async fn connect(
     {
         return Err("environment is not accessible; discovery does not wake it".into());
     }
-    let connection = gateway.connection_for(resolver.universe_id(), &environment);
-    let identity =
-        serde_json::to_string(&(resolver.universe_id(), &connection)).map_err(|e| e.to_string())?;
-    let mut client = {
+    let endpoint = gateway.endpoint_for(resolver.universe_id(), &environment);
+    let identity = serde_json::to_string(&(
+        resolver.universe_id(),
+        environment.environment_id.as_str(),
+        environment.incarnation.incarnation_id.as_str(),
+    ))
+    .map_err(|e| e.to_string())?;
+    let (client, initialized) = {
         let _timer = PhaseTimer::new("connect");
-        EnvironmentDataClient::connect(
-            &connection.endpoint,
-            gateway.connect_options("lightspeed-source-discovery"),
-        )
-        .await
-        .map_err(|e| e.to_string())?
-    };
-    let initialized = {
-        let _timer = PhaseTimer::new("initialize");
-        let initialized = client
-            .initialize(&InitializeParams {
-                protocol_version: CURRENT_PROTOCOL_VERSION,
-                client_name: "lightspeed-source-discovery".into(),
-                scope: connection.scope,
-                resume_connection_id: None,
-            })
-            .await
-            .map_err(|e| e.to_string())?;
-        client
-            .initialized(&InitializedParams {})
+        DataClient::connect_initialized(&endpoint, gateway.connect_options(SOURCE_DISCOVERY_CLIENT))
             .await
-            .map_err(|e| e.to_string())?;
-        initialized
+            .map_err(|e| e.to_string())?
     };
-    if initialized.protocol_version != CURRENT_PROTOCOL_VERSION
-        || !initialized.capabilities.filesystem_read
-        || !initialized.capabilities.filesystem_scan
-    {
+    if initialized.capabilities.filesystem.is_none() {
+        let _ = client.close().await;
         return Err("endpoint does not support filesystem source discovery".into());
     }
-    let cwd = {
-        let _timer = PhaseTimer::new("working_directory");
-        working_directory(
-            &mut client,
-            attachment.working_directory.as_deref(),
-            initialized.default_cwd.as_deref(),
-        )
-        .await?
+    let cwd = match working_directory(
+        attachment.working_directory.as_deref(),
+        &initialized.default_cwd,
+    ) {
+        Ok(cwd) => cwd,
+        Err(error) => {
+            let _ = client.close().await;
+            return Err(error);
+        }
     };
     Ok(SourceConnection {
         client,
@@ -222,3 +229,22 @@ async fn connect(
         identity,
     })
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn the_working_directory_is_configured_or_the_daemon_default() {
+        let default = EnvironmentPath::new("/workspace").unwrap();
+        assert_eq!(working_directory(None, &default).unwrap(), default);
+        assert_eq!(
+            working_directory(Some("/srv/app/./src/.."), &default)
+                .unwrap()
+                .as_str(),
+            "/srv/app"
+        );
+        assert!(working_directory(Some("relative"), &default).is_err());
+        assert!(working_directory(Some("/../escape"), &default).is_err());
+    }
+}
diff --git a/crates/temporal-runtime/src/gateway/deployment.rs b/crates/temporal-runtime/src/gateway/deployment.rs
index eda0a394c..ef63f75b0 100644
--- a/crates/temporal-runtime/src/gateway/deployment.rs
+++ b/crates/temporal-runtime/src/gateway/deployment.rs
@@ -19,26 +19,27 @@ use api::{
     DeploymentApiKeyListParams, DeploymentApiKeyListResponse, DeploymentApiKeyRevokeParams,
     DeploymentApiKeyRevokeResponse, DeploymentApiKeyRotateParams, DeploymentApiKeyView,
     DeploymentApiService, DeploymentEnvironmentAdoptParams, DeploymentEnvironmentAdoptResponse,
-    DeploymentEnvironmentProviderConnection, DeploymentEnvironmentProviderDeleteParams,
-    DeploymentEnvironmentProviderDeleteResponse, DeploymentEnvironmentProviderListParams,
+    DeploymentEnvironmentProviderDeleteParams, DeploymentEnvironmentProviderDeleteResponse,
+    DeploymentEnvironmentProviderFeaturesView, DeploymentEnvironmentProviderListParams,
     DeploymentEnvironmentProviderListResponse, DeploymentEnvironmentProviderPutParams,
     DeploymentEnvironmentProviderPutResponse, DeploymentEnvironmentProviderReadParams,
-    DeploymentEnvironmentProviderReadResponse, DeploymentEnvironmentProviderTransport,
-    DeploymentEnvironmentProviderView, DeploymentProviderBindingDeleteParams,
-    DeploymentProviderBindingDeleteResponse, DeploymentProviderBindingPutParams,
-    DeploymentProviderBindingPutResponse, DeploymentUniverseCreateParams,
-    DeploymentUniverseCreateResponse, DeploymentUniverseDeleteParams,
-    DeploymentUniverseDeleteResponse, DeploymentUniverseListParams, DeploymentUniverseListResponse,
-    DeploymentUniverseReadParams, DeploymentUniverseReadResponse, DeploymentUniverseView,
+    DeploymentEnvironmentProviderReadResponse, DeploymentEnvironmentProviderView,
+    DeploymentProviderBindingDeleteParams, DeploymentProviderBindingDeleteResponse,
+    DeploymentProviderBindingPutParams, DeploymentProviderBindingPutResponse,
+    DeploymentUniverseCreateParams, DeploymentUniverseCreateResponse,
+    DeploymentUniverseDeleteParams, DeploymentUniverseDeleteResponse, DeploymentUniverseListParams,
+    DeploymentUniverseListResponse, DeploymentUniverseReadParams, DeploymentUniverseReadResponse,
+    DeploymentUniverseView,
 };
 use async_trait::async_trait;
-use environment_protocol::shared::EnvironmentTransport;
+use auth::SecretValue;
 use environments::{
-    AdoptEnvironment, EnvironmentConnectionSpec, EnvironmentId, EnvironmentIncarnationId,
+    AdoptEnvironment, EnvironmentEndpoint, EnvironmentId, EnvironmentIncarnationId,
     EnvironmentProviderBindingId, EnvironmentProviderBindingStatus,
     EnvironmentProviderBindingStore, EnvironmentProviderId, EnvironmentProviderRecord,
-    EnvironmentProviderStore, EnvironmentProvisionRequestId, EnvironmentStore,
-    ListEnvironmentProviders, PutEnvironmentProvider, PutEnvironmentProviderBinding,
+    EnvironmentProviderStore, EnvironmentProvisionRequestId, EnvironmentRegistryError,
+    EnvironmentStore, ListEnvironmentProviders, PutEnvironmentProvider,
+    PutEnvironmentProviderBinding, RecordProviderController,
 };
 use harness::SessionId;
 use object_store::ObjectStoreExt as _;
@@ -47,7 +48,12 @@ use temporal_workflow::{AgentSessionWorkflow, compose_workflow_id};
 use temporalio_client::{Client, WorkflowTerminateOptions, errors::WorkflowInteractionError};
 use uuid::Uuid;
 
-use crate::universe::UniverseRuntime;
+use crate::{
+    environments::provider_controllers::{
+        ControllerFeature, WebSocketProviderControllerConnector, probe_controller,
+    },
+    universe::UniverseRuntime,
+};
 
 pub struct GatewayDeploymentApi {
     runtime: Arc<UniverseRuntime>,
@@ -262,19 +268,65 @@ impl DeploymentApiService for GatewayDeploymentApi {
     ) -> Result<AgentApiOutcome<DeploymentEnvironmentProviderPutResponse>, AgentApiError> {
         self.admitted(api::METHOD_DEPLOYMENT_ENVIRONMENT_PROVIDERS_PUT, async {
             let store = self.runtime.stores().store_for(Uuid::nil());
+            let provider_id = parse_environment_provider_id(params.provider_id)?;
+            let controller_endpoint = EnvironmentEndpoint::parse(&params.controller_endpoint)
+                .map_err(|error| {
+                    AgentApiError::invalid_request(format!("invalid controller endpoint: {error}"))
+                })?;
+            let credential = params.credential.map(SecretValue::new);
+            if let Some(credential) = &credential {
+                environments::validate_provider_credential(credential)
+                    .map_err(super::service::environment_providers::map_environments_error)?;
+            }
+            // The handshake presents the credential the provider will hold:
+            // the new one, else the stored one.
+            let presented = match &credential {
+                Some(credential) => Some(credential.clone()),
+                None => match store.read_provider_credential(&provider_id).await {
+                    Ok(stored) => Some(stored),
+                    Err(EnvironmentRegistryError::NotFound { .. }) => None,
+                    Err(error) => {
+                        return Err(
+                            super::service::environment_providers::map_environments_error(error),
+                        );
+                    }
+                },
+            };
+            let facts = match &presented {
+                Some(credential) => {
+                    probe_controller(
+                        &WebSocketProviderControllerConnector,
+                        &controller_endpoint,
+                        credential,
+                    )
+                    .await?
+                }
+                None => None,
+            };
             let provider = store
                 .put_provider(PutEnvironmentProvider {
-                    provider_id: parse_environment_provider_id(params.provider_id)?,
+                    provider_id: provider_id.clone(),
                     display_name: params.display_name,
-                    controller_connection: provider_connection_from_api(
-                        params.controller_connection,
-                    ),
+                    controller_endpoint: controller_endpoint.clone(),
                     metadata: params.metadata,
+                    credential,
                     updated_at_ms: i64::try_from(current_time_ms()?)
                         .map_err(|_| AgentApiError::internal("current timestamp exceeds i64"))?,
                 })
                 .await
                 .map_err(super::service::environment_providers::map_environments_error)?;
+            let provider = match facts {
+                Some((features, data_route_base)) => store
+                    .record_provider_controller(RecordProviderController {
+                        provider_id,
+                        controller_endpoint,
+                        features,
+                        data_route_base,
+                    })
+                    .await
+                    .map_err(super::service::environment_providers::map_environments_error)?,
+                None => provider,
+            };
             Ok(AgentApiOutcome::new(
                 DeploymentEnvironmentProviderPutResponse {
                     provider: environment_provider_view(provider),
@@ -441,6 +493,20 @@ impl DeploymentApiService for GatewayDeploymentApi {
             })?;
         validate_adoption_source(&params.source_target)?;
         let store = self.runtime.stores().store_for(universe_id);
+        // Refuse up front when the binding's provider cannot adopt, instead
+        // of failing the environment after its record exists.
+        let binding = store
+            .read_provider_binding(universe_id, &binding_id)
+            .await
+            .map_err(super::service::environment_providers::map_environments_error)?;
+        self.runtime
+            .state_for(universe_id, false)
+            .await
+            .map_err(|error| AgentApiError::internal(error.to_string()))?
+            .api
+            .environment_service()
+            .require_controller_feature(&binding.provider_id, ControllerFeature::AdoptTarget)
+            .await?;
         let environment = EnvironmentStore::adopt_environment(
             store.as_ref(),
             AdoptEnvironment {
@@ -784,44 +850,21 @@ fn parse_environment_provider_id(value: String) -> Result<EnvironmentProviderId,
         .map_err(|error| AgentApiError::invalid_request(format!("invalid provider id: {error}")))
 }
 
-fn provider_connection_from_api(
-    connection: DeploymentEnvironmentProviderConnection,
-) -> EnvironmentConnectionSpec {
-    EnvironmentConnectionSpec {
-        endpoint: connection.endpoint,
-        transport: match connection.transport {
-            DeploymentEnvironmentProviderTransport::WebSocket => EnvironmentTransport::WebSocket,
-            DeploymentEnvironmentProviderTransport::Http => EnvironmentTransport::Http,
-            DeploymentEnvironmentProviderTransport::Stdio => EnvironmentTransport::Stdio,
-            DeploymentEnvironmentProviderTransport::Ssh => EnvironmentTransport::Ssh,
-            DeploymentEnvironmentProviderTransport::Provider { provider_type } => {
-                EnvironmentTransport::Provider { provider_type }
-            }
-        },
-    }
-}
-
 fn environment_provider_view(
     record: EnvironmentProviderRecord,
 ) -> DeploymentEnvironmentProviderView {
     DeploymentEnvironmentProviderView {
         provider_id: record.provider_id.to_string(),
         display_name: record.display_name,
-        controller_connection: DeploymentEnvironmentProviderConnection {
-            endpoint: record.controller_connection.endpoint,
-            transport: match record.controller_connection.transport {
-                EnvironmentTransport::WebSocket => {
-                    DeploymentEnvironmentProviderTransport::WebSocket
-                }
-                EnvironmentTransport::Http => DeploymentEnvironmentProviderTransport::Http,
-                EnvironmentTransport::Stdio => DeploymentEnvironmentProviderTransport::Stdio,
-                EnvironmentTransport::Ssh => DeploymentEnvironmentProviderTransport::Ssh,
-                EnvironmentTransport::Provider { provider_type } => {
-                    DeploymentEnvironmentProviderTransport::Provider { provider_type }
-                }
-            },
-        },
+        controller_endpoint: record.controller_endpoint.as_str().to_owned(),
         metadata: record.metadata,
+        controller_features: record.controller_features.map(|features| {
+            DeploymentEnvironmentProviderFeaturesView {
+                adopt_target: features.adopt_target,
+                ingress: features.ingress,
+            }
+        }),
+        data_route_base: record.data_route_base.map(|base| base.as_str().to_owned()),
         created_at_ms: record.created_at_ms,
         updated_at_ms: record.updated_at_ms,
     }
diff --git a/crates/temporal-runtime/src/gateway/http.rs b/crates/temporal-runtime/src/gateway/http.rs
index 839cf94f0..aa6ff1b5f 100644
--- a/crates/temporal-runtime/src/gateway/http.rs
+++ b/crates/temporal-runtime/src/gateway/http.rs
@@ -18,18 +18,28 @@ use axum::{
     routing::{get, post},
 };
 use environment_protocol::{
-    gateway::{PROVIDER_DATA_PATH_PREFIX, ROUTE_PATH_PREFIX},
-    registration::{CONNECT_PATH, DATA_PATH},
+    control::target::TargetOwner,
+    ids::{BindingId, EnvironmentId, IncarnationId, ProviderTargetId, UniverseId},
+    limits::MAX_MESSAGE_BYTES,
+    routes::{CONNECT_PATH, CanonicalOrigin, DATA_PATH, canonical_origin, provider_data_route},
 };
+use environments::{EndpointScheme, EnvironmentEndpoint};
 use futures_util::{SinkExt as _, StreamExt as _};
 use serde::Deserialize;
 use store_pg::PgApiKeyStore;
-use tokio_tungstenite::{connect_async, tungstenite::Message as ProviderMessage};
+use tokio::io::{AsyncRead, AsyncWrite};
+use tokio_tungstenite::{
+    WebSocketStream, client_async_with_config, connect_async_with_config,
+    tungstenite::{
+        Message as UpstreamMessage, client::IntoClientRequest as _,
+        http::HeaderValue as UpstreamHeaderValue, protocol::WebSocketConfig,
+    },
+};
 use uuid::Uuid;
 
 use crate::{
     config::{DeploymentStores, GatewayAuthMode, gateway_auth_mode_from_env},
-    environments::gateway::{RouteKey, bearer_matches, close_message},
+    environments::gateway::{ROUTE_PATH_PREFIX, RouteKey, bearer_matches, close_message},
     universe::{UniverseError, UniverseRuntime},
 };
 
@@ -51,8 +61,9 @@ pub struct GatewayServerConfig {
     pub temporal_target: String,
     pub namespace: String,
     pub max_request_body_bytes: usize,
-    /// Externally reachable base URL for the OAuth callback
-    /// (`{base}/auth/callback`). Defaults to `http://{bind}`.
+    /// Externally reachable base URL: the OAuth callback
+    /// (`{base}/auth/callback`) and the origin registered daemons sign.
+    /// Defaults to `http://{bind}`, which only a loopback bind may rely on.
     pub public_base_url: Option<String>,
 }
 
@@ -80,8 +91,10 @@ pub struct GatewayState {
     resolution: UniverseResolution,
     /// Live registered-daemon connections on this replica.
     registrations: Arc<RegisteredConnections>,
-    /// Public base URL daemons are told to dial for data connections.
-    public_base_url: String,
+    /// The origin daemons sign registrations for: the canonical origin of
+    /// the public base URL. Absent when that URL has no WebSocket origin;
+    /// the connect route then refuses every daemon.
+    registration_origin: Option<CanonicalOrigin>,
 }
 
 /// Which route families one HTTP listener serves, derived from the
@@ -106,11 +119,11 @@ impl GatewayRoutes {
 impl GatewayState {
     /// Route every request to one existing service instance.
     pub fn for_api(api: Arc<GatewayAgentApi>) -> Self {
-        let public_base_url = api.public_base_url().to_owned();
+        let registration_origin = registration_origin_of(api.public_base_url());
         Self {
             resolution: UniverseResolution::FixedApi { api },
             registrations: Arc::new(RegisteredConnections::new()),
-            public_base_url,
+            registration_origin,
         }
     }
 
@@ -118,17 +131,8 @@ impl GatewayState {
         &self.registrations
     }
 
-    /// Tell daemons to dial a different public base than the general one.
-    pub fn with_environment_public_url(mut self, url: Option<String>) -> Self {
-        if let Some(url) = url {
-            self.public_base_url = url;
-        }
-        self
-    }
-
-    /// Public data route for reverse-dialed daemon sockets.
-    pub(super) fn registration_data_url(&self) -> String {
-        registration::data_url(&self.public_base_url)
+    pub(super) fn registration_origin(&self) -> Option<&CanonicalOrigin> {
+        self.registration_origin.as_ref()
     }
 
     /// The universe a register request belongs to: the environment's
@@ -148,7 +152,7 @@ impl GatewayState {
                 let universe_id = store.config().universe_id;
                 let known = environments::EnvironmentStore::read_environment_by_daemon_public_key(
                     store.as_ref(),
-                    &params.daemon_public_key,
+                    &params.daemon_public_key.to_hex(),
                 )
                 .await
                 .map_err(|error| AgentApiError::internal(error.to_string()))?;
@@ -168,10 +172,12 @@ impl GatewayState {
             }
             UniverseResolution::Multi { runtime, .. } => {
                 let pool = runtime.stores().pool();
-                if let Some(universe_id) =
-                    store_pg::find_registered_environment_universe(pool, &params.daemon_public_key)
-                        .await
-                        .map_err(|error| AgentApiError::internal(error.to_string()))?
+                if let Some(universe_id) = store_pg::find_registered_environment_universe(
+                    pool,
+                    &params.daemon_public_key.to_hex(),
+                )
+                .await
+                .map_err(|error| AgentApiError::internal(error.to_string()))?
                 {
                     return Ok(Some(universe_id));
                 }
@@ -192,16 +198,17 @@ impl GatewayState {
     ) -> Self {
         let api_keys = PgApiKeyStore::new(runtime.stores().pool().clone());
         let deployment = Arc::new(GatewayDeploymentApi::new(runtime.clone()));
+        let registration_origin = registration_origin_of(&public_base_url);
         Self {
             resolution: UniverseResolution::Multi {
                 mode,
                 runtime,
-                public_base_url: public_base_url.clone(),
+                public_base_url,
                 api_keys,
                 deployment,
             },
             registrations: Arc::new(RegisteredConnections::new()),
-            public_base_url,
+            registration_origin,
         }
     }
 
@@ -321,20 +328,76 @@ impl GatewayState {
         }
     }
 
+    fn deployment_store(&self) -> Arc<store_pg::PgStore> {
+        match &self.resolution {
+            UniverseResolution::FixedApi { api } => api.store().clone(),
+            UniverseResolution::Multi { runtime, .. } => runtime.stores().store_for(Uuid::nil()),
+        }
+    }
+
     async fn environment_provider(
         &self,
         provider_id: &environments::EnvironmentProviderId,
-    ) -> Result<environments::EnvironmentProviderRecord, AgentApiError> {
-        let store = match &self.resolution {
-            UniverseResolution::FixedApi { api } => api.store().clone(),
-            UniverseResolution::Multi { runtime, .. } => runtime.stores().store_for(Uuid::nil()),
-        };
-        environments::EnvironmentProviderStore::read_provider(store.as_ref(), provider_id)
-            .await
-            .map_err(|error| AgentApiError::rejected(error.to_string()))
+    ) -> Result<environments::EnvironmentProviderRecord, environments::EnvironmentRegistryError>
+    {
+        environments::EnvironmentProviderStore::read_provider(
+            self.deployment_store().as_ref(),
+            provider_id,
+        )
+        .await
+    }
+
+    async fn environment_provider_credential(
+        &self,
+        provider_id: &environments::EnvironmentProviderId,
+    ) -> Result<auth::SecretValue, environments::EnvironmentRegistryError> {
+        environments::EnvironmentProviderStore::read_provider_credential(
+            self.deployment_store().as_ref(),
+            provider_id,
+        )
+        .await
     }
 }
 
+/// The registration signature origin of a public base URL, if it has one.
+fn registration_origin_of(public_base_url: &str) -> Option<CanonicalOrigin> {
+    match canonical_origin(public_base_url) {
+        Ok(origin) => Some(origin),
+        Err(error) => {
+            tracing::error!(
+                target: "temporal_runtime",
+                %error,
+                public_base_url,
+                "the public base URL has no WebSocket origin; daemon registration is refused"
+            );
+            None
+        }
+    }
+}
+
+/// The origin registered daemons must sign for, checked once at startup by
+/// a process that serves the registration route: the canonical origin of
+/// `LIGHTSPEED_PUBLIC_BASE_URL`. Without that variable the default
+/// `http://{bind}` is the true origin only on a loopback bind, so any other
+/// bind refuses to start rather than reject every remote daemon.
+pub fn registration_origin(
+    public_base_url: Option<&str>,
+    bind: SocketAddr,
+) -> anyhow::Result<CanonicalOrigin> {
+    let Some(public_base_url) = public_base_url else {
+        if !bind.ip().is_loopback() {
+            anyhow::bail!(
+                "LIGHTSPEED_PUBLIC_BASE_URL is required to serve environment registration on {bind}: \
+                 daemons sign the gateway origin they dial, and only that URL names it"
+            );
+        }
+        return Ok(canonical_origin(&format!("http://{bind}"))?);
+    };
+    canonical_origin(public_base_url).map_err(|error| {
+        anyhow::anyhow!("LIGHTSPEED_PUBLIC_BASE_URL has no WebSocket origin: {error}")
+    })
+}
+
 fn map_universe_error(error: UniverseError) -> AgentApiError {
     match error {
         UniverseError::Unknown { universe_id } => {
@@ -350,6 +413,7 @@ pub async fn serve_gateway(config: GatewayServerConfig) -> anyhow::Result<()> {
     let stores = DeploymentStores::from_env()
         .await?
         .with_blob_cache(crate::config::blob_cache_from_env()?);
+    registration_origin(config.public_base_url.as_deref(), config.bind)?;
     let public_base_url = public_base_url_or_default(&config);
     let runtime = Arc::new(UniverseRuntime::new(
         client,
@@ -535,89 +599,58 @@ async fn environment_route_upgrade(
     if environment.incarnation.incarnation_id.as_str() != key.incarnation_id {
         return StatusCode::CONFLICT.into_response();
     }
+    let upgrade = upgrade
+        .max_message_size(MAX_MESSAGE_BYTES as usize)
+        .max_frame_size(MAX_MESSAGE_BYTES as usize);
     match &environment.source {
-        environments::EnvironmentSource::External { connection } => {
-            if connection.transport != environment_protocol::shared::EnvironmentTransport::WebSocket
-            {
-                return StatusCode::BAD_GATEWAY.into_response();
-            }
-            let endpoint = daemon_data_endpoint(&connection.endpoint);
-            let daemon_socket = match connect_async(&endpoint).await {
-                Ok((socket, _)) => socket,
-                Err(error) => {
-                    tracing::warn!(target: "temporal_runtime", %error, %endpoint, "external environment connection failed");
-                    return StatusCode::SERVICE_UNAVAILABLE.into_response();
-                }
+        environments::EnvironmentSource::External { endpoint } => {
+            let upstream =
+                match dial_upstream(endpoint.as_str(), external_target(endpoint), None).await {
+                    Ok(upstream) => upstream,
+                    Err(failure) => return failure.respond(endpoint.as_str()),
+                };
+            let route = UpstreamRoute::External {
+                endpoint: endpoint.clone(),
             };
             upgrade
-                .max_message_size(64 * 1024 * 1024)
-                .on_upgrade(move |socket| {
-                    proxy_external_route(state, key, endpoint, socket, daemon_socket)
-                })
+                .on_upgrade(move |socket| proxy_upstream(state, key, route, socket, upstream))
                 .into_response()
         }
         environments::EnvironmentSource::Provisioned {
             provider_id,
             binding_id,
         } => {
-            let Some(target_id) = environment.incarnation.provider_target_id.as_ref() else {
+            let Some(target_id) = environment.incarnation.provider_target_id.clone() else {
                 return StatusCode::CONFLICT.into_response();
             };
-            if authorize_provisioned_route(
-                &state,
-                &key,
-                provider_id,
-                binding_id,
-                target_id.as_str(),
-            )
-            .await
-            .is_err()
-            {
+            let route = UpstreamRoute::Provider {
+                provider_id: provider_id.clone(),
+                binding_id: binding_id.clone(),
+                target_id,
+            };
+            if authorize_upstream(&state, &key, &route).await.is_err() {
                 return StatusCode::CONFLICT.into_response();
             }
-            let provider = match state.environment_provider(provider_id).await {
-                Ok(provider) => provider,
-                Err(_) => return StatusCode::BAD_GATEWAY.into_response(),
-            };
-            let endpoint = match provider_data_endpoint(
-                &provider.controller_connection.endpoint,
-                &key,
-                binding_id.as_str(),
-                target_id.as_str(),
-            ) {
-                Ok(endpoint) => endpoint,
-                Err(_) => return StatusCode::BAD_GATEWAY.into_response(),
+            let (endpoint, credential) = match provider_route(&state, &key, &route).await {
+                Ok(route) => route,
+                Err(refusal) => return refusal.respond(),
             };
-            let provider_socket = match connect_async(&endpoint).await {
-                Ok((socket, _)) => socket,
-                Err(error) => {
-                    tracing::warn!(target: "temporal_runtime", %error, %endpoint, "provider data connection failed");
-                    return StatusCode::SERVICE_UNAVAILABLE.into_response();
-                }
+            let upstream = match dial_upstream(
+                &endpoint,
+                UpstreamTarget::Url,
+                Some(credential.expose()),
+            )
+            .await
+            {
+                Ok(upstream) => upstream,
+                Err(failure) => return failure.respond(&endpoint),
             };
-            let provider_id = provider_id.clone();
-            let binding_id = binding_id.clone();
-            let target_id = target_id.to_string();
             upgrade
-                .max_message_size(64 * 1024 * 1024)
-                .on_upgrade(move |socket| {
-                    proxy_provider_route(
-                        state,
-                        key,
-                        provider_id,
-                        binding_id,
-                        target_id,
-                        socket,
-                        provider_socket,
-                    )
-                })
+                .on_upgrade(move |socket| proxy_upstream(state, key, route, socket, upstream))
                 .into_response()
         }
         environments::EnvironmentSource::Registered { .. } => {
-            if matches!(
-                environment.status,
-                environments::EnvironmentStatus::Closing | environments::EnvironmentStatus::Closed
-            ) {
+            if environment.status.is_closing_or_closed() {
                 return StatusCode::CONFLICT.into_response();
             }
             let (daemon_socket, control_connection_id) = match registration::open_registered_route(
@@ -632,7 +665,6 @@ async fn environment_route_upgrade(
                 }
             };
             upgrade
-                .max_message_size(64 * 1024 * 1024)
                 .on_upgrade(move |socket| {
                     registration::proxy_registered_route(
                         state,
@@ -647,92 +679,231 @@ async fn environment_route_upgrade(
     }
 }
 
-fn provider_data_endpoint(
-    controller_endpoint: &str,
-    key: &RouteKey,
-    binding_id: &str,
-    target_id: &str,
-) -> anyhow::Result<String> {
-    let mut endpoint = url::Url::parse(controller_endpoint)?;
-    let scheme = match endpoint.scheme() {
-        "http" => "ws",
-        "https" => "wss",
-        "ws" => "ws",
-        "wss" => "wss",
-        other => anyhow::bail!("unsupported provider controller URL scheme: {other}"),
-    };
-    endpoint
-        .set_scheme(scheme)
-        .map_err(|_| anyhow::anyhow!("invalid provider controller URL scheme"))?;
-    endpoint.set_query(None);
-    endpoint.set_fragment(None);
-    let base_path = endpoint
-        .path()
-        .trim_end_matches('/')
-        .strip_suffix("/control")
-        .ok_or_else(|| anyhow::anyhow!("provider controller endpoint must end in /control"))?;
-    endpoint.set_path(&format!("{base_path}{PROVIDER_DATA_PATH_PREFIX}"));
-    endpoint
-        .path_segments_mut()
-        .map_err(|_| anyhow::anyhow!("provider controller URL cannot be a base URL"))?
-        .pop_if_empty()
-        .push(&key.universe_id.to_string())
-        .push(binding_id)
-        .push(&key.environment_id)
-        .push(&key.incarnation_id)
-        .push(target_id);
-    Ok(endpoint.into())
+/// How long the gateway waits for a provider route or external envd to
+/// accept the upstream WebSocket.
+const UPSTREAM_CONNECT_TIMEOUT: Duration = Duration::from_secs(10);
+/// A provider that has not yet advertised its data routes is asked again
+/// after this long.
+const PROVIDER_ROUTES_RETRY_AFTER_SECS: u64 = 5;
+
+/// The upstream a worker route is proxied to, and what keeps it
+/// authorized.
+enum UpstreamRoute {
+    External {
+        endpoint: EnvironmentEndpoint,
+    },
+    Provider {
+        provider_id: environments::EnvironmentProviderId,
+        binding_id: environments::EnvironmentProviderBindingId,
+        target_id: ProviderTargetId,
+    },
 }
 
-fn daemon_data_endpoint(endpoint: &str) -> String {
-    if let Some(rest) = endpoint.strip_prefix("http://") {
-        format!("ws://{rest}")
-    } else if let Some(rest) = endpoint.strip_prefix("https://") {
-        format!("wss://{rest}")
-    } else {
-        endpoint.to_owned()
+/// Why a provisioned target's data route cannot be dialed now.
+enum ProviderRouteRefusal {
+    /// The provider's controller has not advertised its data routes yet.
+    NotAdvertised,
+    Status(StatusCode),
+}
+
+impl ProviderRouteRefusal {
+    fn respond(self) -> Response {
+        match self {
+            Self::NotAdvertised => (
+                StatusCode::SERVICE_UNAVAILABLE,
+                [(
+                    header::RETRY_AFTER,
+                    HeaderValue::from(PROVIDER_ROUTES_RETRY_AFTER_SECS),
+                )],
+            )
+                .into_response(),
+            Self::Status(status) => status.into_response(),
+        }
     }
 }
 
-async fn authorize_external_route(
+/// The provider data route for a provisioned target and the credential it
+/// is dialed with. The route comes only from the base the controller
+/// advertised; a provider that has not advertised one yet is asked to
+/// retry, one without a credential is a configuration error.
+async fn provider_route(
     state: &GatewayState,
     key: &RouteKey,
-    endpoint: &str,
-) -> anyhow::Result<()> {
-    let api = state
-        .api_for_daemon(key.universe_id)
-        .await
-        .map_err(|error| anyhow::anyhow!(error.message))?;
-    let environment_id = environments::EnvironmentId::try_new(key.environment_id.clone())?;
-    let environment =
-        environments::EnvironmentStore::read_environment(api.store().as_ref(), &environment_id)
-            .await?;
-    let environments::EnvironmentSource::External {
-        connection: assigned_connection,
-    } = &environment.source
+    route: &UpstreamRoute,
+) -> Result<(String, auth::SecretValue), ProviderRouteRefusal> {
+    let UpstreamRoute::Provider {
+        provider_id,
+        binding_id,
+        target_id,
+    } = route
     else {
-        anyhow::bail!("external route no longer belongs to an external environment")
+        return Err(ProviderRouteRefusal::Status(StatusCode::BAD_GATEWAY));
     };
-    if assigned_connection.transport
-        != environment_protocol::shared::EnvironmentTransport::WebSocket
-        || daemon_data_endpoint(&assigned_connection.endpoint) != endpoint
-        || environment.incarnation.incarnation_id.as_str() != key.incarnation_id
-        || matches!(
-            environment.status,
-            environments::EnvironmentStatus::Closing | environments::EnvironmentStatus::Closed
-        )
-    {
-        anyhow::bail!("external environment route is stale or no longer authorized")
+    let unavailable = |error: environments::EnvironmentRegistryError| match error {
+        environments::EnvironmentRegistryError::Store { .. } => {
+            tracing::warn!(target: "temporal_runtime", %error, provider = %provider_id, "provider record unavailable");
+            ProviderRouteRefusal::Status(StatusCode::SERVICE_UNAVAILABLE)
+        }
+        error => {
+            tracing::error!(target: "temporal_runtime", %error, provider = %provider_id, "provider data route is misconfigured");
+            ProviderRouteRefusal::Status(StatusCode::BAD_GATEWAY)
+        }
+    };
+    let provider = state
+        .environment_provider(provider_id)
+        .await
+        .map_err(unavailable)?;
+    let Some(base) = provider.data_route_base.as_ref() else {
+        return Err(ProviderRouteRefusal::NotAdvertised);
+    };
+    let credential = state
+        .environment_provider_credential(provider_id)
+        .await
+        .map_err(unavailable)?;
+    let owner = target_owner(key, binding_id).map_err(|error| {
+        tracing::error!(target: "temporal_runtime", %error, environment = %key.environment_id, "route identity is not a valid target owner");
+        ProviderRouteRefusal::Status(StatusCode::BAD_REQUEST)
+    })?;
+    Ok((provider_data_route(base, &owner, target_id), credential))
+}
+
+fn target_owner(
+    key: &RouteKey,
+    binding_id: &environments::EnvironmentProviderBindingId,
+) -> Result<TargetOwner, environment_protocol::ids::IdError> {
+    Ok(TargetOwner {
+        universe_id: UniverseId::new(key.universe_id.to_string())?,
+        binding_id: BindingId::new(binding_id.as_str())?,
+        environment_id: EnvironmentId::new(key.environment_id.as_str())?,
+        incarnation_id: IncarnationId::new(key.incarnation_id.as_str())?,
+    })
+}
+
+/// Where an upstream socket is dialed.
+#[derive(Clone, Copy)]
+enum UpstreamTarget<'a> {
+    /// `ws://` or `wss://`, dialed as written.
+    Url,
+    /// A Unix socket path; the upgrade targets `/` with `Host: localhost`.
+    Unix(&'a str),
+}
+
+fn external_target(endpoint: &EnvironmentEndpoint) -> UpstreamTarget<'_> {
+    match (endpoint.scheme(), endpoint.unix_socket_path()) {
+        (EndpointScheme::Unix, Some(path)) => UpstreamTarget::Unix(path),
+        _ => UpstreamTarget::Url,
     }
-    Ok(())
 }
 
-async fn authorize_provisioned_route(
+enum Upstream {
+    Tcp(Box<WebSocketStream<tokio_tungstenite::MaybeTlsStream<tokio::net::TcpStream>>>),
+    Unix(Box<WebSocketStream<tokio::net::UnixStream>>),
+}
+
+/// Why an upstream dial failed, and what the worker is told.
+enum UpstreamFailure {
+    /// Unreachable, slow or answering 5xx/429: the worker may retry.
+    Unavailable(String),
+    /// The upstream refused the upgrade for good (wrong credential, no such
+    /// route) or the URL is unusable.
+    Refused(String),
+}
+
+impl UpstreamFailure {
+    fn respond(self, endpoint: &str) -> Response {
+        match self {
+            Self::Unavailable(error) => {
+                tracing::warn!(target: "temporal_runtime", %error, %endpoint, "environment upstream unavailable");
+                StatusCode::SERVICE_UNAVAILABLE.into_response()
+            }
+            Self::Refused(error) => {
+                tracing::error!(target: "temporal_runtime", %error, %endpoint, "environment upstream refused the connection");
+                StatusCode::BAD_GATEWAY.into_response()
+            }
+        }
+    }
+}
+
+fn upstream_config() -> WebSocketConfig {
+    WebSocketConfig::default()
+        .max_message_size(Some(MAX_MESSAGE_BYTES as usize))
+        .max_frame_size(Some(MAX_MESSAGE_BYTES as usize))
+}
+
+/// Dial an upstream data socket with the protocol's message limits, an
+/// optional bearer credential and a connect bound.
+async fn dial_upstream(
+    endpoint: &str,
+    target: UpstreamTarget<'_>,
+    bearer: Option<&str>,
+) -> Result<Upstream, UpstreamFailure> {
+    let url = match target {
+        UpstreamTarget::Url => endpoint,
+        UpstreamTarget::Unix(_) => "ws://localhost/",
+    };
+    let mut request = url
+        .into_client_request()
+        .map_err(|error| UpstreamFailure::Refused(error.to_string()))?;
+    if let Some(bearer) = bearer {
+        let mut value =
+            UpstreamHeaderValue::from_str(&format!("Bearer {bearer}")).map_err(|_| {
+                UpstreamFailure::Refused("the credential is not a valid header value".to_owned())
+            })?;
+        value.set_sensitive(true);
+        request.headers_mut().insert(
+            tokio_tungstenite::tungstenite::http::header::AUTHORIZATION,
+            value,
+        );
+    }
+    let dialed = tokio::time::timeout(UPSTREAM_CONNECT_TIMEOUT, async {
+        match target {
+            UpstreamTarget::Url => {
+                connect_async_with_config(request, Some(upstream_config()), true)
+                    .await
+                    .map(|(socket, _)| Upstream::Tcp(Box::new(socket)))
+                    .map_err(upstream_failure)
+            }
+            UpstreamTarget::Unix(path) => {
+                let stream = tokio::net::UnixStream::connect(path)
+                    .await
+                    .map_err(|error| UpstreamFailure::Unavailable(error.to_string()))?;
+                client_async_with_config(request, stream, Some(upstream_config()))
+                    .await
+                    .map(|(socket, _)| Upstream::Unix(Box::new(socket)))
+                    .map_err(upstream_failure)
+            }
+        }
+    })
+    .await;
+    dialed.unwrap_or_else(|_| {
+        Err(UpstreamFailure::Unavailable(format!(
+            "no upgrade within {} s",
+            UPSTREAM_CONNECT_TIMEOUT.as_secs()
+        )))
+    })
+}
+
+fn upstream_failure(error: tokio_tungstenite::tungstenite::Error) -> UpstreamFailure {
+    use tokio_tungstenite::tungstenite::Error;
+    match error {
+        Error::Http(response) => {
+            let status = response.status();
+            let message = format!("upgrade refused with HTTP {status}");
+            if status.is_server_error() || status.as_u16() == 429 {
+                UpstreamFailure::Unavailable(message)
+            } else {
+                UpstreamFailure::Refused(message)
+            }
+        }
+        Error::Url(error) => UpstreamFailure::Refused(error.to_string()),
+        error => UpstreamFailure::Unavailable(error.to_string()),
+    }
+}
+
+async fn authorize_upstream(
     state: &GatewayState,
     key: &RouteKey,
-    provider_id: &environments::EnvironmentProviderId,
-    binding_id: &environments::EnvironmentProviderBindingId,
-    target_id: &str,
+    route: &UpstreamRoute,
 ) -> anyhow::Result<()> {
     let api = state
         .api_for_daemon(key.universe_id)
@@ -742,118 +913,78 @@ async fn authorize_provisioned_route(
     let environment =
         environments::EnvironmentStore::read_environment(api.store().as_ref(), &environment_id)
             .await?;
-    let environments::EnvironmentSource::Provisioned {
-        provider_id: assigned_provider,
-        binding_id: assigned_binding,
-    } = &environment.source
-    else {
-        anyhow::bail!("provider data routes require a provisioned environment")
-    };
-    if assigned_provider != provider_id
-        || assigned_binding != binding_id
-        || environment.incarnation.incarnation_id.as_str() != key.incarnation_id
-        || environment
-            .incarnation
-            .provider_target_id
-            .as_ref()
-            .map(|id| id.as_str())
-            != Some(target_id)
-        || matches!(
-            environment.status,
-            environments::EnvironmentStatus::Closing | environments::EnvironmentStatus::Closed
-        )
+    if environment.incarnation.incarnation_id.as_str() != key.incarnation_id
+        || environment.status.is_closing_or_closed()
     {
-        anyhow::bail!("provider data route is stale or no longer owned")
+        anyhow::bail!("environment route is stale or the environment is closing")
     }
-    let binding = environments::EnvironmentProviderBindingStore::read_provider_binding(
-        api.store().as_ref(),
-        key.universe_id,
-        binding_id,
-    )
-    .await?;
-    if binding.status != environments::EnvironmentProviderBindingStatus::Enabled
-        || binding.provider_id != *provider_id
-    {
-        anyhow::bail!("provider binding is disabled or changed")
+    match (route, &environment.source) {
+        (
+            UpstreamRoute::External { endpoint },
+            environments::EnvironmentSource::External { endpoint: assigned },
+        ) if assigned == endpoint => Ok(()),
+        (
+            UpstreamRoute::Provider {
+                provider_id,
+                binding_id,
+                target_id,
+            },
+            environments::EnvironmentSource::Provisioned {
+                provider_id: assigned_provider,
+                binding_id: assigned_binding,
+            },
+        ) if assigned_provider == provider_id
+            && assigned_binding == binding_id
+            && environment.incarnation.provider_target_id.as_ref() == Some(target_id) =>
+        {
+            let binding = environments::EnvironmentProviderBindingStore::read_provider_binding(
+                api.store().as_ref(),
+                key.universe_id,
+                binding_id,
+            )
+            .await?;
+            if binding.status != environments::EnvironmentProviderBindingStatus::Enabled
+                || binding.provider_id != *provider_id
+            {
+                anyhow::bail!("provider binding is disabled or changed")
+            }
+            Ok(())
+        }
+        _ => anyhow::bail!("environment route no longer matches its environment"),
     }
-    Ok(())
 }
 
-async fn proxy_provider_route(
+async fn proxy_upstream(
     state: Arc<GatewayState>,
     key: RouteKey,
-    provider_id: environments::EnvironmentProviderId,
-    binding_id: environments::EnvironmentProviderBindingId,
-    target_id: String,
-    mut worker: WebSocket,
-    provider: tokio_tungstenite::WebSocketStream<
-        tokio_tungstenite::MaybeTlsStream<tokio::net::TcpStream>,
-    >,
+    route: UpstreamRoute,
+    worker: WebSocket,
+    upstream: Upstream,
 ) {
-    let (mut provider_writer, mut provider_reader) = provider.split();
-    let mut reauthorize = tokio::time::interval(Duration::from_secs(5));
-    loop {
-        tokio::select! {
-            _ = reauthorize.tick() => {
-                if authorize_provisioned_route(
-                    &state, &key, &provider_id, &binding_id, &target_id,
-                ).await.is_err() {
-                    let _ = worker.send(close_message("provider route authorization changed")).await;
-                    break;
-                }
-            }
-            message = worker.recv() => {
-                let Some(Ok(message)) = message else { break };
-                let close = matches!(message, Message::Close(_));
-                let message = match message {
-                    Message::Text(value) => ProviderMessage::Text(value.to_string().into()),
-                    Message::Binary(value) => ProviderMessage::Binary(value),
-                    Message::Ping(value) => ProviderMessage::Ping(value),
-                    Message::Pong(value) => ProviderMessage::Pong(value),
-                    Message::Close(_) => ProviderMessage::Close(None),
-                };
-                if provider_writer.send(message).await.is_err() || close { break }
-            }
-            message = provider_reader.next() => {
-                let Some(Ok(message)) = message else { break };
-                let close = matches!(message, ProviderMessage::Close(_));
-                let message = match message {
-                    ProviderMessage::Text(value) => Some(Message::Text(value.to_string().into())),
-                    ProviderMessage::Binary(value) => Some(Message::Binary(value)),
-                    ProviderMessage::Ping(value) => Some(Message::Ping(value)),
-                    ProviderMessage::Pong(value) => Some(Message::Pong(value)),
-                    ProviderMessage::Close(_) => Some(Message::Close(None)),
-                    ProviderMessage::Frame(_) => None,
-                };
-                if let Some(message) = message
-                    && worker.send(message).await.is_err()
-                { break }
-                if close { break }
-            }
-        }
+    match upstream {
+        Upstream::Tcp(socket) => proxy_frames(state, key, route, worker, *socket).await,
+        Upstream::Unix(socket) => proxy_frames(state, key, route, worker, *socket).await,
     }
-    // Whichever leg ended first, complete the WebSocket closing handshake on
-    // both sides instead of dropping the opposite TCP stream abruptly.
-    let _ = provider_writer.send(ProviderMessage::Close(None)).await;
-    let _ = worker.send(Message::Close(None)).await;
 }
 
-async fn proxy_external_route(
+/// Pipe one worker route and its upstream frame for frame, pings and pongs
+/// included, re-checking the route's authorization on an interval.
+async fn proxy_frames<S>(
     state: Arc<GatewayState>,
     key: RouteKey,
-    endpoint: String,
+    route: UpstreamRoute,
     mut worker: WebSocket,
-    daemon: tokio_tungstenite::WebSocketStream<
-        tokio_tungstenite::MaybeTlsStream<tokio::net::TcpStream>,
-    >,
-) {
-    let (mut daemon_writer, mut daemon_reader) = daemon.split();
+    upstream: WebSocketStream<S>,
+) where
+    S: AsyncRead + AsyncWrite + Unpin,
+{
+    let (mut upstream_writer, mut upstream_reader) = upstream.split();
     let mut reauthorize = tokio::time::interval(Duration::from_secs(5));
     loop {
         tokio::select! {
             _ = reauthorize.tick() => {
-                if authorize_external_route(&state, &key, &endpoint).await.is_err() {
-                    let _ = worker.send(close_message("external route authorization changed")).await;
+                if authorize_upstream(&state, &key, &route).await.is_err() {
+                    let _ = worker.send(close_message("environment route authorization changed")).await;
                     break;
                 }
             }
@@ -861,24 +992,24 @@ async fn proxy_external_route(
                 let Some(Ok(message)) = message else { break };
                 let close = matches!(message, Message::Close(_));
                 let message = match message {
-                    Message::Text(value) => ProviderMessage::Text(value.to_string().into()),
-                    Message::Binary(value) => ProviderMessage::Binary(value),
-                    Message::Ping(value) => ProviderMessage::Ping(value),
-                    Message::Pong(value) => ProviderMessage::Pong(value),
-                    Message::Close(_) => ProviderMessage::Close(None),
+                    Message::Text(value) => UpstreamMessage::Text(value.to_string().into()),
+                    Message::Binary(value) => UpstreamMessage::Binary(value),
+                    Message::Ping(value) => UpstreamMessage::Ping(value),
+                    Message::Pong(value) => UpstreamMessage::Pong(value),
+                    Message::Close(_) => UpstreamMessage::Close(None),
                 };
-                if daemon_writer.send(message).await.is_err() || close { break }
+                if upstream_writer.send(message).await.is_err() || close { break }
             }
-            message = daemon_reader.next() => {
+            message = upstream_reader.next() => {
                 let Some(Ok(message)) = message else { break };
-                let close = matches!(message, ProviderMessage::Close(_));
+                let close = matches!(message, UpstreamMessage::Close(_));
                 let message = match message {
-                    ProviderMessage::Text(value) => Some(Message::Text(value.to_string().into())),
-                    ProviderMessage::Binary(value) => Some(Message::Binary(value)),
-                    ProviderMessage::Ping(value) => Some(Message::Ping(value)),
-                    ProviderMessage::Pong(value) => Some(Message::Pong(value)),
-                    ProviderMessage::Close(_) => Some(Message::Close(None)),
-                    ProviderMessage::Frame(_) => None,
+                    UpstreamMessage::Text(value) => Some(Message::Text(value.to_string().into())),
+                    UpstreamMessage::Binary(value) => Some(Message::Binary(value)),
+                    UpstreamMessage::Ping(value) => Some(Message::Ping(value)),
+                    UpstreamMessage::Pong(value) => Some(Message::Pong(value)),
+                    UpstreamMessage::Close(_) => Some(Message::Close(None)),
+                    UpstreamMessage::Frame(_) => None,
                 };
                 if let Some(message) = message
                     && worker.send(message).await.is_err()
@@ -887,9 +1018,10 @@ async fn proxy_external_route(
             }
         }
     }
-    // A worker activity may be cancelled or its client may disappear without
-    // a close frame. Do not propagate that abrupt teardown to envd.
-    let _ = daemon_writer.send(ProviderMessage::Close(None)).await;
+    // Whichever leg ended first, complete the WebSocket closing handshake on
+    // both sides instead of dropping the opposite stream abruptly; a worker
+    // that vanished without a close frame never tears envd down abruptly.
+    let _ = upstream_writer.send(UpstreamMessage::Close(None)).await;
     let _ = worker.send(Message::Close(None)).await;
 }
 
@@ -1151,32 +1283,65 @@ mod tests {
     }
 
     #[test]
-    fn provider_data_url_is_derived_and_path_segments_are_escaped() {
+    fn provider_data_routes_come_from_the_advertised_base() {
         let key = RouteKey {
             universe_id: Uuid::parse_str("6f3a1a52-58c1-4f0e-9c2d-1a2b3c4d5e6f").unwrap(),
-            environment_id: "environment with space".to_owned(),
-            incarnation_id: "incarnation/one".to_owned(),
+            environment_id: "environment_1".to_owned(),
+            incarnation_id: "incarnation_1".to_owned(),
         };
-        let endpoint = provider_data_endpoint(
-            "https://provider.example/control",
+        let owner = target_owner(
             &key,
-            "primary",
-            "target-one",
+            &environments::EnvironmentProviderBindingId::new("primary"),
         )
         .unwrap();
+        let base =
+            environment_protocol::routes::DataRouteBase::new("wss://provider.example/routes")
+                .unwrap();
         assert_eq!(
-            endpoint,
-            "wss://provider.example/routes/6f3a1a52-58c1-4f0e-9c2d-1a2b3c4d5e6f/primary/environment%20with%20space/incarnation%2Fone/target-one"
+            provider_data_route(
+                &base,
+                &owner,
+                &ProviderTargetId::new("default/pod one").unwrap()
+            ),
+            "wss://provider.example/routes/6f3a1a52-58c1-4f0e-9c2d-1a2b3c4d5e6f/primary/environment_1/incarnation_1/default%2Fpod%20one"
         );
-        let nested = provider_data_endpoint(
-            "https://provider.example/services/incus/control",
-            &key,
-            "primary",
-            "target-one",
-        )
-        .unwrap();
-        assert!(nested.starts_with("wss://provider.example/services/incus/routes/"));
-        assert!(provider_data_endpoint("wss://provider.example/custom", &key, "b", "t").is_err());
+    }
+
+    #[test]
+    fn upstream_refusals_split_into_retryable_and_permanent() {
+        let refused = |status: u16| {
+            upstream_failure(tokio_tungstenite::tungstenite::Error::Http(Box::new(
+                tokio_tungstenite::tungstenite::http::Response::builder()
+                    .status(status)
+                    .body(None)
+                    .unwrap(),
+            )))
+        };
+        assert!(matches!(refused(401), UpstreamFailure::Refused(_)));
+        assert!(matches!(refused(404), UpstreamFailure::Refused(_)));
+        assert!(matches!(refused(503), UpstreamFailure::Unavailable(_)));
+        assert!(matches!(refused(429), UpstreamFailure::Unavailable(_)));
+    }
+
+    #[test]
+    fn the_registration_origin_comes_from_the_public_base_url() {
+        let loopback: SocketAddr = "127.0.0.1:18080".parse().unwrap();
+        let public: SocketAddr = "0.0.0.0:18080".parse().unwrap();
+        assert_eq!(
+            registration_origin(None, loopback).unwrap().as_str(),
+            "ws://127.0.0.1:18080"
+        );
+        assert!(
+            registration_origin(None, public).is_err(),
+            "a non-loopback bind needs the public base URL"
+        );
+        assert_eq!(
+            registration_origin(Some("https://Lightspeed.example/base/"), public)
+                .unwrap()
+                .as_str(),
+            "wss://lightspeed.example"
+        );
+        assert!(registration_origin(Some("lightspeed.example"), public).is_err());
     }
 
     #[test]
diff --git a/crates/temporal-runtime/src/gateway/registration.rs b/crates/temporal-runtime/src/gateway/registration.rs
index a1c24bdd9..4516e8db9 100644
--- a/crates/temporal-runtime/src/gateway/registration.rs
+++ b/crates/temporal-runtime/src/gateway/registration.rs
@@ -1,20 +1,27 @@
 //! Outbound `envd` registration on the environment gateway.
 //!
-//! One public route accepts control connections: the daemon proves its
-//! identity against a nonce, is admitted by a registration key the first
+//! One public route accepts control connections: the registration channel
+//! of `environment_protocol::registration`, on the shared JSON-RPC
+//! envelope with the daemon as the client. The gateway sends the frozen
+//! `registration/challenge` first; the daemon proves its identity in
+//! `registration/register`, is admitted by a registration key the first
 //! time and by its identity afterwards, and then holds the socket while the
-//! gateway pings it and asks it to open data connections. A second public
-//! route accepts those reverse-dialed data sockets and pairs each with the
-//! worker route that requested it; the pair is then proxied frame for frame
-//! exactly like a passive external environment.
+//! gateway pings it and asks it, with `registration/openStream`, to dial
+//! data streams. A second public route accepts those reverse-dialed stream
+//! sockets and pairs each with the worker route that requested it; the
+//! pair is then proxied frame for frame exactly like a passive external
+//! environment. The gateway never names a URL: the daemon derives the
+//! stream URL from its own connect URL.
 //!
-//! The gateway holds no durable lifecycle authority here. Connect,
-//! heartbeat, and disconnect are written as observations on the environment
-//! row; the lifecycle reconciler derives ephemeral cleanup and stale
-//! repair from them.
+//! Connect, heartbeat, and disconnect are written as observations on the
+//! environment row; the lifecycle reconciler derives ephemeral cleanup and
+//! stale repair from them. The one lifecycle decision the gateway makes
+//! itself is a departure: an ephemeral environment whose daemon said
+//! `registration/goodbye` is closed at once instead of after the key's
+//! disconnect grace.
 
 use std::{
-    collections::HashMap,
+    collections::{HashMap, VecDeque},
     sync::{Arc, Mutex},
     time::{Duration, Instant},
 };
@@ -27,66 +34,110 @@ use axum::{
     http::{HeaderMap, StatusCode},
     response::{IntoResponse, Response},
 };
-use ed25519_dalek::{Signature, Verifier as _, VerifyingKey};
+use ed25519_dalek::{Signature, VerifyingKey};
 use environment_protocol::{
+    ENVD_PROTOCOL_VERSION,
+    bytes::SecretString,
+    error::{BusyReason, NotFoundReason, PermissionReason, PreconditionReason, ProtocolError},
+    ids::{ControlConnectionId, DaemonId, EnvironmentId, IncarnationId},
+    jsonrpc::{self, Id, Notification, Request},
+    limits::{HEARTBEAT_MISSED_INTERVALS, MAX_MESSAGE_BYTES},
+    manifest::{
+        RegistrationChallenge, RegistrationClosed, RegistrationGoodbye, RegistrationOpenStream,
+        RegistrationRegister,
+    },
+    metadata::DescriptiveText,
     registration::{
-        DATA_PATH, DaemonControlMessage, GatewayControlMessage, REGISTRATION_NONCE_BYTES,
-        RegisterParams, RegistrationReceipt, RegistrationRejectionCode, decode_hex, encode_hex,
-        signed_registration_message, validate_registration_metadata,
+        Admission, ChallengeNonce, ChallengeParams, ClosedParams, ClosedReason, DaemonPublicKey,
+        GoodbyeParams, OpenStreamParams, OpenStreamResponse, RegisterParams, RegisterResponse,
+        RegistrationIdentityMode, RegistrationReceipt, StreamSpec, signed_registration_message,
     },
-    shared::CURRENT_PROTOCOL_VERSION,
+    routes::CanonicalOrigin,
 };
 use environments::{
-    CreateRegisteredEnvironment, EnvironmentRecord, EnvironmentRegistrationKeyStore,
-    EnvironmentRegistryError, EnvironmentStatus, EnvironmentStore, ObserveRegisteredEnvironment,
-    RegisteredConnectionObservation, registration_key_hash, validate_daemon_public_key,
+    BeginCloseEnvironment, CreateRegisteredEnvironment, DaemonBuild, EnvironmentRecord,
+    EnvironmentRegistrationKeyStore, EnvironmentRegistryError, EnvironmentSource, EnvironmentStore,
+    ObserveRegisteredEnvironment, RegisteredConnectionObservation, RegisteredIdentityMode,
+    registration_key_hash,
 };
 use tokio::sync::{Semaphore, mpsc, oneshot};
 use uuid::Uuid;
 
 use super::http::GatewayState;
-use crate::environments::gateway::{RouteKey, close_message};
+use crate::environments::{
+    gateway::{RouteKey, close_message},
+    registration::departure_closes,
+};
 
 /// Interval between gateway pings on a control connection; each pong
-/// refreshes the environment's heartbeat stamp.
+/// refreshes the environment's heartbeat stamp. Sent to the daemon as
+/// `heartbeatIntervalMs`.
 pub const HEARTBEAT_INTERVAL: Duration = Duration::from_secs(30);
-/// Time a daemon has to answer the challenge.
+/// A control connection that sends no frame for this long is dead.
+const LIVENESS_TIMEOUT: Duration =
+    Duration::from_secs(HEARTBEAT_INTERVAL.as_secs() * HEARTBEAT_MISSED_INTERVALS as u64);
+/// Time from the challenge to the register response; the gateway closes
+/// the socket when it passes and the daemon reconnects with backoff.
 const HANDSHAKE_TIMEOUT: Duration = Duration::from_secs(15);
-/// Time a daemon has to dial the data route for one open request.
-const DATA_DIAL_TIMEOUT: Duration = Duration::from_secs(15);
+/// Time a daemon has to dial the stream route and answer one
+/// `registration/openStream`. The worker's upgrade waits on this pairing,
+/// so worker routes connect with a longer bound
+/// (`environments::gateway::WORKER_ROUTE_CONNECT_TIMEOUT`) and receive the
+/// gateway's typed 502/504 instead of their own connect timeout.
+pub(crate) const STREAM_OPEN_TIMEOUT: Duration = Duration::from_secs(15);
 /// Interval at which a control connection re-reads durable state.
 const REAUTHORIZE_INTERVAL: Duration = Duration::from_secs(5);
-/// Unauthenticated handshakes in flight at once.
+/// Unauthenticated handshakes in flight at once. A permit is held from the
+/// upgrade until the handshake resolves, never for an admitted session.
 const MAX_CONCURRENT_HANDSHAKES: usize = 256;
-/// Failed authentications per key prefix (or daemon) per window.
+/// Failed admissions per verified daemon identity per window.
 const MAX_FAILURES_PER_WINDOW: usize = 20;
 const FAILURE_WINDOW: Duration = Duration::from_secs(60);
-/// Control frames are small JSON documents; anything larger is hostile.
+/// Daemon identities the failure limiter tracks at once; the identity whose
+/// last failure is oldest is forgotten first.
+const MAX_LIMITED_IDENTITIES: usize = 4096;
+/// Registration frames are small JSON documents (a register request with
+/// full metadata is about 12 KiB), so the control route accepts far less
+/// than the protocol's message limit before anyone is authenticated.
 const CONTROL_MAX_MESSAGE_BYTES: usize = 64 * 1024;
+/// `openStream` requests one control connection may have unanswered.
+const CONTROL_COMMAND_QUEUE: usize = 16;
 
 /// Live state of registered daemons on this gateway replica. In-memory by
 /// design: durable truth is the environment row.
 pub struct RegisteredConnections {
     controls: Mutex<HashMap<(Uuid, String), ControlHandle>>,
-    pending: Mutex<HashMap<String, PendingData>>,
+    pending: Mutex<HashMap<String, PendingStream>>,
     handshakes: Arc<Semaphore>,
-    failures: Mutex<HashMap<String, Vec<Instant>>>,
+    failures: Mutex<FailureLimiter>,
 }
 
 struct ControlHandle {
-    connection_id: String,
+    connection_id: ControlConnectionId,
     incarnation_id: String,
     commands: mpsc::Sender<ControlCommand>,
+    /// Fired when a newer connection of the same identity is installed.
+    /// A oneshot, so backpressure on `commands` can never drop it.
+    supersede: oneshot::Sender<()>,
 }
 
 enum ControlCommand {
-    OpenData { token: String, data_url: String },
-    Supersede,
+    /// Ask the daemon for one data stream; `answered` receives its
+    /// `registration/openStream` response.
+    OpenStream {
+        token: SecretString,
+        answered: oneshot::Sender<Result<(), ProtocolError>>,
+    },
 }
 
-struct PendingData {
+/// A stream token the gateway issued and is waiting to pair.
+struct PendingStream {
     sender: oneshot::Sender<WebSocket>,
     expires_at: Instant,
+    key: RouteKey,
+    /// The control connection the token was sent on; pairing is refused
+    /// once it is no longer current.
+    control_connection_id: ControlConnectionId,
 }
 
 impl Default for RegisteredConnections {
@@ -101,16 +152,21 @@ impl RegisteredConnections {
             controls: Mutex::new(HashMap::new()),
             pending: Mutex::new(HashMap::new()),
             handshakes: Arc::new(Semaphore::new(MAX_CONCURRENT_HANDSHAKES)),
-            failures: Mutex::new(HashMap::new()),
+            failures: Mutex::new(FailureLimiter::default()),
         }
     }
 
     /// The control connection currently serving an environment, if any.
     pub fn current_connection_id(&self, key: &RouteKey) -> Option<String> {
+        self.current(key.universe_id, &key.environment_id)
+            .map(|id| id.as_str().to_owned())
+    }
+
+    fn current(&self, universe_id: Uuid, environment_id: &str) -> Option<ControlConnectionId> {
         self.controls
             .lock()
             .expect("registered connections poisoned")
-            .get(&(key.universe_id, key.environment_id.clone()))
+            .get(&(universe_id, environment_id.to_owned()))
             .map(|handle| handle.connection_id.clone())
     }
 
@@ -132,7 +188,7 @@ impl RegisteredConnections {
         &self,
         universe_id: Uuid,
         environment_id: &str,
-        connection_id: &str,
+        connection_id: &ControlConnectionId,
     ) -> bool {
         let mut controls = self
             .controls
@@ -141,7 +197,7 @@ impl RegisteredConnections {
         let key = (universe_id, environment_id.to_owned());
         if controls
             .get(&key)
-            .is_some_and(|handle| handle.connection_id == connection_id)
+            .is_some_and(|handle| &handle.connection_id == connection_id)
         {
             controls.remove(&key);
             true
@@ -150,103 +206,141 @@ impl RegisteredConnections {
         }
     }
 
-    fn record_failure(&self, subject: &str) -> bool {
+    fn take_pending(&self, token: &str) -> Option<PendingStream> {
+        let mut pending = self.pending.lock().expect("pending streams poisoned");
         let now = Instant::now();
-        let mut failures = self.failures.lock().expect("failures poisoned");
-        let entry = failures.entry(subject.to_owned()).or_default();
-        entry.retain(|at| now.duration_since(*at) < FAILURE_WINDOW);
-        entry.push(now);
-        entry.len() > MAX_FAILURES_PER_WINDOW
+        pending.retain(|_, entry| entry.expires_at > now);
+        pending.remove(token)
     }
 
-    fn over_failure_limit(&self, subject: &str) -> bool {
-        let now = Instant::now();
-        let failures = self.failures.lock().expect("failures poisoned");
-        failures.get(subject).is_some_and(|entries| {
-            entries
+    fn retry_after(&self, identity: &DaemonPublicKey) -> Option<Duration> {
+        self.failures
+            .lock()
+            .expect("failure limiter poisoned")
+            .retry_after(identity, Instant::now())
+    }
+
+    fn record_failure(&self, identity: &DaemonPublicKey) {
+        self.failures
+            .lock()
+            .expect("failure limiter poisoned")
+            .record(*identity, Instant::now());
+    }
+}
+
+/// Failed admissions per verified daemon identity. Keyed only on identities
+/// whose signature verified, so nobody can spend another daemon's
+/// allowance with claimed values; pruned on every insert and capped.
+#[derive(Default)]
+struct FailureLimiter {
+    identities: HashMap<DaemonPublicKey, VecDeque<Instant>>,
+}
+
+impl FailureLimiter {
+    /// How long `identity` must wait before its next attempt, when it is
+    /// over the limit.
+    fn retry_after(&self, identity: &DaemonPublicKey, now: Instant) -> Option<Duration> {
+        let failures = self.identities.get(identity)?;
+        let live: Vec<&Instant> = failures
+            .iter()
+            .filter(|at| now.duration_since(**at) < FAILURE_WINDOW)
+            .collect();
+        if live.len() < MAX_FAILURES_PER_WINDOW {
+            return None;
+        }
+        let oldest = live.first()?;
+        Some((FAILURE_WINDOW - now.duration_since(**oldest)).max(Duration::from_millis(1)))
+    }
+
+    fn record(&mut self, identity: DaemonPublicKey, now: Instant) {
+        self.identities.retain(|_, failures| {
+            while failures
+                .front()
+                .is_some_and(|at| now.duration_since(*at) >= FAILURE_WINDOW)
+            {
+                failures.pop_front();
+            }
+            !failures.is_empty()
+        });
+        if !self.identities.contains_key(&identity)
+            && self.identities.len() >= MAX_LIMITED_IDENTITIES
+            && let Some(stalest) = self
+                .identities
                 .iter()
-                .filter(|at| now.duration_since(**at) < FAILURE_WINDOW)
-                .count()
-                >= MAX_FAILURES_PER_WINDOW
-        })
+                .min_by_key(|(_, failures)| failures.back().copied())
+                .map(|(identity, _)| *identity)
+        {
+            self.identities.remove(&stalest);
+        }
+        let failures = self.identities.entry(identity).or_default();
+        failures.push_back(now);
+        while failures.len() > MAX_FAILURES_PER_WINDOW {
+            failures.pop_front();
+        }
     }
 
-    fn take_pending(&self, token: &str) -> Option<PendingData> {
-        let mut pending = self.pending.lock().expect("pending data poisoned");
-        let now = Instant::now();
-        pending.retain(|_, entry| entry.expires_at > now);
-        pending.remove(token)
+    #[cfg(test)]
+    fn len(&self) -> usize {
+        self.identities.len()
     }
 }
 
 /// Outcome of admitting one register request against durable state.
 #[derive(Debug)]
-pub struct Admission {
+pub struct AdmittedEnvironment {
     pub environment: EnvironmentRecord,
-    pub created: bool,
+    pub admission: Admission,
 }
 
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct RegistrationRejection {
-    pub code: RegistrationRejectionCode,
-    pub message: String,
-}
-
-impl RegistrationRejection {
-    fn new(code: RegistrationRejectionCode, message: impl Into<String>) -> Self {
-        Self {
-            code,
-            message: message.into(),
-        }
+/// Decode `registration/register` params. The protocol version is read
+/// first, so a daemon of another version learns it is stale even when the
+/// rest of its request has a shape this gateway does not know; then out of
+/// bounds descriptive values are `invalidRequest` and every other decode
+/// failure `invalidParams`.
+pub fn decode_register(params: &serde_json::Value) -> Result<RegisterParams, ProtocolError> {
+    if let Some(version) = params
+        .get("protocolVersion")
+        .and_then(serde_json::Value::as_u64)
+        && version != u64::from(ENVD_PROTOCOL_VERSION)
+    {
+        return Err(ProtocolError::version_mismatch(
+            ENVD_PROTOCOL_VERSION,
+            u32::try_from(version).unwrap_or(u32::MAX),
+        ));
+    }
+    let params = RegisterParams::decode(params)?;
+    if params.protocol_version != ENVD_PROTOCOL_VERSION {
+        return Err(ProtocolError::version_mismatch(
+            ENVD_PROTOCOL_VERSION,
+            params.protocol_version,
+        ));
     }
+    Ok(params)
 }
 
-/// Check a register request's shape and signature against the challenge
-/// nonce. Pure: no store access.
+/// Check a register request's signature over the challenge nonce bound to
+/// one of the gateway's expected origins. Pure: no store access.
 pub fn verify_register_request(
     params: &RegisterParams,
-    nonce: &[u8],
-) -> Result<(), RegistrationRejection> {
-    if params.protocol_version != CURRENT_PROTOCOL_VERSION {
-        return Err(RegistrationRejection::new(
-            RegistrationRejectionCode::UnsupportedProtocol,
-            format!(
-                "unsupported registration protocol version {}; expected {CURRENT_PROTOCOL_VERSION}",
-                params.protocol_version
-            ),
-        ));
+    nonce: &ChallengeNonce,
+    origins: &[CanonicalOrigin],
+) -> Result<(), ProtocolError> {
+    let invalid = |message: &str| {
+        ProtocolError::permission_denied(Some(PermissionReason::InvalidSignature), message)
+    };
+    let public_key = VerifyingKey::from_bytes(params.daemon_public_key.as_bytes())
+        .map_err(|_| invalid("daemon public key is not a valid Ed25519 key"))?;
+    let signature = Signature::from_bytes(params.signature.as_bytes());
+    if origins.iter().any(|origin| {
+        public_key
+            .verify_strict(&signed_registration_message(nonce, origin), &signature)
+            .is_ok()
+    }) {
+        return Ok(());
     }
-    validate_daemon_public_key(&params.daemon_public_key).map_err(|error| {
-        RegistrationRejection::new(RegistrationRejectionCode::InvalidRequest, error.to_string())
-    })?;
-    validate_registration_metadata(params.display_name.as_deref(), &params.metadata).map_err(
-        |message| RegistrationRejection::new(RegistrationRejectionCode::InvalidRequest, message),
-    )?;
-    let public_key = decode_hex(&params.daemon_public_key)
-        .and_then(|bytes| <[u8; 32]>::try_from(bytes).ok())
-        .and_then(|bytes| VerifyingKey::from_bytes(&bytes).ok())
-        .ok_or_else(|| {
-            RegistrationRejection::new(
-                RegistrationRejectionCode::InvalidSignature,
-                "daemon public key is not a valid Ed25519 key",
-            )
-        })?;
-    let signature = decode_hex(&params.signature)
-        .and_then(|bytes| Signature::from_slice(&bytes).ok())
-        .ok_or_else(|| {
-            RegistrationRejection::new(
-                RegistrationRejectionCode::InvalidSignature,
-                "signature is not a valid Ed25519 signature",
-            )
-        })?;
-    public_key
-        .verify(&signed_registration_message(nonce), &signature)
-        .map_err(|_| {
-            RegistrationRejection::new(
-                RegistrationRejectionCode::InvalidSignature,
-                "signature does not verify against the challenge",
-            )
-        })
+    Err(invalid(
+        "signature does not verify against the challenge and this gateway's origin",
+    ))
 }
 
 /// Admit a verified register request inside its universe: reconnect a known
@@ -256,112 +350,172 @@ pub async fn admit_registration<S>(
     store: &S,
     params: &RegisterParams,
     now_ms: i64,
-) -> Result<Admission, RegistrationRejection>
+) -> Result<AdmittedEnvironment, ProtocolError>
 where
     S: EnvironmentStore + EnvironmentRegistrationKeyStore + ?Sized,
 {
+    let daemon_public_key = params.daemon_public_key.to_hex();
     let known = store
-        .read_environment_by_daemon_public_key(&params.daemon_public_key)
+        .read_environment_by_daemon_public_key(&daemon_public_key)
         .await
         .map_err(unavailable)?;
     if let Some(environment) = known {
-        if matches!(
-            environment.status,
-            EnvironmentStatus::Closing | EnvironmentStatus::Closed
-        ) {
-            return Err(RegistrationRejection::new(
-                RegistrationRejectionCode::EnvironmentClosed,
-                format!(
-                    "environment {} is closed; this daemon identity is spent",
-                    environment.environment_id
-                ),
-            ));
+        if environment.status.is_closing_or_closed() {
+            return Err(environment_closed(&environment));
         }
-        return Ok(Admission {
+        return Ok(AdmittedEnvironment {
             environment,
-            created: false,
+            admission: Admission::Reconnected,
         });
     }
     let Some(secret) = params.registration_key.as_ref() else {
-        return Err(RegistrationRejection::new(
-            RegistrationRejectionCode::UnknownDaemon,
-            "unknown daemon identity and no registration key presented",
-        ));
+        return Err(unknown_daemon());
     };
     let key = store
         .resolve_registration_key(&registration_key_hash(secret.expose()))
         .await
         .map_err(unavailable)?
-        .ok_or_else(|| {
-            RegistrationRejection::new(
-                RegistrationRejectionCode::InvalidRegistrationKey,
-                "registration key is not recognized",
-            )
-        })?;
+        .ok_or_else(unknown_registration_key)?;
     key.check_admits(now_ms).map_err(map_registry_error)?;
-    let mut metadata = params.metadata.clone();
+    let mut metadata = params.metadata.as_map().clone();
     metadata.extend(
-        environments::RegisteredDaemonBuild::from_registration(
-            &params.implementation,
-            params.protocol_version,
-        )
-        .metadata(),
+        DaemonBuild::from_implementation(&params.implementation, params.protocol_version)
+            .metadata(),
     );
     let environment = store
         .create_registered_environment(CreateRegisteredEnvironment {
             registration_key_id: key.registration_key_id.clone(),
             environment_id: super::service::allocate_environment_id_public(),
             incarnation_id: super::service::allocate_incarnation_id_public(),
-            daemon_public_key: params.daemon_public_key.clone(),
-            display_name: params.display_name.clone(),
+            daemon_public_key,
+            display_name: params
+                .display_name
+                .as_ref()
+                .map(|name| name.as_str().to_owned()),
             metadata,
             created_at_ms: now_ms,
         })
         .await
         .map_err(map_registry_error)?;
-    Ok(Admission {
+    Ok(AdmittedEnvironment {
         environment,
-        created: true,
+        admission: Admission::Created,
     })
 }
 
-fn map_registry_error(error: EnvironmentRegistryError) -> RegistrationRejection {
+/// The receipt of an admitted environment, built only from a registered
+/// record.
+fn registration_receipt(
+    environment: &EnvironmentRecord,
+    control_connection_id: &ControlConnectionId,
+    admission: Admission,
+) -> Result<RegistrationReceipt, ProtocolError> {
+    let EnvironmentSource::Registered {
+        daemon_id,
+        identity_mode,
+        ..
+    } = &environment.source
+    else {
+        return Err(ProtocolError::internal(
+            "the admitted environment is not a registered environment",
+        ));
+    };
+    let internal = |error: environment_protocol::ids::IdError| {
+        ProtocolError::internal(format!("admitted environment id: {error}"))
+    };
+    Ok(RegistrationReceipt {
+        environment_id: EnvironmentId::new(environment.environment_id.as_str())
+            .map_err(internal)?,
+        incarnation_id: IncarnationId::new(environment.incarnation.incarnation_id.as_str())
+            .map_err(internal)?,
+        daemon_id: DaemonId::new(daemon_id.as_str()).map_err(internal)?,
+        control_connection_id: control_connection_id.clone(),
+        identity_mode: match identity_mode {
+            RegisteredIdentityMode::Persistent => RegistrationIdentityMode::Persistent,
+            RegisteredIdentityMode::Ephemeral => RegistrationIdentityMode::Ephemeral,
+        },
+        admission,
+    })
+}
+
+fn environment_closed(environment: &EnvironmentRecord) -> ProtocolError {
+    ProtocolError::failed_precondition(
+        PreconditionReason::EnvironmentClosed,
+        format!(
+            "environment {} is closed; this daemon identity is spent",
+            environment.environment_id
+        ),
+    )
+}
+
+fn unknown_daemon() -> ProtocolError {
+    ProtocolError::not_found_because(
+        NotFoundReason::UnknownDaemon,
+        "unknown daemon identity and no registration key presented",
+    )
+}
+
+fn unknown_registration_key() -> ProtocolError {
+    ProtocolError::permission_denied(
+        Some(PermissionReason::InvalidRegistrationKey),
+        "registration key is not recognized",
+    )
+}
+
+fn map_registry_error(error: EnvironmentRegistryError) -> ProtocolError {
     match error {
+        EnvironmentRegistryError::RegistrationKeyUnavailable {
+            reason: "expired", ..
+        } => ProtocolError::expired("registration key is expired"),
         EnvironmentRegistryError::RegistrationKeyUnavailable { reason, .. } => {
-            RegistrationRejection::new(
-                if reason == "expired" {
-                    RegistrationRejectionCode::RegistrationKeyExpired
-                } else {
-                    RegistrationRejectionCode::RegistrationKeyRevoked
-                },
+            ProtocolError::permission_denied(
+                Some(PermissionReason::RegistrationKeyRevoked),
                 format!("registration key is {reason}"),
             )
         }
         EnvironmentRegistryError::RegistrationCapacityExhausted { limit, .. } => {
-            RegistrationRejection::new(
-                RegistrationRejectionCode::CapacityExhausted,
+            ProtocolError::busy(
+                Some(BusyReason::CapacityExhausted),
+                None,
                 format!("registration key has reached its active environment limit of {limit}"),
             )
         }
         EnvironmentRegistryError::AlreadyExists {
             kind: "daemon_identity",
             ..
-        } => RegistrationRejection::new(
-            RegistrationRejectionCode::IdentityInUse,
+        } => ProtocolError::failed_precondition(
+            PreconditionReason::IdentityInUse,
             "daemon identity is already bound to an environment elsewhere",
         ),
+        // The record the request would create breaks the registry's bounds:
+        // admission is refused, never granted with the value dropped.
         EnvironmentRegistryError::InvalidInput { message } => {
-            RegistrationRejection::new(RegistrationRejectionCode::InvalidRequest, message)
+            ProtocolError::invalid_request(message)
         }
         other => unavailable(other),
     }
 }
 
-fn unavailable(error: EnvironmentRegistryError) -> RegistrationRejection {
+fn unavailable(error: EnvironmentRegistryError) -> ProtocolError {
     tracing::warn!(target: "temporal_runtime", %error, "registration store failure");
-    RegistrationRejection::new(
-        RegistrationRejectionCode::Unavailable,
-        "registration is temporarily unavailable",
+    registration_unavailable()
+}
+
+fn registration_unavailable() -> ProtocolError {
+    ProtocolError::unavailable("registration is temporarily unavailable")
+}
+
+/// True for refusals that count against a verified identity's allowance:
+/// credentials that did not admit it.
+fn counts_as_failure(error: &ProtocolError) -> bool {
+    use environment_protocol::error::ErrorData;
+    matches!(
+        error.data,
+        ErrorData::PermissionDenied { .. }
+            | ErrorData::Expired {}
+            | ErrorData::NotFound {
+                reason: Some(NotFoundReason::UnknownDaemon)
+            }
     )
 }
 
@@ -370,22 +524,25 @@ pub(super) async fn connect_upgrade(
     State(state): State<Arc<GatewayState>>,
     upgrade: WebSocketUpgrade,
 ) -> Response {
+    let Some(origin) = state.registration_origin().cloned() else {
+        tracing::error!(
+            target: "temporal_runtime",
+            "registration refused: the gateway has no valid public base URL to verify daemon signatures against"
+        );
+        return StatusCode::SERVICE_UNAVAILABLE.into_response();
+    };
     let Ok(permit) = state.registrations().handshakes.clone().try_acquire_owned() else {
         return StatusCode::SERVICE_UNAVAILABLE.into_response();
     };
     upgrade
         .max_message_size(CONTROL_MAX_MESSAGE_BYTES)
-        .on_upgrade(move |socket| async move {
-            let outcome = control_session(state, socket, permit).await;
-            if let Err(error) = outcome {
-                tracing::debug!(target: "temporal_runtime", %error, "registration control session ended with error");
-            }
-        })
+        .max_frame_size(CONTROL_MAX_MESSAGE_BYTES)
+        .on_upgrade(move |socket| control_connection(state, socket, permit, origin))
         .into_response()
 }
 
-/// `GET /environment-gateway/data`: a reverse-dialed data socket presenting
-/// its one-time token as a bearer header.
+/// `GET /environment-gateway/data`: a reverse-dialed stream socket
+/// presenting its one-time token as a bearer header.
 pub(super) async fn data_upgrade(
     State(state): State<Arc<GatewayState>>,
     headers: HeaderMap,
@@ -394,16 +551,24 @@ pub(super) async fn data_upgrade(
     let token = headers
         .get(axum::http::header::AUTHORIZATION)
         .and_then(|value| value.to_str().ok())
-        .and_then(|value| value.strip_prefix("Bearer "))
-        .map(str::to_owned);
+        .and_then(|value| value.strip_prefix("Bearer "));
     let Some(token) = token else {
         return StatusCode::UNAUTHORIZED.into_response();
     };
-    let Some(pending) = state.registrations().take_pending(&token) else {
+    let registrations = state.registrations();
+    let Some(pending) = registrations.take_pending(token) else {
         return StatusCode::UNAUTHORIZED.into_response();
     };
+    if registrations.current(pending.key.universe_id, &pending.key.environment_id)
+        != Some(pending.control_connection_id.clone())
+    {
+        // The control connection that issued the token was superseded or
+        // ended: whoever dials now is not the daemon it was sent to.
+        return StatusCode::UNAUTHORIZED.into_response();
+    }
     upgrade
-        .max_message_size(64 * 1024 * 1024)
+        .max_message_size(MAX_MESSAGE_BYTES as usize)
+        .max_frame_size(MAX_MESSAGE_BYTES as usize)
         .on_upgrade(move |socket| async move {
             // The waiting route owns the socket from here; if it gave up,
             // dropping the socket closes the daemon's dial.
@@ -412,7 +577,7 @@ pub(super) async fn data_upgrade(
         .into_response()
 }
 
-/// Ask the daemon serving `key` to dial a data socket for one worker route
+/// Ask the daemon serving `key` to dial a data stream for one worker route
 /// and wait for it. Returns the paired socket and the control connection it
 /// was issued under, so the proxy can fence on it.
 pub(super) async fn open_registered_route(
@@ -434,31 +599,53 @@ pub(super) async fn open_registered_route(
         (handle.commands.clone(), handle.connection_id.clone())
     };
     let token = new_token();
-    let (sender, receiver) = oneshot::channel();
+    let (sender, socket) = oneshot::channel();
     registrations
         .pending
         .lock()
-        .expect("pending data poisoned")
+        .expect("pending streams poisoned")
         .insert(
             token.clone(),
-            PendingData {
+            PendingStream {
                 sender,
-                expires_at: Instant::now() + DATA_DIAL_TIMEOUT,
+                expires_at: Instant::now() + STREAM_OPEN_TIMEOUT,
+                key: key.clone(),
+                control_connection_id: control_connection_id.clone(),
             },
         );
-    let sent = commands
-        .send(ControlCommand::OpenData {
-            token: token.clone(),
-            data_url: state.registration_data_url(),
-        })
-        .await;
-    if sent.is_err() {
-        registrations.take_pending(&token);
-        return Err(StatusCode::SERVICE_UNAVAILABLE);
-    }
-    match tokio::time::timeout(DATA_DIAL_TIMEOUT, receiver).await {
-        Ok(Ok(socket)) => Ok((socket, control_connection_id)),
-        _ => {
+    let opened = tokio::time::timeout(STREAM_OPEN_TIMEOUT, async {
+        let (answered, answer) = oneshot::channel();
+        commands
+            .send(ControlCommand::OpenStream {
+                token: SecretString::new(token.clone()),
+                answered,
+            })
+            .await
+            .map_err(|_| StatusCode::SERVICE_UNAVAILABLE)?;
+        match answer.await {
+            Ok(Ok(())) => {}
+            Ok(Err(error)) => {
+                tracing::warn!(
+                    target: "temporal_runtime",
+                    environment = %key.environment_id,
+                    %error,
+                    "registered daemon could not open a stream"
+                );
+                return Err(StatusCode::BAD_GATEWAY);
+            }
+            // The control connection ended before the daemon answered.
+            Err(_) => return Err(StatusCode::SERVICE_UNAVAILABLE),
+        }
+        socket.await.map_err(|_| StatusCode::BAD_GATEWAY)
+    })
+    .await;
+    match opened {
+        Ok(Ok(socket)) => Ok((socket, control_connection_id.as_str().to_owned())),
+        Ok(Err(status)) => {
+            registrations.take_pending(&token);
+            Err(status)
+        }
+        Err(_) => {
             registrations.take_pending(&token);
             Err(StatusCode::GATEWAY_TIMEOUT)
         }
@@ -517,147 +704,319 @@ async fn authorize_registered_route(
         EnvironmentStore::read_environment(api.store().as_ref(), &environment_id).await?;
     if !environment.is_registered()
         || environment.incarnation.incarnation_id.as_str() != key.incarnation_id
-        || matches!(
-            environment.status,
-            EnvironmentStatus::Closing | EnvironmentStatus::Closed
-        )
+        || environment.status.is_closing_or_closed()
     {
         anyhow::bail!("registered route no longer valid");
     }
     Ok(())
 }
 
-async fn control_session(
+/// What the gateway does with one frame before admission.
+#[derive(Debug, PartialEq)]
+enum PreAdmission {
+    /// A `registration/register` request.
+    Register(Request),
+    /// Answer and keep waiting: a framing error.
+    Answer(jsonrpc::Response),
+    /// Answer, then close: a request other than register.
+    AnswerAndClose(jsonrpc::Response),
+    /// Close without an answer: a notification before admission.
+    Close,
+    /// Nothing to do: a response to an id the gateway never sent, a
+    /// malformed notification, a ping or pong.
+    Ignore,
+}
+
+fn classify_pre_admission(message: &Message) -> PreAdmission {
+    match message {
+        Message::Text(text) => match jsonrpc::parse(text.as_str()) {
+            Err(rejection) => match rejection.into_response() {
+                Some(response) => PreAdmission::Answer(response),
+                None => PreAdmission::Ignore,
+            },
+            Ok(jsonrpc::Message::Request(request))
+                if request.method == RegistrationRegister::NAME =>
+            {
+                PreAdmission::Register(request)
+            }
+            Ok(jsonrpc::Message::Request(request)) => PreAdmission::AnswerAndClose(
+                jsonrpc::Response::failure(Some(request.id), ProtocolError::not_initialized()),
+            ),
+            Ok(jsonrpc::Message::Notification(_)) => PreAdmission::Close,
+            Ok(jsonrpc::Message::Response(_)) => PreAdmission::Ignore,
+        },
+        Message::Binary(_) => PreAdmission::Answer(binary_frame_refusal()),
+        Message::Close(_) => PreAdmission::Close,
+        Message::Ping(_) | Message::Pong(_) => PreAdmission::Ignore,
+    }
+}
+
+/// What the gateway does with one text frame after admission.
+#[derive(Debug, PartialEq)]
+enum Admitted {
+    /// Send this answer; the connection stays open.
+    Answer(jsonrpc::Response),
+    /// The daemon answered the gateway request with this id.
+    StreamAnswer(Id, Result<(), ProtocolError>),
+    /// `registration/goodbye`: the daemon is stopping deliberately.
+    Goodbye,
+    /// Ignore and log.
+    Ignore(String),
+}
+
+fn classify_admitted(text: &str) -> Admitted {
+    match jsonrpc::parse(text) {
+        Err(rejection) => match rejection.into_response() {
+            Some(response) => Admitted::Answer(response),
+            None => Admitted::Ignore("malformed notification".to_owned()),
+        },
+        Ok(jsonrpc::Message::Request(request)) => {
+            let error = if request.method == RegistrationRegister::NAME {
+                ProtocolError::invalid_request("the daemon is already admitted")
+            } else {
+                ProtocolError::method_not_found(&request.method)
+            };
+            Admitted::Answer(jsonrpc::Response::failure(Some(request.id), error))
+        }
+        Ok(jsonrpc::Message::Notification(notification))
+            if notification.method == RegistrationGoodbye::NAME =>
+        {
+            match notification.params::<GoodbyeParams>() {
+                Ok(_) => Admitted::Goodbye,
+                Err(error) => Admitted::Ignore(format!("undecodable goodbye: {error}")),
+            }
+        }
+        Ok(jsonrpc::Message::Notification(notification)) => {
+            Admitted::Ignore(format!("unknown notification {}", notification.method))
+        }
+        Ok(jsonrpc::Message::Response(response)) => match response.id.clone() {
+            Some(id) => {
+                let answer = response
+                    .decode::<OpenStreamResponse>()
+                    .map(|_| ())
+                    .map_err(|error| match error {
+                        jsonrpc::ResponseError::Failed(error) => error,
+                        jsonrpc::ResponseError::Undecodable(message) => ProtocolError::internal(
+                            format!("the openStream response breaks the contract: {message}"),
+                        ),
+                    });
+                Admitted::StreamAnswer(id, answer)
+            }
+            None => Admitted::Ignore(format!(
+                "error response without an id: {}",
+                response
+                    .result
+                    .err()
+                    .map(|error| error.to_string())
+                    .unwrap_or_default()
+            )),
+        },
+    }
+}
+
+fn binary_frame_refusal() -> jsonrpc::Response {
+    jsonrpc::Response::failure(
+        None,
+        ProtocolError::invalid_request("binary frames are not part of the registration channel"),
+    )
+}
+
+/// Everything the handshake established.
+struct Handshake {
+    universe_id: Uuid,
+    store: Arc<store_pg::PgStore>,
+    register: RegisterParams,
+    register_id: Id,
+    admitted: AdmittedEnvironment,
+}
+
+/// Why a handshake produced no admitted session.
+enum Refused {
+    /// The socket is gone or the daemon gave up; nothing to answer.
+    Silent,
+    /// Answer the register request with this error, then close.
+    Answer(Id, ProtocolError),
+}
+
+async fn control_connection(
     state: Arc<GatewayState>,
     mut socket: WebSocket,
-    _permit: tokio::sync::OwnedSemaphorePermit,
-) -> anyhow::Result<()> {
-    let nonce = {
-        use rand::TryRng as _;
-        let mut bytes = [0u8; REGISTRATION_NONCE_BYTES];
-        rand::rngs::SysRng
-            .try_fill_bytes(&mut bytes)
-            .expect("OS random source unavailable");
-        bytes
-    };
-    send_control(
-        &mut socket,
-        &GatewayControlMessage::Challenge {
-            protocol_version: CURRENT_PROTOCOL_VERSION,
-            nonce: encode_hex(&nonce),
+    permit: tokio::sync::OwnedSemaphorePermit,
+    origin: CanonicalOrigin,
+) {
+    let handshake =
+        tokio::time::timeout(HANDSHAKE_TIMEOUT, handshake(&state, &mut socket, &origin)).await;
+    // The permit bounds unauthenticated handshakes only: it is released as
+    // soon as the handshake resolved, whatever its outcome.
+    drop(permit);
+    match handshake {
+        Ok(Ok(handshake)) => {
+            if let Err(error) = admitted_session(&state, socket, handshake).await {
+                tracing::debug!(target: "temporal_runtime", %error, "registration control session ended with error");
+            }
+        }
+        Ok(Err(Refused::Answer(id, error))) => {
+            tracing::info!(target: "temporal_runtime", kind = error.kind().as_str(), %error, "registration refused");
+            let _ = send_text(
+                &mut socket,
+                jsonrpc::Response::failure(Some(id), error).to_text(),
+            )
+            .await;
+            let _ = socket.send(Message::Close(None)).await;
+        }
+        Ok(Err(Refused::Silent)) => {
+            let _ = socket.send(Message::Close(None)).await;
+        }
+        Err(_) => {
+            // A daemon that is paused or starved retries with backoff.
+            tracing::info!(target: "temporal_runtime", "registration handshake timed out");
+            let _ = socket.send(Message::Close(None)).await;
+        }
+    }
+}
+
+/// Challenge, read the register request, verify and admit it.
+async fn handshake(
+    state: &Arc<GatewayState>,
+    socket: &mut WebSocket,
+    origin: &CanonicalOrigin,
+) -> Result<Handshake, Refused> {
+    let nonce = new_nonce();
+    let challenge = Notification::new(
+        RegistrationChallenge::NAME,
+        &ChallengeParams {
+            protocol_version: ENVD_PROTOCOL_VERSION,
+            nonce,
         },
     )
-    .await?;
-    let register =
-        match tokio::time::timeout(HANDSHAKE_TIMEOUT, next_daemon_message(&mut socket)).await {
-            Ok(Ok(Some(DaemonControlMessage::Register(params)))) => params,
-            Ok(Ok(None)) => return Ok(()),
-            Ok(Err(error)) => {
-                reject(
-                    &mut socket,
-                    RegistrationRejectionCode::InvalidRequest,
-                    error.to_string(),
-                )
-                .await;
-                return Ok(());
+    .map_err(|_| Refused::Silent)?;
+    send_text(socket, challenge.to_text())
+        .await
+        .map_err(|_| Refused::Silent)?;
+    let request = loop {
+        let Some(Ok(message)) = socket.recv().await else {
+            return Err(Refused::Silent);
+        };
+        match classify_pre_admission(&message) {
+            PreAdmission::Register(request) => break request,
+            PreAdmission::Answer(response) => {
+                send_text(socket, response.to_text())
+                    .await
+                    .map_err(|_| Refused::Silent)?;
             }
-            Err(_) => {
-                reject(
-                    &mut socket,
-                    RegistrationRejectionCode::InvalidRequest,
-                    "handshake timed out",
-                )
-                .await;
-                return Ok(());
+            PreAdmission::AnswerAndClose(response) => {
+                let _ = send_text(socket, response.to_text()).await;
+                return Err(Refused::Silent);
             }
-        };
+            PreAdmission::Close => return Err(Refused::Silent),
+            PreAdmission::Ignore => {}
+        }
+    };
+    let id = request.id.clone();
+    let refuse = |error: ProtocolError| Refused::Answer(id.clone(), error);
+    let register = decode_register(&request.params).map_err(refuse)?;
+    verify_register_request(&register, &nonce, std::slice::from_ref(origin)).map_err(refuse)?;
+
+    // From here the identity is verified: rate limits key on it alone.
     let registrations = state.registrations();
-    let subject = register
-        .registration_key
-        .as_ref()
-        .map(|key| format!("key:{}", key.expose().chars().take(12).collect::<String>()))
-        .unwrap_or_else(|| {
-            format!(
-                "daemon:{}",
-                &register.daemon_public_key[..16.min(register.daemon_public_key.len())]
-            )
-        });
-    if registrations.over_failure_limit(&subject) {
-        reject(
-            &mut socket,
-            RegistrationRejectionCode::RateLimited,
-            "too many failed registrations; retry later",
-        )
-        .await;
-        return Ok(());
-    }
-    if let Err(rejection) = verify_register_request(&register, &nonce) {
-        registrations.record_failure(&subject);
-        reject(&mut socket, rejection.code, rejection.message).await;
-        return Ok(());
+    let identity = register.daemon_public_key;
+    if let Some(retry_after) = registrations.retry_after(&identity) {
+        return Err(refuse(ProtocolError::busy(
+            Some(BusyReason::RateLimited),
+            Some(u64::try_from(retry_after.as_millis()).unwrap_or(u64::MAX)),
+            "too many failed registrations for this daemon identity; retry later",
+        )));
     }
+    let refuse_counted = |error: ProtocolError| {
+        if counts_as_failure(&error) {
+            registrations.record_failure(&identity);
+        }
+        refuse(error)
+    };
     let universe_id = match state.registration_universe(&register).await {
         Ok(Some(universe_id)) => universe_id,
         Ok(None) => {
-            registrations.record_failure(&subject);
-            let (code, message) = if register.registration_key.is_some() {
-                (
-                    RegistrationRejectionCode::InvalidRegistrationKey,
-                    "registration key is not recognized",
-                )
+            return Err(refuse_counted(if register.registration_key.is_some() {
+                unknown_registration_key()
             } else {
-                (
-                    RegistrationRejectionCode::UnknownDaemon,
-                    "unknown daemon identity and no registration key presented",
-                )
-            };
-            reject(&mut socket, code, message).await;
-            return Ok(());
+                unknown_daemon()
+            }));
         }
         Err(error) => {
             tracing::warn!(target: "temporal_runtime", error = %error.message, "registration universe lookup failed");
-            reject(
-                &mut socket,
-                RegistrationRejectionCode::Unavailable,
-                "registration is temporarily unavailable",
-            )
-            .await;
-            return Ok(());
+            return Err(refuse(registration_unavailable()));
         }
     };
-    let api = match state.api_for_daemon(universe_id).await {
-        Ok(api) => api,
+    let api = state.api_for_daemon(universe_id).await.map_err(|error| {
+        tracing::warn!(target: "temporal_runtime", error = %error.message, "registration universe unavailable");
+        refuse(registration_unavailable())
+    })?;
+    let store = api.store().clone();
+    let admitted = admit_registration(store.as_ref(), &register, now_ms())
+        .await
+        .map_err(refuse_counted)?;
+
+    // Record the connect, with the build that serves the environment now,
+    // before the daemon learns it is admitted: a row that cannot take the
+    // observation must not report a live daemon.
+    EnvironmentStore::observe_registered_environment(
+        store.as_ref(),
+        ObserveRegisteredEnvironment {
+            environment_id: admitted.environment.environment_id.clone(),
+            observation: RegisteredConnectionObservation::Connected,
+            observed_at_ms: now_ms(),
+            metadata: DaemonBuild::from_implementation(
+                &register.implementation,
+                register.protocol_version,
+            )
+            .metadata(),
+        },
+    )
+    .await
+    .map_err(|error| refuse(map_registry_error(error)))?;
+    Ok(Handshake {
+        universe_id,
+        store,
+        register,
+        register_id: id,
+        admitted,
+    })
+}
+
+/// The admitted control connection: answer the register request, then
+/// ping, pair streams and watch the environment until the session ends.
+/// Cleanup runs on every exit path.
+async fn admitted_session(
+    state: &Arc<GatewayState>,
+    mut socket: WebSocket,
+    handshake: Handshake,
+) -> anyhow::Result<()> {
+    let Handshake {
+        universe_id,
+        store,
+        register,
+        register_id,
+        admitted,
+    } = handshake;
+    let environment = admitted.environment;
+    let environment_id = environment.environment_id.to_string();
+    let connection_id = ControlConnectionId::new(format!("connection_{}", Uuid::new_v4().simple()))
+        .expect("generated control connection ids are valid");
+    let receipt = match registration_receipt(&environment, &connection_id, admitted.admission) {
+        Ok(receipt) => receipt,
         Err(error) => {
-            tracing::warn!(target: "temporal_runtime", error = %error.message, "registration universe unavailable");
-            reject(
+            let _ = send_text(
                 &mut socket,
-                RegistrationRejectionCode::Unavailable,
-                "registration is temporarily unavailable",
+                jsonrpc::Response::failure(Some(register_id), error).to_text(),
             )
             .await;
+            let _ = socket.send(Message::Close(None)).await;
             return Ok(());
         }
     };
-    let store = api.store().clone();
-    let admission = match admit_registration(store.as_ref(), &register, now_ms()).await {
-        Ok(admission) => admission,
-        Err(rejection) => {
-            if matches!(
-                rejection.code,
-                RegistrationRejectionCode::InvalidRegistrationKey
-                    | RegistrationRejectionCode::RegistrationKeyRevoked
-                    | RegistrationRejectionCode::RegistrationKeyExpired
-            ) {
-                registrations.record_failure(&subject);
-            }
-            reject(&mut socket, rejection.code, rejection.message).await;
-            return Ok(());
-        }
-    };
-    let environment = admission.environment;
-    let environment_id = environment.environment_id.to_string();
-    let connection_id = format!("connection_{}", Uuid::new_v4().simple());
-    let (commands, mut command_rx) = mpsc::channel::<ControlCommand>(16);
+    let registrations = state.registrations();
+    let (commands, command_rx) = mpsc::channel(CONTROL_COMMAND_QUEUE);
+    let (supersede, superseded) = oneshot::channel();
     if let Some(previous) = registrations.install(
         universe_id,
         environment_id.clone(),
@@ -665,106 +1024,293 @@ async fn control_session(
             connection_id: connection_id.clone(),
             incarnation_id: environment.incarnation.incarnation_id.to_string(),
             commands,
+            supersede,
         },
     ) {
-        let _ = previous.commands.try_send(ControlCommand::Supersede);
+        let _ = previous.supersede.send(());
     }
-    // Every admission re-records which build serves the environment, so a
-    // replaced daemon shows its new version, commit, and protocol on the row
-    // instead of the one it first registered with.
-    let daemon_build = environments::RegisteredDaemonBuild::from_registration(
-        &register.implementation,
-        register.protocol_version,
+    tracing::info!(
+        target: "temporal_runtime",
+        %universe_id,
+        environment = %environment_id,
+        daemon = %receipt.daemon_id,
+        daemon_public_key = %register.daemon_public_key,
+        connection = %connection_id,
+        admission = ?receipt.admission,
+        "registered environment control connection admitted"
     );
-    let observe = |observation: RegisteredConnectionObservation| {
-        let store = store.clone();
-        let environment_id = environment.environment_id.clone();
-        let metadata = match observation {
-            RegisteredConnectionObservation::Connected => daemon_build.metadata(),
-            _ => std::collections::BTreeMap::new(),
-        };
-        async move {
-            let result = EnvironmentStore::observe_registered_environment(
-                store.as_ref(),
-                ObserveRegisteredEnvironment {
-                    environment_id,
-                    observation,
-                    observed_at_ms: now_ms(),
-                    metadata,
-                },
-            )
-            .await;
-            if let Err(error) = result {
-                tracing::warn!(target: "temporal_runtime", %error, "registered observation failed");
-            }
-        }
-    };
-    observe(RegisteredConnectionObservation::Connected).await;
-    let identity_mode = environment
-        .source
-        .identity_mode()
-        .map(|mode| mode.as_str().to_owned())
-        .unwrap_or_default();
-    let daemon_id = match &environment.source {
-        environments::EnvironmentSource::Registered { daemon_id, .. } => daemon_id.to_string(),
-        _ => String::new(),
+    let session = ControlSession {
+        state,
+        store: &store,
+        universe_id,
+        environment: &environment,
+        connection_id: &connection_id,
     };
+    let (end, heartbeat_write) = session
+        .serve(&mut socket, register_id, receipt, command_rx, superseded)
+        .await;
+    let was_current = registrations.remove_if_current(universe_id, &environment_id, &connection_id);
+    // A heartbeat write that already passed its "still current" check
+    // must land before the disconnect, or a late `Connected` would report
+    // a live daemon on a row nobody holds. Later writes see the removal.
+    if let Some(write) = heartbeat_write {
+        settle_heartbeat_write(write).await;
+    }
     tracing::info!(
         target: "temporal_runtime",
         %universe_id,
         environment = %environment_id,
-        daemon = %daemon_id,
         connection = %connection_id,
-        created = admission.created,
-        "registered environment control connection admitted"
+        reason = end.reason(),
+        current = was_current,
+        "registered environment control connection ended"
     );
-    send_control(
-        &mut socket,
-        &GatewayControlMessage::Accepted {
-            receipt: RegistrationReceipt {
-                environment_id: environment_id.clone(),
-                incarnation_id: environment.incarnation.incarnation_id.to_string(),
-                daemon_id,
-                connection_id: connection_id.clone(),
-                identity_mode,
-            },
-            heartbeat_interval_ms: HEARTBEAT_INTERVAL.as_millis() as u64,
+    if was_current {
+        observe(
+            &store,
+            &environment.environment_id,
+            RegisteredConnectionObservation::Disconnected,
+        )
+        .await;
+        if end == SessionEnd::Goodbye && departure_closes(&environment) {
+            close_departed(&store, &environment).await;
+        }
+    }
+    let _ = socket.send(Message::Close(None)).await;
+    Ok(())
+}
+
+/// Longest wait for an in-flight heartbeat write when a session ends; a
+/// write still running after it is aborted.
+const HEARTBEAT_SETTLE_TIMEOUT: Duration = Duration::from_secs(5);
+
+async fn settle_heartbeat_write(mut write: tokio::task::JoinHandle<()>) {
+    if tokio::time::timeout(HEARTBEAT_SETTLE_TIMEOUT, &mut write)
+        .await
+        .is_err()
+    {
+        write.abort();
+        tracing::warn!(
+            target: "temporal_runtime",
+            "registered heartbeat write did not finish before the disconnect; aborted"
+        );
+    }
+}
+
+async fn close_departed(store: &Arc<store_pg::PgStore>, environment: &EnvironmentRecord) {
+    let result = EnvironmentStore::begin_close_environment(
+        store.as_ref(),
+        BeginCloseEnvironment {
+            environment_id: environment.environment_id.clone(),
+            updated_at_ms: now_ms(),
         },
     )
-    .await?;
+    .await;
+    match result {
+        Ok(_) => tracing::info!(
+            target: "temporal_runtime",
+            environment = %environment.environment_id,
+            "ephemeral registered daemon departed; closing its environment"
+        ),
+        // The reconciler's grace sweep closes it later.
+        Err(error) => tracing::warn!(
+            target: "temporal_runtime",
+            environment = %environment.environment_id,
+            %error,
+            "closing a departed ephemeral environment failed"
+        ),
+    }
+}
 
-    let mut heartbeat = tokio::time::interval(HEARTBEAT_INTERVAL);
-    heartbeat.tick().await;
-    let mut reauthorize = tokio::time::interval(REAUTHORIZE_INTERVAL);
-    reauthorize.tick().await;
-    let end_reason: &str = loop {
-        tokio::select! {
-            command = command_rx.recv() => match command {
-                Some(ControlCommand::OpenData { token, data_url }) => {
-                    let message = GatewayControlMessage::OpenData {
-                        token: token.into(),
-                        data_url,
+/// Why an admitted session ended.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum SessionEnd {
+    Superseded,
+    EnvironmentClosed,
+    Goodbye,
+    HeartbeatTimeout,
+    DaemonClosed,
+    SendFailed,
+}
+
+impl SessionEnd {
+    fn reason(self) -> &'static str {
+        match self {
+            Self::Superseded => "superseded",
+            Self::EnvironmentClosed => "environment closed",
+            Self::Goodbye => "goodbye",
+            Self::HeartbeatTimeout => "heartbeat timeout",
+            Self::DaemonClosed => "daemon closed",
+            Self::SendFailed => "send failed",
+        }
+    }
+}
+
+struct ControlSession<'a> {
+    state: &'a Arc<GatewayState>,
+    store: &'a Arc<store_pg::PgStore>,
+    universe_id: Uuid,
+    environment: &'a EnvironmentRecord,
+    connection_id: &'a ControlConnectionId,
+}
+
+impl ControlSession<'_> {
+    /// Serve the admitted session until it ends. Also returns the heartbeat
+    /// write still in flight, which the caller settles before recording
+    /// the disconnect.
+    async fn serve(
+        &self,
+        socket: &mut WebSocket,
+        register_id: Id,
+        receipt: RegistrationReceipt,
+        commands: mpsc::Receiver<ControlCommand>,
+        superseded: oneshot::Receiver<()>,
+    ) -> (SessionEnd, Option<tokio::task::JoinHandle<()>>) {
+        let response = jsonrpc::Response::success(
+            register_id,
+            &RegisterResponse {
+                receipt,
+                heartbeat_interval_ms: u64::try_from(HEARTBEAT_INTERVAL.as_millis())
+                    .unwrap_or(u64::MAX),
+            },
+        );
+        if send_text(socket, response.to_text()).await.is_err() {
+            return (SessionEnd::SendFailed, None);
+        }
+        let mut heartbeat_write = None;
+        let end = self
+            .run(socket, commands, superseded, &mut heartbeat_write)
+            .await;
+        (end, heartbeat_write)
+    }
+
+    async fn run(
+        &self,
+        socket: &mut WebSocket,
+        mut commands: mpsc::Receiver<ControlCommand>,
+        mut superseded: oneshot::Receiver<()>,
+        heartbeat_write: &mut Option<tokio::task::JoinHandle<()>>,
+    ) -> SessionEnd {
+        let mut heartbeat = tokio::time::interval(HEARTBEAT_INTERVAL);
+        heartbeat.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Delay);
+        heartbeat.tick().await;
+        let (mut environment_closed, _watcher) = self.watch_environment_closed();
+        let mut watching = true;
+        let mut deadline = tokio::time::Instant::now() + LIVENESS_TIMEOUT;
+        let mut next_request = 0_u64;
+        let mut streams: HashMap<Id, oneshot::Sender<Result<(), ProtocolError>>> = HashMap::new();
+        let mut commands_closed = false;
+        loop {
+            // Biased: a frame that already arrived is read before the
+            // liveness deadline is checked, so a loop that fell behind
+            // never declares an answering daemon dead.
+            tokio::select! {
+                biased;
+                _ = &mut superseded => {
+                    self.closed(socket, ClosedReason::Superseded, "another process with this daemon identity connected").await;
+                    return SessionEnd::Superseded;
+                }
+                closed = &mut environment_closed, if watching => {
+                    if closed.is_ok() {
+                        self.closed(socket, ClosedReason::EnvironmentClosed, "the environment was closed").await;
+                        return SessionEnd::EnvironmentClosed;
+                    }
+                    watching = false;
+                }
+                command = commands.recv(), if !commands_closed => {
+                    // The channel closes only when a newer connection
+                    // replaced this session's handle; supersede follows.
+                    let Some(ControlCommand::OpenStream { token, answered }) = command else {
+                        commands_closed = true;
+                        continue;
+                    };
+                    next_request += 1;
+                    let id = Id::String(format!("g{next_request}"));
+                    let request = Request::new(
+                        id.clone(),
+                        RegistrationOpenStream::NAME,
+                        &OpenStreamParams { token, stream: StreamSpec::DataProtocol {} },
+                    );
+                    let Ok(request) = request else {
+                        let _ = answered.send(Err(ProtocolError::internal("encode openStream")));
+                        continue;
                     };
-                    if send_control(&mut socket, &message).await.is_err() {
-                        break "send failed";
+                    if send_text(socket, request.to_text()).await.is_err() {
+                        return SessionEnd::SendFailed;
+                    }
+                    streams.retain(|_, waiting| !waiting.is_closed());
+                    streams.insert(id, answered);
+                }
+                _ = heartbeat.tick() => {
+                    if socket.send(Message::Ping(Default::default())).await.is_err() {
+                        return SessionEnd::SendFailed;
                     }
                 }
-                Some(ControlCommand::Supersede) => {
-                    let _ = socket.send(close_message("superseded by a newer connection of the same daemon")).await;
-                    break "superseded";
+                message = socket.recv() => {
+                    let Some(Ok(message)) = message else {
+                        return SessionEnd::DaemonClosed;
+                    };
+                    deadline = tokio::time::Instant::now() + LIVENESS_TIMEOUT;
+                    let answer = match message {
+                        Message::Pong(_) => {
+                            if heartbeat_write.as_ref().is_none_or(|write| write.is_finished()) {
+                                *heartbeat_write = Some(self.record_heartbeat());
+                            }
+                            None
+                        }
+                        Message::Ping(_) => None,
+                        Message::Close(_) => return SessionEnd::DaemonClosed,
+                        Message::Binary(_) => Some(binary_frame_refusal()),
+                        Message::Text(text) => match classify_admitted(text.as_str()) {
+                            Admitted::Answer(response) => Some(response),
+                            Admitted::StreamAnswer(id, answer) => {
+                                match streams.remove(&id) {
+                                    Some(waiting) => { let _ = waiting.send(answer); }
+                                    None => tracing::debug!(target: "temporal_runtime", %id, "ignoring a response to an unknown request id"),
+                                }
+                                None
+                            }
+                            Admitted::Goodbye => {
+                                tracing::info!(target: "temporal_runtime", environment = %self.environment.environment_id, "registered daemon said goodbye");
+                                return SessionEnd::Goodbye;
+                            }
+                            Admitted::Ignore(reason) => {
+                                tracing::debug!(target: "temporal_runtime", %reason, "ignoring a registration frame");
+                                None
+                            }
+                        },
+                    };
+                    if let Some(answer) = answer
+                        && send_text(socket, answer.to_text()).await.is_err()
+                    {
+                        return SessionEnd::SendFailed;
+                    }
                 }
-                None => break "command channel closed",
-            },
-            _ = heartbeat.tick() => {
-                if socket.send(Message::Ping(Default::default())).await.is_err() {
-                    break "ping failed";
+                _ = tokio::time::sleep_until(deadline) => {
+                    return SessionEnd::HeartbeatTimeout;
                 }
             }
-            _ = reauthorize.tick() => {
-                match EnvironmentStore::read_environment(store.as_ref(), &environment.environment_id).await {
-                    Ok(current) if matches!(current.status, EnvironmentStatus::Closing | EnvironmentStatus::Closed) => {
-                        let _ = socket.send(close_message("environment closed")).await;
-                        break "environment closed";
+        }
+    }
+
+    /// Re-read the environment every [`REAUTHORIZE_INTERVAL`] off the
+    /// session loop, so a slow store never delays pings, pongs or stream
+    /// requests. The receiver fires once the environment is closing or
+    /// closed; the watcher stops when the returned guard drops.
+    fn watch_environment_closed(&self) -> (oneshot::Receiver<()>, AbortOnDrop) {
+        let store = self.store.clone();
+        let environment_id = self.environment.environment_id.clone();
+        let (closed, receiver) = oneshot::channel();
+        let task = tokio::spawn(async move {
+            let mut interval = tokio::time::interval(REAUTHORIZE_INTERVAL);
+            interval.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Delay);
+            interval.tick().await;
+            loop {
+                interval.tick().await;
+                match EnvironmentStore::read_environment(store.as_ref(), &environment_id).await {
+                    Ok(current) if current.status.is_closing_or_closed() => {
+                        let _ = closed.send(());
+                        return;
                     }
                     Ok(_) => {}
                     Err(error) => {
@@ -772,89 +1318,102 @@ async fn control_session(
                     }
                 }
             }
-            message = socket.recv() => match message {
-                Some(Ok(Message::Pong(_))) => observe(RegisteredConnectionObservation::Heartbeat).await,
-                Some(Ok(Message::Ping(bytes))) => {
-                    if socket.send(Message::Pong(bytes)).await.is_err() {
-                        break "pong failed";
-                    }
-                }
-                Some(Ok(Message::Close(_))) | None => break "daemon closed",
-                Some(Ok(_)) => {}
-                Some(Err(_)) => break "socket error",
+        });
+        (receiver, AbortOnDrop(task))
+    }
+
+    /// Tell the daemon its session ends for good, then close.
+    async fn closed(&self, socket: &mut WebSocket, reason: ClosedReason, message: &str) {
+        if let Ok(notification) = Notification::new(
+            RegistrationClosed::NAME,
+            &ClosedParams {
+                reason,
+                message: DescriptiveText::lossy(message),
             },
+        ) {
+            let _ = send_text(socket, notification.to_text()).await;
         }
-    };
-    let was_current = registrations.remove_if_current(universe_id, &environment_id, &connection_id);
-    tracing::info!(
-        target: "temporal_runtime",
-        %universe_id,
-        environment = %environment_id,
-        connection = %connection_id,
-        reason = end_reason,
-        current = was_current,
-        "registered environment control connection ended"
-    );
-    if was_current {
-        observe(RegisteredConnectionObservation::Disconnected).await;
+        let _ = socket
+            .send(close_message(match reason {
+                ClosedReason::Superseded => "superseded by a newer connection of the same daemon",
+                ClosedReason::EnvironmentClosed => "environment closed",
+            }))
+            .await;
+    }
+
+    /// A pong from the current control connection means the daemon is
+    /// connected: refresh the stamp and restore `Ready` if a lost write or
+    /// the stale sweep marked the row offline. Written off the session
+    /// loop so a slow store never delays pings or stream requests.
+    fn record_heartbeat(&self) -> tokio::task::JoinHandle<()> {
+        let registrations = self.state.registrations().clone();
+        let store = self.store.clone();
+        let universe_id = self.universe_id;
+        let environment_id = self.environment.environment_id.clone();
+        let connection_id = self.connection_id.clone();
+        tokio::spawn(async move {
+            if registrations.current(universe_id, environment_id.as_str()) != Some(connection_id) {
+                return;
+            }
+            observe(
+                &store,
+                &environment_id,
+                RegisteredConnectionObservation::Connected,
+            )
+            .await;
+        })
     }
-    Ok(())
 }
 
-async fn send_control(
-    socket: &mut WebSocket,
-    message: &GatewayControlMessage,
-) -> anyhow::Result<()> {
-    socket
-        .send(Message::Text(serde_json::to_string(message)?.into()))
-        .await
-        .map_err(|error| anyhow::anyhow!("send control message: {error}"))
+/// Aborts a background task when the session that owns it ends.
+struct AbortOnDrop(tokio::task::JoinHandle<()>);
+
+impl Drop for AbortOnDrop {
+    fn drop(&mut self) {
+        self.0.abort();
+    }
 }
 
-async fn reject(
-    socket: &mut WebSocket,
-    code: RegistrationRejectionCode,
-    message: impl Into<String>,
+async fn observe(
+    store: &Arc<store_pg::PgStore>,
+    environment_id: &environments::EnvironmentId,
+    observation: RegisteredConnectionObservation,
 ) {
-    let message = message.into();
-    tracing::info!(target: "temporal_runtime", ?code, %message, "registration rejected");
-    let _ = send_control(socket, &GatewayControlMessage::Rejected { code, message }).await;
-    let _ = socket.send(Message::Close(None)).await;
+    let result = EnvironmentStore::observe_registered_environment(
+        store.as_ref(),
+        ObserveRegisteredEnvironment {
+            environment_id: environment_id.clone(),
+            observation,
+            observed_at_ms: now_ms(),
+            metadata: Default::default(),
+        },
+    )
+    .await;
+    if let Err(error) = result {
+        tracing::warn!(target: "temporal_runtime", %error, ?observation, "registered observation failed");
+    }
 }
 
-async fn next_daemon_message(
-    socket: &mut WebSocket,
-) -> anyhow::Result<Option<DaemonControlMessage>> {
-    loop {
-        match socket.recv().await {
-            Some(Ok(Message::Text(text))) => {
-                return serde_json::from_str(&text)
-                    .map(Some)
-                    .map_err(|error| anyhow::anyhow!("decode register message: {error}"));
-            }
-            Some(Ok(Message::Binary(bytes))) => {
-                return serde_json::from_slice(&bytes)
-                    .map(Some)
-                    .map_err(|error| anyhow::anyhow!("decode register message: {error}"));
-            }
-            Some(Ok(Message::Close(_))) | None => return Ok(None),
-            Some(Ok(Message::Ping(bytes))) => {
-                socket.send(Message::Pong(bytes)).await?;
-            }
-            Some(Ok(_)) => {}
-            Some(Err(error)) => return Err(error.into()),
-        }
-    }
+async fn send_text(socket: &mut WebSocket, text: String) -> Result<(), axum::Error> {
+    socket.send(Message::Text(text.into())).await
+}
+
+fn new_nonce() -> ChallengeNonce {
+    ChallengeNonce::from_bytes(random_bytes())
 }
 
 fn new_token() -> String {
     use base64::Engine as _;
+    base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(random_bytes::<32>())
+}
+
+fn random_bytes<const N: usize>() -> [u8; N] {
     use rand::TryRng as _;
-    let mut bytes = [0u8; 32];
+    let mut bytes = [0u8; N];
     rand::rngs::SysRng
         .try_fill_bytes(&mut bytes)
         .expect("OS random source unavailable");
-    base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(bytes)
+    bytes
 }
 
 fn now_ms() -> i64 {
@@ -864,25 +1423,22 @@ fn now_ms() -> i64 {
         .unwrap_or(0)
 }
 
-/// The public data route daemons dial for reverse data connections.
-pub fn data_url(public_base_url: &str) -> String {
-    format!(
-        "{}{DATA_PATH}",
-        crate::environments::gateway::websocket_base(public_base_url.trim_end_matches('/'))
-    )
-}
-
 #[cfg(test)]
 mod tests {
-    use std::collections::BTreeMap;
-
     use ed25519_dalek::{Signer as _, SigningKey};
-    use environment_protocol::shared::{ImplementationInfo, SecretString};
+    use environment_protocol::{
+        error::{ErrorData, ProtocolErrorKind},
+        handshake::ImplementationInfo,
+        metadata::{DisplayName, Metadata},
+        registration::Ed25519Signature,
+        routes::canonical_origin,
+    };
     use environments::{
         BeginCloseEnvironment, CreateEnvironmentRegistrationKey, EnvironmentRegistrationKeyId,
-        FinishCloseEnvironment, InMemoryEnvironmentRegistryStore, RegisteredIdentityMode,
+        EnvironmentStatus, FinishCloseEnvironment, InMemoryEnvironmentRegistryStore,
         RegistrationKeyPolicy, RevokeEnvironmentRegistrationKey, mint_registration_key,
     };
+    use serde_json::json;
 
     use super::*;
 
@@ -890,23 +1446,38 @@ mod tests {
         SigningKey::from_bytes(&[seed; 32])
     }
 
-    fn register(key: &SigningKey, nonce: &[u8], secret: Option<&str>) -> RegisterParams {
+    fn origin() -> CanonicalOrigin {
+        canonical_origin("wss://gateway.example/environment-gateway/connect").unwrap()
+    }
+
+    fn register_signed(
+        key: &SigningKey,
+        nonce: &ChallengeNonce,
+        origin: &CanonicalOrigin,
+        secret: Option<&str>,
+    ) -> RegisterParams {
         RegisterParams {
-            protocol_version: CURRENT_PROTOCOL_VERSION,
+            protocol_version: ENVD_PROTOCOL_VERSION,
             registration_key: secret.map(SecretString::new),
-            daemon_public_key: encode_hex(key.verifying_key().as_bytes()),
-            signature: encode_hex(&key.sign(&signed_registration_message(nonce)).to_bytes()),
-            display_name: Some("worker".to_owned()),
-            metadata: BTreeMap::new(),
-            implementation: ImplementationInfo {
-                name: "lightspeed-envd".to_owned(),
-                version: Some("0.1.0".to_owned()),
-                git_sha: Some("1111111111111111111111111111111111111111".to_owned()),
-                target: Some("x86_64-unknown-linux-musl".to_owned()),
-            },
+            daemon_public_key: DaemonPublicKey::from_bytes(key.verifying_key().to_bytes()),
+            signature: Ed25519Signature::from_bytes(
+                key.sign(&signed_registration_message(nonce, origin))
+                    .to_bytes(),
+            ),
+            display_name: Some(DisplayName::new("worker").unwrap()),
+            metadata: Metadata::default(),
+            implementation: ImplementationInfo::new("lightspeed-envd")
+                .and_then(|info| info.with_version("0.1.0"))
+                .and_then(|info| info.with_git_sha("1111111111111111111111111111111111111111"))
+                .and_then(|info| info.with_target("x86_64-unknown-linux-musl"))
+                .unwrap(),
         }
     }
 
+    fn register(key: &SigningKey, secret: Option<&str>) -> RegisterParams {
+        register_signed(key, &ChallengeNonce::from_bytes([1; 32]), &origin(), secret)
+    }
+
     async fn store_with_key(
         id: &str,
         policy: RegistrationKeyPolicy,
@@ -935,85 +1506,205 @@ mod tests {
     }
 
     #[test]
-    fn register_requests_are_verified_against_the_nonce_and_domain() {
+    fn signatures_bind_the_nonce_and_the_gateway_origin() {
         let key = daemon(1);
-        let nonce = [5u8; 32];
-        assert!(verify_register_request(&register(&key, &nonce, None), &nonce).is_ok());
-        let replayed = verify_register_request(&register(&key, &nonce, None), &[6u8; 32]);
+        let nonce = ChallengeNonce::from_bytes([5; 32]);
+        let params = register_signed(&key, &nonce, &origin(), None);
+        assert!(verify_register_request(&params, &nonce, &[origin()]).is_ok());
+
+        let replayed =
+            verify_register_request(&params, &ChallengeNonce::from_bytes([6; 32]), &[origin()])
+                .unwrap_err();
+        assert!(matches!(
+            replayed.data,
+            ErrorData::PermissionDenied {
+                reason: Some(PermissionReason::InvalidSignature)
+            }
+        ));
+
+        // A nonce relayed from another gateway was signed for that origin.
+        let elsewhere = canonical_origin("wss://other.example").unwrap();
+        let relayed = register_signed(&key, &nonce, &elsewhere, None);
         assert_eq!(
-            replayed.unwrap_err().code,
-            RegistrationRejectionCode::InvalidSignature
+            verify_register_request(&relayed, &nonce, &[origin()])
+                .unwrap_err()
+                .kind(),
+            ProtocolErrorKind::PermissionDenied
         );
-        let mut wrong_key = register(&key, &nonce, None);
-        wrong_key.daemon_public_key = encode_hex(daemon(2).verifying_key().as_bytes());
+        assert!(verify_register_request(&relayed, &nonce, &[origin(), elsewhere]).is_ok());
+
+        let mut wrong_key = params.clone();
+        wrong_key.daemon_public_key =
+            DaemonPublicKey::from_bytes(daemon(2).verifying_key().to_bytes());
         assert_eq!(
-            verify_register_request(&wrong_key, &nonce)
+            verify_register_request(&wrong_key, &nonce, &[origin()])
                 .unwrap_err()
-                .code,
-            RegistrationRejectionCode::InvalidSignature
+                .kind(),
+            ProtocolErrorKind::PermissionDenied
         );
-        let mut old = register(&key, &nonce, None);
-        old.protocol_version = 0;
+    }
+
+    fn register_value() -> serde_json::Value {
+        serde_json::to_value(register(&daemon(1), None)).unwrap()
+    }
+
+    #[test]
+    fn register_decoding_checks_the_version_first_and_refuses_out_of_bounds_facts() {
+        assert!(decode_register(&register_value()).is_ok());
+
+        // A future daemon with members this gateway does not know still
+        // learns the version it must speak.
+        let mut future = register_value();
+        future["protocolVersion"] = json!(ENVD_PROTOCOL_VERSION + 1);
+        future["newMember"] = json!(true);
+        let mismatch = decode_register(&future).unwrap_err();
         assert_eq!(
-            verify_register_request(&old, &nonce).unwrap_err().code,
-            RegistrationRejectionCode::UnsupportedProtocol
+            mismatch.data,
+            ErrorData::VersionMismatch {
+                expected: ENVD_PROTOCOL_VERSION,
+                received: ENVD_PROTOCOL_VERSION + 1,
+            }
         );
-        let mut reserved = register(&key, &nonce, None);
-        reserved
-            .metadata
-            .insert("lightspeed.x".to_owned(), "y".to_owned());
+
+        let mut poisoned = register_value();
+        poisoned["implementation"]["version"] = json!("x".repeat(300));
         assert_eq!(
-            verify_register_request(&reserved, &nonce).unwrap_err().code,
-            RegistrationRejectionCode::InvalidRequest
+            decode_register(&poisoned).unwrap_err().kind(),
+            ProtocolErrorKind::InvalidRequest
         );
+        let mut reserved = register_value();
+        reserved["metadata"] = json!({"lightspeed.x": "y"});
+        assert_eq!(
+            decode_register(&reserved).unwrap_err().kind(),
+            ProtocolErrorKind::InvalidRequest
+        );
+
+        // Hex that is not canonical, or not ASCII, never panics: it is an
+        // ordinary invalidParams before anything else runs.
+        for key in [
+            "AB".repeat(32),
+            format!("{}\u{e9}", "a".repeat(62)),
+            "+1".repeat(32),
+        ] {
+            let mut value = register_value();
+            value["daemonPublicKey"] = json!(key);
+            assert_eq!(
+                decode_register(&value).unwrap_err().kind(),
+                ProtocolErrorKind::InvalidParams
+            );
+        }
+        let mut data_url = register_value();
+        data_url["dataUrl"] = json!("wss://elsewhere.example/data");
+        assert_eq!(
+            decode_register(&data_url).unwrap_err().kind(),
+            ProtocolErrorKind::InvalidParams
+        );
+    }
+
+    #[test]
+    fn the_failure_limiter_keys_on_identities_and_hints_a_retry() {
+        let start = Instant::now();
+        let mut limiter = FailureLimiter::default();
+        let first = DaemonPublicKey::from_bytes([1; 32]);
+        let second = DaemonPublicKey::from_bytes([2; 32]);
+        for _ in 0..MAX_FAILURES_PER_WINDOW {
+            assert_eq!(limiter.retry_after(&first, start), None);
+            limiter.record(first, start);
+        }
+        let hint = limiter.retry_after(&first, start).expect("over the limit");
+        assert!(hint <= FAILURE_WINDOW && hint > Duration::ZERO);
+        assert_eq!(limiter.retry_after(&second, start), None);
+        assert_eq!(
+            limiter.retry_after(&first, start + FAILURE_WINDOW),
+            None,
+            "the window slides"
+        );
+
+        // Expired entries are pruned on the next insert.
+        limiter.record(second, start + FAILURE_WINDOW);
+        assert_eq!(limiter.len(), 1);
+    }
+
+    #[test]
+    fn the_failure_limiter_is_capped() {
+        let now = Instant::now();
+        let mut limiter = FailureLimiter::default();
+        for index in 0..=MAX_LIMITED_IDENTITIES {
+            let mut bytes = [0u8; 32];
+            bytes[..8].copy_from_slice(&(index as u64).to_le_bytes());
+            limiter.record(
+                DaemonPublicKey::from_bytes(bytes),
+                now + Duration::from_millis(index as u64),
+            );
+        }
+        assert_eq!(limiter.len(), MAX_LIMITED_IDENTITIES);
+        assert!(
+            !limiter
+                .identities
+                .contains_key(&DaemonPublicKey::from_bytes([0; 32])),
+            "the identity whose last failure is oldest is forgotten first"
+        );
+    }
+
+    #[test]
+    fn only_credential_refusals_count_against_an_identity() {
+        assert!(counts_as_failure(&unknown_registration_key()));
+        assert!(counts_as_failure(&unknown_daemon()));
+        assert!(counts_as_failure(&ProtocolError::expired("x")));
+        assert!(!counts_as_failure(&registration_unavailable()));
+        assert!(!counts_as_failure(&ProtocolError::busy(
+            Some(BusyReason::CapacityExhausted),
+            None,
+            "x"
+        )));
     }
 
     #[tokio::test(flavor = "current_thread")]
     async fn admission_creates_once_reconnects_by_identity_and_spends_closed_identities() {
         let (store, secret) = store_with_key("rk", policy(RegisteredIdentityMode::Ephemeral)).await;
         let key = daemon(3);
-        let nonce = [1u8; 32];
-        let unknown = admit_registration(&store, &register(&key, &nonce, None), 2_000)
+        let unknown = admit_registration(&store, &register(&key, None), 2_000)
             .await
             .unwrap_err();
-        assert_eq!(unknown.code, RegistrationRejectionCode::UnknownDaemon);
+        assert!(matches!(
+            unknown.data,
+            ErrorData::NotFound {
+                reason: Some(NotFoundReason::UnknownDaemon)
+            }
+        ));
 
-        let created = admit_registration(&store, &register(&key, &nonce, Some(&secret)), 2_000)
+        let created = admit_registration(&store, &register(&key, Some(&secret)), 2_000)
             .await
             .expect("created");
-        assert!(created.created);
+        assert_eq!(created.admission, Admission::Created);
         assert_eq!(created.environment.status, EnvironmentStatus::Ready);
+        let metadata = &created.environment.metadata;
         assert_eq!(
-            created
-                .environment
-                .metadata
-                .get("lightspeed.envd.version")
-                .map(String::as_str),
+            metadata.get("lightspeed.envd.version").map(String::as_str),
             Some("0.1.0")
         );
         assert_eq!(
-            created
-                .environment
-                .metadata
-                .get("lightspeed.envd.gitSha")
-                .map(String::as_str),
-            Some("1111111111111111111111111111111111111111")
+            metadata.get("lightspeed.envd.protocolVersion"),
+            Some(&ENVD_PROTOCOL_VERSION.to_string())
         );
+
+        let connection = ControlConnectionId::new("connection_1").unwrap();
+        let receipt =
+            registration_receipt(&created.environment, &connection, created.admission).unwrap();
+        assert_eq!(receipt.identity_mode, RegistrationIdentityMode::Ephemeral);
+        assert_eq!(receipt.admission, Admission::Created);
+        assert_eq!(receipt.control_connection_id, connection);
         assert_eq!(
-            created
-                .environment
-                .metadata
-                .get("lightspeed.envd.protocolVersion")
-                .map(String::as_str),
-            Some(CURRENT_PROTOCOL_VERSION.to_string().as_str())
+            receipt.environment_id.as_str(),
+            created.environment.environment_id.as_str()
         );
+        assert!(receipt.daemon_id.as_str().starts_with("daemon_"));
 
         // Reconnects ignore the key entirely, even a wrong one.
-        let reconnected =
-            admit_registration(&store, &register(&key, &nonce, Some("lsrk_wrong")), 3_000)
-                .await
-                .expect("reconnect");
-        assert!(!reconnected.created);
+        let reconnected = admit_registration(&store, &register(&key, Some("lsrk_wrong")), 3_000)
+            .await
+            .expect("reconnect");
+        assert_eq!(reconnected.admission, Admission::Reconnected);
         assert_eq!(
             reconnected.environment.environment_id,
             created.environment.environment_id
@@ -1026,10 +1717,15 @@ mod tests {
             })
             .await
             .expect("close");
-        let closing = admit_registration(&store, &register(&key, &nonce, Some(&secret)), 4_100)
+        let closing = admit_registration(&store, &register(&key, Some(&secret)), 4_100)
             .await
             .unwrap_err();
-        assert_eq!(closing.code, RegistrationRejectionCode::EnvironmentClosed);
+        assert!(matches!(
+            closing.data,
+            ErrorData::FailedPrecondition {
+                reason: PreconditionReason::EnvironmentClosed
+            }
+        ));
         store
             .finish_close_environment(FinishCloseEnvironment {
                 environment_id: created.environment.environment_id.clone(),
@@ -1037,15 +1733,15 @@ mod tests {
             })
             .await
             .expect("finish");
-        let closed = admit_registration(&store, &register(&key, &nonce, Some(&secret)), 4_300)
+        let closed = admit_registration(&store, &register(&key, Some(&secret)), 4_300)
             .await
             .unwrap_err();
-        assert_eq!(closed.code, RegistrationRejectionCode::EnvironmentClosed);
-        assert!(closed.code.is_terminal());
+        assert!(!closed.is_retryable());
+        assert_eq!(closed.kind(), ProtocolErrorKind::FailedPrecondition);
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn admission_maps_key_policy_refusals_to_typed_codes() {
+    async fn admission_maps_key_policy_refusals_to_typed_kinds() {
         let (store, secret) = store_with_key(
             "rk",
             RegistrationKeyPolicy {
@@ -1054,24 +1750,30 @@ mod tests {
             },
         )
         .await;
-        let nonce = [2u8; 32];
-        admit_registration(&store, &register(&daemon(4), &nonce, Some(&secret)), 2_000)
+        admit_registration(&store, &register(&daemon(4), Some(&secret)), 2_000)
             .await
             .expect("first");
-        let full = admit_registration(&store, &register(&daemon(5), &nonce, Some(&secret)), 2_100)
+        let full = admit_registration(&store, &register(&daemon(5), Some(&secret)), 2_100)
             .await
             .unwrap_err();
-        assert_eq!(full.code, RegistrationRejectionCode::CapacityExhausted);
-        assert!(!full.code.is_terminal());
+        assert!(matches!(
+            full.data,
+            ErrorData::Busy {
+                reason: Some(BusyReason::CapacityExhausted),
+                ..
+            }
+        ));
+        assert!(full.is_retryable());
 
-        let bad = admit_registration(
-            &store,
-            &register(&daemon(6), &nonce, Some("lsrk_nope")),
-            2_200,
-        )
-        .await
-        .unwrap_err();
-        assert_eq!(bad.code, RegistrationRejectionCode::InvalidRegistrationKey);
+        let bad = admit_registration(&store, &register(&daemon(6), Some("lsrk_nope")), 2_200)
+            .await
+            .unwrap_err();
+        assert!(matches!(
+            bad.data,
+            ErrorData::PermissionDenied {
+                reason: Some(PermissionReason::InvalidRegistrationKey)
+            }
+        ));
 
         store
             .revoke_registration_key(RevokeEnvironmentRegistrationKey {
@@ -1080,19 +1782,20 @@ mod tests {
             })
             .await
             .expect("revoke");
-        let revoked =
-            admit_registration(&store, &register(&daemon(7), &nonce, Some(&secret)), 3_100)
-                .await
-                .unwrap_err();
-        assert_eq!(
-            revoked.code,
-            RegistrationRejectionCode::RegistrationKeyRevoked
-        );
+        let revoked = admit_registration(&store, &register(&daemon(7), Some(&secret)), 3_100)
+            .await
+            .unwrap_err();
+        assert!(matches!(
+            revoked.data,
+            ErrorData::PermissionDenied {
+                reason: Some(PermissionReason::RegistrationKeyRevoked)
+            }
+        ));
         // The already registered daemon still reconnects after revocation.
-        let reconnect = admit_registration(&store, &register(&daemon(4), &nonce, None), 3_200)
+        let reconnect = admit_registration(&store, &register(&daemon(4), None), 3_200)
             .await
             .expect("reconnect");
-        assert!(!reconnect.created);
+        assert_eq!(reconnect.admission, Admission::Reconnected);
 
         let (expired_store, expired_secret) = store_with_key(
             "rk-exp",
@@ -1104,36 +1807,112 @@ mod tests {
         .await;
         let expired = admit_registration(
             &expired_store,
-            &register(&daemon(8), &nonce, Some(&expired_secret)),
+            &register(&daemon(8), Some(&expired_secret)),
             2_000,
         )
         .await
         .unwrap_err();
+        assert_eq!(expired.kind(), ProtocolErrorKind::Expired);
+    }
+
+    fn text(value: serde_json::Value) -> Message {
+        Message::Text(value.to_string().into())
+    }
+
+    #[test]
+    fn before_admission_only_register_is_served() {
+        let register = text(json!({
+            "jsonrpc": "2.0", "id": 1, "method": "registration/register", "params": {}
+        }));
+        assert!(matches!(
+            classify_pre_admission(&register),
+            PreAdmission::Register(_)
+        ));
+        let other = text(json!({"jsonrpc": "2.0", "id": 2, "method": "env/getIdle"}));
+        let PreAdmission::AnswerAndClose(response) = classify_pre_admission(&other) else {
+            panic!("a request other than register is refused and closes");
+        };
         assert_eq!(
-            expired.code,
-            RegistrationRejectionCode::RegistrationKeyExpired
+            response.result.unwrap_err().kind(),
+            ProtocolErrorKind::NotInitialized
         );
+        let goodbye = text(json!({
+            "jsonrpc": "2.0", "method": "registration/goodbye", "params": {"reason": "shutdown"}
+        }));
+        assert_eq!(classify_pre_admission(&goodbye), PreAdmission::Close);
+        let PreAdmission::Answer(response) =
+            classify_pre_admission(&Message::Text("not json".into()))
+        else {
+            panic!("a parse error is answered and the socket stays open");
+        };
+        assert_eq!(response.id, None);
+        assert_eq!(
+            response.result.unwrap_err().kind(),
+            ProtocolErrorKind::ParseError
+        );
+        assert!(matches!(
+            classify_pre_admission(&Message::Binary(vec![1_u8].into())),
+            PreAdmission::Answer(_)
+        ));
+        let stray = text(json!({"jsonrpc": "2.0", "id": "g9", "result": {}}));
+        assert_eq!(classify_pre_admission(&stray), PreAdmission::Ignore);
     }
 
     #[test]
-    fn data_url_is_the_public_websocket_base_plus_the_data_path() {
+    fn after_admission_stream_answers_and_goodbye_are_recognized() {
         assert_eq!(
-            data_url("https://lightspeed.example/"),
-            "wss://lightspeed.example/environment-gateway/data"
+            classify_admitted(&json!({"jsonrpc": "2.0", "id": "g1", "result": {}}).to_string()),
+            Admitted::StreamAnswer(Id::String("g1".to_owned()), Ok(()))
         );
+        let Admitted::StreamAnswer(_, Err(error)) = classify_admitted(
+            &jsonrpc::Response::failure(
+                Some(Id::String("g2".to_owned())),
+                ProtocolError::unavailable("dial failed"),
+            )
+            .to_text(),
+        ) else {
+            panic!("a failed dial is an error answer");
+        };
+        assert_eq!(error.kind(), ProtocolErrorKind::Unavailable);
         assert_eq!(
-            data_url("http://127.0.0.1:18080"),
-            "ws://127.0.0.1:18080/environment-gateway/data"
+            classify_admitted(
+                &json!({
+                    "jsonrpc": "2.0", "method": "registration/goodbye",
+                    "params": {"reason": "shutdown"}
+                })
+                .to_string()
+            ),
+            Admitted::Goodbye
+        );
+        let Admitted::Answer(again) = classify_admitted(
+            &json!({"jsonrpc": "2.0", "id": 1, "method": "registration/register"}).to_string(),
+        ) else {
+            panic!("a second register is answered");
+        };
+        assert_eq!(
+            again.result.unwrap_err().kind(),
+            ProtocolErrorKind::InvalidRequest
+        );
+        let Admitted::Answer(unknown) = classify_admitted(
+            &json!({"jsonrpc": "2.0", "id": 3, "method": "registration/unknown"}).to_string(),
+        ) else {
+            panic!("an unknown request is answered");
+        };
+        assert_eq!(
+            unknown.result.unwrap_err().kind(),
+            ProtocolErrorKind::MethodNotFound
         );
+        assert!(matches!(
+            classify_admitted(&json!({"jsonrpc": "2.0", "method": "x/y"}).to_string()),
+            Admitted::Ignore(_)
+        ));
     }
 
     #[test]
-    fn failure_accounting_rate_limits_a_subject() {
-        let registrations = RegisteredConnections::new();
-        for _ in 0..MAX_FAILURES_PER_WINDOW {
-            registrations.record_failure("key:abc");
-        }
-        assert!(registrations.over_failure_limit("key:abc"));
-        assert!(!registrations.over_failure_limit("key:other"));
+    fn the_liveness_deadline_is_three_heartbeats() {
+        assert_eq!(
+            LIVENESS_TIMEOUT,
+            HEARTBEAT_INTERVAL * HEARTBEAT_MISSED_INTERVALS
+        );
     }
 }
diff --git a/crates/temporal-runtime/src/gateway/request_context.rs b/crates/temporal-runtime/src/gateway/request_context.rs
index 4349766e8..cb6a0165d 100644
--- a/crates/temporal-runtime/src/gateway/request_context.rs
+++ b/crates/temporal-runtime/src/gateway/request_context.rs
@@ -121,7 +121,7 @@ pub fn initialize_response(caller: CallerAccess) -> api::AgentApiOutcome<api::In
             envd: EnvironmentDaemonInfo {
                 version: release_info::VERSION.to_owned(),
                 git_sha: release_info::GIT_SHA.to_owned(),
-                protocol_version: environment_protocol::shared::CURRENT_PROTOCOL_VERSION,
+                protocol_version: environment_protocol::ENVD_PROTOCOL_VERSION,
                 targets: release_info::envd_targets().map(str::to_owned).collect(),
             },
         },
diff --git a/crates/temporal-runtime/src/gateway/service/mod.rs b/crates/temporal-runtime/src/gateway/service/mod.rs
index 795596b23..2c7f0ccf5 100644
--- a/crates/temporal-runtime/src/gateway/service/mod.rs
+++ b/crates/temporal-runtime/src/gateway/service/mod.rs
@@ -182,8 +182,8 @@ fn env_flag(name: &str) -> bool {
 pub(super) fn validate_caller_metadata(
     metadata: &BTreeMap<String, String>,
 ) -> Result<(), AgentApiError> {
-    environment_protocol::registration::validate_registration_metadata(None, metadata)
-        .map_err(|message| AgentApiError::invalid_request(format!("invalid metadata: {message}")))
+    environment_protocol::metadata::validate_caller_metadata(metadata)
+        .map_err(|error| AgentApiError::invalid_request(format!("invalid metadata: {error}")))
 }
 
 fn validate_delete_after_close_ms(value: Option<u64>) -> Result<(), AgentApiError> {
@@ -830,7 +830,7 @@ impl GatewayAgentApi {
             github_api_client: None,
             model_discovery_openai: None,
             model_discovery_anthropic: None,
-            provider_controller_connector: Arc::new(WebSocketProviderControllerConnector::default()),
+            provider_controller_connector: Arc::new(WebSocketProviderControllerConnector),
             environment_gateway,
         }
     }
diff --git a/crates/temporal-runtime/src/gateway/service/session_jobs.rs b/crates/temporal-runtime/src/gateway/service/session_jobs.rs
index 06a74520d..31696a893 100644
--- a/crates/temporal-runtime/src/gateway/service/session_jobs.rs
+++ b/crates/temporal-runtime/src/gateway/service/session_jobs.rs
@@ -2,29 +2,40 @@ use super::*;
 
 use ::environments::{EnvironmentId, EnvironmentJobGroupId, EnvironmentRecord};
 use base64::{Engine as _, engine::general_purpose::STANDARD as BASE64_STANDARD};
-use environment_client::{EnvironmentClientError, EnvironmentDataClient, WebSocketConnectOptions};
+use environment_client::{ClientError, DataClient};
 use environment_protocol::{
     data::{
-        handshake::{
-            InitializeParams as DataInitializeParams, InitializedParams as DataInitializedParams,
+        exec::{
+            ExitStatus as ProtocolExitStatus, GapReason as ProtocolGapReason,
+            OutputChunk as ProtocolOutputChunk, OutputGap as ProtocolOutputGap,
+            OutputStream as ProtocolOutputStream, ReturnOn as ProtocolReturnOn,
+            StoppedBy as ProtocolStoppedBy,
         },
-        jobs::{
-            CancelJobsParams as ProtocolCancelJobsParams, JobArtifact as ProtocolJobArtifact,
-            JobCancelScope as ProtocolJobCancelScope, JobDependency as ProtocolJobDependency,
-            JobDependencyPolicy as ProtocolJobDependencyPolicy,
-            JobOutputChunk as ProtocolJobOutputChunk, JobOutputStream as ProtocolJobOutputStream,
-            JobReadResult as ProtocolJobReadResult, JobStartSpec as ProtocolJobStartSpec,
+        handshake::JobLimits,
+        job::{
+            CancelJobsParams as ProtocolCancelJobsParams, JobCancelScope as ProtocolJobCancelScope,
+            JobReadEntry as ProtocolJobReadEntry, JobReadRequest as ProtocolJobReadRequest,
             JobStatus as ProtocolJobStatus, JobSummary as ProtocolJobSummary,
-            ReadJobsParams as ProtocolReadJobsParams, StartJobsParams as ProtocolStartJobsParams,
+            JobSummaryEntry as ProtocolJobSummaryEntry, ReadJobsParams as ProtocolReadJobsParams,
         },
     },
-    error::EnvironmentProtocolErrorCode,
-    shared::{
-        ByteChunk, CURRENT_PROTOCOL_VERSION, EnvironmentCapabilities, EnvironmentDataConnection,
-        EnvironmentPath, EnvironmentTransport, JobId,
-    },
+    error::ProtocolErrorKind,
+    ids::{JobId, JobName, JobRequestId, QueueKey},
+    paths::EnvironmentPath,
+};
+use temporal_workflow::{
+    EnvironmentJobCommand, EnvironmentJobDependency, EnvironmentJobDependencyPolicy,
+    EnvironmentJobId, EnvironmentJobRecord, EnvironmentJobSpec, EnvironmentJobStartPayloadV1,
+    EnvironmentJobStatus,
 };
-use harness::validate_general_string_id;
+use tools::environment::jobs::DEFAULT_JOB_OUTPUT_BYTES;
+
+/// `User-Agent` of the job API's worker-route upgrades; `clientInfo` is
+/// always the runtime build.
+const JOB_API_USER_AGENT: &str = "lightspeed-temporal-runtime";
+
+/// Deadline of each data-plane call the job API makes.
+const JOB_API_REQUEST_TIMEOUT: Duration = Duration::from_secs(60);
 
 impl GatewayAgentApi {
     pub(super) async fn create_environment_job_records(
@@ -32,19 +43,16 @@ impl GatewayAgentApi {
         params: EnvironmentJobCreateParams,
     ) -> Result<EnvironmentJobCreateResponse, AgentApiError> {
         let environment_id = parse_environment_job_environment_id(params.environment_id)?;
-        self.start_environment_jobs(environment_id, params.request_id, params.jobs, None)
-            .await
-    }
-
-    async fn start_environment_jobs(
-        &self,
-        environment_id: EnvironmentId,
-        request_id: String,
-        jobs: Vec<SessionJobStartSpecInput>,
-        default_cwd: Option<EnvironmentPath>,
-    ) -> Result<EnvironmentJobCreateResponse, AgentApiError> {
-        let mut protocol_specs = Vec::with_capacity(jobs.len());
-        for (index, spec) in jobs.into_iter().enumerate() {
+        let request_id = JobRequestId::new(params.request_id).map_err(|error| {
+            AgentApiError::invalid_request(format!("invalid request_id: {error}"))
+        })?;
+        if params.jobs.is_empty() {
+            return Err(AgentApiError::invalid_request(
+                "environments/jobs/create requires at least one job",
+            ));
+        }
+        let mut specs = Vec::with_capacity(params.jobs.len());
+        for (index, spec) in params.jobs.into_iter().enumerate() {
             let job_id = spec
                 .job_id
                 .as_deref()
@@ -52,68 +60,42 @@ impl GatewayAgentApi {
                 .transpose()
                 .map_err(AgentApiError::invalid_request)?
                 .unwrap_or_else(|| derived_job_id(&environment_id, &request_id, index));
-            let mut spec =
-                api_start_spec_to_protocol(spec, job_id).map_err(AgentApiError::invalid_request)?;
-            if spec.cwd.is_none() {
-                spec.cwd = default_cwd.clone();
-            }
-            protocol_specs.push(spec);
+            specs.push(
+                api_start_spec_to_workflow(spec, job_id).map_err(AgentApiError::invalid_request)?,
+            );
         }
         let instance = self.read_job_instance(&environment_id).await?;
-        self.start_environment_jobs_protocol_specs(instance, request_id, protocol_specs)
+        // Refuse what the daemon would refuse before a workflow exists for
+        // it: a daemon without jobs, or more jobs than one start takes.
+        let client = self.connect_job_client(&instance).await?;
+        let limits = client.initialize_response().limits.job.clone();
+        let _ = client.close().await;
+        if specs.len() > limits.max_request_jobs as usize {
+            return Err(AgentApiError::invalid_request(format!(
+                "environments/jobs/create names {} jobs; the environment starts at most {} at once",
+                specs.len(),
+                limits.max_request_jobs
+            )));
+        }
+        self.start_environment_jobs(instance, request_id, specs)
             .await
     }
 
-    async fn start_environment_jobs_protocol_specs(
+    async fn start_environment_jobs(
         &self,
         instance: EnvironmentRecord,
-        request_id: String,
-        jobs: Vec<ProtocolJobStartSpec>,
+        request_id: JobRequestId,
+        jobs: Vec<EnvironmentJobSpec>,
     ) -> Result<EnvironmentJobCreateResponse, AgentApiError> {
-        validate_job_request_id(&request_id)?;
-        if jobs.is_empty() {
-            return Err(AgentApiError::invalid_request(
-                "environments/jobs/create requires at least one job",
-            ));
-        }
-        let key = self
-            .environment_gateway
-            .route_key(self.store.config().universe_id, &instance);
-        let connection = self.environment_gateway.connection(&key);
-        let (_client, capabilities) = connect_initialized_environment_data_client(
-            &connection,
-            self.environment_gateway
-                .connect_options("lightspeed-temporal-runtime"),
-        )
-        .await
-        .map_err(|error| AgentApiError::rejected(error.to_string()))?;
-        if !capabilities.job_start {
-            return Err(AgentApiError::rejected(format!(
-                "environment does not support durable job start: {}",
-                instance.environment_id
-            )));
-        }
-        let request = ProtocolStartJobsParams {
-            namespace: instance.environment_id.as_str().to_owned(),
-            request_id: request_id.clone(),
-            jobs,
-        };
-        let request_fingerprint =
-            BlobRef::from_bytes(&serde_json::to_vec(&request).map_err(|error| {
-                AgentApiError::internal(format!("encode environment job request: {error}"))
-            })?);
-        let job_group_id = derived_job_group_id(
-            &instance.environment_id,
-            &request_id,
-            request_fingerprint.as_str(),
-        );
-        let job_ids = request.jobs.iter().map(|job| job.job_id.clone()).collect();
-        let start_payload = temporal_workflow::EnvironmentJobStartPayload { request };
+        let payload = EnvironmentJobStartPayloadV1::new(request_id.into_string(), jobs);
+        let encoded = payload.encode().map_err(|error| {
+            AgentApiError::internal(format!("encode environment job workflow start: {error}"))
+        })?;
+        let job_group_id =
+            derived_job_group_id(&instance.environment_id, &BlobRef::from_bytes(&encoded));
         let request_ref = self
             .store
-            .put_bytes(serde_json::to_vec(&start_payload).map_err(|error| {
-                AgentApiError::internal(format!("encode environment job workflow start: {error}"))
-            })?)
+            .put_bytes(encoded)
             .await
             .map_err(map_blob_store_error)?;
         let snapshot = self
@@ -124,7 +106,7 @@ impl GatewayAgentApi {
                     job_group_id: job_group_id.as_str().to_owned(),
                     request_ref,
                 },
-                job_ids,
+                payload.job_ids(),
                 Vec::new(),
             )
             .await?;
@@ -134,22 +116,7 @@ impl GatewayAgentApi {
             jobs: snapshot
                 .jobs
                 .into_iter()
-                .map(|summary| SessionJobStartedView {
-                    name: summary.name,
-                    job_id: summary.job_id.as_str().to_owned(),
-                    handle: SessionJobHandleView {
-                        environment_id: instance.environment_id.as_str().to_owned(),
-                        job_id: summary.job_id.as_str().to_owned(),
-                    },
-                    promise_id: None,
-                    status: api_job_status(summary.status),
-                    dependencies: summary
-                        .dependencies
-                        .into_iter()
-                        .map(|id| id.as_str().to_owned())
-                        .collect(),
-                    queue_key: summary.queue_key,
-                })
+                .map(|record| api_started_job(&instance.environment_id, record))
                 .collect(),
         })
     }
@@ -157,7 +124,7 @@ impl GatewayAgentApi {
     async fn start_environment_job_workflow(
         &self,
         start: temporal_workflow::EnvironmentJobStartActivityRequest,
-        job_ids: Vec<JobId>,
+        job_ids: Vec<EnvironmentJobId>,
         subscriptions: Vec<temporal_workflow::EnvironmentJobSubscription>,
     ) -> Result<temporal_workflow::EnvironmentJobWorkflowSnapshot, AgentApiError> {
         let workflow_id = temporal_workflow::compose_environment_job_workflow_id(
@@ -230,158 +197,164 @@ impl GatewayAgentApi {
         &self,
         params: EnvironmentJobReadParams,
     ) -> Result<EnvironmentJobReadResponse, AgentApiError> {
-        let jobs = self
-            .read_jobs(
-                params.jobs,
-                params.output_bytes,
-                params.after_seq,
-                params.include_artifacts,
-            )
-            .await?;
-        Ok(EnvironmentJobReadResponse { jobs })
-    }
-
-    async fn read_jobs(
-        &self,
-        handles: Vec<SessionJobHandleInput>,
-        output_bytes: Option<usize>,
-        after_seq: Option<u64>,
-        include_artifacts: bool,
-    ) -> Result<Vec<SessionJobReadEntryView>, AgentApiError> {
-        let mut entries = Vec::with_capacity(handles.len());
-        for handle in handles {
-            let resolved = match parse_job_handle(handle) {
-                Ok(handle) => handle,
-                Err(error) => {
-                    entries.push(session_job_read_error(None, error));
-                    continue;
-                }
-            };
-            let environment_id = match EnvironmentId::try_new(resolved.environment_id.clone()) {
-                Ok(environment_id) => environment_id,
-                Err(error) => {
-                    entries.push(session_job_read_error(Some(resolved), error.to_string()));
-                    continue;
-                }
-            };
-            let job_id = match parse_protocol_job_id(&resolved.job_id) {
-                Ok(job_id) => job_id,
-                Err(error) => {
-                    entries.push(session_job_read_error(Some(resolved), error));
-                    continue;
-                }
-            };
-            let mut client = match self
-                .connect_client_for_job_handle(&environment_id, "read")
+        if params.after.is_some() && params.tail_bytes.is_some() {
+            return Err(AgentApiError::invalid_request(
+                "environments/jobs/read takes after or tailBytes, not both",
+            ));
+        }
+        let position = JobReadPosition {
+            after: params.after,
+            tail_bytes: params.tail_bytes,
+            max_bytes: params.max_bytes.unwrap_or(DEFAULT_JOB_OUTPUT_BYTES),
+        };
+        let mut entries: Vec<Option<SessionJobReadEntryView>> = vec![None; params.jobs.len()];
+        let mut groups: BTreeMap<EnvironmentId, Vec<(usize, SessionJobHandleView, JobId)>> =
+            BTreeMap::new();
+        for (index, handle) in params.jobs.into_iter().enumerate() {
+            match parse_job_handle(handle) {
+                Ok((environment_id, handle, job_id)) => groups
+                    .entry(environment_id)
+                    .or_default()
+                    .push((index, handle, job_id)),
+                Err(error) => entries[index] = Some(session_job_read_error(None, error)),
+            }
+        }
+        for (environment_id, jobs) in groups {
+            match self
+                .read_jobs_in_environment(&environment_id, &jobs, position)
                 .await
             {
-                Ok(client) => client,
+                Ok(read) => {
+                    for ((index, _, _), entry) in jobs.iter().zip(read) {
+                        entries[*index] = Some(entry);
+                    }
+                }
                 Err(error) => {
-                    entries.push(session_job_read_error(Some(resolved), error));
-                    continue;
+                    for (index, handle, _) in jobs {
+                        entries[index] = Some(session_job_read_error(Some(handle), error.clone()));
+                    }
+                }
+            }
+        }
+        Ok(EnvironmentJobReadResponse {
+            jobs: entries.into_iter().flatten().collect(),
+        })
+    }
+
+    /// One `job/read` entry per job, in order, within the daemon's ceilings.
+    async fn read_jobs_in_environment(
+        &self,
+        environment_id: &EnvironmentId,
+        jobs: &[(usize, SessionJobHandleView, JobId)],
+        position: JobReadPosition,
+    ) -> Result<Vec<SessionJobReadEntryView>, String> {
+        let instance = self
+            .read_job_instance(environment_id)
+            .await
+            .map_err(|error| error.message)?;
+        let client = self
+            .connect_job_client(&instance)
+            .await
+            .map_err(|error| error.message)?;
+        let limits = client.initialize_response().limits.job.clone();
+        let mut entries = Vec::with_capacity(jobs.len());
+        let mut result = Ok(());
+        for chunk in jobs.chunks((limits.max_request_jobs as usize).max(1)) {
+            let params =
+                job_read_params(chunk.iter().map(|(_, _, job_id)| job_id), position, &limits);
+            match client.read_jobs(&params).await {
+                Ok(response) => {
+                    for ((_, handle, _), entry) in chunk.iter().zip(response.jobs) {
+                        entries.push(session_job_read_entry(handle.clone(), entry));
+                    }
                 }
-            };
-            match client
-                .read_jobs(&ProtocolReadJobsParams {
-                    namespace: environment_id.as_str().to_owned(),
-                    jobs: vec![job_id],
-                    after_seq,
-                    max_bytes: output_bytes,
-                    include_artifacts,
-                    wait_ms: None,
-                })
-                .await
-            {
-                Ok(response) => entries.push(session_job_read_entry_from_response(
-                    resolved,
-                    response.jobs.into_iter().next(),
-                )),
                 Err(error) => {
-                    entries.push(session_job_read_error(Some(resolved), error.to_string()))
+                    result = Err(error.to_string());
+                    break;
                 }
             }
         }
-        Ok(entries)
+        let _ = client.close().await;
+        result.map(|()| entries)
     }
 
     pub(super) async fn cancel_environment_job_records(
         &self,
         params: EnvironmentJobCancelParams,
     ) -> Result<EnvironmentJobCancelResponse, AgentApiError> {
-        let jobs = self
-            .cancel_jobs(params.jobs, params.scope, params.force)
-            .await?;
-        Ok(EnvironmentJobCancelResponse { jobs })
-    }
-
-    async fn cancel_jobs(
-        &self,
-        handles: Vec<SessionJobHandleInput>,
-        scope: SessionJobCancelScopeView,
-        force: bool,
-    ) -> Result<Vec<SessionJobCancelEntryView>, AgentApiError> {
-        let mut entries = Vec::with_capacity(handles.len());
-        for handle in handles {
-            let resolved = match parse_job_handle(handle) {
-                Ok(handle) => handle,
-                Err(error) => {
-                    entries.push(session_job_cancel_error(None, error));
-                    continue;
-                }
-            };
-            let environment_id = match EnvironmentId::try_new(resolved.environment_id.clone()) {
-                Ok(environment_id) => environment_id,
-                Err(error) => {
-                    entries.push(session_job_cancel_error(Some(resolved), error.to_string()));
-                    continue;
-                }
-            };
-            let job_id = match parse_protocol_job_id(&resolved.job_id) {
-                Ok(job_id) => job_id,
-                Err(error) => {
-                    entries.push(session_job_cancel_error(Some(resolved), error));
-                    continue;
-                }
-            };
+        let scope = match params.scope {
+            SessionJobCancelScopeView::Job => ProtocolJobCancelScope::Job,
+            SessionJobCancelScopeView::Dependents => ProtocolJobCancelScope::Dependents,
+        };
+        let mut entries = Vec::with_capacity(params.jobs.len());
+        let mut groups: BTreeMap<EnvironmentId, Vec<(SessionJobHandleView, JobId)>> =
+            BTreeMap::new();
+        for handle in params.jobs {
+            match parse_job_handle(handle) {
+                Ok((environment_id, handle, job_id)) => groups
+                    .entry(environment_id)
+                    .or_default()
+                    .push((handle, job_id)),
+                Err(error) => entries.push(session_job_cancel_error(None, error)),
+            }
+        }
+        for (environment_id, jobs) in groups {
             match self
-                .cancel_job_on_provider(&environment_id, job_id, scope, force)
+                .cancel_jobs_in_environment(&environment_id, &jobs, scope, params.force)
                 .await
             {
-                Ok(summary) => entries.push(SessionJobCancelEntryView {
-                    handle: Some(resolved),
-                    summary: Some(api_job_summary(summary)),
-                    error: None,
-                }),
-                Err(error) => entries.push(session_job_cancel_error(Some(resolved), error)),
+                Ok(cancelled) => entries.extend(cancelled),
+                Err(error) => entries.extend(
+                    jobs.into_iter()
+                        .map(|(handle, _)| session_job_cancel_error(Some(handle), error.clone())),
+                ),
             }
         }
-        Ok(entries)
+        Ok(EnvironmentJobCancelResponse { jobs: entries })
     }
 
-    async fn cancel_job_on_provider(
+    /// The daemon's entries for the named jobs, then for the dependents a
+    /// `dependents` cancel reached.
+    async fn cancel_jobs_in_environment(
         &self,
         environment_id: &EnvironmentId,
-        job_id: JobId,
-        scope: SessionJobCancelScopeView,
+        jobs: &[(SessionJobHandleView, JobId)],
+        scope: ProtocolJobCancelScope,
         force: bool,
-    ) -> Result<ProtocolJobSummary, String> {
-        let mut client = self
-            .connect_client_for_job_handle(environment_id, "cancel")
-            .await?;
-        let response = client
-            .cancel_jobs(&ProtocolCancelJobsParams {
-                namespace: environment_id.as_str().to_owned(),
-                jobs: vec![job_id],
-                scope: protocol_cancel_scope(scope),
-                force,
-            })
+    ) -> Result<Vec<SessionJobCancelEntryView>, String> {
+        let instance = self
+            .read_job_instance(environment_id)
             .await
-            .map_err(|error| error.to_string())?;
-        response
-            .jobs
-            .into_iter()
-            .next()
-            .ok_or_else(|| "provider returned no job result".to_owned())
+            .map_err(|error| error.message)?;
+        let client = self
+            .connect_job_client(&instance)
+            .await
+            .map_err(|error| error.message)?;
+        let per_request =
+            (client.initialize_response().limits.job.max_request_jobs as usize).max(1);
+        let mut entries = Vec::new();
+        let mut result = Ok(());
+        for chunk in jobs.chunks(per_request) {
+            let params = ProtocolCancelJobsParams {
+                job_ids: chunk.iter().map(|(_, job_id)| job_id.clone()).collect(),
+                scope,
+                force,
+            };
+            match client.cancel_jobs(&params).await {
+                Ok(response) => entries.extend(
+                    response
+                        .jobs
+                        .into_iter()
+                        .map(|entry| session_job_cancel_entry(environment_id, entry)),
+                ),
+                Err(error) => {
+                    result = Err(error.to_string());
+                    break;
+                }
+            }
+        }
+        let _ = client.close().await;
+        result.map(|()| entries)
     }
 
     /// Resolve the environment through the shared status-aware resolver so
@@ -401,236 +374,269 @@ impl GatewayAgentApi {
             .map_err(super::environments::map_environment_resolve_error)
     }
 
-    async fn connect_client_for_job_handle(
+    /// An initialized data client for the environment; its daemon must
+    /// serve the `job` family.
+    async fn connect_job_client(
         &self,
-        environment_id: &EnvironmentId,
-        operation: &str,
-    ) -> Result<EnvironmentDataClient<environment_client::WebSocketTransport>, String> {
-        let instance = self
-            .read_job_instance(environment_id)
-            .await
-            .map_err(|error| error.to_string())?;
+        instance: &EnvironmentRecord,
+    ) -> Result<DataClient, AgentApiError> {
         let key = self
             .environment_gateway
-            .route_key(self.store.config().universe_id, &instance);
-        let connection = self.environment_gateway.connection(&key);
-        let (client, capabilities) = connect_initialized_environment_data_client(
-            &connection,
+            .route_key(self.store.config().universe_id, instance);
+        let (client, initialized) = DataClient::connect_initialized(
+            &self.environment_gateway.endpoint(&key),
             self.environment_gateway
-                .connect_options("lightspeed-temporal-runtime"),
+                .connect_options(JOB_API_USER_AGENT)
+                .with_request_timeout(JOB_API_REQUEST_TIMEOUT),
         )
         .await
-        .map_err(|error| error.to_string())?;
-        let supported = match operation {
-            "read" => capabilities.job_read,
-            "cancel" => capabilities.job_cancel,
-            _ => true,
-        };
-        if !supported {
-            return Err(format!(
-                "environment does not support durable job {operation}: {}",
-                environment_id
-            ));
+        .map_err(map_environment_client_api_error)?;
+        if initialized.capabilities.job.is_none() {
+            let _ = client.close().await;
+            return Err(AgentApiError::rejected(format!(
+                "environment does not serve durable jobs: {}",
+                instance.environment_id
+            )));
         }
         Ok(client)
     }
 }
 
+/// Where each job of an API read starts and how much it shows.
+#[derive(Clone, Copy, Debug)]
+struct JobReadPosition {
+    after: Option<u64>,
+    tail_bytes: Option<u64>,
+    /// Per job; never more than the daemon's read ceiling allows.
+    max_bytes: u64,
+}
+
+/// One `job/read` for `jobs` at `position`, waiting for nothing. The
+/// per-job budget shrinks so the total stays within `maxReadBytes`.
+fn job_read_params<'a>(
+    jobs: impl ExactSizeIterator<Item = &'a JobId>,
+    position: JobReadPosition,
+    limits: &JobLimits,
+) -> ProtocolReadJobsParams {
+    let count = jobs.len().max(1) as u64;
+    let per_job = position.max_bytes.min(limits.max_read_bytes / count);
+    ProtocolReadJobsParams {
+        jobs: jobs
+            .map(|job_id| ProtocolJobReadRequest {
+                job_id: job_id.clone(),
+                after: position.after,
+                tail_bytes: position.tail_bytes,
+                max_bytes: Some(per_job),
+            })
+            .collect(),
+        max_bytes: per_job * count,
+        wait_ms: 0,
+        return_on: ProtocolReturnOn::AnyOutput,
+    }
+}
+
 fn parse_environment_job_environment_id(value: String) -> Result<EnvironmentId, AgentApiError> {
     EnvironmentId::try_new(value).map_err(|error| {
         AgentApiError::invalid_request(format!("invalid environment instance id: {error}"))
     })
 }
 
-fn validate_job_request_id(value: &str) -> Result<(), AgentApiError> {
-    validate_general_string_id("job request_id", value)
-        .map_err(|error| AgentApiError::invalid_request(format!("invalid request_id: {error}")))
-}
-
 fn parse_protocol_job_id(value: &str) -> Result<JobId, String> {
-    validate_general_string_id("job_id", value)
-        .map_err(|error| format!("invalid job_id: {error}"))?;
-    Ok(JobId::new(value.to_owned()))
+    JobId::new(value).map_err(|error| format!("invalid job_id: {error}"))
 }
 
-fn parse_job_handle(handle: SessionJobHandleInput) -> Result<SessionJobHandleView, String> {
+fn parse_job_handle(
+    handle: SessionJobHandleInput,
+) -> Result<(EnvironmentId, SessionJobHandleView, JobId), String> {
     let environment_id = EnvironmentId::try_new(handle.environment_id)
         .map_err(|error| format!("invalid job handle environment_id: {error}"))?;
     let job_id = parse_protocol_job_id(&handle.job_id)?;
-    Ok(SessionJobHandleView {
+    let view = SessionJobHandleView {
         environment_id: environment_id.as_str().to_owned(),
         job_id: job_id.as_str().to_owned(),
-    })
+    };
+    Ok((environment_id, view, job_id))
 }
 
-fn api_start_spec_to_protocol(
+/// The job workflow's record of an API job spec, validated against the
+/// wire grammar so the start activity cannot refuse it later.
+fn api_start_spec_to_workflow(
     spec: SessionJobStartSpecInput,
     job_id: JobId,
-) -> Result<ProtocolJobStartSpec, String> {
+) -> Result<EnvironmentJobSpec, String> {
     if spec.argv.is_empty() {
         return Err("job argv must not be empty".to_owned());
     }
-    Ok(ProtocolJobStartSpec {
-        job_id,
-        name: spec.name,
-        argv: spec.argv,
-        cwd: spec
-            .cwd
-            .as_deref()
-            .map(EnvironmentPath::new)
-            .transpose()
-            .map_err(|error| format!("invalid job cwd: {error}"))?,
-        env: spec.env,
-        secret_env: BTreeMap::new(),
-        stdin: spec.stdin.map(|stdin| ByteChunk::from(stdin.into_bytes())),
-        timeout_ms: spec.timeout_ms,
+    let name = spec
+        .name
+        .map(|name| {
+            JobName::new(name)
+                .map(JobName::into_string)
+                .map_err(|error| format!("invalid job name: {error}"))
+        })
+        .transpose()?;
+    let cwd = spec
+        .cwd
+        .map(|cwd| {
+            EnvironmentPath::new(cwd)
+                .map(|cwd| cwd.as_str().to_owned())
+                .map_err(|error| format!("invalid job cwd: {error}"))
+        })
+        .transpose()?;
+    let queue_key = spec
+        .queue_key
+        .map(|key| {
+            QueueKey::new(key)
+                .map(QueueKey::into_string)
+                .map_err(|error| format!("invalid job queue_key: {error}"))
+        })
+        .transpose()?;
+    Ok(EnvironmentJobSpec {
+        job_id: EnvironmentJobId::new(job_id.into_string()),
+        name,
+        command: EnvironmentJobCommand {
+            argv: spec.argv,
+            cwd,
+            env: spec.env,
+            stdin: spec.stdin,
+            timeout_ms: spec.timeout_ms,
+        },
         depends_on: spec
             .depends_on
             .into_iter()
-            .map(api_dependency_to_protocol)
+            .map(api_dependency_to_workflow)
             .collect::<Result<Vec<_>, _>>()?,
         dependency_policy: match spec.dependency_policy {
             SessionJobDependencyPolicyView::AllSucceeded => {
-                ProtocolJobDependencyPolicy::AllSucceeded
+                EnvironmentJobDependencyPolicy::AllSucceeded
+            }
+            SessionJobDependencyPolicyView::AllTerminal => {
+                EnvironmentJobDependencyPolicy::AllTerminal
             }
-            SessionJobDependencyPolicyView::AllTerminal => ProtocolJobDependencyPolicy::AllTerminal,
         },
-        queue_key: spec.queue_key,
+        queue_key,
     })
 }
 
-fn api_dependency_to_protocol(
+fn api_dependency_to_workflow(
     dependency: SessionJobDependencyInput,
-) -> Result<ProtocolJobDependency, String> {
+) -> Result<EnvironmentJobDependency, String> {
     match (dependency.job_id, dependency.name) {
-        (Some(job_id), None) => Ok(ProtocolJobDependency {
-            job_id: Some(parse_protocol_job_id(&job_id)?),
-            name: None,
+        (Some(job_id), None) => Ok(EnvironmentJobDependency::JobId {
+            job_id: EnvironmentJobId::new(parse_protocol_job_id(&job_id)?.into_string()),
         }),
-        (None, Some(name)) if !name.is_empty() => Ok(ProtocolJobDependency {
-            job_id: None,
-            name: Some(name),
+        (None, Some(name)) => Ok(EnvironmentJobDependency::Name {
+            name: JobName::new(name)
+                .map_err(|error| format!("invalid job dependency name: {error}"))?
+                .into_string(),
         }),
         (Some(_), Some(_)) => {
             Err("job dependency must specify job_id or name, not both".to_owned())
         }
-        _ => Err("job dependency must specify job_id or name".to_owned()),
+        (None, None) => Err("job dependency must specify job_id or name".to_owned()),
     }
 }
 
-fn protocol_cancel_scope(scope: SessionJobCancelScopeView) -> ProtocolJobCancelScope {
-    match scope {
-        SessionJobCancelScopeView::Job => ProtocolJobCancelScope::Job,
-        SessionJobCancelScopeView::Dependents => ProtocolJobCancelScope::Dependents,
-    }
-}
-
-fn derived_job_id(environment_id: &EnvironmentId, request_id: &str, index: usize) -> JobId {
+fn derived_job_id(
+    environment_id: &EnvironmentId,
+    request_id: &JobRequestId,
+    index: usize,
+) -> JobId {
     let hash = BlobRef::from_bytes(format!("{environment_id}:{request_id}:{index}").as_bytes());
-    JobId::new(format!("job-{}", &hash.as_str()[7..31]))
+    JobId::new(format!("job-{}", &hash.as_str()[7..31])).expect("hex job id fits the id grammar")
 }
 
+/// A group is named by its environment and the content address of its
+/// encoded start payload, which is also the payload's CAS `request_ref`.
 fn derived_job_group_id(
     environment_id: &EnvironmentId,
-    request_id: &str,
-    request_fingerprint: &str,
+    payload_ref: &BlobRef,
 ) -> EnvironmentJobGroupId {
-    let hash = BlobRef::from_bytes(
-        format!("{environment_id}:{request_id}:{request_fingerprint}").as_bytes(),
-    );
+    let hash = BlobRef::from_bytes(format!("{environment_id}:{payload_ref}").as_bytes());
     EnvironmentJobGroupId::new(format!("ejg_{}", &hash.as_str()[7..31]))
 }
 
-async fn connect_initialized_environment_data_client(
-    connection: &EnvironmentDataConnection,
-    options: WebSocketConnectOptions,
-) -> Result<
-    (
-        EnvironmentDataClient<environment_client::WebSocketTransport>,
-        EnvironmentCapabilities,
-    ),
-    AgentApiError,
-> {
-    let mut client = connect_environment_data_client(connection, options).await?;
-    let response = client
-        .initialize(&DataInitializeParams {
-            protocol_version: CURRENT_PROTOCOL_VERSION,
-            client_name: "lightspeed-temporal-runtime".to_owned(),
-            scope: connection.scope.clone(),
-            resume_connection_id: None,
-        })
-        .await
-        .map_err(map_environment_client_api_error)?;
-    if response.protocol_version != CURRENT_PROTOCOL_VERSION {
-        return Err(AgentApiError::internal(format!(
-            "unsupported environment data protocol version {}; expected {CURRENT_PROTOCOL_VERSION}",
-            response.protocol_version
-        )));
+fn map_environment_client_api_error(error: ClientError) -> AgentApiError {
+    let message = error.to_string();
+    match error.protocol_kind() {
+        Some(ProtocolErrorKind::InvalidParams | ProtocolErrorKind::InvalidRequest) => {
+            AgentApiError::invalid_request(message)
+        }
+        Some(ProtocolErrorKind::NotFound) => AgentApiError::not_found(message),
+        Some(ProtocolErrorKind::AlreadyExists) => AgentApiError::conflict(message),
+        Some(
+            ProtocolErrorKind::FailedPrecondition
+            | ProtocolErrorKind::CapabilityUnavailable
+            | ProtocolErrorKind::PermissionDenied
+            | ProtocolErrorKind::VersionMismatch,
+        ) => AgentApiError::rejected(message),
+        _ => match error {
+            ClientError::WrongPlane { .. } | ClientError::Configuration { .. } => {
+                AgentApiError::rejected(message)
+            }
+            _ => AgentApiError::internal(message),
+        },
     }
-    let capabilities = response.capabilities;
-    client
-        .initialized(&DataInitializedParams {})
-        .await
-        .map_err(map_environment_client_api_error)?;
-    Ok((client, capabilities))
 }
 
-pub(crate) async fn connect_environment_data_client(
-    connection: &EnvironmentDataConnection,
-    options: WebSocketConnectOptions,
-) -> Result<EnvironmentDataClient<environment_client::WebSocketTransport>, AgentApiError> {
-    match &connection.transport {
-        EnvironmentTransport::WebSocket => {
-            EnvironmentDataClient::connect(&connection.endpoint, options)
-                .await
-                .map_err(map_environment_client_api_error)
-        }
-        other => Err(AgentApiError::rejected(format!(
-            "unsupported environment data transport for environment jobs: {other:?}"
-        ))),
+/// The started view of a job the workflow recorded. A job the daemon no
+/// longer knows (`lost`) is reported as failed: the API has no such status.
+fn api_started_job(
+    environment_id: &EnvironmentId,
+    record: EnvironmentJobRecord,
+) -> SessionJobStartedView {
+    SessionJobStartedView {
+        name: record.name,
+        job_id: record.job_id.as_str().to_owned(),
+        handle: SessionJobHandleView {
+            environment_id: environment_id.as_str().to_owned(),
+            job_id: record.job_id.as_str().to_owned(),
+        },
+        promise_id: None,
+        status: api_record_status(record.status),
+        dependencies: record
+            .depends_on
+            .into_iter()
+            .map(EnvironmentJobId::into_string)
+            .collect(),
+        queue_key: record.queue_key,
     }
 }
 
-fn map_environment_client_api_error(error: EnvironmentClientError) -> AgentApiError {
-    match error {
-        EnvironmentClientError::Protocol(error) => match error.code {
-            EnvironmentProtocolErrorCode::InvalidRequest => {
-                AgentApiError::invalid_request(error.message)
-            }
-            EnvironmentProtocolErrorCode::NotFound => AgentApiError::not_found(error.message),
-            EnvironmentProtocolErrorCode::Conflict
-            | EnvironmentProtocolErrorCode::Unsupported
-            | EnvironmentProtocolErrorCode::CapabilityUnavailable => {
-                AgentApiError::rejected(error.message)
-            }
-            _ => AgentApiError::internal(error.message),
-        },
-        other => AgentApiError::internal(other.to_string()),
+fn api_record_status(status: EnvironmentJobStatus) -> SessionJobStatusView {
+    match status {
+        EnvironmentJobStatus::Queued => SessionJobStatusView::Queued,
+        EnvironmentJobStatus::Running => SessionJobStatusView::Running,
+        EnvironmentJobStatus::Succeeded => SessionJobStatusView::Succeeded,
+        EnvironmentJobStatus::Failed | EnvironmentJobStatus::Lost => SessionJobStatusView::Failed,
+        EnvironmentJobStatus::TimedOut => SessionJobStatusView::TimedOut,
+        EnvironmentJobStatus::Cancelled => SessionJobStatusView::Cancelled,
+        EnvironmentJobStatus::DependencyFailed => SessionJobStatusView::DependencyFailed,
+        EnvironmentJobStatus::Interrupted => SessionJobStatusView::Interrupted,
     }
 }
 
-fn session_job_read_entry_from_response(
+fn session_job_read_entry(
     handle: SessionJobHandleView,
-    response: Option<ProtocolJobReadResult>,
+    entry: ProtocolJobReadEntry,
 ) -> SessionJobReadEntryView {
-    match response {
-        Some(response) => SessionJobReadEntryView {
+    match entry {
+        ProtocolJobReadEntry::Job { summary, output } => SessionJobReadEntryView {
             handle: Some(handle),
-            summary: Some(api_job_summary(response.summary)),
-            output_chunks: response
-                .output_chunks
+            summary: Some(api_job_summary(*summary)),
+            output_chunks: output
+                .chunks
                 .into_iter()
                 .map(api_job_output_chunk)
                 .collect(),
-            output_next_seq: response.output_next_seq,
-            artifacts: response
-                .artifacts
-                .into_iter()
-                .map(api_job_artifact)
-                .collect(),
+            output_next: output.next,
+            output_end: output.end,
+            output_gaps: output.gaps.into_iter().map(api_job_output_gap).collect(),
             error: None,
         },
-        None => session_job_read_error(Some(handle), "provider returned no job result".to_owned()),
+        ProtocolJobReadEntry::Error { error, .. } => {
+            session_job_read_error(Some(handle), error.to_string())
+        }
     }
 }
 
@@ -642,12 +648,33 @@ fn session_job_read_error(
         handle,
         summary: None,
         output_chunks: Vec::new(),
-        output_next_seq: 0,
-        artifacts: Vec::new(),
+        output_next: 0,
+        output_end: 0,
+        output_gaps: Vec::new(),
         error: Some(error),
     }
 }
 
+fn session_job_cancel_entry(
+    environment_id: &EnvironmentId,
+    entry: ProtocolJobSummaryEntry,
+) -> SessionJobCancelEntryView {
+    let handle = |job_id: &JobId| SessionJobHandleView {
+        environment_id: environment_id.as_str().to_owned(),
+        job_id: job_id.as_str().to_owned(),
+    };
+    match entry {
+        ProtocolJobSummaryEntry::Job { summary } => SessionJobCancelEntryView {
+            handle: Some(handle(&summary.job_id)),
+            summary: Some(api_job_summary(*summary)),
+            error: None,
+        },
+        ProtocolJobSummaryEntry::Error { job_id, error } => {
+            session_job_cancel_error(Some(handle(&job_id)), error.to_string())
+        }
+    }
+}
+
 fn session_job_cancel_error(
     handle: Option<SessionJobHandleView>,
     error: String,
@@ -661,57 +688,254 @@ fn session_job_cancel_error(
 
 fn api_job_summary(summary: ProtocolJobSummary) -> SessionJobSummaryView {
     SessionJobSummaryView {
-        namespace: summary.namespace,
-        job_id: summary.job_id.as_str().to_owned(),
-        name: summary.name,
+        job_id: summary.job_id.into_string(),
+        request_id: summary.request_id.into_string(),
+        name: summary.name.map(JobName::into_string),
         status: api_job_status(summary.status),
         dependencies: summary
-            .dependencies
+            .depends_on
             .into_iter()
-            .map(|id| id.as_str().to_owned())
+            .map(JobId::into_string)
             .collect(),
         created_at_ms: summary.created_at_ms,
         queued_at_ms: summary.queued_at_ms,
         started_at_ms: summary.started_at_ms,
         finished_at_ms: summary.finished_at_ms,
-        exit_code: summary.exit_code,
-        orphaned_descendants: summary.orphaned_descendants,
-        failure: summary.failure,
-        queue_key: summary.queue_key,
+        cancel_requested_at_ms: summary.cancel_requested_at_ms,
+        duration_ms: summary.duration_ms,
+        exit: summary.exit.map(|exit| match exit {
+            ProtocolExitStatus::Code { code } => SessionJobExitView::Code { code },
+            ProtocolExitStatus::Signal {
+                signal,
+                core_dumped,
+            } => SessionJobExitView::Signal {
+                signal: signal.as_str().to_owned(),
+                core_dumped,
+            },
+        }),
+        stopped_by: summary.stopped_by.map(|stopped_by| match stopped_by {
+            ProtocolStoppedBy::Timeout => SessionJobStoppedByView::Timeout,
+            ProtocolStoppedBy::Terminate => SessionJobStoppedByView::Terminate,
+            ProtocolStoppedBy::Kill => SessionJobStoppedByView::Kill,
+        }),
+        orphaned_descendants: summary.leftovers.is_some(),
+        failure: summary.error.map(|error| error.to_string()),
+        queue_key: summary.queue_key.map(QueueKey::into_string),
     }
 }
 
 fn api_job_status(status: ProtocolJobStatus) -> SessionJobStatusView {
     match status {
-        ProtocolJobStatus::Accepted => SessionJobStatusView::Accepted,
         ProtocolJobStatus::Queued => SessionJobStatusView::Queued,
         ProtocolJobStatus::Running => SessionJobStatusView::Running,
         ProtocolJobStatus::Succeeded => SessionJobStatusView::Succeeded,
         ProtocolJobStatus::Failed => SessionJobStatusView::Failed,
-        ProtocolJobStatus::CancelRequested => SessionJobStatusView::CancelRequested,
-        ProtocolJobStatus::Cancelled => SessionJobStatusView::Cancelled,
         ProtocolJobStatus::TimedOut => SessionJobStatusView::TimedOut,
+        ProtocolJobStatus::Cancelled => SessionJobStatusView::Cancelled,
         ProtocolJobStatus::DependencyFailed => SessionJobStatusView::DependencyFailed,
         ProtocolJobStatus::Interrupted => SessionJobStatusView::Interrupted,
-        ProtocolJobStatus::Lost => SessionJobStatusView::Lost,
     }
 }
 
-fn api_job_output_chunk(chunk: ProtocolJobOutputChunk) -> SessionJobOutputChunkView {
+fn api_job_output_chunk(chunk: ProtocolOutputChunk) -> SessionJobOutputChunkView {
     SessionJobOutputChunkView {
-        seq: chunk.seq,
+        offset: chunk.offset,
         stream: match chunk.stream {
-            ProtocolJobOutputStream::Stdout => SessionJobOutputStreamView::Stdout,
-            ProtocolJobOutputStream::Stderr => SessionJobOutputStreamView::Stderr,
+            // Jobs never run on a PTY; a merged stream reads as stdout.
+            ProtocolOutputStream::Stdout | ProtocolOutputStream::Pty => {
+                SessionJobOutputStreamView::Stdout
+            }
+            ProtocolOutputStream::Stderr => SessionJobOutputStreamView::Stderr,
         },
-        data_base64: BASE64_STANDARD.encode(chunk.chunk.into_inner()),
+        data_base64: BASE64_STANDARD.encode(chunk.data.as_slice()),
     }
 }
 
-fn api_job_artifact(artifact: ProtocolJobArtifact) -> SessionJobArtifactView {
-    SessionJobArtifactView {
-        path: artifact.path.as_str().to_owned(),
-        kind: artifact.kind,
-        metadata: artifact.metadata,
+fn api_job_output_gap(gap: ProtocolOutputGap) -> SessionJobOutputGapView {
+    SessionJobOutputGapView {
+        offset: gap.offset,
+        omitted_bytes: gap.omitted_bytes,
+        reason: match gap.reason {
+            ProtocolGapReason::Overflow => SessionJobOutputGapReasonView::Overflow,
+            ProtocolGapReason::Expired => SessionJobOutputGapReasonView::Expired,
+        },
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use environment_protocol::{bytes::ByteChunk, data::exec::OutputPage, error::ProtocolError};
+
+    use super::*;
+
+    fn limits(max_read_bytes: u64) -> JobLimits {
+        JobLimits {
+            max_read_bytes,
+            max_request_jobs: 64,
+            max_retained_output_bytes: 2 * 1024 * 1024,
+            record_retention_ms: 1,
+            cancel_grace_ms: 1,
+        }
+    }
+
+    fn job_id(value: &str) -> JobId {
+        JobId::new(value).unwrap()
+    }
+
+    #[test]
+    fn reads_split_the_daemon_ceiling_across_jobs() {
+        let jobs = [job_id("a"), job_id("b")];
+        let params = job_read_params(
+            jobs.iter(),
+            JobReadPosition {
+                after: None,
+                tail_bytes: Some(100),
+                max_bytes: 1_000,
+            },
+            &limits(600),
+        );
+        assert_eq!(params.max_bytes, 600);
+        assert_eq!(params.wait_ms, 0);
+        for (entry, expected) in params.jobs.iter().zip(&jobs) {
+            assert_eq!(&entry.job_id, expected);
+            assert_eq!(entry.tail_bytes, Some(100));
+            assert_eq!(entry.after, None);
+            assert_eq!(entry.max_bytes, Some(300));
+        }
+    }
+
+    #[test]
+    fn api_specs_are_validated_against_the_wire_grammar() {
+        let spec = |name: Option<&str>, cwd: Option<&str>| SessionJobStartSpecInput {
+            name: name.map(str::to_owned),
+            job_id: None,
+            argv: vec!["make".to_owned()],
+            cwd: cwd.map(str::to_owned),
+            env: BTreeMap::new(),
+            stdin: Some("input".to_owned()),
+            timeout_ms: None,
+            depends_on: vec![SessionJobDependencyInput {
+                job_id: None,
+                name: Some("lint".to_owned()),
+            }],
+            dependency_policy: SessionJobDependencyPolicyView::AllTerminal,
+            queue_key: Some("ci".to_owned()),
+        };
+        let stored =
+            api_start_spec_to_workflow(spec(Some("build"), Some("/workspace")), job_id("build"))
+                .unwrap();
+        assert_eq!(stored.command.cwd.as_deref(), Some("/workspace"));
+        assert_eq!(stored.command.stdin.as_deref(), Some("input"));
+        assert_eq!(
+            stored.depends_on,
+            vec![EnvironmentJobDependency::Name {
+                name: "lint".to_owned()
+            }]
+        );
+        assert!(api_start_spec_to_workflow(spec(None, Some("relative")), job_id("x")).is_err());
+        assert!(api_start_spec_to_workflow(spec(Some("a\tb"), None), job_id("x")).is_err());
+        assert!(parse_protocol_job_id("not a job id").is_err());
+    }
+
+    #[test]
+    fn read_entries_carry_byte_positions_and_entry_errors() {
+        let summary: ProtocolJobSummary = serde_json::from_value(serde_json::json!({
+            "jobId": "build",
+            "requestId": "req-1",
+            "status": "failed",
+            "createdAtMs": 1,
+            "exit": {"kind": "signal", "signal": "SIGSEGV", "coreDumped": true},
+            "stoppedBy": "kill",
+        }))
+        .unwrap();
+        let handle = SessionJobHandleView {
+            environment_id: "environment_1".to_owned(),
+            job_id: "build".to_owned(),
+        };
+        let entry = session_job_read_entry(
+            handle.clone(),
+            ProtocolJobReadEntry::Job {
+                summary: Box::new(summary),
+                output: OutputPage {
+                    chunks: vec![ProtocolOutputChunk {
+                        offset: 10,
+                        stream: ProtocolOutputStream::Stderr,
+                        data: ByteChunk::from(b"boom".to_vec()),
+                    }],
+                    next: 14,
+                    end: 40,
+                    gaps: vec![ProtocolOutputGap {
+                        offset: 4,
+                        omitted_bytes: 6,
+                        reason: ProtocolGapReason::Overflow,
+                    }],
+                },
+            },
+        );
+        assert_eq!((entry.output_next, entry.output_end), (14, 40));
+        assert_eq!(entry.output_chunks[0].offset, 10);
+        assert_eq!(
+            entry.output_chunks[0].stream,
+            SessionJobOutputStreamView::Stderr
+        );
+        assert_eq!(entry.output_gaps[0].omitted_bytes, 6);
+        let summary = entry.summary.unwrap();
+        assert_eq!(summary.request_id, "req-1");
+        assert_eq!(
+            summary.exit,
+            Some(SessionJobExitView::Signal {
+                signal: "SIGSEGV".to_owned(),
+                core_dumped: true
+            })
+        );
+        assert_eq!(summary.stopped_by, Some(SessionJobStoppedByView::Kill));
+
+        let missing = session_job_read_entry(
+            handle,
+            ProtocolJobReadEntry::Error {
+                job_id: job_id("build"),
+                error: ProtocolError::not_found("unknown job"),
+            },
+        );
+        assert!(missing.summary.is_none());
+        assert!(missing.error.is_some());
+    }
+
+    #[test]
+    fn lost_jobs_are_reported_as_failed() {
+        assert_eq!(
+            api_record_status(EnvironmentJobStatus::Lost),
+            SessionJobStatusView::Failed
+        );
+        assert_eq!(
+            api_record_status(EnvironmentJobStatus::Queued),
+            SessionJobStatusView::Queued
+        );
+    }
+
+    #[test]
+    fn client_refusals_keep_their_api_kind() {
+        let kind = |error: ProtocolError| {
+            map_environment_client_api_error(ClientError::Protocol(error)).kind
+        };
+        assert_eq!(
+            kind(ProtocolError::invalid_params("bad")),
+            AgentApiErrorKind::InvalidRequest
+        );
+        assert_eq!(
+            kind(ProtocolError::not_found("gone")),
+            AgentApiErrorKind::NotFound
+        );
+        assert_eq!(
+            kind(ProtocolError::failed_precondition(
+                environment_protocol::error::PreconditionReason::JobIdInUse,
+                "in use"
+            )),
+            AgentApiErrorKind::Rejected
+        );
+        assert_eq!(
+            map_environment_client_api_error(ClientError::DeadlineExceeded { elapsed_ms: 1 }).kind,
+            AgentApiErrorKind::Internal
+        );
     }
 }
diff --git a/crates/temporal-runtime/src/gateway/service/tests.rs b/crates/temporal-runtime/src/gateway/service/tests.rs
index b872f5af7..d7708431a 100644
--- a/crates/temporal-runtime/src/gateway/service/tests.rs
+++ b/crates/temporal-runtime/src/gateway/service/tests.rs
@@ -2531,6 +2531,7 @@ async fn skill_list_reads_latest_structured_provenance() {
     environment.availability = EnvironmentSkillAvailability::Stale;
     environment.warnings = vec!["scan incomplete".into()];
     environment.skills.push(EnvironmentSkill {
+        root: "/skills/system".into(),
         skill_id: tools::skills::SkillId::new("environment:review"),
         name: "current".into(),
         description: "same named skill".into(),
diff --git a/crates/temporal-runtime/src/main.rs b/crates/temporal-runtime/src/main.rs
index 3250492d4..8723f02cd 100644
--- a/crates/temporal-runtime/src/main.rs
+++ b/crates/temporal-runtime/src/main.rs
@@ -3,8 +3,8 @@ use std::{env, net::SocketAddr, sync::Arc, time::Duration};
 use clap::{Args, Parser, Subcommand};
 use temporal_runtime::{
     config::{
-        DeploymentStores, TaskQueues, cas_sweep_grace_from_env, environment_public_url_from_env,
-        gateway_auth_mode_from_env, postgres_pool_from_env, task_queues_from_env,
+        DeploymentStores, TaskQueues, cas_sweep_grace_from_env, gateway_auth_mode_from_env,
+        postgres_pool_from_env, task_queues_from_env,
     },
     gateway::{
         DEFAULT_GATEWAY_BIND, DEFAULT_MAX_REQUEST_BODY_BYTES, DEFAULT_TEMPORAL_NAMESPACE,
@@ -554,6 +554,14 @@ async fn run_roles(args: RunArgs) -> anyhow::Result<()> {
         .await?
         .with_blob_cache(temporal_runtime::config::blob_cache_from_env()?);
     let reaper_stores = stores.clone();
+    if roles.has(Role::EnvironmentGateway) {
+        // Daemons sign the gateway origin they dial; refuse to serve
+        // registration under an origin the gateway cannot name.
+        temporal_runtime::gateway::http::registration_origin(
+            args.public_base_url.as_deref(),
+            args.bind,
+        )?;
+    }
     let public_base_url = args
         .public_base_url
         .clone()
@@ -676,10 +684,7 @@ async fn run_roles(args: RunArgs) -> anyhow::Result<()> {
                 api: roles.has(Role::Gateway),
                 environment: roles.has(Role::EnvironmentGateway),
             };
-            let gateway_state = Arc::new(
-                GatewayState::multi(mode, universes, public_base_url)
-                    .with_environment_public_url(environment_public_url_from_env()?),
-            );
+            let gateway_state = Arc::new(GatewayState::multi(mode, universes, public_base_url));
             let app = gateway_router(gateway_state, args.max_request_body_bytes, routes);
             let listener = tokio::net::TcpListener::bind(args.bind).await?;
             tracing::info!(
diff --git a/crates/temporal-runtime/src/universe.rs b/crates/temporal-runtime/src/universe.rs
index 274ad807c..31d5bf5a8 100644
--- a/crates/temporal-runtime/src/universe.rs
+++ b/crates/temporal-runtime/src/universe.rs
@@ -264,20 +264,50 @@ impl UniverseRuntime {
 
     /// Run the one active deployment lifecycle reconciler. Provider calls are
     /// idempotent, so process restart safely resumes any persisted intent.
+    /// Each tick is one deployment pass: every provider is dialed at most
+    /// once, and a provider whose connection fails is skipped for the rest
+    /// of the pass in every universe. Every
+    /// [`STEADY_OBSERVATION_INTERVAL`](crate::environments::lifecycle::STEADY_OBSERVATION_INTERVAL)
+    /// a pass also observes steady environments, and each pass first dials
+    /// providers whose controller facts are not recorded yet.
     pub async fn run_environment_reconciler(self: Arc<Self>) {
+        use crate::environments::provider_controllers::{
+            ProviderFactsRefresh, ProviderPass, WebSocketProviderControllerConnector,
+        };
         let mut interval = tokio::time::interval(std::time::Duration::from_millis(500));
         interval.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Skip);
         let mut failures = crate::gateway::ReconcileFailureLog::default();
+        let mut facts = ProviderFactsRefresh::default();
+        let provider_store = self.stores.store_for(Uuid::nil());
+        let mut steady_at: Option<std::time::Instant> = None;
         loop {
             interval.tick().await;
+            let scope = if steady_at.is_none_or(|at| {
+                at.elapsed() >= crate::environments::lifecycle::STEADY_OBSERVATION_INTERVAL
+            }) {
+                steady_at = Some(std::time::Instant::now());
+                ::environments::ReconcileScope::WithSteady
+            } else {
+                ::environments::ReconcileScope::Converging
+            };
+            let mut pass = ProviderPass::default();
+            facts
+                .run(
+                    &mut pass,
+                    provider_store.as_ref(),
+                    &WebSocketProviderControllerConnector,
+                )
+                .await;
             let universe_ids = match store_pg::list_universes_with_pending_environments(
                 self.stores.pool(),
+                scope,
             )
             .await
             {
                 Ok(ids) => ids,
                 Err(error) => {
                     tracing::warn!(target: "temporal_runtime", %error, "environment reconciler scan failed");
+                    pass.close().await;
                     continue;
                 }
             };
@@ -292,13 +322,14 @@ impl UniverseRuntime {
                 match state
                     .api
                     .environment_service()
-                    .reconcile_environment_lifecycle_once()
+                    .reconcile_environment_lifecycle_pass(&mut pass, scope)
                     .await
                 {
                     Ok(_) => failures.succeeded(universe_id),
                     Err(error) => failures.failed(universe_id, &error),
                 }
             }
+            pass.close().await;
         }
     }
 
@@ -321,6 +352,9 @@ impl UniverseRuntime {
                     continue;
                 }
             };
+            // Providers whose daemons timed out are skipped for the rest of
+            // the pass, in every universe.
+            let mut unhealthy = std::collections::HashSet::new();
             for universe_id in universe_ids {
                 let state = match self.state_for(universe_id, false).await {
                     Ok(state) => state,
@@ -332,7 +366,7 @@ impl UniverseRuntime {
                 match state
                     .api
                     .environment_service()
-                    .reconcile_idle_power_once()
+                    .reconcile_idle_power_pass(&mut unhealthy)
                     .await
                 {
                     Ok(_) => failures.succeeded(universe_id),
diff --git a/crates/temporal-runtime/src/worker/activities/environment_jobs.rs b/crates/temporal-runtime/src/worker/activities/environment_jobs.rs
index 03272f9c8..01624d55c 100644
--- a/crates/temporal-runtime/src/worker/activities/environment_jobs.rs
+++ b/crates/temporal-runtime/src/worker/activities/environment_jobs.rs
@@ -1,34 +1,58 @@
-use std::collections::{BTreeMap, BTreeSet};
+//! Activities of `EnvironmentJobWorkflow`.
+//!
+//! The workflow keeps its own job records and start payload in history;
+//! these activities are the only place that maps them to and from the
+//! environment protocol's `job/*` wire types.
 
-use environment_client::{EnvironmentClientError, EnvironmentDataClient};
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    time::Duration,
+};
+
+use environment_client::{ClientError, DataClient};
 use environment_protocol::{
+    bytes::ByteChunk,
     data::{
-        handshake::{InitializeParams, InitializedParams},
-        jobs::{CancelJobsParams, JobStatus, ReadJobsParams},
+        exec::{CommandSpec, ExecInput, ReturnOn},
+        job::{
+            CancelJobsParams, JobCancelScope, JobDependency, JobDependencyPolicy, JobReadEntry,
+            JobReadRequest, JobSpec, JobStatus, JobSummary, JobSummaryEntry, ReadJobsParams,
+            StartJobsParams,
+        },
     },
-    error::EnvironmentProtocolErrorCode,
-    shared::{CURRENT_PROTOCOL_VERSION, EnvironmentDataConnection, EnvironmentTransport},
+    error::{ProtocolError, ProtocolErrorKind},
+    ids::{JobId, JobName, JobRequestId, QueueKey},
+    paths::EnvironmentPath,
 };
-use environments::{EnvironmentId, EnvironmentJobGroupId};
+use environments::{EnvironmentId, EnvironmentJobGroupId, EnvironmentRecord};
 use harness::{BlobRef, PromiseSourceCheckResult, storage::BlobStore};
 use temporal_workflow::{
-    EnvironmentJobCancelActivityRequest, EnvironmentJobPollActivityRequest,
-    EnvironmentJobPollActivityResult, EnvironmentJobPrepareWorkflowToolRequest,
+    EnvironmentJobCancelActivityRequest, EnvironmentJobCancelActivityResult,
+    EnvironmentJobCancelScope, EnvironmentJobCommand, EnvironmentJobDependency,
+    EnvironmentJobDependencyPolicy, EnvironmentJobId, EnvironmentJobObservation,
+    EnvironmentJobPollActivityRequest, EnvironmentJobPollActivityResult,
+    EnvironmentJobPrepareWorkflowToolRequest, EnvironmentJobRecord, EnvironmentJobSpec,
     EnvironmentJobStartActivityRequest, EnvironmentJobStartActivityResult,
-    EnvironmentJobStartPayload, EnvironmentJobSubscription, EnvironmentJobWorkflowArgs,
-    EnvironmentJobWorkflowToolContext,
+    EnvironmentJobStartPayloadV1, EnvironmentJobStatus, EnvironmentJobSubscription,
+    EnvironmentJobWorkflowArgs, EnvironmentJobWorkflowToolContext,
 };
 use temporalio_common::error::ApplicationFailure;
 use temporalio_sdk::activities::ActivityError;
 use tools::environment::jobs::{
-    JOB_RUN_WORKFLOW_SEMANTIC_TYPE, JOB_RUN_WORKFLOW_TOOL_ID, JOB_SUBMIT_WORKFLOW_SEMANTIC_TYPE,
-    JOB_SUBMIT_WORKFLOW_TOOL_ID, JobHandle, NormalizeJobResultInput, normalize_job_result,
+    DEFAULT_JOB_OUTPUT_BYTES, JOB_RUN_WORKFLOW_SEMANTIC_TYPE, JOB_RUN_WORKFLOW_TOOL_ID,
+    JOB_SUBMIT_WORKFLOW_SEMANTIC_TYPE, JOB_SUBMIT_WORKFLOW_TOOL_ID, JobHandle,
+    NormalizeJobResultInput, job_output_read, model_job_error, normalize_job_result,
     store_model_job_result,
 };
 
 use super::{common::activity_error, state::EnvironmentJobActivityDeps};
 
-const PROMISE_JOB_OUTPUT_BYTES: usize = 16 * 1024;
+/// `User-Agent` of the job activities' worker-route upgrades; `clientInfo`
+/// is always the runtime build.
+const JOB_ACTIVITY_USER_AGENT: &str = "lightspeed-environment-job-workflow";
+
+/// Deadline of every data-plane call these background activities make.
+const JOB_REQUEST_TIMEOUT: Duration = Duration::from_secs(60);
 
 #[derive(Clone, Copy)]
 enum WorkflowJobToolKind {
@@ -49,11 +73,7 @@ pub(super) async fn prepare_workflow_tool(
     deps: Option<&EnvironmentJobActivityDeps>,
     request: EnvironmentJobPrepareWorkflowToolRequest,
 ) -> Result<EnvironmentJobWorkflowArgs, ActivityError> {
-    let deps = deps.ok_or_else(|| {
-        activity_error(anyhow::anyhow!(
-            "environment job activities are not configured"
-        ))
-    })?;
+    let deps = configured(deps)?;
     let start = request.start;
     let expected_holder =
         temporal_workflow::compose_workflow_id(start.universe_id, &start.invocation.session_id);
@@ -112,16 +132,16 @@ pub(super) async fn prepare_workflow_tool(
     }
     let environment_id =
         EnvironmentId::try_new(execution_context.environment_id).map_err(activity_error)?;
+    let working_directory = execution_context.working_directory.as_deref();
     // The executor admitted this call against the session's attachment
     // grant; the context names the machine it admitted.
-    let request_id = format!(
-        "jobreq:{}:{}:{}:{}",
+    let request_id = workflow_tool_request_id(
         start.invocation.run_id.as_u64(),
         start.invocation.turn_id.as_u64(),
         start.invocation.tool_batch_id.as_u64(),
-        start.invocation.tool_call_id.as_str()
+        start.invocation.tool_call_id.as_str(),
     );
-    let mut jobs = match tool_kind {
+    let wire_jobs = match tool_kind {
         WorkflowJobToolKind::Submit => {
             let args: tools::environment::jobs::JobSubmitArgs =
                 serde_json::from_slice(&arguments).map_err(activity_error)?;
@@ -134,7 +154,7 @@ pub(super) async fn prepare_workflow_tool(
                 .into_iter()
                 .map(|spec| {
                     let job_id = spec.job_id.clone();
-                    spec.into_protocol_spec(job_id)
+                    spec.into_job_spec(job_id, working_directory)
                         .map_err(|error| activity_error(anyhow::anyhow!(error.to_string())))
                 })
                 .collect::<Result<Vec<_>, _>>()?
@@ -144,36 +164,17 @@ pub(super) async fn prepare_workflow_tool(
                 serde_json::from_slice(&arguments).map_err(activity_error)?;
             let job_id = derived_job_run_id(start.invocation.invocation_id.as_str());
             vec![
-                args.into_protocol_spec(job_id)
+                args.into_job_spec(job_id, working_directory)
                     .map_err(|error| activity_error(anyhow::anyhow!(error.to_string())))?,
             ]
         }
     };
-    if let Some(cwd) = &execution_context.working_directory {
-        for job in &mut jobs {
-            let path = tools::environment::sources::absolute(
-                std::path::Path::new(cwd),
-                job.cwd.as_ref().map(|path| path.as_str()).unwrap_or("."),
-            )
-            .map_err(|error| activity_error(anyhow::anyhow!(error)))?;
-            job.cwd = Some(
-                environment_protocol::shared::EnvironmentPath::new(path.to_string_lossy())
-                    .map_err(activity_error)?,
-            );
-        }
-    }
-    let params = environment_protocol::data::jobs::StartJobsParams {
-        namespace: environment_id.as_str().to_owned(),
-        request_id,
-        jobs,
-    };
-    let request_fingerprint =
-        BlobRef::from_bytes(&serde_json::to_vec(&params).map_err(activity_error)?);
-    let job_group_id = derived_workflow_tool_job_group_id(
-        &environment_id,
-        &params.request_id,
-        request_fingerprint.as_str(),
-    );
+    let jobs = wire_jobs
+        .into_iter()
+        .map(workflow_job_spec)
+        .collect::<Result<Vec<_>, _>>()
+        .map_err(|error| activity_error(anyhow::anyhow!(error)))?;
+    let payload = EnvironmentJobStartPayloadV1::new(request_id.into_string(), jobs);
     let completion_promises = start
         .invocation
         .completion_promises
@@ -186,12 +187,12 @@ pub(super) async fn prepare_workflow_tool(
         })?;
     let subscriptions = match tool_kind {
         WorkflowJobToolKind::Submit => {
-            if completion_promises.len() != params.jobs.len() {
+            if completion_promises.len() != payload.jobs.len() {
                 return Err(activity_error(anyhow::anyhow!(
                     "job_submit completion promise count does not match job count"
                 )));
             }
-            params
+            payload
                 .jobs
                 .iter()
                 .map(|job| {
@@ -232,16 +233,16 @@ pub(super) async fn prepare_workflow_tool(
                 holder_workflow_id: start.holder_workflow_id.clone(),
                 promise_id: promise_id.as_str().to_owned(),
                 completion_key: harness::REPLY_COMPLETION_KEY.to_owned(),
-                job_id: params.jobs[0].job_id.clone(),
+                job_id: payload.jobs[0].job_id.clone(),
                 notified: false,
             }]
         }
     };
-    let job_ids = params.jobs.iter().map(|job| job.job_id.clone()).collect();
-    let payload = EnvironmentJobStartPayload { request: params };
+    let encoded = payload.encode().map_err(activity_error)?;
+    let job_group_id = derived_job_group_id(&environment_id, &BlobRef::from_bytes(&encoded));
     let request_ref = deps
         .blobs
-        .put_bytes(serde_json::to_vec(&payload).map_err(activity_error)?)
+        .put_bytes(encoded)
         .await
         .map_err(activity_error)?;
     Ok(EnvironmentJobWorkflowArgs {
@@ -252,7 +253,7 @@ pub(super) async fn prepare_workflow_tool(
             job_group_id: job_group_id.as_str().to_owned(),
             request_ref,
         },
-        job_ids,
+        job_ids: payload.job_ids(),
         subscriptions,
         started: false,
         jobs: Vec::new(),
@@ -266,67 +267,238 @@ pub(super) async fn prepare_workflow_tool(
     })
 }
 
-fn derived_job_run_id(invocation_id: &str) -> environment_protocol::shared::JobId {
+/// The start's idempotency key: one per model tool call, so a retried call
+/// replays its jobs and a new call reusing a job id is refused.
+fn workflow_tool_request_id(run: u64, turn: u64, batch: u64, call_id: &str) -> JobRequestId {
+    JobRequestId::new(format!("jobreq:{run}:{turn}:{batch}:{call_id}")).unwrap_or_else(|_| {
+        // A provider call id outside the id grammar is hashed instead.
+        let hash = BlobRef::from_bytes(format!("{run}:{turn}:{batch}:{call_id}").as_bytes());
+        JobRequestId::new(format!("jobreq-{}", &hash.as_str()[7..39]))
+            .expect("hex request id fits the id grammar")
+    })
+}
+
+fn derived_job_run_id(invocation_id: &str) -> JobId {
     let hash = BlobRef::from_bytes(invocation_id.as_bytes());
-    environment_protocol::shared::JobId::new(format!("job-{}", &hash.as_str()[7..31]))
+    JobId::new(format!("job-{}", &hash.as_str()[7..31])).expect("hex job id fits the id grammar")
 }
 
-fn derived_workflow_tool_job_group_id(
+/// A group is named by its environment and the content address of its
+/// encoded start payload, which is also the payload's CAS `request_ref`.
+fn derived_job_group_id(
     environment_id: &EnvironmentId,
-    request_id: &str,
-    request_fingerprint: &str,
+    payload_ref: &BlobRef,
 ) -> EnvironmentJobGroupId {
-    let hash = BlobRef::from_bytes(
-        format!("{environment_id}:{request_id}:{request_fingerprint}").as_bytes(),
-    );
+    let hash = BlobRef::from_bytes(format!("{environment_id}:{payload_ref}").as_bytes());
     EnvironmentJobGroupId::new(format!("ejg_{}", &hash.as_str()[7..31]))
 }
 
+/// The workflow's record of a wire job spec built by the model-facing
+/// arguments. The spec never carries secrets here: the start activity
+/// resolves credential-bound variables.
+fn workflow_job_spec(spec: JobSpec) -> Result<EnvironmentJobSpec, String> {
+    let JobSpec {
+        job_id,
+        name,
+        command,
+        depends_on,
+        dependency_policy,
+        queue_key,
+    } = spec;
+    let CommandSpec {
+        argv,
+        cwd,
+        env,
+        secret_env,
+        input,
+        timeout_ms,
+    } = command;
+    if !secret_env.is_empty() {
+        return Err(format!(
+            "job {job_id} carries secret variables before credential resolution"
+        ));
+    }
+    let stdin = match input {
+        ExecInput::None {} => None,
+        ExecInput::Bytes { data } => Some(
+            String::from_utf8(data.into_inner())
+                .map_err(|_| format!("job {job_id} stdin is not UTF-8"))?,
+        ),
+        ExecInput::Pipe {} => return Err(format!("job {job_id} cannot read a pipe")),
+    };
+    Ok(EnvironmentJobSpec {
+        job_id: EnvironmentJobId::new(job_id.into_string()),
+        name: name.map(JobName::into_string),
+        command: EnvironmentJobCommand {
+            argv,
+            cwd: cwd.map(|cwd| cwd.as_str().to_owned()),
+            env,
+            stdin,
+            timeout_ms,
+        },
+        depends_on: depends_on
+            .into_iter()
+            .map(|dependency| match dependency {
+                JobDependency::JobId { job_id } => EnvironmentJobDependency::JobId {
+                    job_id: EnvironmentJobId::new(job_id.into_string()),
+                },
+                JobDependency::Name { name } => EnvironmentJobDependency::Name {
+                    name: name.into_string(),
+                },
+            })
+            .collect(),
+        dependency_policy: match dependency_policy {
+            JobDependencyPolicy::AllSucceeded => EnvironmentJobDependencyPolicy::AllSucceeded,
+            JobDependencyPolicy::AllTerminal => EnvironmentJobDependencyPolicy::AllTerminal,
+        },
+        queue_key: queue_key.map(QueueKey::into_string),
+    })
+}
+
+/// The wire spec of a stored job, without its secret variables.
+fn wire_job_spec(spec: EnvironmentJobSpec) -> Result<JobSpec, String> {
+    let EnvironmentJobSpec {
+        job_id,
+        name,
+        command,
+        depends_on,
+        dependency_policy,
+        queue_key,
+    } = spec;
+    let job_id = wire_job_id(&job_id)?;
+    Ok(JobSpec {
+        name: name
+            .map(|name| JobName::new(name).map_err(|error| format!("job {job_id} name: {error}")))
+            .transpose()?,
+        command: CommandSpec {
+            argv: command.argv,
+            cwd: command
+                .cwd
+                .map(|cwd| {
+                    EnvironmentPath::new(cwd).map_err(|error| format!("job {job_id} cwd: {error}"))
+                })
+                .transpose()?,
+            env: command.env,
+            secret_env: BTreeMap::new(),
+            input: match command.stdin {
+                Some(stdin) => ExecInput::Bytes {
+                    data: ByteChunk::from(stdin.into_bytes()),
+                },
+                None => ExecInput::None {},
+            },
+            timeout_ms: command.timeout_ms,
+        },
+        depends_on: depends_on
+            .into_iter()
+            .map(|dependency| match dependency {
+                EnvironmentJobDependency::JobId { job_id } => {
+                    wire_job_id(&job_id).map(|job_id| JobDependency::JobId { job_id })
+                }
+                EnvironmentJobDependency::Name { name } => JobName::new(name)
+                    .map(|name| JobDependency::Name { name })
+                    .map_err(|error| format!("job dependency name: {error}")),
+            })
+            .collect::<Result<Vec<_>, _>>()?,
+        dependency_policy: match dependency_policy {
+            EnvironmentJobDependencyPolicy::AllSucceeded => JobDependencyPolicy::AllSucceeded,
+            EnvironmentJobDependencyPolicy::AllTerminal => JobDependencyPolicy::AllTerminal,
+        },
+        queue_key: queue_key
+            .map(|key| {
+                QueueKey::new(key).map_err(|error| format!("job {job_id} queue key: {error}"))
+            })
+            .transpose()?,
+        job_id,
+    })
+}
+
+fn wire_job_id(job_id: &EnvironmentJobId) -> Result<JobId, String> {
+    JobId::new(job_id.as_str()).map_err(|error| format!("job id {job_id}: {error}"))
+}
+
+/// The workflow's record of a daemon summary.
+fn job_record(summary: &JobSummary) -> EnvironmentJobRecord {
+    EnvironmentJobRecord {
+        job_id: EnvironmentJobId::new(summary.job_id.as_str()),
+        name: summary.name.as_ref().map(|name| name.as_str().to_owned()),
+        status: job_status(summary.status),
+        depends_on: summary
+            .depends_on
+            .iter()
+            .map(|job_id| EnvironmentJobId::new(job_id.as_str()))
+            .collect(),
+        queue_key: summary
+            .queue_key
+            .as_ref()
+            .map(|key| key.as_str().to_owned()),
+    }
+}
+
+fn job_status(status: JobStatus) -> EnvironmentJobStatus {
+    match status {
+        JobStatus::Queued => EnvironmentJobStatus::Queued,
+        JobStatus::Running => EnvironmentJobStatus::Running,
+        JobStatus::Succeeded => EnvironmentJobStatus::Succeeded,
+        JobStatus::Failed => EnvironmentJobStatus::Failed,
+        JobStatus::TimedOut => EnvironmentJobStatus::TimedOut,
+        JobStatus::Cancelled => EnvironmentJobStatus::Cancelled,
+        JobStatus::DependencyFailed => EnvironmentJobStatus::DependencyFailed,
+        JobStatus::Interrupted => EnvironmentJobStatus::Interrupted,
+    }
+}
+
+/// A per-entry error: `notFound` is the workflow's `lost` outcome; any
+/// other entry error means the daemon broke the contract.
+fn entry_error_observation(
+    job_id: &JobId,
+    error: ProtocolError,
+) -> Result<EnvironmentJobObservation, ActivityError> {
+    if error.kind() == ProtocolErrorKind::NotFound {
+        Ok(EnvironmentJobObservation::NotFound {
+            job_id: EnvironmentJobId::new(job_id.as_str()),
+        })
+    } else {
+        Err(activity_error(anyhow::anyhow!(
+            "environment answered job {job_id} with {error}"
+        )))
+    }
+}
+
 pub(super) async fn start(
     deps: Option<&EnvironmentJobActivityDeps>,
     request: EnvironmentJobStartActivityRequest,
 ) -> Result<EnvironmentJobStartActivityResult, ActivityError> {
-    let deps = deps.ok_or_else(|| {
-        activity_error(anyhow::anyhow!(
-            "environment job activities are not configured"
-        ))
-    })?;
+    let deps = configured(deps)?;
     let environment_id =
         EnvironmentId::try_new(request.environment_id.clone()).map_err(activity_error)?;
-    let mut payload: EnvironmentJobStartPayload = serde_json::from_slice(
+    let payload = EnvironmentJobStartPayloadV1::decode(
         &deps
             .blobs
             .read_bytes(&request.request_ref)
             .await
             .map_err(activity_error)?,
     )
-    .map_err(activity_error)?;
-    if payload.request.namespace != environment_id.as_str() {
-        return Err(activity_error(anyhow::anyhow!(
-            "environment job start namespace does not match instance {environment_id}"
-        )));
-    }
-
-    for job in &mut payload.request.jobs {
+    .map_err(non_retryable_activity_error)?;
+    let request_id = JobRequestId::new(payload.request_id.clone()).map_err(|error| {
+        non_retryable_activity_error(anyhow::anyhow!("job request id: {error}"))
+    })?;
+    let requested_ids = payload.job_ids().into_iter().collect::<BTreeSet<_>>();
+    let mut jobs = Vec::with_capacity(payload.jobs.len());
+    for spec in payload.jobs {
+        let mut job = wire_job_spec(spec)
+            .map_err(|error| non_retryable_activity_error(anyhow::anyhow!(error)))?;
         let secret_env = deps
             .credentials
-            .resolve_secret_env(&environment_id, &job.env)
+            .resolve_secret_env(&environment_id, &job.command.env)
             .await
             .map_err(activity_error)?;
-        job.secret_env.extend(secret_env);
+        job.command.secret_env.extend(secret_env);
+        jobs.push(job);
     }
 
-    start_on_provider(deps, &environment_id, &payload).await
-}
-
-async fn start_on_provider(
-    deps: &EnvironmentJobActivityDeps,
-    environment_id: &EnvironmentId,
-    payload: &EnvironmentJobStartPayload,
-) -> Result<EnvironmentJobStartActivityResult, ActivityError> {
     let instance = deps
         .environments
-        .read_environment(environment_id)
+        .read_environment(&environment_id)
         .await
         .map_err(activity_error)?;
     if matches!(
@@ -337,131 +509,152 @@ async fn start_on_provider(
             "cannot start jobs on closing environment instance {environment_id}"
         )));
     }
-    let gateway = deps.gateway.as_ref().ok_or_else(|| {
-        non_retryable_activity_error(anyhow::anyhow!(
-            "environment gateway is not configured on this worker"
-        ))
-    })?;
-    let connection = gateway.connection_for(deps.universe_id, &instance);
-    let (mut client, capabilities) = initialized_client(&connection, gateway).await?;
-    if !capabilities.job_start {
-        return Err(non_retryable_activity_error(anyhow::anyhow!(
-            "environment does not support durable job start: {environment_id}"
-        )));
-    }
+    let client = job_client(deps, &instance).await?;
     let response = client
-        .start_jobs(&payload.request)
-        .await
-        .map_err(start_environment_activity_error)?;
-    let requested_ids = payload
-        .request
-        .jobs
+        .start_jobs(&StartJobsParams { request_id, jobs })
+        .await;
+    let _ = client.close().await;
+    let response = response.map_err(client_activity_error)?;
+    let records = response.jobs.iter().map(job_record).collect::<Vec<_>>();
+    let returned_ids = records
         .iter()
-        .map(|job| job.job_id.clone())
-        .collect::<BTreeSet<_>>();
-    let returned_ids = response
-        .jobs
-        .iter()
-        .map(|job| job.job_id.clone())
+        .map(|record| record.job_id.clone())
         .collect::<BTreeSet<_>>();
     if requested_ids != returned_ids {
         return Err(non_retryable_activity_error(anyhow::anyhow!(
-            "environment provider start response job ids do not match the request"
+            "environment start response job ids do not match the request"
         )));
     }
-    Ok(EnvironmentJobStartActivityResult {
-        jobs: response.jobs,
-    })
-}
-
-fn start_environment_activity_error(error: EnvironmentClientError) -> ActivityError {
-    match &error {
-        EnvironmentClientError::Protocol(error)
-            if matches!(
-                error.code,
-                EnvironmentProtocolErrorCode::InvalidRequest
-                    | EnvironmentProtocolErrorCode::Unauthorized
-                    | EnvironmentProtocolErrorCode::Forbidden
-                    | EnvironmentProtocolErrorCode::NotFound
-                    | EnvironmentProtocolErrorCode::Conflict
-                    | EnvironmentProtocolErrorCode::Unsupported
-                    | EnvironmentProtocolErrorCode::CapabilityUnavailable
-            ) =>
-        {
-            non_retryable_activity_error(anyhow::anyhow!(error.message.clone()))
-        }
-        _ => activity_error(error),
-    }
-}
-
-fn non_retryable_activity_error(error: impl Into<anyhow::Error>) -> ActivityError {
-    ActivityError::application(ApplicationFailure::non_retryable(error.into()))
+    Ok(EnvironmentJobStartActivityResult { jobs: records })
 }
 
 pub(super) async fn poll(
     deps: Option<&EnvironmentJobActivityDeps>,
     request: EnvironmentJobPollActivityRequest,
 ) -> Result<EnvironmentJobPollActivityResult, ActivityError> {
-    let deps = deps.ok_or_else(|| {
-        activity_error(anyhow::anyhow!(
-            "environment job activities are not configured"
-        ))
-    })?;
+    let deps = configured(deps)?;
     let environment_id = EnvironmentId::try_new(request.environment_id).map_err(activity_error)?;
+    let job_ids = request
+        .job_ids
+        .iter()
+        .map(wire_job_id)
+        .collect::<Result<Vec<_>, _>>()
+        .map_err(|error| non_retryable_activity_error(anyhow::anyhow!(error)))?;
+    if job_ids.is_empty() {
+        return Ok(EnvironmentJobPollActivityResult {
+            jobs: Vec::new(),
+            resolutions: BTreeMap::new(),
+        });
+    }
     let instance = deps
         .environments
         .read_environment(&environment_id)
         .await
         .map_err(activity_error)?;
-    let gateway = deps.gateway.as_ref().ok_or_else(|| {
-        non_retryable_activity_error(anyhow::anyhow!(
-            "environment gateway is not configured on this worker"
-        ))
-    })?;
-    let connection = gateway.connection_for(deps.universe_id, &instance);
-    let (mut client, _) = initialized_client(&connection, gateway).await?;
-    let requested_job_ids = request.job_ids.iter().cloned().collect::<BTreeSet<_>>();
-    let response = client
-        .read_jobs(&ReadJobsParams {
-            namespace: environment_id.as_str().to_owned(),
-            jobs: request.job_ids,
-            after_seq: None,
-            max_bytes: Some(PROMISE_JOB_OUTPUT_BYTES),
-            include_artifacts: true,
-            wait_ms: None,
-        })
-        .await
-        .map_err(activity_error)?;
-    let mut jobs = Vec::with_capacity(response.jobs.len());
+    let client = job_client(deps, &instance).await?;
+    let result = poll_jobs(deps, &client, &environment_id, &job_ids).await;
+    let _ = client.close().await;
+    result
+}
+
+async fn poll_jobs(
+    deps: &EnvironmentJobActivityDeps,
+    client: &DataClient,
+    environment_id: &EnvironmentId,
+    job_ids: &[JobId],
+) -> Result<EnvironmentJobPollActivityResult, ActivityError> {
+    let limits = client.initialize_response().limits.job.clone();
+    let per_request = (limits.max_request_jobs as usize).max(1);
+    let mut jobs = Vec::with_capacity(job_ids.len());
+    let mut terminal = Vec::new();
+    // Summaries first, without output: most polls find running jobs.
+    for chunk in job_ids.chunks(per_request) {
+        let response = client
+            .read_jobs(&ReadJobsParams {
+                jobs: chunk
+                    .iter()
+                    .map(|job_id| JobReadRequest {
+                        job_id: job_id.clone(),
+                        after: None,
+                        tail_bytes: None,
+                        max_bytes: None,
+                    })
+                    .collect(),
+                max_bytes: 0,
+                wait_ms: 0,
+                return_on: ReturnOn::AnyOutput,
+            })
+            .await
+            .map_err(client_activity_error)?;
+        for (job_id, entry) in chunk.iter().zip(response.jobs) {
+            match entry {
+                JobReadEntry::Job { summary, .. } => {
+                    let record = job_record(&summary);
+                    if record.status.is_terminal() {
+                        terminal.push((job_id.clone(), record.status));
+                    }
+                    jobs.push(EnvironmentJobObservation::Job { record });
+                }
+                JobReadEntry::Error { job_id, error } => {
+                    jobs.push(entry_error_observation(&job_id, error)?);
+                }
+            }
+        }
+    }
+
     let mut resolutions = BTreeMap::new();
-    for result in response.jobs {
-        let summary = result.summary.clone();
-        if summary.status.is_terminal() {
-            let error = (summary.status != JobStatus::Succeeded).then(|| {
-                summary.failure.clone().unwrap_or_else(|| {
-                    format!(
-                        "environment job {} ended as {:?}",
-                        summary.job_id, summary.status
-                    )
-                })
-            });
-            let normalized = normalize_job_result(
-                deps.blobs.as_ref(),
-                NormalizeJobResultInput {
-                    handle: Some(JobHandle {
-                        environment_id: environment_id.as_str().to_owned(),
-                        job_id: summary.job_id.clone(),
-                    }),
-                    summary: Some(result.summary),
-                    output_chunks: result.output_chunks,
-                    output_next_seq: result.output_next_seq,
-                    artifacts: result.artifacts,
-                    error,
-                    output_bytes: Some(PROMISE_JOB_OUTPUT_BYTES),
+    for observation in &jobs {
+        if let EnvironmentJobObservation::NotFound { job_id } = observation {
+            let handle = job_handle(environment_id, job_id)?;
+            let result = model_job_error(
+                Some(handle),
+                format!("environment no longer knows job {job_id}"),
+            );
+            let result_ref =
+                store_model_job_result(deps.blobs.as_ref(), deps.blob_graph.as_deref(), &result)
+                    .await
+                    .map_err(activity_error)?;
+            resolutions.insert(
+                job_id.as_str().to_owned(),
+                PromiseSourceCheckResult::Failed {
+                    error_ref: Some(result_ref),
                 },
-            )
+            );
+        }
+    }
+
+    // Each terminal job's result shows the head and the tail of its output.
+    let per_read = (per_request / 2).max(1);
+    for chunk in terminal.chunks(per_read) {
+        let ids = chunk
+            .iter()
+            .map(|(job_id, _)| job_id.clone())
+            .collect::<Vec<_>>();
+        let output_bytes = DEFAULT_JOB_OUTPUT_BYTES.min(limits.max_read_bytes / ids.len() as u64);
+        let response = client
+            .read_jobs(&job_output_read(&ids, None, output_bytes))
             .await
-            .map_err(activity_error)?;
+            .map_err(client_activity_error)?;
+        let mut entries = response.jobs.into_iter();
+        for (job_id, status) in chunk {
+            let handle = job_handle(environment_id, &EnvironmentJobId::new(job_id.as_str()))?;
+            let mut input = NormalizeJobResultInput::from_entries(
+                Some(handle),
+                entries.by_ref().take(2).collect::<Vec<_>>(),
+            );
+            if !status.is_success() && input.error.is_none() {
+                input.error = Some(
+                    match input.summary.as_ref().and_then(|s| s.error.as_ref()) {
+                        Some(error) => {
+                            format!("environment job {job_id} ended {status:?}: {error}")
+                        }
+                        None => format!("environment job {job_id} ended {status:?}"),
+                    },
+                );
+            }
+            let normalized = normalize_job_result(deps.blobs.as_ref(), input)
+                .await
+                .map_err(activity_error)?;
             let result_ref = store_model_job_result(
                 deps.blobs.as_ref(),
                 deps.blob_graph.as_deref(),
@@ -469,7 +662,7 @@ pub(super) async fn poll(
             )
             .await
             .map_err(activity_error)?;
-            let resolution = if summary.status == JobStatus::Succeeded {
+            let resolution = if status.is_success() {
                 PromiseSourceCheckResult::Resolved {
                     payload_ref: Some(result_ref),
                 }
@@ -478,99 +671,311 @@ pub(super) async fn poll(
                     error_ref: Some(result_ref),
                 }
             };
-            resolutions.insert(summary.job_id.as_str().to_owned(), resolution);
+            resolutions.insert(job_id.as_str().to_owned(), resolution);
         }
-        jobs.push(summary);
     }
-    let returned_job_ids = jobs
-        .iter()
-        .map(|job| job.job_id.clone())
-        .collect::<BTreeSet<_>>();
-    let terminal = returned_job_ids == requested_job_ids
-        && !jobs.is_empty()
-        && jobs.iter().all(|job| job.status.is_terminal());
-    Ok(EnvironmentJobPollActivityResult {
-        jobs,
-        resolutions,
-        terminal,
+    Ok(EnvironmentJobPollActivityResult { jobs, resolutions })
+}
+
+fn job_handle(
+    environment_id: &EnvironmentId,
+    job_id: &EnvironmentJobId,
+) -> Result<JobHandle, ActivityError> {
+    Ok(JobHandle {
+        environment_id: environment_id.as_str().to_owned(),
+        job_id: wire_job_id(job_id)
+            .map_err(|error| non_retryable_activity_error(anyhow::anyhow!(error)))?,
     })
 }
 
 pub(super) async fn cancel(
     deps: Option<&EnvironmentJobActivityDeps>,
     request: EnvironmentJobCancelActivityRequest,
-) -> Result<Vec<environment_protocol::data::jobs::JobSummary>, ActivityError> {
-    let deps = deps.ok_or_else(|| {
-        activity_error(anyhow::anyhow!(
-            "environment job activities are not configured"
-        ))
-    })?;
+) -> Result<EnvironmentJobCancelActivityResult, ActivityError> {
+    let deps = configured(deps)?;
     let environment_id = EnvironmentId::try_new(request.environment_id).map_err(activity_error)?;
+    let job_ids = request
+        .jobs
+        .iter()
+        .map(wire_job_id)
+        .collect::<Result<Vec<_>, _>>()
+        .map_err(|error| non_retryable_activity_error(anyhow::anyhow!(error)))?;
+    if job_ids.is_empty() {
+        return Ok(EnvironmentJobCancelActivityResult { jobs: Vec::new() });
+    }
     let instance = deps
         .environments
         .read_environment(&environment_id)
         .await
         .map_err(activity_error)?;
+    let client = job_client(deps, &instance).await?;
+    let result = cancel_jobs(&client, &job_ids, request.scope, request.force).await;
+    let _ = client.close().await;
+    result
+}
+
+async fn cancel_jobs(
+    client: &DataClient,
+    job_ids: &[JobId],
+    scope: EnvironmentJobCancelScope,
+    force: bool,
+) -> Result<EnvironmentJobCancelActivityResult, ActivityError> {
+    let per_request = (client.initialize_response().limits.job.max_request_jobs as usize).max(1);
+    let scope = match scope {
+        EnvironmentJobCancelScope::Job => JobCancelScope::Job,
+        EnvironmentJobCancelScope::Dependents => JobCancelScope::Dependents,
+    };
+    let mut jobs = Vec::new();
+    for chunk in job_ids.chunks(per_request) {
+        let response = client
+            .cancel_jobs(&CancelJobsParams {
+                job_ids: chunk.to_vec(),
+                scope,
+                force,
+            })
+            .await
+            .map_err(client_activity_error)?;
+        for entry in response.jobs {
+            jobs.push(match entry {
+                JobSummaryEntry::Job { summary } => EnvironmentJobObservation::Job {
+                    record: job_record(&summary),
+                },
+                JobSummaryEntry::Error { job_id, error } => {
+                    entry_error_observation(&job_id, error)?
+                }
+            });
+        }
+    }
+    Ok(EnvironmentJobCancelActivityResult { jobs })
+}
+
+fn configured(
+    deps: Option<&EnvironmentJobActivityDeps>,
+) -> Result<&EnvironmentJobActivityDeps, ActivityError> {
+    deps.ok_or_else(|| {
+        activity_error(anyhow::anyhow!(
+            "environment job activities are not configured"
+        ))
+    })
+}
+
+/// An initialized data client for the environment's current incarnation;
+/// the daemon must serve the `job` family.
+async fn job_client(
+    deps: &EnvironmentJobActivityDeps,
+    instance: &EnvironmentRecord,
+) -> Result<DataClient, ActivityError> {
     let gateway = deps.gateway.as_ref().ok_or_else(|| {
         non_retryable_activity_error(anyhow::anyhow!(
             "environment gateway is not configured on this worker"
         ))
     })?;
-    let connection = gateway.connection_for(deps.universe_id, &instance);
-    let (mut client, _) = initialized_client(&connection, gateway).await?;
-    let response = client
-        .cancel_jobs(&CancelJobsParams {
-            namespace: environment_id.as_str().to_owned(),
-            jobs: request.jobs,
-            scope: request.scope,
-            force: request.force,
-        })
-        .await
-        .map_err(activity_error)?;
-    Ok(response.jobs)
+    let endpoint = gateway.endpoint_for(deps.universe_id, instance);
+    let (client, initialized) = DataClient::connect_initialized(
+        &endpoint,
+        gateway
+            .connect_options(JOB_ACTIVITY_USER_AGENT)
+            .with_request_timeout(JOB_REQUEST_TIMEOUT),
+    )
+    .await
+    .map_err(client_activity_error)?;
+    if initialized.capabilities.job.is_none() {
+        let _ = client.close().await;
+        return Err(non_retryable_activity_error(anyhow::anyhow!(
+            "environment does not serve durable jobs: {}",
+            instance.environment_id
+        )));
+    }
+    Ok(client)
 }
 
-async fn initialized_client(
-    connection: &EnvironmentDataConnection,
-    gateway: &crate::environments::gateway::EnvironmentGatewayClientConfig,
-) -> Result<
-    (
-        EnvironmentDataClient<environment_client::WebSocketTransport>,
-        environment_protocol::shared::EnvironmentCapabilities,
-    ),
-    ActivityError,
-> {
-    if connection.transport != EnvironmentTransport::WebSocket {
-        return Err(activity_error(anyhow::anyhow!(
-            "unsupported environment job transport: {:?}",
-            connection.transport
-        )));
+/// Retry what may pass on a later attempt (transport trouble, busy or
+/// unavailable daemons, server defects); refusals of the request itself,
+/// such as `invalidParams` or `failedPrecondition {jobIdInUse}`, and
+/// version or plane mismatches fail the activity for good.
+fn client_activity_error(error: ClientError) -> ActivityError {
+    if is_transient(&error) {
+        activity_error(error)
+    } else {
+        non_retryable_activity_error(error)
     }
-    let mut client = EnvironmentDataClient::connect(
-        &connection.endpoint,
-        gateway.connect_options("lightspeed-environment-job-workflow"),
-    )
-    .await
-    .map_err(activity_error)?;
-    let response = client
-        .initialize(&InitializeParams {
-            protocol_version: CURRENT_PROTOCOL_VERSION,
-            client_name: "lightspeed-environment-job-workflow".to_owned(),
-            scope: connection.scope.clone(),
-            resume_connection_id: None,
-        })
-        .await
-        .map_err(activity_error)?;
-    if response.protocol_version != CURRENT_PROTOCOL_VERSION {
-        return Err(activity_error(anyhow::anyhow!(
-            "unsupported environment protocol version {}",
-            response.protocol_version
+}
+
+fn is_transient(error: &ClientError) -> bool {
+    error.is_retryable()
+        || matches!(
+            error,
+            ClientError::Decode(_) | ClientError::InvalidMessage(_)
+        )
+        || error.protocol_kind() == Some(ProtocolErrorKind::Internal)
+}
+
+fn non_retryable_activity_error(error: impl Into<anyhow::Error>) -> ActivityError {
+    ActivityError::application(ApplicationFailure::non_retryable(error.into()))
+}
+
+#[cfg(test)]
+mod tests {
+    use environment_protocol::error::PreconditionReason;
+
+    use super::*;
+
+    fn submitted_spec() -> JobSpec {
+        JobSpec {
+            job_id: JobId::new("build").unwrap(),
+            name: Some(JobName::new("build & test").unwrap()),
+            command: CommandSpec {
+                argv: vec!["make".to_owned(), "test".to_owned()],
+                cwd: Some(EnvironmentPath::new("/workspace").unwrap()),
+                env: BTreeMap::from([("CI".to_owned(), "1".to_owned())]),
+                secret_env: BTreeMap::new(),
+                input: ExecInput::Bytes {
+                    data: ByteChunk::from(b"input".to_vec()),
+                },
+                timeout_ms: Some(1_000),
+            },
+            depends_on: vec![
+                JobDependency::JobId {
+                    job_id: JobId::new("setup").unwrap(),
+                },
+                JobDependency::Name {
+                    name: JobName::new("lint").unwrap(),
+                },
+            ],
+            dependency_policy: JobDependencyPolicy::AllTerminal,
+            queue_key: Some(QueueKey::new("ci").unwrap()),
+        }
+    }
+
+    #[test]
+    fn stored_specs_map_back_onto_the_wire_unchanged() {
+        let spec = submitted_spec();
+        let stored = workflow_job_spec(spec.clone()).unwrap();
+        assert_eq!(stored.command.stdin.as_deref(), Some("input"));
+        assert_eq!(stored.command.cwd.as_deref(), Some("/workspace"));
+        assert_eq!(wire_job_spec(stored).unwrap(), spec);
+    }
+
+    #[test]
+    fn stored_specs_never_hold_secrets_or_pipes() {
+        let mut secret = submitted_spec();
+        secret
+            .command
+            .secret_env
+            .insert("TOKEN".to_owned(), "value".into());
+        assert!(workflow_job_spec(secret).is_err());
+        let mut piped = submitted_spec();
+        piped.command.input = ExecInput::Pipe {};
+        assert!(workflow_job_spec(piped).is_err());
+    }
+
+    #[test]
+    fn invalid_stored_ids_are_refused_at_the_wire_boundary() {
+        let mut stored = workflow_job_spec(submitted_spec()).unwrap();
+        stored.job_id = EnvironmentJobId::new("not a job id");
+        assert!(wire_job_spec(stored).is_err());
+    }
+
+    #[test]
+    fn request_ids_fit_the_id_grammar_for_any_call_id() {
+        assert_eq!(
+            workflow_tool_request_id(1, 2, 3, "toolu_01").as_str(),
+            "jobreq:1:2:3:toolu_01"
+        );
+        let hashed = workflow_tool_request_id(1, 2, 3, "call id/with spaces");
+        assert!(hashed.as_str().starts_with("jobreq-"));
+        assert_eq!(
+            hashed,
+            workflow_tool_request_id(1, 2, 3, "call id/with spaces")
+        );
+        assert!(
+            derived_job_run_id("invocation")
+                .as_str()
+                .starts_with("job-")
+        );
+    }
+
+    #[test]
+    fn job_group_ids_follow_the_encoded_payload() {
+        let environment_id = EnvironmentId::new("environment_1");
+        let payload = EnvironmentJobStartPayloadV1::new(
+            "jobreq:1:1:1:call",
+            vec![workflow_job_spec(submitted_spec()).unwrap()],
+        );
+        let encoded = payload.encode().unwrap();
+        let first = derived_job_group_id(&environment_id, &BlobRef::from_bytes(&encoded));
+        assert_eq!(
+            first,
+            derived_job_group_id(&environment_id, &BlobRef::from_bytes(&encoded))
+        );
+        let other = EnvironmentJobStartPayloadV1::new("jobreq:1:1:1:other", payload.jobs.clone());
+        assert_ne!(
+            first,
+            derived_job_group_id(
+                &environment_id,
+                &BlobRef::from_bytes(&other.encode().unwrap())
+            )
+        );
+    }
+
+    #[test]
+    fn not_found_entries_become_lost_observations() {
+        let job_id = JobId::new("build").unwrap();
+        assert_eq!(
+            entry_error_observation(&job_id, ProtocolError::not_found("unknown job")).unwrap(),
+            EnvironmentJobObservation::NotFound {
+                job_id: EnvironmentJobId::new("build")
+            }
+        );
+        assert!(entry_error_observation(&job_id, ProtocolError::internal("broken")).is_err());
+    }
+
+    #[test]
+    fn refusals_are_terminal_and_transport_trouble_is_retried() {
+        let retryable = |error: ClientError| is_transient(&error);
+        assert!(!retryable(ClientError::Protocol(
+            ProtocolError::failed_precondition(PreconditionReason::JobIdInUse, "job id in use")
+        )));
+        assert!(!retryable(ClientError::Protocol(
+            ProtocolError::invalid_params("bad")
         )));
+        assert!(retryable(ClientError::Protocol(
+            ProtocolError::unavailable("daemon restarting")
+        )));
+        assert!(retryable(ClientError::Protocol(ProtocolError::internal(
+            "bug"
+        ))));
+        assert!(retryable(ClientError::Connect {
+            endpoint: "ws://gateway.test".to_owned(),
+            message: "refused".to_owned(),
+        }));
+        assert!(retryable(ClientError::DeadlineExceeded {
+            elapsed_ms: 60_000
+        }));
+    }
+
+    #[test]
+    fn daemon_summaries_map_onto_workflow_records() {
+        let summary: JobSummary = serde_json::from_value(serde_json::json!({
+            "jobId": "build",
+            "requestId": "jobreq:1:1:1:call",
+            "name": "build",
+            "status": "timedOut",
+            "dependsOn": ["setup"],
+            "queueKey": "ci",
+            "createdAtMs": 1,
+            "stoppedBy": "timeout",
+        }))
+        .unwrap();
+        assert_eq!(
+            job_record(&summary),
+            EnvironmentJobRecord {
+                job_id: EnvironmentJobId::new("build"),
+                name: Some("build".to_owned()),
+                status: EnvironmentJobStatus::TimedOut,
+                depends_on: vec![EnvironmentJobId::new("setup")],
+                queue_key: Some("ci".to_owned()),
+            }
+        );
     }
-    let capabilities = response.capabilities;
-    client
-        .initialized(&InitializedParams {})
-        .await
-        .map_err(activity_error)?;
-    Ok((client, capabilities))
 }
diff --git a/crates/temporal-runtime/src/worker/activities/mod.rs b/crates/temporal-runtime/src/worker/activities/mod.rs
index 659f12b0b..ebd67a6c8 100644
--- a/crates/temporal-runtime/src/worker/activities/mod.rs
+++ b/crates/temporal-runtime/src/worker/activities/mod.rs
@@ -708,7 +708,7 @@ impl WorkerActivities {
         self: Arc<Self>,
         _ctx: ActivityContext,
         request: EnvironmentJobCancelActivityRequest,
-    ) -> Result<Vec<environment_protocol::data::jobs::JobSummary>, ActivityError> {
+    ) -> Result<temporal_workflow::EnvironmentJobCancelActivityResult, ActivityError> {
         let state = self.state_for_universe(request.universe_id).await?;
         environment_jobs::cancel(state.environment_jobs(), request).await
     }
diff --git a/crates/temporal-runtime/src/worker/session_tools.rs b/crates/temporal-runtime/src/worker/session_tools.rs
index 0b0369a12..0c9132aa5 100644
--- a/crates/temporal-runtime/src/worker/session_tools.rs
+++ b/crates/temporal-runtime/src/worker/session_tools.rs
@@ -1,13 +1,10 @@
 use std::{collections::BTreeMap, sync::Arc};
 
 use async_trait::async_trait;
-use environment_client::{EnvironmentClientError, EnvironmentDataClient, WebSocketConnectOptions};
+use environment_client::{ClientError, DataClient};
 use environment_protocol::{
-    data::{
-        handshake::{InitializeParams, InitializedParams},
-        jobs::{JobReadResult as ProtocolJobReadResult, ReadJobsParams},
-    },
-    shared::{CURRENT_PROTOCOL_VERSION, EnvironmentDataConnection, EnvironmentTransport},
+    data::fs::{FileKind, GetMetadataParams},
+    paths::EnvironmentPath,
 };
 use environments::{EnvironmentId, EnvironmentRecord, EnvironmentRegistryError, EnvironmentStore};
 use harness::PromiseIdAllocator;
@@ -32,10 +29,10 @@ use tools::{
         is_environment_selection_tool,
     },
     environment::jobs::{
-        JOB_RUN_WORKFLOW_SEMANTIC_TYPE, JOB_RUN_WORKFLOW_TOOL_ID,
+        DEFAULT_JOB_OUTPUT_BYTES, JOB_RUN_WORKFLOW_SEMANTIC_TYPE, JOB_RUN_WORKFLOW_TOOL_ID,
         JOB_SUBMIT_WORKFLOW_SEMANTIC_TYPE, JOB_SUBMIT_WORKFLOW_TOOL_ID, JobHandle, JobHandleArg,
         JobReadArgs, JobSubmitExecutionContextV1, ModelJobResult, ModelJobResultSet,
-        NormalizeJobResultInput, normalize_job_result,
+        NormalizeJobResultInput, job_output_read, model_job_error, normalize_job_result,
     },
     environment_protocol::RemoteEnvironmentConnection,
     fs::{AttachedVfsFileSystem, FsPath, FsToolContext},
@@ -417,8 +414,7 @@ impl SessionTools {
                         environments,
                         args.jobs,
                         args.output_bytes,
-                        args.after_seq,
-                        args.include_artifacts,
+                        args.after,
                     )
                     .await?;
                 self.succeeded_job_read_result(call, result.entries).await
@@ -442,10 +438,12 @@ impl SessionTools {
         policy: Option<&harness::EnvironmentsFeature>,
         environments: &SessionEnvironmentManager,
         handles: Vec<JobHandleArg>,
-        output_bytes: Option<usize>,
-        after_seq: Option<u64>,
-        include_artifacts: bool,
+        output_bytes: Option<u64>,
+        after: Option<u64>,
     ) -> Result<EnvironmentJobRead, CoreAgentIoError> {
+        let output_bytes = output_bytes
+            .unwrap_or(DEFAULT_JOB_OUTPUT_BYTES)
+            .min(ToolLimits::default().max_model_visible_output_bytes);
         let mut entries = Vec::with_capacity(handles.len());
         for handle in handles {
             let resolved = match resolve_job_handle_arg(active_environment_id, policy, handle) {
@@ -517,26 +515,26 @@ impl SessionTools {
                 }
                 continue;
             };
+            // The head and the tail of the output, or a page from `after`,
+            // within the daemon's read ceiling.
+            let budget = jobs.limits().map_or(output_bytes, |limits| {
+                output_bytes.min(limits.max_read_bytes)
+            });
             match jobs
-                .read_jobs(ReadJobsParams {
-                    namespace: environment_id.as_str().to_owned(),
-                    jobs: vec![resolved.job_id.clone()],
-                    after_seq,
-                    max_bytes: output_bytes,
-                    include_artifacts,
-                    wait_ms: None,
-                })
+                .read_jobs(job_output_read(
+                    std::slice::from_ref(&resolved.job_id),
+                    after,
+                    budget,
+                ))
                 .await
             {
                 Ok(response) => {
+                    let input =
+                        NormalizeJobResultInput::from_entries(Some(resolved), response.jobs);
                     entries.push(
-                        job_read_entry_from_response(
-                            self.blobs.as_ref(),
-                            resolved,
-                            response.jobs.into_iter().next(),
-                            output_bytes,
-                        )
-                        .await?,
+                        normalize_job_result(self.blobs.as_ref(), input)
+                            .await
+                            .map_err(map_blob_error)?,
                     );
                 }
                 Err(error) => {
@@ -1276,66 +1274,28 @@ impl SessionTools {
             .environment_gateway
             .as_ref()
             .ok_or_else(|| io_error("environment gateway is not configured on this worker"))?;
-        let connection = gateway.connection_for(
+        let endpoint = gateway.endpoint_for(
             self.environment_resolver
                 .as_ref()
                 .map(|resolver| resolver.universe_id())
                 .unwrap_or_default(),
             &resource,
         );
-        let mut client = connect_environment_data_client(
-            &connection,
+        let (client, _) = DataClient::connect_initialized(
+            &endpoint,
             gateway.connect_options("lightspeed-temporal-runtime"),
         )
-        .await?;
-        let response = client
-            .initialize(&InitializeParams {
-                protocol_version: CURRENT_PROTOCOL_VERSION,
-                client_name: "lightspeed-temporal-runtime".to_owned(),
-                scope: connection.scope.clone(),
-                resume_connection_id: None,
-            })
-            .await
-            .map_err(map_environment_client_error)?;
-        if response.protocol_version != CURRENT_PROTOCOL_VERSION {
-            return Err(io_error(format!(
-                "unsupported environment data protocol version {}; expected {CURRENT_PROTOCOL_VERSION}",
-                response.protocol_version
-            )));
-        }
-        client
-            .initialized(&InitializedParams {})
-            .await
-            .map_err(map_environment_client_error)?;
-        let cwd = if response.capabilities.filesystem_read {
-            match crate::environments::sources::working_directory(
-                &mut client,
-                working_directory,
-                response.default_cwd.as_deref(),
-            )
-            .await
-            {
-                Ok(cwd) => cwd,
-                Err(error) => {
-                    let _ = client.close().await;
-                    return Err(io_error(error));
-                }
+        .await
+        .map_err(map_environment_client_error)?;
+        let cwd = match environment_working_directory(&client, working_directory).await {
+            Ok(cwd) => cwd,
+            Err(error) => {
+                let _ = client.close().await;
+                return Err(io_error(error));
             }
-        } else {
-            let cwd = working_directory
-                .or(response.default_cwd.as_deref())
-                .ok_or_else(|| io_error("environment has no working directory"))?;
-            tools::environment::sources::absolute(std::path::Path::new("/"), cwd)
-                .map_err(io_error)?
-                .to_string_lossy()
-                .into_owned()
         };
-        let cwd = Some(FsPath::new(cwd).map_err(io_error)?);
-
-        let mut remote_connection = RemoteEnvironmentConnection::new(client, response.capabilities);
-        if let Some(cwd) = cwd {
-            remote_connection = remote_connection.with_cwd(cwd);
-        }
+        let remote_connection = RemoteEnvironmentConnection::new(client)
+            .with_cwd(FsPath::new(cwd.as_str()).map_err(io_error)?);
         let (_fs_context, mut environment_context) =
             remote_connection.clone().into_contexts(self.blobs.clone());
         if let Some(credentials) = &self.environment_credentials {
@@ -1571,73 +1531,46 @@ fn supplied_environment_policy(
         .ok_or_else(|| io_error("environment grant is missing from the batch request"))
 }
 
-async fn job_read_entry_from_response(
-    blobs: &dyn BlobStore,
-    handle: JobHandle,
-    response: Option<ProtocolJobReadResult>,
-    output_bytes: Option<usize>,
-) -> Result<ModelJobResult, CoreAgentIoError> {
-    match response {
-        Some(response) => normalize_job_result(
-            blobs,
-            NormalizeJobResultInput {
-                handle: Some(handle),
-                summary: Some(response.summary),
-                output_chunks: response.output_chunks,
-                output_next_seq: response.output_next_seq,
-                artifacts: response.artifacts,
-                output_bytes,
-                ..Default::default()
-            },
-        )
-        .await
-        .map_err(map_blob_error),
-        None => Ok(model_job_error(
-            Some(handle),
-            "provider returned no job result".to_owned(),
-        )),
-    }
-}
-
-fn model_job_error(handle: Option<JobHandle>, error: String) -> ModelJobResult {
-    ModelJobResult {
-        handle: handle.map(|mut handle| {
-            handle.environment_id =
-                tools::environment::handles::environment_handle(&handle.environment_id);
-            handle
-        }),
-        summary: None,
-        output: Vec::new(),
-        output_next_seq: 0,
-        truncated: false,
-        artifacts: Vec::new(),
-        error: Some(error),
-    }
-}
-
-async fn connect_environment_data_client(
-    connection: &EnvironmentDataConnection,
-    options: WebSocketConnectOptions,
-) -> Result<EnvironmentDataClient<environment_client::WebSocketTransport>, CoreAgentIoError> {
-    match &connection.transport {
-        EnvironmentTransport::WebSocket => {
-            EnvironmentDataClient::connect(&connection.endpoint, options)
-                .await
-                .map_err(map_environment_client_error)
+/// The session's working directory in the environment: the attachment's
+/// configured one, else the daemon's `defaultCwd`. It must be a directory,
+/// a symlink to one inside the fs root included; a daemon without the
+/// filesystem family cannot be asked, so its directory is taken as given.
+async fn environment_working_directory(
+    client: &DataClient,
+    configured: Option<&str>,
+) -> Result<EnvironmentPath, String> {
+    let initialized = client.initialize_response();
+    let cwd = match configured {
+        Some(value) => {
+            if !value.starts_with('/') {
+                return Err(format!(
+                    "environment working directory must be absolute: {value}"
+                ));
+            }
+            let normalized =
+                tools::environment::sources::absolute(std::path::Path::new("/"), value)?;
+            EnvironmentPath::new(normalized.to_string_lossy())
+                .map_err(|error| format!("environment working directory {value}: {error}"))?
         }
-        EnvironmentTransport::Http => Err(unsupported_environment_data_transport("http")),
-        EnvironmentTransport::Stdio => Err(unsupported_environment_data_transport("stdio")),
-        EnvironmentTransport::Ssh => Err(unsupported_environment_data_transport("ssh")),
-        EnvironmentTransport::Provider { provider_type } => Err(
-            unsupported_environment_data_transport(format!("provider:{provider_type}")),
-        ),
+        None => initialized.default_cwd.clone(),
+    };
+    if initialized.capabilities.filesystem.is_none() {
+        return Ok(cwd);
     }
-}
-
-fn unsupported_environment_data_transport(transport: impl std::fmt::Display) -> CoreAgentIoError {
-    io_error(format!(
-        "environment data transport is not supported by this worker: {transport}"
-    ))
+    let response = client
+        .get_metadata(&GetMetadataParams {
+            path: cwd.clone(),
+            follow_symlinks: true,
+        })
+        .await
+        .map_err(|error| format!("working directory {}: {error}", cwd.as_str()))?;
+    if response.metadata.kind != FileKind::Directory {
+        return Err(format!(
+            "working directory is not a directory: {}",
+            cwd.as_str()
+        ));
+    }
+    Ok(cwd)
 }
 
 #[derive(Clone, Copy)]
@@ -2302,7 +2235,7 @@ fn map_environments_error(error: EnvironmentRegistryError) -> CoreAgentIoError {
     io_error(format!("load session environment bindings: {error}"))
 }
 
-fn map_environment_client_error(error: EnvironmentClientError) -> CoreAgentIoError {
+fn map_environment_client_error(error: ClientError) -> CoreAgentIoError {
     io_error(format!("environment data-plane call failed: {error}"))
 }
 
@@ -2335,9 +2268,9 @@ mod tests {
     use tools::environment::control::ENVIRONMENT_LIST_TOOL_NAME;
 
     use crate::environments::runtime::RuntimeEnvironment;
-    use environment_protocol::shared::{EnvironmentTransport, ProviderTargetId};
+    use environment_protocol::ids::{JobId, ProviderTargetId};
     use environments::{
-        CreateEnvironment, EnvironmentConnectionSpec, EnvironmentIncarnationId,
+        CreateEnvironment, EnvironmentEndpoint, EnvironmentIncarnationId,
         EnvironmentIncarnationRecord, EnvironmentProviderBindingId,
         EnvironmentProviderBindingStatus, EnvironmentProviderBindingStore, EnvironmentProviderId,
         EnvironmentProviderStore, EnvironmentProvisionRequestId, EnvironmentSource,
@@ -4256,7 +4189,7 @@ mod tests {
         blobs: Arc<InMemoryBlobStore>,
         process: Arc<RecordingProcessExecutor>,
     ) -> RuntimeEnvironment {
-        let target_id = ProviderTargetId::new("test");
+        let target_id = ProviderTargetId::new("test").unwrap();
         let resource = environments::EnvironmentRecord {
             environment_id: harness::EnvironmentId::new("test"),
             request_id: EnvironmentProvisionRequestId::new("request-test"),
@@ -4282,6 +4215,7 @@ mod tests {
             public_endpoint: None,
             metadata: BTreeMap::new(),
             last_seen_at_ms: None,
+            lifecycle_error: None,
             created_at_ms: 1,
             updated_at_ms: 1,
         };
@@ -4298,23 +4232,31 @@ mod tests {
     #[cfg(any(target_os = "linux", target_os = "macos"))]
     mod transfers {
         use super::*;
-        use environment_protocol::data::transfer_session::{TransferRequest, TransferResponse};
-
-        struct LocalTransfer(environment_daemon::filesystem::LocalFileSystem);
-
-        #[async_trait]
-        impl tools::transfer::EnvironmentTransfer for LocalTransfer {
-            async fn request(
-                &self,
-                request: TransferRequest,
-            ) -> tools::ToolResult<TransferResponse> {
-                self.0
-                    .transfer(request)
-                    .await
-                    .map_err(|error| tools::ToolError::InvalidRequest {
-                        message: error.message,
-                    })
-            }
+        use environment_protocol::handshake::ImplementationInfo;
+
+        /// envd's data plane over an in-process socket, rooted at `root`
+        /// with its state dir beside it.
+        async fn in_process_envd(root: &std::path::Path, state: &std::path::Path) -> DataClient {
+            let runtime =
+                environment_daemon::DaemonRuntime::new(environment_daemon::config::DaemonConfig {
+                    listen: None,
+                    cwd: root.into(),
+                    fs_root: root.into(),
+                    state_dir: state.into(),
+                    read_only_fs: false,
+                    registration: None,
+                    scrubbed_env: Vec::new(),
+                })
+                .expect("envd runtime");
+            let (client_io, server_io) = tokio::io::duplex(1 << 20);
+            tokio::spawn(environment_daemon::server::serve_stream(runtime, server_io));
+            let options = environment_client::ConnectOptions::new(
+                ImplementationInfo::new("session-tools-test").expect("client info"),
+            );
+            DataClient::connect_initialized_over(client_io, options)
+                .await
+                .expect("connect to in-process envd")
+                .0
         }
 
         async fn dispatch(
@@ -4368,19 +4310,19 @@ mod tests {
                 ] {
                     let (blobs, tools, session_id, workspace_attachments) =
                         session_tools_with_readme_attachment().await;
-                    let root = tempfile::tempdir().unwrap();
-                    let fs = environment_daemon::filesystem::LocalFileSystem::new(
-                        root.path().into(),
-                        root.path().into(),
-                        true,
-                    );
+                    let temp = tempfile::tempdir().unwrap();
+                    let root = temp.path().canonicalize().unwrap().join("root");
+                    std::fs::create_dir_all(&root).unwrap();
+                    let client =
+                        in_process_envd(&root, &temp.path().canonicalize().unwrap().join("state"))
+                            .await;
                     let environment = test_environment(
                         blobs.clone(),
                         Arc::new(RecordingProcessExecutor::default()),
                     );
                     let mut context = environment.tool_context().clone();
-                    context.process_cwd = Some(FsPath::new(root.path().to_string_lossy()).unwrap());
-                    context.transfer = Some(Arc::new(LocalTransfer(fs)));
+                    context.process_cwd = Some(FsPath::new(root.to_string_lossy()).unwrap());
+                    context.transfer = Some(Arc::new(client));
                     let environment =
                         RuntimeEnvironment::from_resource(environment.resource().clone(), context);
                     let tools = tools
@@ -4403,20 +4345,17 @@ mod tests {
                     let result = dispatch(&tools, request.clone(), batch).await;
                     succeeded(&blobs, &result).await;
                     assert_eq!(
-                        std::fs::read(root.path().join("created/nested/README.md")).unwrap(),
+                        std::fs::read(root.join("created/nested/README.md")).unwrap(),
                         b"hello\n"
                     );
 
                     // A completed retry through the hosted path must keep its operation
                     // identity and preserve edits made after publication.
-                    std::fs::write(
-                        root.path().join("created/nested/README.md"),
-                        b"environment edit",
-                    )
-                    .unwrap();
+                    std::fs::write(root.join("created/nested/README.md"), b"environment edit")
+                        .unwrap();
                     succeeded(&blobs, &dispatch(&tools, request.clone(), batch).await).await;
                     assert_eq!(
-                        std::fs::read(root.path().join("created/nested/README.md")).unwrap(),
+                        std::fs::read(root.join("created/nested/README.md")).unwrap(),
                         b"environment edit"
                     );
 
@@ -4511,11 +4450,10 @@ mod tests {
             .put_provider(PutEnvironmentProvider {
                 provider_id: EnvironmentProviderId::new(provider_id),
                 display_name: None,
-                controller_connection: EnvironmentConnectionSpec::new(
-                    "http://controller.test",
-                    EnvironmentTransport::Http,
-                ),
+                controller_endpoint: EnvironmentEndpoint::parse("ws://controller.test/control")
+                    .unwrap(),
                 metadata: BTreeMap::new(),
+                credential: Some(auth::SecretValue::new("provider-credential")),
                 updated_at_ms: 10,
             })
             .await
@@ -4540,7 +4478,7 @@ mod tests {
         provider_id: &str,
         observed_at_ms: i64,
     ) {
-        let target_id = ProviderTargetId::new(format!("target-{environment_id}"));
+        let target_id = ProviderTargetId::new(format!("target-{environment_id}")).unwrap();
         let environment_id = EnvironmentId::new(environment_id);
         store
             .create_environment(CreateEnvironment {
@@ -4562,9 +4500,10 @@ mod tests {
         store
             .observe_provisioned_environment(ObserveProvisionedEnvironment {
                 environment_id,
-                provider_target_id: target_id,
+                provider_target_id: Some(target_id),
                 status: EnvironmentStatus::Offline,
                 power_states: Vec::new(),
+                daemon_build: None,
                 observed_at_ms,
             })
             .await
@@ -4619,9 +4558,12 @@ mod tests {
             registry
                 .observe_provisioned_environment(ObserveProvisionedEnvironment {
                     environment_id: environment_id.clone(),
-                    provider_target_id: ProviderTargetId::new("target-environment-allowed-1"),
+                    provider_target_id: Some(
+                        ProviderTargetId::new("target-environment-allowed-1").unwrap(),
+                    ),
                     status,
                     power_states,
+                    daemon_build: None,
                     observed_at_ms: 11,
                 })
                 .await
@@ -4723,7 +4665,7 @@ mod tests {
             Some(&policy),
             JobHandleArg {
                 environment_id: Some(handle.into()),
-                job_id: environment_protocol::shared::JobId::new("build"),
+                job_id: JobId::new("build").unwrap(),
             },
         )
         .unwrap();
@@ -4744,7 +4686,7 @@ mod tests {
                 Some(&test_environment_policy(&["other"])),
                 JobHandleArg {
                     environment_id: Some(handle.into()),
-                    job_id: environment_protocol::shared::JobId::new("build"),
+                    job_id: JobId::new("build").unwrap(),
                 }
             )
             .is_err()
@@ -4901,9 +4843,10 @@ mod tests {
         registry
             .observe_provisioned_environment(ObserveProvisionedEnvironment {
                 environment_id: EnvironmentId::new("environment-pending"),
-                provider_target_id: ProviderTargetId::new("target-pending"),
+                provider_target_id: Some(ProviderTargetId::new("target-pending").unwrap()),
                 status: EnvironmentStatus::Ready,
                 power_states: Vec::new(),
+                daemon_build: None,
                 observed_at_ms: 20,
             })
             .await
@@ -4937,6 +4880,7 @@ mod tests {
             .fail_environment_lifecycle(environments::FailEnvironmentLifecycle {
                 environment_id: EnvironmentId::new("environment-failed"),
                 message: "no capacity".to_owned(),
+                daemon_build: None,
                 observed_at_ms: 11,
             })
             .await
@@ -5742,7 +5686,7 @@ mod tests {
             ])),
             JobHandleArg {
                 environment_id: None,
-                job_id: environment_protocol::shared::JobId::new("build"),
+                job_id: JobId::new("build").unwrap(),
             },
         )
         .expect("defaults to the active environment");
@@ -5757,7 +5701,7 @@ mod tests {
             ])),
             JobHandleArg {
                 environment_id: Some("environment_other".to_owned()),
-                job_id: environment_protocol::shared::JobId::new("build"),
+                job_id: JobId::new("build").unwrap(),
             },
         )
         .expect("explicit environment wins");
@@ -5769,7 +5713,7 @@ mod tests {
                 None,
                 JobHandleArg {
                     environment_id: None,
-                    job_id: environment_protocol::shared::JobId::new("build"),
+                    job_id: JobId::new("build").unwrap(),
                 },
             )
             .is_err(),
diff --git a/crates/temporal-runtime/tests/code_capabilities_live.rs b/crates/temporal-runtime/tests/code_capabilities_live.rs
index 328f22ff1..1ac73f4b4 100644
--- a/crates/temporal-runtime/tests/code_capabilities_live.rs
+++ b/crates/temporal-runtime/tests/code_capabilities_live.rs
@@ -313,6 +313,7 @@ where
     let mut tasks = Tasks(vec![task.abort_handle()]);
     let directory = tempfile::tempdir()?;
     let root = directory.path().canonicalize()?;
+    let daemon_state = tempfile::tempdir()?;
     let context = support::live::local_request_context_for(api::AccessScope::Universe {
         universe_id: universe,
     })
@@ -326,11 +327,11 @@ where
                 display_name:"Code capability test".into(), identity_mode:api::EnvironmentIdentityModeView::Ephemeral,
                 max_active_environments:Some(1), ephemeral_disconnect_grace_ms:None, expires_at_ms:None,
             }).await?.result;
-            let connect_url = format!("ws://{address}/environment-gateway/connect");
+            let connect_url = format!("ws://{address}{}", environment_protocol::routes::CONNECT_PATH);
             let mut registration = environment_daemon::config::RegistrationConfig::new(connect_url.clone(), environment_daemon::upgrade::resolve_discovery_url(Some(&connect_url), None)?);
-            registration.registration_key = Some(environment_protocol::shared::SecretString::new(key.secret.0));
+            registration.registration_key = Some(environment_protocol::bytes::SecretString::new(key.secret.0));
             let daemon = environment_daemon::DaemonRuntime::new(environment_daemon::config::DaemonConfig {
-                listen:None, cwd:root.clone(), fs_root:root.clone(), state_dir:root.join(".envd"), read_only_fs:false, registration:Some(registration), scrubbed_env:vec![],
+                listen:None, cwd:root.clone(), fs_root:root.clone(), state_dir:daemon_state.path().into(), read_only_fs:false, registration:Some(registration), scrubbed_env:vec![],
             })?;
             let task = tokio::spawn(environment_daemon::server::run(daemon));
             tasks.0.push(task.abort_handle());
@@ -643,9 +644,11 @@ async fn jobs_and_subagents_case(fixture: Fixture) -> anyhow::Result<()> {
                 .as_ref()
                 .is_some_and(|handle| handle.environment_id
                     == tools::environment::handles::environment_handle(environment))
-                && actual.summary.as_ref().is_some_and(|summary| summary.status
-                    == environment_protocol::data::jobs::JobStatus::Succeeded
-                    && &summary.namespace == environment),
+                && actual
+                    .summary
+                    .as_ref()
+                    .is_some_and(|summary| summary.status
+                        == tools::environment::jobs::ModelJobStatus::Succeeded),
             "job must finish on the admitted environment: {actual:?}"
         );
     }
diff --git a/crates/temporal-runtime/tests/environment_provider_live.rs b/crates/temporal-runtime/tests/environment_provider_live.rs
index 6f2c35b1b..ba421c6a8 100644
--- a/crates/temporal-runtime/tests/environment_provider_live.rs
+++ b/crates/temporal-runtime/tests/environment_provider_live.rs
@@ -1,9 +1,10 @@
 //! Minimal live environment control-plane acceptance test.
 //!
-//! This deliberately uses the in-process provider with real Postgres and the
-//! real deployment reconciler. It covers the durable provider and ingress seams
-//! without requiring an Incus installation; the separate Incus live smoke test
-//! owns backend connectivity and topology.
+//! This deliberately uses the fake controller, served on loopback and
+//! registered like any provider, with real Postgres and the real deployment
+//! reconciler. It covers the durable provider and ingress seams without
+//! requiring an Incus installation; the separate Incus live smoke test owns
+//! backend connectivity and topology.
 
 mod support;
 
@@ -11,8 +12,7 @@ use std::{collections::BTreeMap, sync::Arc, time::Duration};
 
 use api::{
     AgentApiService, DeploymentApiService, DeploymentEnvironmentAdoptParams,
-    DeploymentEnvironmentProviderConnection, DeploymentEnvironmentProviderDeleteParams,
-    DeploymentEnvironmentProviderPutParams, DeploymentEnvironmentProviderTransport,
+    DeploymentEnvironmentProviderDeleteParams, DeploymentEnvironmentProviderPutParams,
     DeploymentProviderBindingPutParams, DeploymentUniverseCreateParams, EnvironmentCloseParams,
     EnvironmentCreateParams, EnvironmentIngressPutParams, EnvironmentLifecycleStatusView,
     EnvironmentListParams, EnvironmentProviderBindingStatusView, EnvironmentTemplateListParams,
@@ -26,6 +26,7 @@ use support::live::{
 };
 use temporal_runtime::{
     DeploymentStores, UniverseRuntime,
+    environments::fake_controller::{FAKE_INGRESS_ENDPOINT, FAKE_TEMPLATE_ID, FakeController},
     gateway::{GatewayAgentApi, GatewayDeploymentApi},
     pg_store_from_env,
 };
@@ -57,6 +58,7 @@ async fn environment_provider_lifecycle_and_adoption_round_trip() -> anyhow::Res
         stores,
     )?);
     let operator = GatewayDeploymentApi::new(runtime.clone());
+    let controller = FakeController::start().await?;
     let reconciler = tokio::spawn(runtime.clone().run_environment_reconciler());
     // Direct service calls carry an explicit local request context.
     use temporal_runtime::gateway::request_context::{
@@ -80,16 +82,46 @@ async fn environment_provider_lifecycle_and_adoption_round_trip() -> anyhow::Res
             operator.put_environment_provider(DeploymentEnvironmentProviderPutParams {
                 provider_id: provider_id.clone(),
                 display_name: Some("Live fake provider".to_owned()),
-                controller_connection: DeploymentEnvironmentProviderConnection {
-                    endpoint: "in-process".to_owned(),
-                    transport: DeploymentEnvironmentProviderTransport::Provider {
-                        provider_type: "fake".to_owned(),
-                    },
-                },
+                controller_endpoint: controller.controller_url().to_owned(),
                 metadata: BTreeMap::new(),
+                credential: Some(controller.credential().to_owned()),
             }),
         )
         .await?;
+        // Registration ran the controller handshake and recorded its facts.
+        let registered = calling(
+            deployment_caller.clone(),
+            operator.read_environment_provider(api::DeploymentEnvironmentProviderReadParams {
+                provider_id: provider_id.clone(),
+            }),
+        )
+        .await?
+        .result
+        .provider;
+        assert_eq!(
+            registered.controller_features,
+            Some(api::DeploymentEnvironmentProviderFeaturesView {
+                adopt_target: true,
+                ingress: true,
+            })
+        );
+        assert!(registered.data_route_base.is_some());
+        // A controller URL that names no controller is refused outright.
+        let mispathed = calling(
+            deployment_caller.clone(),
+            operator.put_environment_provider(DeploymentEnvironmentProviderPutParams {
+                provider_id: format!("{provider_id}-mispathed"),
+                display_name: None,
+                controller_endpoint: controller
+                    .controller_url()
+                    .replace("/control", "/elsewhere"),
+                metadata: BTreeMap::new(),
+                credential: Some(controller.credential().to_owned()),
+            }),
+        )
+        .await
+        .expect_err("a mis-pathed controller URL is refused");
+        assert_eq!(mispathed.kind, api::AgentApiErrorKind::InvalidRequest);
         for (universe_id, binding_id) in [(universe_a, "primary-a"), (universe_b, "primary-b")] {
             calling(
                 deployment_caller.clone(),
@@ -123,14 +155,15 @@ async fn environment_provider_lifecycle_and_adoption_round_trip() -> anyhow::Res
         )
         .await?;
         assert_eq!(templates.result.templates.len(), 1);
-        assert_eq!(templates.result.templates[0].template_id, "rust-v1");
+        assert_eq!(templates.result.templates[0].template_id, FAKE_TEMPLATE_ID);
+        assert!(templates.result.templates[0].resources.is_some());
 
         let created = calling(
             caller_a.clone(),
             state_a.api.create_environment(EnvironmentCreateParams {
                 request_id: format!("create-{suffix}"),
                 binding_id: "primary-a".to_owned(),
-                template_id: "rust-v1".to_owned(),
+                template_id: FAKE_TEMPLATE_ID.to_owned(),
                 display_name: Some("Provisioned live VM".to_owned()),
                 metadata: BTreeMap::new(),
                 idle_policy: None,
@@ -144,7 +177,7 @@ async fn environment_provider_lifecycle_and_adoption_round_trip() -> anyhow::Res
             state_a.api.create_environment(EnvironmentCreateParams {
                 request_id: format!("create-{suffix}"),
                 binding_id: "primary-a".to_owned(),
-                template_id: "rust-v1".to_owned(),
+                template_id: FAKE_TEMPLATE_ID.to_owned(),
                 display_name: None,
                 metadata: BTreeMap::new(),
                 idle_policy: None,
@@ -208,6 +241,19 @@ async fn environment_provider_lifecycle_and_adoption_round_trip() -> anyhow::Res
         .await?;
         assert!(created_ready.incarnation.provider_target_id.is_some());
         assert!(adopted_ready.incarnation.provider_target_id.is_some());
+        // The Ready transition ran the data-plane handshake and recorded the
+        // daemon's protocol version.
+        assert_eq!(
+            created_ready
+                .metadata
+                .get(environments::ENVD_PROTOCOL_VERSION_METADATA_KEY)
+                .map(String::as_str),
+            Some(
+                environment_protocol::ENVD_PROTOCOL_VERSION
+                    .to_string()
+                    .as_str()
+            )
+        );
 
         let listed_a = calling(
             caller_a.clone(),
@@ -236,10 +282,17 @@ async fn environment_provider_lifecycle_and_adoption_round_trip() -> anyhow::Res
                 }),
         )
         .await?;
-        assert_eq!(
-            ingress.result.environment.public_endpoint.as_deref(),
-            Some("https://fake.env.test")
-        );
+        // The put records the intent; the reconciler realizes it.
+        assert!(ingress.result.environment.public_ingress_enabled);
+        calling(
+            caller_a.clone(),
+            wait_for_public_endpoint(
+                state_a.api.as_ref(),
+                created.environment_id.as_str(),
+                Some(FAKE_INGRESS_ENDPOINT),
+            ),
+        )
+        .await?;
         calling(
             caller_a.clone(),
             state_a
@@ -250,6 +303,11 @@ async fn environment_provider_lifecycle_and_adoption_round_trip() -> anyhow::Res
                 }),
         )
         .await?;
+        calling(
+            caller_a.clone(),
+            wait_for_public_endpoint(state_a.api.as_ref(), created.environment_id.as_str(), None),
+        )
+        .await?;
 
         for (api, caller, environment_id) in [
             (
@@ -278,6 +336,7 @@ async fn environment_provider_lifecycle_and_adoption_round_trip() -> anyhow::Res
 
     reconciler.abort();
     let _ = reconciler.await;
+    drop(controller);
     runtime.evict(universe_a).await;
     runtime.evict(universe_b).await;
     for universe_id in [universe_a, universe_b] {
@@ -319,6 +378,33 @@ async fn wait_for_status(
     }
 }
 
+async fn wait_for_public_endpoint(
+    api: &temporal_runtime::gateway::GatewayAgentApi,
+    environment_id: &str,
+    expected: Option<&str>,
+) -> anyhow::Result<api::EnvironmentView> {
+    let started = std::time::Instant::now();
+    loop {
+        let environment = api
+            .read_environment(api::EnvironmentReadParams {
+                environment_id: environment_id.to_owned(),
+            })
+            .await?
+            .result
+            .environment;
+        if environment.public_endpoint.as_deref() == expected {
+            return Ok(environment);
+        }
+        if started.elapsed() > Duration::from_secs(10) {
+            anyhow::bail!(
+                "timed out waiting for environment {environment_id} to report public endpoint {expected:?}; it reports {:?}",
+                environment.public_endpoint
+            );
+        }
+        tokio::time::sleep(Duration::from_millis(100)).await;
+    }
+}
+
 fn require_live_env() -> anyhow::Result<()> {
     if std::env::var("LIGHTSPEED_TEST_POSTGRES_URL").is_err()
         && std::env::var("LIGHTSPEED_POSTGRES_URL").is_err()
@@ -353,9 +439,8 @@ async fn run_environment_power_live_client(
 ) -> anyhow::Result<()> {
     use std::collections::BTreeMap;
 
-    use environment_protocol::shared::EnvironmentTransport;
     use environments::{
-        EnvironmentConnectionSpec, EnvironmentProviderBindingId, EnvironmentProviderBindingStatus,
+        EnvironmentEndpoint, EnvironmentProviderBindingId, EnvironmentProviderBindingStatus,
         EnvironmentProviderBindingStore, EnvironmentProviderId, EnvironmentProviderStore,
         PutEnvironmentProvider, PutEnvironmentProviderBinding,
     };
@@ -369,17 +454,14 @@ async fn run_environment_power_live_client(
     let suffix = uuid::Uuid::new_v4().simple().to_string();
     let provider_id = format!("fake-power-{suffix}");
     let binding_id = format!("binding-power-{suffix}");
+    let controller = FakeController::start().await?;
     store
         .put_provider(PutEnvironmentProvider {
             provider_id: EnvironmentProviderId::new(provider_id.clone()),
             display_name: Some("Live fake provider (power)".to_owned()),
-            controller_connection: EnvironmentConnectionSpec::new(
-                "in-process",
-                EnvironmentTransport::Provider {
-                    provider_type: "fake".to_owned(),
-                },
-            ),
+            controller_endpoint: EnvironmentEndpoint::parse(controller.controller_url())?,
             metadata: BTreeMap::new(),
+            credential: Some(auth::SecretValue::new(controller.credential())),
             updated_at_ms: 1,
         })
         .await?;
@@ -405,7 +487,7 @@ async fn run_environment_power_live_client(
         .create_environment(api::EnvironmentCreateParams {
             request_id: format!("power-{suffix}"),
             binding_id: binding_id.clone(),
-            template_id: "rust-v1".to_owned(),
+            template_id: FAKE_TEMPLATE_ID.to_owned(),
             display_name: Some("Power VM".to_owned()),
             metadata: BTreeMap::new(),
             idle_policy: Some(policy.clone()),
@@ -480,8 +562,8 @@ async fn run_environment_power_live_client(
         .environment;
     assert_eq!(restored.idle_policy.as_ref(), Some(&policy));
 
-    // The reaper sees the candidate but cannot reach a daemon through the
-    // fake provider, so it leaves the environment alone.
+    // The reaper sees the candidate but no gateway serves its route here, so
+    // it cannot read an idle report and leaves the environment alone.
     let stats = api.reap_idle_environments_once().await?;
     assert_eq!(stats.candidates, 1);
     assert_eq!(stats.unreachable, 1);
@@ -660,10 +742,7 @@ async fn run_environment_power_live_client(
     let external = api
         .create_external_environment(api::EnvironmentExternalCreateParams {
             request_id: format!("power-external-{suffix}"),
-            connection: api::EnvironmentConnectionView {
-                endpoint: format!("ws://127.0.0.1:1/{suffix}"),
-                transport: api::EnvironmentConnectionTransportView::WebSocket,
-            },
+            endpoint: format!("ws://127.0.0.1:1/{suffix}"),
             display_name: None,
             metadata: BTreeMap::new(),
         })
diff --git a/crates/temporal-runtime/tests/environment_registration_live.rs b/crates/temporal-runtime/tests/environment_registration_live.rs
index 8a45ff53c..bf84c0c17 100644
--- a/crates/temporal-runtime/tests/environment_registration_live.rs
+++ b/crates/temporal-runtime/tests/environment_registration_live.rs
@@ -1,10 +1,11 @@
 //! Key-based outbound registration, end to end against the real gateway:
 //! an in-process `lightspeed-envd` dials the environment gateway with a
 //! registration key, becomes a `Ready` registered environment, serves a
-//! worker route through a reverse-dialed data socket, goes `Offline` when
-//! its control connection drops, reconnects by identity alone, keeps
-//! reconnecting after its key is revoked, and is refused for good once its
-//! environment is closed.
+//! worker route through a reverse-dialed stream socket, goes `Offline` when
+//! its control connection drops, reconnects by identity alone, loses to a
+//! newer process with the same identity, keeps reconnecting after its key
+//! is revoked, closes its ephemeral environment at once when it says
+//! goodbye, and is told to exit for good once its environment is closed.
 
 mod support;
 
@@ -17,22 +18,31 @@ use api::{
     EnvironmentRegistrationKeyReadParams, EnvironmentRegistrationKeyRevokeParams,
     EnvironmentSourceView, EnvironmentView,
 };
-use environment_client::{EnvironmentDataClient, JsonRpcTransport};
+use environment_client::DataClient;
 use environment_daemon::{
     DaemonRuntime,
     config::{DaemonConfig, RegistrationConfig},
+    server::DaemonExit,
 };
 use environment_protocol::{
+    ENVD_PROTOCOL_VERSION,
+    bytes::{ByteChunk, SecretString},
     data::{
+        exec::{
+            CommandSpec, ExecInput, ExecState, ExitStatus, OutputChunk, PtySize, ReturnOn,
+            StoppedBy,
+        },
         fs::{ReadDirectoryParams, WriteFileParams},
-        handshake::InitializeParams,
-        idle::IdleParams,
+        idle::GetIdleParams,
         process::{
-            ProcessOutputChunk, ProcessSignal, ReadProcessParams, StartProcessParams,
+            ProcessSignal, ReadProcessParams, ReadProcessResponse, StartProcessParams,
             TerminateProcessParams, WriteProcessParams,
         },
     },
-    shared::{ByteChunk, CURRENT_PROTOCOL_VERSION, EnvironmentPath, ProcessId, SecretString},
+    error::ProtocolErrorKind,
+    ids::ProcessId,
+    metadata::{DisplayName, Metadata},
+    paths::EnvironmentPath,
 };
 use environments::EnvironmentStore as _;
 use support::live::{LIVE_TEST_LOCK, require_storage_live_env};
@@ -207,15 +217,15 @@ async fn scenario(
     assert_eq!(minted.registration_key.active_environment_count, 0);
 
     // First daemon: a fresh identity admitted by the key.
-    let root_a = sandbox.join("a");
-    std::fs::create_dir_all(&root_a)?;
-    let receipt_a = root_a.join("receipt.json");
+    let root_a = workspace(sandbox, "a")?;
+    let receipt_a = sandbox.join("receipt-a.json");
     let daemon_a = spawn_daemon(daemon_config(
         &root_a,
+        &sandbox.join("state-a"),
         connect_url,
         Some(&secret),
         Some(&receipt_a),
-    )?);
+    )?)?;
     let environment_a =
         wait_for_registered(api, &key_id, 1, EnvironmentLifecycleStatusView::Ready).await?;
     let EnvironmentSourceView::Registered {
@@ -233,51 +243,40 @@ async fn scenario(
     assert_eq!(*identity_mode, EnvironmentIdentityModeView::Ephemeral);
     assert!(daemon_id.starts_with("daemon_"));
     assert!(environment_a.last_seen_at_ms.is_some());
+    let metadata = &environment_a.metadata;
     assert_eq!(
-        environment_a
-            .metadata
-            .get("harbor.trialId")
-            .map(String::as_str),
+        metadata.get("harbor.trialId").map(String::as_str),
         Some("trial-1")
     );
     assert_eq!(
-        environment_a
-            .metadata
-            .get("lightspeed.envd.version")
-            .map(String::as_str),
+        metadata.get("lightspeed.envd.version").map(String::as_str),
         Some(release_info::VERSION)
     );
     assert_eq!(
-        environment_a
-            .metadata
-            .get("lightspeed.envd.gitSha")
-            .map(String::as_str),
+        metadata.get("lightspeed.envd.gitSha").map(String::as_str),
         Some(release_info::GIT_SHA)
     );
     assert_eq!(
-        environment_a
-            .metadata
-            .get("lightspeed.envd.protocolVersion")
-            .map(String::as_str),
-        Some(CURRENT_PROTOCOL_VERSION.to_string().as_str())
+        metadata.get("lightspeed.envd.protocolVersion"),
+        Some(&ENVD_PROTOCOL_VERSION.to_string())
     );
-    let receipt: serde_json::Value = serde_json::from_str(&std::fs::read_to_string(&receipt_a)?)?;
+    let receipt = read_receipt(&receipt_a)?;
     assert_eq!(receipt["environmentId"], environment_a.environment_id);
     assert_eq!(receipt["daemonId"], daemon_id.as_str());
     assert_eq!(receipt["identityMode"], "ephemeral");
+    assert_eq!(receipt["admission"], "created");
+    assert!(
+        receipt["controlConnectionId"]
+            .as_str()
+            .is_some_and(|id| id.starts_with("connection_"))
+    );
     assert!(receipt.get("registrationKey").is_none());
-    let key_view = api
-        .read_environment_registration_key(EnvironmentRegistrationKeyReadParams {
-            registration_key_id: key_id.clone(),
-        })
-        .await?
-        .result
-        .registration_key;
+    let key_view = read_key(api, &key_id).await?;
     assert_eq!(key_view.active_environment_count, 1);
     assert_eq!(key_view.registered_environment_count, 1);
 
-    // The worker route reaches the daemon through a reverse-dialed data
-    // socket; two concurrent routes each get their own socket.
+    // The worker route reaches the daemon through a reverse-dialed stream
+    // socket; concurrent routes each get their own socket.
     let record = runtime
         .state_for(universe_id, false)
         .await?
@@ -293,81 +292,76 @@ async fn scenario(
         base_url,
         runtime.environment_gateway().deployment_token(),
     );
-    let connection = gateway.connection_for(universe_id, &record);
-    let mut first = EnvironmentDataClient::connect(
-        &connection.endpoint,
-        gateway.connect_options("registration-live"),
-    )
-    .await?;
-    let mut second = EnvironmentDataClient::connect(
-        &connection.endpoint,
-        gateway.connect_options("registration-live"),
-    )
-    .await?;
-    let mut third = EnvironmentDataClient::connect(
-        &connection.endpoint,
-        gateway.connect_options("registration-live"),
-    )
-    .await?;
-    let mut capabilities = None;
-    for client in [&mut first, &mut second, &mut third] {
-        let initialized = client
-            .initialize(&InitializeParams {
-                protocol_version: CURRENT_PROTOCOL_VERSION,
-                client_name: "registration-live".to_owned(),
-                scope: environment_protocol::shared::EnvironmentScope::Default,
-                resume_connection_id: None,
-            })
-            .await?;
-        assert_eq!(initialized.protocol_version, CURRENT_PROTOCOL_VERSION);
-        capabilities = Some(initialized.capabilities);
-    }
-    let capabilities = capabilities.expect("negotiated capabilities");
+    let key = gateway.route_key(universe_id, &record);
+    let options = || gateway.connect_options("registration-live");
+    let (first, initialized) = gateway.connect(&key, options()).await?;
+    let (second, _) = gateway.connect(&key, options()).await?;
+    let (third, _) = gateway.connect(&key, options()).await?;
+    assert_eq!(initialized.protocol_version, ENVD_PROTOCOL_VERSION);
+    assert_eq!(
+        initialized.default_cwd.as_str(),
+        root_a.to_str().expect("utf-8 root")
+    );
+    let written = path(&root_a, "registered.txt")?;
     first
         .write_file(&WriteFileParams {
-            path: EnvironmentPath::new("registered.txt")?,
+            path: written.clone(),
             data: ByteChunk::new(b"through the reverse dial".to_vec()),
+            create: Default::default(),
+            if_match: None,
+            executable: false,
         })
         .await?;
     let listing = second
         .read_directory(&ReadDirectoryParams {
-            path: EnvironmentPath::new(".")?,
+            path: initialized.default_cwd.clone(),
+            limit: 100,
+            cursor: None,
         })
         .await?;
     assert!(
         listing
             .entries
             .iter()
-            .any(|entry| entry.file_name == "registered.txt"),
+            .any(|entry| entry.name.as_str() == "registered.txt"),
         "second data socket sees the file the first wrote: {listing:?}"
     );
     assert_eq!(
         std::fs::read_to_string(root_a.join("registered.txt"))?,
         "through the reverse dial"
     );
-    process_scenario(&mut first, &mut second, &root_a).await?;
-    executor_scenario(third, capabilities).await?;
+    process_scenario(&first, &second, &root_a).await?;
+    executor_scenario(third).await?;
     first.close().await?;
     second.close().await?;
 
     // Dropping the control connection makes the environment Offline; the
     // same identity, now without any key, reconnects the same environment.
-    daemon_a.abort();
+    daemon_a.exit.abort();
     wait_for_status(
         api,
         &environment_a.environment_id,
         EnvironmentLifecycleStatusView::Offline,
     )
     .await?;
-    let daemon_a = spawn_daemon(daemon_config(&root_a, connect_url, None, Some(&receipt_a))?);
+    let daemon_a = spawn_daemon(daemon_config(
+        &root_a,
+        &sandbox.join("state-a"),
+        connect_url,
+        None,
+        Some(&receipt_a),
+    )?)?;
     wait_for_status(
         api,
         &environment_a.environment_id,
         EnvironmentLifecycleStatusView::Ready,
     )
     .await?;
-    let receipt: serde_json::Value = serde_json::from_str(&std::fs::read_to_string(&receipt_a)?)?;
-    assert_eq!(receipt["environmentId"], environment_a.environment_id);
+    wait_for_receipt_admission(&receipt_a, "reconnected").await?;
+    assert_eq!(
+        read_receipt(&receipt_a)?["environmentId"],
+        environment_a.environment_id
+    );
     assert_eq!(
         wait_for_registered(api, &key_id, 1, EnvironmentLifecycleStatusView::Ready)
             .await?
@@ -376,10 +370,49 @@ async fn scenario(
         "reconnect must not create a second environment"
     );
 
+    // A second process with the same identity (a cloned state directory)
+    // wins; the older one is told it was superseded and exits instead of
+    // fighting for the identity.
+    let twin_state = sandbox.join("state-a-twin");
+    std::fs::create_dir_all(&twin_state)?;
+    std::fs::copy(
+        sandbox
+            .join("state-a")
+            .join(environment_daemon::identity::DAEMON_KEY_FILE),
+        twin_state.join(environment_daemon::identity::DAEMON_KEY_FILE),
+    )?;
+    let twin_a = spawn_daemon(daemon_config(
+        &root_a,
+        &twin_state,
+        connect_url,
+        None,
+        None,
+    )?)?;
+    let superseded = tokio::time::timeout(SETTLE, daemon_a.exit).await??;
+    assert!(
+        matches!(superseded, DaemonExit::Superseded { .. }),
+        "unexpected exit: {superseded:?}"
+    );
+    assert_eq!(superseded.status(), 5);
+    wait_for_status(
+        api,
+        &environment_a.environment_id,
+        EnvironmentLifecycleStatusView::Ready,
+    )
+    .await?;
+    let (after_supersede, _) = gateway.connect(&key, options()).await?;
+    after_supersede.get_idle(&GetIdleParams {}).await?;
+    after_supersede.close().await?;
+
     // A second identity with the same key is a second environment.
-    let root_b = sandbox.join("b");
-    std::fs::create_dir_all(&root_b)?;
-    let daemon_b = spawn_daemon(daemon_config(&root_b, connect_url, Some(&secret), None)?);
+    let root_b = workspace(sandbox, "b")?;
+    let daemon_b = spawn_daemon(daemon_config(
+        &root_b,
+        &sandbox.join("state-b"),
+        connect_url,
+        Some(&secret),
+        None,
+    )?)?;
     let environments = wait_for_registered_count(api, &key_id, 2).await?;
     let environment_b = environments
         .iter()
@@ -394,74 +427,78 @@ async fn scenario(
         close_environments: false,
     })
     .await?;
-    let root_c = sandbox.join("c");
-    std::fs::create_dir_all(&root_c)?;
-    let daemon_c = spawn_daemon(daemon_config(&root_c, connect_url, Some(&secret), None)?);
-    let refused = tokio::time::timeout(SETTLE, daemon_c).await??;
-    let refused = refused.expect_err("a revoked key is a terminal refusal for a new daemon");
+    let root_c = workspace(sandbox, "c")?;
+    let daemon_c = spawn_daemon(daemon_config(
+        &root_c,
+        &sandbox.join("state-c"),
+        connect_url,
+        Some(&secret),
+        None,
+    )?)?;
+    let refused = tokio::time::timeout(SETTLE, daemon_c.exit).await??;
     assert!(
-        refused.to_string().contains("RegistrationKeyRevoked"),
-        "unexpected refusal: {refused:#}"
+        matches!(refused, DaemonExit::Refused(_)),
+        "a revoked key is a terminal refusal for a new daemon: {refused:?}"
     );
-    daemon_b.abort();
-    wait_for_status(
-        api,
-        &environment_b.environment_id,
-        EnvironmentLifecycleStatusView::Offline,
-    )
-    .await?;
-    let daemon_b = spawn_daemon(daemon_config(&root_b, connect_url, None, None)?);
+    assert_eq!(refused.status(), 3);
+
+    // A deliberate stop says goodbye and the daemon exits cleanly. The
+    // sandbox is finished, so its ephemeral environment closes at once
+    // instead of sitting Offline for the key's disconnect grace.
+    daemon_b.runtime.shutdown().cancel();
+    let stopped = tokio::time::timeout(SETTLE, daemon_b.exit).await??;
+    assert!(
+        matches!(stopped, DaemonExit::Shutdown),
+        "unexpected exit: {stopped:?}"
+    );
+    assert_eq!(stopped.status(), 0);
     wait_for_status(
         api,
         &environment_b.environment_id,
-        EnvironmentLifecycleStatusView::Ready,
+        EnvironmentLifecycleStatusView::Closed,
     )
     .await?;
+    // The departed identity is spent: a restart is refused at register.
+    let restarted_b = spawn_daemon(daemon_config(
+        &root_b,
+        &sandbox.join("state-b"),
+        connect_url,
+        None,
+        None,
+    )?)?;
+    let refused_b = tokio::time::timeout(SETTLE, restarted_b.exit).await??;
+    assert!(
+        matches!(refused_b, DaemonExit::EnvironmentClosed),
+        "a departed ephemeral identity cannot reconnect: {refused_b:?}"
+    );
+    assert_eq!(refused_b.status(), 4);
 
-    // Closing the environment spends the identity: the daemon is told to go
-    // and its reconnect is refused for good.
+    // Closing the environment spends the identity: the daemon is told the
+    // environment closed and exits for good.
     api.close_environment(EnvironmentCloseParams {
         environment_id: environment_a.environment_id.clone(),
     })
     .await?;
-    let spent = tokio::time::timeout(SETTLE, daemon_a).await??;
-    let spent = spent.expect_err("a closed environment is a terminal refusal");
+    let spent = tokio::time::timeout(SETTLE, twin_a.exit).await??;
     assert!(
-        spent.to_string().contains("EnvironmentClosed"),
-        "unexpected refusal: {spent:#}"
+        matches!(spent, DaemonExit::EnvironmentClosed),
+        "a closed environment ends its daemon: {spent:?}"
     );
+    assert_eq!(spent.status(), 4);
     wait_for_status(
         api,
         &environment_a.environment_id,
         EnvironmentLifecycleStatusView::Closed,
     )
     .await?;
-    let key_view = api
-        .read_environment_registration_key(EnvironmentRegistrationKeyReadParams {
-            registration_key_id: key_id.clone(),
-        })
-        .await?
-        .result
-        .registration_key;
+    let key_view = read_key(api, &key_id).await?;
     assert_eq!(key_view.registered_environment_count, 2);
-    assert_eq!(key_view.active_environment_count, 1);
+    assert_eq!(key_view.active_environment_count, 0);
     assert_eq!(
         key_view.status,
         api::EnvironmentRegistrationKeyStatusView::Revoked
     );
 
-    daemon_b.abort();
-    api.close_environment(EnvironmentCloseParams {
-        environment_id: environment_b.environment_id.clone(),
-    })
-    .await?;
-    wait_for_status(
-        api,
-        &environment_b.environment_id,
-        EnvironmentLifecycleStatusView::Closed,
-    )
-    .await?;
-
     // Ephemeral grace: a key with a short grace closes an environment whose
     // daemon stays away, through the lifecycle reconciler alone.
     let short = api
@@ -475,30 +512,24 @@ async fn scenario(
         .await?
         .result;
     let short_key_id = short.registration_key.registration_key_id.clone();
-    let root_d = sandbox.join("d");
-    std::fs::create_dir_all(&root_d)?;
+    let root_d = workspace(sandbox, "d")?;
     let daemon_d = spawn_daemon(daemon_config(
         &root_d,
+        &sandbox.join("state-d"),
         connect_url,
         Some(&short.secret.0),
         None,
-    )?);
+    )?)?;
     let environment_d =
         wait_for_registered(api, &short_key_id, 1, EnvironmentLifecycleStatusView::Ready).await?;
-    daemon_d.abort();
+    daemon_d.exit.abort();
     wait_for_status(
         api,
         &environment_d.environment_id,
         EnvironmentLifecycleStatusView::Closed,
     )
     .await?;
-    let short_view = api
-        .read_environment_registration_key(EnvironmentRegistrationKeyReadParams {
-            registration_key_id: short_key_id,
-        })
-        .await?
-        .result
-        .registration_key;
+    let short_view = read_key(api, &short_key_id).await?;
     assert_eq!(short_view.active_environment_count, 0);
     assert_eq!(short_view.registered_environment_count, 1);
     Ok(())
@@ -508,88 +539,115 @@ async fn scenario(
 /// at once: a normal exit leaves its background child running, reported
 /// and counted by the idle report and stoppable through the handle; the
 /// read cursor is the daemon's, so the second socket continues where the
-/// first stopped and an empty write is a wait; a PTY takes input; and an
-/// interrupt reaches the group.
-async fn process_scenario<T>(
-    first: &mut EnvironmentDataClient<T>,
-    second: &mut EnvironmentDataClient<T>,
+/// first stopped while positioned reads consume nothing; a PTY takes input;
+/// an interrupt reaches the group; and terminate escalates gracefully.
+async fn process_scenario(
+    first: &DataClient,
+    second: &DataClient,
     root: &Path,
-) -> anyhow::Result<()>
-where
-    T: JsonRpcTransport + Send + 'static,
-{
+) -> anyhow::Result<()> {
     // A service the command left behind survives its exit.
     first
         .start_process(&shell_process(
             "live-leftover",
             "nohup sleep 60 >/dev/null 2>&1 & echo $! > leftover.pid; echo started; exit 0",
             false,
-        ))
+        )?)
         .await?;
     let leftover_pid = wait_for_pid_file(&root.join("leftover.pid")).await?;
-    tokio::time::sleep(Duration::from_millis(100)).await;
     let read = first
-        .read_process(&read_params("live-leftover", Some(10_000)))
+        .read_process(&read_until_exit("live-leftover")?)
         .await?;
-    assert!(read.exited);
-    assert_eq!(read.exit_code, Some(0));
-    assert!(read.pid.is_some(), "the response names the root pid");
-    assert_eq!(chunk_text(&read.chunks), "started\n");
+    assert_eq!(read.state, ExecState::Exited);
+    assert_eq!(read.exit, Some(ExitStatus::Code { code: 0 }));
+    assert!(read.pid > 0, "the response names the root pid");
+    assert_eq!(page_text(&read.output.chunks), "started\n");
     assert!(
-        read.leftover_processes
+        read.leftovers.as_ref().is_some_and(|leftovers| leftovers
+            .processes
             .iter()
-            .any(|member| i32::try_from(member.pid) == Ok(leftover_pid)),
+            .any(|member| i32::try_from(member.pid) == Ok(leftover_pid))),
         "the leftover is reported with its pid: {:?}",
-        read.leftover_processes
+        read.leftovers
     );
     assert!(
         process_alive(leftover_pid),
         "the leftover survives the call that started it"
     );
-    let idle = second.idle(&IdleParams {}).await?;
-    assert_eq!(idle.running_processes, 0);
-    assert_eq!(idle.leftover_process_groups, 1);
-    assert!(idle.is_quiescent(), "a leftover is not running work");
+    let idle = second.get_idle(&GetIdleParams {}).await?;
+    assert_eq!(idle.running_process_count, 0);
+    assert_eq!(idle.leftover_process_group_count, 1);
     second
         .terminate_process(&TerminateProcessParams {
-            process_id: ProcessId::new("live-leftover"),
+            process_id: process_id("live-leftover")?,
             signal: ProcessSignal::Kill,
         })
         .await?;
     wait_for_process_gone(leftover_pid).await?;
-    assert_eq!(first.idle(&IdleParams {}).await?.leftover_process_groups, 0);
+    assert_eq!(
+        first
+            .get_idle(&GetIdleParams {})
+            .await?
+            .leftover_process_group_count,
+        0
+    );
 
     // The daemon owns the cursor: the second socket reads only what the
-    // first did not, and an empty write after exit is a wait.
+    // first did not, a positioned read consumes nothing, and writing to a
+    // process without input is refused.
     first
         .start_process(&shell_process(
             "live-cursor",
             "echo one; sleep 0.4; echo two; sleep 0.4; echo three",
             false,
-        ))
+        )?)
         .await?;
     let head = first
-        .read_process(&read_params("live-cursor", Some(150)))
+        .read_process(&ReadProcessParams {
+            return_on: ReturnOn::AnyOutput,
+            wait_ms: 10_000,
+            ..read_until_exit("live-cursor")?
+        })
         .await?;
-    assert!(!head.exited);
-    assert_eq!(chunk_text(&head.chunks), "one\n");
+    assert_eq!(head.state, ExecState::Running);
+    assert_eq!(page_text(&head.output.chunks), "one\n");
     let rest = second
-        .read_process(&read_params("live-cursor", Some(10_000)))
+        .read_process(&read_until_exit("live-cursor")?)
         .await?;
-    assert!(rest.exited);
-    assert_eq!(chunk_text(&rest.chunks), "two\nthree\n");
-    let last_head_seq = head.chunks.last().expect("head chunk").seq;
-    assert!(rest.chunks.iter().all(|chunk| chunk.seq > last_head_seq));
-    let wait = first
-        .write_process(&WriteProcessParams {
-            process_id: ProcessId::new("live-cursor"),
-            chunk: None,
-            close_stdin: false,
+    assert_eq!(rest.state, ExecState::Exited);
+    assert_eq!(page_text(&rest.output.chunks), "two\nthree\n");
+    assert!(
+        rest.output
+            .chunks
+            .iter()
+            .all(|chunk| chunk.offset >= head.output.next)
+    );
+    let whole = first
+        .read_process(&ReadProcessParams {
+            after: Some(0),
+            ..read_until_exit("live-cursor")?
         })
         .await?;
+    assert_eq!(page_text(&whole.output.chunks), "one\ntwo\nthree\n");
+    assert_eq!(whole.output.next, whole.output.end);
+    let tail = second
+        .read_process(&ReadProcessParams {
+            tail_bytes: Some(6),
+            ..read_until_exit("live-cursor")?
+        })
+        .await?;
+    assert_eq!(page_text(&tail.output.chunks), "three\n");
+    let refused = first
+        .write_process(&WriteProcessParams {
+            process_id: process_id("live-cursor")?,
+            data: ByteChunk::new(b"late".to_vec()),
+            close_input: false,
+        })
+        .await
+        .expect_err("an exited process takes no input");
     assert_eq!(
-        wait.status,
-        environment_protocol::data::process::WriteProcessStatus::Accepted
+        refused.protocol_kind(),
+        Some(ProtocolErrorKind::FailedPrecondition)
     );
 
     // A PTY takes input written from another socket.
@@ -598,27 +656,22 @@ where
             "live-pty",
             "read line; echo got:$line",
             true,
-        ))
+        )?)
         .await?;
     let write = second
         .write_process(&WriteProcessParams {
-            process_id: ProcessId::new("live-pty"),
-            chunk: Some(ByteChunk::new(b"hello\n".to_vec())),
-            close_stdin: false,
+            process_id: process_id("live-pty")?,
+            data: ByteChunk::new(b"hello\n".to_vec()),
+            close_input: false,
         })
         .await?;
-    assert_eq!(
-        write.status,
-        environment_protocol::data::process::WriteProcessStatus::Accepted
-    );
-    let pty = first
-        .read_process(&read_params("live-pty", Some(10_000)))
-        .await?;
-    assert!(pty.exited);
+    assert_eq!(write.accepted_bytes, 6);
+    let pty = first.read_process(&read_until_exit("live-pty")?).await?;
+    assert_eq!(pty.state, ExecState::Exited);
     assert!(
-        chunk_text(&pty.chunks).contains("got:hello"),
+        page_text(&pty.output.chunks).contains("got:hello"),
         "{:?}",
-        chunk_text(&pty.chunks)
+        page_text(&pty.output.chunks)
     );
 
     // An interrupt reaches the group; the next read observes the trap.
@@ -627,39 +680,63 @@ where
             "live-interrupt",
             "trap 'echo caught; exit 3' INT; sleep 100 & wait $!",
             false,
-        ))
+        )?)
         .await?;
     tokio::time::sleep(Duration::from_millis(300)).await;
     let signalled = first
         .terminate_process(&TerminateProcessParams {
-            process_id: ProcessId::new("live-interrupt"),
+            process_id: process_id("live-interrupt")?,
             signal: ProcessSignal::Interrupt,
         })
         .await?;
     assert!(signalled.running);
     let caught = second
-        .read_process(&read_params("live-interrupt", Some(10_000)))
+        .read_process(&read_until_exit("live-interrupt")?)
         .await?;
-    assert!(caught.exited);
-    assert_eq!(caught.exit_code, Some(3));
-    assert_eq!(chunk_text(&caught.chunks), "caught\n");
+    assert_exited_with(&caught, 3, None, "caught\n");
+
+    // Terminate is graceful first: the process may clean up on SIGTERM.
+    first
+        .start_process(&shell_process(
+            "live-terminate",
+            "trap 'echo stopping; exit 7' TERM; sleep 100 & wait $!",
+            false,
+        )?)
+        .await?;
+    tokio::time::sleep(Duration::from_millis(300)).await;
+    second
+        .terminate_process(&TerminateProcessParams {
+            process_id: process_id("live-terminate")?,
+            signal: ProcessSignal::Terminate,
+        })
+        .await?;
+    let terminated = first
+        .read_process(&read_until_exit("live-terminate")?)
+        .await?;
+    assert_exited_with(&terminated, 7, Some(StoppedBy::Terminate), "stopping\n");
     Ok(())
 }
 
+fn assert_exited_with(
+    read: &ReadProcessResponse,
+    code: i32,
+    stopped_by: Option<StoppedBy>,
+    output: &str,
+) {
+    assert_eq!(read.state, ExecState::Exited);
+    assert_eq!(read.exit, Some(ExitStatus::Code { code }));
+    assert_eq!(read.stopped_by, stopped_by);
+    assert_eq!(page_text(&read.output.chunks), output);
+}
+
 /// The substrate executor over the real transport: a yielded run returns
 /// a handle and pid, a continue reads only new output, and a kill through
 /// the handle ends the group.
-async fn executor_scenario<T>(
-    client: EnvironmentDataClient<T>,
-    capabilities: environment_protocol::shared::EnvironmentCapabilities,
-) -> anyhow::Result<()>
-where
-    T: JsonRpcTransport + Send + 'static,
-{
-    let connection = RemoteEnvironmentConnection::new(client, capabilities);
+async fn executor_scenario(client: DataClient) -> anyhow::Result<()> {
+    let connection = RemoteEnvironmentConnection::new(client);
     let executor = connection
         .process_executor()
-        .expect("the daemon negotiates process execution");
+        .expect("the daemon serves the process family");
     let mut request = ProcessRequest::argv(["/bin/sh", "-c", "echo hi; sleep 60"]);
     request.yield_ms = Some(300);
     request.max_output_bytes = Some(4096);
@@ -679,7 +756,7 @@ where
         more.stdout.text_lossy()
     );
 
-    let root_pid = running.pid.expect("pid") as i32;
+    let root_pid = i32::try_from(running.pid.expect("pid"))?;
     let killed = executor
         .continue_process(ContinueProcessRequest {
             handle,
@@ -697,32 +774,50 @@ where
     Ok(())
 }
 
-fn shell_process(process_id: &str, script: &str, tty: bool) -> StartProcessParams {
-    StartProcessParams {
-        process_id: ProcessId::new(process_id),
-        argv: vec!["/bin/sh".to_owned(), "-c".to_owned(), script.to_owned()],
-        cwd: None,
-        env: BTreeMap::new(),
-        secret_env: BTreeMap::new(),
-        stdin: None,
-        timeout_ms: Some(60_000),
-        tty,
-    }
+fn process_id(id: &str) -> anyhow::Result<ProcessId> {
+    Ok(ProcessId::new(id)?)
 }
 
-fn read_params(process_id: &str, wait_ms: Option<u64>) -> ReadProcessParams {
-    ReadProcessParams {
-        process_id: ProcessId::new(process_id),
-        after_seq: None,
-        max_bytes: None,
-        wait_ms,
-    }
+fn path(root: &Path, name: &str) -> anyhow::Result<EnvironmentPath> {
+    let path = root.join(name);
+    Ok(EnvironmentPath::new(path.to_str().ok_or_else(|| {
+        anyhow::anyhow!("non-utf-8 path {}", path.display())
+    })?)?)
+}
+
+fn shell_process(process_id: &str, script: &str, pty: bool) -> anyhow::Result<StartProcessParams> {
+    Ok(StartProcessParams {
+        process_id: self::process_id(process_id)?,
+        command: CommandSpec {
+            argv: vec!["/bin/sh".to_owned(), "-c".to_owned(), script.to_owned()],
+            cwd: None,
+            env: BTreeMap::new(),
+            secret_env: BTreeMap::new(),
+            input: ExecInput::None {},
+            timeout_ms: Some(60_000),
+        },
+        pty: pty.then_some(PtySize { rows: 24, cols: 80 }),
+    })
 }
 
-fn chunk_text(chunks: &[ProcessOutputChunk]) -> String {
+/// A cursor read that returns once the process exited and its output
+/// settled.
+fn read_until_exit(process_id: &str) -> anyhow::Result<ReadProcessParams> {
+    Ok(ReadProcessParams {
+        process_id: self::process_id(process_id)?,
+        after: None,
+        tail_bytes: None,
+        ack: None,
+        max_bytes: 65_536,
+        wait_ms: 10_000,
+        return_on: ReturnOn::Exit,
+    })
+}
+
+fn page_text(chunks: &[OutputChunk]) -> String {
     let bytes = chunks
         .iter()
-        .flat_map(|chunk| chunk.chunk.as_slice().to_vec())
+        .flat_map(|chunk| chunk.data.as_slice().to_vec())
         .collect::<Vec<_>>();
     String::from_utf8_lossy(&bytes).into_owned()
 }
@@ -764,41 +859,83 @@ async fn wait_for_process_gone(pid: i32) -> anyhow::Result<()> {
     }
 }
 
+fn read_receipt(path: &Path) -> anyhow::Result<serde_json::Value> {
+    Ok(serde_json::from_str(&std::fs::read_to_string(path)?)?)
+}
+
+async fn wait_for_receipt_admission(path: &Path, admission: &str) -> anyhow::Result<()> {
+    let deadline = tokio::time::Instant::now() + SETTLE;
+    loop {
+        if read_receipt(path).is_ok_and(|receipt| receipt["admission"] == admission) {
+            return Ok(());
+        }
+        if tokio::time::Instant::now() > deadline {
+            anyhow::bail!("receipt {} never said {admission}", path.display());
+        }
+        tokio::time::sleep(POLL).await;
+    }
+}
+
+/// A canonical, empty working tree for one daemon.
+fn workspace(sandbox: &Path, name: &str) -> anyhow::Result<std::path::PathBuf> {
+    let root = sandbox.join(name);
+    std::fs::create_dir_all(&root)?;
+    Ok(root.canonicalize()?)
+}
+
+/// A daemon serving `root`, with its state outside the tree it serves.
 fn daemon_config(
     root: &Path,
+    state_dir: &Path,
     connect_url: &str,
     key: Option<&str>,
     receipt: Option<&Path>,
 ) -> anyhow::Result<DaemonConfig> {
-    let root = root.canonicalize()?;
     let mut metadata = BTreeMap::new();
     metadata.insert("harbor.trialId".to_owned(), "trial-1".to_owned());
+    let mut registration = RegistrationConfig::new(
+        connect_url.to_owned(),
+        environment_daemon::upgrade::resolve_discovery_url(Some(connect_url), None)?,
+    );
+    registration.registration_key = key.map(SecretString::new);
+    registration.display_name = Some(DisplayName::new("registration live daemon")?);
+    registration.metadata = Metadata::new(metadata)?;
+    registration.receipt_path = receipt.map(Path::to_path_buf);
     Ok(DaemonConfig {
         listen: None,
-        cwd: root.clone(),
-        fs_root: root.clone(),
-        state_dir: root.join(".lightspeed-envd"),
+        cwd: root.to_path_buf(),
+        fs_root: root.to_path_buf(),
+        state_dir: state_dir.to_path_buf(),
         read_only_fs: false,
-        registration: Some({
-            let mut registration = RegistrationConfig::new(
-                connect_url.to_owned(),
-                environment_daemon::upgrade::resolve_discovery_url(Some(connect_url), None)?,
-            );
-            registration.registration_key = key.map(SecretString::new);
-            registration.display_name = Some("registration live daemon".to_owned());
-            registration.metadata = metadata;
-            registration.receipt_path = receipt.map(Path::to_path_buf);
-            registration
-        }),
+        registration: Some(registration),
         scrubbed_env: Vec::new(),
     })
 }
 
-fn spawn_daemon(config: DaemonConfig) -> tokio::task::JoinHandle<anyhow::Result<()>> {
-    tokio::spawn(async move {
-        let runtime = DaemonRuntime::new(config)?;
-        environment_daemon::server::run(runtime).await
-    })
+/// One running daemon: how it ends, and the runtime whose shutdown token
+/// stops it deliberately.
+struct Daemon {
+    exit: tokio::task::JoinHandle<DaemonExit>,
+    runtime: DaemonRuntime,
+}
+
+fn spawn_daemon(config: DaemonConfig) -> anyhow::Result<Daemon> {
+    let runtime = DaemonRuntime::new(config)?;
+    let exit = tokio::spawn(environment_daemon::server::run(runtime.clone()));
+    Ok(Daemon { exit, runtime })
+}
+
+async fn read_key(
+    api: &GatewayAgentApi,
+    key_id: &str,
+) -> anyhow::Result<api::EnvironmentRegistrationKeyView> {
+    Ok(api
+        .read_environment_registration_key(EnvironmentRegistrationKeyReadParams {
+            registration_key_id: key_id.to_owned(),
+        })
+        .await?
+        .result
+        .registration_key)
 }
 
 async fn wait_for_registered(
diff --git a/crates/temporal-runtime/tests/profiles_live.rs b/crates/temporal-runtime/tests/profiles_live.rs
index 88bdfdd1c..57522cf9e 100644
--- a/crates/temporal-runtime/tests/profiles_live.rs
+++ b/crates/temporal-runtime/tests/profiles_live.rs
@@ -50,12 +50,12 @@ async fn run_profile_environment_selection_live_client(
 ) -> anyhow::Result<()> {
     use std::collections::BTreeMap;
 
-    use environment_protocol::shared::EnvironmentTransport;
     use environments::{
-        EnvironmentConnectionSpec, EnvironmentProviderBindingId, EnvironmentProviderBindingStatus,
+        EnvironmentEndpoint, EnvironmentProviderBindingId, EnvironmentProviderBindingStatus,
         EnvironmentProviderBindingStore, EnvironmentProviderId, EnvironmentProviderStore,
         PutEnvironmentProvider, PutEnvironmentProviderBinding,
     };
+    use temporal_runtime::environments::fake_controller::{FAKE_TEMPLATE_ID, FakeController};
 
     let store = pg_store_from_env().await?;
     let model = support::live::openai_live_model();
@@ -68,20 +68,17 @@ async fn run_profile_environment_selection_live_client(
     let binding_id = format!("binding-profile-{suffix}");
     let profile_id = ProfileId::new(format!("live_selection_{suffix}"));
 
-    // Register the in-process fake provider and bind it to this universe
-    // directly through the store: the deployment API is deployment-scoped and
-    // this test drives one universe's gateway.
+    // Serve a fake controller on loopback, register it and bind it to this
+    // universe directly through the store: the deployment API is
+    // deployment-scoped and this test drives one universe's gateway.
+    let controller = FakeController::start().await?;
     store
         .put_provider(PutEnvironmentProvider {
             provider_id: EnvironmentProviderId::new(provider_id.clone()),
             display_name: Some("Live fake provider".to_owned()),
-            controller_connection: EnvironmentConnectionSpec::new(
-                "in-process",
-                EnvironmentTransport::Provider {
-                    provider_type: "fake".to_owned(),
-                },
-            ),
+            controller_endpoint: EnvironmentEndpoint::parse(controller.controller_url())?,
             metadata: BTreeMap::new(),
+            credential: Some(auth::SecretValue::new(controller.credential())),
             updated_at_ms: 1,
         })
         .await?;
@@ -101,7 +98,7 @@ async fn run_profile_environment_selection_live_client(
         .create_environment(api::EnvironmentCreateParams {
             request_id: format!("independent-{suffix}"),
             binding_id: binding_id.clone(),
-            template_id: "rust-v1".into(),
+            template_id: FAKE_TEMPLATE_ID.into(),
             display_name: None,
             metadata: BTreeMap::new(),
             idle_policy: None,
diff --git a/crates/temporal-runtime/tests/subagents_live.rs b/crates/temporal-runtime/tests/subagents_live.rs
index 41ae3566f..4f7881ae3 100644
--- a/crates/temporal-runtime/tests/subagents_live.rs
+++ b/crates/temporal-runtime/tests/subagents_live.rs
@@ -1314,28 +1314,26 @@ async fn run_agent_run_inherit_environment_live_client(
 ) -> anyhow::Result<()> {
     use std::collections::BTreeMap;
 
-    use environment_protocol::shared::EnvironmentTransport;
     use environments::{
-        EnvironmentConnectionSpec, EnvironmentProviderBindingId, EnvironmentProviderBindingStatus,
+        EnvironmentEndpoint, EnvironmentProviderBindingId, EnvironmentProviderBindingStatus,
         EnvironmentProviderBindingStore, EnvironmentProviderId, EnvironmentProviderStore,
         PutEnvironmentProvider, PutEnvironmentProviderBinding,
     };
+    use temporal_runtime::environments::fake_controller::FakeController;
 
     let store = pg_store_from_env().await?;
     let suffix = uuid::Uuid::new_v4().simple().to_string();
     let provider_id = format!("fake-inherit-{suffix}");
     let binding_id = format!("binding-inherit-{suffix}");
+    // Serves the controller and data routes until the test returns.
+    let controller = FakeController::start().await?;
     store
         .put_provider(PutEnvironmentProvider {
             provider_id: EnvironmentProviderId::new(provider_id.clone()),
             display_name: Some("Live fake provider".to_owned()),
-            controller_connection: EnvironmentConnectionSpec::new(
-                "in-process",
-                EnvironmentTransport::Provider {
-                    provider_type: "fake".to_owned(),
-                },
-            ),
+            controller_endpoint: EnvironmentEndpoint::parse(controller.controller_url())?,
             metadata: BTreeMap::new(),
+            credential: Some(auth::SecretValue::new(controller.credential())),
             updated_at_ms: 1,
         })
         .await?;
diff --git a/crates/temporal-runtime/tests/vfs_transfer_live.rs b/crates/temporal-runtime/tests/vfs_transfer_live.rs
index 2faf3451a..e1a0c5ef2 100644
--- a/crates/temporal-runtime/tests/vfs_transfer_live.rs
+++ b/crates/temporal-runtime/tests/vfs_transfer_live.rs
@@ -13,11 +13,13 @@ use environment_daemon::{
     config::{DaemonConfig, RegistrationConfig},
 };
 use environment_protocol::{
+    bytes::SecretString,
     data::{
-        handshake::InitializeParams,
-        inventory::{ScanContent, ScanDigestAlgorithm, ScanParams},
+        fs::{TreeContent, TreeFilter},
+        scan::{ScanLimits, ScanParams, ScanRoot, ScanRootResult, ScanSkip, ScanSkipReason},
     },
-    shared::{CURRENT_PROTOCOL_VERSION, EnvironmentPath, SecretString},
+    paths::EnvironmentPath,
+    routes::CONNECT_PATH,
 };
 use environments::EnvironmentStore;
 use harness::{
@@ -112,97 +114,224 @@ async fn temporal_live_vfs_transfers_follow_profile_grants_and_publish_large_fil
     let mut tasks = Tasks(vec![gateway.abort_handle()]);
     let sandbox = tempfile::tempdir()?;
     let root = sandbox.path().canonicalize()?;
+    let daemon_state = tempfile::tempdir()?;
     let context =
         support::live::local_request_context_for(api::AccessScope::Universe { universe_id })
             .await?;
     // Keep the large transfer scenario off the current-thread test stack.
-    let result = temporal_runtime::gateway::request_context::with_request_context(context, Box::pin(async {
-        let state = runtime.state_for(universe_id, false).await?;
-        let key = state.api.create_environment_registration_key(api::EnvironmentRegistrationKeyCreateParams {
-            display_name: "VFS transfer live".into(),
-            identity_mode: api::EnvironmentIdentityModeView::Ephemeral,
-            max_active_environments: Some(1),
-            ephemeral_disconnect_grace_ms: None,
-            expires_at_ms: None,
-        }).await?.result;
-        let connect_url = format!("ws://{address}/environment-gateway/connect");
-        let mut registration = RegistrationConfig::new(connect_url.clone(),
-            environment_daemon::upgrade::resolve_discovery_url(Some(&connect_url), None)?);
-        registration.registration_key = Some(SecretString::new(key.secret.0));
-        let daemon = DaemonRuntime::new(DaemonConfig {
-            listen: None, cwd: root.clone(), fs_root: root.clone(), state_dir: root.join(".envd"),
-            read_only_fs: false, registration: Some(registration), scrubbed_env: Vec::new(),
-        })?;
-        let daemon = tokio::spawn(environment_daemon::server::run(daemon));
-        tasks.0.push(daemon.abort_handle());
-        let environment = tokio::time::timeout(Duration::from_secs(30), async {
-            loop {
-                let environments = state.api.list_environments(api::EnvironmentListParams::default()).await?.result.environments;
-                if let Some(environment) = environments.into_iter().find(|e| e.status == api::EnvironmentLifecycleStatusView::Ready) {
-                    return anyhow::Ok(environment);
+    let result = temporal_runtime::gateway::request_context::with_request_context(
+        context,
+        Box::pin(async {
+            let state = runtime.state_for(universe_id, false).await?;
+            let key = state
+                .api
+                .create_environment_registration_key(api::EnvironmentRegistrationKeyCreateParams {
+                    display_name: "VFS transfer live".into(),
+                    identity_mode: api::EnvironmentIdentityModeView::Ephemeral,
+                    max_active_environments: Some(1),
+                    ephemeral_disconnect_grace_ms: None,
+                    expires_at_ms: None,
+                })
+                .await?
+                .result;
+            let connect_url = format!("ws://{address}{CONNECT_PATH}");
+            let mut registration = RegistrationConfig::new(
+                connect_url.clone(),
+                environment_daemon::upgrade::resolve_discovery_url(Some(&connect_url), None)?,
+            );
+            registration.registration_key = Some(SecretString::new(key.secret.0));
+            let daemon = DaemonRuntime::new(DaemonConfig {
+                listen: None,
+                cwd: root.clone(),
+                fs_root: root.clone(),
+                state_dir: daemon_state.path().into(),
+                read_only_fs: false,
+                registration: Some(registration),
+                scrubbed_env: Vec::new(),
+            })?;
+            let daemon = tokio::spawn(environment_daemon::server::run(daemon));
+            tasks.0.push(daemon.abort_handle());
+            let environment = tokio::time::timeout(Duration::from_secs(30), async {
+                loop {
+                    let environments = state
+                        .api
+                        .list_environments(api::EnvironmentListParams::default())
+                        .await?
+                        .result
+                        .environments;
+                    if let Some(environment) = environments
+                        .into_iter()
+                        .find(|e| e.status == api::EnvironmentLifecycleStatusView::Ready)
+                    {
+                        return anyhow::Ok(environment);
+                    }
+                    tokio::time::sleep(Duration::from_millis(100)).await;
                 }
-                tokio::time::sleep(Duration::from_millis(100)).await;
-            }
-        }).await??;
-        let hosted = Arc::new(SessionTools::from_pg_store(state.store.clone())
-            .with_environment_gateway(gateway_config.clone()));
-        let activities = WorkerActivities::for_universe(universe_id,
-            ActivityState::from_pg_store(state.store.clone(), Arc::new(TransferLlm { blobs: state.store.clone() }), hosted.clone())
-                .with_hosted_tools(hosted).with_environment_gateway(gateway_config.clone()));
-        let gateway_config = gateway_config.clone();
-        let store = state.store.clone();
-        run_with_live_worker(activities, |client, queue, base_session| async move {
-            let api = GatewayAgentApi::builder(client.clone(), store.clone())
-                .with_task_queue(queue).with_environment_gateway(gateway_config.clone()).build();
-            // All provider surfaces execute both directions. Additional sessions
-            // test the public grant boundary using the same profile path.
-            for (index, (provider, mode)) in [
-                (ProviderApiKind::OpenAiResponses, "edit"),
-                (ProviderApiKind::AnthropicMessages, "edit"),
-                (ProviderApiKind::OpenAiCompletions, "edit"),
-                (ProviderApiKind::OpenAiResponses, "readonly"),
-                (ProviderApiKind::OpenAiResponses, "sourcing"),
-                (ProviderApiKind::OpenAiResponses, "noenv"),
-                (ProviderApiKind::OpenAiResponses, "content"),
-                (ProviderApiKind::AnthropicMessages, "content"),
-                (ProviderApiKind::OpenAiCompletions, "content"),
-                (ProviderApiKind::OpenAiResponses, "contentread"),
-            ].into_iter().enumerate() {
-                let session = SessionId::new(format!("{base_session}_{index}_{mode}"));
-                let case = Box::pin(run_case(&api, store.as_ref(), &session, provider, mode, index, &root, &environment.environment_id)).await;
-                let handle = client.get_workflow_handle::<temporal_workflow::AgentSessionWorkflow>(
-                    temporal_workflow::compose_workflow_id(universe_id, &session));
-                let _ = handle.terminate(WorkflowTerminateOptions::builder().reason("transfer live cleanup").build()).await;
-                case?;
-            }
-            // Scan negotiation and conditional observations use the same reverse route.
-            let record = store.read_environment(&harness::EnvironmentId::new(&environment.environment_id)).await?;
-            let connection = gateway_config.connection_for(universe_id, &record);
-            let mut remote = environment_client::EnvironmentDataClient::connect(&connection.endpoint, gateway_config.connect_options("transfer-live-scan")).await?;
-            let initialized = remote.initialize(&InitializeParams {
-                protocol_version: CURRENT_PROTOCOL_VERSION, client_name: "transfer-live-scan".into(),
-                scope: connection.scope, resume_connection_id: None,
-            }).await?;
-            anyhow::ensure!(initialized.capabilities.filesystem_scan && initialized.capabilities.filesystem_transfer);
-            let mut query = ScanParams {
-            follow_symlinks: false,
-                roots: vec![EnvironmentPath::new("./capture-source")?], include_patterns: vec!["new.bin".into()],
-                read_content: false, digest_algorithm: Some(ScanDigestAlgorithm::Sha256), limits: Default::default(), if_none_match: None,
-            };
-            let scan = remote.scan(&query).await?;
-            anyhow::ensure!(scan.complete && scan.diagnostics.is_empty());
-            assert!(scan.entries.iter().any(|entry| matches!(&entry.content, ScanContent::File { digest: Some(digest), .. }
-                if digest == BlobRef::from_bytes(&std::fs::read(root.join("capture-source/new.bin")).unwrap()).as_str())));
-            query.if_none_match = Some(scan.fingerprint.expect("complete scan fingerprint"));
-            let unchanged = remote.scan(&query).await?;
-            anyhow::ensure!(unchanged.unchanged && unchanged.entries.is_empty());
-            std::fs::write(root.join("capture-source/new.bin"), b"changed after observation")?;
-            let changed = remote.scan(&query).await?;
-            anyhow::ensure!(changed.complete && !changed.unchanged && changed.fingerprint != query.if_none_match);
-            remote.close().await?;
-            anyhow::Ok(())
-        }).await
-    })).await;
+            })
+            .await??;
+            let hosted = Arc::new(
+                SessionTools::from_pg_store(state.store.clone())
+                    .with_environment_gateway(gateway_config.clone()),
+            );
+            let activities = WorkerActivities::for_universe(
+                universe_id,
+                ActivityState::from_pg_store(
+                    state.store.clone(),
+                    Arc::new(TransferLlm {
+                        blobs: state.store.clone(),
+                    }),
+                    hosted.clone(),
+                )
+                .with_hosted_tools(hosted)
+                .with_environment_gateway(gateway_config.clone()),
+            );
+            let gateway_config = gateway_config.clone();
+            let store = state.store.clone();
+            run_with_live_worker(activities, |client, queue, base_session| async move {
+                let api = GatewayAgentApi::builder(client.clone(), store.clone())
+                    .with_task_queue(queue)
+                    .with_environment_gateway(gateway_config.clone())
+                    .build();
+                // All provider surfaces execute both directions. Additional sessions
+                // test the public grant boundary using the same profile path.
+                for (index, (provider, mode)) in [
+                    (ProviderApiKind::OpenAiResponses, "edit"),
+                    (ProviderApiKind::AnthropicMessages, "edit"),
+                    (ProviderApiKind::OpenAiCompletions, "edit"),
+                    (ProviderApiKind::OpenAiResponses, "readonly"),
+                    (ProviderApiKind::OpenAiResponses, "sourcing"),
+                    (ProviderApiKind::OpenAiResponses, "noenv"),
+                    (ProviderApiKind::OpenAiResponses, "content"),
+                    (ProviderApiKind::AnthropicMessages, "content"),
+                    (ProviderApiKind::OpenAiCompletions, "content"),
+                    (ProviderApiKind::OpenAiResponses, "contentread"),
+                ]
+                .into_iter()
+                .enumerate()
+                {
+                    let session = SessionId::new(format!("{base_session}_{index}_{mode}"));
+                    let case = Box::pin(run_case(
+                        &api,
+                        store.as_ref(),
+                        &session,
+                        provider,
+                        mode,
+                        index,
+                        &root,
+                        &environment.environment_id,
+                    ))
+                    .await;
+                    let handle = client
+                        .get_workflow_handle::<temporal_workflow::AgentSessionWorkflow>(
+                            temporal_workflow::compose_workflow_id(universe_id, &session),
+                        );
+                    let _ = handle
+                        .terminate(
+                            WorkflowTerminateOptions::builder()
+                                .reason("transfer live cleanup")
+                                .build(),
+                        )
+                        .await;
+                    case?;
+                }
+                // Scan negotiation and conditional observations use the same reverse route.
+                let record = store
+                    .read_environment(&harness::EnvironmentId::new(&environment.environment_id))
+                    .await?;
+                let (remote, initialized) = environment_client::DataClient::connect_initialized(
+                    &gateway_config.endpoint_for(universe_id, &record),
+                    gateway_config.connect_options("transfer-live-scan"),
+                )
+                .await?;
+                anyhow::ensure!(initialized.capabilities.filesystem.is_some());
+                let ceilings = initialized.limits.filesystem.scan;
+                // Scans observe small files such as skills and prompts: the
+                // large captured file is listed as skipped, never hashed,
+                // while a small sibling is observed with its digest.
+                std::fs::write(root.join("capture-source/observed.txt"), b"observed")?;
+                let mut query = ScanParams {
+                    roots: vec![ScanRoot {
+                        path: EnvironmentPath::new(root.join("capture-source").to_string_lossy())?,
+                        if_none_match: None,
+                        max_depth: None,
+                    }],
+                    filter: TreeFilter {
+                        include: vec!["new.bin".into(), "observed.txt".into()],
+                        ..TreeFilter::default()
+                    },
+                    read_content: false,
+                    include_digests: true,
+                    follow_symlinks: false,
+                    limits: ScanLimits {
+                        max_entries: ceilings.max_entries,
+                        max_file_bytes: ceilings.max_file_bytes,
+                        max_total_bytes: ceilings.max_total_bytes,
+                        max_duration_ms: ceilings.max_duration_ms,
+                    },
+                };
+                anyhow::ensure!(
+                    std::fs::metadata(root.join("capture-source/new.bin"))?.len()
+                        > ceilings.max_file_bytes,
+                    "the captured file must exceed the scan's per-file ceiling"
+                );
+                let expected =
+                    BlobRef::from_bytes(&std::fs::read(root.join("capture-source/observed.txt"))?);
+                let scan = remote.scan(&query).await?;
+                let fingerprint = match scan.roots.as_slice() {
+                    [
+                        ScanRootResult::Complete {
+                            fingerprint,
+                            entries,
+                            skipped,
+                            skipped_entry_count,
+                            ..
+                        },
+                    ] => {
+                        anyhow::ensure!(
+                            *skipped_entry_count == 1
+                                && matches!(skipped.as_slice(), [ScanSkip {
+                                    path: Some(path),
+                                    reason: ScanSkipReason::FileTooLarge,
+                                }] if path.as_str() == "new.bin"),
+                            "{scan:?}"
+                        );
+                        anyhow::ensure!(
+                            matches!(entries.as_slice(), [entry]
+                                if entry.path.as_str() == "observed.txt"
+                                    && matches!(&entry.content, TreeContent::File { digest: Some(digest), .. }
+                                        if format!("sha256:{}", digest.hex()) == expected.as_str())),
+                            "{scan:?}"
+                        );
+                        fingerprint.clone()
+                    }
+                    other => anyhow::bail!("capture-source scan did not complete: {other:?}"),
+                };
+                query.roots[0].if_none_match = Some(fingerprint.clone());
+                let unchanged = remote.scan(&query).await?;
+                anyhow::ensure!(
+                    matches!(
+                        unchanged.roots.as_slice(),
+                        [ScanRootResult::Unchanged { .. }]
+                    ),
+                    "{unchanged:?}"
+                );
+                std::fs::write(
+                    root.join("capture-source/observed.txt"),
+                    b"changed after observation",
+                )?;
+                let changed = remote.scan(&query).await?;
+                anyhow::ensure!(
+                    matches!(changed.roots.as_slice(),
+                [ScanRootResult::Complete { fingerprint: changed, .. }] if *changed != fingerprint),
+                    "{changed:?}"
+                );
+                remote.close().await?;
+                anyhow::Ok(())
+            })
+            .await
+        }),
+    )
+    .await;
     drop(tasks);
     let store = runtime.state_for(universe_id, false).await?.store.clone();
     runtime.evict(universe_id).await;
diff --git a/crates/temporal-workflow/Cargo.toml b/crates/temporal-workflow/Cargo.toml
index b6d5bfce0..49f5fac0b 100644
--- a/crates/temporal-workflow/Cargo.toml
+++ b/crates/temporal-workflow/Cargo.toml
@@ -11,7 +11,6 @@ harness = { path = "../harness", features = ["contract"] }
 schemars = { version = "1", features = ["uuid1"] }
 sha2 = "0.11"
 hex = "0.4"
-environment-protocol = { path = "../environment-protocol" }
 anyhow = "1"
 chrono = { version = "0.4", default-features = false, features = ["std"] }
 futures = "0.3"
diff --git a/crates/temporal-workflow/src/activities.rs b/crates/temporal-workflow/src/activities.rs
index 603c7762a..f468a63d8 100644
--- a/crates/temporal-workflow/src/activities.rs
+++ b/crates/temporal-workflow/src/activities.rs
@@ -9,10 +9,11 @@ use crate::{
     AppendEventsRequest, AwaitEnvironmentReadyActivityRequest, AwaitEnvironmentReadyActivityResult,
     AwaitMaterializationRequest, AwaitMaterializationResult, ContextCompactActivityRequest,
     CreateOrLoadSessionRequest, CreateOrLoadSessionResult, EnvironmentJobCancelActivityRequest,
-    EnvironmentJobPollActivityRequest, EnvironmentJobPollActivityResult,
-    EnvironmentJobPrepareWorkflowToolRequest, EnvironmentJobStartActivityRequest,
-    EnvironmentJobStartActivityResult, JoinedContextPreparationRequest, LlmGenerateActivityRequest,
-    PutBlobRequest, ReadBlobRequest, ReadBlobResult, RuntimeProjectionRefreshActivityRequest,
+    EnvironmentJobCancelActivityResult, EnvironmentJobPollActivityRequest,
+    EnvironmentJobPollActivityResult, EnvironmentJobPrepareWorkflowToolRequest,
+    EnvironmentJobStartActivityRequest, EnvironmentJobStartActivityResult,
+    JoinedContextPreparationRequest, LlmGenerateActivityRequest, PutBlobRequest, ReadBlobRequest,
+    ReadBlobResult, RuntimeProjectionRefreshActivityRequest,
     RuntimeProjectionRefreshActivityResult, SubagentCloseActivityRequest,
     SubagentPrepareActivityRequest, SubagentPrepareActivityResult, SubagentResolveActivityRequest,
     ToolInvokeBatchActivityRequest, ToolInvokeCallActivityRequest, ToolInvokeCallActivityResult,
@@ -270,7 +271,7 @@ impl WorkflowActivities {
     pub async fn environment_job_cancel(
         _ctx: ActivityContext,
         _request: EnvironmentJobCancelActivityRequest,
-    ) -> Result<Vec<environment_protocol::data::jobs::JobSummary>, ActivityError> {
+    ) -> Result<EnvironmentJobCancelActivityResult, ActivityError> {
         unimplemented!("workflow activity definition only")
     }
 
diff --git a/crates/temporal-workflow/src/environment_jobs.rs b/crates/temporal-workflow/src/environment_jobs.rs
new file mode 100644
index 000000000..09ab7b321
--- /dev/null
+++ b/crates/temporal-workflow/src/environment_jobs.rs
@@ -0,0 +1,495 @@
+//! Records and activity contracts of `EnvironmentJobWorkflow`.
+//!
+//! The workflow owns every type it persists in history (arguments,
+//! continue-as-new state, local-activity results, signals and the start
+//! payload). None of them is an environment protocol wire type: the job
+//! activities map between these records and `job/*` at their boundary, so a
+//! protocol change never changes a history shape.
+
+use std::collections::BTreeMap;
+
+use harness::{BlobRef, PromiseSourceCheckResult};
+use serde::{Deserialize, Serialize};
+use uuid::Uuid;
+
+use crate::WorkflowToolStartArgs;
+
+/// A job id on the environment's daemon (`jobId` on the wire). The start
+/// activity validates it when it maps the payload onto `job/start`.
+#[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
+#[serde(transparent)]
+pub struct EnvironmentJobId(String);
+
+impl EnvironmentJobId {
+    pub fn new(value: impl Into<String>) -> Self {
+        Self(value.into())
+    }
+
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+
+    pub fn into_string(self) -> String {
+        self.0
+    }
+}
+
+impl std::fmt::Display for EnvironmentJobId {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(&self.0)
+    }
+}
+
+/// Lifecycle of one job as the workflow records it. Every daemon status has
+/// a variant; `lost` is the workflow's own outcome for a job the daemon no
+/// longer knows.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum EnvironmentJobStatus {
+    /// Waiting for dependencies or its queue.
+    Queued,
+    Running,
+    /// Exited with code 0.
+    Succeeded,
+    /// Exited otherwise, or could not start.
+    Failed,
+    /// Its timeout expired and the daemon stopped it.
+    TimedOut,
+    /// Stopped or never started because of a cancel.
+    Cancelled,
+    /// A dependency did not finish as the dependency policy requires.
+    DependencyFailed,
+    /// The daemon stopped while the job was queued or running.
+    Interrupted,
+    /// The daemon answered `notFound` for the job: it never existed there or
+    /// its record was garbage-collected.
+    Lost,
+}
+
+impl EnvironmentJobStatus {
+    /// `queued` and `running` are live; every other status is final.
+    pub fn is_terminal(self) -> bool {
+        !matches!(self, Self::Queued | Self::Running)
+    }
+
+    pub fn is_success(self) -> bool {
+        self == Self::Succeeded
+    }
+}
+
+/// What the workflow keeps about one job.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct EnvironmentJobRecord {
+    pub job_id: EnvironmentJobId,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub name: Option<String>,
+    pub status: EnvironmentJobStatus,
+    /// Resolved ids of the jobs this one depends on.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub depends_on: Vec<EnvironmentJobId>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub queue_key: Option<String>,
+}
+
+impl EnvironmentJobRecord {
+    /// The record of a job the daemon answered `notFound` for and the
+    /// workflow holds nothing else about.
+    pub fn lost(job_id: EnvironmentJobId) -> Self {
+        Self {
+            job_id,
+            name: None,
+            status: EnvironmentJobStatus::Lost,
+            depends_on: Vec::new(),
+            queue_key: None,
+        }
+    }
+}
+
+/// One job as a poll or cancel activity observed it.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case", tag = "kind", deny_unknown_fields)]
+pub enum EnvironmentJobObservation {
+    /// The daemon's summary, mapped onto the workflow's record.
+    Job { record: EnvironmentJobRecord },
+    /// The daemon answered this entry with `notFound`. The workflow records
+    /// the job as `lost`, a terminal failure.
+    NotFound { job_id: EnvironmentJobId },
+}
+
+impl EnvironmentJobObservation {
+    pub fn job_id(&self) -> &EnvironmentJobId {
+        match self {
+            Self::Job { record } => &record.job_id,
+            Self::NotFound { job_id } => job_id,
+        }
+    }
+}
+
+/// Which jobs a cancel affects.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum EnvironmentJobCancelScope {
+    /// Only the named jobs.
+    #[default]
+    Job,
+    /// The named jobs and every job that transitively depends on them.
+    Dependents,
+}
+
+/// Start payload of a job group, stored in CAS and named by
+/// [`EnvironmentJobStartActivityRequest::request_ref`]. Written once by the
+/// starter, read by the start activity, which resolves credential-bound
+/// secret variables and maps it onto `job/start`. It never holds secret
+/// values. Its content address is the stable fingerprint of the request, so
+/// a starter derives the job-group id (and with it the workflow id) from the
+/// encoded payload.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct EnvironmentJobStartPayloadV1 {
+    /// [`Self::VERSION`].
+    pub version: u32,
+    /// Idempotency key of the start (`requestId` on the wire): a retried
+    /// start with the same id and jobs replays the existing jobs.
+    pub request_id: String,
+    /// Never empty.
+    pub jobs: Vec<EnvironmentJobSpec>,
+}
+
+impl EnvironmentJobStartPayloadV1 {
+    pub const VERSION: u32 = 1;
+
+    pub fn new(request_id: impl Into<String>, jobs: Vec<EnvironmentJobSpec>) -> Self {
+        Self {
+            version: Self::VERSION,
+            request_id: request_id.into(),
+            jobs,
+        }
+    }
+
+    /// The bytes a starter stores in CAS.
+    pub fn encode(&self) -> Result<Vec<u8>, serde_json::Error> {
+        serde_json::to_vec(self)
+    }
+
+    /// Decode a stored payload, checking its version before its shape.
+    pub fn decode(bytes: &[u8]) -> Result<Self, EnvironmentJobStartPayloadError> {
+        #[derive(Deserialize)]
+        struct VersionProbe {
+            version: u32,
+        }
+        let probe: VersionProbe =
+            serde_json::from_slice(bytes).map_err(EnvironmentJobStartPayloadError::Decode)?;
+        if probe.version != Self::VERSION {
+            return Err(EnvironmentJobStartPayloadError::UnsupportedVersion {
+                version: probe.version,
+            });
+        }
+        serde_json::from_slice(bytes).map_err(EnvironmentJobStartPayloadError::Decode)
+    }
+
+    pub fn job_ids(&self) -> Vec<EnvironmentJobId> {
+        self.jobs.iter().map(|job| job.job_id.clone()).collect()
+    }
+}
+
+/// Why a stored start payload could not be read.
+#[derive(Debug)]
+pub enum EnvironmentJobStartPayloadError {
+    Decode(serde_json::Error),
+    UnsupportedVersion { version: u32 },
+}
+
+impl std::fmt::Display for EnvironmentJobStartPayloadError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::Decode(error) => write!(f, "decode environment job start payload: {error}"),
+            Self::UnsupportedVersion { version } => write!(
+                f,
+                "unsupported environment job start payload version {version} (expected {})",
+                EnvironmentJobStartPayloadV1::VERSION
+            ),
+        }
+    }
+}
+
+impl std::error::Error for EnvironmentJobStartPayloadError {
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        match self {
+            Self::Decode(error) => Some(error),
+            Self::UnsupportedVersion { .. } => None,
+        }
+    }
+}
+
+/// One job of a start payload.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct EnvironmentJobSpec {
+    pub job_id: EnvironmentJobId,
+    /// Local name other jobs of the same start can depend on.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub name: Option<String>,
+    pub command: EnvironmentJobCommand,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub depends_on: Vec<EnvironmentJobDependency>,
+    #[serde(
+        default,
+        skip_serializing_if = "EnvironmentJobDependencyPolicy::is_default"
+    )]
+    pub dependency_policy: EnvironmentJobDependencyPolicy,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub queue_key: Option<String>,
+}
+
+/// What a job runs.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct EnvironmentJobCommand {
+    /// Program and arguments. Not empty.
+    pub argv: Vec<String>,
+    /// Absolute working directory in the environment; the daemon's default
+    /// when absent.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub cwd: Option<String>,
+    /// Plain variables. Credential-bound variables are resolved by the start
+    /// activity and never stored here.
+    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+    pub env: BTreeMap<String, String>,
+    /// Text written to standard input, then end of file; `/dev/null` when
+    /// absent.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub stdin: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub timeout_ms: Option<u64>,
+}
+
+/// A dependency of a job.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case", tag = "kind", deny_unknown_fields)]
+pub enum EnvironmentJobDependency {
+    /// An existing job on the daemon, or one in the same start.
+    JobId { job_id: EnvironmentJobId },
+    /// The `name` of a job in the same start.
+    Name { name: String },
+}
+
+/// What a job waits for from its dependencies.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum EnvironmentJobDependencyPolicy {
+    /// Run once every dependency succeeded; otherwise `dependency_failed`.
+    #[default]
+    AllSucceeded,
+    /// Run once every dependency is terminal, whatever its status.
+    AllTerminal,
+}
+
+impl EnvironmentJobDependencyPolicy {
+    pub fn is_default(&self) -> bool {
+        *self == Self::AllSucceeded
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct EnvironmentJobStartActivityRequest {
+    pub universe_id: Uuid,
+    pub environment_id: String,
+    pub job_group_id: String,
+    /// CAS reference of the encoded [`EnvironmentJobStartPayloadV1`].
+    pub request_ref: BlobRef,
+}
+
+/// The started jobs, one record per payload job.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct EnvironmentJobStartActivityResult {
+    pub jobs: Vec<EnvironmentJobRecord>,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct EnvironmentJobSubscription {
+    pub holder_workflow_id: String,
+    pub promise_id: String,
+    pub completion_key: String,
+    pub job_id: EnvironmentJobId,
+    #[serde(default)]
+    pub notified: bool,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct EnvironmentJobWorkflowArgs {
+    pub universe_id: Uuid,
+    pub start: EnvironmentJobStartActivityRequest,
+    pub job_ids: Vec<EnvironmentJobId>,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub subscriptions: Vec<EnvironmentJobSubscription>,
+    #[serde(default)]
+    pub started: bool,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub jobs: Vec<EnvironmentJobRecord>,
+    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+    pub resolutions: BTreeMap<String, PromiseSourceCheckResult>,
+    #[serde(default = "default_environment_job_poll_ms")]
+    pub poll_ms: u64,
+    #[serde(default)]
+    pub poll_attempt: u32,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub workflow_tool: Option<EnvironmentJobWorkflowToolContext>,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct EnvironmentJobWorkflowToolContext {
+    pub execution_id: String,
+    pub invocation_id: harness::WorkflowToolInvocationId,
+}
+
+/// Accepted inputs for the core job workflow. Bare public starts arrive as
+/// fully prepared job arguments; internally supervised starts use the fixed
+/// internally supervised input and are normalized by an activity before
+/// provider work begins.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(untagged)]
+pub enum EnvironmentJobWorkflowInput {
+    WorkflowTool(WorkflowToolStartArgs),
+    Job(EnvironmentJobWorkflowArgs),
+}
+
+impl From<EnvironmentJobWorkflowArgs> for EnvironmentJobWorkflowInput {
+    fn from(value: EnvironmentJobWorkflowArgs) -> Self {
+        Self::Job(value)
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct EnvironmentJobPrepareWorkflowToolRequest {
+    pub start: WorkflowToolStartArgs,
+}
+
+fn default_environment_job_poll_ms() -> u64 {
+    2_000
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct EnvironmentJobWorkflowSnapshot {
+    pub environment_id: String,
+    pub job_group_id: String,
+    #[serde(default)]
+    pub started: bool,
+    #[serde(default)]
+    pub jobs: Vec<EnvironmentJobRecord>,
+    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+    pub resolutions: BTreeMap<String, PromiseSourceCheckResult>,
+    /// Every job of the group has a terminal record and a recorded
+    /// resolution.
+    pub terminal: bool,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub last_error: Option<String>,
+}
+
+/// Poll of the group's jobs that are not settled yet.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct EnvironmentJobPollActivityRequest {
+    pub universe_id: Uuid,
+    pub environment_id: String,
+    pub job_group_id: String,
+    pub job_ids: Vec<EnvironmentJobId>,
+}
+
+/// One observation per polled job. `resolutions` is keyed by job id and
+/// holds the promise result of every job observed terminal, `NotFound`
+/// included (a `Failed` resolution carrying the model-facing result); the
+/// workflow falls back to a `Failed` resolution without a payload for a
+/// `NotFound` job that has none.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct EnvironmentJobPollActivityResult {
+    pub jobs: Vec<EnvironmentJobObservation>,
+    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+    pub resolutions: BTreeMap<String, PromiseSourceCheckResult>,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct EnvironmentJobCancelSignal {
+    pub jobs: Vec<EnvironmentJobId>,
+    #[serde(default)]
+    pub scope: EnvironmentJobCancelScope,
+    #[serde(default)]
+    pub force: bool,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct EnvironmentJobCancelActivityRequest {
+    pub universe_id: Uuid,
+    pub environment_id: String,
+    pub jobs: Vec<EnvironmentJobId>,
+    pub scope: EnvironmentJobCancelScope,
+    pub force: bool,
+}
+
+/// One observation per job the cancel listed (named jobs first, then
+/// dependents). Observations of jobs outside the group are ignored.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct EnvironmentJobCancelActivityResult {
+    pub jobs: Vec<EnvironmentJobObservation>,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn start_payload_round_trips_and_checks_its_version() {
+        let payload = EnvironmentJobStartPayloadV1::new(
+            "jobreq:1",
+            vec![EnvironmentJobSpec {
+                job_id: EnvironmentJobId::new("build"),
+                name: Some("build".to_owned()),
+                command: EnvironmentJobCommand {
+                    argv: vec!["make".to_owned()],
+                    cwd: Some("/workspace".to_owned()),
+                    env: BTreeMap::new(),
+                    stdin: None,
+                    timeout_ms: Some(60_000),
+                },
+                depends_on: vec![EnvironmentJobDependency::Name {
+                    name: "fetch".to_owned(),
+                }],
+                dependency_policy: EnvironmentJobDependencyPolicy::AllTerminal,
+                queue_key: None,
+            }],
+        );
+        let bytes = payload.encode().expect("encode payload");
+        assert_eq!(
+            EnvironmentJobStartPayloadV1::decode(&bytes).expect("decode payload"),
+            payload
+        );
+
+        let mut future: serde_json::Value = serde_json::from_slice(&bytes).expect("json");
+        future["version"] = serde_json::json!(2);
+        future["extra"] = serde_json::json!(true);
+        assert!(matches!(
+            EnvironmentJobStartPayloadV1::decode(&serde_json::to_vec(&future).expect("encode")),
+            Err(EnvironmentJobStartPayloadError::UnsupportedVersion { version: 2 })
+        ));
+    }
+
+    #[test]
+    fn only_live_statuses_are_not_terminal() {
+        use EnvironmentJobStatus::*;
+        for status in [Queued, Running] {
+            assert!(!status.is_terminal());
+        }
+        for status in [
+            Succeeded,
+            Failed,
+            TimedOut,
+            Cancelled,
+            DependencyFailed,
+            Interrupted,
+            Lost,
+        ] {
+            assert!(status.is_terminal());
+        }
+        assert!(Succeeded.is_success());
+        assert!(!Lost.is_success());
+    }
+}
diff --git a/crates/temporal-workflow/src/lib.rs b/crates/temporal-workflow/src/lib.rs
index 57ce0f75d..cef7a3453 100644
--- a/crates/temporal-workflow/src/lib.rs
+++ b/crates/temporal-workflow/src/lib.rs
@@ -5,6 +5,18 @@ mod code_execution;
 mod code_tools;
 pub use code_tools::*;
 mod config;
+mod environment_jobs;
+pub use environment_jobs::{
+    EnvironmentJobCancelActivityRequest, EnvironmentJobCancelActivityResult,
+    EnvironmentJobCancelScope, EnvironmentJobCancelSignal, EnvironmentJobCommand,
+    EnvironmentJobDependency, EnvironmentJobDependencyPolicy, EnvironmentJobId,
+    EnvironmentJobObservation, EnvironmentJobPollActivityRequest, EnvironmentJobPollActivityResult,
+    EnvironmentJobPrepareWorkflowToolRequest, EnvironmentJobRecord, EnvironmentJobSpec,
+    EnvironmentJobStartActivityRequest, EnvironmentJobStartActivityResult,
+    EnvironmentJobStartPayloadError, EnvironmentJobStartPayloadV1, EnvironmentJobStatus,
+    EnvironmentJobSubscription, EnvironmentJobWorkflowArgs, EnvironmentJobWorkflowInput,
+    EnvironmentJobWorkflowSnapshot, EnvironmentJobWorkflowToolContext,
+};
 mod rehydrate;
 mod session_preparation;
 mod temporal_helpers;
@@ -62,28 +74,22 @@ pub use types::{
     AwaitEnvironmentReadyActivityRequest, AwaitEnvironmentReadyActivityResult,
     AwaitMaterializationRequest, AwaitMaterializationResult, AwaitOutcome, AwaitPromiseResult,
     CancellingWatchdog, ContextCompactActivityRequest, CreateOrLoadSessionRequest,
-    CreateOrLoadSessionResult, EnvironmentJobCancelActivityRequest, EnvironmentJobCancelSignal,
-    EnvironmentJobPollActivityRequest, EnvironmentJobPollActivityResult,
-    EnvironmentJobPrepareWorkflowToolRequest, EnvironmentJobStartActivityRequest,
-    EnvironmentJobStartActivityResult, EnvironmentJobStartPayload, EnvironmentJobSubscription,
-    EnvironmentJobWorkflowArgs, EnvironmentJobWorkflowInput, EnvironmentJobWorkflowSnapshot,
-    EnvironmentJobWorkflowToolContext, JoinedContextPreparationRequest,
-    LLM_PROVIDER_TRANSIENT_ERROR_TYPE, LLM_TRANSIENT_FAILURE_DETAILS_VERSION,
-    LlmGenerateActivityRequest, LlmTransientFailureDetails, PendingEmission,
-    PendingPromiseCancellation, PendingSourceResolution, PendingToolBatchResume, PromiseSourcePoll,
-    PutBlobRequest, ReadBlobRequest, ReadBlobResult, RuntimeProjectionRefreshActivityRequest,
-    RuntimeProjectionRefreshActivityResult, SessionBootstrapPayloadTooLarge, SubagentChildRef,
-    SubagentCloseActivityRequest, SubagentExecutionPhase, SubagentExecutionSnapshot,
-    SubagentPrepareActivityRequest, SubagentPrepareActivityResult, SubagentResolveActivityRequest,
-    SubagentTerminal, ToolInvokeBatchActivityRequest, ToolInvokeCallActivityRequest,
-    ToolInvokeCallActivityResult, ToolPreparePromiseControlsActivityRequest,
-    WORKFLOW_TOOL_RECIPE_FINGERPRINT_PREFIX, WORKFLOW_TOOL_RECIPE_FORMAT_V1,
-    WORKFLOW_TOOL_RECOVERY_QUERY, WorkflowToolExecutionCancelRequest,
-    WorkflowToolExecutionCheckRequest, WorkflowToolRecipeV1, WorkflowToolRecoveryResult,
-    WorkflowToolReplyValidationRequest, WorkflowToolReplyValidationResult,
-    WorkflowToolStartActivityRequest, WorkflowToolStartActivityResult, WorkflowToolStartArgs,
-    compose_environment_job_workflow_id, compose_workflow_id, split_workflow_id,
-    workflow_tool_recipe_fingerprint,
+    CreateOrLoadSessionResult, JoinedContextPreparationRequest, LLM_PROVIDER_TRANSIENT_ERROR_TYPE,
+    LLM_TRANSIENT_FAILURE_DETAILS_VERSION, LlmGenerateActivityRequest, LlmTransientFailureDetails,
+    PendingEmission, PendingPromiseCancellation, PendingSourceResolution, PendingToolBatchResume,
+    PromiseSourcePoll, PutBlobRequest, ReadBlobRequest, ReadBlobResult,
+    RuntimeProjectionRefreshActivityRequest, RuntimeProjectionRefreshActivityResult,
+    SessionBootstrapPayloadTooLarge, SubagentChildRef, SubagentCloseActivityRequest,
+    SubagentExecutionPhase, SubagentExecutionSnapshot, SubagentPrepareActivityRequest,
+    SubagentPrepareActivityResult, SubagentResolveActivityRequest, SubagentTerminal,
+    ToolInvokeBatchActivityRequest, ToolInvokeCallActivityRequest, ToolInvokeCallActivityResult,
+    ToolPreparePromiseControlsActivityRequest, WORKFLOW_TOOL_RECIPE_FINGERPRINT_PREFIX,
+    WORKFLOW_TOOL_RECIPE_FORMAT_V1, WORKFLOW_TOOL_RECOVERY_QUERY,
+    WorkflowToolExecutionCancelRequest, WorkflowToolExecutionCheckRequest, WorkflowToolRecipeV1,
+    WorkflowToolRecoveryResult, WorkflowToolReplyValidationRequest,
+    WorkflowToolReplyValidationResult, WorkflowToolStartActivityRequest,
+    WorkflowToolStartActivityResult, WorkflowToolStartArgs, compose_environment_job_workflow_id,
+    compose_workflow_id, split_workflow_id, workflow_tool_recipe_fingerprint,
 };
 pub use workflows::bots;
 pub use workflows::channels;
diff --git a/crates/temporal-workflow/src/types.rs b/crates/temporal-workflow/src/types.rs
index 1994cc1ee..d24f73735 100644
--- a/crates/temporal-workflow/src/types.rs
+++ b/crates/temporal-workflow/src/types.rs
@@ -400,79 +400,6 @@ pub struct CancellingWatchdog {
     pub since_ms: u64,
 }
 
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct EnvironmentJobStartActivityRequest {
-    pub universe_id: Uuid,
-    pub environment_id: String,
-    pub job_group_id: String,
-    pub request_ref: BlobRef,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct EnvironmentJobStartPayload {
-    pub request: environment_protocol::data::jobs::StartJobsParams,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct EnvironmentJobStartActivityResult {
-    pub jobs: Vec<environment_protocol::data::jobs::JobSummary>,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct EnvironmentJobSubscription {
-    pub holder_workflow_id: String,
-    pub promise_id: String,
-    pub completion_key: String,
-    pub job_id: environment_protocol::shared::JobId,
-    #[serde(default)]
-    pub notified: bool,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct EnvironmentJobWorkflowArgs {
-    pub universe_id: Uuid,
-    pub start: EnvironmentJobStartActivityRequest,
-    pub job_ids: Vec<environment_protocol::shared::JobId>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub subscriptions: Vec<EnvironmentJobSubscription>,
-    #[serde(default)]
-    pub started: bool,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub jobs: Vec<environment_protocol::data::jobs::JobSummary>,
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    pub resolutions: BTreeMap<String, harness::PromiseSourceCheckResult>,
-    #[serde(default = "default_environment_job_poll_ms")]
-    pub poll_ms: u64,
-    #[serde(default)]
-    pub poll_attempt: u32,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub workflow_tool: Option<EnvironmentJobWorkflowToolContext>,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct EnvironmentJobWorkflowToolContext {
-    pub execution_id: String,
-    pub invocation_id: harness::WorkflowToolInvocationId,
-}
-
-/// Accepted inputs for the core job workflow. Bare public starts arrive as
-/// fully prepared job arguments; internally supervised starts use the fixed
-/// internally supervised input and are normalized by an activity before
-/// provider work begins.
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(untagged)]
-pub enum EnvironmentJobWorkflowInput {
-    WorkflowTool(WorkflowToolStartArgs),
-    Job(EnvironmentJobWorkflowArgs),
-}
-
-impl From<EnvironmentJobWorkflowArgs> for EnvironmentJobWorkflowInput {
-    fn from(value: EnvironmentJobWorkflowArgs) -> Self {
-        Self::Job(value)
-    }
-}
-
-/// Sub-agent execution: one delegation supervised by
 /// `SubagentExecutionWorkflow`, started on call by the parent session.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub struct SubagentPrepareActivityRequest {
@@ -547,62 +474,6 @@ pub struct SubagentExecutionSnapshot {
     pub resolution: Option<harness::PromiseResolution>,
 }
 
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct EnvironmentJobPrepareWorkflowToolRequest {
-    pub start: WorkflowToolStartArgs,
-}
-
-fn default_environment_job_poll_ms() -> u64 {
-    2_000
-}
-
-#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub struct EnvironmentJobWorkflowSnapshot {
-    pub environment_id: String,
-    pub job_group_id: String,
-    #[serde(default)]
-    pub started: bool,
-    #[serde(default)]
-    pub jobs: Vec<environment_protocol::data::jobs::JobSummary>,
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    pub resolutions: BTreeMap<String, harness::PromiseSourceCheckResult>,
-    pub terminal: bool,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub last_error: Option<String>,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct EnvironmentJobPollActivityRequest {
-    pub universe_id: Uuid,
-    pub environment_id: String,
-    pub job_group_id: String,
-    pub job_ids: Vec<environment_protocol::shared::JobId>,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct EnvironmentJobPollActivityResult {
-    pub jobs: Vec<environment_protocol::data::jobs::JobSummary>,
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    pub resolutions: BTreeMap<String, harness::PromiseSourceCheckResult>,
-    pub terminal: bool,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct EnvironmentJobCancelSignal {
-    pub jobs: Vec<environment_protocol::shared::JobId>,
-    pub scope: environment_protocol::data::jobs::JobCancelScope,
-    pub force: bool,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct EnvironmentJobCancelActivityRequest {
-    pub universe_id: Uuid,
-    pub environment_id: String,
-    pub jobs: Vec<environment_protocol::shared::JobId>,
-    pub scope: environment_protocol::data::jobs::JobCancelScope,
-    pub force: bool,
-}
-
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub struct CreateOrLoadSessionRequest {
     pub session_id: SessionId,
diff --git a/crates/temporal-workflow/src/workflows/environment_job.rs b/crates/temporal-workflow/src/workflows/environment_job.rs
index d948e7fb5..79927389d 100644
--- a/crates/temporal-workflow/src/workflows/environment_job.rs
+++ b/crates/temporal-workflow/src/workflows/environment_job.rs
@@ -10,10 +10,12 @@ use temporalio_sdk::{
 
 use crate::{
     AgentSessionWorkflow, DEFAULT_CONTINUE_AS_NEW_HISTORY_THRESHOLD,
-    EnvironmentJobCancelActivityRequest, EnvironmentJobCancelSignal,
-    EnvironmentJobPollActivityRequest, EnvironmentJobSubscription, EnvironmentJobWorkflowInput,
-    EnvironmentJobWorkflowSnapshot, EnvironmentJobWorkflowToolContext, WorkflowActivities,
-    WorkflowToolRecoveryResult, compose_environment_job_workflow_id,
+    EnvironmentJobCancelActivityRequest, EnvironmentJobCancelScope, EnvironmentJobCancelSignal,
+    EnvironmentJobId, EnvironmentJobObservation, EnvironmentJobPollActivityRequest,
+    EnvironmentJobPollActivityResult, EnvironmentJobRecord, EnvironmentJobStatus,
+    EnvironmentJobSubscription, EnvironmentJobWorkflowInput, EnvironmentJobWorkflowSnapshot,
+    EnvironmentJobWorkflowToolContext, WorkflowActivities, WorkflowToolRecoveryResult,
+    compose_environment_job_workflow_id,
 };
 
 #[workflow]
@@ -82,6 +84,7 @@ impl EnvironmentJobWorkflow {
             state.snapshot.started = args.started;
             state.snapshot.jobs = args.jobs.clone();
             state.snapshot.resolutions = args.resolutions.clone();
+            refresh_terminal(&mut state.snapshot, &args.job_ids);
             state.workflow_tool = args.workflow_tool.clone();
             for subscription in args.subscriptions.drain(..) {
                 if !state.subscriptions.iter().any(|existing| {
@@ -137,17 +140,9 @@ impl EnvironmentJobWorkflow {
                     )
                     .await
                 {
-                    Ok(jobs) => ctx.state_mut(|state| {
-                        for job in jobs {
-                            if let Some(existing) = state
-                                .snapshot
-                                .jobs
-                                .iter_mut()
-                                .find(|existing| existing.job_id == job.job_id)
-                            {
-                                *existing = job;
-                            }
-                        }
+                    Ok(result) => ctx.state_mut(|state| {
+                        apply_observations(&mut state.snapshot, &args.job_ids, result.jobs);
+                        refresh_terminal(&mut state.snapshot, &args.job_ids);
                         state.snapshot.last_error = None;
                     }),
                     Err(error) => {
@@ -156,7 +151,8 @@ impl EnvironmentJobWorkflow {
                 }
             }
 
-            if !ctx.state(|state| state.snapshot.terminal) {
+            let unsettled = ctx.state(|state| unsettled_job_ids(&state.snapshot, &args.job_ids));
+            if !unsettled.is_empty() {
                 match ctx
                     .execute_local_activity(
                         WorkflowActivities::environment_job_poll,
@@ -164,7 +160,7 @@ impl EnvironmentJobWorkflow {
                             universe_id: args.universe_id,
                             environment_id: args.start.environment_id.clone(),
                             job_group_id: args.start.job_group_id.clone(),
-                            job_ids: args.job_ids.clone(),
+                            job_ids: unsettled,
                         },
                         environment_job_activity_options(),
                     )
@@ -172,9 +168,7 @@ impl EnvironmentJobWorkflow {
                 {
                     Ok(result) => {
                         ctx.state_mut(|state| {
-                            state.snapshot.jobs = result.jobs;
-                            state.snapshot.resolutions.extend(result.resolutions);
-                            state.snapshot.terminal = result.terminal;
+                            apply_poll_result(&mut state.snapshot, &args.job_ids, result);
                             state.snapshot.last_error = None;
                         });
                     }
@@ -298,7 +292,7 @@ async fn cancel_workflow_jobs(
                 universe_id: args.universe_id,
                 environment_id: args.start.environment_id.clone(),
                 jobs,
-                scope: environment_protocol::data::jobs::JobCancelScope::Job,
+                scope: EnvironmentJobCancelScope::Job,
                 force: false,
             },
             environment_job_activity_options(),
@@ -306,6 +300,86 @@ async fn cancel_workflow_jobs(
         .await;
 }
 
+/// Apply a poll: record the resolutions, then the observations. A job the
+/// daemon answered `notFound` for is `lost`; when the activity returned no
+/// resolution for it, the job still settles as a failure without a payload,
+/// so its subscribers are released.
+fn apply_poll_result(
+    snapshot: &mut EnvironmentJobWorkflowSnapshot,
+    job_ids: &[EnvironmentJobId],
+    result: EnvironmentJobPollActivityResult,
+) {
+    snapshot.resolutions.extend(
+        result
+            .resolutions
+            .into_iter()
+            .filter(|(job_id, _)| job_ids.iter().any(|id| id.as_str() == job_id)),
+    );
+    for observation in &result.jobs {
+        if let EnvironmentJobObservation::NotFound { job_id } = observation
+            && job_ids.contains(job_id)
+        {
+            snapshot
+                .resolutions
+                .entry(job_id.as_str().to_owned())
+                .or_insert(harness::PromiseSourceCheckResult::Failed { error_ref: None });
+        }
+    }
+    apply_observations(snapshot, job_ids, result.jobs);
+    refresh_terminal(snapshot, job_ids);
+}
+
+/// A summary replaces the job's record; `notFound` marks the job `lost`,
+/// keeping what the workflow already knew about it. Observations of jobs
+/// outside the group (such as dependents a cancel reached) are ignored.
+fn apply_observations(
+    snapshot: &mut EnvironmentJobWorkflowSnapshot,
+    job_ids: &[EnvironmentJobId],
+    observations: Vec<EnvironmentJobObservation>,
+) {
+    for observation in observations {
+        if !job_ids.contains(observation.job_id()) {
+            continue;
+        }
+        let existing = snapshot
+            .jobs
+            .iter_mut()
+            .find(|existing| &existing.job_id == observation.job_id());
+        match (observation, existing) {
+            (EnvironmentJobObservation::Job { record }, Some(existing)) => *existing = record,
+            (EnvironmentJobObservation::Job { record }, None) => snapshot.jobs.push(record),
+            (EnvironmentJobObservation::NotFound { .. }, Some(existing)) => {
+                existing.status = EnvironmentJobStatus::Lost;
+            }
+            (EnvironmentJobObservation::NotFound { job_id }, None) => {
+                snapshot.jobs.push(EnvironmentJobRecord::lost(job_id));
+            }
+        }
+    }
+}
+
+/// Jobs of the group without both a terminal record and a resolution.
+fn unsettled_job_ids(
+    snapshot: &EnvironmentJobWorkflowSnapshot,
+    job_ids: &[EnvironmentJobId],
+) -> Vec<EnvironmentJobId> {
+    job_ids
+        .iter()
+        .filter(|job_id| {
+            let terminal = snapshot
+                .jobs
+                .iter()
+                .any(|job| &job.job_id == *job_id && job.status.is_terminal());
+            !(terminal && snapshot.resolutions.contains_key(job_id.as_str()))
+        })
+        .cloned()
+        .collect()
+}
+
+fn refresh_terminal(snapshot: &mut EnvironmentJobWorkflowSnapshot, job_ids: &[EnvironmentJobId]) {
+    snapshot.terminal = !job_ids.is_empty() && unsettled_job_ids(snapshot, job_ids).is_empty();
+}
+
 /// Environment jobs deliberately remain co-located with the core environment
 /// registry and environment adapter. Their short, idempotent adapter calls therefore
 /// run as local activities: Temporal still records completion and retries, but
@@ -358,7 +432,7 @@ fn queue_workflow_tool_cancellation(
     {
         state.pending_cancels.push(EnvironmentJobCancelSignal {
             jobs: vec![subscription.job_id.clone()],
-            scope: environment_protocol::data::jobs::JobCancelScope::Job,
+            scope: EnvironmentJobCancelScope::Job,
             force: false,
         });
     }
@@ -456,7 +530,8 @@ fn workflow_tool_recovery(state: &EnvironmentJobWorkflow) -> WorkflowToolRecover
 
 #[cfg(test)]
 mod tests {
-    use environment_protocol::shared::JobId;
+    use std::collections::BTreeMap;
+
     use harness::{BlobRef, PromiseSourceCheckResult};
 
     use super::*;
@@ -466,7 +541,7 @@ mod tests {
             holder_workflow_id: "universe/session_1".to_owned(),
             promise_id: "promise_1".to_owned(),
             completion_key: "job_1".to_owned(),
-            job_id: JobId::new("job_1"),
+            job_id: EnvironmentJobId::new("job_1"),
             notified: false,
         }
     }
@@ -515,6 +590,143 @@ mod tests {
         assert!(second.is_empty());
     }
 
+    fn record(job_id: &str, status: EnvironmentJobStatus) -> EnvironmentJobRecord {
+        EnvironmentJobRecord {
+            job_id: EnvironmentJobId::new(job_id),
+            name: Some(job_id.to_owned()),
+            status,
+            depends_on: Vec::new(),
+            queue_key: None,
+        }
+    }
+
+    #[test]
+    fn not_found_settles_the_job_as_lost() {
+        let job_ids = vec![
+            EnvironmentJobId::new("job_1"),
+            EnvironmentJobId::new("job_2"),
+        ];
+        let mut snapshot = EnvironmentJobWorkflowSnapshot {
+            started: true,
+            jobs: vec![
+                record("job_1", EnvironmentJobStatus::Running),
+                record("job_2", EnvironmentJobStatus::Queued),
+            ],
+            ..Default::default()
+        };
+        assert_eq!(unsettled_job_ids(&snapshot, &job_ids), job_ids);
+
+        let done = BlobRef::from_bytes(b"done");
+        apply_poll_result(
+            &mut snapshot,
+            &job_ids,
+            EnvironmentJobPollActivityResult {
+                jobs: vec![
+                    EnvironmentJobObservation::Job {
+                        record: record("job_1", EnvironmentJobStatus::Succeeded),
+                    },
+                    EnvironmentJobObservation::NotFound {
+                        job_id: EnvironmentJobId::new("job_2"),
+                    },
+                    EnvironmentJobObservation::NotFound {
+                        job_id: EnvironmentJobId::new("elsewhere"),
+                    },
+                ],
+                resolutions: BTreeMap::from([(
+                    "job_1".to_owned(),
+                    PromiseSourceCheckResult::Resolved {
+                        payload_ref: Some(done.clone()),
+                    },
+                )]),
+            },
+        );
+
+        assert!(snapshot.terminal);
+        assert!(unsettled_job_ids(&snapshot, &job_ids).is_empty());
+        assert_eq!(snapshot.jobs.len(), 2);
+        assert_eq!(snapshot.jobs[1].status, EnvironmentJobStatus::Lost);
+        // The record keeps what the workflow knew before the job was lost.
+        assert_eq!(snapshot.jobs[1].name.as_deref(), Some("job_2"));
+        assert_eq!(
+            snapshot.resolutions.get("job_2"),
+            Some(&PromiseSourceCheckResult::Failed { error_ref: None })
+        );
+        assert!(!snapshot.resolutions.contains_key("elsewhere"));
+    }
+
+    #[test]
+    fn activity_resolution_of_a_lost_job_wins_and_running_jobs_stay_unsettled() {
+        let job_ids = vec![
+            EnvironmentJobId::new("job_1"),
+            EnvironmentJobId::new("job_2"),
+        ];
+        let mut snapshot = EnvironmentJobWorkflowSnapshot::default();
+        let lost = BlobRef::from_bytes(b"lost");
+        apply_poll_result(
+            &mut snapshot,
+            &job_ids,
+            EnvironmentJobPollActivityResult {
+                jobs: vec![
+                    EnvironmentJobObservation::NotFound {
+                        job_id: EnvironmentJobId::new("job_1"),
+                    },
+                    EnvironmentJobObservation::Job {
+                        record: record("job_2", EnvironmentJobStatus::Running),
+                    },
+                ],
+                resolutions: BTreeMap::from([(
+                    "job_1".to_owned(),
+                    PromiseSourceCheckResult::Failed {
+                        error_ref: Some(lost.clone()),
+                    },
+                )]),
+            },
+        );
+
+        assert!(!snapshot.terminal);
+        assert_eq!(
+            snapshot.jobs[0],
+            EnvironmentJobRecord::lost(EnvironmentJobId::new("job_1"))
+        );
+        assert_eq!(
+            snapshot.resolutions.get("job_1"),
+            Some(&PromiseSourceCheckResult::Failed {
+                error_ref: Some(lost)
+            })
+        );
+        assert_eq!(
+            unsettled_job_ids(&snapshot, &job_ids),
+            vec![EnvironmentJobId::new("job_2")]
+        );
+    }
+
+    #[test]
+    fn cancel_not_found_marks_lost_but_waits_for_the_poll_resolution() {
+        let job_ids = vec![EnvironmentJobId::new("job_1")];
+        let mut snapshot = EnvironmentJobWorkflowSnapshot {
+            jobs: vec![record("job_1", EnvironmentJobStatus::Running)],
+            ..Default::default()
+        };
+        apply_observations(
+            &mut snapshot,
+            &job_ids,
+            vec![
+                EnvironmentJobObservation::NotFound {
+                    job_id: EnvironmentJobId::new("job_1"),
+                },
+                EnvironmentJobObservation::Job {
+                    record: record("dependent", EnvironmentJobStatus::Cancelled),
+                },
+            ],
+        );
+        refresh_terminal(&mut snapshot, &job_ids);
+
+        assert_eq!(snapshot.jobs.len(), 1);
+        assert_eq!(snapshot.jobs[0].status, EnvironmentJobStatus::Lost);
+        assert!(!snapshot.terminal);
+        assert_eq!(unsettled_job_ids(&snapshot, &job_ids), job_ids);
+    }
+
     #[test]
     fn workflow_tool_cancellation_targets_only_the_matching_job() {
         let invocation_id =
@@ -545,7 +757,10 @@ mod tests {
         );
 
         assert_eq!(workflow.pending_cancels.len(), 1);
-        assert_eq!(workflow.pending_cancels[0].jobs, vec![JobId::new("job_1")]);
+        assert_eq!(
+            workflow.pending_cancels[0].jobs,
+            vec![EnvironmentJobId::new("job_1")]
+        );
         assert!(workflow.nudged);
 
         queue_workflow_tool_cancellation(
diff --git a/crates/temporal-workflow/src/workflows/session/preparation.rs b/crates/temporal-workflow/src/workflows/session/preparation.rs
index c84d39480..f9d6d6c87 100644
--- a/crates/temporal-workflow/src/workflows/session/preparation.rs
+++ b/crates/temporal-workflow/src/workflows/session/preparation.rs
@@ -380,8 +380,8 @@ async fn prepare_operation(
                     "session configuration revision changed",
                 ));
             }
-            summary.config_changed = drive.state().lifecycle.config.as_ref() != Some(&config);
             configure(ctx, drive, &mut candidate, config, expected_revision).await?;
+            summary.config_changed = config_changed(drive, &candidate);
         }
         SessionOperation::ApplyProfile {
             profile,
@@ -418,6 +418,14 @@ async fn prepare_operation(
     Ok((candidate, summary))
 }
 
+/// Whether the candidate's admitted configuration differs from the live one.
+/// Admission materializes defaults (such as the compaction policy) into the
+/// requested document, so comparing the request itself would report a
+/// change for a replacement the harness admits as a no-op.
+fn config_changed(live: &CoreAgentDrive, candidate: &PreparationCandidate) -> bool {
+    live.state().lifecycle.config != candidate.state().lifecycle.config
+}
+
 async fn configure(
     ctx: &mut WorkflowContext<AgentSessionWorkflow>,
     drive: &mut CoreAgentDrive,
@@ -504,7 +512,6 @@ async fn apply_profile(
         workflow_time_ms(ctx),
     )?;
     if profile.config.is_some() {
-        summary.config_changed = drive.state().lifecycle.config.as_ref() != Some(&config);
         candidate.push(
             CoreAgentCommand::ReplaceSessionConfig {
                 expected_revision,
@@ -512,6 +519,7 @@ async fn apply_profile(
             },
             workflow_time_ms(ctx),
         )?;
+        summary.config_changed = config_changed(drive, candidate);
     }
     // The default fills an empty pointer and never overrides a live
     // selection. The configuration replacement above has already cleared a
@@ -690,6 +698,68 @@ pub(super) fn abandon_pending_run(state: &mut AgentSessionWorkflow) {
 mod tests {
     use super::*;
 
+    /// A live session opened with the default configuration, whose admission
+    /// materialized the default compaction policy.
+    fn opened_live() -> CoreAgentDrive {
+        let empty = CoreAgentDrive::from_replayed(
+            SessionId::new("config-changed"),
+            CoreAgentState::new(),
+            None,
+        );
+        let mut opening = PreparationCandidate::new(&empty);
+        opening
+            .push(
+                CoreAgentCommand::OpenSession {
+                    config: crate::default_session_config(harness::ModelSelection {
+                        api_kind: harness::ProviderApiKind::OpenAiResponses,
+                        provider_id: "openai".into(),
+                        model: "gpt-test".into(),
+                    }),
+                },
+                1,
+            )
+            .unwrap();
+        let state = opening.state().clone();
+        let head = state.reduced_to.clone();
+        CoreAgentDrive::from_replayed(empty.session_id().clone(), state, head)
+    }
+
+    #[test]
+    fn config_change_compares_the_admitted_configuration() {
+        let live = opened_live();
+        let current = live.state().lifecycle.config.clone().unwrap();
+        assert!(current.context.compaction.is_some());
+        // A profile document omits the defaults admission fills in: the same
+        // configuration is no change.
+        let mut same = current.clone();
+        same.context.compaction = None;
+        let mut candidate = PreparationCandidate::new(&live);
+        candidate
+            .push(
+                CoreAgentCommand::ReplaceSessionConfig {
+                    expected_revision: None,
+                    config: same,
+                },
+                2,
+            )
+            .unwrap();
+        assert!(!config_changed(&live, &candidate));
+
+        let mut other = current;
+        other.model.model = "gpt-other".into();
+        let mut candidate = PreparationCandidate::new(&live);
+        candidate
+            .push(
+                CoreAgentCommand::ReplaceSessionConfig {
+                    expected_revision: None,
+                    config: other,
+                },
+                2,
+            )
+            .unwrap();
+        assert!(config_changed(&live, &candidate));
+    }
+
     fn pending() -> PendingRunPreparation {
         let config = crate::default_session_config(harness::ModelSelection {
             api_kind: harness::ProviderApiKind::OpenAiResponses,
diff --git a/crates/tools/Cargo.toml b/crates/tools/Cargo.toml
index 7428e7895..0d2da8f64 100644
--- a/crates/tools/Cargo.toml
+++ b/crates/tools/Cargo.toml
@@ -8,9 +8,10 @@ api = { path = "../api" }
 async-trait = "0.1"
 harness = { path = "../harness", features = ["contract"] }
 futures-util = "0.3"
-glob = "0.3"
+globset = "0.4"
+ignore = "0.4"
 environment-client = { path = "../environment-client" }
-environment-protocol = { path = "../environment-protocol", features = ["schema"] }
+environment-protocol = { path = "../environment-protocol" }
 jsonschema = { version = "0.58", default-features = false }
 regex = "1"
 schemars = "1"
diff --git a/crates/tools/src/builtin/canonical.rs b/crates/tools/src/builtin/canonical.rs
index c3087217d..db334315b 100644
--- a/crates/tools/src/builtin/canonical.rs
+++ b/crates/tools/src/builtin/canonical.rs
@@ -498,7 +498,7 @@ fn job_submit_schema() -> Value {
                         "job_id": {
                             "type": "string",
                             "pattern": "^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$",
-                            "description": "Your name for the job (for example \"build\"). It keys the job's promise in the result and identifies the job to job_read."
+                            "description": "Your name for this run of the job (for example \"build\"). It keys the job's promise in the result and identifies the job to job_read. An id names one run: to run a command again, choose a new id."
                         },
                         "argv": { "type": "array", "items": { "type": "string" } },
                         "cwd": { "type": ["string", "null"] },
@@ -578,9 +578,16 @@ fn job_read_schema() -> Value {
         "type": "object",
         "properties": {
             "jobs": { "type": "array", "items": job_handle_schema() },
-            "output_bytes": { "type": ["integer", "null"], "minimum": 0 },
-            "after_seq": { "type": ["integer", "null"], "minimum": 0 },
-            "include_artifacts": { "type": "boolean" }
+            "output_bytes": {
+                "type": ["integer", "null"],
+                "minimum": 0,
+                "description": "Output bytes to show per job. Without `after`, half come from the start of the output and half from its end."
+            },
+            "after": {
+                "type": ["integer", "null"],
+                "minimum": 0,
+                "description": "Byte offset to read forward from, such as a result's `output_next` or its omitted range's `offset`."
+            }
         },
         "required": ["jobs"],
         "additionalProperties": false,
diff --git a/crates/tools/src/builtin/output_schema_tests.rs b/crates/tools/src/builtin/output_schema_tests.rs
index 776aaf8d3..520f2ac58 100644
--- a/crates/tools/src/builtin/output_schema_tests.rs
+++ b/crates/tools/src/builtin/output_schema_tests.rs
@@ -289,24 +289,22 @@ async fn process_schema_requires_one_typed_encoding_per_stream() {
 fn durable_job_and_agent_results_preserve_their_exact_serialized_names() {
     use crate::environment::jobs::{
         JobHandle, JobSubmitResult, JobSubmitted, ModelJobOutputSegment, ModelJobResult,
-        ModelJobResultSet,
+        ModelJobResultSet, ModelJobStatus, ModelJobSummary, ModelOutputOmission, ModelOutputStream,
+        ModelStoppedBy,
     };
     use crate::subagents::{SubagentResultEnvelope, SubagentResultStatus, SubagentToolKind};
-    use environment_protocol::{
-        data::jobs::{JobArtifact, JobOutputStream, JobStatus, JobSummary},
-        shared::{EnvironmentPath, JobId},
-    };
+    use environment_protocol::ids::JobId;
 
     let handle = JobHandle {
         environment_id: "env-1".into(),
-        job_id: JobId::new("build"),
+        job_id: JobId::new("build").unwrap(),
     };
     let submitted = JobSubmitResult {
         jobs: vec![JobSubmitted {
             name: Some("Build".into()),
             job_id: handle.job_id.clone(),
             handle: Some(handle.clone()),
-            status: JobStatus::Queued,
+            status: ModelJobStatus::Queued,
             dependencies: vec![],
             queue_key: None,
             promise: Some("promise_1".into()),
@@ -319,35 +317,48 @@ fn durable_job_and_agent_results_preserve_their_exact_serialized_names() {
     .expect("submitted jobs");
     let result = ModelJobResult {
         handle: Some(handle),
-        summary: Some(JobSummary {
-            namespace: "session".into(),
-            job_id: JobId::new("build"),
+        summary: Some(ModelJobSummary {
+            job_id: JobId::new("build").unwrap(),
             name: None,
-            status: JobStatus::TimedOut,
-            dependencies: vec![],
+            status: ModelJobStatus::TimedOut,
+            depends_on: vec![],
+            queue_key: None,
             created_at_ms: 1,
-            queued_at_ms: None,
             started_at_ms: Some(2),
             finished_at_ms: Some(3),
+            duration_ms: Some(1),
             exit_code: None,
-            orphaned_descendants: true,
-            failure: None,
-            queue_key: None,
+            signal: Some("SIGTERM".into()),
+            core_dumped: false,
+            stopped_by: Some(ModelStoppedBy::Timeout),
+            swept_processes: vec![crate::environment::process::LeftoverProcess {
+                pid: 7,
+                command: "sleep 100".into(),
+            }],
+            error: None,
         }),
         output: vec![ModelJobOutputSegment {
-            stream: JobOutputStream::Stdout,
+            stream: ModelOutputStream::Stdout,
+            text: Some("start".into()),
+            blob_ref: None,
+            media_type: None,
+            byte_len: None,
+        }],
+        omitted: Some(ModelOutputOmission {
+            offset: 5,
+            bytes: 90,
+            lost_bytes: 0,
+        }),
+        tail: vec![ModelJobOutputSegment {
+            stream: ModelOutputStream::Stderr,
             text: Some("done".into()),
             blob_ref: None,
             media_type: None,
             byte_len: Some(4),
         }],
-        output_next_seq: 9,
+        output_next: 99,
+        output_end: 99,
         truncated: false,
-        artifacts: vec![JobArtifact {
-            path: EnvironmentPath::new("/out").unwrap(),
-            kind: None,
-            metadata: Default::default(),
-        }],
         error: None,
     };
     let schema = validator(BuiltinTool::environment_canonical(
@@ -355,8 +366,8 @@ fn durable_job_and_agent_results_preserve_their_exact_serialized_names() {
     ));
     schema.validate(&serialized(&result)).expect("joined job");
     let mut invalid = serialized(&result);
-    invalid["summary"]["status"] = json!("timed_out");
-    assert!(!schema.is_valid(&invalid), "job statuses use camelCase");
+    invalid["summary"]["status"] = json!("timedOut");
+    assert!(!schema.is_valid(&invalid), "job statuses use snake_case");
     validator(BuiltinTool::environment_canonical(
         BuiltinToolOperation::JobRead,
     ))
diff --git a/crates/tools/src/builtin/shared.rs b/crates/tools/src/builtin/shared.rs
index bb57517e1..cd4bb2b66 100644
--- a/crates/tools/src/builtin/shared.rs
+++ b/crates/tools/src/builtin/shared.rs
@@ -31,6 +31,9 @@ pub(super) fn visible_with_search_stop(
         crate::fs::FsSearchStop::TimeLimit => {
             "[truncated: time budget exhausted — narrow the path or add an include filter]"
         }
+        crate::fs::FsSearchStop::ResponseLimit => {
+            "[truncated: response size limit reached — narrow the pattern or the path]"
+        }
     };
     if !visible.is_empty() {
         visible.push('\n');
diff --git a/crates/tools/src/environment.rs b/crates/tools/src/environment.rs
index c2ca34c59..248c871bd 100644
--- a/crates/tools/src/environment.rs
+++ b/crates/tools/src/environment.rs
@@ -15,6 +15,7 @@ pub(crate) mod catalog_text;
 pub mod control;
 pub mod handles;
 pub mod jobs;
+pub mod output;
 pub mod process;
 pub mod projection;
 pub mod sources;
diff --git a/crates/tools/src/environment/jobs.rs b/crates/tools/src/environment/jobs.rs
index 4662f0923..4d68531d4 100644
--- a/crates/tools/src/environment/jobs.rs
+++ b/crates/tools/src/environment/jobs.rs
@@ -1,16 +1,26 @@
 //! Durable environment job capability boundary.
+//!
+//! The model-facing argument and result types here are this crate's own:
+//! they map to and from the environment protocol's job wire types at this
+//! boundary, so a protocol change never silently reshapes what the model
+//! reads or writes.
 
 use std::collections::BTreeMap;
 
 use async_trait::async_trait;
 use environment_protocol::{
-    data::jobs::{
-        CancelJobsParams, CancelJobsResponse, JobArtifact, JobCancelScope,
-        JobDependency as ProtocolJobDependency, JobDependencyPolicy, JobOutputChunk, JobStartSpec,
-        JobStatus, JobSummary, ReadJobsParams, ReadJobsResponse, StartJobsParams,
-        StartJobsResponse,
+    bytes::ByteChunk,
+    data::{
+        exec::{CommandSpec, ExecInput, ExitStatus, StoppedBy},
+        handshake::JobLimits,
+        job::{
+            CancelJobsParams, CancelJobsResponse, JobDependency, JobDependencyPolicy, JobReadEntry,
+            JobReadRequest, JobSpec, JobStatus, JobSummary, ReadJobsParams, ReadJobsResponse,
+            StartJobsParams, StartJobsResponse,
+        },
     },
-    shared::{ByteChunk, EnvironmentPath, JobId},
+    ids::{JobId, JobName, QueueKey},
+    paths::EnvironmentPath,
 };
 use serde::{Deserialize, Serialize};
 use thiserror::Error;
@@ -20,7 +30,13 @@ use harness::{
     storage::{BlobEdge, BlobGraphStore, BlobStore, BlobStoreError},
 };
 
-use crate::fs::FsPath;
+use crate::{
+    environment::{
+        output::{ShownOutput, is_stderr},
+        process::LeftoverProcess,
+    },
+    fs::FsPath,
+};
 
 pub const JOB_SUBMIT_TOOL_NAME: &str = "job_submit";
 pub const JOB_RUN_TOOL_NAME: &str = "job_run";
@@ -32,11 +48,19 @@ pub const JOB_RUN_WORKFLOW_SEMANTIC_TYPE: &str = "lightspeed.environment.job.run
 pub const JOB_RUN_DEFAULT_TIMEOUT_MS: u64 = 30 * 60 * 1_000;
 pub const JOB_RUN_MAX_TIMEOUT_MS: u64 = 60 * 60 * 1_000;
 pub const JOB_RUN_DEADLINE_AFTER_MS: u64 = 65 * 60 * 1_000;
+/// Output a job result shows when the reader names no budget: the first
+/// half from the start of the output, the second half from its end.
+pub const DEFAULT_JOB_OUTPUT_BYTES: u64 = 16 * 1024;
 
 pub type JobExecResult<T> = Result<T, JobError>;
 
 #[async_trait]
 pub trait JobExecutor: Send + Sync {
+    /// The endpoint's job ceilings, when known; reads stay within them.
+    fn limits(&self) -> Option<JobLimits> {
+        None
+    }
+
     async fn start_jobs(&self, request: StartJobsParams) -> JobExecResult<StartJobsResponse>;
 
     async fn read_jobs(&self, request: ReadJobsParams) -> JobExecResult<ReadJobsResponse>;
@@ -52,6 +76,10 @@ pub enum JobError {
     #[error("invalid environment job request: {message}")]
     InvalidRequest { message: String },
 
+    /// A job id is taken by another run; the model must choose a new id.
+    #[error("environment job id in use: {message}")]
+    JobIdInUse { message: String },
+
     #[error("environment job execution failed: {message}")]
     Failed { message: String },
 }
@@ -69,6 +97,7 @@ pub struct JobHandleArg {
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, schemars::JsonSchema)]
 pub struct JobHandle {
     pub environment_id: String,
+    #[schemars(with = "String")]
     pub job_id: JobId,
 }
 
@@ -97,7 +126,13 @@ pub struct JobRunArgs {
 }
 
 impl JobRunArgs {
-    pub fn into_protocol_spec(self, job_id: JobId) -> JobExecResult<JobStartSpec> {
+    /// The wire spec of this single job. A relative `cwd` resolves against
+    /// `working_directory`, which is also the default `cwd`.
+    pub fn into_job_spec(
+        self,
+        job_id: JobId,
+        working_directory: Option<&str>,
+    ) -> JobExecResult<JobSpec> {
         let timeout_ms = self.timeout_ms.unwrap_or(JOB_RUN_DEFAULT_TIMEOUT_MS);
         if timeout_ms > JOB_RUN_MAX_TIMEOUT_MS {
             return Err(JobError::InvalidRequest {
@@ -113,10 +148,10 @@ impl JobRunArgs {
             stdin: self.stdin,
             timeout_ms: Some(timeout_ms),
             depends_on: Vec::new(),
-            dependency_policy: JobDependencyPolicy::AllSucceeded,
+            dependency_policy: JobDependencyPolicyArg::AllSucceeded,
             queue_key: self.queue_key,
         }
-        .into_protocol_spec(job_id)
+        .into_job_spec(job_id, working_directory)
     }
 }
 
@@ -150,22 +185,18 @@ impl JobSubmitExecutionContextV1 {
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
 pub struct JobDependencyArg {
-    #[serde(default, alias = "jobId", skip_serializing_if = "Option::is_none")]
+    #[serde(default, skip_serializing_if = "Option::is_none")]
     pub job_id: Option<JobId>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub name: Option<String>,
 }
 
 impl JobDependencyArg {
-    fn into_protocol_dependency(self) -> JobExecResult<ProtocolJobDependency> {
+    fn into_job_dependency(self) -> JobExecResult<JobDependency> {
         match (self.job_id, self.name) {
-            (Some(job_id), None) => Ok(ProtocolJobDependency {
-                job_id: Some(job_id),
-                name: None,
-            }),
-            (None, Some(name)) if !name.is_empty() => Ok(ProtocolJobDependency {
-                job_id: None,
-                name: Some(name),
+            (Some(job_id), None) => Ok(JobDependency::JobId { job_id }),
+            (None, Some(name)) if !name.is_empty() => Ok(JobDependency::Name {
+                name: job_name(name)?,
             }),
             (Some(_), Some(_)) => Err(JobError::InvalidRequest {
                 message: "job dependency must specify job_id or name, not both".to_owned(),
@@ -177,6 +208,26 @@ impl JobDependencyArg {
     }
 }
 
+/// What a job waits for from its `depends_on` jobs.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum JobDependencyPolicyArg {
+    /// Run once every dependency succeeded.
+    #[default]
+    AllSucceeded,
+    /// Run once every dependency finished, whatever its outcome.
+    AllTerminal,
+}
+
+impl From<JobDependencyPolicyArg> for JobDependencyPolicy {
+    fn from(policy: JobDependencyPolicyArg) -> Self {
+        match policy {
+            JobDependencyPolicyArg::AllSucceeded => Self::AllSucceeded,
+            JobDependencyPolicyArg::AllTerminal => Self::AllTerminal,
+        }
+    }
+}
+
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub struct JobSubmitSpecArgs {
     #[serde(default, skip_serializing_if = "Option::is_none")]
@@ -194,13 +245,21 @@ pub struct JobSubmitSpecArgs {
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub depends_on: Vec<JobDependencyArg>,
     #[serde(default)]
-    pub dependency_policy: JobDependencyPolicy,
+    pub dependency_policy: JobDependencyPolicyArg,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub queue_key: Option<String>,
 }
 
 impl JobSubmitSpecArgs {
-    pub fn into_protocol_spec(self, job_id: JobId) -> JobExecResult<JobStartSpec> {
+    /// The wire spec of this job. A relative `cwd` resolves against
+    /// `working_directory`, which is also the default `cwd`; without one a
+    /// relative `cwd` is refused and an absent one means the environment's
+    /// default.
+    pub fn into_job_spec(
+        self,
+        job_id: JobId,
+        working_directory: Option<&str>,
+    ) -> JobExecResult<JobSpec> {
         if self.argv.is_empty() {
             return Err(JobError::InvalidRequest {
                 message: "job argv must not be empty".to_owned(),
@@ -217,42 +276,50 @@ impl JobSubmitSpecArgs {
         let depends_on = self
             .depends_on
             .into_iter()
-            .map(JobDependencyArg::into_protocol_dependency)
+            .map(JobDependencyArg::into_job_dependency)
             .collect::<JobExecResult<Vec<_>>>()?;
-        Ok(JobStartSpec {
+        Ok(JobSpec {
             job_id,
-            name: self.name,
-            argv: self.argv,
-            cwd: self.cwd.as_ref().map(environment_path).transpose()?,
-            env: self.env,
-            secret_env: BTreeMap::new(),
-            stdin: self.stdin.map(|value| ByteChunk::from(value.into_bytes())),
-            timeout_ms: self.timeout_ms,
+            name: self.name.map(job_name).transpose()?,
+            command: CommandSpec {
+                argv: self.argv,
+                cwd: job_cwd(self.cwd.as_ref(), working_directory)?,
+                env: self.env,
+                secret_env: BTreeMap::new(),
+                input: match self.stdin {
+                    Some(stdin) => ExecInput::Bytes {
+                        data: ByteChunk::from(stdin.into_bytes()),
+                    },
+                    None => ExecInput::None {},
+                },
+                timeout_ms: self.timeout_ms,
+            },
             depends_on,
-            dependency_policy: self.dependency_policy,
-            queue_key: self.queue_key,
+            dependency_policy: self.dependency_policy.into(),
+            queue_key: self
+                .queue_key
+                .map(|key| {
+                    QueueKey::new(key).map_err(|error| JobError::InvalidRequest {
+                        message: format!("queue_key is invalid: {error}"),
+                    })
+                })
+                .transpose()?,
         })
     }
 }
 
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
 pub struct JobReadArgs {
     pub jobs: Vec<JobHandleArg>,
+    /// Output bytes to show per job. Without `after`, half come from the
+    /// start of the output and half from its end.
     #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub output_bytes: Option<usize>,
+    pub output_bytes: Option<u64>,
+    /// Byte offset to page forward from, such as a previous result's
+    /// `output_next` or its omitted range's `offset`.
     #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub after_seq: Option<u64>,
-    #[serde(default)]
-    pub include_artifacts: bool,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct JobCancelArgs {
-    pub jobs: Vec<JobHandleArg>,
-    #[serde(default)]
-    pub scope: JobCancelScope,
-    #[serde(default)]
-    pub force: bool,
+    pub after: Option<u64>,
 }
 
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, schemars::JsonSchema)]
@@ -264,10 +331,12 @@ pub struct JobSubmitResult {
 pub struct JobSubmitted {
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub name: Option<String>,
+    #[schemars(with = "String")]
     pub job_id: JobId,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub handle: Option<JobHandle>,
-    pub status: JobStatus,
+    pub status: ModelJobStatus,
+    #[schemars(with = "Vec<String>")]
     pub dependencies: Vec<JobId>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub queue_key: Option<String>,
@@ -276,33 +345,216 @@ pub struct JobSubmitted {
     pub promise: Option<String>,
 }
 
+impl JobSubmitted {
+    pub fn from_summary(summary: &JobSummary, handle: Option<JobHandle>) -> Self {
+        Self {
+            name: summary.name.as_ref().map(|name| name.as_str().to_owned()),
+            job_id: summary.job_id.clone(),
+            handle,
+            status: summary.status.into(),
+            dependencies: summary.depends_on.clone(),
+            queue_key: summary
+                .queue_key
+                .as_ref()
+                .map(|key| key.as_str().to_owned()),
+            promise: None,
+        }
+    }
+}
+
+/// Where a job stands.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, schemars::JsonSchema)]
+#[serde(rename_all = "snake_case")]
+pub enum ModelJobStatus {
+    Queued,
+    Running,
+    Succeeded,
+    Failed,
+    TimedOut,
+    Cancelled,
+    DependencyFailed,
+    Interrupted,
+}
+
+impl ModelJobStatus {
+    pub fn is_terminal(self) -> bool {
+        !matches!(self, Self::Queued | Self::Running)
+    }
+}
+
+impl From<JobStatus> for ModelJobStatus {
+    fn from(status: JobStatus) -> Self {
+        match status {
+            JobStatus::Queued => Self::Queued,
+            JobStatus::Running => Self::Running,
+            JobStatus::Succeeded => Self::Succeeded,
+            JobStatus::Failed => Self::Failed,
+            JobStatus::TimedOut => Self::TimedOut,
+            JobStatus::Cancelled => Self::Cancelled,
+            JobStatus::DependencyFailed => Self::DependencyFailed,
+            JobStatus::Interrupted => Self::Interrupted,
+        }
+    }
+}
+
+/// Why the environment stopped a job that did not end on its own.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, schemars::JsonSchema)]
+#[serde(rename_all = "snake_case")]
+pub enum ModelStoppedBy {
+    Timeout,
+    Terminate,
+    Kill,
+}
+
+impl From<StoppedBy> for ModelStoppedBy {
+    fn from(stopped_by: StoppedBy) -> Self {
+        match stopped_by {
+            StoppedBy::Timeout => Self::Timeout,
+            StoppedBy::Terminate => Self::Terminate,
+            StoppedBy::Kill => Self::Kill,
+        }
+    }
+}
+
+/// What a job is and how it ended.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, schemars::JsonSchema)]
+pub struct ModelJobSummary {
+    #[schemars(with = "String")]
+    pub job_id: JobId,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub name: Option<String>,
+    pub status: ModelJobStatus,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    #[schemars(with = "Vec<String>")]
+    pub depends_on: Vec<JobId>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub queue_key: Option<String>,
+    pub created_at_ms: i64,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub started_at_ms: Option<i64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub finished_at_ms: Option<i64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub duration_ms: Option<u64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub exit_code: Option<i32>,
+    /// The signal that killed the job's command, such as `SIGSEGV`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub signal: Option<String>,
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub core_dumped: bool,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub stopped_by: Option<ModelStoppedBy>,
+    /// Processes the job left running, which the environment stopped when
+    /// the job finished; the job's script should shut them down itself.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub swept_processes: Vec<LeftoverProcess>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+}
+
+impl From<JobSummary> for ModelJobSummary {
+    fn from(summary: JobSummary) -> Self {
+        let (exit_code, signal, core_dumped) = match summary.exit {
+            Some(ExitStatus::Code { code }) => (Some(code), None, false),
+            Some(ExitStatus::Signal {
+                signal,
+                core_dumped,
+            }) => (None, Some(signal.as_str().to_owned()), core_dumped),
+            None => (None, None, false),
+        };
+        Self {
+            job_id: summary.job_id,
+            name: summary.name.map(JobName::into_string),
+            status: summary.status.into(),
+            depends_on: summary.depends_on,
+            queue_key: summary.queue_key.map(QueueKey::into_string),
+            created_at_ms: summary.created_at_ms,
+            started_at_ms: summary.started_at_ms,
+            finished_at_ms: summary.finished_at_ms,
+            duration_ms: summary.duration_ms,
+            exit_code,
+            signal,
+            core_dumped,
+            stopped_by: summary.stopped_by.map(Into::into),
+            swept_processes: summary
+                .leftovers
+                .map(|report| {
+                    report
+                        .processes
+                        .into_iter()
+                        .map(|process| LeftoverProcess {
+                            pid: process.pid,
+                            command: process.command.unwrap_or_default(),
+                        })
+                        .collect()
+                })
+                .unwrap_or_default(),
+            error: summary.error.map(|error| error.to_string()),
+        }
+    }
+}
+
+/// A range of output the result leaves out. Read it with `job_read`
+/// `after: offset`; the `lost_bytes` of it that the environment dropped to
+/// bound retained output read back as a gap.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, schemars::JsonSchema)]
+pub struct ModelOutputOmission {
+    /// Byte offset of the first omitted byte.
+    pub offset: u64,
+    pub bytes: u64,
+    /// Omitted bytes that are gone for good; reading them again does not
+    /// return them.
+    #[serde(default, skip_serializing_if = "is_zero")]
+    pub lost_bytes: u64,
+}
+
+fn is_zero(value: &u64) -> bool {
+    *value == 0
+}
+
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, schemars::JsonSchema)]
-#[serde(rename_all = "camelCase")]
 pub struct ModelJobResult {
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub handle: Option<JobHandle>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub summary: Option<JobSummary>,
+    pub summary: Option<ModelJobSummary>,
+    /// Output from the requested position, in order.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub output: Vec<ModelJobOutputSegment>,
-    pub output_next_seq: u64,
-    pub truncated: bool,
+    /// Output between `output` and `tail` that is not shown.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub omitted: Option<ModelOutputOmission>,
+    /// The last output bytes, after the omitted range.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub artifacts: Vec<JobArtifact>,
+    pub tail: Vec<ModelJobOutputSegment>,
+    /// Byte offset after the last output shown; pass it as `after` to read
+    /// on.
+    pub output_next: u64,
+    /// Output bytes the job produced so far.
+    pub output_end: u64,
+    /// More output exists after `output_next`.
+    pub truncated: bool,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub error: Option<String>,
 }
 
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, schemars::JsonSchema)]
-#[serde(rename_all = "camelCase")]
 pub struct ModelJobResultSet {
     pub jobs: Vec<ModelJobResult>,
 }
 
+/// Which stream produced an output segment.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, schemars::JsonSchema)]
+#[serde(rename_all = "snake_case")]
+pub enum ModelOutputStream {
+    Stdout,
+    Stderr,
+}
+
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, schemars::JsonSchema)]
-#[serde(rename_all = "camelCase")]
 pub struct ModelJobOutputSegment {
-    pub stream: environment_protocol::data::jobs::JobOutputStream,
+    pub stream: ModelOutputStream,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub text: Option<String>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
@@ -313,21 +565,6 @@ pub struct ModelJobOutputSegment {
     pub byte_len: Option<usize>,
 }
 
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct JobCancelResultSet {
-    pub jobs: Vec<JobCancelResultEntry>,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct JobCancelResultEntry {
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub handle: Option<JobHandle>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub summary: Option<JobSummary>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub error: Option<String>,
-}
-
 pub fn visible_job_read_output(jobs: &[ModelJobResult]) -> String {
     serde_json::to_string_pretty(&ModelJobResultSet {
         jobs: jobs.to_vec(),
@@ -335,15 +572,107 @@ pub fn visible_job_read_output(jobs: &[ModelJobResult]) -> String {
     .unwrap_or_else(|error| format!("failed to encode job results: {error}"))
 }
 
+/// The `job/read` entries that show one job: a page forward from `after`,
+/// or, without it, the head and the tail of the output, each half of
+/// `output_bytes`. [`NormalizeJobResultInput::from_entries`] reassembles the
+/// answer.
+pub fn job_output_requests(
+    job_id: &JobId,
+    after: Option<u64>,
+    output_bytes: u64,
+) -> Vec<JobReadRequest> {
+    match after {
+        Some(after) => vec![JobReadRequest {
+            job_id: job_id.clone(),
+            after: Some(after),
+            tail_bytes: None,
+            max_bytes: Some(output_bytes),
+        }],
+        None => {
+            let head = output_bytes / 2;
+            vec![
+                JobReadRequest {
+                    job_id: job_id.clone(),
+                    after: Some(0),
+                    tail_bytes: None,
+                    max_bytes: Some(head),
+                },
+                JobReadRequest {
+                    job_id: job_id.clone(),
+                    after: None,
+                    tail_bytes: Some(output_bytes - head),
+                    max_bytes: Some(output_bytes - head),
+                },
+            ]
+        }
+    }
+}
+
+/// A complete `job/read` for `jobs`, each shown as [`job_output_requests`]
+/// describes, waiting for nothing.
+pub fn job_output_read(jobs: &[JobId], after: Option<u64>, output_bytes: u64) -> ReadJobsParams {
+    let entries = jobs
+        .iter()
+        .flat_map(|job_id| job_output_requests(job_id, after, output_bytes))
+        .collect::<Vec<_>>();
+    ReadJobsParams {
+        max_bytes: output_bytes.saturating_mul(jobs.len() as u64),
+        jobs: entries,
+        wait_ms: 0,
+        return_on: environment_protocol::data::exec::ReturnOn::AnyOutput,
+    }
+}
+
 #[derive(Clone, Debug, Default)]
 pub struct NormalizeJobResultInput {
     pub handle: Option<JobHandle>,
     pub summary: Option<JobSummary>,
-    pub output_chunks: Vec<JobOutputChunk>,
-    pub output_next_seq: u64,
-    pub artifacts: Vec<JobArtifact>,
+    /// Output shown from the requested position: `output`, then `omitted`
+    /// and `tail`.
+    pub output: ShownOutput,
     pub error: Option<String>,
-    pub output_bytes: Option<usize>,
+}
+
+impl NormalizeJobResultInput {
+    /// Reassemble the entries [`job_output_requests`] asked for one job: a
+    /// summary and its pages, or the entry's error (`notFound` for a job the
+    /// environment does not know).
+    pub fn from_entries(
+        handle: Option<JobHandle>,
+        entries: impl IntoIterator<Item = JobReadEntry>,
+    ) -> Self {
+        let mut summary = None;
+        let mut pages = Vec::new();
+        let mut error = None;
+        for entry in entries {
+            match entry {
+                JobReadEntry::Job {
+                    summary: entry_summary,
+                    output,
+                } => {
+                    summary = Some(*entry_summary);
+                    pages.push(output);
+                }
+                JobReadEntry::Error {
+                    job_id,
+                    error: cause,
+                } => {
+                    error.get_or_insert_with(|| format!("job {job_id}: {cause}"));
+                }
+            }
+        }
+        let mut pages = pages.into_iter();
+        let output = pages
+            .next()
+            .map(|head| ShownOutput::from_pages(head, pages.next()))
+            .unwrap_or_default();
+        Self {
+            handle,
+            summary,
+            output,
+            error,
+        }
+    }
 }
 
 pub async fn normalize_job_result(
@@ -353,46 +682,76 @@ pub async fn normalize_job_result(
     let NormalizeJobResultInput {
         handle,
         summary,
-        output_chunks,
-        output_next_seq,
-        artifacts,
+        output,
         error,
-        output_bytes,
     } = input;
-    let observed_bytes = output_chunks
-        .iter()
-        .map(|chunk| chunk.chunk.as_slice().len())
-        .sum::<usize>();
-    let truncated = output_bytes.is_some_and(|limit| observed_bytes >= limit);
+    let truncated = output.next < output.end;
+    let omitted = output.omitted.map(|omission| ModelOutputOmission {
+        offset: omission.offset,
+        bytes: omission.bytes,
+        lost_bytes: omission.lost_bytes,
+    });
+    let head = segments(blobs, output.head).await?;
+    let tail = segments(blobs, output.tail).await?;
+    Ok(ModelJobResult {
+        handle: handle.map(|mut handle| {
+            handle.environment_id = super::handles::environment_handle(&handle.environment_id);
+            handle
+        }),
+        summary: summary.map(Into::into),
+        output: head,
+        omitted,
+        tail,
+        output_next: output.next,
+        output_end: output.end,
+        truncated,
+        error,
+    })
+}
+
+/// A result that carries only an error, such as an unknown job.
+pub fn model_job_error(handle: Option<JobHandle>, error: String) -> ModelJobResult {
+    ModelJobResult {
+        handle: handle.map(|mut handle| {
+            handle.environment_id = super::handles::environment_handle(&handle.environment_id);
+            handle
+        }),
+        summary: None,
+        output: Vec::new(),
+        omitted: None,
+        tail: Vec::new(),
+        output_next: 0,
+        output_end: 0,
+        truncated: false,
+        error: Some(error),
+    }
+}
+
+/// Merge consecutive chunks of one stream; text stays inline, bytes that
+/// are not UTF-8 go to CAS and are referenced.
+async fn segments(
+    blobs: &dyn BlobStore,
+    chunks: Vec<environment_protocol::data::exec::OutputChunk>,
+) -> Result<Vec<ModelJobOutputSegment>, BlobStoreError> {
     let mut output = Vec::new();
     let mut index = 0;
-    while index < output_chunks.len() {
-        let stream = output_chunks[index].stream;
+    while index < chunks.len() {
+        let stream = model_stream(chunks[index].stream);
         let mut bytes = Vec::new();
-        while index < output_chunks.len() && output_chunks[index].stream == stream {
-            bytes.extend_from_slice(output_chunks[index].chunk.as_slice());
+        while index < chunks.len() && model_stream(chunks[index].stream) == stream {
+            bytes.extend_from_slice(chunks[index].data.as_slice());
             index += 1;
         }
         match String::from_utf8(bytes) {
             Ok(text) => {
                 if !text.is_empty() {
-                    if let Some(ModelJobOutputSegment {
-                        stream: previous_stream,
-                        text: Some(previous),
-                        ..
-                    }) = output.last_mut()
-                        && *previous_stream == stream
-                    {
-                        previous.push_str(&text);
-                    } else {
-                        output.push(ModelJobOutputSegment {
-                            stream,
-                            text: Some(text),
-                            blob_ref: None,
-                            media_type: None,
-                            byte_len: None,
-                        });
-                    }
+                    output.push(ModelJobOutputSegment {
+                        stream,
+                        text: Some(text),
+                        blob_ref: None,
+                        media_type: None,
+                        byte_len: None,
+                    });
                 }
             }
             Err(error) => {
@@ -409,18 +768,15 @@ pub async fn normalize_job_result(
             }
         }
     }
-    Ok(ModelJobResult {
-        handle: handle.map(|mut handle| {
-            handle.environment_id = super::handles::environment_handle(&handle.environment_id);
-            handle
-        }),
-        summary,
-        output,
-        output_next_seq,
-        truncated,
-        artifacts,
-        error,
-    })
+    Ok(output)
+}
+
+fn model_stream(stream: environment_protocol::data::exec::OutputStream) -> ModelOutputStream {
+    if is_stderr(stream) {
+        ModelOutputStream::Stderr
+    } else {
+        ModelOutputStream::Stdout
+    }
 }
 
 pub async fn store_model_job_result(
@@ -438,6 +794,7 @@ pub async fn store_model_job_result(
     let edges = result
         .output
         .iter()
+        .chain(&result.tail)
         .filter_map(|segment| {
             segment
                 .blob_ref
@@ -453,18 +810,44 @@ pub async fn store_model_job_result(
     Ok(root)
 }
 
-fn environment_path(path: &FsPath) -> JobExecResult<EnvironmentPath> {
-    EnvironmentPath::new(path.as_str()).map_err(|error| JobError::InvalidRequest {
-        message: error.to_string(),
+fn job_name(name: String) -> JobExecResult<JobName> {
+    JobName::new(name).map_err(|error| JobError::InvalidRequest {
+        message: format!("job name is invalid: {error}"),
     })
 }
 
+fn job_cwd(
+    cwd: Option<&FsPath>,
+    working_directory: Option<&str>,
+) -> JobExecResult<Option<EnvironmentPath>> {
+    let invalid = |message: String| JobError::InvalidRequest { message };
+    let resolved = match (cwd, working_directory) {
+        (Some(cwd), _) if cwd.is_absolute() => cwd.as_str().to_owned(),
+        (cwd, Some(base)) => crate::environment::sources::absolute(
+            std::path::Path::new(base),
+            cwd.map_or(".", FsPath::as_str),
+        )
+        .map_err(invalid)?
+        .to_string_lossy()
+        .into_owned(),
+        (Some(cwd), None) => {
+            return Err(invalid(format!(
+                "job cwd {cwd} is relative and the environment has no working directory"
+            )));
+        }
+        (None, None) => return Ok(None),
+    };
+    EnvironmentPath::new(resolved)
+        .map(Some)
+        .map_err(|error| invalid(error.to_string()))
+}
+
 #[cfg(test)]
 mod tests {
     use std::sync::{Arc, Mutex};
 
     use async_trait::async_trait;
-    use environment_protocol::data::jobs::{JobOutputStream, JobStatus};
+    use environment_protocol::data::exec::{OutputChunk, OutputPage, OutputStream, SignalName};
     use harness::storage::{
         BlobEdge, BlobGraphStore, BlobStore, BlobStoreError, InMemoryBlobStore,
     };
@@ -472,6 +855,10 @@ mod tests {
 
     use super::*;
 
+    fn job_id(value: &str) -> JobId {
+        JobId::new(value).unwrap()
+    }
+
     #[test]
     fn job_submit_arguments_do_not_accept_an_environment_override() {
         let error = serde_json::from_value::<JobSubmitArgs>(json!({
@@ -491,15 +878,65 @@ mod tests {
         }))
         .expect("decode job_run");
         let spec = args
-            .into_protocol_spec(JobId::new("job-derived"))
+            .into_job_spec(job_id("job-derived"), None)
             .expect("materialize job_run");
 
-        assert_eq!(spec.job_id, JobId::new("job-derived"));
-        assert_eq!(spec.argv, vec!["cargo", "test"]);
-        assert_eq!(spec.timeout_ms, Some(JOB_RUN_DEFAULT_TIMEOUT_MS));
+        assert_eq!(spec.job_id, job_id("job-derived"));
+        assert_eq!(spec.command.argv, vec!["cargo", "test"]);
+        assert_eq!(spec.command.timeout_ms, Some(JOB_RUN_DEFAULT_TIMEOUT_MS));
         assert!(spec.depends_on.is_empty());
     }
 
+    #[test]
+    fn job_cwd_resolves_against_the_working_directory() {
+        let spec = |cwd: Option<&str>, base: Option<&str>| {
+            JobSubmitSpecArgs {
+                name: None,
+                job_id: job_id("build"),
+                argv: vec!["true".to_owned()],
+                cwd: cwd.map(|cwd| FsPath::new(cwd).unwrap()),
+                env: BTreeMap::new(),
+                stdin: Some("input".to_owned()),
+                timeout_ms: None,
+                depends_on: Vec::new(),
+                dependency_policy: JobDependencyPolicyArg::AllSucceeded,
+                queue_key: None,
+            }
+            .into_job_spec(job_id("build"), base)
+        };
+        let resolved = spec(Some("sub"), Some("/srv")).unwrap();
+        assert_eq!(resolved.command.cwd.unwrap().as_str(), "/srv/sub");
+        assert_eq!(
+            resolved.command.input,
+            ExecInput::Bytes {
+                data: b"input".to_vec().into()
+            }
+        );
+        assert_eq!(
+            spec(None, Some("/srv"))
+                .unwrap()
+                .command
+                .cwd
+                .unwrap()
+                .as_str(),
+            "/srv"
+        );
+        assert_eq!(
+            spec(Some("/abs"), Some("/srv"))
+                .unwrap()
+                .command
+                .cwd
+                .unwrap()
+                .as_str(),
+            "/abs"
+        );
+        assert!(spec(None, None).unwrap().command.cwd.is_none());
+        assert!(matches!(
+            spec(Some("sub"), None),
+            Err(JobError::InvalidRequest { .. })
+        ));
+    }
+
     #[test]
     fn job_submit_accepts_snake_case_job_id_dependencies() {
         let args = serde_json::from_value::<JobSubmitArgs>(json!({
@@ -509,7 +946,8 @@ mod tests {
             }, {
                 "job_id": "test",
                 "argv": ["true"],
-                "depends_on": [{"job_id": "build"}]
+                "depends_on": [{"job_id": "build"}, {"name": "lint"}],
+                "dependency_policy": "allTerminal"
             }]
         }))
         .expect("decode job_submit with snake_case dependency id");
@@ -519,41 +957,23 @@ mod tests {
             .into_iter()
             .map(|spec| {
                 let job_id = spec.job_id.clone();
-                spec.into_protocol_spec(job_id)
+                spec.into_job_spec(job_id, None)
             })
             .collect::<JobExecResult<Vec<_>>>()
             .expect("materialize protocol specs");
 
         assert_eq!(
             specs[1].depends_on,
-            vec![ProtocolJobDependency::job_id("build")]
-        );
-    }
-
-    #[test]
-    fn job_submit_accepts_camel_case_dependency_alias_for_compatibility() {
-        let args = serde_json::from_value::<JobSubmitArgs>(json!({
-            "jobs": [{
-                "job_id": "build",
-                "argv": ["true"]
-            }, {
-                "job_id": "test",
-                "argv": ["true"],
-                "depends_on": [{"jobId": "build"}]
-            }]
-        }))
-        .expect("decode job_submit with camelCase dependency id alias");
-
-        let spec = args.jobs.into_iter().nth(1).expect("dependent job");
-        let job_id = spec.job_id.clone();
-        let spec = spec
-            .into_protocol_spec(job_id)
-            .expect("materialize protocol spec");
-
-        assert_eq!(
-            spec.depends_on,
-            vec![ProtocolJobDependency::job_id("build")]
+            vec![
+                JobDependency::JobId {
+                    job_id: job_id("build")
+                },
+                JobDependency::Name {
+                    name: JobName::new("lint").unwrap()
+                }
+            ]
         );
+        assert_eq!(specs[1].dependency_policy, JobDependencyPolicy::AllTerminal);
     }
 
     #[test]
@@ -570,7 +990,7 @@ mod tests {
         let spec = args.jobs.into_iter().next().expect("job");
         let job_id = spec.job_id.clone();
         let error = spec
-            .into_protocol_spec(job_id)
+            .into_job_spec(job_id, None)
             .expect_err("empty dependency must be rejected locally");
 
         assert!(matches!(error, JobError::InvalidRequest { .. }));
@@ -593,43 +1013,34 @@ mod tests {
         }))
         .expect("timeout range is a domain validation");
         let error = args
-            .into_protocol_spec(JobId::new("job-derived"))
+            .into_job_spec(job_id("job-derived"), None)
             .expect_err("timeout above maximum must fail");
         assert!(matches!(error, JobError::InvalidRequest { .. }));
     }
 
     #[test]
     fn job_ids_must_fit_the_completion_key_shape() {
-        for job_id in ["build:1", "", "-lead", &"x".repeat(65)] {
+        for value in ["build:1", "-lead", &"x".repeat(65)] {
+            let Ok(id) = JobId::new(value) else {
+                continue;
+            };
             let error = JobSubmitSpecArgs {
                 name: None,
-                job_id: JobId::new(if job_id.is_empty() {
-                    "placeholder"
-                } else {
-                    job_id
-                }),
+                job_id: id.clone(),
                 argv: vec!["true".to_owned()],
                 cwd: None,
                 env: BTreeMap::new(),
                 stdin: None,
                 timeout_ms: None,
                 depends_on: Vec::new(),
-                dependency_policy: JobDependencyPolicy::AllSucceeded,
+                dependency_policy: JobDependencyPolicyArg::AllSucceeded,
                 queue_key: None,
             }
-            .into_protocol_spec(JobId::new(if job_id.is_empty() {
-                "placeholder"
-            } else {
-                job_id
-            }));
-            if job_id.is_empty() {
-                error.expect("placeholder id is valid");
-            } else {
-                assert!(
-                    matches!(error, Err(JobError::InvalidRequest { .. })),
-                    "{job_id:?} must be rejected"
-                );
-            }
+            .into_job_spec(id, None);
+            assert!(
+                matches!(error, Err(JobError::InvalidRequest { .. })),
+                "{value:?} must be rejected"
+            );
         }
     }
 
@@ -643,6 +1054,88 @@ mod tests {
         assert_eq!(context.working_directory.as_deref(), Some("/srv"));
     }
 
+    #[test]
+    fn head_and_tail_requests_split_the_budget() {
+        let requests = job_output_requests(&job_id("build"), None, 16);
+        assert_eq!(requests.len(), 2);
+        assert_eq!(
+            (requests[0].after, requests[0].max_bytes),
+            (Some(0), Some(8))
+        );
+        assert_eq!(
+            (requests[1].tail_bytes, requests[1].max_bytes),
+            (Some(8), Some(8))
+        );
+        let paged = job_output_requests(&job_id("build"), Some(40), 16);
+        assert_eq!((paged[0].after, paged[0].max_bytes), (Some(40), Some(16)));
+        let read = job_output_read(&[job_id("a"), job_id("b")], None, 16);
+        assert_eq!(read.jobs.len(), 4);
+        assert_eq!(read.max_bytes, 32);
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn job_results_show_head_and_tail_with_the_skipped_count() {
+        let blobs = InMemoryBlobStore::new();
+        let entries = vec![
+            JobReadEntry::Job {
+                summary: Box::new(test_summary()),
+                output: page(
+                    vec![chunk(0, OutputStream::Stdout, b"compiling\n")],
+                    10,
+                    1000,
+                ),
+            },
+            JobReadEntry::Job {
+                summary: Box::new(test_summary()),
+                output: page(
+                    vec![chunk(990, OutputStream::Stderr, b"FAILED: 3\n")],
+                    1000,
+                    1000,
+                ),
+            },
+        ];
+        let result =
+            normalize_job_result(&blobs, NormalizeJobResultInput::from_entries(None, entries))
+                .await
+                .expect("normalize");
+
+        assert_eq!(result.output[0].text.as_deref(), Some("compiling\n"));
+        assert_eq!(result.tail[0].text.as_deref(), Some("FAILED: 3\n"));
+        assert_eq!(result.tail[0].stream, ModelOutputStream::Stderr);
+        assert_eq!(
+            result.omitted,
+            Some(ModelOutputOmission {
+                offset: 10,
+                bytes: 980,
+                lost_bytes: 0,
+            })
+        );
+        assert!(!result.truncated);
+        let value = serde_json::to_value(&result).expect("semantic JSON");
+        assert_eq!(value["output_end"], 1000);
+        assert_eq!(value["summary"]["status"], "failed");
+        assert_eq!(value["summary"]["signal"], "SIGSEGV");
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn unknown_jobs_read_as_errors() {
+        let blobs = InMemoryBlobStore::new();
+        let result = normalize_job_result(
+            &blobs,
+            NormalizeJobResultInput::from_entries(
+                None,
+                vec![JobReadEntry::Error {
+                    job_id: job_id("gone"),
+                    error: environment_protocol::error::ProtocolError::not_found("unknown job"),
+                }],
+            ),
+        )
+        .await
+        .expect("normalize");
+        assert!(result.summary.is_none());
+        assert!(result.error.as_deref().is_some_and(|e| e.contains("gone")));
+    }
+
     #[tokio::test(flavor = "current_thread")]
     async fn normalizer_reassembles_utf8_and_preserves_stream_order() {
         let blobs = InMemoryBlobStore::new();
@@ -650,14 +1143,19 @@ mod tests {
             &blobs,
             NormalizeJobResultInput {
                 summary: Some(test_summary()),
-                output_chunks: vec![
-                    output_chunk(0, JobOutputStream::Stdout, vec![b'a', 0xe2]),
-                    output_chunk(1, JobOutputStream::Stdout, vec![0x82, 0xac, b'\n']),
-                    output_chunk(2, JobOutputStream::Stderr, b"warning\n".to_vec()),
-                    output_chunk(3, JobOutputStream::Stdout, b"done\n".to_vec()),
-                ],
-                output_next_seq: 4,
-                output_bytes: Some(1024),
+                output: ShownOutput::from_pages(
+                    page(
+                        vec![
+                            chunk(0, OutputStream::Stdout, &[b'a', 0xe2]),
+                            chunk(2, OutputStream::Stdout, &[0x82, 0xac, b'\n']),
+                            chunk(5, OutputStream::Stderr, b"warning\n"),
+                            chunk(13, OutputStream::Stdout, b"done\n"),
+                        ],
+                        18,
+                        18,
+                    ),
+                    None,
+                ),
                 ..Default::default()
             },
         )
@@ -666,12 +1164,10 @@ mod tests {
 
         assert_eq!(result.output.len(), 3);
         assert_eq!(result.output[0].text.as_deref(), Some("a€\n"));
-        assert_eq!(result.output[1].stream, JobOutputStream::Stderr);
+        assert_eq!(result.output[1].stream, ModelOutputStream::Stderr);
         assert_eq!(result.output[2].text.as_deref(), Some("done\n"));
         assert!(!result.truncated);
-        let value = serde_json::to_value(&result).expect("semantic JSON");
-        assert!(value.get("outputChunks").is_none());
-        assert_eq!(value["outputNextSeq"], 4);
+        assert_eq!(result.output_next, 18);
     }
 
     #[tokio::test(flavor = "current_thread")]
@@ -681,16 +1177,17 @@ mod tests {
             &blobs,
             NormalizeJobResultInput {
                 summary: Some(test_summary()),
-                output_chunks: vec![output_chunk(0, JobOutputStream::Stdout, vec![0xff, 0x00])],
-                output_next_seq: 1,
-                output_bytes: Some(2),
+                output: ShownOutput::from_pages(
+                    page(vec![chunk(0, OutputStream::Stdout, &[0xff, 0x00])], 2, 4),
+                    None,
+                ),
                 ..Default::default()
             },
         )
         .await
         .expect("normalize binary");
 
-        assert!(result.truncated);
+        assert!(result.truncated, "output continues after output_next");
         let segment = &result.output[0];
         assert!(segment.text.is_none());
         assert_eq!(
@@ -715,8 +1212,10 @@ mod tests {
             &blobs,
             NormalizeJobResultInput {
                 summary: Some(test_summary()),
-                output_chunks: vec![output_chunk(0, JobOutputStream::Stdout, vec![0xff])],
-                output_next_seq: 1,
+                output: ShownOutput::from_pages(
+                    page(vec![chunk(0, OutputStream::Stdout, &[0xff])], 1, 1),
+                    None,
+                ),
                 ..Default::default()
             },
         )
@@ -746,29 +1245,44 @@ mod tests {
         }
     }
 
-    fn output_chunk(seq: u64, stream: JobOutputStream, bytes: Vec<u8>) -> JobOutputChunk {
-        JobOutputChunk {
-            seq,
+    fn chunk(offset: u64, stream: OutputStream, bytes: &[u8]) -> OutputChunk {
+        OutputChunk {
+            offset,
             stream,
-            chunk: ByteChunk::from(bytes),
+            data: bytes.to_vec().into(),
+        }
+    }
+
+    fn page(chunks: Vec<OutputChunk>, next: u64, end: u64) -> OutputPage {
+        OutputPage {
+            chunks,
+            next,
+            end,
+            gaps: Vec::new(),
         }
     }
 
     fn test_summary() -> JobSummary {
         JobSummary {
-            namespace: "environment-a".to_owned(),
-            job_id: JobId::new("job-a"),
+            job_id: job_id("job-a"),
+            request_id: environment_protocol::ids::JobRequestId::new("request-a").unwrap(),
             name: None,
-            status: JobStatus::Succeeded,
-            dependencies: Vec::new(),
+            status: JobStatus::Failed,
+            depends_on: Vec::new(),
+            queue_key: None,
             created_at_ms: 1,
             queued_at_ms: Some(1),
             started_at_ms: Some(2),
             finished_at_ms: Some(3),
-            exit_code: Some(0),
-            orphaned_descendants: false,
-            failure: None,
-            queue_key: None,
+            cancel_requested_at_ms: None,
+            duration_ms: Some(1),
+            exit: Some(ExitStatus::Signal {
+                signal: SignalName::new("SIGSEGV").unwrap(),
+                core_dumped: false,
+            }),
+            stopped_by: None,
+            leftovers: None,
+            error: None,
         }
     }
 }
diff --git a/crates/tools/src/environment/output.rs b/crates/tools/src/environment/output.rs
new file mode 100644
index 000000000..e970f4aeb
--- /dev/null
+++ b/crates/tools/src/environment/output.rs
@@ -0,0 +1,411 @@
+//! Shaping command output pages into what the model sees: a head, the
+//! bytes omitted after it, and a tail.
+//!
+//! Environment reads return byte-offset pages with typed gaps. A finished
+//! command whose output exceeds the tool budget is shown as its first bytes
+//! and its last bytes, with the omitted count in between, because failures
+//! are reported at the end.
+
+use environment_protocol::data::exec::{OutputChunk, OutputPage, OutputStream};
+
+/// Output selected for the model, in offset order.
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct ShownOutput {
+    /// Chunks before the first omitted range.
+    pub head: Vec<OutputChunk>,
+    /// The omitted ranges, merged: where the first starts, how many bytes
+    /// all of them hold together, and how many of those the environment no
+    /// longer holds.
+    pub omitted: Option<Omission>,
+    /// Chunks after the first omitted range.
+    pub tail: Vec<OutputChunk>,
+    /// Offset after the last byte or gap shown.
+    pub next: u64,
+    /// Bytes the command produced so far.
+    pub end: u64,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct Omission {
+    pub offset: u64,
+    pub bytes: u64,
+    /// Of `bytes`, those the environment's typed gaps report as gone
+    /// (`overflow`, `expired`): reading them again returns the same gap.
+    /// The rest was skipped here and can still be read.
+    pub lost_bytes: u64,
+}
+
+impl ShownOutput {
+    /// The first page of a read, with an optional second page that starts
+    /// later (a tail read). Bytes of `tail` that `head` already returned
+    /// are dropped; the range between the two pages and every gap inside
+    /// them count as omitted.
+    pub fn from_pages(head: OutputPage, tail: Option<OutputPage>) -> Self {
+        let mut shown = Self::default();
+        let mut items = Vec::new();
+        let mut next = head.next;
+        let mut end = head.end;
+        push_page(&mut items, head, 0);
+        if let Some(tail) = tail {
+            let tail_start = page_start(&tail);
+            if tail_start > next {
+                items.push(Item::Gap {
+                    offset: next,
+                    bytes: tail_start - next,
+                    lost: false,
+                });
+            }
+            let skip_before = next;
+            next = next.max(tail.next);
+            end = end.max(tail.end);
+            push_page(&mut items, tail, skip_before);
+        }
+        shown.next = next;
+        shown.end = end;
+        for item in items {
+            match item {
+                Item::Chunk(chunk) if shown.omitted.is_none() => shown.head.push(chunk),
+                Item::Chunk(chunk) => shown.tail.push(chunk),
+                Item::Gap {
+                    offset,
+                    bytes,
+                    lost,
+                } => {
+                    let lost_bytes = if lost { bytes } else { 0 };
+                    match &mut shown.omitted {
+                        Some(omission) => {
+                            omission.bytes += bytes;
+                            omission.lost_bytes += lost_bytes;
+                        }
+                        None => {
+                            shown.omitted = Some(Omission {
+                                offset,
+                                bytes,
+                                lost_bytes,
+                            })
+                        }
+                    }
+                }
+            }
+        }
+        shown
+    }
+
+    /// Keep at most `budget` bytes: the first half of the budget from the
+    /// head and the rest from the end of what was read, omitting the middle.
+    /// Used when a single page returned more than the model may see.
+    pub fn trim_to(mut self, budget: u64) -> Self {
+        let total = self.shown_bytes();
+        if total <= budget {
+            return self;
+        }
+        let head_budget = budget / 2;
+        let tail_budget = budget - head_budget;
+        let mut chunks: Vec<OutputChunk> = self.head.drain(..).chain(self.tail.drain(..)).collect();
+        let first = chunks
+            .first()
+            .map(|chunk| chunk.offset)
+            .unwrap_or(self.next);
+        let mut head = Vec::new();
+        let mut taken = 0u64;
+        let mut cut_at = first;
+        let mut index = 0;
+        while index < chunks.len() && taken < head_budget {
+            let chunk = &mut chunks[index];
+            let room = head_budget - taken;
+            let length = chunk.data.len() as u64;
+            if length <= room {
+                taken += length;
+                cut_at = chunk.offset + length;
+                head.push(chunk.clone());
+                index += 1;
+            } else {
+                head.push(slice_chunk(chunk, 0, room));
+                cut_at = chunk.offset + room;
+                taken = head_budget;
+            }
+        }
+        let mut tail = Vec::new();
+        let mut kept = 0u64;
+        for chunk in chunks.iter().rev() {
+            if kept >= tail_budget {
+                break;
+            }
+            let length = chunk.data.len() as u64;
+            let chunk_end = chunk.offset + length;
+            let start = chunk.offset.max(cut_at);
+            if chunk_end <= start {
+                break;
+            }
+            let available = chunk_end - start;
+            let keep = available.min(tail_budget - kept);
+            let from = chunk_end - keep - chunk.offset;
+            tail.push(slice_chunk(chunk, from, keep));
+            kept += keep;
+        }
+        tail.reverse();
+        let dropped = total - taken - kept;
+        let omitted = self.omitted_bytes() + dropped;
+        let offset = self
+            .omitted
+            .map_or(cut_at, |omission| omission.offset.min(cut_at));
+        self.head = head;
+        self.tail = tail;
+        let lost_bytes = self.lost_bytes();
+        self.omitted = (omitted > 0).then_some(Omission {
+            offset,
+            bytes: omitted,
+            lost_bytes,
+        });
+        self
+    }
+
+    pub fn shown_bytes(&self) -> u64 {
+        self.head
+            .iter()
+            .chain(&self.tail)
+            .map(|chunk| chunk.data.len() as u64)
+            .sum()
+    }
+
+    pub fn omitted_bytes(&self) -> u64 {
+        self.omitted.map_or(0, |omission| omission.bytes)
+    }
+
+    /// Omitted bytes the environment no longer holds.
+    pub fn lost_bytes(&self) -> u64 {
+        self.omitted.map_or(0, |omission| omission.lost_bytes)
+    }
+}
+
+enum Item {
+    Chunk(OutputChunk),
+    /// `lost`: a gap the environment reported; otherwise a readable range
+    /// between two pages.
+    Gap {
+        offset: u64,
+        bytes: u64,
+        lost: bool,
+    },
+}
+
+/// Where a page begins: its first chunk or gap, or `next` when empty.
+fn page_start(page: &OutputPage) -> u64 {
+    let first_chunk = page.chunks.first().map(|chunk| chunk.offset);
+    let first_gap = page.gaps.first().map(|gap| gap.offset);
+    match (first_chunk, first_gap) {
+        (Some(chunk), Some(gap)) => chunk.min(gap),
+        (Some(offset), None) | (None, Some(offset)) => offset,
+        (None, None) => page.next,
+    }
+}
+
+/// Append a page's chunks and gaps in offset order, dropping bytes before
+/// `skip_before`.
+fn push_page(items: &mut Vec<Item>, page: OutputPage, skip_before: u64) {
+    let mut entries: Vec<Item> = page
+        .chunks
+        .into_iter()
+        .map(Item::Chunk)
+        .chain(page.gaps.into_iter().map(|gap| Item::Gap {
+            offset: gap.offset,
+            bytes: gap.omitted_bytes,
+            lost: true,
+        }))
+        .collect();
+    entries.sort_by_key(|item| match item {
+        Item::Chunk(chunk) => chunk.offset,
+        Item::Gap { offset, .. } => *offset,
+    });
+    for item in entries {
+        match item {
+            Item::Chunk(chunk) => {
+                let length = chunk.data.len() as u64;
+                if chunk.offset + length <= skip_before {
+                    continue;
+                }
+                if chunk.offset < skip_before {
+                    let from = skip_before - chunk.offset;
+                    items.push(Item::Chunk(slice_chunk(&chunk, from, length - from)));
+                } else {
+                    items.push(Item::Chunk(chunk));
+                }
+            }
+            Item::Gap {
+                offset,
+                bytes,
+                lost,
+            } => {
+                let gap_end = offset + bytes;
+                if gap_end <= skip_before {
+                    continue;
+                }
+                let start = offset.max(skip_before);
+                items.push(Item::Gap {
+                    offset: start,
+                    bytes: gap_end - start,
+                    lost,
+                });
+            }
+        }
+    }
+}
+
+fn slice_chunk(chunk: &OutputChunk, from: u64, length: u64) -> OutputChunk {
+    let from = from as usize;
+    let to = from + length as usize;
+    OutputChunk {
+        offset: chunk.offset + from as u64,
+        stream: chunk.stream,
+        data: chunk.data.as_slice()[from..to].to_vec().into(),
+    }
+}
+
+/// Whether a chunk belongs to standard error rather than standard output
+/// (a PTY merges both into standard output).
+pub fn is_stderr(stream: OutputStream) -> bool {
+    matches!(stream, OutputStream::Stderr)
+}
+
+#[cfg(test)]
+mod tests {
+    use environment_protocol::data::exec::{GapReason, OutputGap};
+
+    use super::*;
+
+    fn chunk(offset: u64, text: &str) -> OutputChunk {
+        OutputChunk {
+            offset,
+            stream: OutputStream::Stdout,
+            data: text.as_bytes().to_vec().into(),
+        }
+    }
+
+    fn text(chunks: &[OutputChunk]) -> String {
+        chunks
+            .iter()
+            .map(|chunk| String::from_utf8_lossy(chunk.data.as_slice()).into_owned())
+            .collect()
+    }
+
+    #[test]
+    fn head_and_tail_pages_show_the_skipped_range() {
+        let head = OutputPage {
+            chunks: vec![chunk(0, "head")],
+            next: 4,
+            end: 100,
+            gaps: vec![],
+        };
+        let tail = OutputPage {
+            chunks: vec![chunk(96, "tail")],
+            next: 100,
+            end: 100,
+            gaps: vec![],
+        };
+        let shown = ShownOutput::from_pages(head, Some(tail));
+        assert_eq!(text(&shown.head), "head");
+        assert_eq!(text(&shown.tail), "tail");
+        assert_eq!(
+            shown.omitted,
+            Some(Omission {
+                offset: 4,
+                bytes: 92,
+                lost_bytes: 0,
+            })
+        );
+        assert_eq!((shown.next, shown.end), (100, 100));
+    }
+
+    #[test]
+    fn overlapping_pages_show_every_byte_once() {
+        let head = OutputPage {
+            chunks: vec![chunk(0, "abcdef")],
+            next: 6,
+            end: 8,
+            gaps: vec![],
+        };
+        let tail = OutputPage {
+            chunks: vec![chunk(4, "efgh")],
+            next: 8,
+            end: 8,
+            gaps: vec![],
+        };
+        let shown = ShownOutput::from_pages(head, Some(tail));
+        assert_eq!(text(&shown.head), "abcdefgh");
+        assert!(shown.omitted.is_none());
+    }
+
+    #[test]
+    fn daemon_gaps_count_as_omitted() {
+        let page = OutputPage {
+            chunks: vec![chunk(0, "ab"), chunk(10, "yz")],
+            next: 12,
+            end: 12,
+            gaps: vec![OutputGap {
+                offset: 2,
+                omitted_bytes: 8,
+                reason: GapReason::Overflow,
+            }],
+        };
+        let shown = ShownOutput::from_pages(page, None);
+        assert_eq!(text(&shown.head), "ab");
+        assert_eq!(text(&shown.tail), "yz");
+        assert_eq!(shown.omitted_bytes(), 8);
+        assert_eq!(
+            shown.lost_bytes(),
+            8,
+            "an overflow gap cannot be read again"
+        );
+    }
+
+    #[test]
+    fn retention_gaps_and_skipped_ranges_are_told_apart() {
+        let head = OutputPage {
+            chunks: vec![chunk(0, "head")],
+            next: 14,
+            end: 100,
+            gaps: vec![OutputGap {
+                offset: 4,
+                omitted_bytes: 10,
+                reason: GapReason::Overflow,
+            }],
+        };
+        let tail = OutputPage {
+            chunks: vec![chunk(96, "tail")],
+            next: 100,
+            end: 100,
+            gaps: vec![],
+        };
+        let shown = ShownOutput::from_pages(head, Some(tail));
+        assert_eq!(
+            shown.omitted,
+            Some(Omission {
+                offset: 4,
+                bytes: 92,
+                lost_bytes: 10,
+            })
+        );
+    }
+
+    #[test]
+    fn trimming_keeps_the_first_and_last_bytes() {
+        let page = OutputPage {
+            chunks: vec![chunk(0, "0123456789"), chunk(10, "abcdefghij")],
+            next: 20,
+            end: 20,
+            gaps: vec![],
+        };
+        let shown = ShownOutput::from_pages(page, None).trim_to(8);
+        assert_eq!(text(&shown.head), "0123");
+        assert_eq!(text(&shown.tail), "ghij");
+        assert_eq!(
+            shown.omitted,
+            Some(Omission {
+                offset: 4,
+                bytes: 12,
+                lost_bytes: 0,
+            })
+        );
+        assert_eq!(shown.shown_bytes(), 8);
+    }
+}
diff --git a/crates/tools/src/environment/process/mod.rs b/crates/tools/src/environment/process/mod.rs
index 60a6ca374..7008d6be7 100644
--- a/crates/tools/src/environment/process/mod.rs
+++ b/crates/tools/src/environment/process/mod.rs
@@ -11,7 +11,7 @@
 use std::collections::BTreeMap;
 
 use async_trait::async_trait;
-use environment_protocol::shared::SecretString;
+use environment_protocol::bytes::SecretString;
 use serde::{Deserialize, Serialize};
 use thiserror::Error;
 
diff --git a/crates/tools/src/environment/sources.rs b/crates/tools/src/environment/sources.rs
index 22a508cf3..e4cb070dc 100644
--- a/crates/tools/src/environment/sources.rs
+++ b/crates/tools/src/environment/sources.rs
@@ -1,7 +1,10 @@
 //! Shared machine source scope, resolved from the session's effective directory.
 use environment_protocol::{
-    data::inventory::{InventoryLimits, ScanParams},
-    shared::EnvironmentPath,
+    data::{
+        fs::TreeFilter,
+        scan::{ScanLimits, ScanParams, ScanRoot},
+    },
+    paths::EnvironmentPath,
 };
 use std::{
     collections::BTreeSet,
@@ -61,30 +64,77 @@ pub fn scan_query(
             }
         }
     }
-    if roots.len() > 32 {
-        return Err("discovery exceeds 32 roots".into());
+    // One root slot of the protocol's 32 stays free for the working
+    // directory probe.
+    if roots.len() > 31 {
+        return Err("discovery exceeds 31 roots".into());
     }
+    // Discovery roots are often hidden (`.agents`) or ignored by a project's
+    // ignore files, so both defaults are opted out of below each root.
     Ok(ScanParams {
         roots: roots
             .into_iter()
-            .map(|p| EnvironmentPath::new(p.to_string_lossy()).map_err(|e| e.to_string()))
-            .collect::<Result<_, _>>()?,
-        include_patterns: if source == "prompts" {
-            vec!["*.md".into(), "*.txt".into()]
-        } else {
-            vec!["SKILL.md".into(), "**/SKILL.md".into()]
+            .map(|path| {
+                Ok(ScanRoot {
+                    path: EnvironmentPath::new(path.to_string_lossy())
+                        .map_err(|e| e.to_string())?,
+                    if_none_match: None,
+                    max_depth: None,
+                })
+            })
+            .collect::<Result<_, String>>()?,
+        filter: TreeFilter {
+            include: if source == "prompts" {
+                vec!["*.md".into(), "*.txt".into()]
+            } else {
+                vec!["SKILL.md".into()]
+            },
+            include_hidden: true,
+            include_ignored: true,
+            max_depth: Some(if source == "prompts" { 1 } else { 8 }),
+            ..TreeFilter::default()
         },
         read_content: true,
+        include_digests: false,
         follow_symlinks: true,
-        digest_algorithm: None,
-        if_none_match: None,
-        limits: InventoryLimits {
+        limits: ScanLimits {
             max_entries: 4096,
-            max_depth: if source == "prompts" { 1 } else { 8 },
             max_file_bytes: 64 * 1024,
             max_total_bytes: 2 * 1024 * 1024,
-            max_manifest_bytes: 4 * 1024 * 1024,
             max_duration_ms: 2000,
         },
     })
 }
+
+/// Add the working-directory probe to a discovery scan: a root examined at
+/// depth 0, so the same observation proves `cwd` is an existing directory
+/// (`complete` without entries) instead of a separate `fs/getMetadata`.
+/// The probe is the last root of the response.
+pub fn with_working_directory_probe(params: &mut ScanParams, cwd: &EnvironmentPath) {
+    params.roots.push(ScanRoot {
+        path: cwd.clone(),
+        if_none_match: None,
+        max_depth: Some(0),
+    });
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn discovery_scans_select_by_name_and_probe_the_working_directory() {
+        let mut params = scan_query(None, "/project", Some("/home/dev"), "skills").unwrap();
+        assert_eq!(params.filter.include, vec!["SKILL.md"]);
+        assert!(params.filter.include_hidden && params.filter.include_ignored);
+        let cwd = EnvironmentPath::new("/project").unwrap();
+        with_working_directory_probe(&mut params, &cwd);
+        let probe = params.roots.last().unwrap();
+        assert_eq!(
+            (probe.path.as_str(), probe.max_depth),
+            ("/project", Some(0))
+        );
+        let prompts = scan_query(None, "/project", Some("/home/dev"), "prompts").unwrap();
+        assert_eq!(prompts.filter.max_depth, Some(1));
+    }
+}
diff --git a/crates/tools/src/environment/tools/jobs.rs b/crates/tools/src/environment/tools/jobs.rs
index bb919b948..bb9d31cc0 100644
--- a/crates/tools/src/environment/tools/jobs.rs
+++ b/crates/tools/src/environment/tools/jobs.rs
@@ -1,14 +1,17 @@
 //! Canonical durable-job operations.
 
-use environment_protocol::data::jobs::{ReadJobsParams, StartJobsParams, StartJobsResponse};
+use environment_protocol::{
+    data::job::{JobReadEntry, StartJobsParams, StartJobsResponse},
+    ids::JobRequestId,
+};
 
 use crate::{
     environment::{
         EnvironmentToolContext,
         jobs::{
-            JobError, JobHandle, JobReadArgs, JobSubmitArgs, JobSubmitResult, JobSubmitted,
-            ModelJobResultSet, NormalizeJobResultInput, normalize_job_result,
-            visible_job_read_output,
+            DEFAULT_JOB_OUTPUT_BYTES, JobHandle, JobReadArgs, JobSubmitArgs, JobSubmitResult,
+            JobSubmitted, ModelJobResultSet, NormalizeJobResultInput, job_output_read,
+            normalize_job_result, visible_job_read_output,
         },
     },
     error::ToolResult,
@@ -37,32 +40,55 @@ pub async fn invoke_job_read(
         return Err(invalid_request("job_read requires at least one job"));
     }
     let jobs = ctx.jobs.as_ref().ok_or_else(unsupported_job_capability)?;
-    let response = jobs
-        .read_jobs(ReadJobsParams {
-            namespace: job_namespace(ctx, None)?,
-            jobs: args.jobs.into_iter().map(|handle| handle.job_id).collect(),
-            after_seq: args.after_seq,
-            max_bytes: args.output_bytes,
-            include_artifacts: args.include_artifacts,
-            wait_ms: None,
-        })
-        .await?;
-    let mut normalized = Vec::with_capacity(response.jobs.len());
-    for job in response.jobs {
-        normalized.push(
-            normalize_job_result(
-                ctx.blobs.as_ref(),
-                NormalizeJobResultInput {
-                    summary: Some(job.summary),
-                    output_chunks: job.output_chunks,
-                    output_next_seq: job.output_next_seq,
-                    artifacts: job.artifacts,
-                    output_bytes: args.output_bytes,
-                    ..Default::default()
-                },
-            )
-            .await?,
-        );
+    let job_ids = args
+        .jobs
+        .iter()
+        .map(|handle| handle.job_id.clone())
+        .collect::<Vec<_>>();
+    let mut output_bytes = args
+        .output_bytes
+        .unwrap_or(DEFAULT_JOB_OUTPUT_BYTES)
+        .min(ctx.limits.max_model_visible_output_bytes);
+    // Without `after` every job takes two `job/read` entries (head and
+    // tail); the environment's `maxRequestJobs` bounds entries, not jobs,
+    // so the jobs go out in as many requests as that bound needs.
+    let mut after = args.after;
+    let mut jobs_per_request = job_ids.len();
+    if let Some(limits) = jobs.limits() {
+        let max_entries = limits.max_request_jobs as usize;
+        if job_ids.len() > max_entries {
+            return Err(invalid_request(format!(
+                "job_read names {} jobs; the environment reads at most {} at once",
+                job_ids.len(),
+                limits.max_request_jobs
+            )));
+        }
+        if after.is_none() && max_entries < 2 {
+            // No room for a tail entry: show the head only.
+            after = Some(0);
+        }
+        let per_job = if after.is_some() { 1 } else { 2 };
+        jobs_per_request = (max_entries / per_job).max(1);
+        let in_one_request = jobs_per_request.min(job_ids.len()) as u64;
+        output_bytes = output_bytes.min(limits.max_read_bytes / in_one_request);
+    }
+    let per_job = if after.is_some() { 1 } else { 2 };
+    let mut normalized = Vec::with_capacity(job_ids.len());
+    for chunk in job_ids.chunks(jobs_per_request.max(1)) {
+        let response = jobs
+            .read_jobs(job_output_read(chunk, after, output_bytes))
+            .await?;
+        let mut entries = response.jobs.into_iter();
+        for _ in chunk {
+            let job_entries: Vec<JobReadEntry> = entries.by_ref().take(per_job).collect();
+            normalized.push(
+                normalize_job_result(
+                    ctx.blobs.as_ref(),
+                    NormalizeJobResultInput::from_entries(None, job_entries),
+                )
+                .await?,
+            );
+        }
     }
     Ok(ModelJobResultSet { jobs: normalized })
 }
@@ -75,29 +101,29 @@ fn submit_params_from_args(
     ctx: &EnvironmentToolContext,
     args: JobSubmitArgs,
 ) -> ToolResult<StartJobsParams> {
+    let working_directory = ctx.process_cwd.as_ref().map(|cwd| cwd.as_str());
     let mut specs = Vec::with_capacity(args.jobs.len());
     for spec in args.jobs {
         let job_id = spec.job_id.clone();
-        specs.push(spec.into_protocol_spec(job_id)?);
+        specs.push(spec.into_job_spec(job_id, working_directory)?);
     }
     Ok(StartJobsParams {
-        namespace: job_namespace(ctx, None)?,
-        request_id: "default".to_owned(),
+        request_id: request_id(ctx),
         jobs: specs,
     })
 }
 
-fn job_namespace(
-    ctx: &EnvironmentToolContext,
-    explicit_session_id: Option<&str>,
-) -> ToolResult<String> {
-    explicit_session_id
-        .map(ToOwned::to_owned)
-        .or_else(|| ctx.session_id.clone())
-        .ok_or_else(|| JobError::InvalidRequest {
-            message: "environment job namespace requires a session_id".to_owned(),
+/// One request id per call: the invocation's stable operation identity, so
+/// a retried call replays its jobs while a new call that reuses a job id is
+/// refused instead of answered with an earlier run.
+fn request_id(ctx: &EnvironmentToolContext) -> JobRequestId {
+    ctx.operation_id
+        .as_deref()
+        .and_then(|operation_id| JobRequestId::new(operation_id).ok())
+        .unwrap_or_else(|| {
+            JobRequestId::new(format!("jobreq-{}", uuid::Uuid::new_v4().simple()))
+                .expect("uuid request id fits the id grammar")
         })
-        .map_err(Into::into)
 }
 
 fn submit_result_from_response(
@@ -107,21 +133,162 @@ fn submit_result_from_response(
     JobSubmitResult {
         jobs: response
             .jobs
-            .into_iter()
-            .map(|summary| JobSubmitted {
-                name: summary.name,
-                handle: ctx.environment_id.clone().map(|environment_id| JobHandle {
+            .iter()
+            .map(|summary| {
+                let handle = ctx.environment_id.clone().map(|environment_id| JobHandle {
                     environment_id: crate::environment::handles::environment_handle(
                         &environment_id,
                     ),
                     job_id: summary.job_id.clone(),
-                }),
-                job_id: summary.job_id,
-                status: summary.status,
-                dependencies: summary.dependencies,
-                queue_key: summary.queue_key,
-                promise: None,
+                });
+                JobSubmitted::from_summary(summary, handle)
             })
             .collect(),
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use std::sync::{Arc, Mutex};
+
+    use async_trait::async_trait;
+    use environment_protocol::{
+        data::job::{
+            CancelJobsParams, CancelJobsResponse, JobStatus, JobSummary, ReadJobsParams,
+            ReadJobsResponse,
+        },
+        ids::JobId,
+    };
+    use harness::storage::InMemoryBlobStore;
+    use serde_json::json;
+
+    use super::*;
+    use crate::environment::jobs::{JobExecResult, JobExecutor};
+
+    #[derive(Default)]
+    struct RecordingJobs {
+        starts: Mutex<Vec<StartJobsParams>>,
+        reads: Mutex<Vec<ReadJobsParams>>,
+        limits: Option<environment_protocol::data::handshake::JobLimits>,
+    }
+
+    #[async_trait]
+    impl JobExecutor for RecordingJobs {
+        fn limits(&self) -> Option<environment_protocol::data::handshake::JobLimits> {
+            self.limits.clone()
+        }
+
+        async fn start_jobs(&self, request: StartJobsParams) -> JobExecResult<StartJobsResponse> {
+            let jobs = request
+                .jobs
+                .iter()
+                .map(|job| JobSummary {
+                    job_id: job.job_id.clone(),
+                    request_id: request.request_id.clone(),
+                    name: None,
+                    status: JobStatus::Queued,
+                    depends_on: Vec::new(),
+                    queue_key: None,
+                    created_at_ms: 1,
+                    queued_at_ms: None,
+                    started_at_ms: None,
+                    finished_at_ms: None,
+                    cancel_requested_at_ms: None,
+                    duration_ms: None,
+                    exit: None,
+                    stopped_by: None,
+                    leftovers: None,
+                    error: None,
+                })
+                .collect();
+            self.starts.lock().unwrap().push(request);
+            Ok(StartJobsResponse { jobs })
+        }
+
+        async fn read_jobs(&self, request: ReadJobsParams) -> JobExecResult<ReadJobsResponse> {
+            let jobs = request
+                .jobs
+                .iter()
+                .map(|entry| JobReadEntry::Error {
+                    job_id: entry.job_id.clone(),
+                    error: environment_protocol::error::ProtocolError::not_found("unknown job"),
+                })
+                .collect();
+            self.reads.lock().unwrap().push(request);
+            Ok(ReadJobsResponse { jobs })
+        }
+
+        async fn cancel_jobs(
+            &self,
+            _request: CancelJobsParams,
+        ) -> JobExecResult<CancelJobsResponse> {
+            unreachable!("not cancelled")
+        }
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn inline_job_submits_send_a_request_id_per_call() {
+        let jobs = Arc::new(RecordingJobs::default());
+        let base = EnvironmentToolContext::new(None, Arc::new(InMemoryBlobStore::new()))
+            .with_jobs(jobs.clone());
+        let args = || {
+            serde_json::from_value::<JobSubmitArgs>(json!({
+                "jobs": [{"job_id": "build", "argv": ["make"]}]
+            }))
+            .unwrap()
+        };
+        let first = base.clone().with_operation_id("tool-first");
+        invoke_job_submit(&first, args()).await.unwrap();
+        invoke_job_submit(&first, args()).await.unwrap();
+        let second = base.with_operation_id("tool-second");
+        let submitted = invoke_job_submit(&second, args()).await.unwrap();
+
+        let starts = jobs.starts.lock().unwrap();
+        assert_eq!(starts[0].request_id.as_str(), "tool-first");
+        assert_eq!(
+            starts[0].request_id, starts[1].request_id,
+            "a retried call replays"
+        );
+        assert_ne!(
+            starts[0].request_id, starts[2].request_id,
+            "a new call is a new run"
+        );
+        assert_eq!(starts[0].jobs[0].job_id, JobId::new("build").unwrap());
+        assert_eq!(
+            serde_json::to_value(&submitted).unwrap()["jobs"][0]["status"],
+            "queued"
+        );
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn job_reads_split_head_and_tail_entries_across_requests() {
+        let jobs = Arc::new(RecordingJobs {
+            limits: Some(environment_protocol::data::handshake::JobLimits {
+                max_read_bytes: 4096,
+                max_request_jobs: 4,
+                max_retained_output_bytes: 1 << 20,
+                record_retention_ms: 1,
+                cancel_grace_ms: 1,
+            }),
+            ..RecordingJobs::default()
+        });
+        let ctx = EnvironmentToolContext::new(None, Arc::new(InMemoryBlobStore::new()))
+            .with_jobs(jobs.clone());
+        let args = serde_json::from_value::<JobReadArgs>(json!({
+            "jobs": [{"job_id": "a"}, {"job_id": "b"}, {"job_id": "c"}]
+        }))
+        .unwrap();
+        let result = invoke_job_read(&ctx, args).await.unwrap();
+
+        assert_eq!(result.jobs.len(), 3);
+        let reads = jobs.reads.lock().unwrap();
+        assert_eq!(reads.len(), 2, "two jobs of head and tail fill one request");
+        assert!(reads.iter().all(|read| read.jobs.len() <= 4));
+        assert!(reads.iter().all(|read| read.max_bytes <= 4096));
+        let named = reads
+            .iter()
+            .flat_map(|read| read.jobs.iter().map(|entry| entry.job_id.as_str()))
+            .collect::<Vec<_>>();
+        assert_eq!(named, ["a", "a", "b", "b", "c", "c"]);
+    }
+}
diff --git a/crates/tools/src/environment_protocol/conformance.rs b/crates/tools/src/environment_protocol/conformance.rs
index 94f17e17e..9a22c42a3 100644
--- a/crates/tools/src/environment_protocol/conformance.rs
+++ b/crates/tools/src/environment_protocol/conformance.rs
@@ -1,263 +1,1312 @@
-//! Reusable conformance checks for environment data-plane implementations.
+//! Data-plane conformance: drives any environment data server through
+//! [`DataClient`] and checks the contract envd implements.
+//!
+//! The suite checks, against the wire and not through tool adapters:
+//!
+//! - the `initialize` response: plane, version, ceilings and capability
+//!   families;
+//! - `fs/*`: staged writes with `create` and `ifMatch` preconditions and a
+//!   returned version, ranged reads with `fileSize` and `truncated`,
+//!   ceilings refused as `invalidParams`, `fs/rename` without overwrite,
+//!   paged `fs/readDirectory`, `fs/remove` preconditions, typed `notFound`
+//!   and confinement errors, the shared pattern grammar of
+//!   `fs/globFiles` and `fs/searchText` (and that the tools' generic glob
+//!   fallback selects the same files), and per-root `fs/scan` results;
+//! - confinement of symlinks (when the `process` family can create them):
+//!   an in-root link is followed, a link that leaves the root is refused
+//!   with `permissionDenied {outsideRoot}`;
+//! - `process/*` (when the family is present): settled exits with codes and
+//!   named signals, start-time input larger than a pipe buffer, tail reads,
+//!   duplicate ids refused before anything runs, unknown handles as
+//!   `notFound`, and graceful `terminate`;
+//! - `job/*` (when the family is present): `requestId` replay versus
+//!   `jobIdInUse`, per-entry `notFound`, and byte-exact paging.
+//!
+//! The suite works in a fresh directory below `work_directory` and removes
+//! it at the end. Commands run through `/bin/sh`.
+//!
+//! ```no_run
+//! # async fn example(client: environment_client::DataClient) {
+//! use tools::environment_protocol::conformance::{DataConformance, run};
+//!
+//! let work = environment_protocol::paths::EnvironmentPath::new("/workspace").unwrap();
+//! run(&DataConformance::new(client, work)).await.into_result().expect("data plane conforms");
+//! # }
+//! ```
 
-use std::sync::Arc;
+use std::{
+    collections::BTreeMap,
+    fmt,
+    future::Future,
+    time::{Duration, Instant},
+};
 
-use environment_client::{EnvironmentClientError, EnvironmentDataClient, JsonRpcTransport};
+use environment_client::{ClientError, DataClient};
 use environment_protocol::{
-    data::handshake::{InitializeParams, InitializedParams},
-    shared::{CURRENT_PROTOCOL_VERSION, EnvironmentCapabilities},
+    ENVD_PROTOCOL_VERSION,
+    bytes::ByteChunk,
+    data::{
+        exec::{CommandSpec, ExecInput, ExecState, ExitStatus, ReturnOn, StoppedBy},
+        fs::{
+            CreateDirectoryParams, FileKind, GetMetadataParams, GlobFilesLimits, GlobFilesParams,
+            ReadDirectoryParams, ReadFileParams, RemoveParams, RenameParams, SearchTextLimits,
+            SearchTextParams, TreeFilter, WriteCondition, WriteFileParams, WriteFileResponse,
+        },
+        handshake::InitializeResponse,
+        idle::GetIdleParams,
+        job::{JobReadEntry, JobReadRequest, JobSpec, ReadJobsParams, StartJobsParams},
+        process::{
+            ProcessSignal, ReadProcessParams, ReadProcessResponse, StartProcessParams,
+            TerminateProcessParams, WriteProcessParams,
+        },
+        scan::{ScanLimits, ScanParams, ScanRoot, ScanRootResult},
+    },
+    error::{ErrorData, PermissionReason, PreconditionReason, ProtocolErrorKind},
+    handshake::Plane,
+    ids::{JobId, JobRequestId, ProcessId},
+    limits::MIN_CONCURRENT_REQUESTS,
+    paths::{EnvironmentPath, TreePath},
 };
-use harness::storage::InMemoryBlobStore;
 use thiserror::Error;
 
-use crate::{
-    environment_protocol::RemoteEnvironmentConnection,
-    error::ToolError,
-    fs::{
-        CopyOptions, CreateDirectoryOptions, FileAccessPolicy, FsError, FsPath, FsPathError,
-        RemoveOptions,
-        tools::{ReadFileArgs, WriteFileArgs, invoke_read_file, invoke_write_file},
-    },
-};
+/// What to run the suite against.
+#[derive(Clone)]
+pub struct DataConformance {
+    /// An initialized connection to the server under test.
+    pub client: DataClient,
+    /// An existing, writable directory inside the filesystem root.
+    pub work_directory: EnvironmentPath,
+    /// A path outside the server's filesystem root, when the root is
+    /// narrowed; checks that it is refused with `permissionDenied`.
+    pub outside_root: Option<EnvironmentPath>,
+    /// Bound on waiting for a command to exit. Default 30 s.
+    pub command_timeout: Duration,
+}
 
+impl DataConformance {
+    pub fn new(client: DataClient, work_directory: EnvironmentPath) -> Self {
+        Self {
+            client,
+            work_directory,
+            outside_root: None,
+            command_timeout: Duration::from_secs(30),
+        }
+    }
+}
+
+impl fmt::Debug for DataConformance {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("DataConformance")
+            .field("work_directory", &self.work_directory)
+            .field("outside_root", &self.outside_root)
+            .finish_non_exhaustive()
+    }
+}
+
+/// The outcome of one check.
 #[derive(Clone, Debug)]
-pub struct EnvironmentDataConformanceOptions {
-    pub initialize: InitializeParams,
-    pub expected_capabilities: EnvironmentCapabilities,
-    pub expected_default_cwd: FsPath,
-    /// A relative directory that the suite may create and remove.
-    pub test_directory: FsPath,
-    /// An absolute path outside the provider's exposed filesystem route.
-    pub forbidden_path: FsPath,
+pub struct CheckResult {
+    /// Stable check name, such as `fs.writeFile.preconditions`.
+    pub name: &'static str,
+    /// Why the check failed.
+    pub failure: Option<String>,
 }
 
-#[derive(Debug, Error)]
-pub enum EnvironmentDataConformanceError {
-    #[error(transparent)]
-    Client(#[from] EnvironmentClientError),
+/// Every check that ran, in order.
+#[derive(Clone, Debug, Default)]
+pub struct DataConformanceReport {
+    pub checks: Vec<CheckResult>,
+}
 
-    #[error(transparent)]
-    Filesystem(#[from] FsError),
+impl DataConformanceReport {
+    pub fn passed(&self) -> bool {
+        self.checks.iter().all(|check| check.failure.is_none())
+    }
 
-    #[error(transparent)]
-    Path(#[from] FsPathError),
+    pub fn failures(&self) -> impl Iterator<Item = &CheckResult> {
+        self.checks.iter().filter(|check| check.failure.is_some())
+    }
 
-    #[error(transparent)]
-    Tool(#[from] ToolError),
+    /// `Ok` when every check passed.
+    pub fn into_result(self) -> Result<Self, DataConformanceFailure> {
+        if self.passed() {
+            Ok(self)
+        } else {
+            Err(DataConformanceFailure(self))
+        }
+    }
+}
+
+/// A report with at least one failed check.
+#[derive(Clone, Debug, Error)]
+pub struct DataConformanceFailure(pub DataConformanceReport);
+
+impl fmt::Display for DataConformanceFailure {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(formatter, "data conformance failed:")?;
+        for check in self.0.failures() {
+            write!(
+                formatter,
+                "\n- {}: {}",
+                check.name,
+                check.failure.as_deref().unwrap_or_default()
+            )?;
+        }
+        Ok(())
+    }
+}
+
+type Check = Result<(), String>;
+
+/// Run every check that the server's capability families allow.
+pub async fn run(suite: &DataConformance) -> DataConformanceReport {
+    let mut report = DataConformanceReport::default();
+    let initialized = suite.client.initialize_response().clone();
+    let handshake = check_initialize(&initialized);
+    let handshake_failed = handshake.is_err();
+    record(&mut report, "initialize", handshake);
+    if handshake_failed {
+        return report;
+    }
+    record(
+        &mut report,
+        "env.getIdle",
+        call(suite.client.get_idle(&GetIdleParams {}))
+            .await
+            .map(drop),
+    );
 
-    #[error("environment data conformance check failed: {0}")]
-    Check(String),
+    let work = match prepare(suite).await {
+        Ok(work) => work,
+        Err(failure) => {
+            record(&mut report, "fs.prepare", Err(failure));
+            return report;
+        }
+    };
+    let context = Context {
+        client: &suite.client,
+        initialized: &initialized,
+        work: &work,
+        timeout: suite.command_timeout,
+    };
+    record(
+        &mut report,
+        "fs.writeFile.preconditions",
+        context.write_preconditions().await,
+    );
+    record(
+        &mut report,
+        "fs.readFile.range",
+        context.ranged_reads().await,
+    );
+    record(
+        &mut report,
+        "fs.readFile.notRegular",
+        context.reads_refuse_directories().await,
+    );
+    record(&mut report, "fs.rename", context.rename().await);
+    record(
+        &mut report,
+        "fs.readDirectory.paging",
+        context.directory_paging().await,
+    );
+    record(&mut report, "fs.remove", context.remove().await);
+    record(
+        &mut report,
+        "fs.errors",
+        context.errors(suite.outside_root.as_ref()).await,
+    );
+    record(
+        &mut report,
+        "fs.globFiles.grammar",
+        context.glob_grammar().await,
+    );
+    record(
+        &mut report,
+        "fs.glob.genericParity",
+        context.glob_parity().await,
+    );
+    record(&mut report, "fs.searchText", context.search().await);
+    record(&mut report, "fs.scan.perRoot", context.scan().await);
+    if initialized.capabilities.process.is_some() {
+        record(
+            &mut report,
+            "fs.confinement.symlinks",
+            context
+                .symlink_confinement(suite.outside_root.as_ref())
+                .await,
+        );
+        record(&mut report, "process.exit", context.process_exit().await);
+        record(
+            &mut report,
+            "process.signal",
+            context.process_signal().await,
+        );
+        record(
+            &mut report,
+            "process.largeInput",
+            context.process_large_input().await,
+        );
+        record(
+            &mut report,
+            "process.duplicateId",
+            context.process_duplicate_id().await,
+        );
+        record(
+            &mut report,
+            "process.unknown",
+            context.process_unknown().await,
+        );
+        record(
+            &mut report,
+            "process.terminate",
+            context.process_terminate().await,
+        );
+    }
+    if initialized.capabilities.job.is_some() {
+        record(&mut report, "job.requestId", context.job_request_id().await);
+        record(&mut report, "job.read.unknown", context.job_unknown().await);
+        record(&mut report, "job.read.paging", context.job_paging().await);
+    }
+    record(
+        &mut report,
+        "fs.cleanup",
+        call(suite.client.remove(&RemoveParams {
+            path: work,
+            recursive: true,
+            force: true,
+        }))
+        .await
+        .map(drop),
+    );
+    report
+}
+
+fn record(report: &mut DataConformanceReport, name: &'static str, outcome: Check) {
+    report.checks.push(CheckResult {
+        name,
+        failure: outcome.err(),
+    });
 }
 
-/// Exercises the transport handshake and the generic filesystem adapter.
-///
-/// Provider implementations can invoke this from their own integration tests.
-/// The supplied test directory is removed after a successful check.
-pub async fn assert_environment_data_conformance<T>(
-    mut client: EnvironmentDataClient<T>,
-    options: EnvironmentDataConformanceOptions,
-) -> Result<(), EnvironmentDataConformanceError>
-where
-    T: JsonRpcTransport + Send + 'static,
-{
-    if options.test_directory.is_absolute()
-        || options.test_directory.is_root()
-        || options.test_directory.has_unresolved_parent()
-        || options.test_directory.segments().count() != 1
-    {
-        return Err(check(
-            "test_directory must be a single relative path segment",
-        ));
-    }
-    if !options.forbidden_path.is_absolute() {
-        return Err(check("forbidden_path must be absolute"));
-    }
-    if !options.expected_capabilities.filesystem_read
-        || !options.expected_capabilities.filesystem_write
-    {
-        return Err(check(
-            "filesystem conformance requires read and write capabilities",
-        ));
-    }
-
-    let initialized = client.initialize(&options.initialize).await?;
-    if initialized.protocol_version != CURRENT_PROTOCOL_VERSION {
-        return Err(check(format!(
-            "protocol version was {}, expected {CURRENT_PROTOCOL_VERSION}",
+fn check_initialize(initialized: &InitializeResponse) -> Check {
+    ensure(
+        initialized.plane == Plane::Data,
+        "initialize did not name the data plane",
+    )?;
+    ensure(
+        initialized.protocol_version == ENVD_PROTOCOL_VERSION,
+        format!(
+            "protocolVersion {} differs from {ENVD_PROTOCOL_VERSION}",
             initialized.protocol_version
-        )));
-    }
-    if initialized.capabilities != options.expected_capabilities {
-        return Err(check(format!(
-            "initialize capabilities were {:?}, expected {:?}",
-            initialized.capabilities, options.expected_capabilities
-        )));
-    }
-    if initialized.default_cwd.as_deref() != Some(options.expected_default_cwd.as_str()) {
-        return Err(check(format!(
-            "default cwd was {:?}, expected {}",
-            initialized.default_cwd, options.expected_default_cwd
-        )));
-    }
-    client.initialized(&InitializedParams {}).await?;
-
-    let connection = RemoteEnvironmentConnection::new(client, initialized.capabilities)
-        .with_cwd(options.expected_default_cwd.clone());
-    if connection.process_executor().is_some() != options.expected_capabilities.process_start {
-        return Err(check(
-            "process executor did not follow process_start capability",
-        ));
-    }
-    let has_any_job_capability = options.expected_capabilities.job_start
-        || options.expected_capabilities.job_list
-        || options.expected_capabilities.job_read
-        || options.expected_capabilities.job_cancel;
-    if connection.job_executor().is_some() != has_any_job_capability {
-        return Err(check("job executor did not follow advertised capabilities"));
-    }
-
-    let (fs_context, _) = connection.into_contexts(Arc::new(InMemoryBlobStore::new()));
-    if fs_context.fs_cwd.as_ref() != Some(&options.expected_default_cwd) {
-        return Err(check("filesystem tool context did not retain default cwd"));
-    }
-    if fs_context.fs.access_policy() != FileAccessPolicy::FullReadWrite {
-        return Err(check(
-            "writable environment filesystem was not exposed as read-write",
-        ));
-    }
-
-    let nested = options.test_directory.join("nested")?;
-    let source = nested.join("source.txt")?;
-    let copy = nested.join("copy.txt")?;
-    let copied_tree = FsPath::new(format!("{}-copy", options.test_directory))?;
-    let contents = "environment data conformance\n";
-
-    let write = invoke_write_file(
-        &fs_context,
-        WriteFileArgs {
-            path: source.clone(),
-            content: Some(contents.to_owned()),
-            content_ref: None,
-        },
-    )
-    .await?;
-    let expected_source = options.expected_default_cwd.join_path(&source)?;
-    if write.resolved_path != expected_source {
-        return Err(check(format!(
-            "relative tool path resolved to {}, expected {expected_source}",
-            write.resolved_path
-        )));
-    }
-
-    let read = invoke_read_file(
-        &fs_context,
-        ReadFileArgs {
-            path: source.clone(),
-            offset: None,
-            limit: None,
-        },
-    )
+        ),
+    )?;
+    ensure(
+        initialized.limits.max_concurrent_requests >= MIN_CONCURRENT_REQUESTS,
+        "maxConcurrentRequests is below the protocol minimum",
+    )?;
+    let filesystem = initialized
+        .capabilities
+        .filesystem
+        .as_ref()
+        .ok_or("the suite needs the filesystem family")?;
+    ensure(filesystem.write, "the suite needs a writable filesystem")
+}
+
+async fn prepare(suite: &DataConformance) -> Result<EnvironmentPath, String> {
+    let work = join(
+        &suite.work_directory,
+        &format!("conformance-{}", uuid::Uuid::new_v4().simple()),
+    )?;
+    call(suite.client.create_directory(&CreateDirectoryParams {
+        path: work.clone(),
+        recursive: false,
+    }))
     .await?;
-    if read.text != contents.trim_end() {
-        return Err(check(
-            "read_file did not return bytes written by write_file",
-        ));
-    }
-
-    let source_metadata = fs_context.fs.get_metadata(&expected_source).await?;
-    if !source_metadata.is_file || source_metadata.is_directory {
-        return Err(check("file metadata did not identify a regular file"));
-    }
-    let expected_nested = options.expected_default_cwd.join_path(&nested)?;
-    let directory_metadata = fs_context.fs.get_metadata(&expected_nested).await?;
-    if !directory_metadata.is_directory || directory_metadata.is_file {
-        return Err(check("directory metadata did not identify a directory"));
-    }
-    if !matches!(
-        fs_context
-            .fs
-            .create_directory(&expected_nested, CreateDirectoryOptions::single())
-            .await,
-        Err(FsError::AlreadyExists { .. })
-    ) {
-        return Err(check(
-            "provider conflict did not map to FsError::AlreadyExists",
-        ));
-    }
-    let entries = fs_context.fs.read_directory(&expected_nested).await?;
-    if !entries
-        .iter()
-        .any(|entry| entry.file_name == "source.txt" && entry.is_file)
-    {
-        return Err(check("read_directory omitted the written file"));
-    }
-
-    let expected_copy = options.expected_default_cwd.join_path(&copy)?;
-    fs_context
-        .fs
-        .copy(&expected_source, &expected_copy, CopyOptions::file())
+    Ok(work)
+}
+
+struct Context<'a> {
+    client: &'a DataClient,
+    initialized: &'a InitializeResponse,
+    work: &'a EnvironmentPath,
+    timeout: Duration,
+}
+
+impl Context<'_> {
+    fn path(&self, relative: &str) -> Result<EnvironmentPath, String> {
+        let tree = TreePath::new(relative).map_err(|error| error.to_string())?;
+        self.work.join(&tree).map_err(|error| error.to_string())
+    }
+
+    async fn write(&self, relative: &str, data: &[u8]) -> Result<WriteFileResponse, String> {
+        call(self.client.write_file(&WriteFileParams {
+            path: self.path(relative)?,
+            data: ByteChunk::from(data),
+            create: WriteCondition::Always,
+            if_match: None,
+            executable: false,
+        }))
+        .await
+    }
+
+    async fn mkdir(&self, relative: &str) -> Check {
+        call(self.client.create_directory(&CreateDirectoryParams {
+            path: self.path(relative)?,
+            recursive: true,
+        }))
+        .await
+        .map(drop)
+    }
+
+    async fn write_preconditions(&self) -> Check {
+        let path = self.path("precondition.txt")?;
+        let written = self.write("precondition.txt", b"one").await?;
+        let read = call(self.client.read_file(&ReadFileParams {
+            path: path.clone(),
+            offset: 0,
+            max_bytes: 16,
+        }))
+        .await?;
+        ensure(
+            read.version == written.version,
+            "a read after a write reports a different version",
+        )?;
+        let absent = self
+            .client
+            .write_file(&WriteFileParams {
+                path: path.clone(),
+                data: ByteChunk::from(&b"two"[..]),
+                create: WriteCondition::IfAbsent,
+                if_match: None,
+                executable: false,
+            })
+            .await;
+        expect_precondition(absent, PreconditionReason::CreateCondition)?;
+        let rewritten = call(self.client.write_file(&WriteFileParams {
+            path: path.clone(),
+            data: ByteChunk::from(&b"two"[..]),
+            create: WriteCondition::IfPresent,
+            if_match: Some(written.version.clone()),
+            executable: false,
+        }))
+        .await?;
+        ensure(
+            rewritten.version != written.version,
+            "a changed file kept its version",
+        )?;
+        let stale = self
+            .client
+            .write_file(&WriteFileParams {
+                path,
+                data: ByteChunk::from(&b"three"[..]),
+                create: WriteCondition::Always,
+                if_match: Some(written.version),
+                executable: false,
+            })
+            .await;
+        expect_precondition(stale, PreconditionReason::IfMatchFailed)
+    }
+
+    async fn ranged_reads(&self) -> Check {
+        self.write("range.txt", b"0123456789").await?;
+        let path = self.path("range.txt")?;
+        let middle = call(self.client.read_file(&ReadFileParams {
+            path: path.clone(),
+            offset: 2,
+            max_bytes: 3,
+        }))
         .await?;
-    if fs_context.fs.read_file(&expected_copy).await? != contents.as_bytes() {
-        return Err(check("file copy did not preserve contents"));
-    }
-
-    let expected_test_directory = options
-        .expected_default_cwd
-        .join_path(&options.test_directory)?;
-    let expected_copied_tree = options.expected_default_cwd.join_path(&copied_tree)?;
-    fs_context
-        .fs
-        .copy(
-            &expected_test_directory,
-            &expected_copied_tree,
-            CopyOptions::recursive(),
+        ensure(
+            middle.data.as_slice() == b"234",
+            "offset and maxBytes select the range",
+        )?;
+        ensure(middle.file_size == 10, "fileSize is the whole file's size")?;
+        ensure(
+            middle.truncated,
+            "truncated is set when bytes follow the range",
+        )?;
+        let end = call(self.client.read_file(&ReadFileParams {
+            path: path.clone(),
+            offset: 7,
+            max_bytes: 10,
+        }))
+        .await?;
+        ensure(
+            end.data.as_slice() == b"789" && !end.truncated,
+            "a range reaching the end is not truncated",
+        )?;
+        let ceiling = self.initialized.limits.filesystem.max_read_file_bytes;
+        let above = self
+            .client
+            .read_file(&ReadFileParams {
+                path,
+                offset: 0,
+                max_bytes: ceiling + 1,
+            })
+            .await;
+        match above {
+            Err(error) => match error.protocol_error().map(|error| &error.data) {
+                Some(ErrorData::InvalidParams {
+                    ceiling: Some(reported),
+                    ..
+                }) if *reported == ceiling => Ok(()),
+                _ => Err(format!("maxBytes above the ceiling answered {error}")),
+            },
+            Ok(_) => Err("maxBytes above the ceiling was accepted, not refused".into()),
+        }
+    }
+
+    async fn reads_refuse_directories(&self) -> Check {
+        self.mkdir("directory").await?;
+        let read = self
+            .client
+            .read_file(&ReadFileParams {
+                path: self.path("directory")?,
+                offset: 0,
+                max_bytes: 16,
+            })
+            .await;
+        match read {
+            Err(error)
+                if matches!(
+                    error.protocol_error().map(|error| &error.data),
+                    Some(ErrorData::FailedPrecondition {
+                        reason: PreconditionReason::IsDirectory
+                            | PreconditionReason::NotRegularFile
+                    })
+                ) =>
+            {
+                Ok(())
+            }
+            other => Err(format!("reading a directory answered {other:?}")),
+        }
+    }
+
+    async fn rename(&self) -> Check {
+        self.write("rename-a.txt", b"a").await?;
+        self.write("rename-b.txt", b"b").await?;
+        let rename = |source: &str, destination: &str, overwrite| {
+            Ok::<_, String>(RenameParams {
+                source: self.path(source)?,
+                destination: self.path(destination)?,
+                overwrite,
+                if_match: None,
+            })
+        };
+        expect_kind(
+            self.client
+                .rename(&rename("rename-a.txt", "rename-b.txt", false)?)
+                .await,
+            ProtocolErrorKind::AlreadyExists,
+        )?;
+        call(
+            self.client
+                .rename(&rename("rename-a.txt", "rename-c.txt", false)?),
         )
         .await?;
-    let copied_source = expected_copied_tree.join("nested/source.txt")?;
-    if fs_context.fs.read_file(&copied_source).await? != contents.as_bytes() {
-        return Err(check("recursive directory copy did not preserve contents"));
-    }
-
-    let missing = options
-        .expected_default_cwd
-        .join("missing-conformance-file")?;
-    if !matches!(
-        fs_context.fs.read_file(&missing).await,
-        Err(FsError::NotFound { .. })
-    ) {
-        return Err(check("provider notFound did not map to FsError::NotFound"));
-    }
-    if !matches!(
-        fs_context.fs.read_file(&options.forbidden_path).await,
-        Err(FsError::PermissionDenied { .. })
-    ) {
-        return Err(check(
-            "route escape did not map to FsError::PermissionDenied",
-        ));
-    }
-
-    fs_context
-        .fs
-        .remove(&expected_copy, RemoveOptions::file())
+        expect_kind(
+            self.client
+                .rename(&rename("rename-a.txt", "rename-d.txt", false)?)
+                .await,
+            ProtocolErrorKind::NotFound,
+        )?;
+        let moved = call(self.client.read_file(&ReadFileParams {
+            path: self.path("rename-c.txt")?,
+            offset: 0,
+            max_bytes: 16,
+        }))
         .await?;
-    fs_context
-        .fs
-        .remove(&expected_copied_tree, RemoveOptions::recursive())
+        ensure(
+            moved.data.as_slice() == b"a",
+            "rename did not move the content",
+        )
+    }
+
+    async fn directory_paging(&self) -> Check {
+        self.mkdir("listing").await?;
+        for name in ["c", "a", "b"] {
+            self.write(&format!("listing/{name}"), b"").await?;
+        }
+        let mut names = Vec::new();
+        let mut cursor = None;
+        for _ in 0..5 {
+            let page = call(self.client.read_directory(&ReadDirectoryParams {
+                path: self.path("listing")?,
+                limit: 1,
+                cursor,
+            }))
+            .await?;
+            ensure(page.entries.len() <= 1, "a page exceeded its limit")?;
+            names.extend(
+                page.entries
+                    .into_iter()
+                    .map(|entry| entry.name.as_str().to_owned()),
+            );
+            cursor = page.next_cursor;
+            if cursor.is_none() {
+                break;
+            }
+        }
+        ensure(
+            names == ["a", "b", "c"],
+            format!("paged listing returned {names:?}, not the names in order"),
+        )
+    }
+
+    async fn remove(&self) -> Check {
+        self.mkdir("removal").await?;
+        self.write("removal/file", b"x").await?;
+        let remove = |recursive, force, relative: &str| {
+            Ok::<_, String>(RemoveParams {
+                path: self.path(relative)?,
+                recursive,
+                force,
+            })
+        };
+        expect_precondition(
+            self.client.remove(&remove(false, false, "removal")?).await,
+            PreconditionReason::NotEmpty,
+        )?;
+        call(self.client.remove(&remove(true, false, "removal")?)).await?;
+        call(self.client.remove(&remove(false, true, "removal")?)).await?;
+        expect_kind(
+            self.client.remove(&remove(false, false, "removal")?).await,
+            ProtocolErrorKind::NotFound,
+        )
+    }
+
+    async fn errors(&self, outside_root: Option<&EnvironmentPath>) -> Check {
+        expect_kind(
+            self.client
+                .read_file(&ReadFileParams {
+                    path: self.path("missing")?,
+                    offset: 0,
+                    max_bytes: 1,
+                })
+                .await,
+            ProtocolErrorKind::NotFound,
+        )?;
+        if let Some(outside) = outside_root {
+            let read = self
+                .client
+                .read_file(&ReadFileParams {
+                    path: outside.clone(),
+                    offset: 0,
+                    max_bytes: 1,
+                })
+                .await;
+            match read {
+                Err(error)
+                    if matches!(
+                        error.protocol_error().map(|error| &error.data),
+                        Some(ErrorData::PermissionDenied {
+                            reason: Some(PermissionReason::OutsideRoot)
+                        })
+                    ) => {}
+                other => return Err(format!("a path outside the root answered {other:?}")),
+            }
+        }
+        Ok(())
+    }
+
+    async fn glob_grammar(&self) -> Check {
+        self.mkdir("glob/sub").await?;
+        self.write("glob/a.rs", b"").await?;
+        self.write("glob/sub/b.rs", b"").await?;
+        let ceilings = self.initialized.limits.filesystem.glob;
+        let glob = |include: &str, max_depth| GlobFilesParams {
+            root: self.path("glob").expect("glob root"),
+            filter: TreeFilter {
+                include: vec![include.to_owned()],
+                max_depth,
+                ..TreeFilter::default()
+            },
+            limits: GlobFilesLimits {
+                max_matches: ceilings.max_matches.min(100),
+                max_files: ceilings.max_files.min(1000),
+                max_duration_ms: ceilings.max_duration_ms.min(10_000),
+            },
+        };
+        let names = |matches: Vec<EnvironmentPath>| {
+            matches
+                .iter()
+                .filter_map(|path| path.file_name().map(str::to_owned))
+                .collect::<Vec<_>>()
+        };
+        let segment = call(self.client.glob_files(&glob("*.rs", None))).await?;
+        ensure(
+            names(segment.matches) == ["a.rs", "b.rs"],
+            "a pattern without '/' matches names at any depth",
+        )?;
+        let anchored = call(self.client.glob_files(&glob("/*.rs", None))).await?;
+        ensure(
+            names(anchored.matches) == ["a.rs"],
+            "'*' stays within one segment and a leading '/' anchors",
+        )?;
+        let shallow = call(self.client.glob_files(&glob("**/*.rs", Some(1)))).await?;
+        ensure(
+            names(shallow.matches) == ["a.rs"],
+            "maxDepth 1 selects the root's direct children",
+        )
+    }
+
+    /// The tools' `glob` over this server and over an in-memory filesystem
+    /// holding the same tree select the same files: the generic fallback
+    /// follows the grammar and the walk defaults of `fs/globFiles`.
+    async fn glob_parity(&self) -> Check {
+        use crate::fs::{
+            CreateDirectoryOptions, FileSystem as _, FsPath, FsToolContext, InMemoryFileSystem,
+            tools::{GlobArgs, invoke_glob},
+        };
+
+        const FILES: [&str; 10] = [
+            "parity/a.rs",
+            "parity/notes.md",
+            "parity/sub/b.rs",
+            "parity/sub/deep/c.rs",
+            "parity/.hidden/d.rs",
+            "parity/.e.rs",
+            "parity/build/out.rs",
+            "parity/skipped.rs",
+            "parity/sub/.gitignore",
+            "parity/.ignore",
+        ];
+        const PATTERNS: [&str; 8] = [
+            "*.rs",
+            "/*.rs",
+            "sub/*.rs",
+            "**/*.rs",
+            "sub/**",
+            "build/",
+            "*.{rs,md}",
+            "deep/*.rs",
+        ];
+        let memory = InMemoryFileSystem::full_access();
+        let local_root = FsPath::new("/parity").map_err(|error| error.to_string())?;
+        for file in FILES {
+            let contents: &[u8] = match file {
+                "parity/sub/.gitignore" => b"deep/\n",
+                "parity/.ignore" => b"skipped.rs\n",
+                _ => b"",
+            };
+            if let Some((directory, _)) = file.rsplit_once('/') {
+                self.mkdir(directory).await?;
+                memory
+                    .create_directory(
+                        &FsPath::new(format!("/{directory}")).map_err(|error| error.to_string())?,
+                        CreateDirectoryOptions::recursive(),
+                    )
+                    .await
+                    .map_err(|error| error.to_string())?;
+            }
+            self.write(file, contents).await?;
+            memory
+                .write_file(
+                    &FsPath::new(format!("/{file}")).map_err(|error| error.to_string())?,
+                    contents.to_vec(),
+                )
+                .await
+                .map_err(|error| error.to_string())?;
+        }
+        let blobs: std::sync::Arc<dyn harness::storage::BlobStore> =
+            std::sync::Arc::new(harness::storage::InMemoryBlobStore::new());
+        let remote_root =
+            FsPath::new(self.path("parity")?.as_str()).map_err(|error| error.to_string())?;
+        let remote = FsToolContext::new(
+            std::sync::Arc::new(
+                super::RemoteEnvironmentConnection::new(self.client.clone()).file_system(),
+            ),
+            blobs.clone(),
+        );
+        let local = FsToolContext::new(std::sync::Arc::new(memory), blobs);
+        let relative = |root: &FsPath, matches: Vec<FsPath>| {
+            matches
+                .iter()
+                .map(|path| {
+                    path.as_str()
+                        .strip_prefix(root.as_str())
+                        .unwrap_or(path.as_str())
+                        .to_owned()
+                })
+                .collect::<Vec<_>>()
+        };
+        for pattern in PATTERNS {
+            let args = |root: &FsPath| GlobArgs {
+                pattern: pattern.to_owned(),
+                path: Some(root.clone()),
+                max_depth: None,
+                limit: None,
+            };
+            let native = invoke_glob(&remote, args(&remote_root))
+                .await
+                .map_err(|error| format!("glob {pattern:?} on the server: {error}"))?;
+            let generic = invoke_glob(&local, args(&local_root))
+                .await
+                .map_err(|error| format!("generic glob {pattern:?}: {error}"))?;
+            let native = relative(&remote_root, native.matches);
+            let generic = relative(&local_root, generic.matches);
+            ensure(
+                native == generic,
+                format!(
+                    "glob {pattern:?} selected {native:?} on the server but {generic:?} in the generic fallback"
+                ),
+            )?;
+        }
+        Ok(())
+    }
+
+    async fn search(&self) -> Check {
+        self.mkdir("search").await?;
+        self.write("search/notes.txt", b"alpha\nneedle here\n")
+            .await?;
+        let ceilings = self.initialized.limits.filesystem.search;
+        let response = call(self.client.search_text(&SearchTextParams {
+            root: self.path("search")?,
+            pattern: "NEEDLE".into(),
+            pattern_ignore_case: true,
+            filter: TreeFilter {
+                include: vec!["*.txt".into()],
+                ..TreeFilter::default()
+            },
+            limits: SearchTextLimits {
+                max_matches: ceilings.max_matches.min(10),
+                max_files: ceilings.max_files.min(100),
+                max_bytes: ceilings.max_bytes.min(1 << 20),
+                max_duration_ms: ceilings.max_duration_ms.min(10_000),
+                max_line_bytes: ceilings.max_line_bytes,
+            },
+        }))
         .await?;
-    fs_context
-        .fs
-        .remove(&expected_test_directory, RemoveOptions::recursive())
+        ensure(
+            matches!(response.matches.as_slice(), [found] if found.line_number == 2 && found.line == "needle here"),
+            format!("search answered {:?}", response.matches),
+        )
+    }
+
+    async fn scan(&self) -> Check {
+        self.mkdir("scan").await?;
+        self.write("scan/one.md", b"# one").await?;
+        let ceilings = self.initialized.limits.filesystem.scan;
+        let response = call(self.client.scan(&ScanParams {
+            roots: vec![
+                ScanRoot {
+                    path: self.path("scan")?,
+                    if_none_match: None,
+                    max_depth: None,
+                },
+                ScanRoot {
+                    path: self.path("scan-missing")?,
+                    if_none_match: None,
+                    max_depth: None,
+                },
+                ScanRoot {
+                    path: self.work.clone(),
+                    if_none_match: None,
+                    max_depth: Some(0),
+                },
+            ],
+            filter: TreeFilter {
+                include: vec!["*.md".into()],
+                ..TreeFilter::default()
+            },
+            read_content: true,
+            include_digests: false,
+            follow_symlinks: false,
+            limits: ScanLimits {
+                max_entries: ceilings.max_entries.min(100),
+                max_file_bytes: ceilings.max_file_bytes.min(4096),
+                max_total_bytes: ceilings.max_total_bytes.min(65536),
+                max_duration_ms: ceilings.max_duration_ms.min(10_000),
+            },
+        }))
         .await?;
-    if !matches!(
-        fs_context.fs.get_metadata(&expected_test_directory).await,
-        Err(FsError::NotFound { .. })
-    ) {
-        return Err(check("recursive remove left the test directory behind"));
+        match response.roots.as_slice() {
+            [
+                ScanRootResult::Complete { entries, .. },
+                ScanRootResult::Missing { .. },
+                ScanRootResult::Complete { entries: probe, .. },
+            ] if entries.len() == 1
+                && entries[0].data.as_ref().map(ByteChunk::as_slice) == Some(&b"# one"[..])
+                && probe.is_empty() =>
+            {
+                Ok(())
+            }
+            other => Err(format!("scan answered {other:?}")),
+        }
+    }
+
+    /// An in-root symlink is followed; one whose target leaves the root is
+    /// refused with `permissionDenied {outsideRoot}` by `fs/readFile` and a
+    /// following `fs/getMetadata`, while the link itself stays describable.
+    async fn symlink_confinement(&self, outside_root: Option<&EnvironmentPath>) -> Check {
+        self.write("link-target.txt", b"inside").await?;
+        let mut script = "ln -s link-target.txt link-inside".to_owned();
+        if let Some(outside) = outside_root {
+            script.push_str(&format!(" && ln -s '{outside}' link-outside"));
+        }
+        let process_id = self.start(&script, ExecInput::None {}).await?;
+        let (_, exited) = self.read_to_exit(&process_id).await?;
+        ensure(
+            exited.exit == Some(ExitStatus::Code { code: 0 }),
+            format!("creating the links exited {:?}", exited.exit),
+        )?;
+        let inside = call(self.client.read_file(&ReadFileParams {
+            path: self.path("link-inside")?,
+            offset: 0,
+            max_bytes: 16,
+        }))
+        .await?;
+        ensure(
+            inside.data.as_slice() == b"inside",
+            "reading an in-root link did not read its target",
+        )?;
+        let followed = call(self.client.get_metadata(&GetMetadataParams {
+            path: self.path("link-inside")?,
+            follow_symlinks: true,
+        }))
+        .await?;
+        ensure(
+            followed.metadata.kind == FileKind::File,
+            format!(
+                "a followed in-root link described a {:?}",
+                followed.metadata.kind
+            ),
+        )?;
+        if outside_root.is_none() {
+            return Ok(());
+        }
+        let outside = self.path("link-outside")?;
+        let link = call(self.client.get_metadata(&GetMetadataParams {
+            path: outside.clone(),
+            follow_symlinks: false,
+        }))
+        .await?;
+        ensure(
+            link.metadata.kind == FileKind::Symlink,
+            "an escaping link is still describable as a symlink",
+        )?;
+        let outside_root = |result: Result<_, ClientError>, what: &str| match result {
+            Err(error)
+                if matches!(
+                    error.protocol_error().map(|error| &error.data),
+                    Some(ErrorData::PermissionDenied {
+                        reason: Some(PermissionReason::OutsideRoot)
+                    })
+                ) =>
+            {
+                Ok(())
+            }
+            Err(error) => Err(format!("{what} through an escaping link answered {error}")),
+            Ok(_) => Err(format!("{what} followed a link that leaves the root")),
+        };
+        outside_root(
+            self.client
+                .read_file(&ReadFileParams {
+                    path: outside.clone(),
+                    offset: 0,
+                    max_bytes: 16,
+                })
+                .await
+                .map(drop),
+            "fs/readFile",
+        )?;
+        outside_root(
+            self.client
+                .get_metadata(&GetMetadataParams {
+                    path: outside,
+                    follow_symlinks: true,
+                })
+                .await
+                .map(drop),
+            "fs/getMetadata {followSymlinks}",
+        )
+    }
+
+    fn process_id(&self) -> ProcessId {
+        ProcessId::new(format!("conformance-{}", uuid::Uuid::new_v4().simple()))
+            .expect("generated ids fit the grammar")
+    }
+
+    async fn start(&self, script: &str, input: ExecInput) -> Result<ProcessId, String> {
+        let process_id = self.process_id();
+        call(self.client.start_process(&StartProcessParams {
+            process_id: process_id.clone(),
+            command: shell(script, input, self.work),
+            pty: None,
+        }))
+        .await?;
+        Ok(process_id)
+    }
+
+    /// Read from the cursor until the exit has settled and all output is in.
+    async fn read_to_exit(
+        &self,
+        process_id: &ProcessId,
+    ) -> Result<(Vec<u8>, ReadProcessResponse), String> {
+        let deadline = Instant::now() + self.timeout;
+        let mut output = Vec::new();
+        loop {
+            let remaining = deadline.saturating_duration_since(Instant::now());
+            if remaining.is_zero() {
+                return Err("the command did not exit in time".into());
+            }
+            let response = call(self.client.read_process(&ReadProcessParams {
+                process_id: process_id.clone(),
+                after: None,
+                tail_bytes: None,
+                ack: None,
+                max_bytes: self.initialized.limits.process.max_read_bytes,
+                wait_ms: (remaining.as_millis() as u64).min(self.initialized.limits.max_wait_ms),
+                return_on: ReturnOn::Exit,
+            }))
+            .await?;
+            ensure(
+                response.output.gaps.is_empty(),
+                "output gaps in a short command",
+            )?;
+            for chunk in &response.output.chunks {
+                output.extend_from_slice(chunk.data.as_slice());
+            }
+            if response.state == ExecState::Exited && response.output.next == response.output.end {
+                return Ok((output, response));
+            }
+        }
+    }
+
+    async fn process_exit(&self) -> Check {
+        let process_id = self
+            .start("printf out; printf err >&2; exit 3", ExecInput::None {})
+            .await?;
+        let (output, response) = self.read_to_exit(&process_id).await?;
+        ensure(
+            response.exit == Some(ExitStatus::Code { code: 3 }),
+            format!("exit was {:?}, not code 3", response.exit),
+        )?;
+        let text = String::from_utf8_lossy(&output);
+        ensure(
+            text.contains("out") && text.contains("err"),
+            "stdout and stderr both reach the output",
+        )
+    }
+
+    async fn process_signal(&self) -> Check {
+        let process_id = self.start("kill -TERM $$", ExecInput::None {}).await?;
+        let (_, response) = self.read_to_exit(&process_id).await?;
+        match &response.exit {
+            Some(ExitStatus::Signal { signal, .. }) if signal.as_str() == "SIGTERM" => Ok(()),
+            other => Err(format!("a signal death was reported as {other:?}")),
+        }
+    }
+
+    async fn process_large_input(&self) -> Check {
+        let input = vec![b'x'; 1 << 20];
+        let process_id = self
+            .start(
+                "cat",
+                ExecInput::Bytes {
+                    data: ByteChunk::from(input.clone()),
+                },
+            )
+            .await?;
+        let (output, response) = self.read_to_exit(&process_id).await?;
+        ensure(
+            response.output.end == input.len() as u64 && output == input,
+            format!(
+                "cat echoed {} of {} input bytes",
+                response.output.end,
+                input.len()
+            ),
+        )?;
+        let tail = self
+            .client
+            .read_process(&ReadProcessParams {
+                process_id,
+                after: None,
+                tail_bytes: Some(10),
+                ack: None,
+                max_bytes: 10,
+                wait_ms: 0,
+                return_on: ReturnOn::AnyOutput,
+            })
+            .await;
+        match tail {
+            // A fully read process may already be released.
+            Err(error) if error.protocol_kind() == Some(ProtocolErrorKind::NotFound) => Ok(()),
+            Err(error) => Err(error.to_string()),
+            Ok(tail) => ensure(
+                tail.output.next == tail.output.end
+                    && tail
+                        .output
+                        .chunks
+                        .first()
+                        .is_none_or(|chunk| chunk.offset >= tail.output.end - 10),
+                "a tail read starts at end - tailBytes",
+            ),
+        }
+    }
+
+    async fn process_duplicate_id(&self) -> Check {
+        let marker = self.path("duplicate-marker")?;
+        let script = format!("echo ran >> '{marker}'");
+        let process_id = self.start("sleep 30", ExecInput::None {}).await?;
+        let duplicate = self
+            .client
+            .start_process(&StartProcessParams {
+                process_id: process_id.clone(),
+                command: shell(&script, ExecInput::None {}, self.work),
+                pty: None,
+            })
+            .await;
+        let _ = self
+            .client
+            .terminate_process(&TerminateProcessParams {
+                process_id,
+                signal: ProcessSignal::Kill,
+            })
+            .await;
+        expect_kind(duplicate, ProtocolErrorKind::AlreadyExists)?;
+        expect_kind(
+            self.client
+                .read_file(&ReadFileParams {
+                    path: marker,
+                    offset: 0,
+                    max_bytes: 16,
+                })
+                .await,
+            ProtocolErrorKind::NotFound,
+        )
+        .map_err(|_| "a refused duplicate start ran its command".to_owned())
+    }
+
+    async fn process_unknown(&self) -> Check {
+        let unknown = self.process_id();
+        expect_kind(
+            self.client
+                .read_process(&ReadProcessParams {
+                    process_id: unknown.clone(),
+                    after: None,
+                    tail_bytes: None,
+                    ack: None,
+                    max_bytes: 1,
+                    wait_ms: 0,
+                    return_on: ReturnOn::AnyOutput,
+                })
+                .await,
+            ProtocolErrorKind::NotFound,
+        )?;
+        expect_kind(
+            self.client
+                .write_process(&WriteProcessParams {
+                    process_id: unknown.clone(),
+                    data: ByteChunk::from(&b"x"[..]),
+                    close_input: false,
+                })
+                .await,
+            ProtocolErrorKind::NotFound,
+        )?;
+        expect_kind(
+            self.client
+                .terminate_process(&TerminateProcessParams {
+                    process_id: unknown,
+                    signal: ProcessSignal::Kill,
+                })
+                .await,
+            ProtocolErrorKind::NotFound,
+        )
     }
 
-    Ok(())
+    async fn process_terminate(&self) -> Check {
+        let process_id = self.start("sleep 60", ExecInput::None {}).await?;
+        let response = call(self.client.terminate_process(&TerminateProcessParams {
+            process_id: process_id.clone(),
+            signal: ProcessSignal::Terminate,
+        }))
+        .await?;
+        ensure(
+            response.running,
+            "terminate of a running process reported it not running",
+        )?;
+        let (_, exited) = self.read_to_exit(&process_id).await?;
+        ensure(
+            exited.stopped_by == Some(StoppedBy::Terminate),
+            format!("stoppedBy was {:?}", exited.stopped_by),
+        )
+    }
+
+    fn job(&self, job_id: &JobId, script: &str) -> JobSpec {
+        JobSpec {
+            job_id: job_id.clone(),
+            name: None,
+            command: shell(script, ExecInput::None {}, self.work),
+            depends_on: Vec::new(),
+            dependency_policy: Default::default(),
+            queue_key: None,
+        }
+    }
+
+    fn job_ids(&self) -> (JobId, JobRequestId, JobRequestId) {
+        let suffix = uuid::Uuid::new_v4().simple();
+        (
+            JobId::new(format!("conformance-{suffix}")).expect("job id"),
+            JobRequestId::new(format!("request-a-{suffix}")).expect("request id"),
+            JobRequestId::new(format!("request-b-{suffix}")).expect("request id"),
+        )
+    }
+
+    async fn job_request_id(&self) -> Check {
+        let (job_id, first, second) = self.job_ids();
+        let start = |request_id: &JobRequestId| StartJobsParams {
+            request_id: request_id.clone(),
+            jobs: vec![self.job(&job_id, "true")],
+        };
+        let started = call(self.client.start_jobs(&start(&first))).await?;
+        let replayed = call(self.client.start_jobs(&start(&first))).await?;
+        ensure(
+            started.jobs[0].created_at_ms == replayed.jobs[0].created_at_ms,
+            "a retried start with the same requestId created another run",
+        )?;
+        expect_precondition(
+            self.client.start_jobs(&start(&second)).await,
+            PreconditionReason::JobIdInUse,
+        )
+    }
+
+    async fn job_unknown(&self) -> Check {
+        let (job_id, _, _) = self.job_ids();
+        let response = call(self.client.read_jobs(&ReadJobsParams {
+            jobs: vec![JobReadRequest {
+                job_id,
+                after: None,
+                tail_bytes: None,
+                max_bytes: None,
+            }],
+            max_bytes: 0,
+            wait_ms: 0,
+            return_on: ReturnOn::AnyOutput,
+        }))
+        .await?;
+        match response.jobs.as_slice() {
+            [JobReadEntry::Error { error, .. }] if error.kind() == ProtocolErrorKind::NotFound => {
+                Ok(())
+            }
+            other => Err(format!("an unknown job read answered {other:?}")),
+        }
+    }
+
+    async fn job_paging(&self) -> Check {
+        let (job_id, request_id, _) = self.job_ids();
+        // 20 000 bytes: 2 000 numbered lines of 10 bytes each.
+        let script = "i=0; while [ $i -lt 2000 ]; do printf '%09d\\n' $i; i=$((i+1)); done";
+        call(self.client.start_jobs(&StartJobsParams {
+            request_id,
+            jobs: vec![self.job(&job_id, script)],
+        }))
+        .await?;
+        let deadline = Instant::now() + self.timeout;
+        let mut output = Vec::new();
+        let mut after = 0;
+        loop {
+            let remaining = deadline.saturating_duration_since(Instant::now());
+            if remaining.is_zero() {
+                return Err("the job did not finish in time".into());
+            }
+            let response = call(self.client.read_jobs(&ReadJobsParams {
+                jobs: vec![JobReadRequest {
+                    job_id: job_id.clone(),
+                    after: Some(after),
+                    tail_bytes: None,
+                    max_bytes: None,
+                }],
+                max_bytes: 4096,
+                wait_ms: (remaining.as_millis() as u64).min(1000),
+                return_on: ReturnOn::Window,
+            }))
+            .await?;
+            let [
+                JobReadEntry::Job {
+                    summary,
+                    output: page,
+                },
+            ] = response.jobs.as_slice()
+            else {
+                return Err(format!("job read answered {:?}", response.jobs));
+            };
+            ensure(page.gaps.is_empty(), "a 20 000-byte job reported gaps")?;
+            for chunk in &page.chunks {
+                ensure(
+                    chunk.offset == output.len() as u64,
+                    "pages skipped or repeated bytes",
+                )?;
+                output.extend_from_slice(chunk.data.as_slice());
+            }
+            after = page.next;
+            if summary.status.is_terminal() && page.next == page.end {
+                break;
+            }
+        }
+        let expected = (0..2000).map(|i| format!("{i:09}\n")).collect::<String>();
+        ensure(
+            output == expected.as_bytes(),
+            format!(
+                "paged output was {} bytes, not 20 000 exact bytes",
+                output.len()
+            ),
+        )
+    }
+}
+
+fn shell(script: &str, input: ExecInput, cwd: &EnvironmentPath) -> CommandSpec {
+    CommandSpec {
+        argv: vec!["/bin/sh".into(), "-c".into(), script.into()],
+        cwd: Some(cwd.clone()),
+        env: BTreeMap::new(),
+        secret_env: BTreeMap::new(),
+        input,
+        timeout_ms: Some(120_000),
+    }
+}
+
+fn join(base: &EnvironmentPath, name: &str) -> Result<EnvironmentPath, String> {
+    let tree = TreePath::new(name).map_err(|error| error.to_string())?;
+    base.join(&tree).map_err(|error| error.to_string())
+}
+
+fn ensure(condition: bool, message: impl Into<String>) -> Check {
+    if condition {
+        Ok(())
+    } else {
+        Err(message.into())
+    }
+}
+
+async fn call<T>(future: impl Future<Output = Result<T, ClientError>>) -> Result<T, String> {
+    future.await.map_err(|error| error.to_string())
 }
 
-fn check(message: impl Into<String>) -> EnvironmentDataConformanceError {
-    EnvironmentDataConformanceError::Check(message.into())
+fn expect_kind<T: fmt::Debug>(result: Result<T, ClientError>, kind: ProtocolErrorKind) -> Check {
+    match result {
+        Err(error) if error.protocol_kind() == Some(kind) => Ok(()),
+        other => Err(format!("expected {kind}, got {other:?}")),
+    }
+}
+
+fn expect_precondition<T: fmt::Debug>(
+    result: Result<T, ClientError>,
+    reason: PreconditionReason,
+) -> Check {
+    match &result {
+        Err(error)
+            if matches!(
+                error.protocol_error().map(|error| &error.data),
+                Some(ErrorData::FailedPrecondition { reason: actual }) if *actual == reason
+            ) =>
+        {
+            Ok(())
+        }
+        other => Err(format!(
+            "expected failedPrecondition ({reason:?}), got {other:?}"
+        )),
+    }
 }
diff --git a/crates/tools/src/environment_protocol/mod.rs b/crates/tools/src/environment_protocol/mod.rs
index 72eda9b9a..127ef5a0b 100644
--- a/crates/tools/src/environment_protocol/mod.rs
+++ b/crates/tools/src/environment_protocol/mod.rs
@@ -3,8 +3,8 @@
 pub mod conformance;
 pub mod remote;
 
-pub use conformance::{
-    EnvironmentDataConformanceError, EnvironmentDataConformanceOptions,
-    assert_environment_data_conformance,
+pub use conformance::{DataConformance, DataConformanceFailure, DataConformanceReport};
+pub use remote::{
+    RemoteEnvironmentConnection, RemoteEnvironmentFileSystem, RemoteJobExecutor,
+    RemoteProcessExecutor,
 };
-pub use remote::{RemoteEnvironmentConnection, RemoteEnvironmentFileSystem, RemoteProcessExecutor};
diff --git a/crates/tools/src/environment_protocol/remote.rs b/crates/tools/src/environment_protocol/remote.rs
index 9ac7a60f9..85872ffb7 100644
--- a/crates/tools/src/environment_protocol/remote.rs
+++ b/crates/tools/src/environment_protocol/remote.rs
@@ -1,33 +1,59 @@
 //! Remote environment adapters backed by `environment-client`.
+//!
+//! One [`DataClient`] serves every adapter of a connection: calls are
+//! multiplexed, so a long process read never blocks a file read. The
+//! daemon's `initialize` response decides which adapters exist (capability
+//! families) and bounds every request (advertised ceilings).
 
 use std::{
     sync::{
         Arc, LazyLock,
         atomic::{AtomicU64, Ordering},
     },
-    time::{SystemTime, UNIX_EPOCH},
+    time::{Duration, Instant, SystemTime, UNIX_EPOCH},
 };
 
 use async_trait::async_trait;
-use environment_client::{EnvironmentClientError, EnvironmentDataClient, JsonRpcTransport};
+use environment_client::{ClientError, DataClient};
 use environment_protocol::{
+    bytes::ByteChunk,
     data::{
-        fs as remote_fs, jobs as remote_jobs,
+        exec::{
+            CommandSpec, ExecInput, ExecState, ExitStatus, OutputPage, PtySize, ReturnOn, StoppedBy,
+        },
+        fs::{
+            CreateDirectoryParams, FileKind, GetMetadataParams, GlobFilesLimits, GlobFilesParams,
+            GlobFilesStop, ReadDirectoryParams, ReadFileParams, RemoveParams, RenameParams,
+            SearchTextLimits, SearchTextParams, SearchTextStop, TreeFilter, WriteCondition,
+            WriteFileParams,
+        },
+        handshake::{FilesystemLimits, InitializeResponse, JobLimits, TransferCeilings},
+        job::{
+            CancelJobsParams, CancelJobsResponse, ReadJobsParams, ReadJobsResponse,
+            StartJobsParams, StartJobsResponse,
+        },
         process::{
-            self as remote_process, ProcessOutputStream, ProcessTermination, ReadProcessResponse,
-            WriteProcessStatus,
+            ReadProcessParams, ReadProcessResponse, StartProcessParams, TerminateProcessParams,
+            WriteProcessParams,
+        },
+        transfer::{
+            AppendTransferInventoryParams, BeginTransferParams, ListTransferMissingParams,
+            ListTransferMissingResponse, ReadTransferContentParams, ReadTransferContentResponse,
+            ReadTransferInventoryParams, ReadTransferInventoryResponse, TransferOperationParams,
+            TransferStatus, WriteTransferContentParams, WriteTransferContentResponse,
         },
     },
-    error::EnvironmentProtocolErrorCode,
-    shared::{ByteChunk, EnvironmentCapabilities, EnvironmentPath, ProcessId},
+    error::{Capability, ErrorData, PreconditionReason, ProtocolErrorKind},
+    ids::ProcessId,
+    paths::EnvironmentPath,
 };
 use harness::storage::BlobStore;
-use tokio::sync::Mutex as AsyncMutex;
 
 use crate::{
     environment::{
         EnvironmentToolContext,
         jobs::{JobError, JobExecResult, JobExecutor},
+        output::{ShownOutput, is_stderr},
         process::{
             ContinueProcessRequest, LeftoverProcess, ProcessError, ProcessExecResult,
             ProcessExecutor, ProcessHandle, ProcessOutput, ProcessRequest, ProcessSignal,
@@ -35,13 +61,22 @@ use crate::{
         },
     },
     fs::{
-        CopyOptions, CreateDirectoryOptions, FileAccessPolicy, FileMetadata, FileSystem, FsError,
-        FsGlobRequest, FsGlobResponse, FsPath, FsRangedRead, FsResult, FsSearchStop,
-        FsTextSearchMatch, FsTextSearchRequest, FsTextSearchResponse, FsToolContext,
-        ReadDirectoryEntry, RemoveOptions, ranged_read_from_full,
+        CreateDirectoryOptions, FileAccessPolicy, FileMetadata, FileSystem, FsError, FsGlobRequest,
+        FsGlobResponse, FsPath, FsRangedRead, FsResult, FsSearchStop, FsTextSearchMatch,
+        FsTextSearchRequest, FsTextSearchResponse, FsToolContext, FsVersion, ReadDirectoryEntry,
+        RemoveOptions, RenameOptions, VersionedRead, WriteOptions,
     },
+    transfer::EnvironmentTransfer,
 };
 
+/// Output a process read shows when the caller names no budget.
+const DEFAULT_PROCESS_OUTPUT_BYTES: u64 = 512 * 1024;
+/// Terminal size of a PTY the model asks for with `tty: true`.
+const DEFAULT_PTY_SIZE: PtySize = PtySize { rows: 24, cols: 80 };
+/// How long input that the process does not read yet is retried before the
+/// write gives up.
+const INPUT_RETRY_WINDOW: Duration = Duration::from_secs(10);
+
 static NEXT_PROCESS_EXECUTOR_ID: AtomicU64 = AtomicU64::new(1);
 static PROCESS_ID_NONCE: LazyLock<String> = LazyLock::new(|| {
     let started_at_nanos = SystemTime::now()
@@ -51,103 +86,73 @@ static PROCESS_ID_NONCE: LazyLock<String> = LazyLock::new(|| {
     format!("{}-{started_at_nanos}", std::process::id())
 });
 
-pub struct RemoteEnvironmentConnection<T> {
-    client: Arc<AsyncMutex<EnvironmentDataClient<T>>>,
-    capabilities: EnvironmentCapabilities,
+/// A data-plane connection and the tool adapters it supports.
+#[derive(Clone)]
+pub struct RemoteEnvironmentConnection {
+    client: DataClient,
     cwd: Option<FsPath>,
 }
 
-impl<T> Clone for RemoteEnvironmentConnection<T> {
-    fn clone(&self) -> Self {
-        Self {
-            client: self.client.clone(),
-            capabilities: self.capabilities.clone(),
-            cwd: self.cwd.clone(),
-        }
+impl RemoteEnvironmentConnection {
+    /// Adapters over an initialized client; capabilities and ceilings come
+    /// from its `initialize` response.
+    pub fn new(client: DataClient) -> Self {
+        Self { client, cwd: None }
     }
-}
 
-#[async_trait]
-impl<T: JsonRpcTransport + Send + 'static> crate::transfer::EnvironmentTransfer
-    for RemoteEnvironmentConnection<T>
-{
-    async fn request(
-        &self,
-        request: environment_protocol::data::transfer_session::TransferRequest,
-    ) -> crate::error::ToolResult<environment_protocol::data::transfer_session::TransferResponse>
-    {
-        if !self.capabilities.filesystem_transfer {
-            return Err(crate::error::ToolError::UnsupportedCapability {
-                message: "environment transfer unavailable".into(),
-            });
-        }
-        self.client
-            .lock()
-            .await
-            .transfer(&request)
-            .await
-            .map_err(|e| crate::error::ToolError::InvalidRequest {
-                message: e.to_string(),
-            })
+    pub fn with_cwd(mut self, cwd: FsPath) -> Self {
+        self.cwd = Some(cwd);
+        self
     }
-}
 
-impl<T> RemoteEnvironmentConnection<T>
-where
-    T: JsonRpcTransport + Send + 'static,
-{
-    pub fn new(client: EnvironmentDataClient<T>, capabilities: EnvironmentCapabilities) -> Self {
-        Self {
-            client: Arc::new(AsyncMutex::new(client)),
-            capabilities,
-            cwd: None,
-        }
+    pub fn client(&self) -> &DataClient {
+        &self.client
     }
 
-    pub fn with_cwd(mut self, cwd: FsPath) -> Self {
-        self.cwd = Some(cwd);
-        self
+    pub fn initialize_response(&self) -> &InitializeResponse {
+        self.client.initialize_response()
     }
 
-    /// Gracefully shut down the shared data-plane transport after all tool
-    /// adapters derived from this connection have finished using it.
-    pub async fn close(&self) -> Result<(), EnvironmentClientError> {
-        self.client.lock().await.close().await
+    /// Close the shared connection once every adapter derived from it has
+    /// finished.
+    pub async fn close(&self) -> Result<(), ClientError> {
+        self.client.close().await
     }
 
-    pub fn file_system(&self) -> RemoteEnvironmentFileSystem<T> {
+    pub fn file_system(&self) -> RemoteEnvironmentFileSystem {
+        let initialized = self.initialize_response();
         RemoteEnvironmentFileSystem {
             client: self.client.clone(),
-            access_policy: access_policy_for_capabilities(&self.capabilities),
-            filesystem_search: self.capabilities.filesystem_search,
-            filesystem_glob: self.capabilities.filesystem_glob,
-            filesystem_ranged_read: self.capabilities.filesystem_ranged_read,
+            writable: initialized
+                .capabilities
+                .filesystem
+                .as_ref()
+                .is_some_and(|filesystem| filesystem.write),
+            limits: initialized.limits.filesystem.clone(),
         }
     }
 
-    pub fn process_executor(&self) -> Option<RemoteProcessExecutor<T>> {
-        if !self.capabilities.process_start {
-            return None;
-        }
-        let process_id_prefix = NEXT_PROCESS_EXECUTOR_ID.fetch_add(1, Ordering::Relaxed);
+    /// Present when the daemon serves the `process` family.
+    pub fn process_executor(&self) -> Option<RemoteProcessExecutor> {
+        let initialized = self.initialize_response();
+        let process = initialized.capabilities.process.as_ref()?;
         Some(RemoteProcessExecutor {
             client: self.client.clone(),
-            process_id_prefix,
+            pty: process.pty,
+            max_read_bytes: initialized.limits.process.max_read_bytes,
+            max_wait_ms: initialized.limits.max_wait_ms,
+            process_id_prefix: NEXT_PROCESS_EXECUTOR_ID.fetch_add(1, Ordering::Relaxed),
             next_process_id: Arc::new(AtomicU64::new(1)),
         })
     }
 
-    pub fn job_executor(&self) -> Option<RemoteJobExecutor<T>> {
-        if !self.capabilities.job_start
-            && !self.capabilities.job_list
-            && !self.capabilities.job_read
-            && !self.capabilities.job_cancel
-        {
-            return None;
-        }
+    /// Present when the daemon serves the `job` family.
+    pub fn job_executor(&self) -> Option<RemoteJobExecutor> {
+        let initialized = self.initialize_response();
+        initialized.capabilities.job.as_ref()?;
         Some(RemoteJobExecutor {
             client: self.client.clone(),
-            capabilities: self.capabilities.clone(),
+            limits: initialized.limits.job.clone(),
         })
     }
 
@@ -155,6 +160,7 @@ where
         self,
         blobs: Arc<dyn BlobStore>,
     ) -> (FsToolContext, EnvironmentToolContext) {
+        let has_filesystem = self.initialize_response().capabilities.filesystem.is_some();
         let fs = Arc::new(self.file_system());
         let process = self
             .process_executor()
@@ -164,8 +170,8 @@ where
             .map(|executor| Arc::new(executor) as Arc<dyn JobExecutor>);
         let mut fs_ctx = FsToolContext::new(fs, blobs.clone());
         let mut env_ctx = EnvironmentToolContext::new(process, blobs);
-        if self.capabilities.filesystem_transfer {
-            env_ctx.transfer = Some(Arc::new(self.clone()));
+        if has_filesystem {
+            env_ctx.transfer = Some(Arc::new(self.client.clone()));
         }
         if let Some(jobs) = jobs {
             env_ctx = env_ctx.with_jobs(jobs);
@@ -174,46 +180,166 @@ where
             fs_ctx = fs_ctx.with_cwd(cwd.clone());
             env_ctx = env_ctx.with_process_cwd(cwd);
         }
-        // Filesystem tools are exposed only when the daemon negotiated read
-        // access; write access is enforced by the file system's access policy.
-        if self.capabilities.filesystem_read {
+        // Filesystem tools exist only when the daemon serves the filesystem
+        // family; write access follows its `write` fact through the file
+        // system's access policy.
+        if has_filesystem {
             env_ctx = env_ctx.with_filesystem(fs_ctx.clone());
         }
         (fs_ctx, env_ctx)
     }
 }
 
-#[derive(Clone)]
-pub struct RemoteEnvironmentFileSystem<T> {
-    client: Arc<AsyncMutex<EnvironmentDataClient<T>>>,
-    access_policy: FileAccessPolicy,
-    filesystem_search: bool,
-    filesystem_glob: bool,
-    filesystem_ranged_read: bool,
-}
-
 #[async_trait]
-impl<T> FileSystem for RemoteEnvironmentFileSystem<T>
-where
-    T: JsonRpcTransport + Send + 'static,
-{
-    fn access_policy(&self) -> FileAccessPolicy {
-        self.access_policy.clone()
+impl EnvironmentTransfer for DataClient {
+    fn transfer_ceilings(&self) -> TransferCeilings {
+        self.initialize_response().limits.filesystem.transfer
     }
 
-    async fn read_file(&self, path: &FsPath) -> FsResult<Vec<u8>> {
+    async fn begin(&self, params: &BeginTransferParams) -> Result<TransferStatus, ClientError> {
+        self.transfer_begin(params).await
+    }
+
+    async fn advance(
+        &self,
+        params: &TransferOperationParams,
+    ) -> Result<TransferStatus, ClientError> {
+        self.transfer_advance(params).await
+    }
+
+    async fn get_status(
+        &self,
+        params: &TransferOperationParams,
+    ) -> Result<TransferStatus, ClientError> {
+        self.transfer_get_status(params).await
+    }
+
+    async fn read_inventory(
+        &self,
+        params: &ReadTransferInventoryParams,
+    ) -> Result<ReadTransferInventoryResponse, ClientError> {
+        self.transfer_read_inventory(params).await
+    }
+
+    async fn append(
+        &self,
+        params: &AppendTransferInventoryParams,
+    ) -> Result<TransferStatus, ClientError> {
+        self.transfer_append(params).await
+    }
+
+    async fn list_missing(
+        &self,
+        params: &ListTransferMissingParams,
+    ) -> Result<ListTransferMissingResponse, ClientError> {
+        self.transfer_list_missing(params).await
+    }
+
+    async fn read(
+        &self,
+        params: &ReadTransferContentParams,
+    ) -> Result<ReadTransferContentResponse, ClientError> {
+        self.transfer_read(params).await
+    }
+
+    async fn write(
+        &self,
+        params: &WriteTransferContentParams,
+    ) -> Result<WriteTransferContentResponse, ClientError> {
+        self.transfer_write(params).await
+    }
+
+    async fn commit(
+        &self,
+        params: &TransferOperationParams,
+    ) -> Result<TransferStatus, ClientError> {
+        self.transfer_commit(params).await
+    }
+
+    async fn abort(&self, params: &TransferOperationParams) -> Result<TransferStatus, ClientError> {
+        self.transfer_abort(params).await
+    }
+}
+
+/// The environment filesystem over `fs/*`. Every bound comes from the
+/// daemon's advertised ceilings: a read longer than one `fs/readFile` is
+/// refused rather than returned short, and writes are staged and atomic.
+#[derive(Clone)]
+pub struct RemoteEnvironmentFileSystem {
+    client: DataClient,
+    writable: bool,
+    limits: FilesystemLimits,
+}
+
+impl RemoteEnvironmentFileSystem {
+    async fn read_whole(&self, path: &FsPath) -> FsResult<VersionedRead> {
         let response = self
             .client
-            .lock()
-            .await
-            .read_file(&remote_fs::ReadFileParams {
+            .read_file(&ReadFileParams {
                 path: environment_path(path)?,
-                offset: None,
-                max_bytes: None,
+                offset: 0,
+                max_bytes: self.limits.max_read_file_bytes,
             })
             .await
             .map_err(|error| map_fs_error(error, path))?;
-        Ok(response.data.into_inner())
+        if response.truncated {
+            return Err(FsError::InvalidInput {
+                message: format!(
+                    "{path} is {} bytes; the environment returns at most {} bytes per read",
+                    response.file_size, self.limits.max_read_file_bytes
+                ),
+            });
+        }
+        Ok(VersionedRead {
+            bytes: response.data.into_inner(),
+            version: Some(FsVersion::new(response.version.as_str())),
+        })
+    }
+
+    async fn metadata(&self, path: &FsPath, follow_symlinks: bool) -> FsResult<FileKindFacts> {
+        let metadata = self
+            .client
+            .get_metadata(&GetMetadataParams {
+                path: environment_path(path)?,
+                follow_symlinks,
+            })
+            .await
+            .map_err(|error| map_fs_error(error, path))?
+            .metadata;
+        Ok(FileKindFacts {
+            kind: metadata.kind,
+            created_at_ms: metadata.created_at_ms.unwrap_or(0),
+            modified_at_ms: metadata.modified_at_ms,
+        })
+    }
+}
+
+struct FileKindFacts {
+    kind: FileKind,
+    created_at_ms: i64,
+    modified_at_ms: i64,
+}
+
+#[async_trait]
+impl FileSystem for RemoteEnvironmentFileSystem {
+    fn access_policy(&self) -> FileAccessPolicy {
+        if self.writable {
+            FileAccessPolicy::FullReadWrite
+        } else {
+            FileAccessPolicy::FullReadOnly
+        }
+    }
+
+    async fn read_file(&self, path: &FsPath) -> FsResult<Vec<u8>> {
+        Ok(self.read_whole(path).await?.bytes)
+    }
+
+    async fn read_file_versioned(&self, path: &FsPath) -> FsResult<VersionedRead> {
+        self.read_whole(path).await
+    }
+
+    fn max_read_bytes(&self) -> Option<u64> {
+        Some(self.limits.max_read_file_bytes)
     }
 
     async fn read_file_range(
@@ -222,39 +348,60 @@ where
         offset: u64,
         max_bytes: Option<u64>,
     ) -> FsResult<FsRangedRead> {
-        if !self.filesystem_ranged_read {
-            let bytes = self.read_file(path).await?;
-            return Ok(ranged_read_from_full(bytes, offset, max_bytes));
-        }
+        let ceiling = self.limits.max_read_file_bytes;
         let response = self
             .client
-            .lock()
-            .await
-            .read_file(&remote_fs::ReadFileParams {
+            .read_file(&ReadFileParams {
                 path: environment_path(path)?,
-                offset: Some(offset),
-                max_bytes,
+                offset,
+                max_bytes: max_bytes.map_or(ceiling, |max| max.min(ceiling)),
             })
             .await
             .map_err(|error| map_fs_error(error, path))?;
-        let bytes = response.data.into_inner();
-        let file_size = response
-            .file_size
-            .unwrap_or_else(|| offset.saturating_add(bytes.len() as u64));
         Ok(FsRangedRead {
-            file_size,
+            file_size: response.file_size,
             truncated: response.truncated,
-            bytes,
+            bytes: response.data.into_inner(),
         })
     }
 
     async fn write_file(&self, path: &FsPath, contents: Vec<u8>) -> FsResult<()> {
-        self.client
-            .lock()
+        self.write_file_with(path, contents, WriteOptions::default())
             .await
-            .write_file(&remote_fs::WriteFileParams {
+    }
+
+    async fn write_file_with(
+        &self,
+        path: &FsPath,
+        contents: Vec<u8>,
+        options: WriteOptions,
+    ) -> FsResult<()> {
+        if contents.len() as u64 > self.limits.max_write_file_bytes {
+            return Err(FsError::InvalidInput {
+                message: format!(
+                    "{} bytes exceed the environment's {}-byte inline write limit; write larger files from a content_ref",
+                    contents.len(),
+                    self.limits.max_write_file_bytes
+                ),
+            });
+        }
+        let if_match = options
+            .if_match
+            .map(|version| {
+                environment_protocol::data::fs::FileVersion::new(version.as_str()).map_err(
+                    |error| FsError::InvalidInput {
+                        message: error.to_string(),
+                    },
+                )
+            })
+            .transpose()?;
+        self.client
+            .write_file(&WriteFileParams {
                 path: environment_path(path)?,
                 data: ByteChunk::from(contents),
+                create: WriteCondition::Always,
+                if_match,
+                executable: false,
             })
             .await
             .map_err(|error| map_fs_error(error, path))?;
@@ -267,11 +414,9 @@ where
         options: CreateDirectoryOptions,
     ) -> FsResult<()> {
         self.client
-            .lock()
-            .await
-            .create_directory(&remote_fs::CreateDirectoryParams {
+            .create_directory(&CreateDirectoryParams {
                 path: environment_path(path)?,
-                recursive: Some(options.recursive),
+                recursive: options.recursive,
             })
             .await
             .map_err(|error| map_fs_error(error, path))?;
@@ -279,75 +424,81 @@ where
     }
 
     async fn get_metadata(&self, path: &FsPath) -> FsResult<FileMetadata> {
-        let response = self
-            .client
-            .lock()
-            .await
-            .get_metadata(&remote_fs::GetMetadataParams {
-                path: environment_path(path)?,
-            })
-            .await
-            .map_err(|error| map_fs_error(error, path))?;
+        let own = self.metadata(path, false).await?;
+        let is_symlink = own.kind == FileKind::Symlink;
+        let target = if is_symlink {
+            self.metadata(path, true).await?
+        } else {
+            own
+        };
         Ok(FileMetadata {
-            is_directory: response.is_directory,
-            is_file: response.is_file,
-            is_symlink: response.is_symlink,
-            created_at_ms: response.created_at_ms,
-            modified_at_ms: response.modified_at_ms,
+            is_directory: target.kind == FileKind::Directory,
+            is_file: target.kind == FileKind::File,
+            is_symlink,
+            created_at_ms: target.created_at_ms,
+            modified_at_ms: target.modified_at_ms,
         })
     }
 
     async fn read_directory(&self, path: &FsPath) -> FsResult<Vec<ReadDirectoryEntry>> {
-        let response = self
-            .client
-            .lock()
-            .await
-            .read_directory(&remote_fs::ReadDirectoryParams {
-                path: environment_path(path)?,
-            })
-            .await
-            .map_err(|error| map_fs_error(error, path))?;
-        Ok(response
-            .entries
-            .into_iter()
-            .map(|entry| ReadDirectoryEntry {
-                file_name: entry.file_name,
-                is_directory: entry.is_directory,
-                is_file: entry.is_file,
-            })
-            .collect())
+        let directory = environment_path(path)?;
+        let mut entries = Vec::new();
+        let mut cursor = None;
+        loop {
+            let page = self
+                .client
+                .read_directory(&ReadDirectoryParams {
+                    path: directory.clone(),
+                    limit: self.limits.max_directory_entries,
+                    cursor,
+                })
+                .await
+                .map_err(|error| map_fs_error(error, path))?;
+            entries.extend(page.entries.into_iter().map(|entry| ReadDirectoryEntry {
+                file_name: entry.name.as_str().to_owned(),
+                is_directory: entry.metadata.kind == FileKind::Directory,
+                is_file: entry.metadata.kind == FileKind::File,
+            }));
+            match page.next_cursor {
+                Some(next) => cursor = Some(next),
+                None => break,
+            }
+        }
+        Ok(entries)
     }
 
     async fn remove(&self, path: &FsPath, options: RemoveOptions) -> FsResult<()> {
         self.client
-            .lock()
-            .await
-            .remove(&remote_fs::RemoveParams {
+            .remove(&RemoveParams {
                 path: environment_path(path)?,
-                recursive: Some(options.recursive),
-                force: Some(options.force),
+                recursive: options.recursive,
+                force: options.force,
             })
             .await
             .map_err(|error| map_fs_error(error, path))?;
         Ok(())
     }
 
-    async fn copy(
+    async fn rename(
         &self,
         source_path: &FsPath,
         destination_path: &FsPath,
-        options: CopyOptions,
+        options: RenameOptions,
     ) -> FsResult<()> {
         self.client
-            .lock()
-            .await
-            .copy(&remote_fs::CopyParams {
-                source_path: environment_path(source_path)?,
-                destination_path: environment_path(destination_path)?,
-                recursive: options.recursive,
+            .rename(&RenameParams {
+                source: environment_path(source_path)?,
+                destination: environment_path(destination_path)?,
+                overwrite: options.overwrite,
+                if_match: None,
             })
             .await
-            .map_err(|error| map_fs_error(error, destination_path))?;
+            .map_err(|error| match error.protocol_kind() {
+                Some(ProtocolErrorKind::AlreadyExists) => FsError::AlreadyExists {
+                    path: destination_path.clone(),
+                },
+                _ => map_fs_error(error, source_path),
+            })?;
         Ok(())
     }
 
@@ -355,75 +506,92 @@ where
         &self,
         request: &FsTextSearchRequest,
     ) -> FsResult<Option<FsTextSearchResponse>> {
-        if !self.filesystem_search {
-            return Ok(None);
-        }
-        let params = remote_fs::SearchTextParams {
+        let ceilings = self.limits.search;
+        let mut params = SearchTextParams {
             root: environment_path(&request.root)?,
             pattern: request.pattern.clone(),
-            include: request.include.clone(),
-            case_sensitive: request.case_sensitive,
-            max_depth: request
-                .max_depth
-                .map(|depth| u32::try_from(depth).unwrap_or(u32::MAX)),
-            limits: remote_fs::SearchTextLimits {
-                max_matches: request.limits.max_matches,
-                max_files: request.limits.max_files,
-                max_bytes: request.limits.max_bytes,
-                max_duration_ms: request.limits.max_duration_ms,
+            pattern_ignore_case: !request.case_sensitive,
+            filter: TreeFilter {
+                include: request.include.iter().cloned().collect(),
+                max_depth: request.max_depth.map(depth),
+                ..TreeFilter::default()
+            },
+            limits: SearchTextLimits {
+                max_matches: count(request.limits.max_matches, ceilings.max_matches),
+                max_files: count(request.limits.max_files, ceilings.max_files),
+                max_bytes: request.limits.max_bytes.min(ceilings.max_bytes),
+                max_duration_ms: request.limits.max_duration_ms.min(ceilings.max_duration_ms),
+                max_line_bytes: ceilings.max_line_bytes,
             },
         };
-        let response = self
-            .client
-            .lock()
-            .await
-            .search_text(&params)
-            .await
-            .map_err(|error| map_fs_error(error, &request.root))?;
+        let response = match self.client.search_text(&params).await {
+            Ok(response) => response,
+            // `fs/searchText` walks directories; a file root searches that
+            // one file, as the generic fallback does: its parent, limited to
+            // the file's own name.
+            Err(error) if is_not_directory(&error) => {
+                let Some(file_root) = file_root_search(request)? else {
+                    return Ok(Some(FsTextSearchResponse {
+                        matches: Vec::new(),
+                        files_searched: 0,
+                        bytes_searched: 0,
+                        skipped_files: 0,
+                        stopped: None,
+                    }));
+                };
+                params.root = file_root.parent;
+                params.filter = file_root.filter;
+                self.client
+                    .search_text(&params)
+                    .await
+                    .map_err(|error| map_fs_error(error, &request.root))?
+            }
+            Err(error) => return Err(map_fs_error(error, &request.root)),
+        };
         let matches = response
             .matches
             .into_iter()
             .map(|item| {
                 Ok(FsTextSearchMatch {
                     path: FsPath::new(item.path.as_str()).map_err(FsError::from)?,
-                    line_number: item.line_number,
+                    line_number: u64::from(item.line_number),
                     line: item.line,
+                    line_truncated: item.line_truncated,
                 })
             })
             .collect::<FsResult<Vec<_>>>()?;
         Ok(Some(FsTextSearchResponse {
             matches,
-            files_searched: response.files_searched,
-            bytes_searched: response.bytes_searched,
+            files_searched: u64::from(response.searched_file_count),
+            bytes_searched: response.searched_bytes,
+            skipped_files: u64::from(response.skipped_file_count),
             stopped: response.stopped.map(|stop| match stop {
-                remote_fs::SearchTextStop::MatchLimit => FsSearchStop::MatchLimit,
-                remote_fs::SearchTextStop::FileLimit => FsSearchStop::FileLimit,
-                remote_fs::SearchTextStop::ByteLimit => FsSearchStop::ByteLimit,
-                remote_fs::SearchTextStop::TimeLimit => FsSearchStop::TimeLimit,
+                SearchTextStop::MatchLimit => FsSearchStop::MatchLimit,
+                SearchTextStop::FileLimit => FsSearchStop::FileLimit,
+                SearchTextStop::ByteLimit => FsSearchStop::ByteLimit,
+                SearchTextStop::TimeLimit => FsSearchStop::TimeLimit,
+                SearchTextStop::ResponseLimit => FsSearchStop::ResponseLimit,
             }),
         }))
     }
 
     async fn glob_files(&self, request: &FsGlobRequest) -> FsResult<Option<FsGlobResponse>> {
-        if !self.filesystem_glob {
-            return Ok(None);
-        }
-        let params = remote_fs::GlobFilesParams {
+        let ceilings = self.limits.glob;
+        let params = GlobFilesParams {
             root: environment_path(&request.root)?,
-            pattern: request.pattern.clone(),
-            max_depth: request
-                .max_depth
-                .map(|depth| u32::try_from(depth).unwrap_or(u32::MAX)),
-            limits: remote_fs::GlobFilesLimits {
-                max_matches: request.limits.max_matches,
-                max_entries: request.limits.max_entries,
-                max_duration_ms: request.limits.max_duration_ms,
+            filter: TreeFilter {
+                include: vec![request.pattern.clone()],
+                max_depth: request.max_depth.map(depth),
+                ..TreeFilter::default()
+            },
+            limits: GlobFilesLimits {
+                max_matches: count(request.limits.max_matches, ceilings.max_matches),
+                max_files: count(request.limits.max_entries, ceilings.max_files),
+                max_duration_ms: request.limits.max_duration_ms.min(ceilings.max_duration_ms),
             },
         };
         let response = self
             .client
-            .lock()
-            .await
             .glob_files(&params)
             .await
             .map_err(|error| map_fs_error(error, &request.root))?;
@@ -434,38 +602,96 @@ where
             .collect::<FsResult<Vec<_>>>()?;
         Ok(Some(FsGlobResponse {
             matches,
-            entries_visited: response.entries_visited,
+            entries_visited: u64::from(response.visited_file_count),
             stopped: response.stopped.map(|stop| match stop {
-                remote_fs::GlobFilesStop::MatchLimit => FsSearchStop::MatchLimit,
-                remote_fs::GlobFilesStop::EntryLimit => FsSearchStop::FileLimit,
-                remote_fs::GlobFilesStop::TimeLimit => FsSearchStop::TimeLimit,
+                GlobFilesStop::MatchLimit => FsSearchStop::MatchLimit,
+                GlobFilesStop::FileLimit => FsSearchStop::FileLimit,
+                GlobFilesStop::TimeLimit => FsSearchStop::TimeLimit,
+                GlobFilesStop::ResponseLimit => FsSearchStop::ResponseLimit,
             }),
         }))
     }
 }
 
+fn is_not_directory(error: &ClientError) -> bool {
+    matches!(
+        error.protocol_error().map(|error| &error.data),
+        Some(ErrorData::FailedPrecondition {
+            reason: PreconditionReason::NotDirectory
+        })
+    )
+}
+
+/// A text search rooted at a file, as a search of its parent.
+struct FileRootSearch {
+    parent: EnvironmentPath,
+    filter: TreeFilter,
+}
+
+/// The parent walk that searches only `request.root`, or `None` when the
+/// request's include does not select the file (nothing to search).
+fn file_root_search(request: &FsTextSearchRequest) -> FsResult<Option<FileRootSearch>> {
+    let invalid = || FsError::InvalidInput {
+        message: format!("{} is neither a directory nor a file", request.root),
+    };
+    let name = request.root.file_name().ok_or_else(invalid)?;
+    let parent = request.root.parent().ok_or_else(invalid)?;
+    if let Some(include) = request.include.as_deref() {
+        let pattern = crate::fs::pattern::PathPattern::new(include, false).map_err(|error| {
+            FsError::InvalidInput {
+                message: error.to_string(),
+            }
+        })?;
+        if !pattern.matches(name, false) {
+            return Ok(None);
+        }
+    }
+    Ok(Some(FileRootSearch {
+        parent: environment_path(&parent)?,
+        filter: TreeFilter {
+            include: vec![format!("/{}", globset::escape(name))],
+            max_depth: Some(1),
+            include_hidden: true,
+            include_ignored: true,
+            ..TreeFilter::default()
+        },
+    }))
+}
+
+fn count(requested: u64, ceiling: u32) -> u32 {
+    u32::try_from(requested).unwrap_or(u32::MAX).min(ceiling)
+}
+
+fn depth(depth: usize) -> u32 {
+    u32::try_from(depth).unwrap_or(u32::MAX)
+}
+
 /// Process executor over the data plane. It keeps no per-handle state: the
 /// daemon owns the read cursor, so a handle continued from a later batch or
 /// connection reads only what was not delivered yet.
 #[derive(Clone)]
-pub struct RemoteProcessExecutor<T> {
-    client: Arc<AsyncMutex<EnvironmentDataClient<T>>>,
+pub struct RemoteProcessExecutor {
+    client: DataClient,
+    pty: bool,
+    max_read_bytes: u64,
+    max_wait_ms: u64,
     process_id_prefix: u64,
     next_process_id: Arc<AtomicU64>,
 }
 
 #[async_trait]
-impl<T> ProcessExecutor for RemoteProcessExecutor<T>
-where
-    T: JsonRpcTransport + Send + 'static,
-{
+impl ProcessExecutor for RemoteProcessExecutor {
     async fn run_process(&self, request: ProcessRequest) -> ProcessExecResult<ProcessOutput> {
+        if request.tty && !self.pty {
+            return Err(ProcessError::Unsupported {
+                message: "this environment cannot run commands under a PTY (tty: true)".to_owned(),
+            });
+        }
         let process_id = self.next_process_id();
-        let response = {
-            let mut client = self.client.lock().await;
-            client
-                .start_process(&remote_process::StartProcessParams {
-                    process_id: process_id.clone(),
+        self.client
+            .start_process(&StartProcessParams {
+                process_id: process_id.clone(),
+                command: CommandSpec {
                     argv: request.argv,
                     cwd: request
                         .cwd
@@ -474,23 +700,26 @@ where
                         .transpose()?,
                     env: request.env,
                     secret_env: request.secret_env,
-                    stdin: request.stdin.map(ByteChunk::from),
+                    input: match request.stdin {
+                        Some(stdin) => ExecInput::Bytes {
+                            data: ByteChunk::from(stdin),
+                        },
+                        None => ExecInput::None {},
+                    },
                     timeout_ms: request.timeout_ms,
-                    tty: request.tty,
-                })
-                .await
-                .map_err(map_process_error)?;
-            client
-                .read_process(&remote_process::ReadProcessParams {
-                    process_id: process_id.clone(),
-                    after_seq: None,
-                    max_bytes: request.max_output_bytes.map(|value| value as usize),
-                    wait_ms: request.yield_ms,
-                })
-                .await
-                .map_err(map_process_error)?
-        };
-        Ok(output_from_read(process_id, response))
+                },
+                pty: request.tty.then_some(DEFAULT_PTY_SIZE),
+            })
+            .await
+            .map_err(map_process_error)?;
+        let handle = ProcessHandle::new(process_id.as_str());
+        self.read_output(
+            &handle,
+            &process_id,
+            request.yield_ms,
+            request.max_output_bytes,
+        )
+        .await
     }
 
     async fn continue_process(
@@ -498,64 +727,43 @@ where
         request: ContinueProcessRequest,
     ) -> ProcessExecResult<ProcessOutput> {
         let handle = request.handle;
-        let process_id = ProcessId::new(handle.as_str().to_owned());
-        let input = request.input.filter(|input| !input.is_empty());
-        let response = {
-            let mut client = self.client.lock().await;
-            if let Some(signal) = request.signal {
-                client
-                    .terminate_process(&remote_process::TerminateProcessParams {
-                        process_id: process_id.clone(),
-                        signal: match signal {
-                            ProcessSignal::Interrupt => remote_process::ProcessSignal::Interrupt,
-                            ProcessSignal::Kill => remote_process::ProcessSignal::Kill,
-                        },
-                    })
-                    .await
-                    .map_err(map_process_error)?;
-            } else if input.is_some() || request.close_stdin {
-                let write = client
-                    .write_process(&remote_process::WriteProcessParams {
-                        process_id: process_id.clone(),
-                        chunk: input.map(ByteChunk::from),
-                        close_stdin: request.close_stdin,
-                    })
-                    .await
-                    .map_err(map_process_error)?;
-                match write.status {
-                    WriteProcessStatus::Accepted | WriteProcessStatus::Starting => {}
-                    WriteProcessStatus::UnknownProcess => {
-                        return Err(ProcessError::UnknownHandle { handle });
-                    }
-                    WriteProcessStatus::StdinClosed => {
-                        return Err(ProcessError::StdinClosed { handle });
-                    }
-                }
-            }
-            client
-                .read_process(&remote_process::ReadProcessParams {
+        let process_id =
+            ProcessId::new(handle.as_str()).map_err(|_| ProcessError::UnknownHandle {
+                handle: handle.clone(),
+            })?;
+        if let Some(signal) = request.signal {
+            self.client
+                .terminate_process(&TerminateProcessParams {
                     process_id: process_id.clone(),
-                    after_seq: None,
-                    max_bytes: request.max_output_bytes.map(|value| value as usize),
-                    wait_ms: request.wait_ms,
+                    signal: match signal {
+                        ProcessSignal::Interrupt => {
+                            environment_protocol::data::process::ProcessSignal::Interrupt
+                        }
+                        ProcessSignal::Kill => {
+                            environment_protocol::data::process::ProcessSignal::Kill
+                        }
+                    },
                 })
                 .await
-                .map_err(|error| match error {
-                    EnvironmentClientError::Protocol(error)
-                        if error.code == EnvironmentProtocolErrorCode::NotFound =>
-                    {
-                        ProcessError::UnknownHandle {
-                            handle: handle.clone(),
-                        }
-                    }
-                    other => map_process_error(other),
-                })?
-        };
-        Ok(output_from_read(process_id, response))
+                .map_err(|error| map_handle_error(error, &handle))?;
+        } else {
+            let input = request.input.unwrap_or_default();
+            if !input.is_empty() || request.close_stdin {
+                self.write_input(&handle, &process_id, input, request.close_stdin)
+                    .await?;
+            }
+        }
+        self.read_output(
+            &handle,
+            &process_id,
+            request.wait_ms,
+            request.max_output_bytes,
+        )
+        .await
     }
 }
 
-impl<T> RemoteProcessExecutor<T> {
+impl RemoteProcessExecutor {
     fn next_process_id(&self) -> ProcessId {
         let id = self.next_process_id.fetch_add(1, Ordering::Relaxed);
         ProcessId::new(format!(
@@ -563,117 +771,311 @@ impl<T> RemoteProcessExecutor<T> {
             PROCESS_ID_NONCE.as_str(),
             self.process_id_prefix
         ))
+        .expect("generated process ids fit the id grammar")
+    }
+
+    /// Queue `input` for the process, resending what a full input queue did
+    /// not accept, then close the input when asked.
+    async fn write_input(
+        &self,
+        handle: &ProcessHandle,
+        process_id: &ProcessId,
+        input: Vec<u8>,
+        close_input: bool,
+    ) -> ProcessExecResult<()> {
+        let started = Instant::now();
+        let mut offset = 0usize;
+        loop {
+            let rest = &input[offset..];
+            let accepted = self
+                .client
+                .write_process(&WriteProcessParams {
+                    process_id: process_id.clone(),
+                    data: ByteChunk::from(rest),
+                    close_input,
+                })
+                .await
+                .map_err(|error| map_handle_error(error, handle))?
+                .accepted_bytes;
+            offset += usize::try_from(accepted)
+                .unwrap_or(usize::MAX)
+                .min(rest.len());
+            if offset >= input.len() {
+                return Ok(());
+            }
+            if started.elapsed() >= INPUT_RETRY_WINDOW {
+                return Err(ProcessError::Failed {
+                    message: format!(
+                        "process {handle} accepted {offset} of {} input bytes; it is not reading its input",
+                        input.len()
+                    ),
+                });
+            }
+            tokio::time::sleep(Duration::from_millis(50)).await;
+        }
+    }
+
+    /// Read until the process exits and its output settles, or until
+    /// `wait_ms` elapses. A finished command whose output exceeds the budget
+    /// shows its head and tail with the omitted count in between; a running
+    /// one keeps the rest behind the daemon cursor for the next call.
+    async fn read_output(
+        &self,
+        handle: &ProcessHandle,
+        process_id: &ProcessId,
+        wait_ms: Option<u64>,
+        max_output_bytes: Option<u64>,
+    ) -> ProcessExecResult<ProcessOutput> {
+        let budget = max_output_bytes
+            .unwrap_or(DEFAULT_PROCESS_OUTPUT_BYTES)
+            .max(1);
+        let deadline = wait_ms.map(|wait| Instant::now() + Duration::from_millis(wait));
+        let mut pages = Vec::new();
+        let mut collected = 0u64;
+        let mut settled = false;
+        let last = loop {
+            // Once the exit has settled, further pages only drain output.
+            let wait = match deadline {
+                _ if settled => 0,
+                Some(deadline) => deadline
+                    .saturating_duration_since(Instant::now())
+                    .as_millis() as u64,
+                None => self.max_wait_ms,
+            }
+            .min(self.max_wait_ms);
+            let response = self
+                .read_page(
+                    handle,
+                    ReadProcessParams {
+                        process_id: process_id.clone(),
+                        after: None,
+                        tail_bytes: None,
+                        ack: None,
+                        max_bytes: (budget - collected).min(self.max_read_bytes),
+                        wait_ms: wait,
+                        return_on: ReturnOn::Exit,
+                    },
+                )
+                .await?;
+            settled = response.state == ExecState::Exited;
+            collected += page_bytes(&response.output);
+            pages.push(response.output.clone());
+            let more_output = response.output.next < response.output.end;
+            let out_of_time = deadline.is_some_and(|deadline| Instant::now() >= deadline);
+            match response.state {
+                ExecState::Exited if !more_output => break response,
+                ExecState::Exited if collected >= budget => {
+                    let tail_bytes = budget / 2;
+                    let tail = self
+                        .read_page(
+                            handle,
+                            ReadProcessParams {
+                                process_id: process_id.clone(),
+                                after: None,
+                                tail_bytes: Some(tail_bytes),
+                                ack: None,
+                                max_bytes: tail_bytes.min(self.max_read_bytes),
+                                wait_ms: 0,
+                                return_on: ReturnOn::AnyOutput,
+                            },
+                        )
+                        .await?;
+                    pages.push(tail.output.clone());
+                    break tail;
+                }
+                // The page ended before the budget (its chunk limit): read on.
+                ExecState::Exited => continue,
+                ExecState::Running if collected >= budget || out_of_time => break response,
+                ExecState::Running => continue,
+            }
+        };
+        Ok(output_from_read(handle, budget, pages, last))
+    }
+
+    async fn read_page(
+        &self,
+        handle: &ProcessHandle,
+        params: ReadProcessParams,
+    ) -> ProcessExecResult<ReadProcessResponse> {
+        self.client
+            .read_process(&params)
+            .await
+            .map_err(|error| map_handle_error(error, handle))
     }
 }
 
-fn output_from_read(process_id: ProcessId, response: ReadProcessResponse) -> ProcessOutput {
-    let (stdout, stderr) = split_output(response.chunks, response.omitted_bytes);
-    let status = match response.termination {
-        Some(ProcessTermination::TimedOut) => ProcessStatus::TimedOut,
-        Some(ProcessTermination::Killed) => ProcessStatus::Killed,
-        None if response.failure.is_some() => ProcessStatus::Failed,
-        None if response.exited => match response.exit_code {
-            Some(0) => ProcessStatus::Succeeded,
-            _ => ProcessStatus::Failed,
-        },
-        None => ProcessStatus::Running,
-    };
-    let handle = if response.closed || response.exited {
-        None
+fn page_bytes(page: &OutputPage) -> u64 {
+    page.chunks
+        .iter()
+        .map(|chunk| chunk.data.len() as u64)
+        .sum()
+}
+
+/// Shape the pages of one call into the model-facing output. The last page
+/// may be a tail read; earlier pages are consecutive cursor reads.
+fn output_from_read(
+    handle: &ProcessHandle,
+    budget: u64,
+    mut pages: Vec<OutputPage>,
+    last: ReadProcessResponse,
+) -> ProcessOutput {
+    let exited = last.state == ExecState::Exited;
+    let tail = (pages.len() > 1 && exited && last.output.next == last.output.end)
+        .then(|| pages.pop())
+        .flatten();
+    let head = merge_pages(pages);
+    let shown = match tail {
+        Some(tail) if tail.end > head.next => ShownOutput::from_pages(head, Some(tail)),
+        Some(tail) => ShownOutput::from_pages(merge_pages(vec![head, tail]), None),
+        None => ShownOutput::from_pages(head, None),
+    }
+    .trim_to(budget);
+    let (stdout, stderr) = split_output(&shown);
+    let (status, exit_code, failure) = if !exited {
+        (ProcessStatus::Running, None, None)
     } else {
-        Some(ProcessHandle::new(process_id.0))
+        match (&last.stopped_by, &last.exit, &last.error) {
+            (Some(StoppedBy::Timeout), exit, _) => (ProcessStatus::TimedOut, exit_code(exit), None),
+            (Some(StoppedBy::Kill | StoppedBy::Terminate), exit, _) => {
+                (ProcessStatus::Killed, exit_code(exit), None)
+            }
+            (None, _, Some(error)) => (ProcessStatus::Failed, None, Some(error.to_string())),
+            (None, Some(ExitStatus::Code { code: 0 }), None) => {
+                (ProcessStatus::Succeeded, Some(0), None)
+            }
+            (None, Some(ExitStatus::Code { code }), None) => {
+                (ProcessStatus::Failed, Some(*code), None)
+            }
+            (
+                None,
+                Some(ExitStatus::Signal {
+                    signal,
+                    core_dumped,
+                }),
+                None,
+            ) => (
+                ProcessStatus::Failed,
+                None,
+                Some(format!(
+                    "killed by {signal}{}",
+                    if *core_dumped { " (core dumped)" } else { "" }
+                )),
+            ),
+            (None, None, None) => (
+                ProcessStatus::Failed,
+                None,
+                Some("the environment reported no exit status".to_owned()),
+            ),
+        }
     };
     ProcessOutput {
         status,
-        handle,
-        pid: response.pid,
-        exit_code: response.exit_code,
-        failure: response.failure,
+        handle: (!exited).then(|| handle.clone()),
+        pid: Some(last.pid),
+        exit_code,
+        failure,
         stdout,
         stderr,
-        omitted_bytes: response.omitted_bytes,
-        leftover_processes: response
-            .leftover_processes
-            .into_iter()
-            .map(|member| LeftoverProcess {
-                pid: member.pid,
-                command: member.command,
+        omitted_bytes: shown.omitted_bytes(),
+        leftover_processes: last
+            .leftovers
+            .map(|report| {
+                report
+                    .processes
+                    .into_iter()
+                    .map(|member| LeftoverProcess {
+                        pid: member.pid,
+                        command: member.command.unwrap_or_default(),
+                    })
+                    .collect()
             })
-            .collect(),
+            .unwrap_or_default(),
+    }
+}
+
+fn exit_code(exit: &Option<ExitStatus>) -> Option<i32> {
+    match exit {
+        Some(ExitStatus::Code { code }) => Some(*code),
+        _ => None,
+    }
+}
+
+/// Consecutive pages as one: chunks and gaps in order, the last page's
+/// position.
+fn merge_pages(pages: Vec<OutputPage>) -> OutputPage {
+    let mut merged = OutputPage::default();
+    for page in pages {
+        merged.chunks.extend(page.chunks);
+        merged.gaps.extend(page.gaps);
+        merged.next = merged.next.max(page.next);
+        merged.end = merged.end.max(page.end);
+    }
+    merged
+}
+
+/// Sorts chunks into their streams. The omission marker goes where output
+/// was left out: before the first chunk after the omitted range, or at the
+/// end of standard output when nothing follows it.
+fn split_output(shown: &ShownOutput) -> (StreamOutput, StreamOutput) {
+    let mut stdout = StreamOutput::default();
+    let mut stderr = StreamOutput::default();
+    for chunk in &shown.head {
+        let stream = if is_stderr(chunk.stream) {
+            &mut stderr
+        } else {
+            &mut stdout
+        };
+        stream.bytes.extend_from_slice(chunk.data.as_slice());
     }
+    if shown.omitted.is_some() {
+        let stream = match shown.tail.first() {
+            Some(chunk) if is_stderr(chunk.stream) => &mut stderr,
+            _ => &mut stdout,
+        };
+        stream.omitted_at = Some(stream.bytes.len());
+    }
+    for chunk in &shown.tail {
+        let stream = if is_stderr(chunk.stream) {
+            &mut stderr
+        } else {
+            &mut stdout
+        };
+        stream.bytes.extend_from_slice(chunk.data.as_slice());
+    }
+    (stdout, stderr)
 }
 
 #[derive(Clone)]
-pub struct RemoteJobExecutor<T> {
-    client: Arc<AsyncMutex<EnvironmentDataClient<T>>>,
-    capabilities: EnvironmentCapabilities,
+pub struct RemoteJobExecutor {
+    client: DataClient,
+    limits: JobLimits,
 }
 
 #[async_trait]
-impl<T> JobExecutor for RemoteJobExecutor<T>
-where
-    T: JsonRpcTransport + Send + 'static,
-{
-    async fn start_jobs(
-        &self,
-        request: remote_jobs::StartJobsParams,
-    ) -> JobExecResult<remote_jobs::StartJobsResponse> {
-        if !self.capabilities.job_start {
-            return Err(JobError::Unsupported {
-                message: "provider target does not support job/start".to_owned(),
-            });
-        }
+impl JobExecutor for RemoteJobExecutor {
+    fn limits(&self) -> Option<JobLimits> {
+        Some(self.limits.clone())
+    }
+
+    async fn start_jobs(&self, request: StartJobsParams) -> JobExecResult<StartJobsResponse> {
         self.client
-            .lock()
-            .await
             .start_jobs(&request)
             .await
             .map_err(map_job_error)
     }
 
-    async fn read_jobs(
-        &self,
-        request: remote_jobs::ReadJobsParams,
-    ) -> JobExecResult<remote_jobs::ReadJobsResponse> {
-        if !self.capabilities.job_read {
-            return Err(JobError::Unsupported {
-                message: "provider target does not support job/read".to_owned(),
-            });
-        }
-        self.client
-            .lock()
-            .await
-            .read_jobs(&request)
-            .await
-            .map_err(map_job_error)
+    async fn read_jobs(&self, request: ReadJobsParams) -> JobExecResult<ReadJobsResponse> {
+        self.client.read_jobs(&request).await.map_err(map_job_error)
     }
 
-    async fn cancel_jobs(
-        &self,
-        request: remote_jobs::CancelJobsParams,
-    ) -> JobExecResult<remote_jobs::CancelJobsResponse> {
-        if !self.capabilities.job_cancel {
-            return Err(JobError::Unsupported {
-                message: "provider target does not support job/cancel".to_owned(),
-            });
-        }
+    async fn cancel_jobs(&self, request: CancelJobsParams) -> JobExecResult<CancelJobsResponse> {
         self.client
-            .lock()
-            .await
             .cancel_jobs(&request)
             .await
             .map_err(map_job_error)
     }
 }
 
-fn access_policy_for_capabilities(capabilities: &EnvironmentCapabilities) -> FileAccessPolicy {
-    if capabilities.filesystem_write {
-        FileAccessPolicy::FullReadWrite
-    } else {
-        FileAccessPolicy::FullReadOnly
-    }
-}
-
 fn environment_path(path: &FsPath) -> Result<EnvironmentPath, FsError> {
     EnvironmentPath::new(path.as_str()).map_err(|error| FsError::InvalidInput {
         message: error.to_string(),
@@ -686,279 +1088,317 @@ fn process_environment_path(path: &FsPath) -> Result<EnvironmentPath, ProcessErr
     })
 }
 
-fn map_fs_error(error: EnvironmentClientError, path: &FsPath) -> FsError {
-    match error {
-        EnvironmentClientError::Protocol(error) => match error.code {
-            EnvironmentProtocolErrorCode::NotFound => FsError::NotFound { path: path.clone() },
-            EnvironmentProtocolErrorCode::Conflict => FsError::AlreadyExists { path: path.clone() },
-            EnvironmentProtocolErrorCode::Unauthorized
-            | EnvironmentProtocolErrorCode::Forbidden => {
-                FsError::PermissionDenied { path: path.clone() }
-            }
-            EnvironmentProtocolErrorCode::Unsupported
-            | EnvironmentProtocolErrorCode::CapabilityUnavailable => FsError::Unsupported {
-                message: error.message,
-            },
-            EnvironmentProtocolErrorCode::InvalidRequest => FsError::InvalidInput {
-                message: error.message,
-            },
-            _ => FsError::Failed {
-                message: error.message,
-            },
-        },
-        other => FsError::Failed {
-            message: other.to_string(),
+fn map_fs_error(error: ClientError, path: &FsPath) -> FsError {
+    let Some(protocol) = error.protocol_error() else {
+        return FsError::Failed {
+            message: error.to_string(),
+        };
+    };
+    let message = protocol.message.clone();
+    match &protocol.data {
+        ErrorData::NotFound { .. } => FsError::NotFound { path: path.clone() },
+        ErrorData::AlreadyExists {} => FsError::AlreadyExists { path: path.clone() },
+        ErrorData::PermissionDenied { .. } => FsError::PermissionDenied { path: path.clone() },
+        ErrorData::FailedPrecondition {
+            reason: PreconditionReason::IfMatchFailed,
+        } => FsError::Conflict { path: path.clone() },
+        ErrorData::CapabilityUnavailable {
+            capability: Capability::FilesystemWrite,
+        } => FsError::PermissionDenied { path: path.clone() },
+        ErrorData::CapabilityUnavailable { .. } => FsError::Unsupported { message },
+        ErrorData::FailedPrecondition { .. }
+        | ErrorData::InvalidParams { .. }
+        | ErrorData::InvalidRequest {}
+        | ErrorData::PayloadTooLarge { .. } => FsError::InvalidInput { message },
+        _ => FsError::Failed {
+            message: protocol.to_string(),
         },
     }
 }
 
-fn map_process_error(error: EnvironmentClientError) -> ProcessError {
-    match error {
-        EnvironmentClientError::Protocol(error) => match error.code {
-            EnvironmentProtocolErrorCode::Unsupported
-            | EnvironmentProtocolErrorCode::CapabilityUnavailable => ProcessError::Unsupported {
-                message: error.message,
-            },
-            EnvironmentProtocolErrorCode::InvalidRequest
-            | EnvironmentProtocolErrorCode::NotFound => ProcessError::InvalidRequest {
-                message: error.message,
-            },
-            _ => ProcessError::Failed {
-                message: error.message,
-            },
+fn map_process_error(error: ClientError) -> ProcessError {
+    let Some(protocol) = error.protocol_error() else {
+        return ProcessError::Failed {
+            message: error.to_string(),
+        };
+    };
+    let message = protocol.message.clone();
+    match protocol.kind() {
+        ProtocolErrorKind::CapabilityUnavailable => ProcessError::Unsupported { message },
+        ProtocolErrorKind::InvalidParams
+        | ProtocolErrorKind::InvalidRequest
+        | ProtocolErrorKind::NotFound
+        | ProtocolErrorKind::PermissionDenied
+        | ProtocolErrorKind::FailedPrecondition => ProcessError::InvalidRequest {
+            message: protocol.to_string(),
         },
-        other => ProcessError::Failed {
-            message: other.to_string(),
+        _ => ProcessError::Failed {
+            message: protocol.to_string(),
         },
     }
 }
 
-fn map_job_error(error: EnvironmentClientError) -> JobError {
-    match error {
-        EnvironmentClientError::Protocol(error) => match error.code {
-            EnvironmentProtocolErrorCode::Unsupported
-            | EnvironmentProtocolErrorCode::CapabilityUnavailable => JobError::Unsupported {
-                message: error.message,
-            },
-            EnvironmentProtocolErrorCode::InvalidRequest
-            | EnvironmentProtocolErrorCode::NotFound
-            | EnvironmentProtocolErrorCode::Conflict => JobError::InvalidRequest {
-                message: error.message,
-            },
-            _ => JobError::Failed {
-                message: error.message,
-            },
+/// Errors of calls on an existing handle: an unknown, expired or earlier
+/// daemon's handle is `notFound`, closed input `inputClosed`.
+fn map_handle_error(error: ClientError, handle: &ProcessHandle) -> ProcessError {
+    match error.protocol_error().map(|protocol| &protocol.data) {
+        Some(ErrorData::NotFound { .. }) => ProcessError::UnknownHandle {
+            handle: handle.clone(),
         },
-        other => JobError::Failed {
-            message: other.to_string(),
+        Some(ErrorData::FailedPrecondition {
+            reason: PreconditionReason::InputClosed,
+        }) => ProcessError::StdinClosed {
+            handle: handle.clone(),
         },
+        _ => map_process_error(error),
     }
 }
 
-/// Sorts chunks into their streams. The omission marker goes where the
-/// daemon dropped the middle: at the first sequence gap, or at the start of
-/// the output when the gap precedes everything returned.
-fn split_output(
-    chunks: Vec<remote_process::ProcessOutputChunk>,
-    omitted_bytes: u64,
-) -> (StreamOutput, StreamOutput) {
-    let mut stdout = StreamOutput::default();
-    let mut stderr = StreamOutput::default();
-    let mut omission_placed = omitted_bytes == 0;
-    let gap_index = chunks
-        .windows(2)
-        .position(|pair| pair[1].seq != pair[0].seq + 1)
-        .map(|index| index + 1)
-        .unwrap_or(0);
-    for (index, chunk) in chunks.into_iter().enumerate() {
-        let stream = match chunk.stream {
-            ProcessOutputStream::Stdout | ProcessOutputStream::Pty => &mut stdout,
-            ProcessOutputStream::Stderr => &mut stderr,
+fn map_job_error(error: ClientError) -> JobError {
+    let Some(protocol) = error.protocol_error() else {
+        return JobError::Failed {
+            message: error.to_string(),
         };
-        if !omission_placed && index == gap_index {
-            stream.omitted_at = Some(stream.bytes.len());
-            omission_placed = true;
-        }
-        stream.bytes.extend(chunk.chunk.into_inner());
-    }
-    if !omission_placed {
-        stdout.omitted_at = Some(stdout.bytes.len());
+    };
+    let message = protocol.message.clone();
+    match &protocol.data {
+        ErrorData::FailedPrecondition {
+            reason: PreconditionReason::JobIdInUse,
+        } => JobError::JobIdInUse {
+            message: format!("{message}; choose a new job_id for a new run"),
+        },
+        ErrorData::CapabilityUnavailable { .. } => JobError::Unsupported { message },
+        ErrorData::InvalidParams { .. }
+        | ErrorData::InvalidRequest {}
+        | ErrorData::FailedPrecondition { .. }
+        | ErrorData::NotFound { .. } => JobError::InvalidRequest { message },
+        _ => JobError::Failed {
+            message: protocol.to_string(),
+        },
     }
-    (stdout, stderr)
 }
 
 #[cfg(test)]
 mod tests {
     use std::{
         collections::{BTreeMap, VecDeque},
-        sync::{Arc, Mutex},
+        sync::Mutex,
     };
 
-    use environment_client::EnvironmentClientResult;
+    use environment_protocol::{
+        data::exec::{OutputChunk, OutputStream},
+        error::ProtocolError,
+        jsonrpc::{Request, Response},
+    };
     use harness::storage::InMemoryBlobStore;
     use serde_json::{Value, json};
 
     use super::*;
     use crate::fs::tools::{ReadFileArgs, WriteFileArgs, invoke_read_file, invoke_write_file};
 
-    struct MockTransport {
-        sent: Arc<Mutex<Vec<Value>>>,
-        recv: Arc<Mutex<VecDeque<Value>>>,
+    /// Answers each request with the next scripted result and records it.
+    struct Script {
+        replies: Mutex<VecDeque<Result<Value, ProtocolError>>>,
+        sent: Mutex<Vec<Request>>,
     }
 
-    impl MockTransport {
-        fn new(messages: impl IntoIterator<Item = Value>) -> (Self, Arc<Mutex<Vec<Value>>>) {
-            let sent = Arc::new(Mutex::new(Vec::new()));
-            (
-                Self {
-                    sent: sent.clone(),
-                    recv: Arc::new(Mutex::new(messages.into_iter().collect())),
-                },
-                sent,
-            )
-        }
+    fn initialize(capabilities: Value) -> InitializeResponse {
+        let fixture: Value = serde_json::from_str(include_str!(
+            "../../../environment-protocol/fixtures/data/initialize.json"
+        ))
+        .unwrap();
+        let mut response = fixture["response"].clone();
+        response["capabilities"] = capabilities;
+        response["defaultCwd"] = json!("/workspace");
+        serde_json::from_value(response).unwrap()
     }
 
-    #[async_trait]
-    impl JsonRpcTransport for MockTransport {
-        async fn send(&mut self, message: Value) -> EnvironmentClientResult<()> {
-            self.sent.lock().expect("sent lock").push(message);
-            Ok(())
-        }
+    fn scripted(
+        capabilities: Value,
+        replies: impl IntoIterator<Item = Result<Value, ProtocolError>>,
+    ) -> (DataClient, Arc<Script>) {
+        let script = Arc::new(Script {
+            replies: Mutex::new(replies.into_iter().collect()),
+            sent: Mutex::new(Vec::new()),
+        });
+        let handler_script = script.clone();
+        let client = DataClient::in_process(initialize(capabilities), move |request: Request| {
+            let script = handler_script.clone();
+            Box::pin(async move {
+                let reply = script
+                    .replies
+                    .lock()
+                    .unwrap()
+                    .pop_front()
+                    .unwrap_or_else(|| panic!("unscripted request {}", request.method));
+                let id = request.id.clone();
+                script.sent.lock().unwrap().push(request);
+                Ok(match reply {
+                    Ok(value) => Response::success(id, &value),
+                    Err(error) => Response::failure(Some(id), error),
+                })
+            })
+        });
+        (client, script)
+    }
 
-        async fn recv(&mut self) -> EnvironmentClientResult<Option<Value>> {
-            Ok(self.recv.lock().expect("recv lock").pop_front())
+    fn all() -> Value {
+        json!({"filesystem": {"write": true}, "process": {"pty": true}, "job": {}})
+    }
+
+    fn sent(script: &Script) -> Vec<(String, Value)> {
+        script
+            .sent
+            .lock()
+            .unwrap()
+            .iter()
+            .map(|request| (request.method.clone(), request.params.clone()))
+            .collect()
+    }
+
+    fn read_response(chunks: Value, state: &str, next: u64, end: u64) -> Value {
+        let mut response = json!({
+            "output": {"chunks": chunks, "next": next, "end": end},
+            "state": state,
+            "pid": 4242
+        });
+        if state == "exited" {
+            response["exit"] = json!({"kind": "code", "code": 0});
         }
+        response
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn remote_file_system_maps_file_operations_to_data_plane_methods() {
-        let (transport, sent) = MockTransport::new([
-            json!({
-                "jsonrpc": "2.0",
-                "id": 1,
-                "result": {
-                    "data": "aGk="
-                }
-            }),
-            json!({
-                "jsonrpc": "2.0",
-                "id": 2,
-                "result": {}
-            }),
-        ]);
-        let connection = RemoteEnvironmentConnection::new(
-            EnvironmentDataClient::new(transport),
-            EnvironmentCapabilities::filesystem(true, true),
+    async fn remote_reads_are_bounded_and_refuse_truncated_files() {
+        let (client, script) = scripted(
+            all(),
+            [
+                Ok(json!({"data": "aGk=", "fileSize": 2, "version": "v1"})),
+                Ok(json!({"version": "v2"})),
+                Ok(
+                    json!({"data": "aGk=", "fileSize": 9000000, "truncated": true, "version": "v3"}),
+                ),
+            ],
         );
-        let fs = connection.file_system();
+        let fs = RemoteEnvironmentConnection::new(client).file_system();
+        let path = FsPath::new("/workspace/file.txt").unwrap();
 
-        let contents = fs
-            .read_file(&FsPath::new("/workspace/file.txt").expect("path"))
-            .await
-            .expect("read file");
-        fs.write_file(
-            &FsPath::new("/workspace/file.txt").expect("path"),
+        let read = fs.read_file_versioned(&path).await.unwrap();
+        assert_eq!(read.bytes, b"hi");
+        fs.write_file_with(
+            &path,
             b"updated".to_vec(),
+            WriteOptions {
+                if_match: read.version,
+            },
         )
         .await
-        .expect("write file");
+        .unwrap();
+        assert!(matches!(
+            fs.read_file(&path).await,
+            Err(FsError::InvalidInput { .. })
+        ));
+
+        let sent = sent(&script);
+        assert_eq!(sent[0].0, "fs/readFile");
+        assert_eq!(sent[0].1["maxBytes"], 8388608, "reads send the ceiling");
+        assert_eq!(sent[1].0, "fs/writeFile");
+        assert_eq!(sent[1].1["data"], "dXBkYXRlZA==");
+        assert_eq!(sent[1].1["ifMatch"], "v1");
+    }
 
-        assert_eq!(contents, b"hi");
-        let sent = sent.lock().expect("sent lock");
-        assert_eq!(sent[0]["method"], "fs/readFile");
-        assert_eq!(sent[0]["params"]["path"], "/workspace/file.txt");
-        assert_eq!(sent[1]["method"], "fs/writeFile");
-        assert_eq!(sent[1]["params"]["data"], "dXBkYXRlZA==");
+    #[tokio::test(flavor = "current_thread")]
+    async fn a_changed_file_is_a_conflict_and_moves_use_rename() {
+        let (client, script) = scripted(
+            all(),
+            [
+                Err(ProtocolError::failed_precondition(
+                    PreconditionReason::IfMatchFailed,
+                    "changed",
+                )),
+                Ok(json!({})),
+                Err(ProtocolError::already_exists("exists")),
+            ],
+        );
+        let fs = RemoteEnvironmentConnection::new(client).file_system();
+        let path = FsPath::new("/workspace/file.txt").unwrap();
+        let moved = FsPath::new("/workspace/moved.txt").unwrap();
+
+        assert!(matches!(
+            fs.write_file_with(
+                &path,
+                b"x".to_vec(),
+                WriteOptions {
+                    if_match: Some(FsVersion::new("old")),
+                },
+            )
+            .await,
+            Err(FsError::Conflict { .. })
+        ));
+        fs.rename(&path, &moved, RenameOptions::default())
+            .await
+            .unwrap();
+        assert!(matches!(
+            fs.rename(&path, &moved, RenameOptions::default()).await,
+            Err(FsError::AlreadyExists { path }) if path == moved
+        ));
+        let sent = sent(&script);
+        assert_eq!(sent[1].0, "fs/rename");
+        assert_eq!(sent[1].1["destination"], "/workspace/moved.txt");
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn remote_process_executor_runs_and_continues_through_the_daemon_cursor() {
-        let (transport, sent) = MockTransport::new([
-            json!({
-                "jsonrpc": "2.0",
-                "id": 1,
-                "result": {
-                    "processId": "proc-1"
-                }
-            }),
-            json!({
-                "jsonrpc": "2.0",
-                "id": 2,
-                "result": {
-                    "chunks": [
-                        {
-                            "chunk": "b2sK",
-                            "seq": 1,
-                            "stream": "stdout"
-                        },
-                        {
-                            "chunk": "d2Fybgo=",
-                            "seq": 2,
-                            "stream": "stderr"
-                        }
-                    ],
-                    "closed": false,
-                    "exited": false,
-                    "nextSeq": 3,
-                    "pid": 4242
-                }
-            }),
-            json!({
-                "jsonrpc": "2.0",
-                "id": 3,
-                "result": {
-                    "status": "accepted"
-                }
-            }),
-            json!({
-                "jsonrpc": "2.0",
-                "id": 4,
-                "result": {
-                    "chunks": [
-                        {
-                            "chunk": "ZG9uZQo=",
-                            "seq": 3,
-                            "stream": "stdout"
-                        }
-                    ],
-                    "closed": true,
-                    "exited": true,
-                    "exitCode": 0,
-                    "nextSeq": 4,
-                    "pid": 4242,
-                    "leftoverProcesses": [{ "pid": 4243, "command": "sleep 100" }]
-                }
-            }),
-        ]);
-        let connection = RemoteEnvironmentConnection::new(
-            EnvironmentDataClient::new(transport),
-            EnvironmentCapabilities::filesystem(true, true).with_process(),
+    async fn process_runs_and_continues_through_the_daemon_cursor() {
+        let (client, script) = scripted(
+            all(),
+            [
+                Ok(json!({"pid": 4242})),
+                Ok(read_response(
+                    json!([
+                        {"offset": 0, "stream": "stdout", "data": "b2sK"},
+                        {"offset": 3, "stream": "stderr", "data": "d2Fybgo="}
+                    ]),
+                    "running",
+                    8,
+                    8,
+                )),
+                Ok(json!({"acceptedBytes": 6})),
+                Ok({
+                    let mut response = read_response(
+                        json!([{"offset": 8, "stream": "stdout", "data": "ZG9uZQo="}]),
+                        "exited",
+                        13,
+                        13,
+                    );
+                    response["leftovers"] = json!({
+                        "disposition": "kept",
+                        "processes": [{"pid": 4243, "command": "sleep 100"}]
+                    });
+                    response
+                }),
+            ],
         );
-        let process = connection.process_executor().expect("process executor");
+        let process = RemoteEnvironmentConnection::new(client)
+            .process_executor()
+            .unwrap();
 
         let output = process
             .run_process(ProcessRequest {
                 argv: vec!["sh".to_owned(), "-lc".to_owned(), "cat".to_owned()],
-                cwd: Some(FsPath::new("/workspace").expect("cwd")),
+                cwd: Some(FsPath::new("/workspace").unwrap()),
                 env: BTreeMap::new(),
                 secret_env: BTreeMap::new(),
                 stdin: None,
                 tty: true,
                 timeout_ms: None,
-                yield_ms: Some(10),
+                yield_ms: Some(0),
                 max_output_bytes: Some(1024),
             })
             .await
-            .expect("run process");
-
-        let process_id = sent.lock().expect("sent lock")[0]["params"]["processId"]
-            .as_str()
-            .expect("process id")
-            .to_owned();
+            .unwrap();
+        let process_id = sent(&script)[0].1["processId"].as_str().unwrap().to_owned();
         assert_eq!(output.status, ProcessStatus::Running);
         assert_eq!(output.handle, Some(ProcessHandle::new(process_id.clone())));
-        assert_eq!(output.pid, Some(4242));
         assert_eq!(output.stdout.bytes, b"ok\n");
         assert_eq!(output.stderr.bytes, b"warn\n");
 
@@ -968,12 +1408,11 @@ mod tests {
                 input: Some(b"input\n".to_vec()),
                 close_stdin: true,
                 signal: None,
-                wait_ms: Some(10),
+                wait_ms: Some(0),
                 max_output_bytes: Some(1024),
             })
             .await
-            .expect("continue");
-
+            .unwrap();
         assert_eq!(output.status, ProcessStatus::Succeeded);
         assert_eq!(output.handle, None);
         assert_eq!(output.stdout.bytes, b"done\n");
@@ -985,312 +1424,259 @@ mod tests {
             }]
         );
 
-        let sent = sent.lock().expect("sent lock");
-        assert_eq!(sent[0]["method"], "process/start");
-        assert_eq!(sent[0]["params"]["processId"], process_id);
-        assert_eq!(sent[0]["params"]["tty"], true);
-        assert!(sent[0]["params"].get("pipeStdin").is_none());
-        assert!(sent[0]["params"].get("timeoutMs").is_none());
-        assert_eq!(sent[1]["method"], "process/read");
-        assert!(sent[1]["params"].get("afterSeq").is_none());
-        assert_eq!(sent[1]["params"]["waitMs"], 10);
-        assert_eq!(sent[2]["method"], "process/write");
-        assert_eq!(sent[2]["params"]["closeStdin"], true);
-        assert_eq!(sent[3]["method"], "process/read");
+        let sent = sent(&script);
+        assert_eq!(sent[0].0, "process/start");
+        assert_eq!(sent[0].1["pty"], json!({"rows": 24, "cols": 80}));
+        assert!(
+            sent[0].1["command"].get("input").is_none(),
+            "stdin stays /dev/null"
+        );
+        assert_eq!(sent[1].0, "process/read");
         assert!(
-            sent[3]["params"].get("afterSeq").is_none(),
-            "the daemon owns the cursor; the runtime never re-sends a sequence"
+            sent[1].1.get("after").is_none(),
+            "reads use the daemon cursor"
         );
+        assert_eq!(sent[1].1["returnOn"], "exit");
+        assert_eq!(sent[2].0, "process/write");
+        assert_eq!(sent[2].1["closeInput"], true);
+        assert_eq!(sent[3].0, "process/read");
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn remote_process_executor_maps_signals_and_stdin_refusals() {
-        let (transport, sent) = MockTransport::new([
-            json!({ "jsonrpc": "2.0", "id": 1, "result": { "running": true } }),
-            json!({
-                "jsonrpc": "2.0",
-                "id": 2,
-                "result": {
-                    "chunks": [],
-                    "closed": true,
-                    "exited": true,
-                    "nextSeq": 0,
-                    "termination": "killed"
-                }
-            }),
-            json!({ "jsonrpc": "2.0", "id": 3, "result": { "status": "stdinClosed" } }),
-            json!({ "jsonrpc": "2.0", "id": 4, "result": { "status": "unknownProcess" } }),
-        ]);
-        let process = RemoteEnvironmentConnection::new(
-            EnvironmentDataClient::new(transport),
-            EnvironmentCapabilities::filesystem(true, true).with_process(),
-        )
-        .process_executor()
-        .expect("process executor");
-
-        let killed = process
-            .continue_process(ContinueProcessRequest {
-                handle: ProcessHandle::new("proc-9"),
-                input: None,
-                close_stdin: false,
-                signal: Some(ProcessSignal::Kill),
-                wait_ms: Some(5),
-                max_output_bytes: None,
-            })
-            .await
-            .expect("kill");
-        assert_eq!(killed.status, ProcessStatus::Killed);
-        assert_eq!(killed.handle, None);
-
-        let refused = process
-            .continue_process(ContinueProcessRequest {
-                handle: ProcessHandle::new("proc-9"),
-                input: Some(b"x".to_vec()),
-                close_stdin: false,
-                signal: None,
-                wait_ms: Some(5),
-                max_output_bytes: None,
-            })
-            .await
-            .expect_err("stdin closed");
-        assert!(matches!(refused, ProcessError::StdinClosed { .. }));
-        assert!(refused.to_string().contains("tty: true"));
-
-        let unknown = process
-            .continue_process(ContinueProcessRequest {
-                handle: ProcessHandle::new("proc-gone"),
-                input: Some(b"x".to_vec()),
-                close_stdin: false,
-                signal: None,
-                wait_ms: Some(5),
-                max_output_bytes: None,
+    async fn a_finished_command_shows_head_and_tail_of_large_output() {
+        let head = "h".repeat(8);
+        let tail = "t".repeat(4);
+        let encode = |text: &str| {
+            use std::io::Write;
+            let mut out = Vec::new();
+            write!(out, "{text}").unwrap();
+            serde_json::to_value(ByteChunk::from(out)).unwrap()
+        };
+        let (client, script) = scripted(
+            all(),
+            [
+                Ok(json!({"pid": 1})),
+                Ok({
+                    let mut response = read_response(
+                        json!([{"offset": 0, "stream": "stdout", "data": encode(&head)}]),
+                        "exited",
+                        8,
+                        100,
+                    );
+                    response["exit"] = json!({"kind": "code", "code": 1});
+                    response
+                }),
+                Ok({
+                    let mut response = read_response(
+                        json!([{"offset": 96, "stream": "stdout", "data": encode(&tail)}]),
+                        "exited",
+                        100,
+                        100,
+                    );
+                    response["exit"] = json!({"kind": "code", "code": 1});
+                    response
+                }),
+            ],
+        );
+        let process = RemoteEnvironmentConnection::new(client)
+            .process_executor()
+            .unwrap();
+        let output = process
+            .run_process(ProcessRequest {
+                max_output_bytes: Some(8),
+                ..ProcessRequest::argv(["make"])
             })
             .await
-            .expect_err("unknown");
-        assert!(matches!(unknown, ProcessError::UnknownHandle { .. }));
+            .unwrap();
 
-        let sent = sent.lock().expect("sent lock");
-        assert_eq!(sent[0]["method"], "process/terminate");
-        assert_eq!(sent[0]["params"]["signal"], "kill");
-        assert_eq!(sent[1]["method"], "process/read");
-        assert_eq!(sent[2]["method"], "process/write");
-        assert_eq!(sent[3]["method"], "process/write");
+        assert_eq!(output.status, ProcessStatus::Failed);
+        assert_eq!(output.exit_code, Some(1));
+        assert_eq!(output.handle, None);
+        assert_eq!(output.stdout.bytes, b"hhhhtttt");
+        assert_eq!(output.stdout.omitted_at, Some(4));
+        assert_eq!(output.omitted_bytes, 92);
+        let sent = sent(&script);
+        assert_eq!(sent[2].1["tailBytes"], 4, "the end of the output is read");
     }
 
-    #[test]
-    fn split_output_places_the_omission_marker_at_the_sequence_gap() {
-        let chunk = |seq: u64, stream: ProcessOutputStream, text: &str| {
-            remote_process::ProcessOutputChunk {
-                seq,
-                stream,
-                chunk: ByteChunk::from(text.as_bytes()),
-            }
-        };
-        let (stdout, stderr) = split_output(
-            vec![
-                chunk(0, ProcessOutputStream::Stdout, "head"),
-                chunk(1, ProcessOutputStream::Stderr, "warn"),
-                chunk(40, ProcessOutputStream::Stdout, "tail"),
+    #[tokio::test(flavor = "current_thread")]
+    async fn handles_map_not_found_input_closed_and_signals() {
+        let (client, script) = scripted(
+            all(),
+            [
+                Ok(json!({"running": true})),
+                Ok({
+                    let mut response = read_response(json!([]), "exited", 0, 0);
+                    response["exit"] = json!({"kind": "signal", "signal": "SIGKILL"});
+                    response["stoppedBy"] = json!("kill");
+                    response
+                }),
+                Err(ProtocolError::failed_precondition(
+                    PreconditionReason::InputClosed,
+                    "no input",
+                )),
+                Err(ProtocolError::not_found("unknown process")),
             ],
-            500,
         );
-        assert_eq!(stdout.bytes, b"headtail");
-        assert_eq!(stdout.omitted_at, Some(4));
-        assert_eq!(stderr.omitted_at, None);
-
-        let (stdout, _) = split_output(vec![chunk(40, ProcessOutputStream::Stdout, "tail")], 500);
-        assert_eq!(stdout.omitted_at, Some(0), "gap before everything returned");
+        let process = RemoteEnvironmentConnection::new(client)
+            .process_executor()
+            .unwrap();
+        let continue_with = |input: Option<&[u8]>, signal| ContinueProcessRequest {
+            handle: ProcessHandle::new("proc-9"),
+            input: input.map(<[u8]>::to_vec),
+            close_stdin: false,
+            signal,
+            wait_ms: Some(0),
+            max_output_bytes: None,
+        };
 
-        let (stdout, _) = split_output(vec![chunk(0, ProcessOutputStream::Stdout, "all")], 0);
-        assert_eq!(stdout.omitted_at, None);
+        let killed = process
+            .continue_process(continue_with(None, Some(ProcessSignal::Kill)))
+            .await
+            .unwrap();
+        assert_eq!(killed.status, ProcessStatus::Killed);
+        assert_eq!(killed.handle, None);
+        assert!(matches!(
+            process
+                .continue_process(continue_with(Some(b"x"), None))
+                .await,
+            Err(ProcessError::StdinClosed { .. })
+        ));
+        assert!(matches!(
+            process
+                .continue_process(continue_with(Some(b"x"), None))
+                .await,
+            Err(ProcessError::UnknownHandle { .. })
+        ));
+        assert_eq!(sent(&script)[0].1["signal"], "kill");
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn remote_process_executors_use_distinct_process_id_prefixes() {
-        let (transport_a, sent_a) = MockTransport::new([
-            json!({ "jsonrpc": "2.0", "id": 1, "result": { "processId": "unused" } }),
-            json!({
-                "jsonrpc": "2.0",
-                "id": 2,
-                "result": { "chunks": [], "closed": true, "exited": true, "exitCode": 0, "nextSeq": 0 }
-            }),
-        ]);
-        let (transport_b, sent_b) = MockTransport::new([
-            json!({ "jsonrpc": "2.0", "id": 1, "result": { "processId": "unused" } }),
-            json!({
-                "jsonrpc": "2.0",
-                "id": 2,
-                "result": { "chunks": [], "closed": true, "exited": true, "exitCode": 0, "nextSeq": 0 }
-            }),
-        ]);
-        let process_a = RemoteEnvironmentConnection::new(
-            EnvironmentDataClient::new(transport_a),
-            EnvironmentCapabilities::filesystem(true, true).with_process(),
-        )
-        .process_executor()
-        .expect("process executor a");
-        let process_b = RemoteEnvironmentConnection::new(
-            EnvironmentDataClient::new(transport_b),
-            EnvironmentCapabilities::filesystem(true, true).with_process(),
-        )
-        .process_executor()
-        .expect("process executor b");
-
-        for process in [&process_a, &process_b] {
+    async fn capability_facts_gate_the_adapters() {
+        let (client, script) = scripted(json!({"filesystem": {}, "process": {}}), []);
+        let connection =
+            RemoteEnvironmentConnection::new(client).with_cwd(FsPath::new("/workspace").unwrap());
+        let process = connection.process_executor().unwrap();
+        assert!(matches!(
             process
                 .run_process(ProcessRequest {
-                    argv: vec!["true".to_owned()],
-                    cwd: None,
-                    env: BTreeMap::new(),
-                    secret_env: BTreeMap::new(),
-                    stdin: None,
-                    tty: false,
-                    timeout_ms: Some(1_000),
-                    yield_ms: Some(1),
-                    max_output_bytes: Some(128),
+                    tty: true,
+                    ..ProcessRequest::argv(["vim"])
                 })
-                .await
-                .expect("run process");
-        }
-
-        let process_id_a = sent_a.lock().expect("sent a lock")[0]["params"]["processId"]
-            .as_str()
-            .expect("process id a")
-            .to_owned();
-        let process_id_b = sent_b.lock().expect("sent b lock")[0]["params"]["processId"]
-            .as_str()
-            .expect("process id b")
-            .to_owned();
-
-        assert_ne!(process_id_a, process_id_b);
-        assert!(process_id_a.starts_with("proc-"));
-        assert!(process_id_b.starts_with("proc-"));
-    }
-
-    #[tokio::test(flavor = "current_thread")]
-    async fn remote_connection_builds_tool_contexts() {
-        let (transport, _sent) = MockTransport::new([]);
-        let connection = RemoteEnvironmentConnection::new(
-            EnvironmentDataClient::new(transport),
-            EnvironmentCapabilities::filesystem(true, false),
-        )
-        .with_cwd(FsPath::new("/workspace").expect("cwd"));
+                .await,
+            Err(ProcessError::Unsupported { .. })
+        ));
+        assert!(script.sent.lock().unwrap().is_empty(), "nothing was sent");
+        assert!(connection.job_executor().is_none());
 
         let (fs_ctx, env_ctx) = connection.into_contexts(Arc::new(InMemoryBlobStore::new()));
-
-        assert_eq!(fs_ctx.fs_cwd, Some(FsPath::new("/workspace").expect("cwd")));
-        assert_eq!(
-            env_ctx.process_cwd,
-            Some(FsPath::new("/workspace").expect("cwd"))
-        );
-        assert!(env_ctx.process.is_none());
         assert_eq!(fs_ctx.fs.access_policy(), FileAccessPolicy::FullReadOnly);
-        let filesystem = env_ctx
-            .filesystem
-            .as_ref()
-            .expect("read-only capability keeps a filesystem context");
-        assert_eq!(
-            filesystem.fs.access_policy(),
-            FileAccessPolicy::FullReadOnly
-        );
-        assert_eq!(
-            filesystem.fs_cwd,
-            Some(FsPath::new("/workspace").expect("cwd"))
-        );
+        assert_eq!(fs_ctx.fs_cwd, Some(FsPath::new("/workspace").unwrap()));
+        assert!(env_ctx.filesystem.is_some());
+        assert!(env_ctx.transfer.is_some());
+        assert!(env_ctx.jobs.is_none());
+
+        let (client, _) = scripted(json!({}), []);
+        let (_, none) = RemoteEnvironmentConnection::new(client)
+            .into_contexts(Arc::new(InMemoryBlobStore::new()));
+        assert!(none.filesystem.is_none() && none.process.is_none() && none.transfer.is_none());
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn remote_connection_context_filesystem_follows_negotiated_capabilities() {
-        let blobs: Arc<dyn BlobStore> = Arc::new(InMemoryBlobStore::new());
-
-        let (transport, _sent) = MockTransport::new([]);
-        let (_, read_write) = RemoteEnvironmentConnection::new(
-            EnvironmentDataClient::new(transport),
-            EnvironmentCapabilities::filesystem(true, true),
-        )
-        .into_contexts(blobs.clone());
-        assert_eq!(
-            read_write
-                .filesystem
-                .as_ref()
-                .expect("read/write filesystem")
-                .fs
-                .access_policy(),
-            FileAccessPolicy::FullReadWrite
-        );
-
-        let (transport, _sent) = MockTransport::new([]);
-        let (_, none) = RemoteEnvironmentConnection::new(
-            EnvironmentDataClient::new(transport),
-            EnvironmentCapabilities::filesystem(false, false),
-        )
-        .into_contexts(blobs);
-        assert!(
-            none.filesystem.is_none(),
-            "no filesystem tools without negotiated read access"
-        );
+    async fn process_executors_use_distinct_process_id_prefixes() {
+        let exited = || Ok(read_response(json!([]), "exited", 0, 0));
+        let (client_a, sent_a) = scripted(all(), [Ok(json!({"pid": 1})), exited()]);
+        let (client_b, sent_b) = scripted(all(), [Ok(json!({"pid": 2})), exited()]);
+        for client in [client_a, client_b] {
+            RemoteEnvironmentConnection::new(client)
+                .process_executor()
+                .unwrap()
+                .run_process(ProcessRequest::argv(["true"]))
+                .await
+                .unwrap();
+        }
+        let id_a = sent(&sent_a)[0].1["processId"].clone();
+        let id_b = sent(&sent_b)[0].1["processId"].clone();
+        assert_ne!(id_a, id_b);
+        assert!(id_a.as_str().unwrap().starts_with("proc-"));
     }
 
     #[tokio::test(flavor = "current_thread")]
     async fn existing_file_tools_work_through_remote_context() {
-        let (transport, sent) = MockTransport::new([
-            json!({
-                "jsonrpc": "2.0",
-                "id": 1,
-                "result": {}
-            }),
-            json!({
-                "jsonrpc": "2.0",
-                "id": 2,
-                "result": {}
-            }),
-            json!({
-                "jsonrpc": "2.0",
-                "id": 3,
-                "result": {
-                    "data": "aGVsbG8K"
-                }
-            }),
-        ]);
-        let connection = RemoteEnvironmentConnection::new(
-            EnvironmentDataClient::new(transport),
-            EnvironmentCapabilities::filesystem(true, true),
-        )
-        .with_cwd(FsPath::new("/workspace").expect("cwd"));
+        let (client, script) = scripted(
+            all(),
+            [
+                Ok(json!({})),
+                Ok(json!({"version": "v1"})),
+                Ok(json!({"data": "aGVsbG8K", "fileSize": 6, "version": "v1"})),
+            ],
+        );
+        let connection =
+            RemoteEnvironmentConnection::new(client).with_cwd(FsPath::new("/workspace").unwrap());
         let (fs_ctx, _env_ctx) = connection.into_contexts(Arc::new(InMemoryBlobStore::new()));
 
         let write = invoke_write_file(
             &fs_ctx,
             WriteFileArgs {
-                path: FsPath::new("nested/file.txt").expect("path"),
+                path: FsPath::new("nested/file.txt").unwrap(),
                 content: Some("hello\n".to_owned()),
                 content_ref: None,
             },
         )
         .await
-        .expect("write file");
+        .unwrap();
         let read = invoke_read_file(
             &fs_ctx,
             ReadFileArgs {
-                path: FsPath::new("nested/file.txt").expect("path"),
+                path: FsPath::new("nested/file.txt").unwrap(),
                 offset: None,
                 limit: None,
             },
         )
         .await
-        .expect("read file");
+        .unwrap();
 
         assert_eq!(
             write.resolved_path,
-            FsPath::new("/workspace/nested/file.txt").expect("path")
+            FsPath::new("/workspace/nested/file.txt").unwrap()
         );
         assert_eq!(read.text, "hello");
+        let sent = sent(&script);
+        assert_eq!(sent[0].0, "fs/createDirectory");
+        assert_eq!(sent[0].1["path"], "/workspace/nested");
+        assert_eq!(sent[1].0, "fs/writeFile");
+        assert_eq!(sent[2].0, "fs/readFile");
+        assert_eq!(sent[2].1["path"], "/workspace/nested/file.txt");
+    }
 
-        let sent = sent.lock().expect("sent lock");
-        assert_eq!(sent[0]["method"], "fs/createDirectory");
-        assert_eq!(sent[0]["params"]["path"], "/workspace/nested");
-        assert_eq!(sent[1]["method"], "fs/writeFile");
-        assert_eq!(sent[2]["method"], "fs/readFile");
-        assert_eq!(sent[2]["params"]["path"], "/workspace/nested/file.txt");
+    #[test]
+    fn split_output_places_the_omission_marker_before_the_tail() {
+        let chunk = |offset: u64, stream: OutputStream, text: &str| OutputChunk {
+            offset,
+            stream,
+            data: text.as_bytes().to_vec().into(),
+        };
+        let shown = ShownOutput::from_pages(
+            OutputPage {
+                chunks: vec![
+                    chunk(0, OutputStream::Stdout, "head"),
+                    chunk(4, OutputStream::Stderr, "warn"),
+                ],
+                next: 8,
+                end: 60,
+                gaps: vec![],
+            },
+            Some(OutputPage {
+                chunks: vec![chunk(56, OutputStream::Stdout, "tail")],
+                next: 60,
+                end: 60,
+                gaps: vec![],
+            }),
+        );
+        let (stdout, stderr) = split_output(&shown);
+        assert_eq!(stdout.bytes, b"headtail");
+        assert_eq!(stdout.omitted_at, Some(4));
+        assert_eq!(stderr.omitted_at, None);
+        assert_eq!(shown.omitted_bytes(), 48);
     }
 }
diff --git a/crates/tools/src/fs/apply_patch/engine.rs b/crates/tools/src/fs/apply_patch/engine.rs
index edf74d694..3ee2b01c6 100644
--- a/crates/tools/src/fs/apply_patch/engine.rs
+++ b/crates/tools/src/fs/apply_patch/engine.rs
@@ -10,7 +10,8 @@ use serde::{Deserialize, Serialize};
 use crate::{
     error::{ToolError, ToolResult},
     fs::{
-        CreateDirectoryOptions, FileMetadata, FileSystem, FsError, FsPath, RemoveOptions,
+        CreateDirectoryOptions, FileMetadata, FileSystem, FsError, FsPath, FsVersion,
+        RemoveOptions, RenameOptions, WriteOptions,
         apply_patch::{
             parser::{Hunk, ParseError, UpdateFileChunk, parse_patch},
             seek_sequence,
@@ -86,16 +87,26 @@ pub async fn apply_hunks(
                 chunks,
             } => {
                 let path = resolve_patch_path(cwd, path)?;
-                let new_contents =
+                let (new_contents, version) =
                     derive_new_contents_from_chunks(fs, max_file_read_bytes, &path, chunks).await?;
+                // The write is conditional on the version read, so a file
+                // changed since then is a conflict instead of a lost edit.
+                fs.write_file_with(
+                    &path,
+                    new_contents.into_bytes(),
+                    WriteOptions { if_match: version },
+                )
+                .await?;
                 if let Some(move_path) = move_path {
                     let destination = resolve_patch_path(cwd, move_path)?;
-                    write_file_with_parent_dirs(fs, &destination, new_contents.into_bytes())
+                    if let Some(parent) = destination.parent()
+                        && !parent.is_root()
+                    {
+                        fs.create_directory(&parent, CreateDirectoryOptions::recursive())
+                            .await?;
+                    }
+                    fs.rename(&path, &destination, RenameOptions { overwrite: true })
                         .await?;
-                    ensure_file_not_directory(fs, &path).await?;
-                    fs.remove(&path, RemoveOptions::file()).await?;
-                } else {
-                    fs.write_file(&path, new_contents.into_bytes()).await?;
                 }
                 summary.modified.push(affected_path);
             }
@@ -163,8 +174,8 @@ async fn derive_new_contents_from_chunks(
     max_file_read_bytes: Option<u64>,
     path: &FsPath,
     chunks: &[UpdateFileChunk],
-) -> ToolResult<String> {
-    let original_contents = read_file_text(fs, max_file_read_bytes, path).await?;
+) -> ToolResult<(String, Option<FsVersion>)> {
+    let (original_contents, version) = read_file_text(fs, max_file_read_bytes, path).await?;
     let mut original_lines = original_contents
         .split('\n')
         .map(String::from)
@@ -179,15 +190,16 @@ async fn derive_new_contents_from_chunks(
     if !new_lines.last().is_some_and(String::is_empty) {
         new_lines.push(String::new());
     }
-    Ok(new_lines.join("\n"))
+    Ok((new_lines.join("\n"), version))
 }
 
 async fn read_file_text(
     fs: &dyn FileSystem,
     max_file_read_bytes: Option<u64>,
     path: &FsPath,
-) -> ToolResult<String> {
-    let bytes = fs.read_file(path).await?;
+) -> ToolResult<(String, Option<FsVersion>)> {
+    let read = fs.read_file_versioned(path).await?;
+    let bytes = read.bytes;
     if let Some(max_file_read_bytes) = max_file_read_bytes
         && bytes.len() as u64 > max_file_read_bytes
     {
@@ -198,9 +210,8 @@ async fn read_file_text(
             max_file_read_bytes
         )));
     }
-    String::from_utf8(bytes)
-        .map_err(FsError::invalid_data)
-        .map_err(Into::into)
+    let text = String::from_utf8(bytes).map_err(FsError::invalid_data)?;
+    Ok((text, read.version))
 }
 
 fn compute_replacements(
diff --git a/crates/tools/src/fs/local.rs b/crates/tools/src/fs/local.rs
index ceec47085..29d96b765 100644
--- a/crates/tools/src/fs/local.rs
+++ b/crates/tools/src/fs/local.rs
@@ -9,8 +9,8 @@ use std::{
 use async_trait::async_trait;
 
 use crate::fs::{
-    CopyOptions, CreateDirectoryOptions, FileAccessPolicy, FileMetadata, FileSystem, FsError,
-    FsPath, FsResult, ReadDirectoryEntry, RemoveOptions,
+    CreateDirectoryOptions, FileAccessPolicy, FileMetadata, FileSystem, FsError, FsPath, FsResult,
+    ReadDirectoryEntry, RemoveOptions, RenameOptions,
 };
 
 #[derive(Clone, Debug)]
@@ -149,80 +149,49 @@ impl FileSystem for LocalFileSystem {
         .map_err(|error| map_io_error(path, error))
     }
 
-    async fn copy(
+    async fn rename(
         &self,
         source_path: &FsPath,
         destination_path: &FsPath,
-        options: CopyOptions,
+        options: RenameOptions,
     ) -> FsResult<()> {
-        copy_path(
+        rename_path(
             source_path,
             destination_path,
             &self.host_path(source_path),
             &self.host_path(destination_path),
             options,
         )
+        .await
     }
 }
 
-fn copy_path(
+/// `rename(2)`: atomic within one filesystem and mode-preserving. Without
+/// `overwrite` an existing destination is refused first; a directory
+/// destination is never replaced.
+pub(crate) async fn rename_path(
     source_fs_path: &FsPath,
     destination_fs_path: &FsPath,
     source_host_path: &Path,
     destination_host_path: &Path,
-    options: CopyOptions,
+    options: RenameOptions,
 ) -> FsResult<()> {
-    let metadata = std::fs::symlink_metadata(source_host_path)
+    tokio::fs::symlink_metadata(source_host_path)
+        .await
         .map_err(|error| map_io_error(source_fs_path, error))?;
-    let file_type = metadata.file_type();
-
-    if file_type.is_symlink() {
-        return Err(FsError::Unsupported {
-            message: "copying symlinks is not supported by LocalFileSystem".to_string(),
-        });
-    }
-
-    if file_type.is_dir() {
-        if !options.recursive {
-            return Err(FsError::InvalidInput {
-                message: "copy requires recursive: true when source is a directory".to_string(),
+    match tokio::fs::symlink_metadata(destination_host_path).await {
+        Ok(metadata) if metadata.is_dir() || !options.overwrite => {
+            return Err(FsError::AlreadyExists {
+                path: destination_fs_path.clone(),
             });
         }
-        return copy_dir_recursive(source_host_path, destination_host_path)
-            .map_err(|error| map_io_error(destination_fs_path, error));
-    }
-
-    if file_type.is_file() {
-        std::fs::copy(source_host_path, destination_host_path)
-            .map(|_| ())
-            .map_err(|error| map_io_error(destination_fs_path, error))?;
-        return Ok(());
+        Ok(_) => {}
+        Err(error) if error.kind() == io::ErrorKind::NotFound => {}
+        Err(error) => return Err(map_io_error(destination_fs_path, error)),
     }
-
-    Err(FsError::Unsupported {
-        message: format!("unsupported source file type: {}", source_fs_path),
-    })
-}
-
-fn copy_dir_recursive(source: &Path, destination: &Path) -> io::Result<()> {
-    std::fs::create_dir(destination)?;
-    for entry in std::fs::read_dir(source)? {
-        let entry = entry?;
-        let source_path = entry.path();
-        let destination_path = destination.join(entry.file_name());
-        let metadata = std::fs::symlink_metadata(&source_path)?;
-        if metadata.is_dir() {
-            copy_dir_recursive(&source_path, &destination_path)?;
-        } else if metadata.is_file() {
-            std::fs::copy(&source_path, &destination_path)?;
-        } else {
-            return Err(io::Error::new(
-                io::ErrorKind::Unsupported,
-                format!("unsupported file type: {}", source_path.display()),
-            ));
-        }
-    }
-    Ok(())
+    tokio::fs::rename(source_host_path, destination_host_path)
+        .await
+        .map_err(|error| map_io_error(destination_fs_path, error))
 }
 
 fn system_time_to_unix_ms(time: SystemTime) -> i64 {
diff --git a/crates/tools/src/fs/memory.rs b/crates/tools/src/fs/memory.rs
index bb326bd60..7179ec1d3 100644
--- a/crates/tools/src/fs/memory.rs
+++ b/crates/tools/src/fs/memory.rs
@@ -8,8 +8,8 @@ use std::{
 use async_trait::async_trait;
 
 use crate::fs::{
-    CopyOptions, CreateDirectoryOptions, FileAccessPolicy, FileMetadata, FileSystem, FsError,
-    FsPath, FsResult, ReadDirectoryEntry, RemoveOptions,
+    CreateDirectoryOptions, FileAccessPolicy, FileMetadata, FileSystem, FsError, FsPath, FsResult,
+    ReadDirectoryEntry, RemoveOptions, RenameOptions,
 };
 
 #[derive(Clone, Debug)]
@@ -185,18 +185,18 @@ impl FileSystem for InMemoryFileSystem {
         inner.remove(&path, options)
     }
 
-    async fn copy(
+    async fn rename(
         &self,
         source_path: &FsPath,
         destination_path: &FsPath,
-        options: CopyOptions,
+        options: RenameOptions,
     ) -> FsResult<()> {
         let source_path = self.key(source_path)?;
         let destination_path = self.key(destination_path)?;
-        self.ensure_can_read(&source_path)?;
+        self.ensure_can_write(&source_path)?;
         self.ensure_can_write(&destination_path)?;
         let mut inner = self.write_inner()?;
-        inner.copy(&source_path, &destination_path, options)
+        inner.rename(&source_path, &destination_path, options)
     }
 }
 
@@ -294,56 +294,54 @@ impl InMemoryFileSystemInner {
         Ok(())
     }
 
-    fn copy(
+    fn rename(
         &mut self,
         source_path: &FsPath,
         destination_path: &FsPath,
-        options: CopyOptions,
+        options: RenameOptions,
     ) -> FsResult<()> {
-        let source = self
-            .nodes
-            .get(source_path)
-            .cloned()
-            .ok_or_else(|| FsError::NotFound {
+        if !self.nodes.contains_key(source_path) {
+            return Err(FsError::NotFound {
                 path: source_path.clone(),
-            })?;
-        self.ensure_parent_directory(destination_path)?;
-
-        match source {
-            Node::File { contents, .. } => self.write_file(destination_path, contents),
-            Node::Directory { .. } => {
-                if !options.recursive {
-                    return Err(FsError::InvalidInput {
-                        message: "copy requires recursive: true when source is a directory"
-                            .to_string(),
-                    });
-                }
-                if destination_path.starts_with(source_path) {
-                    return Err(FsError::InvalidInput {
-                        message: "cannot copy a directory to itself or one of its descendants"
-                            .to_string(),
-                    });
-                }
-                let entries = self
-                    .nodes
-                    .iter()
-                    .filter(|(path, _)| path.starts_with(source_path))
-                    .map(|(path, node)| (path.clone(), node.clone()))
-                    .collect::<Vec<_>>();
-                for (path, node) in entries {
-                    let relative_segments = path
-                        .segments()
-                        .skip(source_path.segments().count())
-                        .collect::<Vec<_>>();
-                    let destination = destination_path.join_segments(relative_segments)?;
-                    let timestamp = self.next_timestamp();
-                    self.nodes
-                        .insert(destination, node.with_timestamp(timestamp));
-                }
-                self.touch_parent(destination_path);
-                Ok(())
+            });
+        }
+        match self.nodes.get(destination_path) {
+            Some(Node::Directory { .. }) => {
+                return Err(FsError::AlreadyExists {
+                    path: destination_path.clone(),
+                });
             }
+            Some(Node::File { .. }) if !options.overwrite => {
+                return Err(FsError::AlreadyExists {
+                    path: destination_path.clone(),
+                });
+            }
+            _ => {}
         }
+        if destination_path.starts_with(source_path) {
+            return Err(FsError::InvalidInput {
+                message: "cannot move a directory into itself".to_string(),
+            });
+        }
+        self.ensure_parent_directory(destination_path)?;
+        let moved = self
+            .nodes
+            .keys()
+            .filter(|path| path.starts_with(source_path))
+            .cloned()
+            .collect::<Vec<_>>();
+        for path in moved {
+            let node = self.nodes.remove(&path).expect("listed node");
+            let relative_segments = path
+                .segments()
+                .skip(source_path.segments().count())
+                .collect::<Vec<_>>();
+            let destination = destination_path.join_segments(relative_segments)?;
+            self.nodes.insert(destination, node);
+        }
+        self.touch_parent(source_path);
+        self.touch_parent(destination_path);
+        Ok(())
     }
 
     fn ensure_parent_directory(&self, path: &FsPath) -> FsResult<()> {
@@ -421,13 +419,6 @@ impl Node {
     fn is_file(&self) -> bool {
         matches!(self, Self::File { .. })
     }
-
-    fn with_timestamp(self, timestamp: i64) -> Self {
-        match self {
-            Self::Directory { .. } => Self::directory(timestamp),
-            Self::File { contents, .. } => Self::file(contents, timestamp),
-        }
-    }
 }
 
 #[cfg(test)]
diff --git a/crates/tools/src/fs/mod.rs b/crates/tools/src/fs/mod.rs
index 7d916623a..ae41ceb70 100644
--- a/crates/tools/src/fs/mod.rs
+++ b/crates/tools/src/fs/mod.rs
@@ -9,6 +9,7 @@ pub mod apply_patch;
 pub mod local;
 pub mod memory;
 pub mod path;
+pub mod pattern;
 pub mod read_only;
 pub mod scoped;
 pub mod scoped_local;
@@ -42,6 +43,9 @@ pub enum FsError {
     #[error("filesystem path already exists: {path}")]
     AlreadyExists { path: FsPath },
 
+    #[error("file changed since it was read: {path}; read it again before writing")]
+    Conflict { path: FsPath },
+
     #[error("filesystem permission denied for path: {path}")]
     PermissionDenied { path: FsPath },
 
@@ -111,21 +115,45 @@ impl RemoveOptions {
     }
 }
 
-#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize, Deserialize)]
-pub struct CopyOptions {
-    pub recursive: bool,
+#[derive(Clone, Copy, Debug, Default, Eq, PartialEq, Serialize, Deserialize)]
+pub struct RenameOptions {
+    /// Replace an existing destination file; otherwise an existing
+    /// destination is [`FsError::AlreadyExists`].
+    pub overwrite: bool,
 }
 
-impl CopyOptions {
-    pub const fn file() -> Self {
-        Self { recursive: false }
+/// Opaque token naming one version of a file's content, as the backend
+/// reported it on a read. Equal tokens for one path mean unchanged content.
+#[derive(Clone, Debug, Eq, PartialEq, Hash, Serialize, Deserialize)]
+pub struct FsVersion(String);
+
+impl FsVersion {
+    pub fn new(value: impl Into<String>) -> Self {
+        Self(value.into())
     }
 
-    pub const fn recursive() -> Self {
-        Self { recursive: true }
+    pub fn as_str(&self) -> &str {
+        &self.0
     }
 }
 
+/// A whole-file read together with the version it observed, when the
+/// backend tracks versions.
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct VersionedRead {
+    pub bytes: Vec<u8>,
+    pub version: Option<FsVersion>,
+}
+
+/// Preconditions of a write.
+#[derive(Clone, Debug, Default, Eq, PartialEq)]
+pub struct WriteOptions {
+    /// Write only while the file still has this version; otherwise the write
+    /// fails with [`FsError::Conflict`]. Only versions the same backend
+    /// returned from [`FileSystem::read_file_versioned`] are meaningful.
+    pub if_match: Option<FsVersion>,
+}
+
 #[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
 pub struct FileMetadata {
     pub is_directory: bool,
@@ -152,9 +180,11 @@ pub struct FsTextSearchRequest {
     /// generic fallback compiles, so a pattern cannot succeed on one path and
     /// fail on the other.
     pub pattern: String,
-    /// Optional glob matched against the root-relative path or file name.
+    /// Optional path pattern in the [`pattern`] grammar selecting the files
+    /// searched.
     pub include: Option<String>,
     pub case_sensitive: bool,
+    /// Deepest entry depth searched; the root's direct children are depth 1.
     pub max_depth: Option<usize>,
     pub limits: FsSearchLimits,
 }
@@ -172,6 +202,8 @@ pub struct FsTextSearchMatch {
     pub path: FsPath,
     pub line_number: u64,
     pub line: String,
+    /// The line was cut at the backend's line length bound.
+    pub line_truncated: bool,
 }
 
 /// Why a bounded search stopped before exhausting the tree.
@@ -182,6 +214,8 @@ pub enum FsSearchStop {
     FileLimit,
     ByteLimit,
     TimeLimit,
+    /// The matches filled the backend's response budget.
+    ResponseLimit,
 }
 
 #[derive(Clone, Debug, Eq, PartialEq)]
@@ -189,6 +223,9 @@ pub struct FsTextSearchResponse {
     pub matches: Vec<FsTextSearchMatch>,
     pub files_searched: u64,
     pub bytes_searched: u64,
+    /// Files left out because they exceeded the remaining byte budget, were
+    /// binary or could not be read; none of them ends the search.
+    pub skipped_files: u64,
     pub stopped: Option<FsSearchStop>,
 }
 
@@ -197,7 +234,9 @@ pub struct FsTextSearchResponse {
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub struct FsGlobRequest {
     pub root: FsPath,
+    /// A path pattern in the [`pattern`] grammar.
     pub pattern: String,
+    /// Deepest entry depth visited; the root's direct children are depth 1.
     pub max_depth: Option<usize>,
     pub limits: FsGlobLimits,
 }
@@ -223,7 +262,7 @@ pub struct FsGlobResponse {
 pub struct FsRangedRead {
     pub bytes: Vec<u8>,
     pub file_size: u64,
-    /// True when `bytes` is a strict prefix range of the file.
+    /// Bytes exist after `offset` plus the length of `bytes`.
     pub truncated: bool,
 }
 
@@ -265,6 +304,31 @@ pub trait FileSystem: Send + Sync {
 
     async fn write_file(&self, path: &FsPath, contents: Vec<u8>) -> FsResult<()>;
 
+    /// Read a whole file together with its version. Backends without
+    /// versions report none, and their writes need no precondition.
+    async fn read_file_versioned(&self, path: &FsPath) -> FsResult<VersionedRead> {
+        Ok(VersionedRead {
+            bytes: self.read_file(path).await?,
+            version: None,
+        })
+    }
+
+    /// Write a whole file under `options`. Backends without versions never
+    /// hand out a version, so the default is only reached without one.
+    async fn write_file_with(
+        &self,
+        path: &FsPath,
+        contents: Vec<u8>,
+        options: WriteOptions,
+    ) -> FsResult<()> {
+        if options.if_match.is_some() {
+            return Err(FsError::Unsupported {
+                message: "filesystem does not track file versions".into(),
+            });
+        }
+        self.write_file(path, contents).await
+    }
+
     /// Link existing immutable content without loading its bytes into the tool worker.
     async fn write_file_ref(
         &self,
@@ -288,12 +352,36 @@ pub trait FileSystem: Send + Sync {
 
     async fn remove(&self, path: &FsPath, options: RemoveOptions) -> FsResult<()>;
 
-    async fn copy(
+    /// Move a file to `destination_path`, keeping its mode. The default
+    /// writes the destination and removes the source; backends with a
+    /// native rename override it to move atomically.
+    async fn rename(
         &self,
         source_path: &FsPath,
         destination_path: &FsPath,
-        options: CopyOptions,
-    ) -> FsResult<()>;
+        options: RenameOptions,
+    ) -> FsResult<()> {
+        let metadata = self.get_metadata(source_path).await?;
+        if !metadata.is_file {
+            return Err(FsError::Unsupported {
+                message: format!("{source_path} is not a file; only files can be moved"),
+            });
+        }
+        if !options.overwrite {
+            match self.get_metadata(destination_path).await {
+                Ok(_) => {
+                    return Err(FsError::AlreadyExists {
+                        path: destination_path.clone(),
+                    });
+                }
+                Err(FsError::NotFound { .. }) => {}
+                Err(error) => return Err(error),
+            }
+        }
+        let contents = self.read_file(source_path).await?;
+        self.write_file(destination_path, contents).await?;
+        self.remove(source_path, RemoveOptions::file()).await
+    }
 
     /// Execute a bounded text search natively when the backend supports it.
     ///
@@ -315,6 +403,12 @@ pub trait FileSystem: Send + Sync {
         Ok(None)
     }
 
+    /// Largest range one [`read_file_range`](Self::read_file_range) returns,
+    /// when the backend bounds it; longer requests come back `truncated`.
+    fn max_read_bytes(&self) -> Option<u64> {
+        None
+    }
+
     /// Read at most `max_bytes` starting at `offset`, reporting the true file
     /// size. The default transfers the whole file and slices locally;
     /// backends with native range support truncate at the source.
diff --git a/crates/tools/src/fs/pattern.rs b/crates/tools/src/fs/pattern.rs
new file mode 100644
index 000000000..ba3e53ce1
--- /dev/null
+++ b/crates/tools/src/fs/pattern.rs
@@ -0,0 +1,141 @@
+//! The path pattern grammar shared by every glob and include filter.
+//!
+//! Patterns match paths relative to the walk's root, gitignore-style: `*`
+//! and `?` match within one segment, `**` spans segments, `[...]` is a
+//! character class and `{a,b}` an alternation. A pattern without `/`
+//! matches an entry's name at any depth; a `/` anywhere but at the end
+//! anchors it to the root; a trailing `/` matches directories only. The
+//! backslash is an ordinary character, as in POSIX names. Environment
+//! daemons apply the same grammar to `fs/globFiles`, `fs/searchText`,
+//! `fs/scan` and transfer captures, so the generic fallback and a native
+//! walk select the same entries.
+
+use globset::{GlobBuilder, GlobMatcher};
+
+/// One compiled path pattern.
+#[derive(Clone, Debug)]
+pub struct PathPattern {
+    matcher: GlobMatcher,
+    /// The pattern ended in `/`: only directories match.
+    directory_only: bool,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, thiserror::Error)]
+#[error("invalid path pattern {pattern:?}: {message}")]
+pub struct PathPatternError {
+    pub pattern: String,
+    pub message: String,
+}
+
+impl PathPattern {
+    pub fn new(pattern: &str, ignore_case: bool) -> Result<Self, PathPatternError> {
+        let invalid = |message: String| PathPatternError {
+            pattern: pattern.to_owned(),
+            message,
+        };
+        let (body, directory_only) = match pattern.strip_suffix('/') {
+            Some(body) if !body.is_empty() => (body, true),
+            _ => (pattern, false),
+        };
+        if body.is_empty() || body == "/" {
+            return Err(invalid("pattern must not be empty".into()));
+        }
+        let glob = if let Some(anchored) = body.strip_prefix('/') {
+            anchored.to_owned()
+        } else if body.contains('/') {
+            body.to_owned()
+        } else {
+            format!("**/{body}")
+        };
+        let matcher = GlobBuilder::new(&glob)
+            .literal_separator(true)
+            .backslash_escape(false)
+            .case_insensitive(ignore_case)
+            .build()
+            .map_err(|error| invalid(error.kind().to_string()))?
+            .compile_matcher();
+        Ok(Self {
+            matcher,
+            directory_only,
+        })
+    }
+
+    /// Whether the entry at `relative` (segments joined by `/`, no leading
+    /// `/`) below the walk's root matches; `is_dir` says whether that entry
+    /// is a directory.
+    pub fn matches(&self, relative: &str, is_dir: bool) -> bool {
+        (is_dir || !self.directory_only) && self.matcher.is_match(relative)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn matches(pattern: &str, path: &str) -> bool {
+        PathPattern::new(pattern, false)
+            .unwrap()
+            .matches(path, false)
+    }
+
+    #[test]
+    fn star_stays_within_one_segment() {
+        assert!(matches("src/*.rs", "src/lib.rs"));
+        assert!(!matches("src/*.rs", "src/deep/nested.rs"));
+        assert!(matches("src/**/*.rs", "src/deep/nested.rs"));
+        assert!(matches("**/*.rs", "lib.rs"));
+    }
+
+    #[test]
+    fn a_pattern_without_a_slash_matches_names_at_any_depth() {
+        assert!(matches("*.md", "README.md"));
+        assert!(matches("*.md", "docs/guide/intro.md"));
+        assert!(matches("SKILL.md", "review/SKILL.md"));
+    }
+
+    #[test]
+    fn a_leading_slash_anchors_to_the_root() {
+        assert!(matches("/*.md", "README.md"));
+        assert!(!matches("/*.md", "docs/intro.md"));
+        assert!(matches("/docs/*.md", "docs/intro.md"));
+    }
+
+    #[test]
+    fn classes_alternations_and_case() {
+        assert!(matches("*.{rs,toml}", "Cargo.toml"));
+        assert!(matches("file[0-9].txt", "dir/file7.txt"));
+        assert!(!matches("*.RS", "lib.rs"));
+        assert!(
+            PathPattern::new("*.RS", true)
+                .unwrap()
+                .matches("lib.rs", false)
+        );
+        assert!(PathPattern::new("", false).is_err());
+        assert!(PathPattern::new("/", false).is_err());
+        assert!(PathPattern::new("[", false).is_err());
+    }
+
+    #[test]
+    fn a_slash_inside_anchors_like_a_leading_one() {
+        assert!(matches("docs/*.md", "docs/intro.md"));
+        assert!(!matches("docs/*.md", "nested/docs/intro.md"));
+    }
+
+    #[test]
+    fn a_trailing_slash_matches_directories_only() {
+        let build = PathPattern::new("build/", false).unwrap();
+        assert!(build.matches("build", true));
+        assert!(build.matches("nested/build", true));
+        assert!(!build.matches("build", false));
+        let anchored = PathPattern::new("/build/", false).unwrap();
+        assert!(anchored.matches("build", true));
+        assert!(!anchored.matches("nested/build", true));
+    }
+
+    #[test]
+    fn the_backslash_is_an_ordinary_character() {
+        assert!(matches("a\\*.txt", "a\\b.txt"));
+        assert!(!matches("a\\*.txt", "a*.txt"));
+        assert!(matches("*.txt", "dir/back\\slash.txt"));
+    }
+}
diff --git a/crates/tools/src/fs/read_only.rs b/crates/tools/src/fs/read_only.rs
index 8d32e06a5..c3f3cb52b 100644
--- a/crates/tools/src/fs/read_only.rs
+++ b/crates/tools/src/fs/read_only.rs
@@ -6,8 +6,9 @@ use async_trait::async_trait;
 use harness::ToolEffect;
 
 use crate::fs::{
-    CopyOptions, CreateDirectoryOptions, FileAccessPolicy, FileMetadata, FileSystem, FsError,
-    FsPath, FsResult, ReadDirectoryEntry, RemoveOptions,
+    CreateDirectoryOptions, FileAccessPolicy, FileMetadata, FileSystem, FsError, FsGlobRequest,
+    FsGlobResponse, FsPath, FsRangedRead, FsResult, FsTextSearchRequest, FsTextSearchResponse,
+    ReadDirectoryEntry, RemoveOptions, RenameOptions, VersionedRead, WriteOptions,
 };
 
 #[derive(Clone)]
@@ -91,13 +92,50 @@ impl FileSystem for ReadOnlyFileSystem {
         Err(self.deny_write(path))
     }
 
-    async fn copy(
+    async fn rename(
         &self,
-        _source_path: &FsPath,
-        destination_path: &FsPath,
-        _options: CopyOptions,
+        source_path: &FsPath,
+        _destination_path: &FsPath,
+        _options: RenameOptions,
     ) -> FsResult<()> {
-        Err(self.deny_write(destination_path))
+        Err(self.deny_write(source_path))
+    }
+
+    async fn read_file_versioned(&self, path: &FsPath) -> FsResult<VersionedRead> {
+        self.inner.read_file_versioned(path).await
+    }
+
+    async fn write_file_with(
+        &self,
+        path: &FsPath,
+        _contents: Vec<u8>,
+        _options: WriteOptions,
+    ) -> FsResult<()> {
+        Err(self.deny_write(path))
+    }
+
+    async fn search_text(
+        &self,
+        request: &FsTextSearchRequest,
+    ) -> FsResult<Option<FsTextSearchResponse>> {
+        self.inner.search_text(request).await
+    }
+
+    async fn glob_files(&self, request: &FsGlobRequest) -> FsResult<Option<FsGlobResponse>> {
+        self.inner.glob_files(request).await
+    }
+
+    fn max_read_bytes(&self) -> Option<u64> {
+        self.inner.max_read_bytes()
+    }
+
+    async fn read_file_range(
+        &self,
+        path: &FsPath,
+        offset: u64,
+        max_bytes: Option<u64>,
+    ) -> FsResult<FsRangedRead> {
+        self.inner.read_file_range(path, offset, max_bytes).await
     }
 
     fn drain_tool_effects(&self) -> Vec<ToolEffect> {
diff --git a/crates/tools/src/fs/scoped.rs b/crates/tools/src/fs/scoped.rs
index a604f4c7c..7886a7522 100644
--- a/crates/tools/src/fs/scoped.rs
+++ b/crates/tools/src/fs/scoped.rs
@@ -6,8 +6,9 @@ use async_trait::async_trait;
 use harness::ToolEffect;
 
 use crate::fs::{
-    CopyOptions, CreateDirectoryOptions, FileAccessPolicy, FileMetadata, FileSystem, FsError,
-    FsPath, FsResult, ReadDirectoryEntry, RemoveOptions,
+    CreateDirectoryOptions, FileAccessPolicy, FileMetadata, FileSystem, FsError, FsPath,
+    FsRangedRead, FsResult, ReadDirectoryEntry, RemoveOptions, RenameOptions, VersionedRead,
+    WriteOptions,
 };
 
 #[derive(Clone)]
@@ -150,17 +151,52 @@ impl FileSystem for ScopedFileSystem {
         self.inner.remove(&resolved, options).await
     }
 
-    async fn copy(
+    async fn rename(
         &self,
         source_path: &FsPath,
         destination_path: &FsPath,
-        options: CopyOptions,
+        options: RenameOptions,
     ) -> FsResult<()> {
         let resolved_source = self.resolved_path(source_path)?;
         let resolved_destination = self.resolved_path(destination_path)?;
+        self.ensure_write_allowed(source_path, &resolved_source)?;
         self.ensure_write_allowed(destination_path, &resolved_destination)?;
         self.inner
-            .copy(&resolved_source, &resolved_destination, options)
+            .rename(&resolved_source, &resolved_destination, options)
+            .await
+    }
+
+    async fn read_file_versioned(&self, path: &FsPath) -> FsResult<VersionedRead> {
+        let resolved = self.resolved_path(path)?;
+        self.inner.read_file_versioned(&resolved).await
+    }
+
+    async fn write_file_with(
+        &self,
+        path: &FsPath,
+        contents: Vec<u8>,
+        options: WriteOptions,
+    ) -> FsResult<()> {
+        let resolved = self.resolved_path(path)?;
+        self.ensure_write_allowed(path, &resolved)?;
+        self.inner
+            .write_file_with(&resolved, contents, options)
+            .await
+    }
+
+    fn max_read_bytes(&self) -> Option<u64> {
+        self.inner.max_read_bytes()
+    }
+
+    async fn read_file_range(
+        &self,
+        path: &FsPath,
+        offset: u64,
+        max_bytes: Option<u64>,
+    ) -> FsResult<FsRangedRead> {
+        let resolved = self.resolved_path(path)?;
+        self.inner
+            .read_file_range(&resolved, offset, max_bytes)
             .await
     }
 
diff --git a/crates/tools/src/fs/scoped_local.rs b/crates/tools/src/fs/scoped_local.rs
index 1ee50b073..a068b6000 100644
--- a/crates/tools/src/fs/scoped_local.rs
+++ b/crates/tools/src/fs/scoped_local.rs
@@ -9,8 +9,8 @@ use std::{
 use async_trait::async_trait;
 
 use crate::fs::{
-    CopyOptions, CreateDirectoryOptions, FileAccessPolicy, FileMetadata, FileSystem, FsError,
-    FsPath, FsResult, ReadDirectoryEntry, RemoveOptions,
+    CreateDirectoryOptions, FileAccessPolicy, FileMetadata, FileSystem, FsError, FsPath, FsResult,
+    ReadDirectoryEntry, RemoveOptions, RenameOptions,
 };
 
 #[derive(Clone, Debug)]
@@ -286,104 +286,36 @@ impl FileSystem for ScopedLocalFileSystem {
         .map_err(|error| map_io_error(path, error))
     }
 
-    async fn copy(
+    async fn rename(
         &self,
         source_path: &FsPath,
         destination_path: &FsPath,
-        options: CopyOptions,
+        options: RenameOptions,
     ) -> FsResult<()> {
         if !self.writable {
             return Err(FsError::PermissionDenied {
-                path: destination_path.clone(),
+                path: source_path.clone(),
             });
         }
-        let source_host_path = self.resolve_existing(source_path)?;
+        if source_path.is_root() {
+            return Err(FsError::InvalidInput {
+                message: "cannot move scoped local filesystem root".to_string(),
+            });
+        }
+        let source_host_path = self.unresolved_host_path(source_path)?;
+        self.ensure_parent_inside_root(source_path, &source_host_path)?;
         let destination_host_path = self.resolve_mutation_target(destination_path)?;
-        copy_path(
+        crate::fs::local::rename_path(
             source_path,
             destination_path,
             &source_host_path,
             &destination_host_path,
             options,
         )
+        .await
     }
 }
 
-fn copy_path(
-    source_fs_path: &FsPath,
-    destination_fs_path: &FsPath,
-    source_host_path: &Path,
-    destination_host_path: &Path,
-    options: CopyOptions,
-) -> FsResult<()> {
-    let metadata = std::fs::symlink_metadata(source_host_path)
-        .map_err(|error| map_io_error(source_fs_path, error))?;
-    let file_type = metadata.file_type();
-
-    if file_type.is_symlink() {
-        return Err(FsError::Unsupported {
-            message: "copying symlinks is not supported by ScopedLocalFileSystem".to_string(),
-        });
-    }
-
-    if file_type.is_dir() {
-        if !options.recursive {
-            return Err(FsError::InvalidInput {
-                message: "copy requires recursive: true when source is a directory".to_string(),
-            });
-        }
-        if destination_host_path.starts_with(source_host_path) {
-            return Err(FsError::InvalidInput {
-                message: "cannot copy a directory to itself or one of its descendants".to_string(),
-            });
-        }
-        return copy_dir_recursive(source_host_path, destination_host_path)
-            .map_err(|error| map_io_error(destination_fs_path, error));
-    }
-
-    if file_type.is_file() {
-        std::fs::copy(source_host_path, destination_host_path)
-            .map(|_| ())
-            .map_err(|error| map_io_error(destination_fs_path, error))?;
-        return Ok(());
-    }
-
-    Err(FsError::Unsupported {
-        message: format!("unsupported source file type: {}", source_fs_path),
-    })
-}
-
-fn copy_dir_recursive(source: &Path, destination: &Path) -> io::Result<()> {
-    std::fs::create_dir(destination)?;
-    for entry in std::fs::read_dir(source)? {
-        let entry = entry?;
-        let source_path = entry.path();
-        let destination_path = destination.join(entry.file_name());
-        let metadata = std::fs::symlink_metadata(&source_path)?;
-        let file_type = metadata.file_type();
-        if file_type.is_symlink() {
-            return Err(io::Error::new(
-                io::ErrorKind::Unsupported,
-                format!(
-                    "copying symlinks is not supported: {}",
-                    source_path.display()
-                ),
-            ));
-        }
-        if file_type.is_dir() {
-            copy_dir_recursive(&source_path, &destination_path)?;
-        } else if file_type.is_file() {
-            std::fs::copy(&source_path, &destination_path)?;
-        } else {
-            return Err(io::Error::new(
-                io::ErrorKind::Unsupported,
-                format!("unsupported file type: {}", source_path.display()),
-            ));
-        }
-    }
-    Ok(())
-}
-
 fn system_time_to_unix_ms(time: SystemTime) -> i64 {
     time.duration_since(UNIX_EPOCH)
         .map(|duration| duration.as_millis().try_into().unwrap_or(i64::MAX))
diff --git a/crates/tools/src/fs/tools/edit_file.rs b/crates/tools/src/fs/tools/edit_file.rs
index 79fdc6a70..657ebf029 100644
--- a/crates/tools/src/fs/tools/edit_file.rs
+++ b/crates/tools/src/fs/tools/edit_file.rs
@@ -4,7 +4,7 @@ use serde::{Deserialize, Serialize};
 
 use crate::{
     error::ToolResult,
-    fs::{FsError, FsPath, FsToolContext},
+    fs::{FsError, FsPath, FsToolContext, WriteOptions},
 };
 
 use super::{invalid_request, resolve_path};
@@ -35,8 +35,8 @@ pub async fn invoke_edit_file(
     }
 
     let resolved_path = resolve_path(ctx, &args.path)?;
-    let contents = ctx.fs.read_file(&resolved_path).await?;
-    let contents = String::from_utf8(contents).map_err(FsError::invalid_data)?;
+    let read = ctx.fs.read_file_versioned(&resolved_path).await?;
+    let contents = String::from_utf8(read.bytes).map_err(FsError::invalid_data)?;
     let replacements = contents.matches(&args.old_string).count();
 
     if replacements == 0 {
@@ -60,7 +60,17 @@ pub async fn invoke_edit_file(
     };
     let bytes = updated.into_bytes();
     let bytes_written = bytes.len();
-    ctx.fs.write_file(&resolved_path, bytes).await?;
+    // Conditional on the version read: a concurrent change is a conflict,
+    // never silently overwritten.
+    ctx.fs
+        .write_file_with(
+            &resolved_path,
+            bytes,
+            WriteOptions {
+                if_match: read.version,
+            },
+        )
+        .await?;
 
     Ok(EditFileResult {
         path: args.path,
diff --git a/crates/tools/src/fs/tools/glob.rs b/crates/tools/src/fs/tools/glob.rs
index 9c1619b53..55a737c6a 100644
--- a/crates/tools/src/fs/tools/glob.rs
+++ b/crates/tools/src/fs/tools/glob.rs
@@ -2,15 +2,17 @@
 
 use std::time::{Duration, Instant};
 
-use glob::Pattern;
 use serde::{Deserialize, Serialize};
 
 use crate::{
     error::ToolResult,
-    fs::{FsGlobLimits, FsGlobRequest, FsPath, FsSearchStop, FsToolContext},
+    fs::{FsGlobLimits, FsGlobRequest, FsPath, FsSearchStop, FsToolContext, pattern::PathPattern},
 };
 
-use super::{collect_file_paths_bounded, invalid_request, relative_path_string, resolve_path};
+use super::{
+    collect_file_paths_bounded, invalid_request, relative_path_string, resolve_path,
+    root_relative_pattern,
+};
 
 pub const DEFAULT_GLOB_LIMIT: usize = 1_000;
 
@@ -38,8 +40,6 @@ pub async fn invoke_glob(ctx: &FsToolContext, args: GlobArgs) -> ToolResult<Glob
     if args.pattern.is_empty() {
         return Err(invalid_request("glob pattern must not be empty"));
     }
-    let pattern = Pattern::new(&args.pattern)
-        .map_err(|error| invalid_request(format!("invalid glob pattern: {error}")))?;
     let requested_limit = args.limit.unwrap_or(DEFAULT_GLOB_LIMIT);
     if requested_limit == 0 {
         return Err(invalid_request("glob limit must be 1 or greater"));
@@ -56,12 +56,15 @@ pub async fn invoke_glob(ctx: &FsToolContext, args: GlobArgs) -> ToolResult<Glob
         Some(path) => resolve_path(ctx, path)?,
         None => ctx.fs_cwd.clone().unwrap_or_else(FsPath::current_dir),
     };
+    let wire_pattern = root_relative_pattern(&args.pattern, &root);
+    let pattern = PathPattern::new(&wire_pattern, false)
+        .map_err(|error| invalid_request(error.to_string()))?;
 
     // A backend with a native enumeration (e.g. a remote host) walks the
     // tree locally under the same bounds and returns only matching paths.
     let native_request = FsGlobRequest {
         root: root.clone(),
-        pattern: args.pattern.clone(),
+        pattern: wire_pattern,
         max_depth: args.max_depth,
         limits,
     };
@@ -90,7 +93,7 @@ pub async fn invoke_glob(ctx: &FsToolContext, args: GlobArgs) -> ToolResult<Glob
     let mut matches = Vec::new();
 
     for path in paths {
-        if glob_matches(&pattern, &args.pattern, &path, &root) {
+        if pattern.matches(&relative_path_string(&path, &root), false) {
             // Like the match budget elsewhere, truncation is reported only
             // when a match beyond the cap actually arrives.
             if matches.len() as u64 >= limits.max_matches {
@@ -110,19 +113,6 @@ pub async fn invoke_glob(ctx: &FsToolContext, args: GlobArgs) -> ToolResult<Glob
     })
 }
 
-fn glob_matches(pattern: &Pattern, pattern_text: &str, path: &FsPath, root: &FsPath) -> bool {
-    if pattern_text.starts_with('/') {
-        return pattern.matches(path.as_str());
-    }
-
-    let relative = relative_path_string(path, root);
-    pattern.matches(&relative)
-        || (!pattern_text.contains('/')
-            && path
-                .file_name()
-                .is_some_and(|file_name| pattern.matches(file_name)))
-}
-
 #[cfg(test)]
 mod tests {
     use std::sync::Arc;
@@ -172,6 +162,130 @@ mod tests {
         assert!(!result.truncated);
     }
 
+    #[tokio::test(flavor = "current_thread")]
+    async fn generic_glob_keeps_star_within_one_segment() {
+        let fs = InMemoryFileSystem::full_access();
+        fs.create_directory(
+            &FsPath::new("/workspace/src/deep").expect("deep"),
+            CreateDirectoryOptions::recursive(),
+        )
+        .await
+        .expect("create deep");
+        for path in ["/workspace/src/lib.rs", "/workspace/src/deep/nested.rs"] {
+            fs.write_file(&FsPath::new(path).unwrap(), Vec::new())
+                .await
+                .expect("write");
+        }
+        let ctx = context(Arc::new(fs)).with_cwd(FsPath::new("/workspace").expect("cwd"));
+        let glob = |pattern: &str| GlobArgs {
+            pattern: pattern.to_owned(),
+            path: None,
+            max_depth: None,
+            limit: None,
+        };
+
+        let shallow = invoke_glob(&ctx, glob("src/*.rs")).await.expect("glob");
+        assert_eq!(
+            shallow.matches,
+            vec![FsPath::new("/workspace/src/lib.rs").unwrap()]
+        );
+        let named = invoke_glob(&ctx, glob("*.rs")).await.expect("glob");
+        assert_eq!(named.matches.len(), 2, "a bare name matches at any depth");
+        let anchored = invoke_glob(&ctx, glob("/workspace/*.rs"))
+            .await
+            .expect("glob");
+        assert!(
+            anchored.matches.is_empty(),
+            "an absolute pattern below the root anchors to it"
+        );
+        let absolute = invoke_glob(&ctx, glob("/workspace/src/**/*.rs"))
+            .await
+            .expect("glob");
+        assert_eq!(absolute.matches.len(), 2);
+        let rooted = invoke_glob(&ctx, glob("/src/*.rs")).await.expect("glob");
+        assert_eq!(
+            rooted.matches,
+            vec![FsPath::new("/workspace/src/lib.rs").unwrap()],
+            "a leading '/' anchors to the root, as in gitignore"
+        );
+        let elsewhere = invoke_glob(&ctx, glob("/elsewhere/*.rs"))
+            .await
+            .expect("glob");
+        assert!(
+            elsewhere.matches.is_empty(),
+            "any other leading '/' pattern anchors to the root too"
+        );
+        let direct = invoke_glob(
+            &ctx,
+            GlobArgs {
+                max_depth: Some(2),
+                ..glob("**/*.rs")
+            },
+        )
+        .await
+        .expect("glob");
+        assert_eq!(
+            direct.matches,
+            vec![FsPath::new("/workspace/src/lib.rs").unwrap()],
+            "depth 1 is the root's direct children"
+        );
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn generic_glob_applies_the_environment_walk_defaults() {
+        let fs = InMemoryFileSystem::full_access();
+        for directory in [
+            "/repo/.git",
+            "/repo/.cache",
+            "/repo/src/gen",
+            "/repo/target",
+        ] {
+            fs.create_directory(
+                &FsPath::new(directory).unwrap(),
+                CreateDirectoryOptions::recursive(),
+            )
+            .await
+            .expect("create directory");
+        }
+        for (path, contents) in [
+            ("/.gitignore", "*.log\n"),
+            ("/repo/.gitignore", "target/\n"),
+            ("/repo/src/.ignore", "gen/\n!keep.log\n"),
+            ("/repo/.git/HEAD.rs", ""),
+            ("/repo/.cache/hit.rs", ""),
+            ("/repo/.env.rs", ""),
+            ("/repo/target/out.rs", ""),
+            ("/repo/src/gen/made.rs", ""),
+            ("/repo/src/lib.rs", ""),
+            ("/repo/src/debug.log", ""),
+            ("/repo/src/keep.log", ""),
+        ] {
+            fs.write_file(&FsPath::new(path).unwrap(), contents.as_bytes().to_vec())
+                .await
+                .expect("write");
+        }
+        let ctx = context(Arc::new(fs)).with_cwd(FsPath::new("/repo").expect("cwd"));
+        let glob = |pattern: &str| GlobArgs {
+            pattern: pattern.to_owned(),
+            path: None,
+            max_depth: None,
+            limit: None,
+        };
+
+        let sources = invoke_glob(&ctx, glob("*.rs")).await.expect("glob");
+        assert_eq!(
+            sources.matches,
+            vec![FsPath::new("/repo/src/lib.rs").unwrap()],
+            "hidden names, VCS directories and ignored paths are left out"
+        );
+        let logs = invoke_glob(&ctx, glob("*.log")).await.expect("glob");
+        assert_eq!(
+            logs.matches,
+            vec![FsPath::new("/repo/src/keep.log").unwrap()],
+            "an ancestor's rule applies and a deeper negation overrides it"
+        );
+    }
+
     #[tokio::test(flavor = "current_thread")]
     async fn invoke_glob_applies_limit() {
         let fs = InMemoryFileSystem::full_access();
@@ -282,17 +396,6 @@ mod tests {
             self.inner.remove(path, options).await
         }
 
-        async fn copy(
-            &self,
-            source_path: &FsPath,
-            destination_path: &FsPath,
-            options: crate::fs::CopyOptions,
-        ) -> crate::fs::FsResult<()> {
-            self.inner
-                .copy(source_path, destination_path, options)
-                .await
-        }
-
         async fn glob_files(
             &self,
             request: &FsGlobRequest,
diff --git a/crates/tools/src/fs/tools/grep.rs b/crates/tools/src/fs/tools/grep.rs
index 42836e339..830a48237 100644
--- a/crates/tools/src/fs/tools/grep.rs
+++ b/crates/tools/src/fs/tools/grep.rs
@@ -2,16 +2,21 @@
 
 use std::time::{Duration, Instant};
 
-use glob::Pattern;
 use regex::RegexBuilder;
 use serde::{Deserialize, Serialize};
 
 use crate::{
     error::ToolResult,
-    fs::{FsPath, FsSearchLimits, FsSearchStop, FsTextSearchRequest, FsToolContext},
+    fs::{
+        FsPath, FsSearchLimits, FsSearchStop, FsTextSearchRequest, FsToolContext,
+        pattern::PathPattern,
+    },
 };
 
-use super::{collect_file_paths_bounded, invalid_request, relative_path_string, resolve_path};
+use super::{
+    collect_file_paths_bounded, invalid_request, relative_path_string, resolve_path,
+    root_relative_pattern,
+};
 
 pub const DEFAULT_GREP_LIMIT: usize = 1_000;
 
@@ -31,6 +36,9 @@ pub struct GrepMatch {
     pub path: FsPath,
     pub line_number: usize,
     pub line: String,
+    /// The line was cut at the environment's line length bound.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub line_truncated: bool,
 }
 
 #[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize, schemars::JsonSchema)]
@@ -43,6 +51,14 @@ pub struct GrepResult {
     /// within its bounds.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub stopped: Option<FsSearchStop>,
+    /// Files left out because they exceeded the remaining byte budget, were
+    /// binary or could not be read. Skipping never ends the search.
+    #[serde(default, skip_serializing_if = "is_zero")]
+    pub skipped_file_count: u64,
+}
+
+fn is_zero(value: &u64) -> bool {
+    *value == 0
 }
 
 pub async fn invoke_grep(ctx: &FsToolContext, args: GrepArgs) -> ToolResult<GrepResult> {
@@ -53,12 +69,6 @@ pub async fn invoke_grep(ctx: &FsToolContext, args: GrepArgs) -> ToolResult<Grep
         .case_insensitive(!args.case_sensitive)
         .build()
         .map_err(|error| invalid_request(format!("invalid grep regex: {error}")))?;
-    let include = args
-        .include
-        .as_deref()
-        .map(Pattern::new)
-        .transpose()
-        .map_err(|error| invalid_request(format!("invalid grep include glob: {error}")))?;
     let requested_limit = args.limit.unwrap_or(DEFAULT_GREP_LIMIT);
     if requested_limit == 0 {
         return Err(invalid_request("grep limit must be 1 or greater"));
@@ -77,6 +87,15 @@ pub async fn invoke_grep(ctx: &FsToolContext, args: GrepArgs) -> ToolResult<Grep
         Some(path) => resolve_path(ctx, path)?,
         None => ctx.fs_cwd.clone().unwrap_or_else(FsPath::current_dir),
     };
+    let wire_include = args
+        .include
+        .as_deref()
+        .map(|include| root_relative_pattern(include, &root));
+    let include = wire_include
+        .as_deref()
+        .map(|include| PathPattern::new(include, false))
+        .transpose()
+        .map_err(|error| invalid_request(format!("invalid grep include: {error}")))?;
 
     // A backend with a native search (e.g. a remote host) performs the
     // traversal and matching locally under the same bounds and returns only
@@ -84,7 +103,7 @@ pub async fn invoke_grep(ctx: &FsToolContext, args: GrepArgs) -> ToolResult<Grep
     let native_request = FsTextSearchRequest {
         root: root.clone(),
         pattern: args.pattern.clone(),
-        include: args.include.clone(),
+        include: wire_include,
         case_sensitive: args.case_sensitive,
         max_depth: args.max_depth,
         limits,
@@ -97,6 +116,7 @@ pub async fn invoke_grep(ctx: &FsToolContext, args: GrepArgs) -> ToolResult<Grep
                 path: item.path,
                 line_number: item.line_number as usize,
                 line: item.line,
+                line_truncated: item.line_truncated,
             })
             .collect::<Vec<_>>();
         return Ok(GrepResult {
@@ -105,6 +125,7 @@ pub async fn invoke_grep(ctx: &FsToolContext, args: GrepArgs) -> ToolResult<Grep
             matches,
             truncated: native.stopped.is_some(),
             stopped: native.stopped,
+            skipped_file_count: native.skipped_files,
         });
     }
 
@@ -113,13 +134,16 @@ pub async fn invoke_grep(ctx: &FsToolContext, args: GrepArgs) -> ToolResult<Grep
 
 /// Generic fallback over the `FileSystem` interface, bounded by files
 /// visited, cumulative bytes read, matches returned, and elapsed time. It
-/// returns a typed truncated outcome instead of scanning without bound.
+/// returns a typed truncated outcome instead of scanning without bound. A
+/// file larger than the remaining byte budget is skipped and counted, as an
+/// environment's native search does, so one large file never hides the
+/// rest of the tree.
 async fn bounded_generic_grep(
     ctx: &FsToolContext,
     args: GrepArgs,
     root: FsPath,
     regex: regex::Regex,
-    include: Option<Pattern>,
+    include: Option<PathPattern>,
     limits: FsSearchLimits,
 ) -> ToolResult<GrepResult> {
     let started = Instant::now();
@@ -136,10 +160,17 @@ async fn bounded_generic_grep(
     let mut stopped = enumeration_stop;
     let mut matches = Vec::new();
     let mut bytes_searched = 0u64;
+    let mut skipped_file_count = 0u64;
 
     'files: for path in paths {
+        // A file root is matched by its name, as if its parent were walked.
+        let relative = if path == root {
+            root.file_name().unwrap_or_default().to_owned()
+        } else {
+            relative_path_string(&path, &root)
+        };
         if let Some(include) = &include
-            && !path_matches_include(include, &path, &root)
+            && !include.matches(&relative, false)
         {
             continue;
         }
@@ -147,38 +178,24 @@ async fn bounded_generic_grep(
             stopped = Some(FsSearchStop::TimeLimit);
             break;
         }
-
-        // Ranged read: a file beyond the per-file cap or the remaining byte
-        // budget is truncated at the source instead of transferred in full.
         let remaining_budget = limits.max_bytes.saturating_sub(bytes_searched);
-        let per_file_cap = ctx.limits.max_file_read_bytes.saturating_add(1);
-        let read = ctx
-            .fs
-            .read_file_range(
-                &path,
-                0,
-                Some(per_file_cap.min(remaining_budget.saturating_add(1))),
-            )
-            .await?;
-        if read.file_size > ctx.limits.max_file_read_bytes {
-            return Err(invalid_request(format!(
-                "grep would read {} bytes from {}, exceeding max_file_read_bytes={}",
-                read.file_size, path, ctx.limits.max_file_read_bytes
-            )));
-        }
-        if read.truncated {
-            // The file did not fit into the remaining byte budget; partial
-            // content is not searched.
+        if remaining_budget == 0 {
             stopped = Some(FsSearchStop::ByteLimit);
             break;
         }
+
+        // Ranged read: a file beyond the per-file cap or the remaining byte
+        // budget is truncated at the source instead of transferred in full,
+        // and then skipped.
+        let file_budget = remaining_budget.min(ctx.limits.max_file_read_bytes);
+        let read = ctx.fs.read_file_range(&path, 0, Some(file_budget)).await?;
+        if read.truncated {
+            skipped_file_count += 1;
+            continue;
+        }
         bytes_searched = bytes_searched.saturating_add(read.bytes.len() as u64);
-        let over_byte_limit = bytes_searched > limits.max_bytes;
         let Ok(contents) = String::from_utf8(read.bytes) else {
-            if over_byte_limit {
-                stopped = Some(FsSearchStop::ByteLimit);
-                break;
-            }
+            skipped_file_count += 1;
             continue;
         };
 
@@ -192,13 +209,10 @@ async fn bounded_generic_grep(
                     path: path.clone(),
                     line_number: line_index + 1,
                     line: line.to_string(),
+                    line_truncated: false,
                 });
             }
         }
-        if over_byte_limit {
-            stopped = Some(FsSearchStop::ByteLimit);
-            break;
-        }
     }
 
     Ok(GrepResult {
@@ -207,17 +221,10 @@ async fn bounded_generic_grep(
         matches,
         truncated: stopped.is_some(),
         stopped,
+        skipped_file_count,
     })
 }
 
-fn path_matches_include(pattern: &Pattern, path: &FsPath, root: &FsPath) -> bool {
-    let relative = relative_path_string(path, root);
-    pattern.matches(&relative)
-        || path
-            .file_name()
-            .is_some_and(|file_name| pattern.matches(file_name))
-}
-
 #[cfg(test)]
 mod tests {
     use std::sync::Arc;
@@ -226,7 +233,6 @@ mod tests {
 
     use super::*;
     use crate::{
-        error::ToolError,
         fs::{CreateDirectoryOptions, FileSystem, InMemoryFileSystem},
         limits::ToolLimits,
     };
@@ -278,6 +284,7 @@ mod tests {
                 path: FsPath::new("/workspace/src/lib.rs").unwrap(),
                 line_number: 1,
                 line: "pub fn target() {}".to_string(),
+                line_truncated: false,
             }]
         );
         assert!(!result.truncated);
@@ -344,7 +351,7 @@ mod tests {
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn invoke_grep_stops_at_byte_budget_with_a_typed_reason() {
+    async fn invoke_grep_skips_files_over_the_remaining_byte_budget() {
         let fs = InMemoryFileSystem::full_access();
         fs.write_file(
             &FsPath::new("/a.txt").unwrap(),
@@ -377,10 +384,10 @@ mod tests {
         .await
         .expect("grep");
 
-        assert_eq!(result.stopped, Some(FsSearchStop::ByteLimit));
-        assert!(result.truncated);
         // The file that would exceed the remaining budget is truncated at the
-        // source and never searched.
+        // source, never searched, and counted; the walk goes on.
+        assert_eq!(result.stopped, None);
+        assert_eq!(result.skipped_file_count, 1);
         assert_eq!(result.matches.len(), 1);
     }
 
@@ -465,17 +472,6 @@ mod tests {
             self.inner.remove(path, options).await
         }
 
-        async fn copy(
-            &self,
-            source_path: &FsPath,
-            destination_path: &FsPath,
-            options: crate::fs::CopyOptions,
-        ) -> crate::fs::FsResult<()> {
-            self.inner
-                .copy(source_path, destination_path, options)
-                .await
-        }
-
         async fn search_text(
             &self,
             request: &crate::fs::FsTextSearchRequest,
@@ -495,9 +491,11 @@ mod tests {
                     path: FsPath::new("/remote/file.rs").unwrap(),
                     line_number: 7,
                     line: "native target".to_owned(),
+                    line_truncated: false,
                 }],
                 files_searched: 12,
                 bytes_searched: 1024,
+                skipped_files: 0,
                 stopped: Some(FsSearchStop::TimeLimit),
             },
         };
@@ -523,6 +521,7 @@ mod tests {
                 path: FsPath::new("/remote/file.rs").unwrap(),
                 line_number: 7,
                 line: "native target".to_string(),
+                line_truncated: false,
             }]
         );
         assert!(result.truncated);
@@ -530,7 +529,7 @@ mod tests {
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn invoke_grep_enforces_read_byte_limit() {
+    async fn invoke_grep_skips_files_over_the_read_byte_limit() {
         let fs = InMemoryFileSystem::full_access();
         fs.write_file(&FsPath::new("/file.txt").unwrap(), b"hello\n".to_vec())
             .await
@@ -540,7 +539,7 @@ mod tests {
             ..ToolLimits::default()
         });
 
-        let error = invoke_grep(
+        let result = invoke_grep(
             &ctx,
             GrepArgs {
                 pattern: "hello".to_string(),
@@ -552,8 +551,9 @@ mod tests {
             },
         )
         .await
-        .expect_err("grep should fail");
+        .expect("grep");
 
-        assert!(matches!(error, ToolError::InvalidRequest { .. }));
+        assert!(result.matches.is_empty());
+        assert_eq!(result.skipped_file_count, 1);
     }
 }
diff --git a/crates/tools/src/fs/tools/mod.rs b/crates/tools/src/fs/tools/mod.rs
index 2e7266cea..f1a82120c 100644
--- a/crates/tools/src/fs/tools/mod.rs
+++ b/crates/tools/src/fs/tools/mod.rs
@@ -20,4 +20,5 @@ pub use write_file::{WriteFileArgs, WriteFileResult, invoke_write_file};
 
 pub(crate) use shared::{
     collect_file_paths_bounded, invalid_request, relative_path_string, resolve_path,
+    root_relative_pattern,
 };
diff --git a/crates/tools/src/fs/tools/read_file.rs b/crates/tools/src/fs/tools/read_file.rs
index 2ccf4728a..6446af529 100644
--- a/crates/tools/src/fs/tools/read_file.rs
+++ b/crates/tools/src/fs/tools/read_file.rs
@@ -97,18 +97,22 @@ pub async fn invoke_read_file(
     // Ranged read: an oversized file is truncated at the source (when the
     // backend supports ranges) and rejected with its true size instead of
     // being transferred in full.
+    // A backend that bounds one read (an environment's advertised ceiling)
+    // lowers the limit; a file over it is refused, never shown short.
+    let max_bytes = ctx
+        .fs
+        .max_read_bytes()
+        .map_or(ctx.limits.max_file_read_bytes, |ceiling| {
+            ceiling.min(ctx.limits.max_file_read_bytes)
+        });
     let read = ctx
         .fs
-        .read_file_range(
-            &resolved_path,
-            0,
-            Some(ctx.limits.max_file_read_bytes.saturating_add(1)),
-        )
+        .read_file_range(&resolved_path, 0, Some(max_bytes.saturating_add(1)))
         .await?;
-    if read.truncated || read.file_size > ctx.limits.max_file_read_bytes {
+    if read.truncated || read.file_size > max_bytes {
         return Err(invalid_request(format!(
-            "read_file would read {} bytes, exceeding max_file_read_bytes={}",
-            read.file_size, ctx.limits.max_file_read_bytes
+            "read_file would read {} bytes from {resolved_path}, exceeding the {max_bytes}-byte read limit",
+            read.file_size
         )));
     }
     let bytes_read = read.bytes.len();
@@ -371,15 +375,6 @@ mod tests {
         ) -> crate::fs::FsResult<()> {
             unimplemented!()
         }
-
-        async fn copy(
-            &self,
-            _source_path: &FsPath,
-            _destination_path: &FsPath,
-            _options: crate::fs::CopyOptions,
-        ) -> crate::fs::FsResult<()> {
-            unimplemented!()
-        }
     }
 
     #[tokio::test(flavor = "current_thread")]
diff --git a/crates/tools/src/fs/tools/shared.rs b/crates/tools/src/fs/tools/shared.rs
index 0ec97f190..936003dc7 100644
--- a/crates/tools/src/fs/tools/shared.rs
+++ b/crates/tools/src/fs/tools/shared.rs
@@ -25,9 +25,24 @@ pub(crate) fn invalid_request(message: impl Into<String>) -> ToolError {
     }
 }
 
+/// Directories every walk prunes, as environment walks do.
+const VCS_DIRECTORIES: [&str; 4] = [".git", ".hg", ".svn", ".jj"];
+/// Ignore files read per directory, in ascending precedence after
+/// `.git/info/exclude`.
+const IGNORE_FILES: [&str; 2] = [".gitignore", ".ignore"];
+/// Largest ignore file read; longer files are cut.
+const MAX_IGNORE_FILE_BYTES: u64 = 1024 * 1024;
+
 /// Bounded generic traversal shared by the grep and glob fallbacks: stops
 /// enumerating once the file bound or the deadline is reached instead of
-/// walking an arbitrarily large tree.
+/// walking an arbitrarily large tree. `max_depth` counts the root's direct
+/// children as depth 1, as environment walks do.
+///
+/// The walk applies an environment walk's defaults, so a VFS and an
+/// environment select the same files: names starting with `.` are
+/// skipped, `.git`, `.hg`, `.svn` and `.jj` are pruned, and `.gitignore`,
+/// `.ignore` and `.git/info/exclude` apply (ascending precedence, deeper
+/// directories overriding their ancestors, ancestors of `root` included).
 pub(crate) async fn collect_file_paths_bounded(
     ctx: &FsToolContext,
     root: FsPath,
@@ -44,20 +59,49 @@ pub(crate) async fn collect_file_paths_bounded(
         return Ok((Vec::new(), None));
     }
 
+    let mut ancestors = Vec::new();
+    let mut ancestor = root.parent();
+    while let Some(directory) = ancestor {
+        ancestor = directory.parent();
+        ancestors.push(directory);
+    }
+    let mut chain = IgnoreChain::default();
+    for directory in ancestors.into_iter().rev() {
+        chain = chain.with(load_ignores(ctx, &directory).await);
+    }
+
     let mut files = Vec::new();
-    let mut stack = vec![(root, 0usize)];
+    let mut stack = vec![(root, 1usize, chain)];
     let mut stopped = None;
 
-    'walk: while let Some((dir, depth)) = stack.pop() {
+    'walk: while let Some((dir, depth, parent_chain)) = stack.pop() {
         if started.elapsed() >= deadline {
             stopped = Some(crate::fs::FsSearchStop::TimeLimit);
             break;
         }
         let mut entries = ctx.fs.read_directory(&dir).await?;
         entries.sort_by(|left, right| right.file_name.cmp(&left.file_name));
+        let has_ignore_files = entries.iter().any(|entry| {
+            entry.file_name == ".git" || IGNORE_FILES.contains(&entry.file_name.as_str())
+        });
+        let chain = if has_ignore_files {
+            parent_chain.with(load_ignores(ctx, &dir).await)
+        } else {
+            parent_chain
+        };
 
         for entry in entries {
-            let child = dir.join(&entry.file_name).map_err(FsError::from)?;
+            if max_depth.is_some_and(|max_depth| depth > max_depth) {
+                break;
+            }
+            let name = entry.file_name.as_str();
+            if VCS_DIRECTORIES.contains(&name) || name.starts_with('.') {
+                continue;
+            }
+            let child = dir.join(name).map_err(FsError::from)?;
+            if chain.ignores(&child, entry.is_directory) {
+                continue;
+            }
             if entry.is_file {
                 if files.len() as u64 >= max_files {
                     stopped = Some(crate::fs::FsSearchStop::FileLimit);
@@ -65,7 +109,7 @@ pub(crate) async fn collect_file_paths_bounded(
                 }
                 files.push(child);
             } else if entry.is_directory && max_depth.is_none_or(|max_depth| depth < max_depth) {
-                stack.push((child, depth + 1));
+                stack.push((child, depth + 1, chain.clone()));
             }
         }
     }
@@ -74,6 +118,89 @@ pub(crate) async fn collect_file_paths_bounded(
     Ok((files, stopped))
 }
 
+/// The ignore levels in force for one directory, outermost first.
+#[derive(Clone, Default)]
+struct IgnoreChain {
+    levels: std::sync::Arc<Vec<std::sync::Arc<ignore::gitignore::Gitignore>>>,
+}
+
+impl IgnoreChain {
+    fn with(self, level: Option<ignore::gitignore::Gitignore>) -> Self {
+        let Some(level) = level else {
+            return self;
+        };
+        let mut levels = (*self.levels).clone();
+        levels.push(std::sync::Arc::new(level));
+        Self {
+            levels: std::sync::Arc::new(levels),
+        }
+    }
+
+    /// The deepest level with an opinion decides.
+    fn ignores(&self, path: &FsPath, is_dir: bool) -> bool {
+        let candidate = std::path::Path::new(path.as_str());
+        for level in self.levels.iter().rev() {
+            let matched = level.matched(candidate, is_dir);
+            if matched.is_ignore() {
+                return true;
+            }
+            if matched.is_whitelist() {
+                return false;
+            }
+        }
+        false
+    }
+}
+
+/// The ignore level of one directory, or `None` when it has no rules.
+/// Unreadable or missing ignore files count as empty.
+async fn load_ignores(
+    ctx: &FsToolContext,
+    directory: &FsPath,
+) -> Option<ignore::gitignore::Gitignore> {
+    let mut builder = ignore::gitignore::GitignoreBuilder::new(directory.as_str());
+    let mut lines = 0usize;
+    let sources = [".git/info/exclude", IGNORE_FILES[0], IGNORE_FILES[1]];
+    for source in sources {
+        let Ok(path) = directory.join(source) else {
+            continue;
+        };
+        let Ok(read) = ctx
+            .fs
+            .read_file_range(&path, 0, Some(MAX_IGNORE_FILE_BYTES))
+            .await
+        else {
+            continue;
+        };
+        for line in String::from_utf8_lossy(&read.bytes).lines() {
+            if builder.add_line(None, line).is_ok() {
+                lines += 1;
+            }
+        }
+    }
+    if lines == 0 {
+        return None;
+    }
+    builder.build().ok()
+}
+
+/// The model-facing form of a path pattern, in the wire grammar: patterns
+/// match paths relative to the tool's `path`, and a leading `/` anchors to
+/// it, as in gitignore (`/*.rs` selects only `path`'s direct children).
+/// As a convenience, a pattern that spells out `path`'s absolute prefix is
+/// read as an absolute path below it and becomes the anchored form
+/// (`/workspace/src/*.rs` under `/workspace` is `/src/*.rs`).
+pub(crate) fn root_relative_pattern(pattern: &str, root: &FsPath) -> String {
+    if !pattern.starts_with('/') || root.is_root() || !root.is_absolute() {
+        return pattern.to_owned();
+    }
+    pattern
+        .strip_prefix(root.as_str())
+        .and_then(|rest| rest.strip_prefix('/'))
+        .filter(|rest| !rest.is_empty())
+        .map_or_else(|| pattern.to_owned(), |relative| format!("/{relative}"))
+}
+
 pub(crate) fn relative_path_string(path: &FsPath, root: &FsPath) -> String {
     if !path.starts_with(root) {
         return path.as_str().to_string();
diff --git a/crates/tools/src/fs/tools/write_file.rs b/crates/tools/src/fs/tools/write_file.rs
index 453c2ea75..93e6d90c3 100644
--- a/crates/tools/src/fs/tools/write_file.rs
+++ b/crates/tools/src/fs/tools/write_file.rs
@@ -41,7 +41,7 @@ pub struct WriteFileResult {
     pub resolved_path: FsPath,
     pub bytes_written: usize,
     #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub receipt: Option<environment_protocol::data::transfer_session::TransferStatus>,
+    pub receipt: Option<crate::transfer::TransferReceipt>,
 }
 
 impl WriteFileArgs {
diff --git a/crates/tools/src/fs/vfs.rs b/crates/tools/src/fs/vfs.rs
index 5ff3b77c7..291b9971e 100644
--- a/crates/tools/src/fs/vfs.rs
+++ b/crates/tools/src/fs/vfs.rs
@@ -13,8 +13,8 @@ use harness::{
 };
 
 use crate::fs::{
-    CopyOptions, CreateDirectoryOptions, FileAccessPolicy, FileMetadata, FileSystem, FsError,
-    FsPath, FsResult, ReadDirectoryEntry, RemoveOptions,
+    CreateDirectoryOptions, FileAccessPolicy, FileMetadata, FileSystem, FsError, FsPath, FsResult,
+    ReadDirectoryEntry, RemoveOptions,
 };
 
 #[derive(Clone)]
@@ -349,73 +349,6 @@ impl AttachedVfsFileSystem {
         }
         Ok(Some(directory_metadata()))
     }
-
-    async fn copy_generic(
-        &self,
-        source_path: &FsPath,
-        destination_path: &FsPath,
-        options: CopyOptions,
-    ) -> FsResult<()> {
-        let source_path = fs_path_key(source_path)?;
-        let destination_path = fs_path_key(destination_path)?;
-        let source_metadata = self.get_metadata(&source_path).await?;
-        if source_metadata.is_file {
-            let bytes = self.read_file(&source_path).await?;
-            return self.write_file(&destination_path, bytes).await;
-        }
-        if !source_metadata.is_directory {
-            return Err(FsError::InvalidInput {
-                message: format!("path is neither a file nor a directory: {source_path}"),
-            });
-        }
-        if !options.recursive {
-            return Err(FsError::InvalidInput {
-                message: "copy requires recursive: true when source is a directory".to_owned(),
-            });
-        }
-        if destination_path.starts_with(&source_path) {
-            return Err(FsError::InvalidInput {
-                message: "cannot copy a directory to itself or one of its descendants".to_owned(),
-            });
-        }
-        self.copy_directory_generic(&source_path, &destination_path)
-            .await
-    }
-
-    async fn copy_directory_generic(
-        &self,
-        source_path: &FsPath,
-        destination_path: &FsPath,
-    ) -> FsResult<()> {
-        let mut stack = vec![(source_path.clone(), destination_path.clone(), false)];
-        while let Some((source, destination, visited)) = stack.pop() {
-            if visited {
-                let bytes = self.read_file(&source).await?;
-                self.write_file(&destination, bytes).await?;
-                continue;
-            }
-
-            let metadata = self.get_metadata(&source).await?;
-            if metadata.is_file {
-                stack.push((source, destination, true));
-                continue;
-            }
-
-            self.remove(&destination, RemoveOptions::recursive().force())
-                .await?;
-            self.create_directory(&destination, CreateDirectoryOptions::single())
-                .await?;
-
-            let mut entries = self.read_directory(&source).await?;
-            entries.sort_by(|left, right| right.file_name.cmp(&left.file_name));
-            for entry in entries {
-                let source_child = source.join(&entry.file_name)?;
-                let destination_child = destination.join(&entry.file_name)?;
-                stack.push((source_child, destination_child, entry.is_file));
-            }
-        }
-        Ok(())
-    }
 }
 
 fn selected_entry(
@@ -520,15 +453,6 @@ impl FileSystem for VfsSnapshotFileSystem {
     async fn remove(&self, path: &FsPath, _options: RemoveOptions) -> FsResult<()> {
         Err(self.deny_write(path))
     }
-
-    async fn copy(
-        &self,
-        _source_path: &FsPath,
-        destination_path: &FsPath,
-        _options: CopyOptions,
-    ) -> FsResult<()> {
-        Err(self.deny_write(destination_path))
-    }
 }
 
 #[async_trait]
@@ -668,20 +592,6 @@ impl FileSystem for VfsWorkspaceFileSystem {
         .await
     }
 
-    async fn copy(
-        &self,
-        source_path: &FsPath,
-        destination_path: &FsPath,
-        options: CopyOptions,
-    ) -> FsResult<()> {
-        let source = fs_path_to_vfs_path(source_path)?;
-        let destination = fs_path_to_vfs_path(destination_path)?;
-        self.update_head(destination_path, |manifest| {
-            ::vfs::copy_manifest_path(manifest, &source, &destination, options.recursive)
-        })
-        .await
-    }
-
     fn drain_tool_effects(&self) -> Vec<ToolEffect> {
         self.effects.drain()
     }
@@ -816,27 +726,6 @@ impl FileSystem for AttachedVfsFileSystem {
         fs.remove(&resolved.inner_path, options).await
     }
 
-    async fn copy(
-        &self,
-        source_path: &FsPath,
-        destination_path: &FsPath,
-        options: CopyOptions,
-    ) -> FsResult<()> {
-        if let (Some(source), Some(destination)) = (
-            self.route_attachment(source_path)?,
-            self.route_attachment(destination_path)?,
-        ) && source.attachment.path == destination.attachment.path
-        {
-            let fs =
-                self.writable_workspace_for_attachment(&destination.attachment, destination_path)?;
-            return fs
-                .copy(&source.inner_path, &destination.inner_path, options)
-                .await;
-        }
-        self.copy_generic(source_path, destination_path, options)
-            .await
-    }
-
     fn drain_tool_effects(&self) -> Vec<ToolEffect> {
         self.effects.drain()
     }
@@ -1076,12 +965,12 @@ mod tests {
     use tokio::sync::Mutex;
 
     use super::*;
-    use crate::fs::FsToolContext;
     use crate::fs::tools::{
         ApplyPatchArgs, EditFileArgs, GlobArgs, GrepArgs, ListDirArgs, ReadFileArgs, WriteFileArgs,
         invoke_apply_patch, invoke_edit_file, invoke_glob, invoke_grep, invoke_list_dir,
         invoke_read_file, invoke_write_file,
     };
+    use crate::fs::{FsToolContext, RenameOptions};
     use crate::runtime::InlineToolRuntime;
     use crate::runtime::ToolTarget;
     use crate::toolset::{ToolsetConfig, register_toolset};
@@ -1955,7 +1844,7 @@ mod tests {
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn vfs_workspace_file_system_removes_and_copies_paths() {
+    async fn vfs_workspace_file_system_removes_and_renames_paths() {
         let store = Arc::new(TestWorkspaceStore::default());
         let (_blobs, fs, _workspace_id, _base_snapshot_ref) = test_workspace_fs(
             store,
@@ -1963,27 +1852,22 @@ mod tests {
         )
         .await;
 
-        fs.copy(
-            &FsPath::new("/src").unwrap(),
-            &FsPath::new("/copy").unwrap(),
-            CopyOptions::recursive(),
+        fs.rename(
+            &FsPath::new("/src/lib.rs").unwrap(),
+            &FsPath::new("/src/moved.rs").unwrap(),
+            RenameOptions::default(),
         )
         .await
-        .expect("copy dir");
+        .expect("rename file");
         assert_eq!(
-            fs.read_file_text(&FsPath::new("/copy/lib.rs").unwrap())
+            fs.read_file_text(&FsPath::new("/src/moved.rs").unwrap())
                 .await
-                .expect("read copied file"),
+                .expect("read moved file"),
             "pub fn f() {}\n"
         );
         assert!(matches!(
-            fs.copy(
-                &FsPath::new("/copy/lib.rs").unwrap(),
-                &FsPath::new("/copy").unwrap(),
-                CopyOptions::file()
-            )
-            .await,
-            Err(FsError::InvalidInput { .. })
+            fs.read_file(&FsPath::new("/src/lib.rs").unwrap()).await,
+            Err(FsError::NotFound { .. })
         ));
 
         assert!(matches!(
@@ -2387,42 +2271,34 @@ mod tests {
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn attached_vfs_file_system_copies_across_attachments() {
+    async fn attached_vfs_file_system_renames_within_writable_attachments() {
         let (_blobs, _store, fs, _workspace_id) = test_attached_fs().await;
 
-        fs.copy(
-            &FsPath::new("/skills/rust/SKILL.md").unwrap(),
-            &FsPath::new("/workspace/SKILL-copy.md").unwrap(),
-            CopyOptions::file(),
+        fs.write_file(
+            &FsPath::new("/workspace/draft.md").unwrap(),
+            b"draft\n".to_vec(),
         )
         .await
-        .expect("copy file across mounts");
-        assert_eq!(
-            fs.read_file_text(&FsPath::new("/workspace/SKILL-copy.md").unwrap())
-                .await
-                .expect("read copied skill"),
-            "# Rust Skill\n"
-        );
-
-        fs.copy(
-            &FsPath::new("/skills/rust").unwrap(),
-            &FsPath::new("/workspace/skill-copy").unwrap(),
-            CopyOptions::recursive(),
+        .expect("write draft");
+        fs.rename(
+            &FsPath::new("/workspace/draft.md").unwrap(),
+            &FsPath::new("/workspace/final.md").unwrap(),
+            RenameOptions::default(),
         )
         .await
-        .expect("copy directory across mounts");
+        .expect("rename within the workspace");
         assert_eq!(
-            fs.read_file_text(&FsPath::new("/workspace/skill-copy/references/info.md").unwrap())
+            fs.read_file_text(&FsPath::new("/workspace/final.md").unwrap())
                 .await
-                .expect("read copied reference"),
-            "reference\n"
+                .expect("read renamed file"),
+            "draft\n"
         );
 
         assert!(matches!(
-            fs.copy(
-                &FsPath::new("/workspace/SKILL-copy.md").unwrap(),
+            fs.rename(
+                &FsPath::new("/workspace/final.md").unwrap(),
                 &FsPath::new("/skills/rust/generated.md").unwrap(),
-                CopyOptions::file(),
+                RenameOptions::default(),
             )
             .await,
             Err(FsError::PermissionDenied { .. })
diff --git a/crates/tools/src/prompts/environment.rs b/crates/tools/src/prompts/environment.rs
index 9a74784cd..6d3cc6be6 100644
--- a/crates/tools/src/prompts/environment.rs
+++ b/crates/tools/src/prompts/environment.rs
@@ -1,5 +1,5 @@
-//! Bounded environment prompt assembly from a complete filesystem observation.
-use environment_protocol::data::inventory::ScanResponse;
+//! Bounded environment prompt assembly from a filesystem observation.
+use environment_protocol::data::scan::{ScanResponse, ScanRootResult};
 use harness::{
     ContentRef, ContextEntryInput, ContextEntryKey, ContextEntryKind,
     storage::{BlobStore, BlobStoreError},
@@ -16,27 +16,61 @@ pub struct EnvironmentPromptReport {
     pub warnings: Vec<String>,
 }
 
-pub fn assemble(scan: &ScanResponse) -> Result<(String, Vec<String>), String> {
-    if !scan.complete || scan.unchanged {
-        return Err("prompts require a complete changed observation".into());
-    }
+/// Prompts found by one scan, in root then name order.
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct PromptObservation {
+    pub text: String,
+    pub paths: Vec<String>,
+    /// Roots that could not be scanned, by path; the other roots' prompts
+    /// are still assembled.
+    pub warnings: Vec<String>,
+}
+
+pub fn assemble(scan: &ScanResponse) -> Result<PromptObservation, String> {
     let mut seen = BTreeSet::new();
-    let mut entries: Vec<_> = scan.entries.iter().collect();
-    entries.sort_by(|a, b| (a.root.as_str(), &a.path).cmp(&(b.root.as_str(), &b.path)));
+    let mut entries = Vec::new();
+    let mut warnings = Vec::new();
+    for root in &scan.roots {
+        match root {
+            ScanRootResult::Complete {
+                path,
+                canonical_path,
+                entries: root_entries,
+                ..
+            } => {
+                let base = canonical_path.as_ref().unwrap_or(path);
+                for entry in root_entries {
+                    entries.push((path.as_str(), entry, base));
+                }
+            }
+            ScanRootResult::Failed { path, error } => {
+                warnings.push(format!("{path}: prompt root could not be scanned: {error}"));
+            }
+            ScanRootResult::Unchanged { path, .. } => {
+                return Err(format!(
+                    "prompt root {path} answered unchanged; prompts need a full observation"
+                ));
+            }
+            ScanRootResult::Missing { .. } => {}
+        }
+    }
+    entries.sort_by(|a, b| (a.0, a.1.path.as_str()).cmp(&(b.0, b.1.path.as_str())));
     let mut text = String::new();
     let mut paths = Vec::new();
-    for entry in entries {
-        let valid = !entry.path.contains('/')
-            && (entry.path.ends_with(".md") || entry.path.ends_with(".txt"));
-        if !valid || !seen.insert(entry.canonical_path.as_str()) {
+    for (_, entry, base) in entries {
+        let name = entry.path.as_str();
+        let valid =
+            entry.path.segments().count() == 1 && (name.ends_with(".md") || name.ends_with(".txt"));
+        let canonical = base.join(&entry.path).map_err(|e| e.to_string())?;
+        if !valid || !seen.insert(canonical.to_string()) {
             continue;
         }
         let data = entry
             .data
             .as_ref()
             .ok_or("prompt scan omitted file content")?
-            .0
-            .clone();
+            .as_slice()
+            .to_vec();
         let body = String::from_utf8(data).map_err(|e| e.to_string())?;
         if body.chars().count() > 64 * 1024
             || text.chars().count() + body.chars().count() > 256 * 1024
@@ -48,19 +82,28 @@ pub fn assemble(scan: &ScanResponse) -> Result<(String, Vec<String>), String> {
                 text.push_str("\n\n");
             }
             text.push_str(&body);
-            paths.push(entry.canonical_path.to_string());
+            paths.push(canonical.to_string());
         }
     }
-    Ok((text, paths))
+    Ok(PromptObservation {
+        text,
+        paths,
+        warnings,
+    })
 }
 
 pub async fn publication(
     blobs: &dyn BlobStore,
     id: &str,
-    observation: Result<(String, Vec<String>), String>,
+    observation: Result<PromptObservation, String>,
 ) -> Result<BTreeMap<ContextEntryKey, ContextEntryInput>, BlobStoreError> {
     let (text, paths, warnings, available) = match observation {
-        Ok((text, paths)) => (text, paths, vec![], true),
+        Ok(observation) => (
+            observation.text,
+            observation.paths,
+            observation.warnings,
+            true,
+        ),
         Err(error) => (
             format!("Environment prompt sources are unavailable: {error}"),
             vec![],
@@ -103,3 +146,59 @@ pub async fn publication(
     );
     Ok(result)
 }
+
+#[cfg(test)]
+mod tests {
+    use environment_protocol::{
+        data::{
+            fs::TreeContent,
+            scan::{ScanEntry, ScanFingerprint},
+        },
+        error::ProtocolError,
+        paths::{EnvironmentPath, TreePath},
+    };
+
+    use super::*;
+
+    fn prompt(path: &str, text: &str) -> ScanEntry {
+        ScanEntry {
+            path: TreePath::new(path).unwrap(),
+            content: TreeContent::File {
+                size_bytes: text.len() as u64,
+                executable: false,
+                digest: None,
+            },
+            data: Some(text.as_bytes().to_vec().into()),
+        }
+    }
+
+    #[test]
+    fn a_failed_root_is_reported_and_never_hides_the_others() {
+        let scan = ScanResponse {
+            roots: vec![
+                ScanRootResult::Failed {
+                    path: EnvironmentPath::new("/home/.agents/prompts").unwrap(),
+                    error: ProtocolError::deadline_exceeded("slow"),
+                },
+                ScanRootResult::Complete {
+                    path: EnvironmentPath::new("/project/.agents/prompts").unwrap(),
+                    canonical_path: None,
+                    fingerprint: ScanFingerprint::new("scan:v1:x").unwrap(),
+                    entries: vec![prompt("b.md", "second"), prompt("a.md", "first")],
+                    skipped: vec![],
+                    skipped_entry_count: 0,
+                },
+            ],
+        };
+        let observation = assemble(&scan).unwrap();
+        assert_eq!(observation.text, "first\n\nsecond");
+        assert_eq!(
+            observation.paths,
+            vec![
+                "/project/.agents/prompts/a.md",
+                "/project/.agents/prompts/b.md"
+            ]
+        );
+        assert!(observation.warnings[0].starts_with("/home/.agents/prompts:"));
+    }
+}
diff --git a/crates/tools/src/skills/environment.rs b/crates/tools/src/skills/environment.rs
index bbb38b6a7..f072132e4 100644
--- a/crates/tools/src/skills/environment.rs
+++ b/crates/tools/src/skills/environment.rs
@@ -1,12 +1,18 @@
 //! Environment discovery consumes generic endpoint observations independently of VFS.
 use super::{SkillId, parse_skill_frontmatter};
-use environment_protocol::data::inventory::{ScanParams, ScanResponse};
+use environment_protocol::data::{
+    fs::TreeContent,
+    scan::{ScanFingerprint, ScanParams, ScanResponse, ScanRootResult, ScanSkip},
+};
 use harness::{
     BlobRef, ContextEntryInput, CoreAgentCommand, EnvironmentSkillsConfig,
     storage::{BlobStore, BlobStoreError},
 };
 use serde::{Deserialize, Serialize};
-use std::{collections::BTreeSet, path::Path};
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    path::Path,
+};
 
 pub const ENVIRONMENT_SKILL_CATALOG_CONTEXT_KEY: &str = "runtime.catalog.skills.environment";
 
@@ -20,6 +26,8 @@ pub enum EnvironmentSkillAvailability {
 
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub struct EnvironmentSkill {
+    /// The discovery root the skill was found under, as requested.
+    pub root: String,
     pub skill_id: SkillId,
     pub name: String,
     pub description: String,
@@ -39,6 +47,13 @@ pub struct EnvironmentSkillCatalog {
     /// Configured discovery scope, used only to validate last-observation fallback.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub discovery_scope: Option<String>,
+    /// Fingerprint of each scanned root's selection, by root path; a later
+    /// scan sends them as `ifNoneMatch` and reuses this catalog's skills for
+    /// roots that answer `unchanged`. Process-local scan accounting: it is
+    /// never part of the published snapshot, so an edit that leaves every
+    /// skill's metadata as it was (a body change) does not republish.
+    #[serde(skip)]
+    pub root_fingerprints: BTreeMap<String, String>,
 }
 impl EnvironmentSkillCatalog {
     pub fn unavailable(environment_id: &str) -> Self {
@@ -49,6 +64,7 @@ impl EnvironmentSkillCatalog {
             skills: vec![],
             warnings: vec![],
             discovery_scope: None,
+            root_fingerprints: BTreeMap::new(),
         }
     }
 }
@@ -66,40 +82,111 @@ pub fn environment_skill_scan_query(
     )
 }
 
+/// Send `previous`'s per-root fingerprints, so unchanged roots answer
+/// without entries.
+pub fn apply_cached_fingerprints(query: &mut ScanParams, previous: &EnvironmentSkillCatalog) {
+    for root in &mut query.roots {
+        root.if_none_match = previous
+            .root_fingerprints
+            .get(root.path.as_str())
+            .and_then(|fingerprint| ScanFingerprint::new(fingerprint.clone()).ok());
+    }
+}
+
+/// Build the catalog from per-root scan results. A root that failed is
+/// reported in `warnings` by its path and contributes nothing; every other
+/// root still contributes its skills. An `unchanged` root reuses the skills
+/// `previous` recorded for it, so it requires that catalog.
 pub fn environment_skill_catalog(
     environment_id: &str,
     scan: &ScanResponse,
+    previous: Option<&EnvironmentSkillCatalog>,
 ) -> Result<EnvironmentSkillCatalog, String> {
-    if !scan.complete || scan.unchanged {
-        return Err("catalog requires a complete changed observation".into());
-    }
     let mut catalog = EnvironmentSkillCatalog::unavailable(environment_id);
     catalog.availability = EnvironmentSkillAvailability::Available;
-    let mut seen = BTreeSet::new();
-    let mut entries: Vec<_> = scan.entries.iter().collect();
-    entries.sort_by_key(|entry| entry.canonical_path.as_str());
-    for entry in entries {
-        if !matches!(
-            entry.content,
-            environment_protocol::data::inventory::ScanContent::File { .. }
-        ) {
-            continue;
-        }
-        let path = Path::new(entry.canonical_path.as_str());
-        if path.file_name().and_then(|name| name.to_str()) != Some("SKILL.md") {
-            continue;
+    let mut documents = Vec::new();
+    for root in &scan.roots {
+        match root {
+            ScanRootResult::Complete {
+                path,
+                canonical_path,
+                fingerprint,
+                entries,
+                skipped,
+                skipped_entry_count,
+            } => {
+                catalog
+                    .root_fingerprints
+                    .insert(path.to_string(), fingerprint.as_str().to_owned());
+                let base = canonical_path.as_ref().unwrap_or(path);
+                for entry in entries {
+                    if matches!(entry.content, TreeContent::File { .. })
+                        && entry.path.segments().last() == Some("SKILL.md")
+                    {
+                        let doc = base.join(&entry.path).map_err(|error| error.to_string())?;
+                        documents.push((path.to_string(), doc.to_string(), entry.data.clone()));
+                    }
+                }
+                if *skipped_entry_count > 0 {
+                    catalog.warnings.push(skipped_warning(
+                        path.as_str(),
+                        skipped,
+                        *skipped_entry_count,
+                    ));
+                }
+            }
+            ScanRootResult::Unchanged { path, fingerprint } => {
+                let previous = previous
+                    .filter(|previous| {
+                        previous.root_fingerprints.get(path.as_str())
+                            == Some(&fingerprint.as_str().to_owned())
+                    })
+                    .ok_or_else(|| {
+                        format!(
+                            "skill root {path} is unchanged but no matching observation is cached"
+                        )
+                    })?;
+                catalog
+                    .root_fingerprints
+                    .insert(path.to_string(), fingerprint.as_str().to_owned());
+                catalog.skills.extend(
+                    previous
+                        .skills
+                        .iter()
+                        .filter(|skill| skill.root == path.as_str())
+                        .cloned(),
+                );
+                catalog.warnings.extend(
+                    previous
+                        .warnings
+                        .iter()
+                        .filter(|warning| warning.starts_with(&format!("{path}:")))
+                        .cloned(),
+                );
+            }
+            ScanRootResult::Missing { .. } => {}
+            ScanRootResult::Failed { path, error } => catalog
+                .warnings
+                .push(format!("{path}: skill root could not be scanned: {error}")),
         }
+    }
+    documents.sort_by(|left, right| left.1.cmp(&right.1));
+    let mut seen = BTreeSet::new();
+    for (root, doc, data) in documents {
+        let path = Path::new(&doc);
         let Some(dir) = path.parent() else {
             continue;
         };
         if !seen.insert(dir.to_owned()) {
             continue;
         }
-        let data = entry
-            .data
-            .as_ref()
-            .ok_or("scan omitted requested file content")?;
-        let parsed = std::str::from_utf8(&data.0)
+        let Some(data) = data else {
+            catalog
+                .warnings
+                .push(format!("{root}: scan omitted the content of {doc}"));
+            continue;
+        };
+        let parsed = std::str::from_utf8(data.as_slice())
             .map_err(|error| error.to_string())
             .and_then(|text| parse_skill_frontmatter(text).map_err(|e| e.to_string()));
         match parsed {
@@ -108,22 +195,44 @@ pub fn environment_skill_catalog(
                     &serde_json::to_vec(&(environment_id, dir)).expect("serialize identity"),
                 );
                 catalog.skills.push(EnvironmentSkill {
+                    root,
                     skill_id: SkillId::new(format!("environment:{}", identity.as_str())),
                     name: metadata.name,
                     description: metadata.description,
                     short_description: metadata.short_description,
                     skill_dir_path: dir.to_string_lossy().into_owned(),
-                    skill_doc_path: entry.canonical_path.to_string(),
+                    skill_doc_path: doc,
                 });
             }
-            Err(message) => catalog
-                .warnings
-                .push(format!("{}: {message}", entry.canonical_path)),
+            Err(message) => catalog.warnings.push(format!("{root}: {doc}: {message}")),
         }
     }
+    catalog
+        .skills
+        .sort_by(|left, right| left.skill_doc_path.cmp(&right.skill_doc_path));
     Ok(catalog)
 }
 
+fn skipped_warning(root: &str, skipped: &[ScanSkip], total: u32) -> String {
+    let listed = skipped
+        .iter()
+        .filter_map(|skip| {
+            skip.path
+                .as_ref()
+                .map(|path| format!("{path} ({:?})", skip.reason))
+        })
+        .take(5)
+        .collect::<Vec<_>>();
+    if listed.is_empty() {
+        format!("{root}: {total} entries skipped")
+    } else {
+        format!(
+            "{root}: {total} entries skipped, such as {}",
+            listed.join(", ")
+        )
+    }
+}
+
 pub async fn publish_environment_skill_catalog(
     blobs: &dyn BlobStore,
     current: Option<&ContextEntryInput>,
@@ -165,17 +274,113 @@ mod tests {
         skills::*,
     };
     use environment_protocol::{
-        data::inventory::{ScanContent, ScanEntry},
-        shared::EnvironmentPath,
+        data::scan::{ScanEntry, ScanSkipReason},
+        error::ProtocolError,
+        paths::{EnvironmentPath, TreePath},
     };
     use harness::storage::InMemoryBlobStore;
 
+    fn fingerprint(value: &str) -> ScanFingerprint {
+        ScanFingerprint::new(format!("scan:v1:{value}")).unwrap()
+    }
+
+    fn skill_entry(path: &str, doc: &[u8]) -> ScanEntry {
+        ScanEntry {
+            path: TreePath::new(path).unwrap(),
+            content: TreeContent::File {
+                size_bytes: doc.len() as u64,
+                executable: false,
+                digest: None,
+            },
+            data: Some(doc.to_vec().into()),
+        }
+    }
+
+    fn complete(root: &str, entries: Vec<ScanEntry>, skipped: Vec<ScanSkip>) -> ScanRootResult {
+        ScanRootResult::Complete {
+            path: EnvironmentPath::new(root).unwrap(),
+            canonical_path: None,
+            fingerprint: fingerprint(root),
+            skipped_entry_count: skipped.len() as u32,
+            entries,
+            skipped,
+        }
+    }
+
+    #[test]
+    fn one_bad_root_or_entry_never_hides_the_other_skills() {
+        let doc = b"---\nname: review\ndescription: Review changes.\n---\nbody";
+        let scan = ScanResponse {
+            roots: vec![
+                complete(
+                    "/project/.agents/skills",
+                    vec![skill_entry("review/SKILL.md", doc)],
+                    vec![ScanSkip {
+                        path: Some(TreePath::new("huge/SKILL.md").unwrap()),
+                        reason: ScanSkipReason::FileTooLarge,
+                    }],
+                ),
+                ScanRootResult::Failed {
+                    path: EnvironmentPath::new("/user/.agents/skills").unwrap(),
+                    error: ProtocolError::deadline_exceeded("walk took too long"),
+                },
+                ScanRootResult::Missing {
+                    path: EnvironmentPath::new("/user/.lightspeed/skills").unwrap(),
+                },
+            ],
+        };
+        let catalog = environment_skill_catalog("machine", &scan, None).unwrap();
+        assert_eq!(
+            catalog.availability,
+            EnvironmentSkillAvailability::Available
+        );
+        assert_eq!(catalog.skills.len(), 1);
+        assert_eq!(
+            catalog.skills[0].skill_doc_path,
+            "/project/.agents/skills/review/SKILL.md"
+        );
+        assert!(catalog.warnings.iter().any(|warning| {
+            warning.starts_with("/project/.agents/skills:") && warning.contains("huge/SKILL.md")
+        }));
+        assert!(
+            catalog
+                .warnings
+                .iter()
+                .any(|warning| warning.starts_with("/user/.agents/skills:"))
+        );
+
+        let mut query = environment_skill_scan_query(
+            &EnvironmentSkillsConfig::default(),
+            Some("/project"),
+            Some("/user"),
+        )
+        .unwrap();
+        apply_cached_fingerprints(&mut query, &catalog);
+        assert_eq!(
+            query.roots[0].if_none_match,
+            Some(fingerprint("/project/.agents/skills"))
+        );
+        let rescan = ScanResponse {
+            roots: vec![ScanRootResult::Unchanged {
+                path: EnvironmentPath::new("/project/.agents/skills").unwrap(),
+                fingerprint: fingerprint("/project/.agents/skills"),
+            }],
+        };
+        let reused = environment_skill_catalog("machine", &rescan, Some(&catalog)).unwrap();
+        assert_eq!(reused.skills, catalog.skills);
+        assert!(environment_skill_catalog("machine", &rescan, None).is_err());
+    }
+
     #[test]
     fn scope_defaults_and_overrides_are_independent_of_home() {
         let config = EnvironmentSkillsConfig::default();
         let query = environment_skill_scan_query(&config, Some("/project"), Some("/user")).unwrap();
         assert_eq!(
-            query.roots.iter().map(|p| p.as_str()).collect::<Vec<_>>(),
+            query
+                .roots
+                .iter()
+                .map(|p| p.path.as_str())
+                .collect::<Vec<_>>(),
             vec![
                 "/project/.agents/skills",
                 "/project/.lightspeed/skills",
@@ -188,7 +393,11 @@ mod tests {
         };
         let query = environment_skill_scan_query(&config, Some("/project"), None).unwrap();
         assert_eq!(
-            query.roots.iter().map(|p| p.as_str()).collect::<Vec<_>>(),
+            query
+                .roots
+                .iter()
+                .map(|p| p.path.as_str())
+                .collect::<Vec<_>>(),
             vec!["/project/custom", "/user/.codex/skills"]
         );
         assert_eq!(
@@ -242,23 +451,13 @@ mod tests {
         .await
         .unwrap();
         let scan = ScanResponse {
-            fingerprint: Some("observation".into()),
-            unchanged: false,
-            complete: true,
-            diagnostics: vec![],
-            entries: vec![ScanEntry {
-                root: EnvironmentPath::new("/skills").unwrap(),
-                path: "review/SKILL.md".into(),
-                canonical_path: EnvironmentPath::new("/skills/review/SKILL.md").unwrap(),
-                content: ScanContent::File {
-                    size_bytes: doc.len() as u64,
-                    executable: false,
-                    digest: None,
-                },
-                data: Some(doc.as_slice().into()),
-            }],
+            roots: vec![complete(
+                "/skills",
+                vec![skill_entry("review/SKILL.md", doc)],
+                vec![],
+            )],
         };
-        let environment = environment_skill_catalog("machine", &scan).unwrap();
+        let environment = environment_skill_catalog("machine", &scan, None).unwrap();
         assert_eq!(vfs.build.catalog.skills[0].name, environment.skills[0].name);
         assert_ne!(
             vfs.build.catalog.skills[0].skill_id,
diff --git a/crates/tools/src/transfer.rs b/crates/tools/src/transfer.rs
index a2f3e4e3e..9b8673ba2 100644
--- a/crates/tools/src/transfer.rs
+++ b/crates/tools/src/transfer.rs
@@ -2,20 +2,134 @@
 //! File payloads never enter model arguments or tool results.
 use crate::error::{ToolError, ToolResult};
 use async_trait::async_trait;
+use environment_client::ClientError;
 use environment_protocol::{
-    data::{inventory::*, transfer::TransferOnExisting, transfer_session::*},
-    shared::{ByteChunk, EnvironmentPath},
+    bytes::ByteChunk,
+    data::{
+        fs::{TreeContent, TreeFilter, WriteCondition},
+        handshake::TransferCeilings,
+        transfer::{
+            AppendTransferInventoryParams, BeginTransferParams, InventoryEntry,
+            ListTransferMissingParams, ListTransferMissingResponse, ReadTransferContentParams,
+            ReadTransferContentResponse, ReadTransferInventoryParams,
+            ReadTransferInventoryResponse, SpecialFilePolicy, SymlinkPolicy, TransferLimits,
+            TransferOnExisting, TransferOperationParams, TransferPhase, TransferSelection,
+            TransferStatus, WriteTransferContentParams, WriteTransferContentResponse,
+        },
+    },
+    ids::TransferOperationId,
+    paths::{ContentDigest, EnvironmentPath, TreePath},
 };
+use futures_util::TryStreamExt as _;
 use harness::{
     BlobRef,
-    storage::{BlobSource, BlobStore, BlobStoreError},
+    storage::{BlobSource, BlobStore, BlobStoreError, MAX_BLOB_RANGE_BYTES},
 };
 use std::{collections::BTreeMap, sync::Arc};
 
+/// Most entries one tool-driven transfer moves, within the endpoint's own
+/// ceiling.
+const MAX_TRANSFER_ENTRIES: u32 = 100_000;
+/// Digests one operation moves at once over the multiplexed client. Each
+/// digest's chunks still go in offset order, as the daemon requires; only
+/// different digests overlap.
+const CONTENT_CONCURRENCY: usize = 4;
+
+/// The `transfer/*` methods of one environment. [`DataClient`] implements
+/// it over the data plane; tests and in-process environments implement it
+/// directly and report their errors as [`ClientError::Protocol`].
+///
+/// [`DataClient`]: environment_client::DataClient
 #[async_trait]
 pub trait EnvironmentTransfer: Send + Sync {
-    async fn request(&self, request: TransferRequest) -> ToolResult<TransferResponse>;
+    /// The endpoint's advertised transfer ceilings.
+    fn transfer_ceilings(&self) -> TransferCeilings;
+    async fn begin(&self, params: &BeginTransferParams) -> Result<TransferStatus, ClientError>;
+    async fn advance(
+        &self,
+        params: &TransferOperationParams,
+    ) -> Result<TransferStatus, ClientError>;
+    async fn get_status(
+        &self,
+        params: &TransferOperationParams,
+    ) -> Result<TransferStatus, ClientError>;
+    async fn read_inventory(
+        &self,
+        params: &ReadTransferInventoryParams,
+    ) -> Result<ReadTransferInventoryResponse, ClientError>;
+    async fn append(
+        &self,
+        params: &AppendTransferInventoryParams,
+    ) -> Result<TransferStatus, ClientError>;
+    async fn list_missing(
+        &self,
+        params: &ListTransferMissingParams,
+    ) -> Result<ListTransferMissingResponse, ClientError>;
+    async fn read(
+        &self,
+        params: &ReadTransferContentParams,
+    ) -> Result<ReadTransferContentResponse, ClientError>;
+    async fn write(
+        &self,
+        params: &WriteTransferContentParams,
+    ) -> Result<WriteTransferContentResponse, ClientError>;
+    async fn commit(&self, params: &TransferOperationParams)
+    -> Result<TransferStatus, ClientError>;
+    async fn abort(&self, params: &TransferOperationParams) -> Result<TransferStatus, ClientError>;
+}
+
+/// What a finished transfer moved, as the model sees it.
+#[derive(
+    Clone, Debug, PartialEq, Eq, serde::Serialize, serde::Deserialize, schemars::JsonSchema,
+)]
+pub struct TransferReceipt {
+    /// Entries in the transferred tree, the selected root included.
+    pub entry_count: u32,
+    /// File bytes in the transferred tree.
+    pub total_bytes: u64,
+    /// Content bytes moved over the wire.
+    pub transferred_bytes: u64,
+    /// Content bytes satisfied from content already at the destination.
+    pub reused_bytes: u64,
+    /// Entries a capture left out, such as names that are not UTF-8.
+    #[serde(default, skip_serializing_if = "is_zero")]
+    pub skipped_entry_count: u32,
+}
+
+fn is_zero(value: &u32) -> bool {
+    *value == 0
 }
+
+impl From<&TransferStatus> for TransferReceipt {
+    fn from(status: &TransferStatus) -> Self {
+        Self {
+            entry_count: status.entry_count,
+            total_bytes: status.total_bytes,
+            transferred_bytes: status.transferred_bytes,
+            reused_bytes: status.reused_bytes,
+            skipped_entry_count: status.skipped_entry_count,
+        }
+    }
+}
+
+/// What a materialize does with an existing destination, as the model asks.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, serde::Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum OnExisting {
+    #[default]
+    Replace,
+    Error,
+}
+
+impl From<OnExisting> for TransferOnExisting {
+    fn from(on_existing: OnExisting) -> Self {
+        match on_existing {
+            OnExisting::Replace => Self::Replace,
+            OnExisting::Error => Self::Error,
+        }
+    }
+}
+
 fn invalid(message: impl Into<String>) -> ToolError {
     ToolError::InvalidRequest {
         message: message.into(),
@@ -24,40 +138,72 @@ fn invalid(message: impl Into<String>) -> ToolError {
 fn blob_error(error: impl std::fmt::Display) -> ToolError {
     invalid(error.to_string())
 }
-fn status(response: TransferResponse) -> ToolResult<TransferStatus> {
-    match response {
-        TransferResponse::Status(status) => Ok(status),
-        _ => Err(invalid("unexpected transfer response")),
+fn transfer_error(error: ClientError) -> ToolError {
+    invalid(format!("environment transfer failed: {error}"))
+}
+
+fn operation_id(id: &str) -> ToolResult<TransferOperationId> {
+    TransferOperationId::new(id).map_err(|error| invalid(error.to_string()))
+}
+
+fn operation(id: &TransferOperationId) -> TransferOperationParams {
+    TransferOperationParams {
+        operation_id: id.clone(),
+    }
+}
+
+/// The status, unless the operation failed or was aborted.
+fn live(status: TransferStatus) -> ToolResult<TransferStatus> {
+    match status.phase {
+        TransferPhase::Failed => Err(invalid(format!(
+            "environment transfer failed: {}",
+            status
+                .error
+                .as_ref()
+                .map_or_else(|| "no reason given".to_owned(), ToString::to_string)
+        ))),
+        TransferPhase::Aborted => Err(invalid("environment transfer was aborted")),
+        _ => Ok(status),
     }
 }
-async fn advance(
-    remote: &dyn EnvironmentTransfer,
-    id: &str,
-    phase: TransferPhase,
-) -> ToolResult<TransferStatus> {
-    loop {
-        let state = status(
-            remote
-                .request(TransferRequest::Advance {
-                    operation_id: id.into(),
-                })
-                .await?,
-        )?;
-        if state.phase == phase || state.phase == TransferPhase::Complete {
-            return Ok(state);
-        }
-        if state.phase == TransferPhase::Aborted {
-            return Err(invalid("transfer aborted"));
-        }
+
+/// Caller quotas: the endpoint's ceilings, with the entry count bounded by
+/// what one tool call may move.
+fn limits(ceilings: &TransferCeilings, single_file: bool) -> TransferLimits {
+    TransferLimits {
+        max_entries: if single_file {
+            1
+        } else {
+            ceilings.max_entries.min(MAX_TRANSFER_ENTRIES)
+        },
+        max_depth: if single_file { 0 } else { ceilings.max_depth },
+        max_file_bytes: ceilings.max_file_bytes,
+        max_total_bytes: ceilings.max_total_bytes,
+        max_manifest_bytes: ceilings.max_manifest_bytes,
+        max_duration_ms: ceilings.max_duration_ms,
     }
 }
-fn flatten(path: String, entry: &vfs::VfsEntry, entries: &mut Vec<InventoryEntry>) {
+
+fn digest_of(blob_ref: &BlobRef) -> ToolResult<ContentDigest> {
+    ContentDigest::parse(blob_ref.as_str())
+        .map_err(|_| invalid("CAS reference is not a sha256 digest"))
+}
+
+fn blob_of(digest: &ContentDigest) -> ToolResult<BlobRef> {
+    BlobRef::parse(digest.to_string()).map_err(blob_error)
+}
+
+fn flatten(
+    path: TreePath,
+    entry: &vfs::VfsEntry,
+    entries: &mut Vec<InventoryEntry>,
+) -> ToolResult<()> {
     let content = match entry {
-        vfs::VfsEntry::Directory(_) => InventoryContent::Directory,
-        vfs::VfsEntry::File(file) => InventoryContent::File {
+        vfs::VfsEntry::Directory(_) => TreeContent::Directory {},
+        vfs::VfsEntry::File(file) => TreeContent::File {
             size_bytes: file.size_bytes,
             executable: file.executable,
-            digest: file.blob_ref.to_string(),
+            digest: Some(digest_of(&file.blob_ref)?),
         },
     };
     entries.push(InventoryEntry {
@@ -66,17 +212,16 @@ fn flatten(path: String, entry: &vfs::VfsEntry, entries: &mut Vec<InventoryEntry
     });
     if let vfs::VfsEntry::Directory(dir) = entry {
         for (name, child) in &dir.entries {
-            flatten(
-                if path.is_empty() {
-                    name.clone()
-                } else {
-                    format!("{path}/{name}")
-                },
-                child,
-                entries,
-            );
+            let child_path = if path.is_root() {
+                TreePath::new(name.clone())
+            } else {
+                path.join(name)
+            }
+            .map_err(|error| invalid(error.to_string()))?;
+            flatten(child_path, child, entries)?;
         }
     }
+    Ok(())
 }
 
 /// Resolve a workspace once before calling this method. Retries keep that immutable source.
@@ -101,6 +246,10 @@ pub async fn materialize(
     .await
 }
 
+/// Drive a materialize or writeFile operation to completion, resuming from
+/// whatever phase a retried `transfer/begin` reports. A transport failure
+/// leaves the operation in place so a retry can inspect and resume it;
+/// explicit abort is available for cancellation.
 async fn materialize_selection(
     remote: &dyn EnvironmentTransfer,
     blobs: &dyn BlobStore,
@@ -108,126 +257,174 @@ async fn materialize_selection(
     entry: &vfs::VfsEntry,
     selection: TransferSelection,
 ) -> ToolResult<TransferStatus> {
-    let result = async {
-        let initial = status(
-            remote
-                .request(TransferRequest::Begin {
-                    operation_id: id.into(),
-                    selection,
-                    limits: InventoryLimits::default(),
-                })
-                .await?,
-        )?;
-        if initial.phase == TransferPhase::Complete {
-            return Ok(initial);
-        }
-        let mut entries = Vec::new();
-        flatten(String::new(), entry, &mut entries);
-        if entries.len() > InventoryLimits::default().max_entries as usize {
-            return Err(invalid("VFS transfer entry quota exceeded"));
-        }
-        let source_refs: std::collections::BTreeSet<_> = entries
-            .iter()
-            .filter_map(|entry| match &entry.content {
-                InventoryContent::File { digest, .. } => Some(digest),
-                _ => None,
-            })
-            .collect();
-        for digest in source_refs {
-            blobs
-                .retain_blob(&BlobRef::parse(digest.clone()).map_err(blob_error)?)
-                .await
-                .map_err(blob_error)?;
-        }
-        if initial.phase == TransferPhase::Scanning {
-            advance(remote, id, TransferPhase::Inventory).await?;
-        }
-        for (index, page) in entries.chunks(MAX_INVENTORY_PAGE).enumerate() {
-            remote
-                .request(TransferRequest::Append {
-                    operation_id: id.into(),
-                    offset: (index * MAX_INVENTORY_PAGE) as u32,
-                    entries: page.to_vec(),
-                    last: (index + 1) * MAX_INVENTORY_PAGE >= entries.len(),
-                })
-                .await?;
-        }
-        let sizes: BTreeMap<_, _> = entries
-            .iter()
-            .filter_map(|e| match &e.content {
-                InventoryContent::File {
-                    digest, size_bytes, ..
-                } => Some((digest.clone(), *size_bytes)),
-                _ => None,
+    let ceilings = remote.transfer_ceilings();
+    let id = operation_id(id)?;
+    let single_file = matches!(selection, TransferSelection::WriteFile { .. });
+    let quotas = limits(&ceilings, single_file);
+    let mut entries = Vec::new();
+    flatten(TreePath::root(), entry, &mut entries)?;
+    if entries.len() as u64 > u64::from(quotas.max_entries) {
+        return Err(invalid("VFS transfer entry quota exceeded"));
+    }
+    let sizes: BTreeMap<ContentDigest, u64> = entries
+        .iter()
+        .filter_map(|entry| match &entry.content {
+            TreeContent::File {
+                digest: Some(digest),
+                size_bytes,
+                ..
+            } => Some((*digest, *size_bytes)),
+            _ => None,
+        })
+        .collect();
+    for digest in sizes.keys() {
+        blobs
+            .retain_blob(&blob_of(digest)?)
+            .await
+            .map_err(blob_error)?;
+    }
+    let mut state = live(
+        remote
+            .begin(&BeginTransferParams {
+                operation_id: id.clone(),
+                selection,
+                limits: quotas,
             })
-            .collect();
-        loop {
-            // Missing pages shrink as uploads complete; always fetch the first page.
-            let TransferResponse::Missing { digests, .. } = remote
-                .request(TransferRequest::Missing {
-                    operation_id: id.into(),
-                    offset: 0,
-                })
-                .await?
-            else {
-                return Err(invalid("unexpected missing-content response"));
-            };
-            if digests.is_empty() {
-                break;
+            .await
+            .map_err(transfer_error)?,
+    )?;
+    let page_size = ceilings.max_inventory_page_entries.max(1) as usize;
+    let mut stalled_content = false;
+    loop {
+        state = match state.phase {
+            TransferPhase::Complete => return Ok(state),
+            TransferPhase::Inventory => {
+                let appended = state.entry_count as usize;
+                let rest = entries.get(appended..).unwrap_or_default();
+                if rest.is_empty() {
+                    return Err(invalid("transfer inventory is complete but not sealed"));
+                }
+                let mut status = state;
+                for (page_index, page) in rest.chunks(page_size).enumerate() {
+                    let index = appended + page_index * page_size;
+                    status = live(
+                        remote
+                            .append(&AppendTransferInventoryParams {
+                                operation_id: id.clone(),
+                                index: index as u32,
+                                entries: page.to_vec(),
+                                last: index + page.len() == entries.len(),
+                            })
+                            .await
+                            .map_err(transfer_error)?,
+                    )?;
+                }
+                status
             }
-            for digest in digests {
-                let blob_ref = BlobRef::parse(digest.clone()).map_err(blob_error)?;
-                let size = *sizes
-                    .get(&digest)
-                    .ok_or_else(|| invalid("receiver requested undeclared content"))?;
-                blobs.retain_blob(&blob_ref).await.map_err(blob_error)?;
-                let mut offset = 0;
-                loop {
-                    let data = blobs
-                        .read_blob_range(
-                            &blob_ref,
-                            offset,
-                            MAX_CONTENT_CHUNK.min((size - offset) as usize),
-                        )
-                        .await
-                        .map_err(blob_error)?;
-                    if data.len() > MAX_CONTENT_CHUNK || (data.is_empty() && offset < size) {
-                        return Err(invalid("CAS returned incomplete file content"));
+            TransferPhase::Content => {
+                let missing = remote
+                    .list_missing(&ListTransferMissingParams {
+                        operation_id: id.clone(),
+                        limit: ceilings.max_inventory_page_entries.max(1),
+                    })
+                    .await
+                    .map_err(transfer_error)?;
+                if missing.digests.is_empty() {
+                    let next = live(
+                        remote
+                            .advance(&operation(&id))
+                            .await
+                            .map_err(transfer_error)?,
+                    )?;
+                    if next.phase == TransferPhase::Content {
+                        if stalled_content {
+                            return Err(invalid("environment transfer made no progress"));
+                        }
+                        stalled_content = true;
                     }
-                    let end = offset + data.len() as u64;
-                    remote
-                        .request(TransferRequest::Write {
-                            operation_id: id.into(),
-                            digest: digest.clone(),
-                            offset,
-                            data: ByteChunk::from(data),
+                    next
+                } else {
+                    futures_util::stream::iter(missing.digests.iter().map(Ok))
+                        .try_for_each_concurrent(CONTENT_CONCURRENCY, |digest| {
+                            upload(remote, blobs, &id, &ceilings, digest, &sizes)
                         })
                         .await?;
-                    offset = end;
-                    if offset == size {
-                        break;
-                    }
+                    state
                 }
             }
+            TransferPhase::Scanning | TransferPhase::Staging => live(
+                remote
+                    .advance(&operation(&id))
+                    .await
+                    .map_err(transfer_error)?,
+            )?,
+            TransferPhase::Ready => live(
+                remote
+                    .commit(&operation(&id))
+                    .await
+                    .map_err(transfer_error)?,
+            )?,
+            TransferPhase::Failed | TransferPhase::Aborted => live(state)?,
+        };
+    }
+}
+
+async fn upload(
+    remote: &dyn EnvironmentTransfer,
+    blobs: &dyn BlobStore,
+    id: &TransferOperationId,
+    ceilings: &TransferCeilings,
+    digest: &ContentDigest,
+    sizes: &BTreeMap<ContentDigest, u64>,
+) -> ToolResult<()> {
+    let size = *sizes
+        .get(digest)
+        .ok_or_else(|| invalid("receiver requested undeclared content"))?;
+    let blob_ref = blob_of(digest)?;
+    blobs.retain_blob(&blob_ref).await.map_err(blob_error)?;
+    let chunk = ceilings.max_content_chunk_bytes.max(1);
+    let mut offset = 0;
+    loop {
+        let want = chunk.min(size - offset);
+        // One transfer chunk may exceed the store's range bound: fill it
+        // from consecutive ranges.
+        let mut data = Vec::with_capacity(want as usize);
+        while (data.len() as u64) < want {
+            let remaining = want - data.len() as u64;
+            let range = remaining.min(MAX_BLOB_RANGE_BYTES as u64);
+            let bytes = blobs
+                .read_blob_range(&blob_ref, offset + data.len() as u64, range as usize)
+                .await
+                .map_err(blob_error)?;
+            if bytes.len() as u64 > range || bytes.is_empty() {
+                return Err(invalid("CAS returned incomplete file content"));
+            }
+            data.extend_from_slice(&bytes);
+        }
+        if data.is_empty() && offset < size {
+            return Err(invalid("CAS returned incomplete file content"));
+        }
+        let written = remote
+            .write(&WriteTransferContentParams {
+                operation_id: id.clone(),
+                digest: *digest,
+                offset,
+                data: ByteChunk::from(data),
+            })
+            .await
+            .map_err(transfer_error)?;
+        offset = written.next_offset;
+        if offset >= size {
+            return Ok(());
         }
-        advance(remote, id, TransferPhase::Ready).await?;
-        status(
-            remote
-                .request(TransferRequest::Commit {
-                    operation_id: id.into(),
-                })
-                .await?,
-        )
     }
-    .await;
-    // Transport failure is ambiguous: preserve the operation so the caller can inspect
-    // its receipt. Explicit abort is available for cancellation/abandonment.
-    result
 }
+
 struct CaptureSource<'a> {
     remote: &'a dyn EnvironmentTransfer,
-    id: &'a str,
-    digest: String,
+    id: &'a TransferOperationId,
+    digest: ContentDigest,
+    chunk_bytes: u64,
     offset: u64,
     eof: bool,
 }
@@ -237,38 +434,28 @@ impl BlobSource for CaptureSource<'_> {
         if self.eof {
             return Ok(vec![]);
         }
-        if max_bytes < MAX_CONTENT_CHUNK {
-            return Err(BlobStoreError::Store {
-                message: "capture source requires protocol chunk bound".into(),
-            });
-        }
+        let want = (max_bytes as u64).min(self.chunk_bytes).max(1);
         let response = self
             .remote
-            .request(TransferRequest::Read {
-                operation_id: self.id.into(),
-                digest: self.digest.clone(),
+            .read(&ReadTransferContentParams {
+                operation_id: self.id.clone(),
+                digest: self.digest,
                 offset: self.offset,
+                max_bytes: want,
             })
             .await
             .map_err(|e| BlobStoreError::Store {
                 message: e.to_string(),
             })?;
-        match response {
-            TransferResponse::Chunk { data, eof } => {
-                let bytes = data.into_inner();
-                if bytes.len() > MAX_CONTENT_CHUNK || (bytes.is_empty() && !eof) {
-                    return Err(BlobStoreError::Store {
-                        message: "invalid capture chunk".into(),
-                    });
-                }
-                self.offset += bytes.len() as u64;
-                self.eof = eof;
-                Ok(bytes)
-            }
-            _ => Err(BlobStoreError::Store {
-                message: "unexpected capture response".into(),
-            }),
+        let bytes = response.data.into_inner();
+        if bytes.len() as u64 > want || (bytes.is_empty() && response.truncated) {
+            return Err(BlobStoreError::Store {
+                message: "invalid capture chunk".into(),
+            });
         }
+        self.offset += bytes.len() as u64;
+        self.eof = !response.truncated;
+        Ok(bytes)
     }
 }
 #[derive(Clone, Debug)]
@@ -310,111 +497,129 @@ async fn capture_selection(
     source: EnvironmentPath,
     single_file: bool,
 ) -> ToolResult<CapturedContent> {
-    let limits = if single_file {
-        InventoryLimits {
-            max_entries: 1,
-            max_depth: 0,
-            ..InventoryLimits::default()
-        }
-    } else {
-        InventoryLimits::default()
-    };
-    let initial = status(
+    let ceilings = remote.transfer_ceilings();
+    let id = operation_id(id)?;
+    let quotas = limits(&ceilings, single_file);
+    let mut state = live(
         remote
-            .request(TransferRequest::Begin {
-                operation_id: id.into(),
-                selection: TransferSelection::Capture { source },
-                limits,
+            .begin(&BeginTransferParams {
+                operation_id: id.clone(),
+                selection: TransferSelection::Capture {
+                    source,
+                    filter: TreeFilter {
+                        include_hidden: true,
+                        include_ignored: true,
+                        ..TreeFilter::default()
+                    },
+                    symlinks: SymlinkPolicy::ExpandInside,
+                    special_files: SpecialFilePolicy::Reject,
+                },
+                limits: quotas,
             })
-            .await?,
+            .await
+            .map_err(transfer_error)?,
     )?;
-    if initial.phase == TransferPhase::Scanning {
-        advance(remote, id, TransferPhase::Ready).await?;
+    while state.phase == TransferPhase::Scanning {
+        state = live(
+            remote
+                .advance(&operation(&id))
+                .await
+                .map_err(transfer_error)?,
+        )?;
     }
+    // A retried capture that already completed pages the inventory its
+    // receipt retained and never revisits the live source.
+    if !matches!(
+        state.phase,
+        TransferPhase::Inventory | TransferPhase::Complete
+    ) {
+        return Err(invalid(format!(
+            "capture is in phase {:?}, not inventory",
+            state.phase
+        )));
+    }
+    let page_size = ceilings.max_inventory_page_entries.max(1);
     let mut entries = Vec::new();
-    let mut offset = 0;
+    let mut index = 0;
     loop {
-        let TransferResponse::Inventory {
-            entries: page,
-            next_offset,
-        } = remote
-            .request(TransferRequest::Inventory {
-                operation_id: id.into(),
-                offset,
+        let page = remote
+            .read_inventory(&ReadTransferInventoryParams {
+                operation_id: id.clone(),
+                index,
+                limit: page_size,
             })
-            .await?
-        else {
-            return Err(invalid("unexpected inventory response"));
-        };
-        if page.len() > MAX_INVENTORY_PAGE
-            || entries.len() + page.len() > InventoryLimits::default().max_entries as usize
+            .await
+            .map_err(transfer_error)?;
+        if page.entries.len() > page_size as usize
+            || entries.len() + page.entries.len() > quotas.max_entries as usize
         {
             return Err(invalid("capture inventory quota exceeded"));
         }
-        entries.extend(page);
-        match next_offset {
-            Some(next) if next > offset => offset = next,
+        entries.extend(page.entries);
+        match page.next_index {
+            Some(next) if next > index => index = next,
             Some(_) => return Err(invalid("inventory made no progress")),
             None => break,
         }
     }
     if single_file
-        && !matches!(entries.as_slice(), [InventoryEntry { path, content: InventoryContent::File { .. } }] if path.is_empty())
+        && !matches!(entries.as_slice(), [InventoryEntry { path, content: TreeContent::File { .. } }] if path.is_root())
     {
         return Err(invalid(
             "reference requires exactly one file, not a directory",
         ));
     }
+    // Each distinct content once, fetched a few digests at a time.
+    let mut refs: BTreeMap<BlobRef, (ContentDigest, u64)> = BTreeMap::new();
+    for entry in &entries {
+        if let TreeContent::File {
+            digest, size_bytes, ..
+        } = &entry.content
+        {
+            let digest = digest
+                .as_ref()
+                .ok_or_else(|| invalid("capture inventory omitted a file digest"))?;
+            refs.entry(blob_of(digest)?)
+                .or_insert((*digest, *size_bytes));
+        }
+    }
+    futures_util::stream::iter(refs.iter().map(Ok))
+        .try_for_each_concurrent(CONTENT_CONCURRENCY, |(blob_ref, (digest, size_bytes))| {
+            fetch_content(
+                remote,
+                blobs,
+                &id,
+                &ceilings,
+                blob_ref,
+                *digest,
+                *size_bytes,
+            )
+        })
+        .await?;
     let mut manifest = vfs::VfsSnapshotManifest::empty();
-    let mut refs = BTreeMap::new();
     for entry in &entries {
-        let path = vfs::VfsPath::parse(if entry.path.is_empty() {
+        let path = vfs::VfsPath::parse(if entry.path.is_root() {
             "/selection".into()
         } else {
             format!("/selection/{}", entry.path)
         })
         .map_err(blob_error)?;
         match &entry.content {
-            InventoryContent::Directory => {
+            TreeContent::Directory {} => {
                 vfs::create_manifest_directory(&mut manifest, &path, false).map_err(blob_error)?
             }
-            InventoryContent::File {
+            TreeContent::File {
                 digest,
                 size_bytes,
                 executable,
             } => {
-                let blob_ref = BlobRef::parse(digest.clone()).map_err(blob_error)?;
-                if !refs.contains_key(&blob_ref) {
-                    if blobs.has_blob(&blob_ref).await.map_err(blob_error)? {
-                        blobs.retain_blob(&blob_ref).await.map_err(blob_error)?;
-                        if blobs
-                            .stat_blob(&blob_ref)
-                            .await
-                            .map_err(blob_error)?
-                            .byte_len
-                            != *size_bytes
-                        {
-                            return Err(invalid("CAS size differs from capture"));
-                        }
-                    } else {
-                        let mut source = CaptureSource {
-                            remote,
-                            id,
-                            digest: digest.clone(),
-                            offset: 0,
-                            eof: false,
-                        };
-                        blobs
-                            .put_stream(&blob_ref, *size_bytes, &mut source)
-                            .await
-                            .map_err(blob_error)?;
-                    }
-                    refs.insert(blob_ref.clone(), *size_bytes);
-                }
+                let digest = digest
+                    .as_ref()
+                    .ok_or_else(|| invalid("capture inventory omitted a file digest"))?;
                 vfs::write_manifest_file_ref(
                     &mut manifest,
                     &path,
-                    blob_ref,
+                    blob_of(digest)?,
                     *size_bytes,
                     None,
                     *executable,
@@ -423,12 +628,11 @@ async fn capture_selection(
             }
         }
     }
-    let state = status(
+    let state = live(
         remote
-            .request(TransferRequest::Commit {
-                operation_id: id.into(),
-            })
-            .await?,
+            .commit(&operation(&id))
+            .await
+            .map_err(transfer_error)?,
     )?;
     for blob_ref in refs.keys() {
         blobs.retain_blob(blob_ref).await.map_err(blob_error)?;
@@ -446,6 +650,45 @@ async fn capture_selection(
     })
 }
 
+/// Make one captured content available in CAS: reuse a blob already
+/// stored, otherwise stream it from the environment in order.
+async fn fetch_content(
+    remote: &dyn EnvironmentTransfer,
+    blobs: &dyn BlobStore,
+    id: &TransferOperationId,
+    ceilings: &TransferCeilings,
+    blob_ref: &BlobRef,
+    digest: ContentDigest,
+    size_bytes: u64,
+) -> ToolResult<()> {
+    if blobs.has_blob(blob_ref).await.map_err(blob_error)? {
+        blobs.retain_blob(blob_ref).await.map_err(blob_error)?;
+        if blobs
+            .stat_blob(blob_ref)
+            .await
+            .map_err(blob_error)?
+            .byte_len
+            != size_bytes
+        {
+            return Err(invalid("CAS size differs from capture"));
+        }
+        return Ok(());
+    }
+    let mut source = CaptureSource {
+        remote,
+        id,
+        digest,
+        chunk_bytes: ceilings.max_content_chunk_bytes,
+        offset: 0,
+        eof: false,
+    };
+    blobs
+        .put_stream(blob_ref, size_bytes, &mut source)
+        .await
+        .map_err(blob_error)
+        .map(drop)
+}
+
 pub type SharedEnvironmentTransfer = Arc<dyn EnvironmentTransfer>;
 
 /// Materialize a single immutable blob using bounded provider transfer chunks.
@@ -471,6 +714,16 @@ pub(crate) async fn invoke_write_reference(
         .await?;
     let bytes_written = usize::try_from(reference.byte_len)
         .map_err(|_| invalid("file size exceeds platform limits"))?;
+    // `write_file` creates missing parents on every route; a transfer's
+    // writeFile selection, like `fs/writeFile`, needs an existing parent.
+    if let Some(parent) = resolved_path.parent()
+        && !parent.is_root()
+    {
+        filesystem
+            .fs
+            .create_directory(&parent, crate::fs::CreateDirectoryOptions::recursive())
+            .await?;
+    }
     let remote = ctx
         .transfer
         .as_ref()
@@ -497,7 +750,12 @@ pub(crate) async fn invoke_write_reference(
             media_type: reference.media_type,
             executable: false,
         }),
-        TransferSelection::WriteFile { destination },
+        TransferSelection::WriteFile {
+            destination,
+            create: WriteCondition::Always,
+            if_match: None,
+            executable: false,
+        },
     )
     .await?;
     guard.complete = true;
@@ -505,7 +763,7 @@ pub(crate) async fn invoke_write_reference(
         path: args.path,
         resolved_path,
         bytes_written,
-        receipt: Some(receipt),
+        receipt: Some(TransferReceipt::from(&receipt)),
     })
 }
 
@@ -519,7 +777,7 @@ struct EnvironmentReferenceArgs {
 pub(crate) struct EnvironmentReferenceResult {
     #[serde(flatten)]
     pub content: crate::content::ContentDescriptor,
-    pub receipt: TransferStatus,
+    pub receipt: TransferReceipt,
 }
 
 /// Capture one environment file into CAS without a VFS attachment or publication.
@@ -584,7 +842,7 @@ pub(crate) async fn invoke_environment_reference(
             handle: Some(attachment.handle.clone()),
             source: attachment.source.clone(),
         },
-        receipt: captured.status,
+        receipt: TransferReceipt::from(&captured.status),
     };
     let mut result = crate::runtime::encode_output(
         &output,
@@ -608,12 +866,12 @@ impl Drop for TransferGuard {
     fn drop(&mut self) {
         if !self.complete
             && let Ok(handle) = tokio::runtime::Handle::try_current()
+            && let Ok(operation_id) = TransferOperationId::new(self.id.clone())
         {
             let remote = self.remote.clone();
-            let operation_id = self.id.clone();
             handle.spawn(async move {
                 let _ = remote
-                    .request(TransferRequest::Abort { operation_id })
+                    .abort(&TransferOperationParams { operation_id })
                     .await;
             });
         }
@@ -624,24 +882,24 @@ impl Drop for TransferGuard {
 #[serde(deny_unknown_fields)]
 struct MaterializeArgs {
     source_vfs_path: crate::fs::FsPath,
-    destination_environment_path: EnvironmentPath,
+    destination_environment_path: String,
     #[serde(default)]
-    on_existing: TransferOnExisting,
+    on_existing: OnExisting,
 }
 #[derive(serde::Deserialize)]
 #[serde(deny_unknown_fields)]
 struct CaptureArgs {
-    source_environment_path: EnvironmentPath,
+    source_environment_path: String,
     destination_vfs_path: crate::fs::FsPath,
     #[serde(default)]
-    on_existing: TransferOnExisting,
+    on_existing: OnExisting,
 }
 
 #[derive(serde::Serialize, schemars::JsonSchema)]
 pub(crate) struct MaterializeResult {
     pub operation_id: String,
-    pub destination: EnvironmentPath,
-    pub receipt: TransferStatus,
+    pub destination: String,
+    pub receipt: TransferReceipt,
 }
 
 #[derive(serde::Serialize, schemars::JsonSchema)]
@@ -651,19 +909,18 @@ pub(crate) struct CaptureResult {
     pub snapshot_path: String,
     pub destination: crate::fs::FsPath,
     pub published: bool,
-    pub receipt: TransferStatus,
+    pub receipt: TransferReceipt,
 }
 
+/// An absolute environment path; a relative one resolves against the
+/// process working directory.
 fn resolve_environment_path(
     ctx: &crate::environment::EnvironmentToolContext,
-    path: &EnvironmentPath,
+    path: &str,
 ) -> ToolResult<EnvironmentPath> {
-    let Some(cwd) = &ctx.process_cwd else {
-        return Ok(path.clone());
-    };
+    let base = ctx.process_cwd.as_ref().map_or("/", |cwd| cwd.as_str());
     let path =
-        crate::environment::sources::absolute(std::path::Path::new(cwd.as_str()), path.as_str())
-            .map_err(invalid)?;
+        crate::environment::sources::absolute(std::path::Path::new(base), path).map_err(invalid)?;
     EnvironmentPath::new(path.to_string_lossy()).map_err(|e| invalid(e.to_string()))
 }
 
@@ -675,8 +932,7 @@ pub async fn invoke_materialize(
 ) -> ToolResult<crate::runtime::ToolInvocationOutput> {
     let mut args: MaterializeArgs = crate::runtime::decode_args(arguments)?;
     args.source_vfs_path = crate::fs::tools::resolve_path(vfs, &args.source_vfs_path)?;
-    args.destination_environment_path =
-        resolve_environment_path(ctx, &args.destination_environment_path)?;
+    let destination = resolve_environment_path(ctx, &args.destination_environment_path)?;
     let remote = ctx
         .transfer
         .as_deref()
@@ -695,19 +951,20 @@ pub async fn invoke_materialize(
         vfs.blobs.as_ref(),
         &id,
         &entry,
-        args.destination_environment_path.clone(),
-        args.on_existing,
+        destination.clone(),
+        args.on_existing.into(),
     )
     .await?;
     guard.complete = true;
+    let receipt = TransferReceipt::from(&receipt);
     let message = format!(
         "Materialized {} entries ({} bytes); transferred {} bytes, reused {} bytes.",
-        receipt.entries, receipt.bytes, receipt.transferred_bytes, receipt.reused_bytes
+        receipt.entry_count, receipt.total_bytes, receipt.transferred_bytes, receipt.reused_bytes
     );
     crate::runtime::encode_output(
         &MaterializeResult {
             operation_id: id,
-            destination: args.destination_environment_path,
+            destination: destination.as_str().to_owned(),
             receipt,
         },
         message,
@@ -721,7 +978,7 @@ pub async fn invoke_capture(
 ) -> ToolResult<crate::runtime::ToolInvocationOutput> {
     let mut args: CaptureArgs = crate::runtime::decode_args(arguments)?;
     args.destination_vfs_path = crate::fs::tools::resolve_path(vfs, &args.destination_vfs_path)?;
-    args.source_environment_path = resolve_environment_path(ctx, &args.source_environment_path)?;
+    let source = resolve_environment_path(ctx, &args.source_environment_path)?;
     let remote = ctx
         .transfer
         .as_deref()
@@ -730,7 +987,7 @@ pub async fn invoke_capture(
         .fs
         .prepare_vfs_capture(
             &args.destination_vfs_path,
-            args.on_existing == TransferOnExisting::Replace,
+            args.on_existing == OnExisting::Replace,
         )
         .await?;
     let graph = target.blob_graph();
@@ -742,14 +999,7 @@ pub async fn invoke_capture(
         id: id.clone(),
         complete: false,
     };
-    let captured = capture(
-        remote,
-        vfs.blobs.as_ref(),
-        graph.as_deref(),
-        &id,
-        args.source_environment_path,
-    )
-    .await?;
+    let captured = capture(remote, vfs.blobs.as_ref(), graph.as_deref(), &id, source).await?;
     guard.complete = true;
     let publication = target.commit(captured.entry).await;
     let (published, message) = match publication {
@@ -757,7 +1007,7 @@ pub async fn invoke_capture(
             true,
             format!(
                 "Captured {} entries into {}.",
-                captured.status.entries, args.destination_vfs_path
+                captured.status.entry_count, args.destination_vfs_path
             ),
         ),
         Err(error) => (
@@ -775,7 +1025,7 @@ pub async fn invoke_capture(
             snapshot_path: "/selection".into(),
             destination: args.destination_vfs_path,
             published,
-            receipt: captured.status,
+            receipt: TransferReceipt::from(&captured.status),
         },
         message,
     )?;
@@ -841,4 +1091,38 @@ mod tests {
             file,
         )));
     }
+
+    #[test]
+    fn vfs_trees_flatten_into_tree_paths_with_digests() {
+        let file = vfs::VfsFile {
+            blob_ref: BlobRef::from_bytes(b"x"),
+            size_bytes: 1,
+            media_type: None,
+            executable: true,
+        };
+        let mut nested = vfs::VfsDirectory::default();
+        nested
+            .entries
+            .insert("lib.rs".into(), vfs::VfsEntry::File(file.clone()));
+        let mut root = vfs::VfsDirectory::default();
+        root.entries
+            .insert("src".into(), vfs::VfsEntry::Directory(nested));
+        let mut entries = Vec::new();
+        flatten(
+            TreePath::root(),
+            &vfs::VfsEntry::Directory(root),
+            &mut entries,
+        )
+        .unwrap();
+        let paths = entries
+            .iter()
+            .map(|entry| entry.path.as_str())
+            .collect::<Vec<_>>();
+        assert_eq!(paths, vec![".", "src", "src/lib.rs"]);
+        assert!(matches!(
+            &entries[2].content,
+            TreeContent::File { digest: Some(digest), executable: true, .. }
+                if digest.to_string() == file.blob_ref.as_str()
+        ));
+    }
 }
diff --git a/docs/documentation/deployment/configuration.md b/docs/documentation/deployment/configuration.md
index 405e1d5de..ef5195ca4 100644
--- a/docs/documentation/deployment/configuration.md
+++ b/docs/documentation/deployment/configuration.md
@@ -74,9 +74,8 @@ callers:
 | `LIGHTSPEED_GATEWAY_BIND` | `0.0.0.0:18080` | Address inside the runtime's network namespace where HTTP listens. |
 | `LIGHTSPEED_API_URL` on Platform | `http://lightspeed-runtime:18080/rpc` | Private Platform-to-runtime JSON-RPC route. |
 | `LIGHTSPEED_PLATFORM_BASE_URL` | `https://lightspeed.example.com` | Public browser origin used for Platform authentication. |
-| `LIGHTSPEED_PUBLIC_BASE_URL` | `https://lightspeed.example.com` | Public runtime origin used for OAuth callbacks, bot hooks, and environment addresses. |
+| `LIGHTSPEED_PUBLIC_BASE_URL` | `https://lightspeed.example.com` | Public runtime origin used for OAuth callbacks, bot hooks, and environment addresses. Registered daemons must dial this origin, because they sign it when they register. |
 | `LIGHTSPEED_ENVIRONMENT_GATEWAY_URL` | `http://lightspeed-runtime:18080` | Private base URL workers use for environment routes; omit `/rpc`. |
-| `LIGHTSPEED_ENVIRONMENT_PUBLIC_URL` | `https://compute.example.com` | Optional separate public base for daemon data connections. |
 
 An address containing `localhost` is relative to the process using it. Inside
 a container it refers to that container. Conversely, binding to `0.0.0.0`
diff --git a/docs/documentation/deployment/self-hosting.md b/docs/documentation/deployment/self-hosting.md
index 300d3f340..3fb98a77c 100644
--- a/docs/documentation/deployment/self-hosting.md
+++ b/docs/documentation/deployment/self-hosting.md
@@ -316,8 +316,13 @@ the proxy runs on the application host.
 
 Allow WebSocket upgrades and long-lived connections on the two public daemon
 routes. Forward the original host and scheme through the proxy's forwarded
-headers. Match those two routes exactly; forwarding the entire
-`/environment-gateway/` prefix would also expose internal worker routes.
+headers, pass WebSocket ping frames through, accept messages of up to 16 MiB,
+and do not close a quiet connection sooner than 60 seconds. Match those two
+routes exactly; forwarding the entire `/environment-gateway/` prefix would
+also expose internal worker routes. Daemons must dial these routes on the
+host of `LIGHTSPEED_PUBLIC_BASE_URL`: they sign that origin when they
+register, and the runtime refuses to serve registration on a non-loopback
+bind without it.
 
 The Platform checks login, membership, role, and session visibility before
 calling the runtime with its deployment key, universe selector, and actor ID.
diff --git a/docs/documentation/deployment/upgrades-and-recovery.md b/docs/documentation/deployment/upgrades-and-recovery.md
index 69d42b77f..80ba7b98e 100644
--- a/docs/documentation/deployment/upgrades-and-recovery.md
+++ b/docs/documentation/deployment/upgrades-and-recovery.md
@@ -234,7 +234,11 @@ observe the deferred work that follows.
 
 An outbound daemon and its gateway must agree on the environment protocol.
 The release metadata records that protocol, and the gateway reports a mismatch
-when an incompatible daemon connects.
+when an incompatible daemon connects. Provider controllers have their own
+protocol number: redeploy every provider together with a runtime release that
+changes it. A provisioned machine whose baked-in daemon speaks another version
+fails when it becomes ready, with an error naming both versions, so recreate
+such machines from an updated image.
 
 `lightspeed-envd upgrade` installs the build named by the deployment's discovery
 document. It verifies the archive checksum and checks the candidate's version,
@@ -251,8 +255,10 @@ relying on daemon upgrades.
 `LIGHTSPEED_ENVD_AUTO_UPGRADE=true` opts an outbound daemon into upgrading on a
 protocol mismatch. It does not update on every version or source change. The
 daemon replaces its executable and re-executes with its arguments, working
-directory, state directory, and identity retained. An attempt limit prevents
-a stale discovery document from causing an upgrade loop. See the
+directory, state directory, and identity retained. The daemon attempts one
+upgrade per protocol version the gateway names, so a stale discovery document
+cannot cause an upgrade loop. Network failures while fetching the document or
+archive are retried; a checksum or build-fact mismatch stops the daemon. See the
 [daemon reference](../reference/environment-variables.md#environment-daemon)
 for discovery URL and private-CA settings.
 
@@ -263,9 +269,11 @@ it can write, so an in-place executable replacement may require administrator
 action.
 
 Daemon identity persistence and process persistence are different. On daemon
-restart, persisted nonterminal jobs become `Interrupted`; interactive process
-handles were held in memory. Retaining the state directory preserves identity
-and recorded output, not a running operating-system execution. See
+restart, persisted nonterminal jobs become `Interrupted` and their surviving
+processes are stopped. Earlier process handles report that the daemon
+restarted; process groups they left running are reported as leftovers and
+are not killed. Retaining the state directory preserves identity and recorded
+output, not a running operating-system execution. See
 [Processes and jobs](../environments/processes-and-jobs.md) before scheduling a
 machine update around active work.
 
diff --git a/docs/documentation/development/changing-contracts.md b/docs/documentation/development/changing-contracts.md
index 02e6d6063..d0fbbfcf6 100644
--- a/docs/documentation/development/changing-contracts.md
+++ b/docs/documentation/development/changing-contracts.md
@@ -16,7 +16,7 @@ before choosing an exporter or changing a version.
 | --- | --- | --- |
 | Public JSON-RPC API | DTOs, method metadata, and service interfaces in `crates/api/src/` | Rust-exported schema, method manifest, OpenRPC, and API reference; TypeScript client, Configurator tools, Platform method-role map, and profile-editor reference. |
 | Workflow integration | Harness emission types, workflow recipes and recovery types, Channels DTOs, and `crates/temporal-workflow/src/workflow_contract.rs` | Workflow schema, manifest, reference, TypeScript types, and known-answer vectors used by client helpers. |
-| Environment control and data | `crates/environment-protocol` | Rust serde fixtures, daemon and provider implementations, and explicit protocol versions. There is no schema exporter for this boundary today. |
+| Environment protocol | Wire types and the method manifest in `crates/environment-protocol` | Per-plane JSON Schema bundles and OpenRPC documents, per-method fixtures, the daemon, client, and provider implementations, both exact-match protocol versions, and the [protocol reference](../reference/environment-protocol.md). |
 | Runtime database | SQL migrations and their embedded registry in `crates/store-pg` | Migration ledger, required schema revision, table ownership list, and release metadata. |
 | Platform database | Schema modules and Drizzle configuration in `platform/db` | SQL migrations, snapshots, journal, and the separate Platform release revision and upgrade baseline. |
 
@@ -209,26 +209,49 @@ regenerating TypeScript shapes does not prove they accept the same versions.
 
 ## Change the environment protocol
 
-The environment protocol belongs to `crates/environment-protocol`. Its serde
-fixtures establish the serialized controller and data-plane messages, and
-`CURRENT_PROTOCOL_VERSION` defines the handshake version. Daemon and
-controller handshakes check exact version equality.
+The environment protocol belongs to `crates/environment-protocol`. Its wire
+types carry the field documentation, and its
+[method manifest](../../../crates/environment-protocol/src/manifest.rs) binds
+every method to its params and response types, plane, capability, and idle
+classification. A method exists exactly when it has a manifest entry. Every
+method also has a fixture under `crates/environment-protocol/fixtures/<plane>/`
+with a valid params object, response, and typed error. Follow the conventions
+in the crate's [module documentation](../../../crates/environment-protocol/src/lib.rs):
+strict decoding, typed error kinds, no `null`, and wire names in doc comments.
+
+Two numbers version the protocol. `ENVD_PROTOCOL_VERSION` covers the data
+plane and the registration channel; `CONTROLLER_PROTOCOL_VERSION` covers
+provider controllers. Every handshake checks exact equality. A change to a
+plane's wire shape, or to the meaning of an existing field or method, needs a
+new number for that plane, which affects which existing daemons and providers
+can connect. Bump the constant in
+[`version.rs`](../../../crates/environment-protocol/src/version.rs), align
+`LIGHTSPEED_ENVD_PROTOCOL_VERSION` or `LIGHTSPEED_CONTROLLER_PROTOCOL_VERSION`
+in `release/metadata.env`, update the implementations and fixtures, and plan
+the rollout across those components. Product version strings and matching Git
+revisions do not substitute for this compatibility check. The gateway's
+`registration/challenge` notification, the daemon discovery document, and the
+`--print-build` output are the frozen bootstrap surface: only add fields to
+them.
+
+After changing a wire type or a manifest entry, regenerate the committed
+contract documents:
 
-A protocol-version change therefore affects which existing
-daemons and providers can connect. Update the corresponding implementations
-and fixtures, align `LIGHTSPEED_ENVIRONMENT_PROTOCOL_VERSION` in
-`release/metadata.env`, and plan the rollout across those components. Product
-version strings and matching Git revisions do not substitute for this
-compatibility check.
+```bash
+cargo run -p environment-protocol --features schema --bin export-contract
+```
 
-Run the wire fixtures and the affected implementation tests:
+Then run the fixtures, the contract check, and the release metadata check:
 
 ```bash
-cargo test -p environment-protocol --test serde
+cargo test -p environment-protocol
 scripts/release/verify-metadata.sh
 ```
 
-The [environment-provider guide](../integrating-and-extending/environment-providers.md)
+`cargo test -p environment-protocol --test contract` fails while the
+committed contract is stale. Update the
+[protocol reference](../reference/environment-protocol.md) when a rule
+changes. The [environment-provider guide](../integrating-and-extending/environment-providers.md)
 covers the controller, daemon, and gateway responsibilities in more detail.
 
 ## Database migrations
diff --git a/docs/documentation/development/testing-and-evaluation.md b/docs/documentation/development/testing-and-evaluation.md
index b830a7af1..df0a548e9 100644
--- a/docs/documentation/development/testing-and-evaluation.md
+++ b/docs/documentation/development/testing-and-evaluation.md
@@ -164,8 +164,10 @@ cargo test -p temporal-runtime --test sessions_live \
 It doesn't need a model key. The
 [development service guide](../../../scripts/dev/README.md#manual-runtime-roles)
 also gives commands for real provider execution and environment lifecycle
-tests. The `environment_provider_live` suite uses an in-process provider with
-the real database and reconciler; it does not require Incus.
+tests. The `environment_provider_live` suite uses the runtime's fake
+controller, served on loopback with a bearer credential, with the real
+database and reconciler; it does not require Incus. The same fake controller
+runs the client's controller conformance suite in the ordinary test run.
 
 VFS transfer coverage uses real Temporal, PostgreSQL, MinIO, and an envd that
 registers with a temporary local gateway. Its scripted model exercises each
diff --git a/docs/documentation/environments/bring-your-own-compute.md b/docs/documentation/environments/bring-your-own-compute.md
index 88614b8ca..bff9bf095 100644
--- a/docs/documentation/environments/bring-your-own-compute.md
+++ b/docs/documentation/environments/bring-your-own-compute.md
@@ -95,9 +95,10 @@ For the local quickstart, run:
 ```
 
 For a remote installation, replace the gateway URL with its public endpoint,
-for example `wss://lightspeed.example.com/environment-gateway/connect`.
-Plain `ws://` is accepted only for loopback connections. Leave the daemon
-running in this terminal.
+for example `wss://lightspeed.example.com/environment-gateway/connect`. Use
+the host of the deployment's public base URL: the daemon signs the origin it
+dials, and the gateway refuses any other. Plain `ws://` is accepted only for
+loopback connections. Leave the daemon running in this terminal.
 
 The daemon opens an outbound control connection. When a worker needs a data
 connection, the daemon opens another outbound connection for that route.
@@ -105,8 +106,14 @@ This command does not start a passive listener on the machine.
 
 Wait for `receipt.json` to appear, then reload the **Environments** page and
 confirm **My workstation** is ready. The receipt records the assigned
-environment and daemon identifiers, without the registration secret. Keep the
-state directory: it contains the daemon's private identity key.
+environment, incarnation, and daemon identifiers, the control connection, the
+identity mode, and whether this admission created the environment or
+reconnected to it. It never contains the registration secret. Keep the state
+directory: it contains the daemon's private identity key.
+
+The daemon sends the registration key only until its first admission. After
+that it reconnects with its identity alone, even if the key is still
+configured.
 
 Once registration succeeds, you can remove the admission secret from this
 machine in another terminal:
@@ -144,7 +151,8 @@ the directory printed by `pwd`.
 
 ## Stop and reconnect
 
-Press Ctrl+C in the daemon terminal. With persistent registration, the
+Press Ctrl+C in the daemon terminal. The daemon tells the gateway it is
+stopping and exits with status 0. With persistent registration, the
 environment becomes offline and remains in the universe; reload
 **Environments** to inspect its status. To reconnect, use the same state
 directory and omit the deleted registration-key file:
@@ -164,8 +172,13 @@ repeat the `pwd` request to verify access.
 
 For short-lived machines, a registration key can instead use an ephemeral
 identity mode. Those environments close after their disconnect grace period.
-Once an environment is closed, its daemon identity cannot register again;
-a replacement needs a fresh state directory and a valid registration key.
+Once an environment is closed, its daemon identity cannot register again: a
+running daemon is told so and exits with status 4, and a replacement needs a
+fresh state directory and a valid registration key.
+
+Run one daemon per state directory. When a second process connects with the
+same identity, the newer connection wins and the older daemon exits with
+status 5, naming the shared identity in its log.
 
 ## Finish the walkthrough
 
@@ -205,7 +218,10 @@ the runtime and daemon run on the same host; in a container deployment,
 | The environment never appears | Check the registration secret, its universe and limits, and that the daemon can reach the gateway. |
 | A remote WebSocket connection fails | Use `wss://` and ensure both `/environment-gateway/connect` and `/environment-gateway/data` reach the environment gateway through a WebSocket-capable proxy. |
 | Restart fails after deleting the key file | Remove `--registration-key-file` from the command and retain the original `--state-dir`. |
-| The daemon reports incompatible protocol versions | Use daemon and runtime builds from the same release. `lightspeed-envd --print-build` reports daemon build and protocol information. |
+| The daemon reports incompatible protocol versions | Use daemon and runtime builds from the same release, or run `lightspeed-envd upgrade`. `lightspeed-envd --print-build` reports daemon build and protocol information. |
+| The daemon exits with status 3 | The gateway refused registration for good, for example an invalid, revoked, or expired key, or a protocol version the daemon cannot upgrade to. The log names the reason. |
+| Registration is refused because the signature does not verify | The daemon dialed a different host than the gateway's public base URL, such as `localhost` instead of `127.0.0.1`. Use the exact public host. |
+| The daemon exits with status 5 | Another process uses the same state directory and identity. Give each daemon its own state directory. |
 | The agent has no process tool | Enable **Environments**, select the active environment, and apply the setup to the actual session. |
 | A command cannot start or find a program | Check the daemon user's permissions, installed programs, Bash, and working directory on the machine. |
 | A closed environment cannot reconnect | Its identity is spent. Create a replacement with a new state directory and registration key rather than reusing the closed identity. |
diff --git a/docs/documentation/environments/incus-vms.md b/docs/documentation/environments/incus-vms.md
index 6904f98cb..628893b85 100644
--- a/docs/documentation/environments/incus-vms.md
+++ b/docs/documentation/environments/incus-vms.md
@@ -26,12 +26,16 @@ Prepare these files for the provider process:
 - An Incus client certificate and private key authorized for the provider's
   project, network, image, profile, and VM operations.
 - A trusted server CA file for validating the Incus HTTPS endpoint.
+- A provider credential: a random secret of at least 32 bytes without
+  whitespace, which Lightspeed presents to the provider.
 - A provider configuration file with the endpoint, storage pool, and templates.
 
-The provider must be able to reach Incus and the guest networks. Its controller
-and guest daemon listeners currently have no application-level authentication.
-Keep them on the protected deployment network; do not expose them as public
-agent or browser endpoints. [Networking and ingress](networking-and-ingress.md)
+The provider must be able to reach Incus and the guest networks. Its
+controller and data routes require the provider credential as a bearer token
+and refuse other callers before the WebSocket upgrade. The guest daemon
+listener inside each VM has no authentication of its own: keep guest networks
+private, and do not expose the provider or its guests as public agent or
+browser endpoints. [Networking and ingress](networking-and-ingress.md)
 describes the separate authenticated runtime route and optional public app edge.
 
 A Platform administrator registers the physical provider and binds universes.
@@ -96,12 +100,22 @@ image and service for workloads that need different software or permissions.
 
 ## Configure and start the provider
 
+Generate the provider credential and keep it readable only by the provider's
+service account:
+
+```bash
+umask 077
+openssl rand -hex 32 > /run/secrets/lightspeed-provider-credential
+```
+
 Create a configuration file such as `/etc/lightspeed/incus-provider.json`.
 This example leaves public application ingress disabled:
 
 ```json
 {
   "controllerListen": "127.0.0.1:19090",
+  "credentialFile": "/run/secrets/lightspeed-provider-credential",
+  "dataRouteBase": "ws://127.0.0.1:19090/routes",
   "incus": {
     "mode": "single",
     "endpoints": ["https://incus.internal:8443"],
@@ -129,10 +143,17 @@ This example leaves public application ingress disabled:
 ```
 
 Replace the Incus address, certificate paths, pool, and fingerprint with your
-installation's values. The sample controller listens on loopback, which works
-when the environment gateway can reach that same host namespace. For separate
-hosts or containers, bind an appropriate private address and register that
-reachable address instead. Preserve the private trust boundary.
+installation's values. Template `memory` and `disk` are whole Incus sizes such
+as `4GiB`; the provider reports them to Lightspeed in bytes. The sample
+controller listens on loopback, which works when the environment gateway can
+reach that same host namespace. For separate hosts or containers, bind an
+appropriate private address and register that reachable address instead.
+
+`dataRouteBase` is the URL at which Lightspeed reaches this listener's
+`/routes` path, so it must use the address Lightspeed dials, not necessarily
+the bind address. The provider advertises it during the controller handshake.
+When Lightspeed reaches the controller through TLS, for example behind a
+reverse proxy, `dataRouteBase` must use `wss://` as well.
 
 The network block denies the metadata-service address in this example. It
 is an explicit egress rule, not a complete network policy. The provider also
@@ -154,14 +175,15 @@ on the same host, check:
 curl --fail http://127.0.0.1:19090/health
 ```
 
-The health response checks Incus topology. It does not prove that the image can
-boot or that a guest daemon is reachable; the first environment test covers
-those steps.
+The health response checks Incus topology and needs no credential. It does not
+prove that the image can boot or that a guest daemon is reachable; the first
+environment test covers those steps.
 
 The complete [example configuration](../../../crates/environment-provider-incus/config.example.json)
-also includes optional relay settings, an image server, and ingress. The
-provider config has no provider ID or list of authorized universes. Those
-belong to Lightspeed's registry and bindings.
+also includes optional relay settings, an image server, and ingress.
+`relayIdleSeconds` cannot be set below 60, so a quiet long read is never cut
+by the relay. The provider config has no provider ID or list of authorized
+universes. Those belong to Lightspeed's registry and bindings.
 
 ## Register the provider and bind a universe
 
@@ -172,12 +194,17 @@ provider**. Enter:
 | --- | --- |
 | Provider id | `incus-local` |
 | Display name (optional) | `Local Incus` |
-| Transport | `WebSocket` |
 | Controller endpoint | `ws://127.0.0.1:19090/control` |
+| Credential | The contents of the provider credential file |
 
-Choose **Register**. The ID is a stable deployment-wide identifier used by its
-universe bindings. For another topology, use the private endpoint reachable from
-the environment gateway rather than its own loopback address.
+Choose **Register**. Lightspeed connects to the controller and checks its
+handshake. A wrong path or credential refuses the registration; a provider
+that is not running yet is accepted and checked again later. The credential
+is write-only: Lightspeed never shows it again, and leaving it empty when
+editing the provider keeps the stored one. The ID is a stable
+deployment-wide identifier used by its universe bindings. For another
+topology, use the private endpoint reachable from the environment gateway
+rather than its own loopback address.
 
 Choose **Bind universe**, select the **Universe**, leave **Binding id** at the
 provider-ID default or enter a stable ID, and choose **Bind**. There can be at
@@ -202,8 +229,9 @@ with **Environments** enabled, then ask the agent to run `pwd` and a harmless
 file check.
 
 The provider configures the guest daemon during provisioning. The stock setup
-listens privately on port 19091 and starts commands in `/workspace`; it uses
-passive connectivity rather than a daemon registration key. The provider
+listens privately on port 19091, starts commands in `/workspace`, and keeps
+its state in `/var/lib/lightspeed-envd`, outside the agent's working tree. It
+uses passive connectivity rather than a daemon registration key. The provider
 relays requests to it through the guest network.
 
 Continue with [Processes and jobs](processes-and-jobs.md) for a complete file
@@ -215,13 +243,18 @@ disk, so save any needed output first.
 
 Publish a changed image under a new fingerprint and a new template ID. Set
 `deprecated: true` on the old template when it should stop appearing for new
-environments. Edit the provider's `templates` configuration and restart its
-service: configuration is loaded at startup, with no hot reload.
+environments. Deprecation affects only new environments: existing ones keep
+waking, powering, and closing normally. Edit the provider's `templates`
+configuration and restart its service: configuration is loaded at startup,
+with no hot reload.
 
 Retain old template entries while their environments still need them, because
 operations such as ingress enablement consult that configuration. Existing
 machines retain their original setup; changing an image does not upgrade their
-files or running processes.
+files or running processes. A VM whose image carries a daemon that speaks
+another environment protocol version than the runtime fails when it becomes
+ready, with an error naming both versions; recreate it from a current
+template.
 
 Disabling a universe binding prevents new provisioning. It does not close
 environments already created through it. Binding deletion is refused while
@@ -254,6 +287,8 @@ before adopting that topology.
 | The provider cannot start or its health check fails | Check configuration, Incus HTTPS trust, client permissions, topology mode, and endpoint reachability. |
 | The universe has no templates | Check provider registration, the universe's enabled binding, and template deprecation. |
 | Incus cannot find the configured image | Use the immutable fingerprint, make it available on the target, or configure a trusted image server. |
-| A VM boots but its environment is not ready | Check the guest daemon service, matching binary architecture, provider-to-guest routes, and private daemon port. |
+| Registering the provider is refused | Check the controller URL path, the credential, and that `dataRouteBase` uses `wss://` when the controller is reached over TLS. |
+| A VM boots but its environment is not ready | Check the guest daemon service, matching binary architecture, provider-to-guest routes, private daemon port, and that `dataRouteBase` reaches the provider from the environment gateway. |
+| The environment fails naming two protocol versions | The image's daemon does not match the runtime release. Rebuild the image and recreate the environment. |
 | A command cannot write outside the workspace | Inspect the stock service's systemd restrictions and daemon-user permissions. Customize the image deliberately if the task needs more access. |
 | Adding a binding fails during network setup | Check Incus permissions, subnet availability, denied-CIDR overlap, and cluster uplink configuration if applicable. |
diff --git a/docs/documentation/environments/networking-and-ingress.md b/docs/documentation/environments/networking-and-ingress.md
index cd025f125..2ea21afd9 100644
--- a/docs/documentation/environments/networking-and-ingress.md
+++ b/docs/documentation/environments/networking-and-ingress.md
@@ -55,6 +55,13 @@ Use `wss://` for a remote gateway. The daemon accepts plain `ws://` only for
 loopback. For a private certificate authority, configure
 `LIGHTSPEED_ENVD_CA_FILE` with the additional trust anchors.
 
+The daemon derives the data path from its configured connect URL, on the same
+origin and under the same path prefix, so both paths must be published on one
+host. The daemon signs the origin it dialed when it proves its identity, and
+the gateway accepts only the origin of its `LIGHTSPEED_PUBLIC_BASE_URL`.
+Point daemons at that public URL; a daemon that dials the gateway under
+another hostname is refused.
+
 The first connection uses a registration key and the daemon's identity. Later
 connections use the retained identity, and requested data sockets use a
 one-time pairing token. Publishing only the control path can therefore make
@@ -82,12 +89,15 @@ with the network or transport boundary. A filesystem root setting or default
 working directory does not make a publicly reachable process service safe to
 expose.
 
-For Incus, the environment gateway reaches the provider's private `/control`
-and derived `/routes/...` endpoints. The provider then dials the guest daemon
-over the private guest IPv4 network, normally on port 19091. Provider endpoints
-also currently rely on the deployment boundary rather than application
-authentication. The provider's connection to the Incus API uses HTTPS client
-credentials and server trust separately.
+For a provider, the environment gateway reaches the controller URL registered
+for it and the data routes the controller advertises during its handshake.
+Both require the provider credential as a bearer token. For Incus, those are
+the provider's `/control` and `/routes/...` paths, advertised through its
+`dataRouteBase`. The provider then dials the guest daemon over the private
+guest IPv4 network, normally on port 19091. That guest listener has no
+authentication of its own, so keep guest networks private. The provider's
+connection to the Incus API uses HTTPS client credentials and server trust
+separately.
 
 Standalone Incus uses a managed bridge per universe binding. Cluster mode
 uses a managed OVN network over the configured uplink. The provider and its
@@ -102,6 +112,11 @@ specific rules are not a general application-aware egress policy.
 Relay connection timeouts and VM idle policies control different resources.
 An idle relay can close without closing the machine or deleting its files.
 The next operation can open another route while the daemon remains available.
+Every hop between a worker and a daemon, including reverse proxies in front of
+the environment gateway, must pass WebSocket ping frames through and must not
+close a connection that has been quiet for less than 60 seconds: a worker
+waiting on a long command read pings every 20 seconds and otherwise sends
+nothing. Hops must also accept WebSocket messages of up to 16 MiB.
 
 ## Configure public application ingress
 
diff --git a/docs/documentation/environments/overview.md b/docs/documentation/environments/overview.md
index 4171186fd..91019e4d5 100644
--- a/docs/documentation/environments/overview.md
+++ b/docs/documentation/environments/overview.md
@@ -133,6 +133,13 @@ The daemon's default working directory is a convenience, not a process
 sandbox. File-path restrictions and read-only file RPC settings do not prevent
 a shell process from using the permissions of that OS user.
 
+The daemon keeps its identity key, job records, and transfer journal in a
+state directory outside the working directory. File and transfer tools can
+never read or change that directory, but commands running as the daemon's
+user can. Grant **Run commands** only where that is acceptable, or run
+commands in a target whose daemon identity is not worth protecting, such as
+a disposable VM.
+
 Environment credential bindings can supply secrets to processes without
 putting the values into the agent's instructions. Those processes can access
 the injected credentials, so their permissions remain part of the environment's
@@ -155,6 +162,6 @@ Then continue through the task guides:
 - [Networking and ingress](networking-and-ingress.md): connect daemons and
   publish applications through the supported provider edge.
 
-The [environment protocol](../../../crates/environment-protocol/src/lib.rs) and
+The [environment protocol reference](../reference/environment-protocol.md) and
 [environment-variable reference](../reference/environment-variables.md#environment-services)
 define the interfaces and settings.
diff --git a/docs/documentation/environments/power-and-cleanup.md b/docs/documentation/environments/power-and-cleanup.md
index 908a9b7cc..214e05f3a 100644
--- a/docs/documentation/environments/power-and-cleanup.md
+++ b/docs/documentation/environments/power-and-cleanup.md
@@ -75,7 +75,15 @@ of the environment. During a transition, they can differ.
 | Offline | A provisioned machine may be stopped; a borrowed machine may have lost its daemon connection. The source determines whether Lightspeed can wake it. |
 | Closing | Cleanup is in progress. Do not submit new work. |
 | Closed | This environment can no longer be used. |
-| Failed or unknown | Inspect provider or gateway diagnostics instead of assuming readiness. |
+| Failed or unknown | Inspect the environment's lifecycle error and provider or gateway diagnostics instead of assuming readiness. |
+
+Provider trouble does not fail an environment at once. While a provider is
+unreachable or answers with a temporary error, the environment keeps its
+status and records the latest problem as its lifecycle error, shown in its
+details. An environment that is still provisioning, booting, or unknown
+fails with that error once the problem has lasted 30 minutes. An environment also fails when its machine disappears outside
+Lightspeed, or when its daemon speaks a different environment protocol
+version than the runtime; the error names both versions.
 
 A session can retain the ID of an environment that has closed or become
 unavailable. The runtime reports that failure; it does not silently select a
@@ -111,8 +119,10 @@ target/debug/lightspeed environment idle-policy "<environment-id>" --clear
 
 Idle time comes from daemon activity, not time since the last chat message.
 Filesystem, process, and job operations affect that activity clock. Running
-processes and jobs prevent automatic idle action. Initialization and idle
-polling do not keep the machine busy by themselves.
+processes and jobs prevent automatic idle action. Initialization, idle
+polling, and the prompt and skill discovery that runs before each agent run do
+not keep the machine busy by themselves, so a chat-only session does not hold
+an idle machine awake.
 
 The runtime checks periodically, so a threshold is not an exact wall-clock
 deadline. To verify the policy, leave the VM without tracked work and without
@@ -171,17 +181,20 @@ target/debug/lightspeed environment close "<environment-id>"
 target/debug/lightspeed environment read "<environment-id>"
 ```
 
-For Incus, closing disables ingress, requests guest shutdown, and deletes the
-VM and disk. The operation is asynchronous. A provider error can leave it
-closing while reconciliation retries, so inspect the final status and provider
-diagnostics when cleanup does not finish.
+Closing asks the provider to destroy everything the environment's machine
+holds, public ingress included. For Incus, that is a guest shutdown of up to
+30 seconds, then a forced stop, then deletion of the VM and disk. The
+operation is asynchronous. Lightspeed closes by the environment's identity,
+so a machine whose creation failed midway is still found and removed. A
+provider error can leave it closing while reconciliation retries, so inspect
+the final status and provider diagnostics when cleanup does not finish.
 
 For an individual registered or external environment, use the CLI or
 `environments/close` API. Closing their records removes access
 through Lightspeed while leaving the computer and files under your control.
-An outbound registered daemon exits when it receives the terminal rejection
-for its closed identity; an external passive daemon is not terminated by the
-logical close. Neither path is a comprehensive cleanup of programs started
+An outbound registered daemon is told its environment closed and exits with
+status 4; an external passive daemon is not terminated by the logical
+close. Neither path is a comprehensive cleanup of programs started
 on the machine. Inspect and manage those processes and files explicitly.
 
 Environment closure does not delete the independent VFS workspace or revoke
diff --git a/docs/documentation/environments/processes-and-jobs.md b/docs/documentation/environments/processes-and-jobs.md
index e459ead0b..a123fde77 100644
--- a/docs/documentation/environments/processes-and-jobs.md
+++ b/docs/documentation/environments/processes-and-jobs.md
@@ -107,20 +107,32 @@ or input files on that route.
 
 ## Collect output and stop a process
 
-Follow-up calls return output through a daemon-owned cursor. Reconnecting a
-client while the daemon remains alive does not require restarting the
-command. Use the handle returned by the start call, and keep the session on
-the originating environment when continuing it.
-
-Output is bounded. The daemon can omit the middle of accumulated output and
-reports omitted bytes; important complete logs should be written to a file.
-The included daemon retains finished process handles for 60 seconds after the
-exit is first observed. They are not a substitute for stored job records or
-saved artifacts.
+Follow-up calls return output through a daemon-owned cursor. The cursor
+advances only after a reply reaches the caller, so a dropped connection does
+not lose output, and reconnecting while the daemon remains alive does not
+require restarting the command. Use the handle returned by the start call,
+and keep the session on the originating environment when continuing it.
+
+A finished command is reported only after its output has settled, so the
+result includes everything the command printed. Output is bounded. When a
+finished command printed more than the tool shows, the result keeps the
+beginning and the end, where failure summaries usually appear, and reports
+how many bytes it left out in between. The daemon itself retains about 1 MiB
+per process between reads; beyond that, it drops the middle of the unread
+output and keeps its beginning and newest bytes. Write important complete
+logs to a file.
+
+The included daemon keeps a finished process readable for 60 seconds after
+its output was fully read, and for two hours when nobody read it to the end.
+Afterwards the handle reports that it expired. A handle from before a daemon
+restart reports that the daemon restarted. Neither is a substitute for
+stored job records or saved files.
 
 Ask the agent to stop the specific process when it is no longer needed. An
-interrupt sends a signal the command can handle or ignore; a kill terminates
-the process group. Inspect the resulting state afterward.
+interrupt sends a signal the command can handle or ignore; with a PTY it
+reaches the foreground job, as Ctrl+C would. A kill terminates the process
+group. Inspect the resulting state afterward: an exit reports either a code
+or the name of the signal that ended the command.
 
 **Stop run** cancels agent work but is not a guarantee that every remote
 operating-system process has stopped. A command can outlive a canceled tool
@@ -143,7 +155,7 @@ if another attachment made it available. The agent receives:
 | --- | --- |
 | `job_run` | Run one bounded job and return its terminal result. |
 | `job_submit` | Submit a group and receive a promise for each job. |
-| `job_read` | Inspect a job's status, bounded output, and available artifact metadata. |
+| `job_read` | Inspect a job's status and bounded output. |
 
 Use `job_run` for a check the agent should wait for directly. It has a default
 30-minute timeout and a maximum of 60 minutes. Use `job_submit` when the agent
@@ -180,13 +192,15 @@ The default dependency policy is `allSucceeded`. If the check fails or is
 canceled, the report becomes `dependencyFailed`. Use `allTerminal` for a
 follow-up that should run after any terminal outcome, such as cleanup.
 Independent jobs can run concurrently. A shared `queue_key` serializes jobs
-in acceptance order within the environment's job namespace, including jobs
-from separate submissions.
+in acceptance order within the environment, including jobs from separate
+submissions.
 
-Names identify dependencies within a submission. Job IDs identify executions;
-use fresh IDs for a deliberately new run of this example. Jobs accept an
-argument array, working directory, environment variables, timeout, and
-one-shot stdin, but have no interactive input channel or PTY.
+Names identify dependencies within a submission. Job IDs identify executions
+within the environment; use fresh IDs for a deliberately new run of this
+example. Reusing a job ID from an earlier submission is refused rather than
+replaying the earlier run's result, so the agent is told to choose a new ID.
+Jobs accept an argument array, working directory, environment variables,
+timeout, and one-shot stdin, but have no interactive input channel or PTY.
 
 ## Wait, detach, or cancel
 
@@ -220,19 +234,24 @@ environment's job service; there is no central Lightspeed job registry that
 copies the machine's execution state.
 
 The included daemon persists job records and output under its state directory.
-After a daemon restart, previously unfinished records become `interrupted`;
-inspect any effects before starting replacement work. Completed records remain
-readable when that directory survives. Save useful output outside a disposable
-machine before destroying it.
-
-Inspect terminal statuses such as `succeeded`, `failed`, `cancelled`,
-`timedOut`, `dependencyFailed`, `interrupted`, or `lost`. A missing record is
-not evidence of success. Jobs also attempt to clean up descendants left after
-their main process exits; an orphaned-descendant result needs investigation.
-
-The daemon currently returns no discovered artifacts in the optional artifact
-list. A job writing a file does not automatically export it. Read and retain
-output files explicitly before [closing the environment](power-and-cleanup.md).
+A job keeps the beginning and the end of its output, 1 MiB each, and reports
+the size of the omitted middle. After a daemon restart, previously unfinished
+records become `interrupted`, and the daemon stops any of their processes
+that are still running; inspect any effects before starting replacement work.
+Completed records remain readable for seven days when that directory
+survives. Save useful output outside a disposable machine before destroying
+it.
+
+Inspect terminal statuses: `succeeded`, `failed`, `cancelled`, `timedOut`,
+`dependencyFailed`, or `interrupted`. When the environment no longer knows a
+job, because it never existed there or its record expired, `job_read` reports
+it as not found and a pending promise for it settles as `lost`. A missing
+record is not evidence of success. When a job finishes, the
+daemon stops descendants its main process left running; an
+orphaned-descendant result needs investigation.
+
+A job writing a file does not export it. Read and retain output files
+explicitly before [closing the environment](power-and-cleanup.md).
 
 ## Start jobs through the API
 
@@ -258,17 +277,24 @@ For example, this is a complete `environments/jobs/create` params object:
 }
 ```
 
-Retain the request ID and identical inputs when retrying the same admission.
-If omitted, job IDs are derived from the environment, request, and job index.
-Reusing an existing job ID with different job inputs conflicts. Fresh intended
-work should use a new request ID and new explicit job IDs when supplied.
+Retain the request ID and identical inputs when retrying the same admission:
+the environment then returns the jobs it already started. If omitted, job IDs
+are derived from the environment, request, and job index. Reusing an existing
+job ID with another request ID or different job inputs conflicts. Fresh
+intended work should use a new request ID and new explicit job IDs when
+supplied.
 
 The response supplies job handles, not session promises. These standalone jobs
-belong to the environment. Read using the returned handles, inspect each
-entry's status and error, and advance output reads with `outputNextSeq` as
-the next `afterSeq`. Output chunks contain base64 data. Cancellation can target
-the individual job or its dependents; it may initially report
-`cancelRequested`, so continue reading until terminal.
+belong to the environment. Read using the returned handles and inspect each
+entry's status and error; an entry with an error and no summary names a job
+the environment does not know. Output positions are byte offsets: pass an
+entry's `outputNext` as the next read's `after`, or read the last bytes with
+`tailBytes`. `outputEnd` is the output produced so far, and `outputGaps` name
+ranges that are no longer available. Output chunks contain base64 data.
+Cancellation can target the individual job or its dependents. A running job
+first receives a termination signal and is killed after a grace period unless
+`force` is set; it reports `cancelRequestedAtMs` and stays `running` until it
+ends, so continue reading until terminal.
 
 A standalone call can return `environment_not_ready` during provisioning or
 wake-up. Wait and retry with the same creation identity. Exact types and
diff --git a/docs/documentation/environments/using-environments.md b/docs/documentation/environments/using-environments.md
index 17fb18a62..ed8a05709 100644
--- a/docs/documentation/environments/using-environments.md
+++ b/docs/documentation/environments/using-environments.md
@@ -81,6 +81,19 @@ Choose the lowest level that covers the task:
 Each level includes those before it. Command execution includes file editing
 because a process can write files using the daemon user's permissions.
 
+File tools on a machine behave the same way at every level. Search and glob
+skip hidden entries and paths excluded by `.gitignore` or `.ignore`, and
+never descend into `.git` or other version-control metadata; in their
+patterns, `*` matches within one path segment and `**` across segments. One
+read returns at most the daemon's advertised read limit, 8 MiB on the
+included daemon; a ranged read pages through a larger file, while an edit of
+a larger file fails instead of working on a truncated copy. Use
+[VFS transfer](vfs-transfer.md) for large files. Writes replace a file
+atomically. An edit or patch fails, instead of overwriting, when the file
+changed on the machine after the agent read it. File tools stay inside the
+daemon's filesystem root: a symlink is followed only while its target stays
+inside it.
+
 ```json
 {"features":{"environments":{"environments":[{"environmentId":"<environment-id>","default":true,"access":"read"}]}}}
 ```
diff --git a/docs/documentation/environments/vfs-transfer.md b/docs/documentation/environments/vfs-transfer.md
index 02f2575f0..c2105d6ee 100644
--- a/docs/documentation/environments/vfs-transfer.md
+++ b/docs/documentation/environments/vfs-transfer.md
@@ -52,10 +52,12 @@ entries found only in that destination and publishes the complete replacement
 at once. Sibling paths are untouched. Use `on_existing = "error"` when an
 existing destination should cause the operation to fail instead.
 
-Missing destination parents are created where permitted. Non-directory
-ancestors and environment symlinks are rejected. A failed materialize can
-leave newly created parent directories, but it does not publish a partial
-replacement. There is no automatic merge or ongoing synchronization.
+Missing destination parents are created where permitted. A symlinked
+ancestor is followed while it stays inside the daemon's filesystem root; a
+destination that is itself a symlink, a special file, or a non-directory
+ancestor is rejected. A failed materialize can leave newly created parent
+directories, but it does not publish a partial replacement. There is no
+automatic merge or ongoing synchronization.
 
 Capture first saves an immutable VFS snapshot with the selected content at
 `/selection`, then attempts to update the workspace. If another writer changed
@@ -78,58 +80,78 @@ size and concurrency limits. Allow enough machine disk for the existing tree,
 missing uploads, and the staged replacement. Overlapping materialization
 destinations are rejected.
 
-The tool result reports references and counts rather than file payloads. Exact
-limits and wire sizes are defined in the
-[inventory types](../../../crates/environment-protocol/src/data/inventory.rs);
-the [transfer implementation](../../../crates/tools/src/transfer.rs) describes
-content reuse and workspace publication.
+The tool result reports references and counts rather than file payloads. Each
+daemon advertises its exact transfer limits when a client connects; the
+[transfer types](../../../crates/environment-protocol/src/data/transfer.rs)
+define them, and the [transfer implementation](../../../crates/tools/src/transfer.rs)
+describes content reuse and workspace publication.
+
+## What a capture selects
+
+A capture copies the whole selected tree, including hidden entries and paths
+that `.gitignore` excludes. Version-control metadata directories (`.git`,
+`.hg`, `.svn`, and `.jj`) and the daemon's own state directory are never
+captured. A symlink whose target stays inside the selected tree is captured as
+the file or directory it points to. A link that leaves the selection, a
+symlink cycle, or a special file such as a FIFO or device fails the capture.
+Names that are not UTF-8 are skipped and counted in the result.
 
 ## Environment data-plane API
 
-Clients implementing their own transfers use `EnvironmentDataClient::transfer`
-and the `fs/transfer` protocol after negotiating `filesystemTransfer`. The
-daemon interface handles machine files; the Lightspeed tools above connect it
-to VFS and content-addressed storage.
+Clients implementing their own transfers use the `transfer/*` methods of the
+[environment protocol](../reference/environment-protocol.md#files-and-transfers).
+Every daemon serves them as part of its filesystem family. The daemon
+interface handles machine files; the Lightspeed tools above connect it to VFS
+and content-addressed storage.
 
-| Actions | Purpose |
+| Methods | Purpose |
 | --- | --- |
-| `begin`, `advance` | Start an operation and advance scanning or staging. |
-| `inventory`, `append`, `missing` | Exchange inventory pages and identify missing content. |
-| `read`, `write` | Transfer bounded file chunks at explicit offsets. |
-| `commit` | Verify the capture or publish the staged replacement. |
-| `status`, `abort` | Inspect progress or abandon incomplete work. |
-
-Keep the same operation ID and input when retrying. Completed-operation
-receipts survive daemon restart until expiry, so a repeated commit does not
-overwrite subsequent local edits. A partially staged operation does not resume
-transparently after a daemon crash: inspect the destination and abort it before
-starting a new operation.
-
-The [transfer protocol](../../../crates/environment-protocol/src/data/transfer_session.rs)
-defines pagination, retry, and chunk semantics. The older `fs/materialize` and
-`fs/capture` methods remain compatibility adapters for small copies, with
-8 MiB, 1,024-entry, and 30-second limits.
+| `transfer/begin`, `transfer/advance` | Start an operation and advance scanning or staging. |
+| `transfer/readInventory`, `transfer/append`, `transfer/listMissing` | Exchange inventory pages and list content the daemon still needs. |
+| `transfer/read`, `transfer/write` | Transfer bounded content chunks by digest. |
+| `transfer/commit` | Release a capture or publish the staged replacement. |
+| `transfer/getStatus`, `transfer/abort` | Inspect progress or a receipt, or abandon incomplete work. |
+
+Keep the same operation ID and input when retrying. The first failure moves an
+operation to `failed` with its error, every later call reports that error, and
+nothing is committed; start a new operation to try again. A finished
+operation's receipt is kept for 24 hours after it finished, across daemon
+restarts, so a repeated commit does not overwrite subsequent local edits. An
+operation that was in progress when the daemon restarted reports as failed and
+its staging is discarded.
+
+Captures, materializations, and single-file writes use separate selections of
+one operation type. The
+[transfer module](../../../crates/environment-protocol/src/data/transfer.rs)
+defines the phases, pagination, retry, and chunk semantics.
 
 ## Generic filesystem scans
 
-For discovery rather than copying, `EnvironmentDataClient::scan` sends
-`fs/scan` after negotiating `filesystemScan`. A client selects roots and
-patterns and can request metadata, inline content, or SHA-256 digests. This is
-the lower-level operation used to discover files such as prompts and skills.
-
-Complete scans can return a fingerprint for conditional `ifNoneMatch` requests.
-Incomplete scans return diagnostics and never claim the result is unchanged.
-A metadata-only fingerprint covers metadata, not file bytes. Scans have small
-response and time limits; use transfer sessions for large inventories and
-content. The [scan types](../../../crates/environment-protocol/src/data/inventory.rs)
-defines those request fields and responses.
+For discovery rather than copying, `fs/scan` reads several small trees in one
+call. A client selects roots and patterns and can request metadata, inline
+content, or SHA-256 digests. This is the lower-level operation used to discover
+files such as prompts and skills. A scan observes the environment without
+counting as use, so discovery does not keep an idle machine awake.
+
+Each root is reported on its own: complete, missing, or failed with its error.
+Entries the scan cannot include, such as an oversized file or a symlink
+leaving the filesystem root, are skipped and listed with a reason without
+failing the root. A complete root can return a fingerprint for conditional
+`ifNoneMatch` requests. A metadata-only fingerprint covers metadata, not file
+bytes. Scans have small response and time limits; use transfers for large
+inventories and content. The
+[scan types](../../../crates/environment-protocol/src/data/scan.rs)
+define those request fields and responses.
 
 ## Filesystem boundary and consistency
 
-Transfers reject symlinks, special files, and non-UTF-8 names. Replacement uses
-atomic filesystem operations on Linux and macOS; unsupported filesystems fail
-instead of exposing a partly replaced tree. Windows execution support is not
-implemented. Platform-specific details live beside the
+Every transfer path follows the daemon's one confinement rule: it must lie
+inside the daemon's filesystem root, a symlink is followed only while its
+target stays inside the root, and the daemon's state directory is never
+addressed. Replacement uses atomic filesystem operations on Linux and macOS;
+unsupported filesystems fail instead of exposing a partly replaced tree.
+Windows execution support is not implemented. Platform-specific details live
+beside the
 [daemon transfer code](../../../crates/environment-daemon/src/filesystem/transfer/mod.rs).
 
 Capture observes a live filesystem. It verifies metadata and content while
diff --git a/docs/documentation/index.md b/docs/documentation/index.md
index accf791cb..f88b3df9e 100644
--- a/docs/documentation/index.md
+++ b/docs/documentation/index.md
@@ -71,7 +71,9 @@ and follow the guide for your extension.
 
 The [JSON-RPC reference](../../crates/api/contract/api-reference.md) and
 [workflow contract](../../crates/temporal-workflow/contract/workflow-contract.md)
-provide exact operations and payloads.
+provide exact operations and payloads. To supply compute, follow
+[Implement an environment provider](integrating-and-extending/environment-providers.md)
+against the [environment protocol reference](reference/environment-protocol.md).
 
 ## Understand how it works
 
diff --git a/docs/documentation/integrating-and-extending/environment-providers.md b/docs/documentation/integrating-and-extending/environment-providers.md
index 9f7a6fa72..68eb35899 100644
--- a/docs/documentation/integrating-and-extending/environment-providers.md
+++ b/docs/documentation/integrating-and-extending/environment-providers.md
@@ -1,239 +1,329 @@
 # Implement an environment provider
 
-An environment provider supplies managed compute through Lightspeed's public
+An environment provider supplies managed compute through Lightspeed's
 environment protocol. It translates requests such as creating, waking, or
-closing an environment into the infrastructure it controls, then makes that
-environment's filesystem and process service reachable.
+closing an environment into the infrastructure it controls, then routes
+Lightspeed to the daemon running inside that environment.
 
-The provider implements the environment protocol. It does not need Lightspeed's
-database, API implementation, harness, or Temporal runtime. The included Incus
-provider demonstrates that separation. If you only need to connect an existing
-machine, [outbound daemon registration](../environments/bring-your-own-compute.md)
-already provides that path without implementing a provisioning controller.
+The provider implements the controller plane of the
+[environment protocol](../reference/environment-protocol.md). It does not need
+Lightspeed's database, API implementation, harness, or Temporal runtime. The
+included Incus provider demonstrates that separation. If you only need to
+connect an existing machine, [outbound daemon registration](../environments/bring-your-own-compute.md)
+already provides that path without implementing a controller.
 
 ## Separate control from execution
 
-The controller manages targets: machines or other units of compute owned by
-the provider. The data endpoint performs filesystem, process, and job
-operations inside a selected target. A target that exists in infrastructure
-is not necessarily ready to serve that data protocol.
+The controller manages targets: VMs, containers, sandboxes, or other units of
+compute owned by the provider. Inside each target runs `lightspeed-envd`, the
+daemon that serves filesystem, transfer, process, and job operations. The
+provider supplies compute and routing; it does not reimplement the daemon.
+A target that exists in infrastructure is not necessarily ready to serve
+data operations.
 
 ```mermaid
 flowchart LR
-  Runtime[Lightspeed runtime] -->|controller requests| Provider[Provider service]
-  Provider -->|provision and power| Infrastructure[Compute infrastructure]
-  Runtime -->|target data route| Provider
-  Provider -->|data protocol| Daemon[Daemon in target]
-  Infrastructure --> Target[Target machine]
+  Runtime[Lightspeed runtime] -->|controller plane, bearer credential| Controller[Provider controller]
+  Controller -->|provision and power| Infrastructure[Compute infrastructure]
+  Runtime -->|data route, bearer credential| Route[Provider data route]
+  Route -->|data plane, unchanged| Daemon[lightspeed-envd in target]
+  Infrastructure --> Target[Target]
   Target --- Daemon
 ```
 
-The current hosted controller implementation supports WebSocket transport.
-Public transport enums also name other transports, but that does not mean
-the runtime implements them for registered controllers. Use a controller URL
-ending in `/control`, optionally under a path prefix. The runtime derives a
-sibling data route with this form:
+The two planes have separate version numbers. A provider speaks
+`CONTROLLER_PROTOCOL_VERSION`; the daemon in its targets speaks
+`ENVD_PROTOCOL_VERSION`. Both are matched exactly, and both are currently 3.
+A provider that never parses data-plane messages, and only relays them,
+does not depend on the daemon's number. A provider that bakes the daemon
+into its images still has to ship images whose daemon matches the runtime.
 
-```text
-/routes/{universe}/{binding}/{environment}/{incarnation}/{target}
-```
+## Serve the controller endpoint
 
-Your provider must serve that route and reach the appropriate target's data
-endpoint. This is distinct from the public outbound registration routes used
-by bring-your-own daemons.
+The controller is one WebSocket endpoint. The operator registers its URL in
+Lightspeed together with a provider credential. The URL may use `ws://`,
+`wss://`, or `unix:///absolute/path`, under any path; the Incus provider
+uses `/control`. Use `wss` whenever the controller is reachable beyond a
+single host.
 
-The current connection configuration does not supply a bearer token or
-authentication headers to provider controllers. Keep that connection on a
-protected network, as the Incus deployment does; the configured URL does not
-authenticate callers to a publicly exposed controller.
+Every connection to the controller and to each data route carries
+`Authorization: Bearer <credential>`. Compare it in constant time and refuse
+a missing or wrong credential with HTTP 401 before the WebSocket upgrade.
+Treat the credential as a secret in the provider's own configuration, as the
+Incus provider does with its `credentialFile`.
 
-## Start with the protocol types
+Run the shared JSON-RPC envelope and handshake on that socket. `initialize`
+comes first, a repeat is `invalidRequest`, and another protocol version is
+`versionMismatch`. The response names the `controller` plane and carries two
+facts the runtime records on the provider:
 
-The [environment protocol crate](../../../crates/environment-protocol/src/lib.rs)
-defines controller and data messages, wire encoding, and the current handshake
-version. Start from those types and their serialization fixtures. The handshake
-checks protocol compatibility and advertises capabilities; build information
-helps diagnose a mismatch but does not authenticate a peer.
+```json
+{
+  "protocolVersion": 3,
+  "plane": "controller",
+  "serverInfo": {"name": "example-provider", "version": "1.2.0"},
+  "capabilities": {"adoptTarget": false, "ingress": true},
+  "routes": {"data": "wss://provider.example.com/routes"}
+}
+```
 
-The [typed client](../../../crates/environment-client/src/lib.rs) and
-[Incus provider](../../../crates/environment-provider-incus/README.md) are useful
-implementation references. Keep their internal infrastructure choices separate
-from the public wire contract. In particular, the runtime's internal
-environment resolver is policy inside Lightspeed, not an interface a third-party
-provider needs to implement.
+`capabilities` lists the optional features. `adoptTarget` serves
+`target/adopt`; `ingress` serves `ingress/ensure` and `ingress/remove`.
+Everything else is mandatory at this version. The runtime never calls an
+optional method the controller does not advertise and refuses the
+corresponding API requests up front. If one arrives anyway, answer
+`capabilityUnavailable`.
 
-## Implement controller operations
+`routes.data` is the base URL of the data routes. Lightspeed never derives it
+from the controller URL. A controller served over `wss` must advertise a
+`wss` base; the runtime refuses a downgrade.
 
-Advertise only the capabilities your controller can fulfill:
+## Implement controller operations
 
-| Operation | Provider responsibility |
+| Method | Provider responsibility |
 | --- | --- |
-| `controller/initialize` | Negotiate the protocol and describe controller capabilities. |
-| `controller/listTemplates` | Return approved templates available to the supplied universe/binding. |
-| `controller/createTarget` | Create or reconcile a target from stable request and environment identity. |
-| `controller/listTargets`, `controller/getTarget` | Report observed targets and state within that binding. |
-| `controller/adoptTarget` | Explicitly transfer an existing target into managed ownership, when supported. |
-| `controller/setTargetPower` | Converge toward an advertised power state and report actual observation. |
-| `controller/closeTarget` | Remove the owned target; repeated closure should observe it as closed. |
-| `controller/ensureIngress`, `controller/removeIngress` | Apply or remove provider-approved application exposure, when supported. |
+| `template/list` | Return the approved templates available to the supplied universe and binding. |
+| `target/create` | Return the owner's existing target, or apply template policy and start creating one. |
+| `target/adopt` | Take over an existing target named in your own format, when you advertise `adoptTarget`. |
+| `target/get` | Observe the target without changing anything. |
+| `target/setPower` | Converge toward one of the target's supported power states. |
+| `target/close` | Destroy everything the owner's target holds, ingress included. |
+| `ingress/ensure`, `ingress/remove` | Apply or remove provider-approved application exposure, when you advertise `ingress`. |
 
-A create request carries identity and a template selection. For example:
+A create request carries the target's owner and a template selection:
 
 ```json
 {
-  "binding": {
+  "owner": {
+    "universeId": "u1",
     "bindingId": "primary",
-    "universeId": "00000000-0000-0000-0000-000000000001"
+    "environmentId": "env_1",
+    "incarnationId": "inc_1"
   },
-  "environmentId": "environment-1",
-  "incarnationId": "incarnation-1",
-  "requestId": "request-1",
-  "templateId": "lightspeed-dev-v1"
+  "templateId": "ubuntu-24.04-small"
 }
 ```
 
-These are controller method parameters, not a public Lightspeed API request.
-They come from the protocol's
-[create-target fixture](../../../crates/environment-protocol/fixtures/controller_create_target_params.json).
-The request does not carry an arbitrary image, private address, or cloud-init
-document. The provider's template policy determines what the caller may
-provision.
+This comes from the protocol's
+[create fixture](../../../crates/environment-protocol/fixtures/controller/target.create.json),
+which also shows the response and a typed error. The request does not carry
+an arbitrary image, private address, or cloud-init document. Your template
+policy decides what the caller may provision.
+
+Every target and ingress method answers `{"target": <observation>}`.
+The [protocol reference](../reference/environment-protocol.md#controller-plane)
+states each method's rules and errors.
+
+### Answer promptly
+
+Every method returns within a few seconds. Slow work, such as an image pull,
+a boot, or a graceful shutdown, continues in the background. The runtime
+follows it with `target/get`. Container and cloud APIs are usually
+asynchronous already: answer `target/create` with `phase: provisioning` as
+soon as the request is accepted, even before your backend has assigned an
+id, and include `targetId` in the first observation that has one.
 
 ### Make ownership survive retries
 
-An ambiguous infrastructure response is normal: a create request can succeed
-while its response is lost. Record enough ownership information to find that
-same target on retry. Include universe, binding, environment, incarnation,
-request, and template identity, and reject conflicting reuse.
-
-Every mutation and data route must verify the target belongs to the supplied
-binding and incarnation. Knowing a native target ID is insufficient. An old
-incarnation must not gain access to the replacement environment or destroy
-it during delayed cleanup.
-
-Incus uses deterministic names and `user.lightspeed.*` ownership metadata on
-native resources. This allows the provider process to restart and reconcile
-without a private database. Another provider can use different persistence,
-but must preserve the same ownership and retry properties.
-
-Adoption transfers ownership. In the Incus implementation, it
-replaces the source VM's networking/profiles with the managed binding policy,
-and a later close destroys the adopted VM. Document your provider's adoption
-effects as part of its contract rather than presenting adoption as a harmless
-label change.
-
-### Report readiness and power honestly
-
-Target status can distinguish creating, starting, ready, paused, suspended,
-stopped, closing, closed, failed, and unknown. Report infrastructure observation
-and protocol readiness, not merely the desired state requested by a caller.
-Advertise only the supported steady power states.
-
-The Incus provider probes the guest data handshake before reporting a running
-VM as ready. Until that handshake succeeds, the target remains starting.
-Apply the same distinction when your infrastructure reports a machine running
-before its daemon, filesystem, or network is usable.
-
-Ingress follows provider policy. The controller request identifies an owned
-target; it does not let callers choose arbitrary ports or upstream addresses.
-A template advertises `publicIngress`, and the provider decides the approved
-port and endpoint. Return the ready public endpoint or disabled state and
-remove access when ingress or the target is closed. See
-[Networking and ingress](../environments/networking-and-ingress.md) for the
-user-facing behavior this must support.
-
-## Supply the data endpoint
-
-Reusing `lightspeed-envd` inside a target avoids implementing the entire data
-surface again. The daemon already provides filesystem confinement, process
-groups, output cursors, PTYs, background jobs, credential transfer, and idle
-observation. Your provider still owns routing and target lifecycle.
-
-A custom data server must implement the `initialize`/`initialized` handshake
-and the operations it advertises. Its capabilities must agree with the
-controller's target summary. Use the protocol types for the exact handshake
-fields and response shape.
-
-Pay attention to the state that survives an individual socket:
-
-| Area | Behavior to preserve |
+A target belongs to exactly one owner: universe, binding, environment, and
+incarnation. You hold at most one target per owner. An ambiguous
+infrastructure response is normal: a create can succeed while its response is
+lost. `target/create` and `target/adopt` are therefore idempotent per owner.
+When the owner already has a target, return its observation and apply no
+creation policy, so deprecating a template never affects existing targets.
+
+Every target method names the owner in a target reference,
+`{owner, targetId?}`. Without `targetId`, resolve the owner's target yourself.
+This is how Lightspeed closes a target whose id it never learned, so
+`target/close` must work by owner alone and answer `closed` without a
+`targetId` when you hold nothing for that owner. A target that belongs to
+another owner is `failedPrecondition` (`ownerMismatch`). Knowing a native
+target id is never enough: an old incarnation must not reach its
+replacement or destroy it during delayed cleanup.
+
+The Incus provider derives deterministic names from the owner and records
+`user.lightspeed.*` ownership metadata on its native resources, so it can
+restart and reconcile without a private database. Another provider can use
+labels, tags, or its own store, but must preserve the same properties.
+
+Adoption transfers ownership. In the Incus implementation, it replaces the
+source VM's networking and profiles with the binding's policy, and a later
+close destroys the adopted VM. Document your adoption format and effects as
+part of your provider's contract rather than presenting adoption as a
+harmless label change.
+
+### Report what you observe
+
+An observation has two axes. `state.phase` is `provisioning`, `active`,
+`closing`, `closed`, `failed`, or `unknown`. While `active`, `state.power` is
+`running`, `paused`, `suspended`, or `stopped`, in provider-neutral terms:
+a paused container and a frozen VM are both `paused`. `supportedPowerStates`
+lists only the states `target/setPower` can actually reach.
+
+Report infrastructure observation, not the state a caller requested. Set
+`state.daemonReady` only once your own probe reached the daemon on the
+target's data route; a WebSocket upgrade is enough, and you need not speak the
+daemon's protocol. Until then, a running machine stays `daemonReady: false`.
+When a target is `failed` or `unknown`, or a transition waits for something,
+say why in `state.message`; Lightspeed shows it to users as the environment's
+lifecycle error.
+
+A target that no longer exists is `notFound` from `target/get`. Lightspeed
+records the environment as failed, so a target deleted out of band is noticed
+on the next observation.
+
+### Close means destroy
+
+`target/close` removes everything the owner's target holds, its public
+ingress included. Stop gracefully within your own bound, then force. Answer
+`closing` while that runs and `closed` once nothing remains. Repeated close
+calls are expected and must observe the same outcome. Lightspeed never calls
+`ingress/remove` before close; that method exists only to disable ingress on
+a target that stays.
+
+### Expose ingress through policy
+
+Ingress follows provider policy. A request identifies an owned target; it does
+not let callers choose ports or upstream addresses. A template advertises
+`publicIngress`, and the provider decides the approved port and endpoint.
+Report the realized endpoint in the observation's `ingress`, absent when
+disabled; the runtime converges the environment's recorded intent against
+that field. See [Networking and ingress](../environments/networking-and-ingress.md)
+for the user-facing behavior.
+
+Templates report their size as typed `resources`: `vcpus`, `memoryBytes`,
+and `diskBytes`. Use `metadata` only for display facts, such as an image
+fingerprint.
+
+### Return typed errors
+
+Use the protocol's error kinds, each with its fixed integer code. Lightspeed
+branches on them:
+
+| Situation | Answer |
 | --- | --- |
-| Filesystem | Explicit paths/root confinement, bounded reads/searches, write semantics, and typed errors. |
-| Processes | Caller-owned process IDs, input/termination, retained output, and cursor behavior across connections. |
-| Jobs | Namespace/request/job identity, dependency and queue policy, idempotent submission, and retained results. |
-| Credentials | Per-call secret handling without logging or persisting injected values in the job specification. |
-| Idle observation | Monotonic time since real work, together with running-work and leftover-process information. |
-
-For processes, an explicit `afterSeq` rereads retained output without advancing
-the daemon-owned cursor; omitting it uses that cursor. `waitMs` controls how
-long an observation waits, while `timeoutMs` is an execution deadline. Treating
-both as process-kill settings would break callers that poll long-running work.
-
-The shipped daemon retains process/job state beyond a socket but does not
-implement connection resumption through `resumeConnectionId`; initialization
-returns a fresh connection ID. Do not infer durable process survival across a
-daemon restart from socket reconnection behavior. [Processes and jobs](../environments/processes-and-jobs.md)
-explains that separate lifecycle.
-
-`secretEnv` contains plaintext secret values while crossing the data protocol.
-Protect the transport and keep those values out of logs, provider metadata,
-and workflow history. Redacted debug formatting is not encryption. The
-[credential guide](../environments/credentials.md) describes the binding and
-injection policy surrounding this transport.
-
-`env/idle` reports a monotonic idle duration. Running processes and jobs count
-as work; handshake and idle probes do not. Leftover process groups after their
-root exits are reported separately and do not automatically block idle power
-policy. That distinction lets policy choose an appropriate freeze or stop
-behavior without treating observation itself as activity.
-
-Return the protocol's string-coded errors, such as `notFound`, `forbidden`,
-`conflict`, `unsupported`, or `capabilityUnavailable`. These are distinct from
-the public Lightspeed API's numeric JSON-RPC error mapping.
-
-<a id="test-the-provider-boundary"></a>
+| Your backend API is unreachable or overloaded | `unavailable` or `busy`, optionally with `retryAfterMs`. The runtime retries. |
+| The template is deprecated or the target's owner differs | `failedPrecondition` with `templateDeprecated` or `ownerMismatch`. |
+| The template or target does not exist | `notFound`. |
+| A power state is not supported | `invalidParams`. |
+| A power change on a target that is not active | `failedPrecondition` (`targetNotActive`). |
+
+Retryable kinds, `internal`, transport failures, and timeouts keep the
+environment's status and are retried. If such errors persist for 30 minutes,
+the environment fails with the last error. Other refusals fail a provisioning
+environment at once, so reserve them for requests that can never succeed.
+
+## Serve the data routes
+
+A target's data route is your advertised base followed by
+`/{universeId}/{bindingId}/{environmentId}/{incarnationId}/{targetId}`, each
+segment percent-encoded. Lightspeed dials it with the provider credential.
+Check that the owner in the path owns the target, then connect the socket to
+the daemon in that target and relay frames unchanged in both directions.
+
+A relay is an intermediary under the protocol's liveness rule:
+
+- Forward ping and pong frames, and count every frame as activity.
+- Never close a connection for idleness sooner than 60 seconds. A client
+  waiting on a long read pings every 20 seconds and otherwise sends nothing.
+- Accept and send WebSocket messages and frames of up to 16 MiB.
+
+The data socket carries `secretEnv` values in plaintext. Use TLS or a
+protected network on every hop, and keep those values out of logs, provider
+metadata, and traces. The [credential guide](../environments/credentials.md)
+describes the policy around them.
+
+## Run the daemon in your targets
+
+Install `lightspeed-envd` in every target and start it as a passive listener
+the data route can reach, for example on a private port or a Unix socket.
+Configure it with environment variables; the
+[daemon reference](../reference/environment-variables.md#environment-daemon)
+lists them.
+
+- Set `LIGHTSPEED_ENVD_CWD` to the agent's working directory and, when the
+  agent should see only part of the filesystem, `LIGHTSPEED_ENVD_FS_ROOT`.
+- Set `LIGHTSPEED_ENVD_STATE_DIR` to a directory outside the working
+  directory that survives the restarts you intend to support, such as
+  `/var/lib/lightspeed-envd`. It holds job records and output, process spawn
+  records, and the transfer journal. The daemon refuses every data-plane
+  path inside it.
+- Run the daemon as a user whose permissions fit the work. Commands run as
+  that user, and the filesystem root is a boundary for data operations only,
+  not for commands.
+
+The daemon reports a new `daemonInstanceId` after every start. Process
+handles from an earlier instance answer `notFound` with reason
+`daemonRestarted`, and unfinished jobs become `interrupted`. A container
+runtime that restarts the daemon's process or replaces the container is
+therefore visible to callers; avoid restarting a daemon that serves work.
+
+`env/getIdle` reports how long the environment has been idle. Lightspeed's
+power reaper reads it before pausing, suspending, stopping, or closing a
+target under an idle policy. Running processes and jobs keep `idleForMs` at
+zero; handshakes, idle reports, and discovery scans do not count as use.
 
 ## Test the provider
 
-Start with serialization fixtures and the typed client's expectations. The
-protocol and client unit suites can run without provisioning infrastructure:
+Start with the protocol's fixtures and the two conformance suites. They need
+no Lightspeed deployment:
 
 ```bash
 cargo test -p environment-protocol
 cargo test -p environment-client
 ```
 
-The existing `assert_environment_data_conformance` helper in
-[environment tooling](../../../crates/tools/src/environment_protocol/conformance.rs)
-exercises the handshake and generic filesystem operations, mapped errors, and
-forbidden-path confinement. Run it from a test harness against a disposable
-data endpoint and directory; it creates and removes test files. Keep that
-harness separate from the provider's production protocol dependencies.
-
-This is a useful compatibility check, not a complete controller/process/job
-test suite. Also exercise ambiguous create retries, conflicting request
-identity, cross-binding access, stale incarnations, daemon startup lag,
-disconnect/reconnect, duplicate process/job submissions, advertised power
-transitions, and ingress teardown. Use a disposable account or project for
-infrastructure-backed tests.
+The controller suite in
+[`environment_client::conformance::controller`](../../../crates/environment-client/src/conformance/controller.rs),
+behind the client crate's `conformance` feature, drives your controller URL
+with your credential and one template. It checks the handshake rules, the
+HTTP 401 refusal, the data-route downgrade rule, per-owner create
+idempotency, that `target/get` never creates, owner fencing, close by owner,
+and `capabilityUnavailable` for unadvertised features. It creates and closes
+one target, so run it against a disposable account or project. Lightspeed
+runs the same suite against its fake controller in CI, and the
+Incus provider's live suite runs it against a real Incus server.
+
+The data suite in
+[`tools::environment_protocol::conformance`](../../../crates/tools/src/environment_protocol/conformance.rs)
+drives a data endpoint through a data client. Point it at one of your
+targets through your data route to verify that the relay passes the daemon's
+behavior through: writes and reads, confinement, walks, process output and
+exits, and job identity. It works in a fresh directory and removes it.
+
+The suites do not cover everything. Also exercise ambiguous create retries,
+cross-binding access, stale incarnations, daemon startup lag, relay idle
+behavior during a quiet long read, every advertised power transition, a close
+of a target whose create failed midway, and ingress teardown.
 
 ## Register and verify it in Lightspeed
 
-Register the provider through `deployment/environment-providers/put`, create an
-enabled universe binding, and inspect the returned templates. The
-[Incus setup guide](../environments/incus-vms.md) shows the current registration
-and binding procedure; use your provider's controller URL and templates.
-
-Create an environment, wait for protocol readiness, read/write a disposable
-file, and run a harmless command. Then exercise each advertised power state,
-wake it, and close it. Confirm the infrastructure target and any ingress are
-actually removed. Verify that retrying the same create does not allocate a
-second machine and that stale identity cannot access a replacement.
+Register the provider through `deployment/environment-providers/put` with its
+controller endpoint and credential. The credential is write-only: it is
+required for a new provider, kept when omitted, and never returned.
+Registration runs the controller handshake. A refused upgrade, such as HTTP
+404 for a wrong path or 401 for a wrong credential, another plane, or a data
+route that downgrades a `wss` controller, refuses the registration. A
+controller that cannot be reached yet is accepted, and its features and data
+route are recorded at the first successful handshake.
+
+Create an enabled universe binding and inspect the returned templates. The
+[Incus setup guide](../environments/incus-vms.md) shows the registration and
+binding procedure; use your provider's controller URL, credential, and
+templates.
+
+Create an environment, wait for it to become ready, read and write a
+disposable file, and run a harmless command. Exercise each advertised power
+state, wake it, and close it. Confirm that the infrastructure target and any
+ingress are actually removed, and that a stale identity cannot reach a
+replacement.
 
 | Symptom | What to inspect |
 | --- | --- |
-| Provider registration succeeds but calls fail | Supported WebSocket transport, `/control` URL shape, and private reachability. |
-| VM runs but environment never becomes ready | Guest daemon startup and data handshake, including the derived route. |
-| Retrying create allocates another target | Missing persisted ownership/request reconciliation. |
-| A supported tool returns an unsupported-operation error | Advertised capabilities disagree with the data implementation. |
-| A closed target still has public access | Ingress cleanup and infrastructure deletion need reconciliation. |
+| Provider registration is refused | Controller URL path, credential, plane, and the `wss` downgrade rule for `routes.data`. |
+| The target runs but the environment never becomes ready | `daemonReady`, the daemon's startup, and the data route's reachability from the gateway. |
+| The environment fails with a version message | The daemon in your image speaks another protocol version than the runtime. Rebuild the image. |
+| An environment stays provisioning with a lifecycle error | Transient controller errors are being retried; the error names the last failure. |
+| Retrying create allocates another target | Ownership is not resolved before creation policy runs. |
+| Long reads fail after about a minute | A relay closes quiet connections or drops pings. |
+| A closed target still has public access | `target/close` did not remove ingress with the target. |
diff --git a/docs/documentation/reference/environment-protocol.md b/docs/documentation/reference/environment-protocol.md
new file mode 100644
index 000000000..39f2ce468
--- /dev/null
+++ b/docs/documentation/reference/environment-protocol.md
@@ -0,0 +1,640 @@
+# Environment protocol
+
+This page states the environment protocol's rules: what every peer sends,
+accepts and answers. It is written for anyone who implements a provider
+controller, a relay in front of the daemon, or a client. The
+[provider guide](../integrating-and-extending/environment-providers.md)
+explains how to build a provider; this page is the contract that guide
+refers to.
+
+The wire types live in the
+[environment protocol crate](../../../crates/environment-protocol/src/lib.rs).
+Its doc comments use wire names and state the per-field rules. Where this page
+and the crate differ, the crate is authoritative.
+
+## Planes and versions
+
+The protocol has three planes. Each runs over its own WebSocket connection.
+
+| Plane | Client (dials) | Server | Version number | Purpose |
+| --- | --- | --- | --- | --- |
+| Data | The Lightspeed runtime | `lightspeed-envd` in the environment | `ENVD_PROTOCOL_VERSION` | Filesystem, transfer, process, and job operations in one environment. |
+| Controller | The Lightspeed runtime | A provider controller | `CONTROLLER_PROTOCOL_VERSION` | Create, observe, power, and close the provider's targets. |
+| Registration | `lightspeed-envd` | The Lightspeed environment gateway | `ENVD_PROTOCOL_VERSION` | Admit an outbound daemon and ask it for reverse-dialed data streams. |
+
+Both numbers are currently `3`. They are matched exactly. A peer that states
+any other number is refused with `versionMismatch`. There are no version
+ranges and no negotiation. A change to a plane's wire shape, or to the meaning
+of an existing field or method, needs a new number for that plane. The data
+plane and the registration channel share one number, so a data-plane change
+also changes the number in the gateway's challenge, which is what prompts a
+registered daemon to upgrade.
+
+`release/metadata.env` records the same numbers as
+`LIGHTSPEED_ENVD_PROTOCOL_VERSION` and `LIGHTSPEED_CONTROLLER_PROTOCOL_VERSION`.
+`scripts/release/verify-metadata.sh` checks them against the crate.
+
+The controller plane does not depend on data-plane types. A provider that
+changes only its controller does not force a new daemon, and a daemon change
+does not force a provider redeploy unless the provider bakes the daemon into
+its images.
+
+## Contract documents
+
+The [method manifest](../../../crates/environment-protocol/src/manifest.rs)
+lists every method with its plane, direction, family, params and response
+types, and the facts servers act on: the capability a method needs, whether
+it counts as use of the environment, and whether `$/cancelRequest` aborts it.
+A method exists exactly when it has a manifest entry.
+
+Generated from the manifest and committed under
+[`crates/environment-protocol/contract/`](../../../crates/environment-protocol/contract/):
+
+| File | Contents |
+| --- | --- |
+| `data.openrpc.json`, `controller.openrpc.json`, `registration.openrpc.json` | One OpenRPC document per plane: every method, its params, result, and summary. |
+| `data.schema.json`, `controller.schema.json`, `registration.schema.json` | JSON Schema bundles of every type the plane uses. |
+
+Each method also has a fixture under
+[`fixtures/<plane>/`](../../../crates/environment-protocol/fixtures/), named
+after the method with `.` for `/`, such as `fixtures/data/process.read.json`.
+It holds a valid params object, a valid response, and a typed error. The crate's
+tests decode each fixture strictly and check that the committed contract
+matches the current types.
+
+## Envelope
+
+Every plane uses one JSON-RPC 2.0 envelope:
+
+- Each WebSocket **text** frame holds exactly one JSON-RPC message. Binary
+  frames are not part of any plane: a server answers one with
+  `invalidRequest` and a null id, and a client closes the connection.
+- `jsonrpc` must be `"2.0"`. An unknown member of the envelope is
+  `invalidRequest`.
+- Params are passed by name, as an object. Absent params mean `{}`. Params
+  that are not an object are `invalidParams`.
+- A request has an integer or string `id`. A notification has no `id` and is
+  never answered, not even with an error. A malformed frame that names a
+  string `method` and has no `id` is treated as a malformed notification:
+  it is dropped without an answer.
+- A batch (a JSON array) is answered with one `invalidRequest` error and a
+  null id.
+- A frame that is not JSON is answered with `parseError` and a null id.
+- The connection stays open after every framing error.
+
+On the data and controller planes, the server never sends a request or a
+notification. A client that receives one treats it as a protocol violation
+and closes the connection. The registration channel carries requests and
+notifications in both directions; see [Registration channel](#registration-channel).
+
+## Handshake
+
+The data and controller planes each begin with `initialize`. The server
+enforces these rules per connection:
+
+1. Before a successful `initialize`, any other request is answered with
+   `notInitialized`, and notifications are dropped.
+2. An `initialize` whose `protocolVersion` differs from the server's number is
+   answered with `versionMismatch`. Its `expected` field is the server's
+   number and `received` is the number the client stated. The connection
+   stays open and uninitialized; the client closes it.
+3. A second `initialize` after a successful one is `invalidRequest`.
+4. The response names its `plane`. A client checks `plane` and
+   `protocolVersion` before it uses the connection, so a client that reached
+   the wrong socket fails at the handshake.
+
+`clientInfo` and `serverInfo` describe the peer's build: a `name` and
+optional `version`, `gitSha`, and `target`, each 1 to 256 bytes without
+control characters. They are descriptive only. Nothing selects, gates, or
+authenticates on them.
+
+## Decoding
+
+Every params, response, and message type on the three planes decodes
+strictly: an unknown member is refused, and defaults exist only for
+documented optional knobs. An omitted `protocolVersion` is never assumed.
+
+The frozen bootstrap surface is the exception. It is the gateway's first
+frame (the `registration/challenge` notification), the deployment's daemon
+discovery document, and the JSON that `lightspeed-envd --print-build`
+prints. These only gain fields, and they are decoded tolerantly, so a daemon
+of any version can read them.
+
+## Encoding conventions
+
+| Topic | Rule |
+| --- | --- |
+| Methods | `domain/verb[Object]` in lowerCamel, singular domains, no plane prefix. |
+| Fields | camelCase. Lists are plural nouns; counts end in `Count`, sizes in `Bytes`, durations in `Ms`, instants in `AtMs`, ids in `Id`. Payload bytes are always `data`. |
+| Optionality | No `null` except JSON-RPC's own `id`. Absent options and empty collections are omitted. Flags are booleans that default to false and are omitted when false. |
+| Numbers | Byte counts, offsets, and durations are unsigned 64-bit; counts, indices, and depths unsigned 32-bit; instants are signed 64-bit milliseconds since the Unix epoch. Every value stays below 2^53. |
+| Unions | Data unions carry a `kind` tag. |
+| Ids | Lightspeed-assigned ids follow the general grammar `^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$`. Provider-assigned ids (`targetId`, `templateId`, `sourceTarget`) are opaque: 1 to 255 bytes without control characters. |
+| Bytes | Payloads are padded standard base64. Fixed-size cryptographic values are lowercase hex. Content digests are `sha256:<64 hex>`. Opaque fingerprints carry their own prefix, such as `scan:v1:`. |
+| Paths | `EnvironmentPath`: absolute, normalized, at most 4096 bytes; `.` and `..` segments are refused, not rewritten. Tree entries use relative `TreePath` values; the selected root itself is `.`. |
+| Text | Descriptive text such as a target `message` is 1 to 1024 bytes, without control characters other than line feed and tab. URLs are at most 2048 bytes. |
+
+## Errors
+
+An error is a JSON-RPC error object. Its `code` is fixed by its kind, and its
+`data` carries the kind and its typed fields:
+
+```json
+{"jsonrpc": "2.0", "id": 7, "error": {"code": -32004, "message": "unknown process id: p1", "data": {"kind": "notFound", "reason": "expired"}}}
+```
+
+`data.kind` is authoritative. Receivers branch on it, never on the code or
+the message. A message is at most 4096 bytes and is never parsed.
+Retryability is a property of the kind and is never sent. The same error
+object appears inside results that report per-entry failures, such as
+`job/read` entries, `fs/scan` roots, and a failed transfer's status.
+
+| Kind | Code | Retryable | Typed fields | Use |
+| --- | --- | --- | --- | --- |
+| `parseError` | -32700 | No | | The frame is not JSON. |
+| `invalidRequest` | -32600 | No | | A malformed envelope, a batch, a binary frame, a repeated `initialize`. |
+| `methodNotFound` | -32601 | No | | No such method on this plane. |
+| `invalidParams` | -32602 | No | `field`, `ceiling` | Params do not decode, a value is out of range, or a value exceeds an advertised ceiling. `field` is the wire path of the offending member, such as `jobs[0].dependsOn`. |
+| `internal` | -32603 | No | | A defect inside the server. |
+| `notInitialized` | -32002 | No | | A request before `initialize`. |
+| `permissionDenied` | -32003 | No | `reason` | Confinement, operating-system permissions, or registration credentials. |
+| `notFound` | -32004 | No | `reason` | An unknown handle, path, target, or job. |
+| `versionMismatch` | -32005 | No | `expected`, `received` | The stated protocol version differs. |
+| `capabilityUnavailable` | -32006 | No | `capability` | The endpoint lacks a capability family or fact the request needs. |
+| `failedPrecondition` | -32007 | No | `reason` (required) | The current state forbids the request. |
+| `busy` | -32008 | Yes | `reason`, `retryAfterMs` | A concurrency, capacity, or rate limit. |
+| `alreadyExists` | -32009 | No | | The thing to create already exists. |
+| `payloadTooLarge` | -32013 | No | `limitBytes`, `limitEntries` | A message, payload, or result exceeds its limit. |
+| `deadlineExceeded` | -32015 | No | | A server-side duration bound ran out. |
+| `expired` | -32016 | No | | A credential or token is past its validity. |
+| `aborted` | -32017 | Yes | `reason` | Cancelled, or the input changed underneath the operation. |
+| `processFailed` | -32018 | No | | A process could not be started or supervised. |
+| `unavailable` | -32019 | Yes | `retryAfterMs` | A dependency of the server is temporarily unreachable. |
+
+Reasons by kind:
+
+| Kind | Reasons |
+| --- | --- |
+| `permissionDenied` | `outsideRoot`, `daemonState`, `filePermission`, `invalidSignature`, `invalidRegistrationKey`, `registrationKeyRevoked` |
+| `notFound` | `expired` (the handle was evicted), `daemonRestarted` (the handle belongs to an earlier daemon instance), `unknownDaemon` |
+| `capabilityUnavailable` | `filesystem`, `filesystemWrite`, `process`, `processPty`, `job`, `adoptTarget`, `ingress` |
+| `failedPrecondition` | `inputClosed`, `ifMatchFailed`, `createCondition`, `notEmpty`, `isDirectory`, `notDirectory`, `notRegularFile`, `symlinkLoop`, `symlinkRejected`, `filesystemRoot`, `crossDevice`, `noSpace`, `jobIdInUse`, `operationIdInUse`, `transferPhase`, `transferOffset`, `digestMismatch`, `environmentClosed`, `identityInUse`, `ownerMismatch`, `templateDeprecated`, `ingressUnsupported`, `targetNotActive`, `notAdoptable` |
+| `busy` | `requestLimit`, `transferCapacity`, `rateLimited`, `capacityExhausted` |
+| `aborted` | `cancelled`, `sourceChanged` |
+
+An endpoint that cannot honour a parameter refuses the request with
+`capabilityUnavailable`. It never ignores the parameter.
+
+## Liveness
+
+A peer that is waiting for a response sends a WebSocket ping at least every
+20 seconds while any request it sent is unanswered. It may also ping while
+idle. The daemon, providers, and the gateway answer pings and never originate
+them on data or controller connections. A server answers pings even while it
+is busy writing responses.
+
+Intermediaries, such as a gateway route, a provider relay, or an edge proxy,
+forward ping and pong frames, count every frame as activity, and never close
+a connection for idleness sooner than 60 seconds. Request deadlines, not
+pings, detect a server that has stopped answering.
+
+The registration channel has its own heartbeat; see
+[Registration channel](#registration-channel).
+
+## Limits
+
+The protocol has three kinds of limit:
+
+1. **Protocol constants.** Every message, and therefore every frame, is at
+   most 16 MiB (16,777,216 bytes) on every hop. Each reader and writer
+   configures that limit explicitly, with the frame limit equal to the
+   message limit. A sender whose request would exceed it fails locally
+   instead of sending. A server whose response would exceed it answers
+   `payloadTooLarge` for the same id instead.
+2. **Endpoint ceilings.** The daemon advertises its operational ceilings in
+   the data-plane `initialize` response as `limits`. A request above a
+   ceiling is `invalidParams` naming the field and the ceiling. Nothing is
+   clamped.
+3. **Caller quotas.** Each request states its own bounds as required fields,
+   such as `maxBytes`, `waitMs`, or a `limits` object.
+
+Response sizes are bounded by construction. A `process/read` page or one
+`job/read` response holds at most 4096 chunks plus gaps. Search and glob
+matches, and the entries, skips, and content of all roots of one scan, stop
+at a 12 MiB result budget. A scan root or transfer lists at most 100 skipped
+entries and counts the rest. A leftover-process report lists at most 64
+processes, each command cut to 1024 bytes.
+
+## Pipelining and cancellation
+
+Clients may pipeline requests. Responses arrive in any order and are matched
+by id. Servers accept at least 16 requests in flight per connection; the
+daemon advertises its own number as `limits.maxConcurrentRequests`. Beyond
+it, a server answers `busy` with reason `requestLimit` at once.
+
+On the data plane, the client notification `$/cancelRequest {id}` aborts a
+pending request. The manifest marks which methods it stops: `process/read`,
+`job/read`, `fs/searchText`, `fs/globFiles`, and `fs/scan`. They stop
+waiting or walking and answer `aborted` with reason `cancelled`; an aborted
+`process/read` never advances the output cursor. Every other method ignores
+the notification and runs to a consistent state. An unknown or finished id is
+ignored. The controller plane has no cancellation.
+
+When a data connection closes, the daemon cancels that connection's pending
+requests as if each had been cancelled, and drops their replies.
+
+## Controller plane
+
+A provider controller manages targets: machines, containers, or other units
+of compute. The runtime is the client.
+
+### Transport and credential
+
+The controller is a WebSocket endpoint at the URL the operator registers in
+Lightspeed: `ws://`, `wss://`, or `unix:///absolute/path`. Any path is
+allowed. Every connection carries the provider credential as
+`Authorization: Bearer <credential>`. The provider compares it in constant
+time and answers HTTP 401 before the upgrade when it is missing or wrong. The
+same credential authenticates the provider's data routes.
+
+### `initialize`
+
+The params carry `protocolVersion` and `clientInfo`. The response carries:
+
+| Field | Meaning |
+| --- | --- |
+| `protocolVersion` | The controller's number. |
+| `plane` | Always `controller`. |
+| `serverInfo` | The controller's build. |
+| `capabilities` | Optional features: `adoptTarget` serves `target/adopt`, and `ingress` serves `ingress/ensure` and `ingress/remove`. Every other controller method is mandatory. |
+| `routes.data` | The base URL of the provider's data routes. |
+
+```json
+{
+  "protocolVersion": 3,
+  "plane": "controller",
+  "serverInfo": {"name": "lightspeed-provider-incus", "version": "0.5.0"},
+  "capabilities": {"adoptTarget": true, "ingress": true},
+  "routes": {"data": "wss://provider.example.com:19090/routes"}
+}
+```
+
+`routes.data` is a `ws://` or `wss://` URL with a lowercase scheme, a host
+and optional port, an optional path that does not end with `/`, and no user
+information, query, or fragment. It is never rewritten. A controller reached
+over `wss` (or `https`) must advertise a `wss` base, so the credential never
+travels in cleartext. The runtime checks this at every `initialize` and
+treats a downgrade like a failed handshake.
+
+A target's data route is the base followed by
+`/{universeId}/{bindingId}/{environmentId}/{incarnationId}/{targetId}`, each
+segment percent-encoded (everything except RFC 3986 unreserved characters).
+The runtime dials it with the same bearer credential. The provider serves the
+daemon's data plane unchanged on that route, under the liveness rule and the
+message limit above, and refuses a route whose owner does not own the target.
+
+### Methods
+
+| Method | Params | Semantics | Errors |
+| --- | --- | --- | --- |
+| `template/list` | `binding {universeId, bindingId}` | The templates the binding may create targets from. | `unavailable` |
+| `target/create` | `owner`, `templateId` | Idempotent per owner. If the provider already holds a target for the owner, answer its observation and apply no creation policy (deprecation, binding, or image checks). Otherwise apply policy, start creation, and answer promptly with `phase: provisioning`. | `failedPrecondition` (`templateDeprecated`, `ownerMismatch`), `notFound` (template), `invalidParams`, `unavailable` |
+| `target/adopt` | `owner`, `sourceTarget` | Needs `adoptTarget`. Take ownership of an existing target named in a provider-defined format. Idempotent per owner. | `capabilityUnavailable`, `notFound`, `failedPrecondition` (`ownerMismatch`, `notAdoptable`) |
+| `target/get` | `target` | A pure read: it never creates, starts, or changes anything. Resolves by `targetId` when given, otherwise by owner. | `notFound`, `failedPrecondition` (`ownerMismatch`), `unavailable` |
+| `target/setPower` | `target`, `power` | Converge toward one of `supportedPowerStates`. A target already there, or moving there, is observed without action. Answer promptly with the transitional observation. | `notFound`, `invalidParams` (unsupported state), `failedPrecondition` (`targetNotActive`), `unavailable` |
+| `target/close` | `target` | Destroy everything the owner's target holds, public ingress included: gracefully within the provider's own bound, then forced. Answer `closing` while it runs, `closed` once nothing remains, and `closed` without `targetId` when the provider holds nothing for the owner. Idempotent. | `unavailable` |
+| `ingress/ensure` | `target` | Needs `ingress`. Route the template's public ingress to the target. Idempotent. | `capabilityUnavailable`, `notFound`, `failedPrecondition` (`ingressUnsupported`) |
+| `ingress/remove` | `target` | Needs `ingress`. Stop routing public ingress to a target that stays. Idempotent. | `capabilityUnavailable`, `notFound` |
+
+Every target and ingress method answers `{"target": <observation>}`.
+
+### Ownership
+
+A target belongs to exactly one owner:
+
+```json
+{"universeId": "u1", "bindingId": "primary", "environmentId": "env_1", "incarnationId": "inc_1"}
+```
+
+A provider holds at most one target per owner. Every target method names the
+owner in a target reference, `{owner, targetId?}`. Without `targetId`, the
+provider resolves the owner's target itself; this is how the runtime finds
+and closes a target whose id it never learned. A target that belongs to
+another owner is refused with `failedPrecondition` (`ownerMismatch`). Knowing
+a provider's target id is never enough: an old incarnation must not reach or
+destroy its replacement.
+
+Record ownership durably enough to survive the provider's own restarts and
+an ambiguous create, where the target was created but the response was lost.
+The Incus provider uses deterministic names and ownership metadata on its
+native resources; another provider may use its own store.
+
+### Bounded calls
+
+Every method answers within a bounded time, a few seconds. Slow work, such as
+an image pull, a boot, or a graceful shutdown, continues in the background,
+and the runtime follows it with `target/get`. An asynchronous provider may
+answer `target/create` before it has assigned an id; the observation then
+omits `targetId`, and the runtime records the id from the first observation
+that carries one.
+
+### Observation
+
+```json
+{
+  "targetId": "ls-3f2a",
+  "owner": {"universeId": "u1", "bindingId": "primary", "environmentId": "env_1", "incarnationId": "inc_1"},
+  "displayName": "Acorn build machine",
+  "state": {"phase": "active", "power": "running", "daemonReady": true},
+  "supportedPowerStates": ["running", "paused", "stopped"],
+  "ingress": {"endpoint": "https://acorn.env.example.com"}
+}
+```
+
+| Field | Meaning |
+| --- | --- |
+| `targetId` | The provider's id. Absent only while provisioning before an id exists, and in a `closed` observation of an owner with nothing. |
+| `owner` | Always echoed from the request. |
+| `state.phase` | `provisioning`, `active`, `closing`, `closed`, `failed` (broken beyond the provider's own recovery), or `unknown` (the provider cannot tell). |
+| `state.power` | Present exactly when `phase` is `active`: `running`, `paused` (execution halted, memory retained), `suspended` (execution state persisted, compute released), or `stopped` (powered off, disks retained). |
+| `state.daemonReady` | The provider's own probe reached the daemon on the target's data route. The probe is a WebSocket upgrade only, so the provider does not need to speak the daemon's protocol version. |
+| `state.message` | Why the target is `failed` or `unknown`, or what a transition waits for. |
+| `supportedPowerStates` | Power states `target/setPower` can reach. Empty when the provider offers no power control beyond create and close. |
+| `ingress` | Realized public ingress, an `http` or `https` URL. Absent when disabled. |
+| `displayName`, `metadata` | Provider display facts. Metadata has at most 32 entries, and keys starting with `lightspeed.` are reserved. |
+
+Report what the infrastructure shows, not what a caller asked for. A machine
+whose daemon is not reachable yet stays `daemonReady: false`.
+
+A template has a `templateId`, a non-empty `displayName`, an optional
+`description`, and optional `publicIngress` and `deprecated` flags.
+`resources` states `vcpus`, `memoryBytes`, and `diskBytes` in
+provider-neutral units, each omitted when the provider does not fix it. A
+deprecated template creates no new targets; existing targets keep working.
+
+### How the runtime drives a controller
+
+Providers can rely on this behaviour:
+
+- Until it has recorded a target id, the runtime sends `target/create` (or
+  `target/adopt`) on each reconciler pass. Afterwards it observes only with
+  `target/get` and never sends create again.
+- `phase: active`, `power: running`, and `daemonReady: true` lead the runtime
+  to run the data-plane handshake on the target's route. Success marks the
+  environment ready. A daemon that speaks another protocol version fails the
+  environment, naming both versions.
+- `notFound` from `target/get`, `target/setPower`, or an ingress method means
+  the target is gone: the environment fails, or its close finishes.
+  `phase: failed` fails the environment with `state.message`.
+- Retryable kinds, transport failures, timeouts, undecodable answers,
+  `internal`, and every failed controller handshake (a version mismatch
+  included) keep the environment's status and record the error. The
+  environment fails after 30 minutes of such errors. Other refusals fail a
+  provisioning environment at once.
+- Close sends `target/close` by owner, with the target id when one is
+  recorded, until the provider answers `closed` or `notFound`. The runtime
+  never removes ingress before close.
+- Ingress and adoption calls are sent only when the controller advertises
+  the feature. API requests for them are refused otherwise.
+- Connect and `initialize` each have a 10-second deadline, and controller
+  calls a 120-second deadline. After a timeout or transport failure, the
+  runtime skips that provider's remaining environments for the rest of the
+  pass.
+
+## Data plane
+
+The daemon, `lightspeed-envd`, is the data server on every provider. The
+data plane is specified for that daemon; a provider routes to it rather than
+reimplementing it.
+
+### `initialize`
+
+The response carries `protocolVersion`, `plane: data`, `serverInfo`, and:
+
+| Field | Meaning |
+| --- | --- |
+| `daemonInstanceId` | Random per daemon start. A different value than on an earlier connection means the daemon restarted and the earlier instance's process handles are gone. |
+| `capabilities` | Capability families (below). |
+| `limits` | The daemon's ceilings: `maxConcurrentRequests`, `maxWaitMs`, and per-family `process`, `job`, and `filesystem` limits. |
+| `defaultCwd` | The daemon's working directory, the default `cwd` of commands. |
+| `homeDirectory` | The home directory of the user commands run as, when it lies inside the filesystem root. |
+
+A present capability family means all of its methods exist: `filesystem`
+covers `fs/*` and `transfer/*`, including search, glob, scan, and transfers;
+`process` covers `process/*`; `job` covers `job/*`. Inside a family are only
+facts that vary per instance: `filesystem.write` is false on a daemon started
+read-only, and `process.pty` says whether `process/start` accepts `pty`. A
+request that needs an absent family or fact is `capabilityUnavailable` before
+any side effect.
+
+### Methods
+
+| Method | Counts as use | Abortable | Needs | Purpose |
+| --- | --- | --- | --- | --- |
+| `initialize` | No | | | Handshake. |
+| `env/getIdle` | No | | | `idleForMs` since the last use, 0 while any process root or job runs, and diagnostic counts including leftover process groups. |
+| `$/cancelRequest` | No | | | Notification: abort a pending abortable request. |
+| `fs/readFile` | Yes | | `filesystem` | Read at most `maxBytes` of a regular file from `offset`. |
+| `fs/writeFile` | Yes | | `filesystem.write` | Write a file atomically, with `create`, `ifMatch`, and `executable`; answers the new `version`. |
+| `fs/createDirectory` | Yes | | `filesystem.write` | Create a directory, optionally with its parents. |
+| `fs/getMetadata` | Yes | | `filesystem` | Describe one entry, optionally following a symlink. |
+| `fs/readDirectory` | Yes | | `filesystem` | List one page of a directory, sorted by name, with an opaque cursor. |
+| `fs/remove` | Yes | | `filesystem.write` | Remove a file, symlink, or directory without following links. |
+| `fs/rename` | Yes | | `filesystem.write` | Rename atomically, without replacing an existing destination unless `overwrite` is set. |
+| `fs/searchText` | Yes | Yes | `filesystem` | Search file contents below a root with a regular expression. |
+| `fs/globFiles` | Yes | Yes | `filesystem` | List non-directory entries below a root that match patterns. |
+| `fs/scan` | No | Yes | `filesystem` | Observe small trees below several roots, each reported on its own. |
+| `transfer/begin`, `transfer/advance`, `transfer/getStatus`, `transfer/readInventory`, `transfer/append`, `transfer/listMissing`, `transfer/read`, `transfer/write`, `transfer/commit`, `transfer/abort` | Yes | | `filesystem` (writes also `filesystem.write`) | One capture, materialize, or file write as many bounded calls. |
+| `process/start` | Yes | | `process` | Start a process under a caller-chosen `processId`. |
+| `process/read` | Yes | Yes | `process` | Wait for and read a page of output and the process state. |
+| `process/write` | Yes | | `process` | Queue bytes for a pipe or PTY input. |
+| `process/terminate` | Yes | | `process` | Interrupt, terminate, or kill the process group. |
+| `job/start` | Yes | | `job` | Start jobs, or replay an identical earlier start. |
+| `job/read` | Yes | Yes | `job` | Read jobs' summaries and output pages. |
+| `job/cancel` | Yes | | `job` | Cancel jobs and optionally their dependents. |
+
+Methods that count as use reset the environment's idle clock. Handshakes,
+idle reports, cancellations, and scans do not, so discovery and power
+policy can look at an environment without keeping it awake.
+
+### Paths and confinement
+
+A wire path is absolute, in the environment's own filesystem namespace: the
+one its processes see. The daemon's filesystem root is not a chroot. With the
+root narrowed to `/workspace`, `/workspace/src` names that directory and
+`/etc` lies outside the root.
+
+One rule applies to every method and to every command's `cwd`:
+
+- A path that is neither the root nor below it is `permissionDenied`
+  (`outsideRoot`).
+- The daemon resolves the remaining segments one at a time beneath the root.
+  A symlink is followed only while its target stays inside the root; a link
+  that leaves it is refused the same way.
+- No method addresses the daemon's state directory. A path that names it or
+  lies inside it, and a remove, rename, write, or capture whose subject
+  contains it, is `permissionDenied` (`daemonState`). Walks prune it.
+
+Names are UTF-8 and POSIX: `/` is the only separator. An entry whose name is
+not UTF-8 is skipped and counted wherever a method enumerates entries.
+
+### Pattern grammar and walks
+
+`fs/searchText`, `fs/globFiles`, `fs/scan`, and transfer captures share one
+filter: `include` and `exclude` patterns, `ignoreCase`, `includeHidden`,
+`includeIgnored`, and `maxDepth`. Patterns match paths relative to the walk's
+root, gitignore-style: `*` and `?` match within one segment, `**` spans
+segments, `[...]` is a character class, and `{a,b}` an alternation. A pattern
+without `/` matches the entry's name at any depth; a leading `/` anchors it
+to the root. An empty `include` selects everything, and an `exclude` that
+matches a directory prunes it. The root's direct children are depth 1.
+
+By default, walks respect `.gitignore`, `.ignore`, and git excludes, and
+skip names that start with `.`. `includeIgnored` and `includeHidden` opt out.
+`.git`, `.hg`, `.svn`, `.jj`, and the daemon state directory are always
+pruned. Entries a walk cannot read or represent are skipped and counted; they
+never end the walk. A file larger than the remaining byte budget is skipped
+and counted too.
+
+### Process output
+
+A process has one combined output stream: stdout, stderr, or PTY output
+interleaved in arrival order. Positions are byte offsets into it.
+`process/read` returns a page of `chunks`, the `next` offset after the page,
+the `end` offset of everything produced so far, and `gaps` for ranges it
+cannot return (`overflow` when the retention cap dropped them, `expired` when
+they were released after delivery). A page cut at `maxBytes` loses nothing.
+
+A read starts at `after`, at `end - tailBytes`, or at the daemon-owned
+cursor when it names neither. A cursor read advances the cursor only after
+the reply was written to the socket, so a lost connection never consumes
+output. Reads at an explicit `after` or `tailBytes` never move the cursor,
+so a second reader can follow without consuming. An optional `ack` advances
+the cursor to an offset the caller has already processed, which gives a
+caller that tracks positions exactly-once delivery. `returnOn` chooses when a
+wait ends:
+`anyOutput`, `window` (enough bytes for `maxBytes`), or `exit`. Every mode
+returns when `waitMs` elapses.
+
+`state` is `running` or `exited`. `exited` means the root process exited and
+its output has settled. An exit is `{kind: code, code}` or
+`{kind: signal, signal: "SIGSEGV", coreDumped}`, with signals named because
+their numbers differ by platform. `stoppedBy` (`timeout`, `terminate`,
+`kill`) is set when the daemon stopped a running root. A process that leaves
+descendants running reports them as `leftovers` with disposition `kept`;
+processes never sweep their group on a natural exit.
+
+An unknown handle is `notFound`. An evicted handle is `notFound` with reason
+`expired`, and a handle from before a daemon restart is `notFound` with
+reason `daemonRestarted`.
+
+### Jobs
+
+A job's identity is its `jobId` together with the `requestId` of the
+`job/start` that created it. A start that repeats an existing job's
+`requestId` and spec replays it; any other reuse of the id is
+`failedPrecondition` (`jobIdInUse`). Statuses are `queued`, `running`,
+`succeeded`, `failed`, `timedOut`, `cancelled`, `dependencyFailed`, and
+`interrupted`. Dependencies name a job id or a name within the same request.
+Jobs that share a `queueKey` run one at a time, in start order. At job
+completion, the daemon sweeps the job's process group and reports what it
+stopped as `leftovers` with disposition `swept`.
+
+`job/read` takes a list of entries, each reading one job from `after` or the
+last `tailBytes`; a job may appear twice to read its head and tail in one
+call. The request's `maxBytes` is a total budget across entries. An unknown
+job is answered with a per-entry `notFound` error.
+
+### Files and transfers
+
+`fs/writeFile` stages the new content next to the final target and renames
+it into place, so readers see the old or the new file and never a partial
+one. An in-root symlink at the path is followed to its final target. An
+existing target keeps its mode. `ifMatch` makes the write conditional on the
+version a read returned.
+
+A transfer moves a whole file or tree in bounded calls under a
+caller-chosen `operationId`. Retrying a call with the same input is safe. A
+capture reads a tree out of the environment; a materialize replaces a
+destination tree atomically at commit; a file write replaces one file with
+`fs/writeFile` semantics. Content moves by `sha256` digest, so content
+already present is not sent again. The first failure moves the operation to
+`failed`; later calls answer that error and nothing is committed. Finished
+operations keep a receipt for the advertised retention period. The
+[transfer module](../../../crates/environment-protocol/src/data/transfer.rs)
+documents the phases.
+
+## Registration channel
+
+An outbound daemon dials
+`wss://<gateway>[/prefix]/environment-gateway/connect` and keeps that control
+connection open. The daemon is the JSON-RPC client and the gateway the
+server; both directions carry requests and notifications.
+
+```text
+gateway -> daemon  notification registration/challenge {protocolVersion, nonce}   always first
+daemon  -> gateway request      registration/register {protocolVersion, daemonPublicKey,
+                                 signature, registrationKey?, displayName?, metadata?,
+                                 implementation}
+gateway -> daemon  response     {receipt, heartbeatIntervalMs} or an error
+gateway -> daemon  request      registration/openStream {token, stream}            any number of times
+daemon  -> gateway response     {} once the stream socket is upgraded, or unavailable
+daemon  -> gateway notification registration/goodbye {reason: shutdown}            before a deliberate stop
+gateway -> daemon  notification registration/closed {reason, message?}             superseded or environmentClosed
+```
+
+Rules:
+
+- The challenge is frozen. A daemon reads its `protocolVersion` before
+  decoding anything else, and a mismatch leads to an upgrade or a refusal,
+  never to a decode loop.
+- The daemon signs `"lightspeed-envd-registration/v2" ‖ nonce ‖ sha256(origin)`
+  with its Ed25519 key, where `origin` is the canonical WebSocket origin of
+  the gateway URL it dialed. The gateway verifies against the canonical
+  origin of its own public base URL, so a gateway cannot relay another
+  gateway's challenge.
+- The registration key is sent only until the daemon's first admission.
+  `displayName` and `metadata` are read only then.
+- Before admission the gateway accepts only `registration/register`. Out of
+  bounds build facts, display names, or metadata refuse admission with
+  `invalidRequest`; other undecodable params are `invalidParams`.
+- The receipt names `environmentId`, `incarnationId`, `daemonId`,
+  `controlConnectionId`, `identityMode` (`persistent` or `ephemeral`), and
+  `admission` (`created` or `reconnected`).
+- For each `registration/openStream`, the daemon dials the stream URL derived
+  from its configured connect URL, replacing the
+  `/environment-gateway/connect` suffix with `/environment-gateway/data`, with
+  the one-time token as a bearer header, and serves the data plane on that
+  socket. The gateway never names a URL.
+- The gateway pings every `heartbeatIntervalMs`. Either side treats three
+  intervals without any frame as a dead connection.
+- The newest connection for a daemon identity wins. The gateway sends
+  `registration/closed` with reason `superseded` to the older one before
+  closing it.
+
+The daemon's exit status says why it stopped: 0 after a deliberate shutdown,
+1 for an unexpected failure, 2 for a local configuration or receipt-file
+error, 3 for a terminal
+registration refusal or an unsupported gateway protocol, 4 when its
+environment was closed, and 5 when another process with the same identity
+superseded it. Retryable refusals, disconnects, and heartbeat timeouts never
+end the process.
+
+## Conformance
+
+Two suites check an implementation against this contract without
+provisioning anything else:
+
+- The controller suite,
+  [`environment_client::conformance::controller`](../../../crates/environment-client/src/conformance/controller.rs)
+  behind the client crate's `conformance` feature, drives any controller URL
+  with a credential and one template. It checks the handshake rules, the
+  credential refusal, the data-route downgrade rule, per-owner create
+  idempotency, pure `target/get`, owner fencing, close by owner, and
+  `capabilityUnavailable` for features the controller does not advertise.
+  It creates and closes one target.
+- The data suite,
+  [`tools::environment_protocol::conformance`](../../../crates/tools/src/environment_protocol/conformance.rs),
+  drives a data endpoint and checks file writes and reads, confinement,
+  walks, scans, process output and exits, and job identity. It works in a
+  fresh directory and removes it afterwards.
diff --git a/docs/documentation/reference/environment-variables.md b/docs/documentation/reference/environment-variables.md
index dae1d0332..100e2368f 100644
--- a/docs/documentation/reference/environment-variables.md
+++ b/docs/documentation/reference/environment-variables.md
@@ -41,7 +41,6 @@ They do not configure the TypeScript Platform backend.
 | `LIGHTSPEED_POSTGRES_URL` | **Required**; falls back to `LIGHTSPEED_TEST_POSTGRES_URL` | PostgreSQL connection URL used by the runtime, migration commands, and schema diagnostics. Production must use this name. |
 | `LIGHTSPEED_PG_UNIVERSE_ID` | **Required in `single` auth mode** | UUID of the sole universe in a single-tenant deployment. Not used to auto-create universes in multi-tenant modes. |
 | `LIGHTSPEED_ROLES` | `gateway,environment-gateway,sessions,bots,channels` | Roles this process runs, a comma-separated subset of `gateway` (JSON-RPC, OAuth callbacks, webhook hooks), `environment-gateway` (worker environment routes, the public daemon registration routes, the lifecycle reconciler, and the power reaper), `sessions` (session workflows plus the promise-repair reaper, the session-retention reaper, both every five minutes, and the hourly CAS blob sweeper), `bots`, `channels` (also `--roles`). Each worker role polls its own task queue with that subsystem's workflows, activities, and background loops. Run exactly one `environment-gateway` process per deployment. |
-| `LIGHTSPEED_ENVIRONMENT_PUBLIC_URL` | Unset | Base URL outbound daemons are told to dial for data connections when it differs from `LIGHTSPEED_PUBLIC_BASE_URL`, for example a dedicated hostname in front of the environment gateway. |
 | `LIGHTSPEED_TASK_QUEUE` | `lightspeed-sessions` | Sessions task queue shared by the gateway and the `sessions` role. Deployments sharing a Temporal namespace must use distinct queues. |
 | `LIGHTSPEED_TASK_QUEUE_BOTS` | `lightspeed-bots` | Task queue of the `bots` role (bot controllers, trigger fires, bot activities). |
 | `LIGHTSPEED_TASK_QUEUE_CHANNELS` | `lightspeed-channels` | Task queue of the `channels` role (conversation workflows and core channel activities). Connector activities run on the per-account `lightspeed-connector-*` queues served by the connector host. |
@@ -49,7 +48,7 @@ They do not configure the TypeScript Platform backend.
 | `TEMPORAL_NAMESPACE` | `default` | Temporal namespace. Shared with the connector host. |
 | `LIGHTSPEED_GATEWAY_BIND` | `127.0.0.1:18080` | JSON-RPC and environment-gateway listener address. |
 | `LIGHTSPEED_GATEWAY_MAX_REQUEST_BODY_BYTES` | `67108864` | Maximum gateway request body size in bytes. |
-| `LIGHTSPEED_PUBLIC_BASE_URL` | `http://{LIGHTSPEED_GATEWAY_BIND}` | Externally reachable gateway base URL used for OAuth callbacks, bot webhook ingest URLs (`/hooks/bots/…`), and as the environment route base when the process runs the `gateway` role. Hosted deployments should set it explicitly. |
+| `LIGHTSPEED_PUBLIC_BASE_URL` | `http://{LIGHTSPEED_GATEWAY_BIND}`; **required** for an `environment-gateway` process on a non-loopback bind | Externally reachable gateway base URL used for OAuth callbacks, bot webhook ingest URLs (`/hooks/bots/…`), and as the environment route base when the process runs the `gateway` role. Its origin is also the one registered daemons must sign: daemons must dial the registration routes on this host, and a daemon that dials another hostname is refused. A process running `environment-gateway` refuses to start without it unless it binds to loopback. Hosted deployments should set it explicitly. |
 | `LIGHTSPEED_MCP_PRIVATE_NETWORKS` | Empty (`localhost,127.0.0.1,::1` in `dev.sh` profiles) | Comma-separated exact hosts and CIDRs that outbound requests may reach on private networks: native MCP discovery and execution (where the MCP server record must also opt in with `allowPrivateNetwork`) and bot URL polls. All other targets retain public-only HTTPS/SSRF policy. |
 | `LIGHTSPEED_CONFIGURATOR_MCP_INTERNAL_TRUSTED_HEADER_URL` | Unset | Retired; a nonempty value fails startup. Use a scoped API key. |
 | `LIGHTSPEED_MCP_OAUTH_ALLOW_PRIVATE_NETWORKS` | `false` (`true` in `dev.sh` profiles) | Allows MCP OAuth metadata, registration, exchange, and refresh to use HTTP or private endpoints. This does not authorize discovery or tool execution; those use `LIGHTSPEED_MCP_PRIVATE_NETWORKS` plus the record opt-in. |
@@ -162,8 +161,14 @@ route for that environment must reach the same process: **run exactly one
 `environment-gateway` process per deployment** until multi-replica owner
 routing is implemented. `gateway`-only processes and workers may scale
 freely; they hold no daemon connections and do not answer the registration
-routes at all. Expose the two public routes through TLS; the daemon refuses
-plain `ws://` toward anything but loopback.
+routes at all. Expose the two public routes through TLS on the host named by
+`LIGHTSPEED_PUBLIC_BASE_URL`; the daemon refuses plain `ws://` toward
+anything but loopback and derives the data route from its connect URL.
+
+Provider controllers are not configured through environment variables. Each
+provider's controller endpoint and bearer credential are registered through
+`deployment/environment-providers/put`; the credential is stored sealed with
+`LIGHTSPEED_SECRETS_MASTER_KEY` and never returned.
 
 ## Rust CLI
 
@@ -205,23 +210,35 @@ from the environment of each process and job the daemon starts.
 | `LIGHTSPEED_ENVD_LISTEN` | `127.0.0.1:19091` unless a gateway URL is set | WebSocket listener for the passive transport: `host:port` (or `tcp://host:port`) for TCP, or `unix:///absolute/path` for a Unix socket only the daemon's user can connect to. Set it explicitly to listen while also registering outbound. |
 | `LIGHTSPEED_ENVD_GATEWAY_URL` | Unset | Public connect route to dial, `wss://<host>/environment-gateway/connect`. Plain `ws://` is accepted only toward loopback. |
 | `LIGHTSPEED_ENVD_DISCOVERY_URL` | `https://<gateway-host>/.well-known/lightspeed-envd` | Override the deployment discovery document used by `lightspeed-envd upgrade` and automatic protocol-mismatch upgrades. Must use HTTPS, except that HTTP is accepted toward loopback for development. |
-| `LIGHTSPEED_ENVD_AUTO_UPGRADE` | `false` | Opt a registered outbound daemon into installing and re-executing the build in the deployment discovery document when the gateway challenges it with a different protocol number. Accepts boolean values including `1`/`0`; automatic upgrade is attempted once per process lineage. |
-| `LIGHTSPEED_ENVD_REGISTRATION_KEY` | Unset | Registration key admitting a first-seen daemon identity. Read once and dropped from the process environment; on Linux the initial environment stays readable through `/proc`, so use the file form for untrusted workloads. |
+| `LIGHTSPEED_ENVD_AUTO_UPGRADE` | `false` | Opt a registered outbound daemon into installing and re-executing the build in the deployment discovery document when the gateway challenges it with a different protocol number. Accepts boolean values including `1`/`0`; automatic upgrade is attempted once for each protocol version the gateway names. |
+| `LIGHTSPEED_ENVD_REGISTRATION_KEY` | Unset | Registration key admitting a first-seen daemon identity. Read once and dropped from the process environment, and sent to the gateway only until the first admission; on Linux the initial environment stays readable through `/proc`, so use the file form for untrusted workloads. |
 | `LIGHTSPEED_ENVD_REGISTRATION_KEY_FILE` | Unset | File holding the registration key; mutually exclusive with the direct form. Delete the file once the receipt appears. |
-| `LIGHTSPEED_ENVD_REGISTRATION_NAME` | Unset | Display-name hint recorded on the environment at first registration. |
-| `LIGHTSPEED_ENVD_REGISTRATION_METADATA` | Unset | JSON object of string correlation metadata (at most 32 entries; keys up to 64 bytes, values up to 256; the `lightspeed.` prefix is reserved). Descriptive only. |
-| `LIGHTSPEED_ENVD_REGISTRATION_RECEIPT` | Unset | Path the daemon writes `{environmentId, incarnationId, daemonId, connectionId, identityMode}` to once admitted. |
+| `LIGHTSPEED_ENVD_REGISTRATION_NAME` | Unset | Display-name hint recorded on the environment at first registration; ignored on later connections. An out-of-bounds value refuses admission. |
+| `LIGHTSPEED_ENVD_REGISTRATION_METADATA` | Unset | JSON object of string correlation metadata (at most 32 entries; keys up to 64 bytes, values up to 256; the `lightspeed.` prefix is reserved), recorded at first registration only. Descriptive only. |
+| `LIGHTSPEED_ENVD_REGISTRATION_RECEIPT` | Unset | Path the daemon writes `{environmentId, incarnationId, daemonId, controlConnectionId, identityMode, admission}` to once admitted; `identityMode` is `persistent` or `ephemeral`, and `admission` is `created` or `reconnected`. The daemon refuses to start when the path is not writable and exits when writing it fails. |
 | `LIGHTSPEED_ENVD_CA_FILE` | Unset | PEM bundle of additional TLS trust anchors for a gateway behind a private CA. |
-| `LIGHTSPEED_ENVD_CWD` | Current directory | Default working directory exposed to jobs. |
-| `LIGHTSPEED_ENVD_FS_ROOT` | Native filesystem root containing the working directory | Filesystem boundary exposed by the daemon. |
-| `LIGHTSPEED_ENVD_STATE_DIR` | `<cwd>/.lightspeed-envd` | Durable daemon state directory; relative paths resolve under the working directory. Holds the daemon key (`daemon-key`, mode `0600`) and persisted job records/output. Keep it on storage that survives the intended restarts. Deleting identity state causes a new registration and does not clean up the old environment; deleting the directory also removes its job history. |
+| `LIGHTSPEED_ENVD_CWD` | Current directory | Default working directory of commands, jobs, and relative tool paths. |
+| `LIGHTSPEED_ENVD_FS_ROOT` | Native filesystem root containing the working directory | Filesystem boundary of file, search, scan, and transfer operations and of every command's working directory. Paths stay absolute in the machine's own namespace; the root is not a chroot, and it does not confine what commands can access. |
+| `LIGHTSPEED_ENVD_STATE_DIR` | `$XDG_STATE_HOME/lightspeed-envd`, else `$HOME/.local/state/lightspeed-envd` | Durable daemon state directory, created with mode `0700`; a relative path resolves under the working directory. Holds the daemon key (`daemon-key`, mode `0600`), job records and output, process spawn records, and the transfer journal. File and transfer operations never address it, wherever it lives. The daemon refuses to start when the default would lie inside the working directory; set this variable explicitly in that case. Keep it on storage that survives the intended restarts. Deleting identity state causes a new registration and does not clean up the old environment; deleting the directory also removes its job history. |
 
 Identity mode (persistent or ephemeral) is not daemon configuration: it is
 the registration key's policy, minted with
 `lightspeed environment registration-keys create` or on the Platform Environments
-page. A closed environment's daemon identity is spent; the daemon exits with
-a non-zero status on any terminal rejection and never generates a new
-identity on its own.
+page. A closed environment's daemon identity is spent. The daemon never
+generates a new identity on its own, and its exit status says why it stopped:
+
+| Status | Meaning |
+| --- | --- |
+| `0` | Deliberate shutdown on `SIGTERM` or `SIGINT`; a registered daemon tells the gateway first. |
+| `1` | An unexpected failure. |
+| `2` | Local configuration, state directory, or receipt-file error. |
+| `3` | The gateway refused registration for good, or speaks another protocol version and no automatic upgrade succeeded. |
+| `4` | The environment was closed; the identity is spent. |
+| `5` | Another process with the same daemon identity connected and won; the log names the identity. Run one daemon per state directory. |
+
+Disconnects, missed heartbeats, and retryable refusals never end the process:
+the daemon reconnects with backoff. It treats a control connection that
+receives nothing for three heartbeat intervals as dead.
 
 Run `lightspeed-envd upgrade` to install the build currently named by the
 deployment. It uses `LIGHTSPEED_ENVD_DISCOVERY_URL` when set, otherwise derives
@@ -236,8 +253,11 @@ gateway WebSockets and upgrade downloads.
 Automatic upgrade applies only to registered outbound daemons and only to a
 protocol mismatch—not ordinary commit drift. After replacement it re-executes
 the original executable path with the same arguments, preserving the working
-directory, process ID, state directory, and daemon identity. A lineage marker
-prevents a stale discovery document from causing an upgrade loop.
+directory, process ID, state directory, and daemon identity. A marker records
+the protocol version the upgrade targeted, so a stale discovery document cannot
+cause an upgrade loop. Network failures and server errors while fetching the
+discovery document or archive are retried; a checksum, build-fact, or protocol
+mismatch in the candidate ends the daemon with status 3.
 
 `./dev.sh full` and `./dev.sh runtime` also start one daemon on the developer
 machine (opt out with `./dev.sh --no-envd` or `LIGHTSPEED_DEV_ENVD=off`):
@@ -487,7 +507,8 @@ consumed by build scripts and should not be used as deployment overrides.
 | `LIGHTSPEED_RELEASE_RUST_VERSION` | Pinned release Rust toolchain. |
 | `LIGHTSPEED_RELEASE_BUILD_BASE_IMAGE` | Digest-pinned base used to construct the build environment. |
 | `LIGHTSPEED_API_PROTOCOL_VERSION` | API protocol identifier recorded in release metadata. |
-| `LIGHTSPEED_ENVIRONMENT_PROTOCOL_VERSION` | Environment protocol number the gateway and envd must match exactly; checked against the protocol crate and published in `envd.json`. Changing it is the release event that stops older daemons from registering. |
+| `LIGHTSPEED_ENVD_PROTOCOL_VERSION` | Environment protocol number of the data plane and the registration channel: the gateway, the runtime, and envd must match it exactly. Checked against the protocol crate and published in `envd.json`. Changing it is the release event that stops older daemons from registering. |
+| `LIGHTSPEED_CONTROLLER_PROTOCOL_VERSION` | Environment protocol number of the provider controller plane: the runtime and every provider controller must match it exactly. Checked against the protocol crate and recorded in the release manifest. |
 | `LIGHTSPEED_SCHEMA_REVISION` | Required Rust runtime database revision. |
 | `LIGHTSPEED_PLATFORM_SCHEMA_REVISION` | Required Platform database revision. |
 | `LIGHTSPEED_PLATFORM_UPGRADE_FROM` | Oldest Platform migration baseline exercised by release checks. |
diff --git a/docs/documentation/using-lightspeed/workspaces-and-skills.md b/docs/documentation/using-lightspeed/workspaces-and-skills.md
index 6d64856f1..e330bbc13 100644
--- a/docs/documentation/using-lightspeed/workspaces-and-skills.md
+++ b/docs/documentation/using-lightspeed/workspaces-and-skills.md
@@ -305,8 +305,12 @@ preparation for new work. Installing a skill during a run does not refresh the
 catalog during that run. Switching environments removes the old machine's
 catalog; the new machine is scanned at the next eligible refresh.
 
-The machine must be online and support filesystem scanning. Discovery does
-not wake it. If a scan fails or is incomplete, Lightspeed can retain the last
+The machine must be online. Discovery does not wake it, and it does not count
+as use of the machine, so it never keeps an idle machine from pausing. Each
+root is scanned on its own. A file the scan has to skip, such as an oversized
+`SKILL.md`, produces a warning naming its root while the root's other skills
+still appear, and a root that cannot be scanned at all does not hide the
+skills of other roots. If a scan fails or is incomplete, Lightspeed can retain the last
 successful catalog for the same environment and discovery scope, marking it
 stale with a warning in the API. The model's menu continues to list discovered
 paths; reading a skill still accesses the machine's current file.
diff --git a/docs/site/astro.config.mjs b/docs/site/astro.config.mjs
index 01a5973bd..f740fbc78 100644
--- a/docs/site/astro.config.mjs
+++ b/docs/site/astro.config.mjs
@@ -108,6 +108,7 @@ export default defineConfig({
         { label: 'Reference', collapsed: true, items: [
           { label: 'JSON-RPC API', slug: 'reference/api' },
           { label: 'Environment variables', slug: 'reference/environment-variables' },
+          { label: 'Environment protocol', slug: 'reference/environment-protocol' },
           { label: 'Workflow contract', slug: 'reference/workflow-contract' },
         ] },
       ],
diff --git a/platform/backend/src/routes/environment-deployment.ts b/platform/backend/src/routes/environment-deployment.ts
index ae45ea749..ac0778293 100644
--- a/platform/backend/src/routes/environment-deployment.ts
+++ b/platform/backend/src/routes/environment-deployment.ts
@@ -14,13 +14,13 @@ const metadataSchema = z.record(z.string(), z.string()).optional();
 const providerPutSchema = z.object({
   displayName: z.string().trim().min(1).max(200).optional(),
   metadata: metadataSchema,
-  controllerConnection: z.object({
-    endpoint: z.string().trim().min(1).max(2000),
-    transport: z.union([
-      z.object({ type: z.enum(["webSocket", "http"]) }),
-      z.object({ type: z.literal("provider"), providerType: z.string().trim().min(1).max(100) }),
-    ]),
-  }),
+  controllerEndpoint: z
+    .string()
+    .trim()
+    .max(2048)
+    .regex(/^(wss?:\/\/|unix:\/\/\/)[^\s]+$/, "controller endpoint must be a ws://, wss:// or unix:// URL"),
+  // Write-only: required for a new provider, omitted to keep the stored one.
+  credential: z.string().min(1).max(4096).optional(),
 });
 const bindingPutSchema = z.object({
   providerId: z.string().trim().min(1).max(200),
diff --git a/platform/backend/src/routes/gateway.ts b/platform/backend/src/routes/gateway.ts
index c0916109a..1933f852f 100644
--- a/platform/backend/src/routes/gateway.ts
+++ b/platform/backend/src/routes/gateway.ts
@@ -203,7 +203,8 @@ const externalEnvironmentCreateSchema = z.object({
   endpoint: z
     .string()
     .trim()
-    .regex(/^wss?:\/\/[^\s]+$/, "endpoint must be a ws:// or wss:// URL"),
+    .max(2048)
+    .regex(/^(wss?:\/\/|unix:\/\/\/)[^\s]+$/, "endpoint must be a ws://, wss:// or unix:// URL"),
   displayName: z.string().trim().min(1).max(200).optional(),
 });
 
@@ -1813,7 +1814,7 @@ export function gatewayRoutes(ctx: AppContext) {
       const client = engineClientFor(ctx, access);
       const params: EnvironmentExternalCreateParams = {
         requestId: externalEnvironmentRequestId(body.data.endpoint),
-        connection: { endpoint: body.data.endpoint, transport: "webSocket" },
+        endpoint: body.data.endpoint,
         displayName: body.data.displayName,
       };
       const response = await client.call("environments/external/create", params);
diff --git a/platform/configurator-mcp/src/generated/tools.ts b/platform/configurator-mcp/src/generated/tools.ts
index aac1e420f..6d75ded68 100644
--- a/platform/configurator-mcp/src/generated/tools.ts
+++ b/platform/configurator-mcp/src/generated/tools.ts
@@ -5288,20 +5288,16 @@ export const GENERATED_TOOLS: readonly GeneratedToolDescriptor[] = [
     "inputSchema": {
       "$schema": "http://json-schema.org/draft-07/schema#",
       "properties": {
-        "connection": {
-          "allOf": [
-            {
-              "$ref": "#/definitions/EnvironmentConnectionView"
-            }
-          ],
-          "description": "Connection to an envd instance reachable from Lightspeed."
-        },
         "displayName": {
           "type": [
             "string",
             "null"
           ]
         },
+        "endpoint": {
+          "description": "`ws://`, `wss://` or `unix://` URL of an envd instance reachable from\nLightspeed.",
+          "type": "string"
+        },
         "metadata": {
           "additionalProperties": {
             "type": "string"
@@ -5314,61 +5310,9 @@ export const GENERATED_TOOLS: readonly GeneratedToolDescriptor[] = [
       },
       "required": [
         "requestId",
-        "connection"
+        "endpoint"
       ],
-      "type": "object",
-      "definitions": {
-        "EnvironmentConnectionTransportView": {
-          "oneOf": [
-            {
-              "enum": [
-                "webSocket",
-                "http",
-                "stdio",
-                "ssh"
-              ],
-              "type": "string"
-            },
-            {
-              "additionalProperties": {
-                "not": {}
-              },
-              "properties": {
-                "provider": {
-                  "properties": {
-                    "provider_type": {
-                      "type": "string"
-                    }
-                  },
-                  "required": [
-                    "provider_type"
-                  ],
-                  "type": "object"
-                }
-              },
-              "required": [
-                "provider"
-              ],
-              "type": "object"
-            }
-          ]
-        },
-        "EnvironmentConnectionView": {
-          "properties": {
-            "endpoint": {
-              "type": "string"
-            },
-            "transport": {
-              "$ref": "#/definitions/EnvironmentConnectionTransportView"
-            }
-          },
-          "required": [
-            "endpoint",
-            "transport"
-          ],
-          "type": "object"
-        }
-      }
+      "type": "object"
     }
   },
   {
@@ -5376,7 +5320,7 @@ export const GENERATED_TOOLS: readonly GeneratedToolDescriptor[] = [
     "method": "environments/ingress/put",
     "group": "environments",
     "summary": "Configure environment public ingress",
-    "description": "Synchronously enables or disables one provider-authorized HTTPS endpoint for a provisioned environment. The provider owns hostname allocation, the approved guest port, routing, TLS, and health.",
+    "description": "Records the public ingress intent of a provisioned environment; the lifecycle reconciler converges it while the environment is ready, and `publicEndpoint` shows the realized endpoint. Rejected when the provider does not offer ingress. The provider owns hostname, guest port, routing, TLS, and health; an intent its template refuses is dropped.",
     "paramsType": "EnvironmentIngressPutParams",
     "resultType": "AgentApiOutcome<EnvironmentIngressPutResponse>",
     "inputSchema": {
diff --git a/platform/web/src/demo/fixtures/personal-assistant.ts b/platform/web/src/demo/fixtures/personal-assistant.ts
index 1a2485a26..33b7ba4d5 100644
--- a/platform/web/src/demo/fixtures/personal-assistant.ts
+++ b/platform/web/src/demo/fixtures/personal-assistant.ts
@@ -877,7 +877,7 @@ function seedEnvironments(universe: UniverseState): void {
     requestId: `req-${hex("ada-mac-mini", 12)}`,
     source: {
       type: "external",
-      connection: { endpoint: "ws://mac-mini.tailnet:19091", transport: "webSocket" },
+      endpoint: "ws://mac-mini.tailnet:19091",
     },
     displayName: "Mac mini (home)",
     status: "ready",
diff --git a/platform/web/src/demo/fixtures/platform.ts b/platform/web/src/demo/fixtures/platform.ts
index f879a2254..6c4f00ba7 100644
--- a/platform/web/src/demo/fixtures/platform.ts
+++ b/platform/web/src/demo/fixtures/platform.ts
@@ -65,10 +65,9 @@ export function seedPlatform(store: DemoStore): void {
   store.environmentProviders.set(INCUS_PROVIDER_ID, {
     providerId: INCUS_PROVIDER_ID,
     displayName: "Incus (eu-1)",
-    controllerConnection: {
-      endpoint: "wss://incus-eu-1.lightspeed.demo:19090",
-      transport: { type: "webSocket" },
-    },
+    controllerEndpoint: "wss://incus-eu-1.lightspeed.demo:19090/control",
+    controllerFeatures: { adoptTarget: true, ingress: true },
+    dataRouteBase: "wss://incus-eu-1.lightspeed.demo:19090/routes",
     metadata: { region: "eu-1", mode: "cluster" },
     createdAtMs: Date.parse("2026-06-05T12:00:00.000Z"),
     updatedAtMs: Date.parse("2026-08-10T09:00:00.000Z"),
diff --git a/platform/web/src/demo/fixtures/software-factory.ts b/platform/web/src/demo/fixtures/software-factory.ts
index d52a08cbd..a80c7e877 100644
--- a/platform/web/src/demo/fixtures/software-factory.ts
+++ b/platform/web/src/demo/fixtures/software-factory.ts
@@ -1305,7 +1305,7 @@ function seedEnvironments(universe: UniverseState): void {
     requestId: `req-${hex("priya-laptop", 12)}`,
     source: {
       type: "external",
-      connection: { endpoint: "ws://priya-mbp.tailnet.acme.example:19091", transport: "webSocket" },
+      endpoint: "ws://priya-mbp.tailnet.acme.example:19091",
     },
     displayName: "Priya's laptop (envd)",
     status: "ready",
diff --git a/platform/web/src/demo/routes/admin.ts b/platform/web/src/demo/routes/admin.ts
index 2879e04b5..429d370b5 100644
--- a/platform/web/src/demo/routes/admin.ts
+++ b/platform/web/src/demo/routes/admin.ts
@@ -13,8 +13,6 @@ import { groupsFor } from "@/lib/method-groups";
 import type { DemoStore, UniverseState } from "../store";
 import { badRequest, conflict, notFound, readBody } from "./common";
 
-type ControllerConnection = DeploymentEnvironmentProviderView["controllerConnection"];
-
 /// What a fresh binding provisions from when no other universe already
 /// lists this provider's templates.
 const DEFAULT_TEMPLATES: Array<Omit<EnvironmentTemplate, "providerId" | "bindingId">> = [
@@ -53,25 +51,8 @@ function stringMetadata(value: unknown): Record<string, string> {
   return metadata;
 }
 
-function parseConnection(value: unknown): ControllerConnection | null {
-  if (!isRecord(value)) return null;
-  const endpoint = optionalString(value.endpoint);
-  const transport = isRecord(value.transport) ? value.transport : null;
-  if (!endpoint || !transport) return null;
-  switch (transport.type) {
-    case "provider": {
-      const providerType = optionalString(transport.providerType);
-      return providerType ? { endpoint, transport: { type: "provider", providerType } } : null;
-    }
-    case "webSocket":
-    case "http":
-    case "stdio":
-    case "ssh":
-      return { endpoint, transport: { type: transport.type } };
-    default:
-      return null;
-  }
-}
+/// The controller URL schemes the engine accepts.
+const CONTROLLER_ENDPOINT = /^(wss?:\/\/|unix:\/\/\/)[^\s]+$/;
 
 /// The admin page addresses universes by their engine id; the platform id
 /// resolves too so either spelling works.
@@ -166,17 +147,33 @@ export function adminRoutes(store: DemoStore): Hono {
   app.put("/admin/environment-providers/:providerId", async (c) => {
     const providerId = c.req.param("providerId").trim();
     if (!providerId) return badRequest(c, "providerId is required");
-    const body = await readBody<{ displayName?: unknown; metadata?: unknown; controllerConnection?: unknown }>(c);
-    const controllerConnection = parseConnection(body.controllerConnection);
-    if (!controllerConnection) {
-      return badRequest(c, "controllerConnection needs an endpoint and a transport");
+    const body = await readBody<{
+      displayName?: unknown;
+      metadata?: unknown;
+      controllerEndpoint?: unknown;
+      credential?: unknown;
+    }>(c);
+    const controllerEndpoint = optionalString(body.controllerEndpoint);
+    if (!controllerEndpoint || !CONTROLLER_ENDPOINT.test(controllerEndpoint)) {
+      return badRequest(c, "controllerEndpoint must be a ws://, wss:// or unix:// URL");
     }
     const existing = store.environmentProviders.get(providerId);
+    if (!existing && !optionalString(body.credential)) {
+      return badRequest(c, "credential is required for a new provider");
+    }
     const now = Date.now();
     const provider: DeploymentEnvironmentProviderView = {
       providerId,
       ...(optionalString(body.displayName) ? { displayName: optionalString(body.displayName) } : {}),
-      controllerConnection,
+      controllerEndpoint,
+      // The demo has no controller to reach, so a changed endpoint has
+      // not advertised anything yet.
+      ...(existing && existing.controllerEndpoint === controllerEndpoint
+        ? {
+          controllerFeatures: existing.controllerFeatures ?? null,
+          dataRouteBase: existing.dataRouteBase ?? null,
+        }
+        : {}),
       metadata: stringMetadata(body.metadata),
       createdAtMs: existing?.createdAtMs ?? now,
       updatedAtMs: now,
diff --git a/platform/web/src/demo/routes/environments.ts b/platform/web/src/demo/routes/environments.ts
index 77194e23c..39829073e 100644
--- a/platform/web/src/demo/routes/environments.ts
+++ b/platform/web/src/demo/routes/environments.ts
@@ -31,7 +31,7 @@ const POWER_STATUS: Record<PowerState, LifecycleStatus> = {
 
 const IDLE_STAGES = ["pauseAfterMs", "suspendAfterMs", "stopAfterMs", "closeAfterMs"] as const;
 const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
-const WS_ENDPOINT = /^wss?:\/\/[^\s]+$/;
+const ENVD_ENDPOINT = /^(wss?:\/\/|unix:\/\/\/)[^\s]+$/;
 const DEV_ENVD_ENDPOINT = "ws://127.0.0.1:19091";
 
 export interface ProvisionParams {
@@ -169,9 +169,10 @@ export function provisionEnvironment(
   if (template) {
     transition(environment, [["booting", 2_500], ["ready", 6_000]]);
   } else {
-    environment.metadata = {
-      ...environment.metadata,
-      lifecycleError: `unknown template ${params.templateId}`,
+    environment.lifecycleError = {
+      message: `unknown template ${params.templateId}`,
+      firstAtMs: now,
+      lastAtMs: now,
     };
     transition(environment, [["failed", 1_500]]);
   }
@@ -409,7 +410,9 @@ export function environmentRoutes(store: DemoStore): Hono {
     if (!universe) return notFound(c);
     const body = await readBody<{ endpoint?: unknown; displayName?: unknown }>(c);
     const endpoint = typeof body.endpoint === "string" ? body.endpoint.trim() : "";
-    if (!WS_ENDPOINT.test(endpoint)) return badRequest(c, "endpoint must be a ws:// or wss:// URL");
+    if (!ENVD_ENDPOINT.test(endpoint)) {
+      return badRequest(c, "endpoint must be a ws://, wss:// or unix:// URL");
+    }
     const requestId = externalRequestId(endpoint);
     const existing = findByRequestId(universe, requestId);
     if (existing) return c.json(existing, 201);
@@ -418,7 +421,7 @@ export function environmentRoutes(store: DemoStore): Hono {
     const environment: Environment = {
       environmentId,
       requestId,
-      source: { type: "external", connection: { endpoint, transport: "webSocket" } },
+      source: { type: "external", endpoint },
       displayName: typeof body.displayName === "string" && body.displayName.trim()
         ? body.displayName.trim()
         : null,
diff --git a/platform/web/src/pages/AdminEnvironmentProvidersPage.tsx b/platform/web/src/pages/AdminEnvironmentProvidersPage.tsx
index 1dcc6e1bb..c8c89bd33 100644
--- a/platform/web/src/pages/AdminEnvironmentProvidersPage.tsx
+++ b/platform/web/src/pages/AdminEnvironmentProvidersPage.tsx
@@ -64,7 +64,6 @@ type UniverseBindings = {
   error: string | null;
 };
 
-type TransportKind = "webSocket" | "http" | "provider";
 
 /// Deployment-scoped environment provider administration: physical
 /// providers are registered once by a platform admin and shared with
@@ -164,10 +163,12 @@ export function AdminEnvironmentProvidersPage() {
                     <span className="font-mono text-xs text-muted-foreground">
                       {provider.providerId}
                     </span>
-                    <Badge variant="outline">{transportLabel(provider)}</Badge>
+                    {providerFeatureLabels(provider).map((label) => (
+                      <Badge key={label} variant="outline">{label}</Badge>
+                    ))}
                   </div>
                   <p className="mt-1 truncate font-mono text-xs text-muted-foreground">
-                    {provider.controllerConnection.endpoint}
+                    {provider.controllerEndpoint}
                   </p>
                 </div>
                 <div className="flex items-center gap-2">
@@ -271,9 +272,15 @@ export function AdminEnvironmentProvidersPage() {
   );
 }
 
-function transportLabel(provider: Provider): string {
-  const transport = provider.controllerConnection.transport;
-  return transport.type === "provider" ? `provider:${transport.providerType}` : transport.type;
+/// What the controller advertised at its last successful handshake, or
+/// that Lightspeed has not reached it at this endpoint yet.
+function providerFeatureLabels(provider: Provider): string[] {
+  const features = provider.controllerFeatures;
+  if (!features) return ["not reached yet"];
+  return [
+    ...(features.adoptTarget ? ["adoption"] : []),
+    ...(features.ingress ? ["ingress"] : []),
+  ];
 }
 
 function BindingRow({
@@ -374,16 +381,14 @@ function RegisterProviderDialog({
   const [providerId, setProviderId] = useState("");
   const [displayName, setDisplayName] = useState("");
   const [endpoint, setEndpoint] = useState("");
-  const [transport, setTransport] = useState<TransportKind>("webSocket");
-  const [providerType, setProviderType] = useState("");
+  const [credential, setCredential] = useState("");
   const [error, setError] = useState<string | null>(null);
 
   const reset = () => {
     setProviderId("");
     setDisplayName("");
     setEndpoint("");
-    setTransport("webSocket");
-    setProviderType("");
+    setCredential("");
     setError(null);
   };
 
@@ -391,12 +396,8 @@ function RegisterProviderDialog({
     mutationFn: () =>
       api<Provider>("PUT", `/api/v1/admin/environment-providers/${encodeURIComponent(providerId.trim())}`, {
         ...(displayName.trim() ? { displayName: displayName.trim() } : {}),
-        controllerConnection: {
-          endpoint: endpoint.trim(),
-          transport: transport === "provider"
-            ? { type: "provider", providerType: providerType.trim() }
-            : { type: transport },
-        },
+        controllerEndpoint: endpoint.trim(),
+        credential,
       }),
     onSuccess: () => {
       onOpenChange(false);
@@ -410,9 +411,10 @@ function RegisterProviderDialog({
     event.preventDefault();
     if (!providerId.trim()) return setError("a provider id is required");
     if (!endpoint.trim()) return setError("a controller endpoint is required");
-    if (transport === "provider" && !providerType.trim()) {
-      return setError("a provider type is required for in-process providers");
+    if (!/^(wss?:\/\/|unix:\/\/\/)\S+$/.test(endpoint.trim())) {
+      return setError("the controller endpoint must be a ws://, wss:// or unix:// URL");
     }
+    if (!credential) return setError("the provider credential is required");
     save.mutate();
   };
 
@@ -422,9 +424,9 @@ function RegisterProviderDialog({
         <DialogHeader>
           <DialogTitle>Register environment provider</DialogTitle>
           <DialogDescription>
-            Records how Lightspeed reaches the provider's controller endpoint. The
-            provider never self-registers; the deployment network is the trust
-            boundary. Universes get access through bindings.
+            Records how Lightspeed reaches the provider's controller endpoint and
+            the credential it presents there. The provider never self-registers.
+            Universes get access through bindings.
           </DialogDescription>
         </DialogHeader>
         <form onSubmit={submit} className="grid gap-4">
@@ -450,39 +452,29 @@ function RegisterProviderDialog({
               placeholder="Incus on hz02"
             />
           </Field>
-          <Field>
-            <FieldLabel>Transport</FieldLabel>
-            <Select value={transport} onValueChange={(next) => setTransport(next as TransportKind)}>
-              <SelectTrigger className="w-full">
-                <SelectValue>{(value: string) => transportName(value as TransportKind)}</SelectValue>
-              </SelectTrigger>
-              <SelectContent>
-                <SelectItem value="webSocket">{transportName("webSocket")}</SelectItem>
-                <SelectItem value="http">{transportName("http")}</SelectItem>
-                <SelectItem value="provider">{transportName("provider")}</SelectItem>
-              </SelectContent>
-            </Select>
-          </Field>
-          {transport === "provider" && (
-            <Field>
-              <FieldLabel htmlFor="provider-type">Provider type</FieldLabel>
-              <Input
-                id="provider-type"
-                value={providerType}
-                onChange={(e) => setProviderType(e.target.value)}
-                placeholder="fake"
-              />
-            </Field>
-          )}
           <Field>
             <FieldLabel htmlFor="provider-endpoint">Controller endpoint</FieldLabel>
             <Input
               id="provider-endpoint"
               value={endpoint}
               onChange={(e) => setEndpoint(e.target.value)}
-              placeholder={transport === "provider" ? "in-process" : "ws://provider.internal:19090"}
+              placeholder="wss://provider.internal:19090/control"
             />
           </Field>
+          <Field>
+            <FieldLabel htmlFor="provider-credential">Credential</FieldLabel>
+            <Input
+              id="provider-credential"
+              type="password"
+              autoComplete="off"
+              value={credential}
+              onChange={(e) => setCredential(e.target.value)}
+            />
+            <FieldDescription className="text-xs">
+              The bearer secret the provider is configured with. Write-only: it is
+              never shown again.
+            </FieldDescription>
+          </Field>
           {error && <p className="text-sm text-destructive">{error}</p>}
           <DialogFooter>
             <Button type="button" variant="outline" onClick={() => onOpenChange(false)}>
@@ -498,17 +490,6 @@ function RegisterProviderDialog({
   );
 }
 
-function transportName(kind: TransportKind): string {
-  switch (kind) {
-    case "webSocket":
-      return "WebSocket";
-    case "http":
-      return "HTTP";
-    case "provider":
-      return "In-process provider";
-  }
-}
-
 function BindUniverseDialog({
   provider,
   universes,
diff --git a/platform/web/src/pages/EnvironmentsPage.tsx b/platform/web/src/pages/EnvironmentsPage.tsx
index 4fa59fae4..02e759d22 100644
--- a/platform/web/src/pages/EnvironmentsPage.tsx
+++ b/platform/web/src/pages/EnvironmentsPage.tsx
@@ -116,6 +116,7 @@ function ProviderList({ universeId }: { universeId: string }) {
       return rows?.some((environment) =>
         ["provisioning", "booting", "closing", "unknown"].includes(environment.status)
           || powerDiverges(environment)
+          || ingressDiverges(environment)
       ) ? REFRESH_MS : false;
     },
   });
@@ -199,7 +200,7 @@ function ProviderList({ universeId }: { universeId: string }) {
                 (environment) =>
                   environment.source.type === "external"
                   && hints.data?.devEnvdEndpoint
-                  && environment.source.connection.endpoint === hints.data.devEnvdEndpoint,
+                  && environment.source.endpoint === hints.data.devEnvdEndpoint,
               )}
             />
             {creatableTemplates.length > 0 && (
@@ -1119,7 +1120,12 @@ function EnvironmentIngressButton({
           ? "Updating ingress…"
           : environment.publicIngressEnabled ? "Disable public ingress" : "Enable public ingress"}
       </Button>
-      {environment.publicEndpoint && (
+      {ingressDiverges(environment) && (
+        <span className="text-xs text-muted-foreground">
+          {environment.publicIngressEnabled ? "Public endpoint pending…" : "Removing public endpoint…"}
+        </span>
+      )}
+      {environment.publicIngressEnabled && environment.publicEndpoint && (
         <a
           className="break-all text-xs text-primary underline-offset-4 hover:underline"
           href={environment.publicEndpoint}
@@ -1134,6 +1140,15 @@ function EnvironmentIngressButton({
   );
 }
 
+/**
+ * `environments/ingress/put` records the intent; the reconciler realizes it
+ * later, so `publicEndpoint` lags `publicIngressEnabled` until it converges.
+ */
+function ingressDiverges(environment: Environment): boolean {
+  if (environment.source.type !== "provisioned") return false;
+  return environment.publicIngressEnabled !== Boolean(environment.publicEndpoint);
+}
+
 function CloseEnvironmentButton({
   universeId,
   environment,
diff --git a/release/metadata.env b/release/metadata.env
index 6d5ccac31..7690fe094 100644
--- a/release/metadata.env
+++ b/release/metadata.env
@@ -8,10 +8,13 @@ LIGHTSPEED_PRODUCT_VERSION=0.4.0
 LIGHTSPEED_RELEASE_RUST_VERSION=1.99.0
 LIGHTSPEED_RELEASE_BUILD_BASE_IMAGE=rust:1.99.0-bookworm@sha256:59037199c44290f2befcdd58dcc540164763fc296950255aaefeef096a1866b0
 LIGHTSPEED_API_PROTOCOL_VERSION=lightspeed.agent.api.v1
-# The environment protocol number the gateway and envd must agree on exactly;
-# a change here is the release event that stops older daemons from registering.
-LIGHTSPEED_ENVIRONMENT_PROTOCOL_VERSION=2
-LIGHTSPEED_SCHEMA_REVISION=11
+# The environment protocol numbers, each matched exactly. The envd number
+# covers the data plane and the registration channel: a change here is the
+# release event that stops older daemons from registering. The controller
+# number covers provider controllers.
+LIGHTSPEED_ENVD_PROTOCOL_VERSION=3
+LIGHTSPEED_CONTROLLER_PROTOCOL_VERSION=3
+LIGHTSPEED_SCHEMA_REVISION=12
 # Drizzle journal length and the oldest platform migration boundary accepted by
 # the current release's automated upgrade gate.
 LIGHTSPEED_PLATFORM_SCHEMA_REVISION=4
diff --git a/release/release-manifest.schema.json b/release/release-manifest.schema.json
index e0f608835..cffbc9e38 100644
--- a/release/release-manifest.schema.json
+++ b/release/release-manifest.schema.json
@@ -13,7 +13,8 @@
     "envdTarget",
     "buildImage",
     "protocolVersion",
-    "environmentProtocolVersion",
+    "envdProtocolVersion",
+    "controllerProtocolVersion",
     "contractRevision",
     "schemaRevision",
     "platformSchemaRevision",
@@ -32,7 +33,8 @@
     "envdTarget": { "type": "string", "pattern": "-linux-musl$" },
     "buildImage": { "type": "string", "pattern": "@sha256:[0-9a-f]{64}$" },
     "protocolVersion": { "type": "string", "minLength": 1 },
-    "environmentProtocolVersion": { "type": "integer", "minimum": 1 },
+    "envdProtocolVersion": { "type": "integer", "minimum": 1 },
+    "controllerProtocolVersion": { "type": "integer", "minimum": 1 },
     "contractRevision": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" },
     "schemaRevision": { "type": "integer", "minimum": 1 },
     "platformSchemaRevision": { "type": "integer", "minimum": 1 },
diff --git a/scripts/release/create-manifest.mjs b/scripts/release/create-manifest.mjs
index 8a1077e89..e858226f4 100755
--- a/scripts/release/create-manifest.mjs
+++ b/scripts/release/create-manifest.mjs
@@ -58,13 +58,19 @@ if (typeof rustVersion !== "string" || rustVersion.length === 0) {
 // well-known path, next to the archives it names, so an orchestrator can pick
 // the daemon that matches a gateway without credentials or a checkout. The
 // protocol version is the number that decides admission; the rest is
-// provenance. `url` is a plain HTTPS download when one exists, which today is
+// provenance; the controller number only travels in the release manifest.
+// `url` is a plain HTTPS download when one exists, which today is
 // only a tagged release's GitHub asset; a snapshot bundle carries null and the
 // serving deployment fills it in.
 const envdTarget = metadata.LIGHTSPEED_ENVD_TARGET;
-const environmentProtocolVersion = Number(metadata.LIGHTSPEED_ENVIRONMENT_PROTOCOL_VERSION);
-if (!envdTarget || !Number.isInteger(environmentProtocolVersion) || environmentProtocolVersion < 1) {
-  throw new Error("release metadata must name the envd target and the environment protocol version");
+const envdProtocolVersion = Number(metadata.LIGHTSPEED_ENVD_PROTOCOL_VERSION);
+const controllerProtocolVersion = Number(metadata.LIGHTSPEED_CONTROLLER_PROTOCOL_VERSION);
+if (
+  !envdTarget
+  || !Number.isInteger(envdProtocolVersion) || envdProtocolVersion < 1
+  || !Number.isInteger(controllerProtocolVersion) || controllerProtocolVersion < 1
+) {
+  throw new Error("release metadata must name the envd target and both environment protocol versions");
 }
 const channel = process.env.LIGHTSPEED_RELEASE_CHANNEL ?? "main";
 if (!["release", "main"].includes(channel)) {
@@ -96,7 +102,7 @@ const discovery = {
   version,
   gitSha,
   channel,
-  protocolVersion: environmentProtocolVersion,
+  protocolVersion: envdProtocolVersion,
   builtAtMs,
   artifacts: envdArtifacts,
 };
@@ -111,7 +117,8 @@ const manifest = {
   envdTarget,
   buildImage,
   protocolVersion: metadata.LIGHTSPEED_API_PROTOCOL_VERSION,
-  environmentProtocolVersion,
+  envdProtocolVersion,
+  controllerProtocolVersion,
   contractRevision: `sha256:${contractHash.digest("hex")}`,
   schemaRevision: Number(metadata.LIGHTSPEED_SCHEMA_REVISION),
   platformSchemaRevision: Number(metadata.LIGHTSPEED_PLATFORM_SCHEMA_REVISION),
diff --git a/scripts/release/smoke.sh b/scripts/release/smoke.sh
index 200db3e18..2a8aa00ae 100755
--- a/scripts/release/smoke.sh
+++ b/scripts/release/smoke.sh
@@ -21,7 +21,7 @@ node -e '
   if (build.target !== target) throw new Error(`envd target ${build.target} is not ${target}`);
   if (build.protocolVersion !== Number(protocol)) throw new Error("envd protocol version mismatch");
 ' "$(dist/bin/lightspeed-envd --print-build)" "$expected_sha" \
-  "$LIGHTSPEED_ENVD_TARGET" "$LIGHTSPEED_ENVIRONMENT_PROTOCOL_VERSION"
+  "$LIGHTSPEED_ENVD_TARGET" "$LIGHTSPEED_ENVD_PROTOCOL_VERSION"
 
 for archive in dist/archives/*.tar.gz; do
   if [[ "$archive" != *-demo-* && "$archive" != *-docs-* ]]; then
diff --git a/scripts/release/verify-manifest.mjs b/scripts/release/verify-manifest.mjs
index e1efbb625..722eab2b3 100755
--- a/scripts/release/verify-manifest.mjs
+++ b/scripts/release/verify-manifest.mjs
@@ -23,8 +23,11 @@ if (!/^[0-9a-f]{40}$/.test(value.gitSha)) fail("gitSha must be a full SHA");
 if (value.version !== metadata.LIGHTSPEED_PRODUCT_VERSION) fail("unexpected product version");
 if (value.target !== metadata.LIGHTSPEED_RELEASE_TARGET) fail("unexpected target");
 if (value.envdTarget !== metadata.LIGHTSPEED_ENVD_TARGET) fail("unexpected envd target");
-if (value.environmentProtocolVersion !== Number(metadata.LIGHTSPEED_ENVIRONMENT_PROTOCOL_VERSION)) {
-  fail("unexpected environment protocol version");
+if (value.envdProtocolVersion !== Number(metadata.LIGHTSPEED_ENVD_PROTOCOL_VERSION)) {
+  fail("unexpected envd protocol version");
+}
+if (value.controllerProtocolVersion !== Number(metadata.LIGHTSPEED_CONTROLLER_PROTOCOL_VERSION)) {
+  fail("unexpected controller protocol version");
 }
 if (!/@sha256:[0-9a-f]{64}$/.test(value.buildImage)) fail("buildImage is not digest-pinned");
 if (published && !value.buildImage.startsWith("ghcr.io/")) fail("published build image is not in GHCR");
@@ -94,7 +97,7 @@ const discovery = JSON.parse(fs.readFileSync(discoveryFile, "utf8"));
 if (discovery.version !== value.version) dfail("version differs from the manifest");
 if (discovery.gitSha !== value.gitSha) dfail("gitSha differs from the manifest");
 if (!["release", "main"].includes(discovery.channel)) dfail("channel must be release or main");
-if (discovery.protocolVersion !== value.environmentProtocolVersion) {
+if (discovery.protocolVersion !== value.envdProtocolVersion) {
   dfail("protocolVersion differs from the manifest");
 }
 if (!Number.isInteger(discovery.builtAtMs) || discovery.builtAtMs <= 0) dfail("invalid builtAtMs");
diff --git a/scripts/release/verify-metadata.sh b/scripts/release/verify-metadata.sh
index 3e0f060ec..5ccf268e0 100755
--- a/scripts/release/verify-metadata.sh
+++ b/scripts/release/verify-metadata.sh
@@ -10,8 +10,10 @@ grep -F "pub const REQUIRED_SCHEMA_REVISION: i64 = $LIGHTSPEED_SCHEMA_REVISION;"
   crates/store-pg/src/migrations.rs >/dev/null
 grep -F "pub const PROTOCOL_VERSION: &str = \"$LIGHTSPEED_API_PROTOCOL_VERSION\";" \
   crates/api/src/constants.rs >/dev/null
-grep -F "pub const CURRENT_PROTOCOL_VERSION: u32 = $LIGHTSPEED_ENVIRONMENT_PROTOCOL_VERSION;" \
-  crates/environment-protocol/src/shared.rs >/dev/null
+grep -F "pub const ENVD_PROTOCOL_VERSION: u32 = $LIGHTSPEED_ENVD_PROTOCOL_VERSION;" \
+  crates/environment-protocol/src/version.rs >/dev/null
+grep -F "pub const CONTROLLER_PROTOCOL_VERSION: u32 = $LIGHTSPEED_CONTROLLER_PROTOCOL_VERSION;" \
+  crates/environment-protocol/src/version.rs >/dev/null
 if [[ ! "$LIGHTSPEED_ENVD_TARGET" =~ -linux-musl$ ]]; then
   echo "LIGHTSPEED_ENVD_TARGET must be a static musl target" >&2
   exit 1

From 7dc42248b1561bf898b0097eeff65af09494af47 Mon Sep 17 00:00:00 2001
From: lb <542828+lukebuehler@users.noreply.github.com>
Date: Wed, 28 Oct 2026 12:41:21 +0100
Subject: [PATCH 2/5] simplify env management

---
 clients/typescript/schema/api.schema.json     | 1000 ++++---
 clients/typescript/src/generated/methods.ts   |  240 +-
 clients/typescript/src/generated/types.ts     |  603 ++--
 crates/api/contract/api-reference.md          |  105 +-
 crates/api/contract/api.schema.json           | 1000 ++++---
 crates/api/contract/methods.json              |  164 +-
 crates/api/contract/openrpc.json              | 1251 ++++----
 crates/api/src/access.rs                      |    8 +-
 crates/api/src/constants.rs                   |    6 +-
 crates/api/src/deployment.rs                  |  110 +-
 crates/api/src/environments.rs                |  374 ++-
 crates/api/src/ids.rs                         |    2 -
 crates/api/src/rpc.rs                         |   38 +-
 crates/api/src/schema_export.rs               |    4 +-
 crates/api/src/service.rs                     |   20 +-
 crates/api/src/tests.rs                       |  398 ++-
 crates/cli/src/api_client.rs                  |   30 +-
 crates/cli/src/env_cli.rs                     |  405 ++-
 crates/cli/src/main.rs                        |  107 +-
 crates/cli/src/profile_cli.rs                 |  146 +-
 crates/cli/tests/resource_commands.rs         |   55 +-
 crates/environment-client/Cargo.toml          |    3 +-
 .../src/conformance/controller.rs             |  243 +-
 .../src/conformance/data_route.rs             |  178 ++
 .../environment-client/src/conformance/mod.rs |    4 +-
 crates/environment-client/src/connection.rs   |    5 +-
 crates/environment-client/src/controller.rs   |   17 +-
 crates/environment-client/src/dial.rs         |  130 +-
 crates/environment-client/src/error.rs        |   86 +-
 crates/environment-client/tests/client.rs     |  115 +-
 crates/environment-daemon/src/config.rs       |  232 +-
 crates/environment-daemon/src/dispatch.rs     |    2 +-
 crates/environment-daemon/src/lib.rs          |   78 +-
 crates/environment-daemon/src/process.rs      |    4 +-
 crates/environment-daemon/src/registration.rs |  102 +-
 crates/environment-daemon/src/server.rs       |   36 +-
 crates/environment-daemon/src/upgrade.rs      |   14 +-
 .../contract/controller.openrpc.json          |  453 +--
 .../contract/controller.schema.json           |  384 +--
 .../contract/data.openrpc.json                |   19 +-
 .../contract/data.schema.json                 |   17 +-
 .../contract/registration.openrpc.json        |   28 +-
 .../contract/registration.schema.json         |   26 +-
 .../fixtures/bootstrap/build-facts.json       |    2 +-
 .../bootstrap/discovery-document.json         |    2 +-
 .../fixtures/controller/ingress.ensure.json   |   24 +-
 .../fixtures/controller/ingress.remove.json   |   24 +-
 .../fixtures/controller/initialize.json       |   15 +-
 .../fixtures/controller/target.adopt.json     |   44 -
 .../fixtures/controller/target.close.json     |   12 +-
 .../fixtures/controller/target.create.json    |   21 +-
 .../fixtures/controller/target.get.json       |   24 +-
 .../fixtures/controller/target.setPower.json  |   25 +-
 .../fixtures/controller/template.list.json    |   14 +-
 .../fixtures/data/initialize.json             |   10 +-
 .../registration/registration.challenge.json  |    2 +-
 .../registration/registration.register.json   |    3 +-
 crates/environment-protocol/src/contract.rs   |   26 +-
 .../src/control/handshake.rs                  |   27 +-
 .../src/control/ingress.rs                    |    5 +-
 .../environment-protocol/src/control/mod.rs   |   40 +-
 .../src/control/target.rs                     |  112 +-
 .../src/control/template.rs                   |   21 +-
 crates/environment-protocol/src/data/idle.rs  |   13 +-
 crates/environment-protocol/src/error.rs      |   10 +-
 crates/environment-protocol/src/idle.rs       |  244 ++
 crates/environment-protocol/src/ids.rs        |   16 -
 crates/environment-protocol/src/lib.rs        |    9 +-
 crates/environment-protocol/src/limits.rs     |   14 +-
 crates/environment-protocol/src/manifest.rs   |   18 +-
 .../environment-protocol/src/registration.rs  |   13 +-
 crates/environment-protocol/src/routes.rs     |  292 +-
 crates/environment-protocol/src/version.rs    |    4 +-
 crates/environment-protocol/tests/serde.rs    |   55 +-
 crates/environment-provider-incus/CLUSTER.md  |   16 +-
 crates/environment-provider-incus/README.md   |  185 +-
 .../config.cluster.example.json               |    8 +-
 .../config.example.json                       |    8 +-
 .../image/lightspeed-envd.service             |    3 +
 .../environment-provider-incus/src/config.rs  |  211 +-
 crates/environment-provider-incus/src/idle.rs |  604 ++++
 .../environment-provider-incus/src/incus.rs   |  401 +--
 .../environment-provider-incus/src/ingress.rs |    6 +-
 crates/environment-provider-incus/src/lib.rs  |    1 +
 .../environment-provider-incus/src/policy.rs  |   83 +-
 .../environment-provider-incus/src/relay.rs   |  101 +-
 .../environment-provider-incus/src/server.rs  | 1279 +++++---
 .../tests/incus_live.rs                       |  311 +-
 crates/environments/src/lib.rs                | 2637 ++++++++++-------
 crates/environments/src/memory.rs             |  883 +++---
 crates/environments/src/tests.rs              | 2541 ++++++++++------
 .../store-pg/migrations/005_environments.sql  |  448 +--
 .../migrations/012_environment_endpoints.sql  |  138 -
 crates/store-pg/src/deployment.rs             |   11 +-
 crates/store-pg/src/environment.rs            | 2419 +++++++--------
 .../store-pg/src/environment_registration.rs  |  360 ++-
 crates/store-pg/src/lib.rs                    |   42 +-
 crates/store-pg/src/migrations.rs             |    9 +-
 crates/store-pg/tests/migrations_live.rs      |  115 +-
 crates/store-pg/tests/store_pg_live.rs        | 2430 +++++++++++----
 .../src/environments/fake_controller.rs       |  490 ++-
 .../src/environments/gateway.rs               |   32 +-
 .../src/environments/lifecycle.rs             | 2621 ++++++++--------
 .../temporal-runtime/src/environments/mod.rs  |    6 +-
 .../src/environments/power.rs                 |  312 --
 .../src/environments/provider_controllers.rs  |  656 ++--
 .../src/environments/providers.rs             |  510 ++--
 .../src/environments/registration.rs          |  519 ++--
 .../src/environments/resolver.rs              |  853 +++---
 .../src/environments/runtime.rs               |   48 +-
 .../src/environments/signals.rs               |  122 +
 .../src/environments/sources.rs               |   31 +-
 .../src/gateway/deployment.rs                 |  276 +-
 crates/temporal-runtime/src/gateway/http.rs   |  858 ++++--
 crates/temporal-runtime/src/gateway/mod.rs    |    5 +-
 .../src/gateway/registration.rs               | 1136 +++++--
 .../src/gateway/service/environments.rs       |   54 +-
 .../src/gateway/service/mod.rs                |   94 +-
 .../src/gateway/service/session_jobs.rs       |   19 +-
 crates/temporal-runtime/src/main.rs           |   61 +-
 crates/temporal-runtime/src/roles.rs          |    5 +-
 crates/temporal-runtime/src/universe.rs       |  152 +-
 .../src/worker/activities/environment_jobs.rs |   56 +-
 .../src/worker/session_tools.rs               |  595 ++--
 .../tests/code_capabilities_live.rs           |    4 +-
 .../tests/environment_provider_live.rs        | 1222 ++++----
 .../tests/environment_registration_live.rs    |  782 ++++-
 .../temporal-runtime/tests/profiles_live.rs   |  216 +-
 crates/temporal-runtime/tests/runs_live.rs    |   50 +-
 .../temporal-runtime/tests/subagents_live.rs  |   96 +-
 crates/temporal-runtime/tests/support/live.rs |   13 +-
 .../tests/vfs_transfer_live.rs                |    3 +-
 crates/tools/src/environment/control.rs       |    2 -
 .../documentation/deployment/configuration.md |    2 +-
 docs/documentation/deployment/operations.md   |    2 +-
 docs/documentation/deployment/overview.md     |    2 +-
 docs/documentation/deployment/self-hosting.md |    5 +-
 .../deployment/troubleshooting.md             |   15 +-
 .../deployment/upgrades-and-recovery.md       |   14 +-
 .../environments/bring-your-own-compute.md    |   47 +-
 docs/documentation/environments/incus-vms.md  |  144 +-
 .../environments/networking-and-ingress.md    |   54 +-
 docs/documentation/environments/overview.md   |   64 +-
 .../environments/power-and-cleanup.md         |  291 +-
 .../environments/processes-and-jobs.md        |    5 +-
 .../environments/registered-daemons.md        |  379 +++
 .../environments/using-environments.md        |   59 +-
 .../how-it-works/architecture.md              |   13 +-
 .../images/environment-details.png            |  Bin 56307 -> 65993 bytes
 .../environment-providers.md                  |  330 ++-
 .../reference/environment-protocol.md         |  316 +-
 .../reference/environment-variables.md        |   58 +-
 .../using-lightspeed/bots-and-triggers.md     |    5 +-
 docs/documentation/using-lightspeed/cli.md    |   44 +-
 .../p193-environment-model-simplification.md  |  107 +
 docs/site/astro.config.mjs                    |    1 +
 .../src/routes/environment-deployment.ts      |   50 +-
 .../backend/src/routes/environments.test.ts   |  234 ++
 platform/backend/src/routes/gateway.ts        |  120 +-
 platform/backend/src/routes/method-roles.ts   |    5 +-
 .../configurator-mcp/src/generated/tools.ts   |  220 +-
 .../configurator-mcp/test/generated.test.ts   |    2 +
 platform/configurator-mcp/tool-filter.json    |    4 +-
 .../src/components/bot/environment-card.tsx   |   87 +-
 .../web/src/components/bot/setup-summary.ts   |    4 +-
 platform/web/src/components/bot/setup.tsx     |    7 +-
 platform/web/src/components/bot/triggers.tsx  |    6 +-
 .../environment/idle-policy-dialog.tsx        |   95 -
 .../environment/idle-policy-fields.test.ts    |   21 +
 .../environment/idle-policy-fields.tsx        |   76 +-
 .../components/environment/power-controls.tsx |   89 +-
 .../components/session/session-resources.tsx  |   11 +-
 .../session/session-settings-sheet.tsx        |   12 +-
 platform/web/src/demo/fixtures/builders.ts    |  155 +-
 .../src/demo/fixtures/personal-assistant.ts   |   63 +-
 platform/web/src/demo/fixtures/platform.ts    |    5 +-
 .../web/src/demo/fixtures/software-factory.ts |  101 +-
 .../src/demo/fixtures/technical-support.ts    |   33 +-
 platform/web/src/demo/router.test.ts          |    8 +-
 platform/web/src/demo/routes/admin.ts         |  103 +-
 platform/web/src/demo/routes/environments.ts  |  437 +--
 platform/web/src/demo/routes/sessions.ts      |   10 +-
 platform/web/src/lib/environments.ts          |  121 +
 .../web/src/lib/sessions/editor-options.ts    |   13 +-
 .../web/src/lib/sessions/resource-features.ts |    7 +-
 .../lib/sessions/session-resources.test.ts    |    2 +-
 .../web/src/lib/sessions/session-resources.ts |    7 +-
 .../pages/AdminEnvironmentProvidersPage.tsx   |  238 +-
 .../src/pages/BotsPage.permissions.test.tsx   |    5 +-
 platform/web/src/pages/EnvironmentsPage.tsx   | 1023 ++++---
 release/metadata.env                          |    6 +-
 scripts/dev/env.sh                            |    3 +
 192 files changed, 25830 insertions(+), 16042 deletions(-)
 create mode 100644 crates/environment-client/src/conformance/data_route.rs
 delete mode 100644 crates/environment-protocol/fixtures/controller/target.adopt.json
 create mode 100644 crates/environment-protocol/src/idle.rs
 create mode 100644 crates/environment-provider-incus/src/idle.rs
 delete mode 100644 crates/store-pg/migrations/012_environment_endpoints.sql
 delete mode 100644 crates/temporal-runtime/src/environments/power.rs
 create mode 100644 crates/temporal-runtime/src/environments/signals.rs
 create mode 100644 docs/documentation/environments/registered-daemons.md
 create mode 100644 docs/roadmap/p193-environment-model-simplification.md
 create mode 100644 platform/backend/src/routes/environments.test.ts
 delete mode 100644 platform/web/src/components/environment/idle-policy-dialog.tsx
 create mode 100644 platform/web/src/components/environment/idle-policy-fields.test.ts
 create mode 100644 platform/web/src/lib/environments.ts

diff --git a/clients/typescript/schema/api.schema.json b/clients/typescript/schema/api.schema.json
index f36246cf9..2fa7322b8 100644
--- a/clients/typescript/schema/api.schema.json
+++ b/clients/typescript/schema/api.schema.json
@@ -139,7 +139,7 @@
         },
         {
           "const": "environment_not_ready",
-          "description": "The environment exists but is not reachable yet: it is still\nprovisioning/booting, or it was powered down and a wake (desired\npower `running`) has been initiated by this request. Distinct from\n`Rejected` so clients retry with backoff instead of failing —\npolling and automation callers lean on this for wake-on-use.",
+          "description": "The environment exists but is not reachable yet: it is still\nprovisioning, its provider is waking or booting it after a data\nroute dial, or its registered daemon is reconnecting. Distinct from\n`Rejected` so clients retry with backoff instead of failing —\npolling and automation callers lean on this for wake-on-use.",
           "type": "string"
         },
         {
@@ -1084,23 +1084,6 @@
       ],
       "type": "object"
     },
-    "AgentApiOutcomeOfDeploymentEnvironmentAdoptResponse": {
-      "properties": {
-        "notifications": {
-          "items": {
-            "$ref": "#/definitions/AgentNotification"
-          },
-          "type": "array"
-        },
-        "result": {
-          "$ref": "#/definitions/DeploymentEnvironmentAdoptResponse"
-        }
-      },
-      "required": [
-        "result"
-      ],
-      "type": "object"
-    },
     "AgentApiOutcomeOfDeploymentEnvironmentProviderDeleteResponse": {
       "properties": {
         "notifications": {
@@ -1390,23 +1373,6 @@
       ],
       "type": "object"
     },
-    "AgentApiOutcomeOfEnvironmentIdlePolicyPutResponse": {
-      "properties": {
-        "notifications": {
-          "items": {
-            "$ref": "#/definitions/AgentNotification"
-          },
-          "type": "array"
-        },
-        "result": {
-          "$ref": "#/definitions/EnvironmentIdlePolicyPutResponse"
-        }
-      },
-      "required": [
-        "result"
-      ],
-      "type": "object"
-    },
     "AgentApiOutcomeOfEnvironmentIngressPutResponse": {
       "properties": {
         "notifications": {
@@ -1628,6 +1594,40 @@
       ],
       "type": "object"
     },
+    "AgentApiOutcomeOfEnvironmentRegistrationKeyRotateResponse": {
+      "properties": {
+        "notifications": {
+          "items": {
+            "$ref": "#/definitions/AgentNotification"
+          },
+          "type": "array"
+        },
+        "result": {
+          "$ref": "#/definitions/EnvironmentRegistrationKeyRotateResponse"
+        }
+      },
+      "required": [
+        "result"
+      ],
+      "type": "object"
+    },
+    "AgentApiOutcomeOfEnvironmentRegistrationKeyUpdateResponse": {
+      "properties": {
+        "notifications": {
+          "items": {
+            "$ref": "#/definitions/AgentNotification"
+          },
+          "type": "array"
+        },
+        "result": {
+          "$ref": "#/definitions/EnvironmentRegistrationKeyUpdateResponse"
+        }
+      },
+      "required": [
+        "result"
+      ],
+      "type": "object"
+    },
     "AgentApiOutcomeOfEnvironmentTemplateListResponse": {
       "properties": {
         "notifications": {
@@ -1662,6 +1662,23 @@
       ],
       "type": "object"
     },
+    "AgentApiOutcomeOfEnvironmentUpdateResponse": {
+      "properties": {
+        "notifications": {
+          "items": {
+            "$ref": "#/definitions/AgentNotification"
+          },
+          "type": "array"
+        },
+        "result": {
+          "$ref": "#/definitions/EnvironmentUpdateResponse"
+        }
+      },
+      "required": [
+        "result"
+      ],
+      "type": "object"
+    },
     "AgentApiOutcomeOfInitializeResponse": {
       "properties": {
         "notifications": {
@@ -8710,59 +8727,6 @@
       ],
       "type": "object"
     },
-    "DeploymentEnvironmentAdoptParams": {
-      "properties": {
-        "bindingId": {
-          "type": "string"
-        },
-        "displayName": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "metadata": {
-          "additionalProperties": {
-            "type": "string"
-          },
-          "type": "object"
-        },
-        "requestId": {
-          "description": "Stable caller-generated retry identity inside the destination universe.",
-          "type": "string"
-        },
-        "sourceTarget": {
-          "description": "Provider-native source reference. The Incus provider accepts\n`<project>/<instance>` or an instance name in the `default` project.",
-          "type": "string"
-        },
-        "takeOwnership": {
-          "description": "Required acknowledgement that Lightspeed will move, reconfigure, and\ndelete the target as part of its ordinary managed lifecycle.",
-          "type": "boolean"
-        },
-        "universeId": {
-          "type": "string"
-        }
-      },
-      "required": [
-        "universeId",
-        "requestId",
-        "bindingId",
-        "sourceTarget",
-        "takeOwnership"
-      ],
-      "type": "object"
-    },
-    "DeploymentEnvironmentAdoptResponse": {
-      "properties": {
-        "environment": {
-          "$ref": "#/definitions/EnvironmentView"
-        }
-      },
-      "required": [
-        "environment"
-      ],
-      "type": "object"
-    },
     "DeploymentEnvironmentProviderDeleteParams": {
       "properties": {
         "providerId": {
@@ -8785,24 +8749,6 @@
       ],
       "type": "object"
     },
-    "DeploymentEnvironmentProviderFeaturesView": {
-      "description": "Optional controller methods the provider's controller advertised.",
-      "properties": {
-        "adoptTarget": {
-          "description": "Existing targets can be adopted (`environment/adopt`).",
-          "type": "boolean"
-        },
-        "ingress": {
-          "description": "Public ingress can be enabled on environments.",
-          "type": "boolean"
-        }
-      },
-      "required": [
-        "adoptTarget",
-        "ingress"
-      ],
-      "type": "object"
-    },
     "DeploymentEnvironmentProviderListParams": {
       "type": "object"
     },
@@ -8821,30 +8767,35 @@
       "type": "object"
     },
     "DeploymentEnvironmentProviderPutParams": {
-      "description": "Register or replace a provider. `credential` is the bearer token\nLightspeed presents to the provider's controller and data routes: it is\nsealed on receipt and never returned by any method. `Debug` output\nredacts it; request logging must never echo these params.",
+      "description": "Register or replace a provider. `credential` is the optional bearer\ntoken Lightspeed presents to the provider's controller and data routes:\nit is sealed on receipt and never returned by any method. `Debug` output\nredacts it; request logging must never echo these params.",
       "properties": {
+        "clearCredential": {
+          "description": "Remove the stored credential. Excludes `credential`.",
+          "type": "boolean"
+        },
         "controllerEndpoint": {
           "description": "`ws://`, `wss://` or `unix://` URL of the provider controller.",
           "type": "string"
         },
         "credential": {
-          "description": "Required when the provider is new; omit to keep the stored one.",
+          "description": "A new bearer credential; omit to keep the stored one. A provider needs\nnone. Excludes `clearCredential`.",
           "type": [
             "string",
             "null"
           ]
         },
-        "displayName": {
+        "dataRouteBase": {
+          "description": "`ws://` or `wss://` base of the provider's data routes; omit to derive\nit from the controller endpoint. Required for a `unix://` controller,\nand must not be `ws://` for a `wss://` controller.",
           "type": [
             "string",
             "null"
           ]
         },
-        "metadata": {
-          "additionalProperties": {
-            "type": "string"
-          },
-          "type": "object"
+        "displayName": {
+          "type": [
+            "string",
+            "null"
+          ]
         },
         "providerId": {
           "type": "string"
@@ -8895,23 +8846,12 @@
           "description": "`ws://`, `wss://` or `unix://` URL of the provider controller.",
           "type": "string"
         },
-        "controllerFeatures": {
-          "anyOf": [
-            {
-              "$ref": "#/definitions/DeploymentEnvironmentProviderFeaturesView"
-            },
-            {
-              "type": "null"
-            }
-          ],
-          "description": "What the controller advertised at its last successful handshake;\nabsent until Lightspeed first reached it at this endpoint."
-        },
         "createdAtMs": {
           "format": "int64",
           "type": "integer"
         },
         "dataRouteBase": {
-          "description": "Base URL of the provider's data routes, as its controller advertised\nit; absent until then.",
+          "description": "Operator-configured `ws://` or `wss://` base of the provider's data\nroutes; absent derives it from the controller endpoint.",
           "type": [
             "string",
             "null"
@@ -8923,11 +8863,16 @@
             "null"
           ]
         },
-        "metadata": {
-          "additionalProperties": {
-            "type": "string"
-          },
-          "type": "object"
+        "effectiveDataRouteBase": {
+          "description": "The data route base Lightspeed dials: `dataRouteBase`, or the\ncontroller endpoint's origin followed by `/routes`. Absent only when it\ncannot be derived.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "hasCredential": {
+          "description": "A bearer credential is stored and presented to the controller and\ndata routes; without one no `Authorization` header is sent.",
+          "type": "boolean"
         },
         "providerId": {
           "type": "string"
@@ -8940,6 +8885,7 @@
       "required": [
         "providerId",
         "controllerEndpoint",
+        "hasCredential",
         "createdAtMs",
         "updatedAtMs"
       ],
@@ -8947,7 +8893,7 @@
     },
     "DeploymentProviderBindingDeleteParams": {
       "properties": {
-        "bindingId": {
+        "providerId": {
           "type": "string"
         },
         "universeId": {
@@ -8956,7 +8902,7 @@
       },
       "required": [
         "universeId",
-        "bindingId"
+        "providerId"
       ],
       "type": "object"
     },
@@ -8972,39 +8918,23 @@
       "type": "object"
     },
     "DeploymentProviderBindingPutParams": {
+      "description": "Create or replace a universe's binding to a deployment provider.",
       "properties": {
-        "bindingId": {
-          "type": "string"
-        },
-        "expectedRevision": {
-          "format": "uint64",
-          "minimum": 0,
-          "type": [
-            "integer",
-            "null"
-          ]
-        },
-        "metadata": {
-          "additionalProperties": {
-            "type": "string"
-          },
-          "type": "object"
+        "enabled": {
+          "description": "Admits creates, template listing and data routes for the universe.",
+          "type": "boolean"
         },
         "providerId": {
           "type": "string"
         },
-        "status": {
-          "$ref": "#/definitions/EnvironmentProviderBindingStatusView"
-        },
         "universeId": {
           "type": "string"
         }
       },
       "required": [
         "universeId",
-        "bindingId",
         "providerId",
-        "status"
+        "enabled"
       ],
       "type": "object"
     },
@@ -9291,6 +9221,41 @@
       ],
       "type": "object"
     },
+    "EnvironmentCloseReasonView": {
+      "description": "Why an environment is closing or closed.",
+      "oneOf": [
+        {
+          "const": "requested",
+          "description": "`environments/close`.",
+          "type": "string"
+        },
+        {
+          "const": "keyRevoked",
+          "description": "Its registration key was revoked with `closeEnvironments`.",
+          "type": "string"
+        },
+        {
+          "const": "ephemeralGrace",
+          "description": "Its ephemeral daemon stayed away longer than the key's disconnect\ngrace.",
+          "type": "string"
+        },
+        {
+          "const": "departed",
+          "description": "Its ephemeral daemon said goodbye.",
+          "type": "string"
+        },
+        {
+          "const": "offlineTimeout",
+          "description": "Its persistent daemon stayed away longer than the key's\n`offlineCloseAfterMs`.",
+          "type": "string"
+        },
+        {
+          "const": "providerEnded",
+          "description": "The provider reported the target closed or gone.",
+          "type": "string"
+        }
+      ]
+    },
     "EnvironmentCloseResponse": {
       "properties": {
         "environment": {
@@ -9304,16 +9269,13 @@
     },
     "EnvironmentCreateParams": {
       "properties": {
-        "bindingId": {
-          "type": "string"
-        },
         "displayName": {
           "type": [
             "string",
             "null"
           ]
         },
-        "idlePolicy": {
+        "idle": {
           "anyOf": [
             {
               "$ref": "#/definitions/EnvironmentIdlePolicyView"
@@ -9322,7 +9284,7 @@
               "type": "null"
             }
           ],
-          "description": "Optional staged idle policy applied by the power reaper."
+          "description": "Idle policy passed to the provider in place of the template's `idle`.\nThe provider runs the idle clock; it cannot be changed after create."
         },
         "metadata": {
           "additionalProperties": {
@@ -9330,18 +9292,22 @@
           },
           "type": "object"
         },
+        "providerId": {
+          "description": "The provider to create the environment with; the universe needs an\nenabled binding to it.",
+          "type": "string"
+        },
         "requestId": {
-          "description": "Stable caller-generated retry identity, unique inside the universe.",
+          "description": "Stable caller-generated retry identity, unique inside the universe.\nRetrying with identical inputs returns the same environment.",
           "type": "string"
         },
         "templateId": {
-          "description": "Immutable provider template-version identity.",
+          "description": "The provider template to create the environment from.",
           "type": "string"
         }
       },
       "required": [
         "requestId",
-        "bindingId",
+        "providerId",
         "templateId"
       ],
       "type": "object"
@@ -9548,6 +9514,32 @@
       ],
       "type": "object"
     },
+    "EnvironmentDaemonView": {
+      "description": "The envd build serving an environment, from its registration or\nLightspeed's open handshake.",
+      "properties": {
+        "gitSha": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "protocolVersion": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "version": {
+          "type": [
+            "string",
+            "null"
+          ]
+        }
+      },
+      "required": [
+        "protocolVersion"
+      ],
+      "type": "object"
+    },
     "EnvironmentExternalCreateParams": {
       "properties": {
         "displayName": {
@@ -9567,6 +9559,7 @@
           "type": "object"
         },
         "requestId": {
+          "description": "Stable caller-generated retry identity, unique inside the universe.",
           "type": "string"
         }
       },
@@ -9588,63 +9581,31 @@
       "type": "object"
     },
     "EnvironmentIdentityModeView": {
-      "description": "What Lightspeed does with a registered environment while its daemon is\ndisconnected. Registration-key policy, copied onto each environment.",
+      "description": "What happens to a registered environment while its daemon is\ndisconnected. Policy of the registration key that admitted it.",
       "oneOf": [
         {
           "const": "persistent",
-          "description": "Stays offline until explicitly closed.",
+          "description": "Stays open: tools wait up to two minutes for the daemon to reconnect.\nClosed explicitly, or after the key's `offlineCloseAfterMs`.",
           "type": "string"
         },
         {
           "const": "ephemeral",
-          "description": "Closed once the daemon has been away longer than the key's\ndisconnect grace.",
+          "description": "Unusable while disconnected; closed once the daemon has been away\nlonger than the key's disconnect grace, or at once when it says\ngoodbye.",
           "type": "string"
         }
       ]
     },
-    "EnvironmentIdlePolicyPutParams": {
+    "EnvironmentIdlePolicyView": {
+      "additionalProperties": false,
+      "description": "Staged idle policy the provider applies. Thresholds are milliseconds of\nenvd-reported idle time (running processes, jobs and leftover process\ngroups hold it at zero) and must be non-decreasing in the order pause,\nsuspend, stop, close. Stages whose power state the template does not\nsupport are skipped.",
       "properties": {
-        "environmentId": {
-          "type": "string"
-        },
-        "idlePolicy": {
-          "anyOf": [
-            {
-              "$ref": "#/definitions/EnvironmentIdlePolicyView"
-            },
-            {
-              "type": "null"
-            }
-          ],
-          "description": "The complete new policy; omit to clear it."
-        }
-      },
-      "required": [
-        "environmentId"
-      ],
-      "type": "object"
-    },
-    "EnvironmentIdlePolicyPutResponse": {
-      "properties": {
-        "environment": {
-          "$ref": "#/definitions/EnvironmentView"
-        }
-      },
-      "required": [
-        "environment"
-      ],
-      "type": "object"
-    },
-    "EnvironmentIdlePolicyView": {
-      "description": "Staged idle policy. Thresholds are milliseconds of daemon-reported idle\ntime and must be non-decreasing in the order pause, suspend, stop, close.\nStages whose power state the provider does not support are skipped.",
-      "properties": {
-        "closeAfterMs": {
-          "format": "uint64",
-          "minimum": 0,
-          "type": [
-            "integer",
-            "null"
-          ]
+        "closeAfterMs": {
+          "format": "uint64",
+          "minimum": 0,
+          "type": [
+            "integer",
+            "null"
+          ]
         },
         "pauseAfterMs": {
           "format": "uint64",
@@ -9673,55 +9634,10 @@
       },
       "type": "object"
     },
-    "EnvironmentIncarnationView": {
-      "properties": {
-        "createdAtMs": {
-          "format": "int64",
-          "type": "integer"
-        },
-        "incarnationId": {
-          "type": "string"
-        },
-        "powerStates": {
-          "description": "Power states the provider reported for this target; empty until\nobserved or when the provider offers no power control.",
-          "items": {
-            "$ref": "#/definitions/EnvironmentPowerStateView"
-          },
-          "type": "array"
-        },
-        "providerTargetId": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "provisionRequestId": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "templateId": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "updatedAtMs": {
-          "format": "int64",
-          "type": "integer"
-        }
-      },
-      "required": [
-        "incarnationId",
-        "createdAtMs",
-        "updatedAtMs"
-      ],
-      "type": "object"
-    },
     "EnvironmentIngressPutParams": {
       "properties": {
         "enabled": {
+          "description": "Ensure (`true`) or remove (`false`) the provider's public ingress.",
           "type": "boolean"
         },
         "environmentId": {
@@ -9880,68 +9796,29 @@
       },
       "type": "object"
     },
-    "EnvironmentLifecycleErrorView": {
-      "properties": {
-        "firstAtMs": {
-          "description": "When the current run of errors began.",
-          "format": "int64",
-          "type": "integer"
-        },
-        "lastAtMs": {
-          "description": "When `message` was recorded.",
-          "format": "int64",
-          "type": "integer"
-        },
-        "message": {
-          "type": "string"
-        }
-      },
-      "required": [
-        "message",
-        "firstAtMs",
-        "lastAtMs"
-      ],
-      "type": "object"
-    },
-    "EnvironmentLifecycleStatusView": {
-      "oneOf": [
-        {
-          "enum": [
-            "provisioning",
-            "booting",
-            "ready",
-            "closing",
-            "closed",
-            "failed",
-            "unknown"
-          ],
-          "type": "string"
-        },
-        {
-          "const": "paused",
-          "description": "Execution frozen; wakes on next use.",
-          "type": "string"
-        },
-        {
-          "const": "suspended",
-          "description": "Execution state saved to disk; wakes on next use.",
-          "type": "string"
-        },
-        {
-          "const": "offline",
-          "description": "Powered off; provisioned environments wake on next use when the\nprovider supports power control.",
-          "type": "string"
-        }
-      ]
-    },
     "EnvironmentListParams": {
       "properties": {
-        "bindingId": {
+        "after": {
+          "description": "Exclusive environment id cursor: a previous page's `nextAfter`.",
           "type": [
             "string",
             "null"
           ]
         },
+        "includeClosed": {
+          "description": "Also list closed environments; they are omitted by default.",
+          "type": "boolean"
+        },
+        "limit": {
+          "description": "Most environments per page; omit for 100.",
+          "format": "uint32",
+          "maximum": 500,
+          "minimum": 1,
+          "type": [
+            "integer",
+            "null"
+          ]
+        },
         "metadata": {
           "additionalProperties": {
             "type": "string"
@@ -9950,6 +9827,7 @@
           "type": "object"
         },
         "providerId": {
+          "description": "Only provisioned environments of this provider.",
           "type": [
             "string",
             "null"
@@ -9962,15 +9840,16 @@
             "null"
           ]
         },
-        "status": {
+        "state": {
           "anyOf": [
             {
-              "$ref": "#/definitions/EnvironmentLifecycleStatusView"
+              "$ref": "#/definitions/EnvironmentStateView"
             },
             {
               "type": "null"
             }
-          ]
+          ],
+          "description": "Only environments in this lifecycle state. `closed` lists closed\nenvironments without `includeClosed`."
         }
       },
       "type": "object"
@@ -9979,14 +9858,56 @@
       "properties": {
         "environments": {
           "default": [],
+          "description": "Environments in environment id order.",
           "items": {
             "$ref": "#/definitions/EnvironmentView"
           },
           "type": "array"
+        },
+        "nextAfter": {
+          "description": "Pass as `after` to read the next page; absent on the last page.",
+          "type": [
+            "string",
+            "null"
+          ]
         }
       },
       "type": "object"
     },
+    "EnvironmentObservedTargetView": {
+      "description": "What the provider last reported about a provisioned environment's\ntarget. Display only: Lightspeed never converges it, and it may be up to\na few minutes old.",
+      "properties": {
+        "message": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "observedAtMs": {
+          "format": "int64",
+          "type": "integer"
+        },
+        "phase": {
+          "$ref": "#/definitions/EnvironmentTargetPhaseView"
+        },
+        "power": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/EnvironmentPowerStateView"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Present only while `phase` is `active`."
+        }
+      },
+      "required": [
+        "phase",
+        "observedAtMs"
+      ],
+      "type": "object"
+    },
     "EnvironmentPowerPutParams": {
       "properties": {
         "environmentId": {
@@ -9998,7 +9919,7 @@
               "$ref": "#/definitions/EnvironmentPowerStateView"
             }
           ],
-          "description": "Desired steady power state. Must be one of the provider-reported\n`incarnation.powerStates`."
+          "description": "Power state to move the target to; one of its template's\n`powerStates`."
         }
       },
       "required": [
@@ -10019,7 +9940,7 @@
       "type": "object"
     },
     "EnvironmentPowerStateView": {
-      "description": "Steady power state of a provisioned environment.",
+      "description": "Power state of a provisioned environment's target.",
       "oneOf": [
         {
           "enum": [
@@ -10081,12 +10002,12 @@
     },
     "EnvironmentProviderBindingReadParams": {
       "properties": {
-        "bindingId": {
+        "providerId": {
           "type": "string"
         }
       },
       "required": [
-        "bindingId"
+        "providerId"
       ],
       "type": "object"
     },
@@ -10101,49 +10022,27 @@
       ],
       "type": "object"
     },
-    "EnvironmentProviderBindingStatusView": {
-      "enum": [
-        "enabled",
-        "disabled"
-      ],
-      "type": "string"
-    },
     "EnvironmentProviderBindingView": {
+      "description": "A universe's binding to a deployment provider. Creates, templates and\ndata routes of the provider need it enabled.",
       "properties": {
-        "bindingId": {
-          "type": "string"
-        },
         "createdAtMs": {
           "format": "int64",
           "type": "integer"
         },
-        "metadata": {
-          "additionalProperties": {
-            "type": "string"
-          },
-          "type": "object"
+        "enabled": {
+          "type": "boolean"
         },
         "providerId": {
           "type": "string"
         },
-        "revision": {
-          "format": "uint64",
-          "minimum": 0,
-          "type": "integer"
-        },
-        "status": {
-          "$ref": "#/definitions/EnvironmentProviderBindingStatusView"
-        },
         "updatedAtMs": {
           "format": "int64",
           "type": "integer"
         }
       },
       "required": [
-        "bindingId",
         "providerId",
-        "status",
-        "revision",
+        "enabled",
         "createdAtMs",
         "updatedAtMs"
       ],
@@ -10194,7 +10093,12 @@
           ]
         },
         "identityMode": {
-          "$ref": "#/definitions/EnvironmentIdentityModeView"
+          "allOf": [
+            {
+              "$ref": "#/definitions/EnvironmentIdentityModeView"
+            }
+          ],
+          "description": "Immutable once the key exists."
         },
         "maxActiveEnvironments": {
           "description": "Non-closed environments the key may have at once; omit for unlimited.",
@@ -10204,6 +10108,15 @@
             "integer",
             "null"
           ]
+        },
+        "offlineCloseAfterMs": {
+          "description": "Persistent keys only: close environments whose daemon has been away\nlonger than this; omit to keep them open.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": [
+            "integer",
+            "null"
+          ]
         }
       },
       "required": [
@@ -10303,6 +10216,37 @@
       ],
       "type": "object"
     },
+    "EnvironmentRegistrationKeyRotateParams": {
+      "properties": {
+        "registrationKeyId": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "registrationKeyId"
+      ],
+      "type": "object"
+    },
+    "EnvironmentRegistrationKeyRotateResponse": {
+      "properties": {
+        "registrationKey": {
+          "$ref": "#/definitions/EnvironmentRegistrationKeyView"
+        },
+        "secret": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/EnvironmentRegistrationSecretView"
+            }
+          ],
+          "description": "The new plaintext secret, returned only here."
+        }
+      },
+      "required": [
+        "registrationKey",
+        "secret"
+      ],
+      "type": "object"
+    },
     "EnvironmentRegistrationKeyStatusView": {
       "enum": [
         "active",
@@ -10311,6 +10255,68 @@
       ],
       "type": "string"
     },
+    "EnvironmentRegistrationKeyUpdateParams": {
+      "description": "The complete editable policy of a registration key; an absent field is\nunset. The identity mode is immutable.",
+      "properties": {
+        "displayName": {
+          "description": "Group name for the environments this key admits.",
+          "type": "string"
+        },
+        "ephemeralDisconnectGraceMs": {
+          "description": "Disconnect grace for ephemeral environments; omit for the default.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": [
+            "integer",
+            "null"
+          ]
+        },
+        "expiresAtMs": {
+          "format": "int64",
+          "type": [
+            "integer",
+            "null"
+          ]
+        },
+        "maxActiveEnvironments": {
+          "description": "Non-closed environments the key may have at once; omit for unlimited.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": [
+            "integer",
+            "null"
+          ]
+        },
+        "offlineCloseAfterMs": {
+          "description": "Persistent keys only: close environments whose daemon has been away\nlonger than this; omit to keep them open.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": [
+            "integer",
+            "null"
+          ]
+        },
+        "registrationKeyId": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "registrationKeyId",
+        "displayName"
+      ],
+      "type": "object"
+    },
+    "EnvironmentRegistrationKeyUpdateResponse": {
+      "properties": {
+        "registrationKey": {
+          "$ref": "#/definitions/EnvironmentRegistrationKeyView"
+        }
+      },
+      "required": [
+        "registrationKey"
+      ],
+      "type": "object"
+    },
     "EnvironmentRegistrationKeyView": {
       "properties": {
         "activeEnvironmentCount": {
@@ -10344,7 +10350,7 @@
           "$ref": "#/definitions/EnvironmentIdentityModeView"
         },
         "keyPrefix": {
-          "description": "First characters of the secret, for identification only.",
+          "description": "First characters of the key's live secret, for identification only.",
           "type": "string"
         },
         "lastRegisteredAtMs": {
@@ -10362,6 +10368,15 @@
             "null"
           ]
         },
+        "offlineCloseAfterMs": {
+          "description": "Persistent keys only: environments whose daemon has been away longer\nthan this are closed; absent keeps them open.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": [
+            "integer",
+            "null"
+          ]
+        },
         "registeredEnvironmentCount": {
           "description": "Environments ever admitted by this key, closed included.",
           "format": "uint64",
@@ -10380,6 +10395,10 @@
         },
         "status": {
           "$ref": "#/definitions/EnvironmentRegistrationKeyStatusView"
+        },
+        "updatedAtMs": {
+          "format": "int64",
+          "type": "integer"
         }
       },
       "required": [
@@ -10391,7 +10410,8 @@
         "status",
         "registeredEnvironmentCount",
         "activeEnvironmentCount",
-        "createdAtMs"
+        "createdAtMs",
+        "updatedAtMs"
       ],
       "type": "object"
     },
@@ -10420,13 +10440,50 @@
     "EnvironmentSourceView": {
       "oneOf": [
         {
+          "description": "A target a deployment provider created from a template. The provider\nowns its power, idle policy and ingress.",
           "properties": {
-            "bindingId": {
-              "type": "string"
+            "idle": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/EnvironmentIdlePolicyView"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "description": "The create-time idle policy, when one replaced the template's."
+            },
+            "observed": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/EnvironmentObservedTargetView"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "description": "Absent until the provider first reported the target."
             },
             "providerId": {
               "type": "string"
             },
+            "publicEndpoint": {
+              "description": "The public endpoint the provider last reported.",
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "targetId": {
+              "description": "The provider's handle for the target; absent until the provider\naccepted the create.",
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "templateId": {
+              "type": "string"
+            },
             "type": {
               "const": "provisioned",
               "type": "string"
@@ -10435,7 +10492,7 @@
           "required": [
             "type",
             "providerId",
-            "bindingId"
+            "templateId"
           ],
           "type": "object"
         },
@@ -10459,11 +10516,30 @@
         {
           "description": "An envd that dialed the gateway outbound and was admitted by a\nregistration key. The key is the environment's group; the daemon id\nis derived from the daemon's public key and is its identity.",
           "properties": {
+            "connected": {
+              "description": "The daemon's control connection is up.",
+              "type": "boolean"
+            },
+            "connectionChangedAtMs": {
+              "description": "When the daemon last connected or disconnected.",
+              "format": "int64",
+              "type": "integer"
+            },
             "daemonId": {
               "type": "string"
             },
             "identityMode": {
-              "$ref": "#/definitions/EnvironmentIdentityModeView"
+              "allOf": [
+                {
+                  "$ref": "#/definitions/EnvironmentIdentityModeView"
+                }
+              ],
+              "description": "The admitting key's identity mode."
+            },
+            "lastSeenAtMs": {
+              "description": "When the gateway last recorded the daemon's control connection:\nat connect, at disconnect, and at most every five minutes while\nconnected.",
+              "format": "int64",
+              "type": "integer"
             },
             "registrationKeyId": {
               "type": "string"
@@ -10477,15 +10553,98 @@
             "type",
             "registrationKeyId",
             "daemonId",
-            "identityMode"
+            "identityMode",
+            "connected",
+            "connectionChangedAtMs",
+            "lastSeenAtMs"
           ],
           "type": "object"
         }
       ]
     },
+    "EnvironmentStateView": {
+      "description": "The lifecycle Lightspeed owns. External and registered environments are\nonly ever `open` or `closed`.",
+      "oneOf": [
+        {
+          "enum": [
+            "open",
+            "closed"
+          ],
+          "type": "string"
+        },
+        {
+          "const": "provisioning",
+          "description": "The provider is creating the target; the environment opens after\nLightspeed's first handshake with its envd.",
+          "type": "string"
+        },
+        {
+          "const": "closing",
+          "description": "The provider is removing the target.",
+          "type": "string"
+        },
+        {
+          "const": "failed",
+          "description": "Provisioning or the provider failed; `stateMessage` says why.",
+          "type": "string"
+        }
+      ]
+    },
+    "EnvironmentStatusView": {
+      "description": "Display status derived from `state` and the latest observation; never\nstored. Tools that use a paused, suspended or stopped environment wake\nit.",
+      "oneOf": [
+        {
+          "enum": [
+            "provisioning",
+            "ready",
+            "closing",
+            "closed",
+            "failed"
+          ],
+          "type": "string"
+        },
+        {
+          "const": "paused",
+          "description": "Execution frozen with RAM resident.",
+          "type": "string"
+        },
+        {
+          "const": "suspended",
+          "description": "Execution state saved to disk.",
+          "type": "string"
+        },
+        {
+          "const": "stopped",
+          "description": "Powered off with disk retained.",
+          "type": "string"
+        },
+        {
+          "const": "unknown",
+          "description": "Open, but the provider's latest observation is inconclusive.",
+          "type": "string"
+        },
+        {
+          "const": "away",
+          "description": "Registered, open, and its daemon is not connected.",
+          "type": "string"
+        }
+      ]
+    },
+    "EnvironmentTargetPhaseView": {
+      "description": "Lifecycle phase of a provider target, as the provider reports it.",
+      "enum": [
+        "provisioning",
+        "active",
+        "closing",
+        "closed",
+        "failed",
+        "unknown"
+      ],
+      "type": "string"
+    },
     "EnvironmentTemplateListParams": {
       "properties": {
-        "bindingId": {
+        "providerId": {
+          "description": "Only this provider's templates; omit for every enabled binding.",
           "type": [
             "string",
             "null"
@@ -10510,7 +10669,7 @@
     },
     "EnvironmentTemplateReadParams": {
       "properties": {
-        "bindingId": {
+        "providerId": {
           "type": "string"
         },
         "templateId": {
@@ -10518,7 +10677,7 @@
         }
       },
       "required": [
-        "bindingId",
+        "providerId",
         "templateId"
       ],
       "type": "object"
@@ -10566,9 +10725,6 @@
     },
     "EnvironmentTemplateView": {
       "properties": {
-        "bindingId": {
-          "type": "string"
-        },
         "deprecated": {
           "type": "boolean"
         },
@@ -10581,16 +10737,35 @@
         "displayName": {
           "type": "string"
         },
+        "idle": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/EnvironmentIdlePolicyView"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Idle policy targets get when `environments/create` names none."
+        },
         "metadata": {
           "additionalProperties": {
             "type": "string"
           },
           "type": "object"
         },
+        "powerStates": {
+          "description": "Power states `environments/power/put` can move targets of this\ntemplate to; empty without power control.",
+          "items": {
+            "$ref": "#/definitions/EnvironmentPowerStateView"
+          },
+          "type": "array"
+        },
         "providerId": {
           "type": "string"
         },
         "publicIngress": {
+          "description": "`environments/ingress/put` can enable public ingress on targets of\nthis template.",
           "type": "boolean"
         },
         "resources": {
@@ -10611,28 +10786,18 @@
       "required": [
         "templateId",
         "providerId",
-        "bindingId",
         "displayName",
         "publicIngress",
-        "deprecated"
+        "deprecated",
+        "powerStates"
       ],
       "type": "object"
     },
-    "EnvironmentView": {
+    "EnvironmentUpdateParams": {
+      "description": "Replace an environment's display name and caller metadata.",
       "properties": {
-        "createdAtMs": {
-          "format": "int64",
-          "type": "integer"
-        },
-        "desiredPower": {
-          "allOf": [
-            {
-              "$ref": "#/definitions/EnvironmentPowerStateView"
-            }
-          ],
-          "description": "Lightspeed-owned power intent; `status` is the observed state."
-        },
         "displayName": {
+          "description": "The new display name; omit to clear it.",
           "type": [
             "string",
             "null"
@@ -10641,63 +10806,108 @@
         "environmentId": {
           "type": "string"
         },
-        "idlePolicy": {
+        "metadata": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "The complete new caller metadata; omit or `{}` to clear it.",
+          "type": "object"
+        }
+      },
+      "required": [
+        "environmentId"
+      ],
+      "type": "object"
+    },
+    "EnvironmentUpdateResponse": {
+      "properties": {
+        "environment": {
+          "$ref": "#/definitions/EnvironmentView"
+        }
+      },
+      "required": [
+        "environment"
+      ],
+      "type": "object"
+    },
+    "EnvironmentView": {
+      "properties": {
+        "closeReason": {
           "anyOf": [
             {
-              "$ref": "#/definitions/EnvironmentIdlePolicyView"
+              "$ref": "#/definitions/EnvironmentCloseReasonView"
             },
             {
               "type": "null"
             }
-          ]
-        },
-        "incarnation": {
-          "$ref": "#/definitions/EnvironmentIncarnationView"
+          ],
+          "description": "Present exactly while `state` is `closing` or `closed`."
         },
-        "lastSeenAtMs": {
-          "description": "Registered environments only: when the gateway last saw the daemon's\ncontrol connection.",
+        "closedAtMs": {
           "format": "int64",
           "type": [
             "integer",
             "null"
           ]
         },
-        "lifecycleError": {
+        "createdAtMs": {
+          "format": "int64",
+          "type": "integer"
+        },
+        "daemon": {
           "anyOf": [
             {
-              "$ref": "#/definitions/EnvironmentLifecycleErrorView"
+              "$ref": "#/definitions/EnvironmentDaemonView"
             },
             {
               "type": "null"
             }
           ],
-          "description": "Why the environment failed, or the latest error (or what the\nprovider reports it is waiting on) while its lifecycle converges;\nabsent once it reaches a steady state."
+          "description": "The envd build serving the environment; absent until known."
+        },
+        "displayName": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "environmentId": {
+          "type": "string"
         },
         "metadata": {
           "additionalProperties": {
             "type": "string"
           },
+          "description": "Caller metadata.",
           "type": "object"
         },
-        "publicEndpoint": {
-          "description": "The public endpoint the provider last reported. It lags\n`publicIngressEnabled` while the lifecycle reconciler converges.",
+        "requestId": {
+          "description": "The caller's retry identity; absent for registered environments.",
           "type": [
             "string",
             "null"
           ]
         },
-        "publicIngressEnabled": {
-          "description": "Lightspeed-owned public ingress intent; `publicEndpoint` is what the\nprovider realized.",
-          "type": "boolean"
-        },
-        "requestId": {
-          "type": "string"
-        },
         "source": {
           "$ref": "#/definitions/EnvironmentSourceView"
         },
+        "state": {
+          "$ref": "#/definitions/EnvironmentStateView"
+        },
+        "stateChangedAtMs": {
+          "description": "When `state` last changed.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "stateMessage": {
+          "description": "Why the environment failed, or what provisioning or closing is\nwaiting on.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
         "status": {
-          "$ref": "#/definitions/EnvironmentLifecycleStatusView"
+          "$ref": "#/definitions/EnvironmentStatusView"
         },
         "updatedAtMs": {
           "format": "int64",
@@ -10706,12 +10916,10 @@
       },
       "required": [
         "environmentId",
-        "requestId",
         "source",
+        "state",
         "status",
-        "desiredPower",
-        "incarnation",
-        "publicIngressEnabled",
+        "stateChangedAtMs",
         "createdAtMs",
         "updatedAtMs"
       ],
@@ -12282,7 +12490,7 @@
         },
         {
           "const": "deployment/environment-providers",
-          "description": "Environment providers, their bindings and adoption.",
+          "description": "Environment providers and their universe bindings.",
           "type": "string"
         },
         {
diff --git a/clients/typescript/src/generated/methods.ts b/clients/typescript/src/generated/methods.ts
index fe535acfe..daf8840cc 100644
--- a/clients/typescript/src/generated/methods.ts
+++ b/clients/typescript/src/generated/methods.ts
@@ -38,12 +38,12 @@ export const METHODS = [
   "environments/credentials/unbind",
   "environments/create",
   "environments/read",
+  "environments/update",
   "environments/list",
   "environments/close",
   "environments/external/create",
   "environments/ingress/put",
   "environments/power/put",
-  "environments/idle-policy/put",
   "environments/provider-bindings/list",
   "environments/provider-bindings/read",
   "environments/templates/list",
@@ -54,6 +54,8 @@ export const METHODS = [
   "environments/registration-keys/create",
   "environments/registration-keys/read",
   "environments/registration-keys/list",
+  "environments/registration-keys/update",
+  "environments/registration-keys/rotate",
   "environments/registration-keys/revoke",
   "transcriptions/start",
   "transcriptions/read",
@@ -143,7 +145,6 @@ export const METHODS = [
   "deployment/environment-providers/delete",
   "deployment/environment-providers/bindings/put",
   "deployment/environment-providers/bindings/delete",
-  "deployment/environments/adopt",
   "deployment/channels/accounts/list",
 ] as const;
 
@@ -338,79 +339,79 @@ export const METHOD_INFO = {
     scope: "universe",
     access: {"action":"configure_resource","kind":"universe"},
     summary: "Create an environment",
-    description: "Records an idempotent provisioning intent against an enabled universe binding, attributed to the caller. The provider validates its provider-wide template and provisions through its backend asynchronously.",
+    description: "Creates a provisioned environment, attributed to the caller, from a template of a provider enabled for the universe. Idempotent per requestId: same inputs, same environment; others conflict. Provisioning until the target's first envd handshake, then open; idle overrides the template default.",
   },
   "environments/read": {
     scope: "universe",
     access: {"action":"read","kind":"universe"},
     summary: "Read an environment",
-    description: "Returns the durable universe resource, source binding, logical lifecycle state, and minimal current-incarnation identity.",
+    description: "Returns one environment: its source, lifecycle state, derived display status, state message, close reason, daemon build, and the latest provider observation.",
+  },
+  "environments/update": {
+    scope: "universe",
+    access: {"action":"configure_resource","kind":"universe"},
+    summary: "Update an environment",
+    description: "Replaces the display name and caller metadata of an environment of any kind. Refused for a closed environment.",
   },
   "environments/list": {
     scope: "universe",
     access: {"action":"read","kind":"universe"},
     summary: "List environments",
-    description: "Lists the universe environments, optionally filtered by provider, binding, or logical lifecycle state.",
+    description: "Lists the universe environments in id order, one page at a time, optionally filtered by provider, registration key, state, or metadata. Closed environments are omitted unless includeClosed is set or state is closed. Continue from nextAfter.",
   },
   "environments/close": {
     scope: "universe",
     access: {"action":"configure_resource","kind":"universe"},
     summary: "Close an environment",
-    description: "Records an asynchronous idempotent close intent. Provider cleanup is resumed by lifecycle reconciliation; quota is released only after Closed.",
+    description: "Closes an environment; idempotent. A provisioned environment moves to closing while Lightspeed asks its provider to remove the target, retrying until it is gone, then closed. External and registered environments close at once, and a connected registered daemon is told its environment closed.",
   },
   "environments/external/create": {
     scope: "universe",
     access: {"action":"configure_resource","kind":"universe"},
     summary: "Register an external environment",
-    description: "Creates an environment backed by a Lightspeed-reachable envd WebSocket endpoint, attributed to the caller. Reachability is checked on demand.",
+    description: "Creates an open environment backed by a Lightspeed-reachable envd endpoint, attributed to the caller. Idempotent per requestId. Reachability is checked on use.",
   },
   "environments/ingress/put": {
     scope: "universe",
     access: {"action":"configure_resource","kind":"universe"},
     summary: "Configure environment public ingress",
-    description: "Records the public ingress intent of a provisioned environment; the lifecycle reconciler converges it while the environment is ready, and `publicEndpoint` shows the realized endpoint. Rejected when the provider does not offer ingress. The provider owns hostname, guest port, routing, TLS, and health; an intent its template refuses is dropped.",
+    description: "Synchronously ensures or removes public ingress of an open provisioned environment through its provider; source.publicEndpoint carries the reported endpoint. Rejected when the provider offers no ingress; an internal error, safe to retry, when the provider is unreachable or times out. The provider owns hostname, guest port, routing, TLS, and health.",
   },
   "environments/power/put": {
     scope: "universe",
     access: {"action":"configure_resource","kind":"universe"},
-    summary: "Set environment power intent",
-    description: "Records the desired power state (running, paused, suspended, or stopped) of a provisioned environment; the lifecycle reconciler converges the provider target asynchronously. Powered-down environments wake transparently on their next use. Rejected when the provider does not support the state.",
-  },
-  "environments/idle-policy/put": {
-    scope: "universe",
-    access: {"action":"configure_resource","kind":"universe"},
-    summary: "Set environment idle policy",
-    description: "Replaces or clears the staged idle policy of a provisioned environment. The power reaper measures the daemon's idle duration against the pause/suspend/stop/close thresholds and escalates through the stages the provider supports.",
+    summary: "Set environment power",
+    description: "Synchronously moves an open provisioned environment's target to running, paused, suspended, or stopped via its provider and records the observation; the provider may also change power on idle. Rejected without provider power control or when the template lacks the state; an internal error, safe to retry, when the provider is unreachable or times out.",
   },
   "environments/provider-bindings/list": {
     scope: "universe",
     access: {"action":"read","kind":"universe"},
     summary: "List environment provider bindings",
-    description: "Lists this universe's revisioned routing and admission bindings to deployment-scoped physical providers.",
+    description: "Lists this universe's bindings to deployment providers and whether each is enabled.",
   },
   "environments/provider-bindings/read": {
     scope: "universe",
     access: {"action":"read","kind":"universe"},
     summary: "Read an environment provider binding",
-    description: "Returns one universe routing and admission binding. Provider-wide templates and physical resource, network, and ingress policy remain provider-owned.",
+    description: "Returns this universe's binding to one provider. Templates and physical resource, network, and ingress policy remain provider-owned.",
   },
   "environments/templates/list": {
     scope: "universe",
     access: {"action":"read","kind":"universe"},
     summary: "List environment templates",
-    description: "Reads immutable templates directly from the selected bound provider controller.",
+    description: "Reads templates live from the controllers of the universe's enabled provider bindings, or of one provider: compute, power states, public ingress, and default idle policy.",
   },
   "environments/templates/read": {
     scope: "universe",
     access: {"action":"read","kind":"universe"},
     summary: "Read an environment template",
-    description: "Returns one immutable template version from the selected bound provider controller.",
+    description: "Returns one template, read live from a bound provider's controller.",
   },
   "environments/jobs/create": {
     scope: "universe",
     access: {"action":"use_resource","kind":"universe"},
     summary: "Create environment jobs",
-    description: "Starts a dependency-aware job group on one environment instance, injecting the environment's configured credentials at provider start. requestId is the retry identity; jobs are owned by the instance rather than a session. A powered-down environment is woken on use: the call fails with environment_not_ready while the wake is in progress; retry with backoff.",
+    description: "Starts a dependency-aware job group on one environment instance, injecting its configured credentials at provider start. requestId is the retry identity; jobs are owned by the instance, not a session. A powered-down environment wakes on its data route; the call fails with environment_not_ready while it wakes or reconnects; retry with backoff.",
   },
   "environments/jobs/read": {
     scope: "universe",
@@ -428,7 +429,7 @@ export const METHOD_INFO = {
     scope: "universe",
     access: {"action":"configure_resource","kind":"universe"},
     summary: "Mint an environment registration key",
-    description: "Creates a reusable universe-scoped key that lets outbound envd daemons register as environments. The plaintext secret is returned exactly once; only its hash is stored. Identity mode, active limit, disconnect grace, and expiry are the key's policy. Treat the secret like a cluster-join credential.",
+    description: "Creates a reusable universe-scoped key that lets outbound envd daemons register as environments. The plaintext secret is returned exactly once; only its hash is stored. Identity mode (immutable), active limit, disconnect grace, offline close-after, and expiry are the key's policy. Treat the secret like a cluster-join credential.",
   },
   "environments/registration-keys/read": {
     scope: "universe",
@@ -442,6 +443,18 @@ export const METHOD_INFO = {
     summary: "List environment registration keys",
     description: "Lists this universe's registration keys with policy, status, and derived counts. Each key is the group of the environments it admitted.",
   },
+  "environments/registration-keys/update": {
+    scope: "universe",
+    access: {"action":"configure_resource","kind":"universe"},
+    summary: "Update an environment registration key",
+    description: "Replaces a key's editable policy: display name, active limit, disconnect grace, offline close-after, and expiry; an omitted field is unset. The identity mode is immutable. The active limit and expiry apply to later admissions; a changed disconnect grace or offline close-after applies at the next sweep to environments whose daemon is away.",
+  },
+  "environments/registration-keys/rotate": {
+    scope: "universe",
+    access: {"action":"configure_resource","kind":"universe"},
+    summary: "Rotate an environment registration key",
+    description: "Replaces the key's secret and display prefix and retires the old secret at once. The key keeps its id, group, policy, and the environments it admitted; daemons already registered are unaffected because they never present the key again. Returns the new secret once. Refused for a revoked key.",
+  },
   "environments/registration-keys/revoke": {
     scope: "universe",
     access: {"action":"configure_resource","kind":"universe"},
@@ -944,43 +957,37 @@ export const METHOD_INFO = {
     scope: "deployment",
     access: {"kind":"deployment"},
     summary: "Put an environment provider",
-    description: "Registers or replaces one deployment provider: its controller endpoint URL and the bearer credential Lightspeed presents to the controller and data routes. The credential is write-only: required for a new provider, kept when omitted, never returned. The provider does not call this API or require access to Lightspeed.",
+    description: "Registers or replaces a deployment provider: controller endpoint, optional data route base, and optional bearer credential for controller and data routes (write-only: kept when omitted, removed by clearCredential, never returned). The controller is probed: a definitive refusal is invalid_request, unreachable is accepted. The provider never calls Lightspeed.",
   },
   "deployment/environment-providers/list": {
     scope: "deployment",
     access: {"kind":"deployment"},
     summary: "List environment providers",
-    description: "Returns every deployment-registered provider with its controller endpoint and the optional features its controller last advertised.",
+    description: "Returns every deployment-registered provider with its controller endpoint, data route base, and whether a credential is stored.",
   },
   "deployment/environment-providers/read": {
     scope: "deployment",
     access: {"kind":"deployment"},
     summary: "Read an environment provider",
-    description: "Returns one deployment-registered provider with its controller endpoint and the optional features its controller last advertised.",
+    description: "Returns one deployment-registered provider with its controller endpoint, data route base, and whether a credential is stored.",
   },
   "deployment/environment-providers/delete": {
     scope: "deployment",
     access: {"kind":"deployment"},
     summary: "Delete an environment provider",
-    description: "Deletes a deployment provider only when no universe binding references it.",
+    description: "Deletes a deployment provider only when no universe binding and no non-closed environment references it.",
   },
   "deployment/environment-providers/bindings/put": {
     scope: "deployment",
     access: {"kind":"deployment"},
     summary: "Put an environment provider binding",
-    description: "Creates or replaces one universe's complete revisioned routing and admission binding. A deployment provider may have at most one binding in a universe.",
+    description: "Creates or replaces one universe's binding to a deployment provider. Only an enabled binding admits creates, template listing, and data routes for the universe.",
   },
   "deployment/environment-providers/bindings/delete": {
     scope: "deployment",
     access: {"kind":"deployment"},
     summary: "Delete an environment provider binding",
-    description: "Deletes a universe provider binding only after every referencing environment has reached Closed.",
-  },
-  "deployment/environments/adopt": {
-    scope: "deployment",
-    access: {"kind":"deployment"},
-    summary: "Adopt a provider environment",
-    description: "Creates a universe environment by transferring an existing provider target into Lightspeed's managed lifecycle. The caller must explicitly accept ownership transfer.",
+    description: "Deletes a universe's binding to a provider only when the universe has no non-closed environment of that provider.",
   },
   "deployment/channels/accounts/list": {
     scope: "deployment",
@@ -1285,7 +1292,7 @@ export interface MethodMap {
   /**
    * Create an environment
    *
-   * Records an idempotent provisioning intent against an enabled universe binding, attributed to the caller. The provider validates its provider-wide template and provisions through its backend asynchronously.
+   * Creates a provisioned environment, attributed to the caller, from a template of a provider enabled for the universe. Idempotent per requestId: same inputs, same environment; others conflict. Provisioning until the target's first envd handshake, then open; idle overrides the template default.
    */
   "environments/create": {
     params: Api.EnvironmentCreateParams;
@@ -1294,16 +1301,25 @@ export interface MethodMap {
   /**
    * Read an environment
    *
-   * Returns the durable universe resource, source binding, logical lifecycle state, and minimal current-incarnation identity.
+   * Returns one environment: its source, lifecycle state, derived display status, state message, close reason, daemon build, and the latest provider observation.
    */
   "environments/read": {
     params: Api.EnvironmentReadParams;
     result: Api.AgentApiOutcomeOfEnvironmentReadResponse;
   };
+  /**
+   * Update an environment
+   *
+   * Replaces the display name and caller metadata of an environment of any kind. Refused for a closed environment.
+   */
+  "environments/update": {
+    params: Api.EnvironmentUpdateParams;
+    result: Api.AgentApiOutcomeOfEnvironmentUpdateResponse;
+  };
   /**
    * List environments
    *
-   * Lists the universe environments, optionally filtered by provider, binding, or logical lifecycle state.
+   * Lists the universe environments in id order, one page at a time, optionally filtered by provider, registration key, state, or metadata. Closed environments are omitted unless includeClosed is set or state is closed. Continue from nextAfter.
    */
   "environments/list": {
     params: Api.EnvironmentListParams;
@@ -1312,7 +1328,7 @@ export interface MethodMap {
   /**
    * Close an environment
    *
-   * Records an asynchronous idempotent close intent. Provider cleanup is resumed by lifecycle reconciliation; quota is released only after Closed.
+   * Closes an environment; idempotent. A provisioned environment moves to closing while Lightspeed asks its provider to remove the target, retrying until it is gone, then closed. External and registered environments close at once, and a connected registered daemon is told its environment closed.
    */
   "environments/close": {
     params: Api.EnvironmentCloseParams;
@@ -1321,7 +1337,7 @@ export interface MethodMap {
   /**
    * Register an external environment
    *
-   * Creates an environment backed by a Lightspeed-reachable envd WebSocket endpoint, attributed to the caller. Reachability is checked on demand.
+   * Creates an open environment backed by a Lightspeed-reachable envd endpoint, attributed to the caller. Idempotent per requestId. Reachability is checked on use.
    */
   "environments/external/create": {
     params: Api.EnvironmentExternalCreateParams;
@@ -1330,34 +1346,25 @@ export interface MethodMap {
   /**
    * Configure environment public ingress
    *
-   * Records the public ingress intent of a provisioned environment; the lifecycle reconciler converges it while the environment is ready, and `publicEndpoint` shows the realized endpoint. Rejected when the provider does not offer ingress. The provider owns hostname, guest port, routing, TLS, and health; an intent its template refuses is dropped.
+   * Synchronously ensures or removes public ingress of an open provisioned environment through its provider; source.publicEndpoint carries the reported endpoint. Rejected when the provider offers no ingress; an internal error, safe to retry, when the provider is unreachable or times out. The provider owns hostname, guest port, routing, TLS, and health.
    */
   "environments/ingress/put": {
     params: Api.EnvironmentIngressPutParams;
     result: Api.AgentApiOutcomeOfEnvironmentIngressPutResponse;
   };
   /**
-   * Set environment power intent
+   * Set environment power
    *
-   * Records the desired power state (running, paused, suspended, or stopped) of a provisioned environment; the lifecycle reconciler converges the provider target asynchronously. Powered-down environments wake transparently on their next use. Rejected when the provider does not support the state.
+   * Synchronously moves an open provisioned environment's target to running, paused, suspended, or stopped via its provider and records the observation; the provider may also change power on idle. Rejected without provider power control or when the template lacks the state; an internal error, safe to retry, when the provider is unreachable or times out.
    */
   "environments/power/put": {
     params: Api.EnvironmentPowerPutParams;
     result: Api.AgentApiOutcomeOfEnvironmentPowerPutResponse;
   };
-  /**
-   * Set environment idle policy
-   *
-   * Replaces or clears the staged idle policy of a provisioned environment. The power reaper measures the daemon's idle duration against the pause/suspend/stop/close thresholds and escalates through the stages the provider supports.
-   */
-  "environments/idle-policy/put": {
-    params: Api.EnvironmentIdlePolicyPutParams;
-    result: Api.AgentApiOutcomeOfEnvironmentIdlePolicyPutResponse;
-  };
   /**
    * List environment provider bindings
    *
-   * Lists this universe's revisioned routing and admission bindings to deployment-scoped physical providers.
+   * Lists this universe's bindings to deployment providers and whether each is enabled.
    */
   "environments/provider-bindings/list": {
     params: Api.EnvironmentProviderBindingListParams;
@@ -1366,7 +1373,7 @@ export interface MethodMap {
   /**
    * Read an environment provider binding
    *
-   * Returns one universe routing and admission binding. Provider-wide templates and physical resource, network, and ingress policy remain provider-owned.
+   * Returns this universe's binding to one provider. Templates and physical resource, network, and ingress policy remain provider-owned.
    */
   "environments/provider-bindings/read": {
     params: Api.EnvironmentProviderBindingReadParams;
@@ -1375,7 +1382,7 @@ export interface MethodMap {
   /**
    * List environment templates
    *
-   * Reads immutable templates directly from the selected bound provider controller.
+   * Reads templates live from the controllers of the universe's enabled provider bindings, or of one provider: compute, power states, public ingress, and default idle policy.
    */
   "environments/templates/list": {
     params: Api.EnvironmentTemplateListParams;
@@ -1384,7 +1391,7 @@ export interface MethodMap {
   /**
    * Read an environment template
    *
-   * Returns one immutable template version from the selected bound provider controller.
+   * Returns one template, read live from a bound provider's controller.
    */
   "environments/templates/read": {
     params: Api.EnvironmentTemplateReadParams;
@@ -1393,7 +1400,7 @@ export interface MethodMap {
   /**
    * Create environment jobs
    *
-   * Starts a dependency-aware job group on one environment instance, injecting the environment's configured credentials at provider start. requestId is the retry identity; jobs are owned by the instance rather than a session. A powered-down environment is woken on use: the call fails with environment_not_ready while the wake is in progress; retry with backoff.
+   * Starts a dependency-aware job group on one environment instance, injecting its configured credentials at provider start. requestId is the retry identity; jobs are owned by the instance, not a session. A powered-down environment wakes on its data route; the call fails with environment_not_ready while it wakes or reconnects; retry with backoff.
    */
   "environments/jobs/create": {
     params: Api.EnvironmentJobCreateParams;
@@ -1420,7 +1427,7 @@ export interface MethodMap {
   /**
    * Mint an environment registration key
    *
-   * Creates a reusable universe-scoped key that lets outbound envd daemons register as environments. The plaintext secret is returned exactly once; only its hash is stored. Identity mode, active limit, disconnect grace, and expiry are the key's policy. Treat the secret like a cluster-join credential.
+   * Creates a reusable universe-scoped key that lets outbound envd daemons register as environments. The plaintext secret is returned exactly once; only its hash is stored. Identity mode (immutable), active limit, disconnect grace, offline close-after, and expiry are the key's policy. Treat the secret like a cluster-join credential.
    */
   "environments/registration-keys/create": {
     params: Api.EnvironmentRegistrationKeyCreateParams;
@@ -1444,6 +1451,24 @@ export interface MethodMap {
     params: Api.EnvironmentRegistrationKeyListParams;
     result: Api.AgentApiOutcomeOfEnvironmentRegistrationKeyListResponse;
   };
+  /**
+   * Update an environment registration key
+   *
+   * Replaces a key's editable policy: display name, active limit, disconnect grace, offline close-after, and expiry; an omitted field is unset. The identity mode is immutable. The active limit and expiry apply to later admissions; a changed disconnect grace or offline close-after applies at the next sweep to environments whose daemon is away.
+   */
+  "environments/registration-keys/update": {
+    params: Api.EnvironmentRegistrationKeyUpdateParams;
+    result: Api.AgentApiOutcomeOfEnvironmentRegistrationKeyUpdateResponse;
+  };
+  /**
+   * Rotate an environment registration key
+   *
+   * Replaces the key's secret and display prefix and retires the old secret at once. The key keeps its id, group, policy, and the environments it admitted; daemons already registered are unaffected because they never present the key again. Returns the new secret once. Refused for a revoked key.
+   */
+  "environments/registration-keys/rotate": {
+    params: Api.EnvironmentRegistrationKeyRotateParams;
+    result: Api.AgentApiOutcomeOfEnvironmentRegistrationKeyRotateResponse;
+  };
   /**
    * Revoke an environment registration key
    *
@@ -2194,7 +2219,7 @@ export interface MethodMap {
   /**
    * Put an environment provider
    *
-   * Registers or replaces one deployment provider: its controller endpoint URL and the bearer credential Lightspeed presents to the controller and data routes. The credential is write-only: required for a new provider, kept when omitted, never returned. The provider does not call this API or require access to Lightspeed.
+   * Registers or replaces a deployment provider: controller endpoint, optional data route base, and optional bearer credential for controller and data routes (write-only: kept when omitted, removed by clearCredential, never returned). The controller is probed: a definitive refusal is invalid_request, unreachable is accepted. The provider never calls Lightspeed.
    */
   "deployment/environment-providers/put": {
     params: Api.DeploymentEnvironmentProviderPutParams;
@@ -2203,7 +2228,7 @@ export interface MethodMap {
   /**
    * List environment providers
    *
-   * Returns every deployment-registered provider with its controller endpoint and the optional features its controller last advertised.
+   * Returns every deployment-registered provider with its controller endpoint, data route base, and whether a credential is stored.
    */
   "deployment/environment-providers/list": {
     params: Api.DeploymentEnvironmentProviderListParams;
@@ -2212,7 +2237,7 @@ export interface MethodMap {
   /**
    * Read an environment provider
    *
-   * Returns one deployment-registered provider with its controller endpoint and the optional features its controller last advertised.
+   * Returns one deployment-registered provider with its controller endpoint, data route base, and whether a credential is stored.
    */
   "deployment/environment-providers/read": {
     params: Api.DeploymentEnvironmentProviderReadParams;
@@ -2221,7 +2246,7 @@ export interface MethodMap {
   /**
    * Delete an environment provider
    *
-   * Deletes a deployment provider only when no universe binding references it.
+   * Deletes a deployment provider only when no universe binding and no non-closed environment references it.
    */
   "deployment/environment-providers/delete": {
     params: Api.DeploymentEnvironmentProviderDeleteParams;
@@ -2230,7 +2255,7 @@ export interface MethodMap {
   /**
    * Put an environment provider binding
    *
-   * Creates or replaces one universe's complete revisioned routing and admission binding. A deployment provider may have at most one binding in a universe.
+   * Creates or replaces one universe's binding to a deployment provider. Only an enabled binding admits creates, template listing, and data routes for the universe.
    */
   "deployment/environment-providers/bindings/put": {
     params: Api.DeploymentProviderBindingPutParams;
@@ -2239,21 +2264,12 @@ export interface MethodMap {
   /**
    * Delete an environment provider binding
    *
-   * Deletes a universe provider binding only after every referencing environment has reached Closed.
+   * Deletes a universe's binding to a provider only when the universe has no non-closed environment of that provider.
    */
   "deployment/environment-providers/bindings/delete": {
     params: Api.DeploymentProviderBindingDeleteParams;
     result: Api.AgentApiOutcomeOfDeploymentProviderBindingDeleteResponse;
   };
-  /**
-   * Adopt a provider environment
-   *
-   * Creates a universe environment by transferring an existing provider target into Lightspeed's managed lifecycle. The caller must explicitly accept ownership transfer.
-   */
-  "deployment/environments/adopt": {
-    params: Api.DeploymentEnvironmentAdoptParams;
-    result: Api.AgentApiOutcomeOfDeploymentEnvironmentAdoptResponse;
-  };
   /**
    * List channel accounts across universes
    *
@@ -2524,7 +2540,7 @@ export const rpc = {
   /**
    * Create an environment
    *
-   * Records an idempotent provisioning intent against an enabled universe binding, attributed to the caller. The provider validates its provider-wide template and provisions through its backend asynchronously.
+   * Creates a provisioned environment, attributed to the caller, from a template of a provider enabled for the universe. Idempotent per requestId: same inputs, same environment; others conflict. Provisioning until the target's first envd handshake, then open; idle overrides the template default.
    */
   environmentsCreate(client: RpcCaller, params: Api.EnvironmentCreateParams): Promise<Api.AgentApiOutcomeOfEnvironmentCreateResponse> {
     return client.call("environments/create", params);
@@ -2532,15 +2548,23 @@ export const rpc = {
   /**
    * Read an environment
    *
-   * Returns the durable universe resource, source binding, logical lifecycle state, and minimal current-incarnation identity.
+   * Returns one environment: its source, lifecycle state, derived display status, state message, close reason, daemon build, and the latest provider observation.
    */
   environmentsRead(client: RpcCaller, params: Api.EnvironmentReadParams): Promise<Api.AgentApiOutcomeOfEnvironmentReadResponse> {
     return client.call("environments/read", params);
   },
+  /**
+   * Update an environment
+   *
+   * Replaces the display name and caller metadata of an environment of any kind. Refused for a closed environment.
+   */
+  environmentsUpdate(client: RpcCaller, params: Api.EnvironmentUpdateParams): Promise<Api.AgentApiOutcomeOfEnvironmentUpdateResponse> {
+    return client.call("environments/update", params);
+  },
   /**
    * List environments
    *
-   * Lists the universe environments, optionally filtered by provider, binding, or logical lifecycle state.
+   * Lists the universe environments in id order, one page at a time, optionally filtered by provider, registration key, state, or metadata. Closed environments are omitted unless includeClosed is set or state is closed. Continue from nextAfter.
    */
   environmentsList(client: RpcCaller, params: Api.EnvironmentListParams): Promise<Api.AgentApiOutcomeOfEnvironmentListResponse> {
     return client.call("environments/list", params);
@@ -2548,7 +2572,7 @@ export const rpc = {
   /**
    * Close an environment
    *
-   * Records an asynchronous idempotent close intent. Provider cleanup is resumed by lifecycle reconciliation; quota is released only after Closed.
+   * Closes an environment; idempotent. A provisioned environment moves to closing while Lightspeed asks its provider to remove the target, retrying until it is gone, then closed. External and registered environments close at once, and a connected registered daemon is told its environment closed.
    */
   environmentsClose(client: RpcCaller, params: Api.EnvironmentCloseParams): Promise<Api.AgentApiOutcomeOfEnvironmentCloseResponse> {
     return client.call("environments/close", params);
@@ -2556,7 +2580,7 @@ export const rpc = {
   /**
    * Register an external environment
    *
-   * Creates an environment backed by a Lightspeed-reachable envd WebSocket endpoint, attributed to the caller. Reachability is checked on demand.
+   * Creates an open environment backed by a Lightspeed-reachable envd endpoint, attributed to the caller. Idempotent per requestId. Reachability is checked on use.
    */
   environmentsExternalCreate(client: RpcCaller, params: Api.EnvironmentExternalCreateParams): Promise<Api.AgentApiOutcomeOfEnvironmentExternalCreateResponse> {
     return client.call("environments/external/create", params);
@@ -2564,31 +2588,23 @@ export const rpc = {
   /**
    * Configure environment public ingress
    *
-   * Records the public ingress intent of a provisioned environment; the lifecycle reconciler converges it while the environment is ready, and `publicEndpoint` shows the realized endpoint. Rejected when the provider does not offer ingress. The provider owns hostname, guest port, routing, TLS, and health; an intent its template refuses is dropped.
+   * Synchronously ensures or removes public ingress of an open provisioned environment through its provider; source.publicEndpoint carries the reported endpoint. Rejected when the provider offers no ingress; an internal error, safe to retry, when the provider is unreachable or times out. The provider owns hostname, guest port, routing, TLS, and health.
    */
   environmentsIngressPut(client: RpcCaller, params: Api.EnvironmentIngressPutParams): Promise<Api.AgentApiOutcomeOfEnvironmentIngressPutResponse> {
     return client.call("environments/ingress/put", params);
   },
   /**
-   * Set environment power intent
+   * Set environment power
    *
-   * Records the desired power state (running, paused, suspended, or stopped) of a provisioned environment; the lifecycle reconciler converges the provider target asynchronously. Powered-down environments wake transparently on their next use. Rejected when the provider does not support the state.
+   * Synchronously moves an open provisioned environment's target to running, paused, suspended, or stopped via its provider and records the observation; the provider may also change power on idle. Rejected without provider power control or when the template lacks the state; an internal error, safe to retry, when the provider is unreachable or times out.
    */
   environmentsPowerPut(client: RpcCaller, params: Api.EnvironmentPowerPutParams): Promise<Api.AgentApiOutcomeOfEnvironmentPowerPutResponse> {
     return client.call("environments/power/put", params);
   },
-  /**
-   * Set environment idle policy
-   *
-   * Replaces or clears the staged idle policy of a provisioned environment. The power reaper measures the daemon's idle duration against the pause/suspend/stop/close thresholds and escalates through the stages the provider supports.
-   */
-  environmentsIdlePolicyPut(client: RpcCaller, params: Api.EnvironmentIdlePolicyPutParams): Promise<Api.AgentApiOutcomeOfEnvironmentIdlePolicyPutResponse> {
-    return client.call("environments/idle-policy/put", params);
-  },
   /**
    * List environment provider bindings
    *
-   * Lists this universe's revisioned routing and admission bindings to deployment-scoped physical providers.
+   * Lists this universe's bindings to deployment providers and whether each is enabled.
    */
   environmentsProviderBindingsList(client: RpcCaller, params: Api.EnvironmentProviderBindingListParams): Promise<Api.AgentApiOutcomeOfEnvironmentProviderBindingListResponse> {
     return client.call("environments/provider-bindings/list", params);
@@ -2596,7 +2612,7 @@ export const rpc = {
   /**
    * Read an environment provider binding
    *
-   * Returns one universe routing and admission binding. Provider-wide templates and physical resource, network, and ingress policy remain provider-owned.
+   * Returns this universe's binding to one provider. Templates and physical resource, network, and ingress policy remain provider-owned.
    */
   environmentsProviderBindingsRead(client: RpcCaller, params: Api.EnvironmentProviderBindingReadParams): Promise<Api.AgentApiOutcomeOfEnvironmentProviderBindingReadResponse> {
     return client.call("environments/provider-bindings/read", params);
@@ -2604,7 +2620,7 @@ export const rpc = {
   /**
    * List environment templates
    *
-   * Reads immutable templates directly from the selected bound provider controller.
+   * Reads templates live from the controllers of the universe's enabled provider bindings, or of one provider: compute, power states, public ingress, and default idle policy.
    */
   environmentsTemplatesList(client: RpcCaller, params: Api.EnvironmentTemplateListParams): Promise<Api.AgentApiOutcomeOfEnvironmentTemplateListResponse> {
     return client.call("environments/templates/list", params);
@@ -2612,7 +2628,7 @@ export const rpc = {
   /**
    * Read an environment template
    *
-   * Returns one immutable template version from the selected bound provider controller.
+   * Returns one template, read live from a bound provider's controller.
    */
   environmentsTemplatesRead(client: RpcCaller, params: Api.EnvironmentTemplateReadParams): Promise<Api.AgentApiOutcomeOfEnvironmentTemplateReadResponse> {
     return client.call("environments/templates/read", params);
@@ -2620,7 +2636,7 @@ export const rpc = {
   /**
    * Create environment jobs
    *
-   * Starts a dependency-aware job group on one environment instance, injecting the environment's configured credentials at provider start. requestId is the retry identity; jobs are owned by the instance rather than a session. A powered-down environment is woken on use: the call fails with environment_not_ready while the wake is in progress; retry with backoff.
+   * Starts a dependency-aware job group on one environment instance, injecting its configured credentials at provider start. requestId is the retry identity; jobs are owned by the instance, not a session. A powered-down environment wakes on its data route; the call fails with environment_not_ready while it wakes or reconnects; retry with backoff.
    */
   environmentsJobsCreate(client: RpcCaller, params: Api.EnvironmentJobCreateParams): Promise<Api.AgentApiOutcomeOfEnvironmentJobCreateResponse> {
     return client.call("environments/jobs/create", params);
@@ -2644,7 +2660,7 @@ export const rpc = {
   /**
    * Mint an environment registration key
    *
-   * Creates a reusable universe-scoped key that lets outbound envd daemons register as environments. The plaintext secret is returned exactly once; only its hash is stored. Identity mode, active limit, disconnect grace, and expiry are the key's policy. Treat the secret like a cluster-join credential.
+   * Creates a reusable universe-scoped key that lets outbound envd daemons register as environments. The plaintext secret is returned exactly once; only its hash is stored. Identity mode (immutable), active limit, disconnect grace, offline close-after, and expiry are the key's policy. Treat the secret like a cluster-join credential.
    */
   environmentsRegistrationKeysCreate(client: RpcCaller, params: Api.EnvironmentRegistrationKeyCreateParams): Promise<Api.AgentApiOutcomeOfEnvironmentRegistrationKeyCreateResponse> {
     return client.call("environments/registration-keys/create", params);
@@ -2665,6 +2681,22 @@ export const rpc = {
   environmentsRegistrationKeysList(client: RpcCaller, params: Api.EnvironmentRegistrationKeyListParams): Promise<Api.AgentApiOutcomeOfEnvironmentRegistrationKeyListResponse> {
     return client.call("environments/registration-keys/list", params);
   },
+  /**
+   * Update an environment registration key
+   *
+   * Replaces a key's editable policy: display name, active limit, disconnect grace, offline close-after, and expiry; an omitted field is unset. The identity mode is immutable. The active limit and expiry apply to later admissions; a changed disconnect grace or offline close-after applies at the next sweep to environments whose daemon is away.
+   */
+  environmentsRegistrationKeysUpdate(client: RpcCaller, params: Api.EnvironmentRegistrationKeyUpdateParams): Promise<Api.AgentApiOutcomeOfEnvironmentRegistrationKeyUpdateResponse> {
+    return client.call("environments/registration-keys/update", params);
+  },
+  /**
+   * Rotate an environment registration key
+   *
+   * Replaces the key's secret and display prefix and retires the old secret at once. The key keeps its id, group, policy, and the environments it admitted; daemons already registered are unaffected because they never present the key again. Returns the new secret once. Refused for a revoked key.
+   */
+  environmentsRegistrationKeysRotate(client: RpcCaller, params: Api.EnvironmentRegistrationKeyRotateParams): Promise<Api.AgentApiOutcomeOfEnvironmentRegistrationKeyRotateResponse> {
+    return client.call("environments/registration-keys/rotate", params);
+  },
   /**
    * Revoke an environment registration key
    *
@@ -3332,7 +3364,7 @@ export const rpc = {
   /**
    * Put an environment provider
    *
-   * Registers or replaces one deployment provider: its controller endpoint URL and the bearer credential Lightspeed presents to the controller and data routes. The credential is write-only: required for a new provider, kept when omitted, never returned. The provider does not call this API or require access to Lightspeed.
+   * Registers or replaces a deployment provider: controller endpoint, optional data route base, and optional bearer credential for controller and data routes (write-only: kept when omitted, removed by clearCredential, never returned). The controller is probed: a definitive refusal is invalid_request, unreachable is accepted. The provider never calls Lightspeed.
    */
   deploymentEnvironmentProvidersPut(client: RpcCaller, params: Api.DeploymentEnvironmentProviderPutParams): Promise<Api.AgentApiOutcomeOfDeploymentEnvironmentProviderPutResponse> {
     return client.call("deployment/environment-providers/put", params);
@@ -3340,7 +3372,7 @@ export const rpc = {
   /**
    * List environment providers
    *
-   * Returns every deployment-registered provider with its controller endpoint and the optional features its controller last advertised.
+   * Returns every deployment-registered provider with its controller endpoint, data route base, and whether a credential is stored.
    */
   deploymentEnvironmentProvidersList(client: RpcCaller, params: Api.DeploymentEnvironmentProviderListParams): Promise<Api.AgentApiOutcomeOfDeploymentEnvironmentProviderListResponse> {
     return client.call("deployment/environment-providers/list", params);
@@ -3348,7 +3380,7 @@ export const rpc = {
   /**
    * Read an environment provider
    *
-   * Returns one deployment-registered provider with its controller endpoint and the optional features its controller last advertised.
+   * Returns one deployment-registered provider with its controller endpoint, data route base, and whether a credential is stored.
    */
   deploymentEnvironmentProvidersRead(client: RpcCaller, params: Api.DeploymentEnvironmentProviderReadParams): Promise<Api.AgentApiOutcomeOfDeploymentEnvironmentProviderReadResponse> {
     return client.call("deployment/environment-providers/read", params);
@@ -3356,7 +3388,7 @@ export const rpc = {
   /**
    * Delete an environment provider
    *
-   * Deletes a deployment provider only when no universe binding references it.
+   * Deletes a deployment provider only when no universe binding and no non-closed environment references it.
    */
   deploymentEnvironmentProvidersDelete(client: RpcCaller, params: Api.DeploymentEnvironmentProviderDeleteParams): Promise<Api.AgentApiOutcomeOfDeploymentEnvironmentProviderDeleteResponse> {
     return client.call("deployment/environment-providers/delete", params);
@@ -3364,7 +3396,7 @@ export const rpc = {
   /**
    * Put an environment provider binding
    *
-   * Creates or replaces one universe's complete revisioned routing and admission binding. A deployment provider may have at most one binding in a universe.
+   * Creates or replaces one universe's binding to a deployment provider. Only an enabled binding admits creates, template listing, and data routes for the universe.
    */
   deploymentEnvironmentProvidersBindingsPut(client: RpcCaller, params: Api.DeploymentProviderBindingPutParams): Promise<Api.AgentApiOutcomeOfDeploymentProviderBindingPutResponse> {
     return client.call("deployment/environment-providers/bindings/put", params);
@@ -3372,19 +3404,11 @@ export const rpc = {
   /**
    * Delete an environment provider binding
    *
-   * Deletes a universe provider binding only after every referencing environment has reached Closed.
+   * Deletes a universe's binding to a provider only when the universe has no non-closed environment of that provider.
    */
   deploymentEnvironmentProvidersBindingsDelete(client: RpcCaller, params: Api.DeploymentProviderBindingDeleteParams): Promise<Api.AgentApiOutcomeOfDeploymentProviderBindingDeleteResponse> {
     return client.call("deployment/environment-providers/bindings/delete", params);
   },
-  /**
-   * Adopt a provider environment
-   *
-   * Creates a universe environment by transferring an existing provider target into Lightspeed's managed lifecycle. The caller must explicitly accept ownership transfer.
-   */
-  deploymentEnvironmentsAdopt(client: RpcCaller, params: Api.DeploymentEnvironmentAdoptParams): Promise<Api.AgentApiOutcomeOfDeploymentEnvironmentAdoptResponse> {
-    return client.call("deployment/environments/adopt", params);
-  },
   /**
    * List channel accounts across universes
    *
diff --git a/clients/typescript/src/generated/types.ts b/clients/typescript/src/generated/types.ts
index 297865264..40d2b9cb5 100644
--- a/clients/typescript/src/generated/types.ts
+++ b/clients/typescript/src/generated/types.ts
@@ -1368,20 +1368,38 @@ export type MethodGroup =
   | "deployment/environment-providers"
   | "deployment/channels";
 /**
- * Steady power state of a provisioned environment.
+ * Why an environment is closing or closed.
  *
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
- * via the `definition` "EnvironmentPowerStateView".
+ * via the `definition` "EnvironmentCloseReasonView".
  */
-export type EnvironmentPowerStateView = "running" | "paused" | "suspended" | "stopped";
+export type EnvironmentCloseReasonView =
+  "requested" | "keyRevoked" | "ephemeralGrace" | "departed" | "offlineTimeout" | "providerEnded";
 /**
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
  * via the `definition` "EnvironmentSourceView".
  */
 export type EnvironmentSourceView =
   | {
-      bindingId: string;
+      /**
+       * The create-time idle policy, when one replaced the template's.
+       */
+      idle?: EnvironmentIdlePolicyView | null;
+      /**
+       * Absent until the provider first reported the target.
+       */
+      observed?: EnvironmentObservedTargetView | null;
       providerId: string;
+      /**
+       * The public endpoint the provider last reported.
+       */
+      publicEndpoint?: string | null;
+      /**
+       * The provider's handle for the target; absent until the provider
+       * accepted the create.
+       */
+      targetId?: string | null;
+      templateId: string;
       type: "provisioned";
     }
   | {
@@ -1392,33 +1410,74 @@ export type EnvironmentSourceView =
       type: "external";
     }
   | {
+      /**
+       * The daemon's control connection is up.
+       */
+      connected: boolean;
+      /**
+       * When the daemon last connected or disconnected.
+       */
+      connectionChangedAtMs: number;
       daemonId: string;
+      /**
+       * The admitting key's identity mode.
+       */
       identityMode: EnvironmentIdentityModeView;
+      /**
+       * When the gateway last recorded the daemon's control connection:
+       * at connect, at disconnect, and at most every five minutes while
+       * connected.
+       */
+      lastSeenAtMs: number;
       registrationKeyId: string;
       type: "registered";
     };
 /**
- * What Lightspeed does with a registered environment while its daemon is
- * disconnected. Registration-key policy, copied onto each environment.
+ * Lifecycle phase of a provider target, as the provider reports it.
+ *
+ * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
+ * via the `definition` "EnvironmentTargetPhaseView".
+ */
+export type EnvironmentTargetPhaseView =
+  "provisioning" | "active" | "closing" | "closed" | "failed" | "unknown";
+/**
+ * Power state of a provisioned environment's target.
+ *
+ * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
+ * via the `definition` "EnvironmentPowerStateView".
+ */
+export type EnvironmentPowerStateView = "running" | "paused" | "suspended" | "stopped";
+/**
+ * What happens to a registered environment while its daemon is
+ * disconnected. Policy of the registration key that admitted it.
  *
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
  * via the `definition` "EnvironmentIdentityModeView".
  */
 export type EnvironmentIdentityModeView = "persistent" | "ephemeral";
 /**
+ * The lifecycle Lightspeed owns. External and registered environments are
+ * only ever `open` or `closed`.
+ *
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
- * via the `definition` "EnvironmentLifecycleStatusView".
+ * via the `definition` "EnvironmentStateView".
  */
-export type EnvironmentLifecycleStatusView =
-  | ("provisioning" | "booting" | "ready" | "closing" | "closed" | "failed" | "unknown")
-  | "paused"
-  | "suspended"
-  | "offline";
+export type EnvironmentStateView = ("open" | "closed") | "provisioning" | "closing" | "failed";
 /**
+ * Display status derived from `state` and the latest observation; never
+ * stored. Tools that use a paused, suspended or stopped environment wake
+ * it.
+ *
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
- * via the `definition` "EnvironmentProviderBindingStatusView".
+ * via the `definition` "EnvironmentStatusView".
  */
-export type EnvironmentProviderBindingStatusView = "enabled" | "disabled";
+export type EnvironmentStatusView =
+  | ("provisioning" | "ready" | "closing" | "closed" | "failed")
+  | "paused"
+  | "suspended"
+  | "stopped"
+  | "unknown"
+  | "away";
 /**
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
  * via the `definition` "EnvironmentCredentialSourceView".
@@ -4700,110 +4759,6 @@ export interface DeletedSessionView {
   displayName?: string | null;
   sessionId: string;
 }
-/**
- * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
- * via the `definition` "AgentApiOutcomeOfDeploymentEnvironmentAdoptResponse".
- */
-export interface AgentApiOutcomeOfDeploymentEnvironmentAdoptResponse {
-  notifications?: AgentNotification[];
-  result: DeploymentEnvironmentAdoptResponse;
-}
-/**
- * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
- * via the `definition` "DeploymentEnvironmentAdoptResponse".
- */
-export interface DeploymentEnvironmentAdoptResponse {
-  environment: EnvironmentView;
-}
-/**
- * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
- * via the `definition` "EnvironmentView".
- */
-export interface EnvironmentView {
-  createdAtMs: number;
-  /**
-   * Lightspeed-owned power intent; `status` is the observed state.
-   */
-  desiredPower: EnvironmentPowerStateView;
-  displayName?: string | null;
-  environmentId: string;
-  idlePolicy?: EnvironmentIdlePolicyView | null;
-  incarnation: EnvironmentIncarnationView;
-  /**
-   * Registered environments only: when the gateway last saw the daemon's
-   * control connection.
-   */
-  lastSeenAtMs?: number | null;
-  /**
-   * Why the environment failed, or the latest error (or what the
-   * provider reports it is waiting on) while its lifecycle converges;
-   * absent once it reaches a steady state.
-   */
-  lifecycleError?: EnvironmentLifecycleErrorView | null;
-  metadata?: {
-    [k: string]: string;
-  };
-  /**
-   * The public endpoint the provider last reported. It lags
-   * `publicIngressEnabled` while the lifecycle reconciler converges.
-   */
-  publicEndpoint?: string | null;
-  /**
-   * Lightspeed-owned public ingress intent; `publicEndpoint` is what the
-   * provider realized.
-   */
-  publicIngressEnabled: boolean;
-  requestId: string;
-  source: EnvironmentSourceView;
-  status: EnvironmentLifecycleStatusView;
-  updatedAtMs: number;
-}
-/**
- * Staged idle policy. Thresholds are milliseconds of daemon-reported idle
- * time and must be non-decreasing in the order pause, suspend, stop, close.
- * Stages whose power state the provider does not support are skipped.
- *
- * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
- * via the `definition` "EnvironmentIdlePolicyView".
- */
-export interface EnvironmentIdlePolicyView {
-  closeAfterMs?: number | null;
-  pauseAfterMs?: number | null;
-  stopAfterMs?: number | null;
-  suspendAfterMs?: number | null;
-}
-/**
- * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
- * via the `definition` "EnvironmentIncarnationView".
- */
-export interface EnvironmentIncarnationView {
-  createdAtMs: number;
-  incarnationId: string;
-  /**
-   * Power states the provider reported for this target; empty until
-   * observed or when the provider offers no power control.
-   */
-  powerStates?: EnvironmentPowerStateView[];
-  providerTargetId?: string | null;
-  provisionRequestId?: string | null;
-  templateId?: string | null;
-  updatedAtMs: number;
-}
-/**
- * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
- * via the `definition` "EnvironmentLifecycleErrorView".
- */
-export interface EnvironmentLifecycleErrorView {
-  /**
-   * When the current run of errors began.
-   */
-  firstAtMs: number;
-  /**
-   * When `message` was recorded.
-   */
-  lastAtMs: number;
-  message: string;
-}
 /**
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
  * via the `definition` "AgentApiOutcomeOfDeploymentEnvironmentProviderDeleteResponse".
@@ -4828,39 +4783,26 @@ export interface DeploymentEnvironmentProviderView {
    * `ws://`, `wss://` or `unix://` URL of the provider controller.
    */
   controllerEndpoint: string;
-  /**
-   * What the controller advertised at its last successful handshake;
-   * absent until Lightspeed first reached it at this endpoint.
-   */
-  controllerFeatures?: DeploymentEnvironmentProviderFeaturesView | null;
   createdAtMs: number;
   /**
-   * Base URL of the provider's data routes, as its controller advertised
-   * it; absent until then.
+   * Operator-configured `ws://` or `wss://` base of the provider's data
+   * routes; absent derives it from the controller endpoint.
    */
   dataRouteBase?: string | null;
   displayName?: string | null;
-  metadata?: {
-    [k: string]: string;
-  };
-  providerId: string;
-  updatedAtMs: number;
-}
-/**
- * Optional controller methods the provider's controller advertised.
- *
- * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
- * via the `definition` "DeploymentEnvironmentProviderFeaturesView".
- */
-export interface DeploymentEnvironmentProviderFeaturesView {
   /**
-   * Existing targets can be adopted (`environment/adopt`).
+   * The data route base Lightspeed dials: `dataRouteBase`, or the
+   * controller endpoint's origin followed by `/routes`. Absent only when it
+   * cannot be derived.
    */
-  adoptTarget: boolean;
+  effectiveDataRouteBase?: string | null;
   /**
-   * Public ingress can be enabled on environments.
+   * A bearer credential is stored and presented to the controller and
+   * data routes; without one no `Authorization` header is sent.
    */
-  ingress: boolean;
+  hasCredential: boolean;
+  providerId: string;
+  updatedAtMs: number;
 }
 /**
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
@@ -4923,18 +4865,16 @@ export interface DeploymentProviderBindingDeleteResponse {
   binding: EnvironmentProviderBindingView;
 }
 /**
+ * A universe's binding to a deployment provider. Creates, templates and
+ * data routes of the provider need it enabled.
+ *
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
  * via the `definition` "EnvironmentProviderBindingView".
  */
 export interface EnvironmentProviderBindingView {
-  bindingId: string;
   createdAtMs: number;
-  metadata?: {
-    [k: string]: string;
-  };
+  enabled: boolean;
   providerId: string;
-  revision: number;
-  status: EnvironmentProviderBindingStatusView;
   updatedAtMs: number;
 }
 /**
@@ -5083,6 +5023,92 @@ export interface AgentApiOutcomeOfEnvironmentCloseResponse {
 export interface EnvironmentCloseResponse {
   environment: EnvironmentView;
 }
+/**
+ * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
+ * via the `definition` "EnvironmentView".
+ */
+export interface EnvironmentView {
+  /**
+   * Present exactly while `state` is `closing` or `closed`.
+   */
+  closeReason?: EnvironmentCloseReasonView | null;
+  closedAtMs?: number | null;
+  createdAtMs: number;
+  /**
+   * The envd build serving the environment; absent until known.
+   */
+  daemon?: EnvironmentDaemonView | null;
+  displayName?: string | null;
+  environmentId: string;
+  /**
+   * Caller metadata.
+   */
+  metadata?: {
+    [k: string]: string;
+  };
+  /**
+   * The caller's retry identity; absent for registered environments.
+   */
+  requestId?: string | null;
+  source: EnvironmentSourceView;
+  state: EnvironmentStateView;
+  /**
+   * When `state` last changed.
+   */
+  stateChangedAtMs: number;
+  /**
+   * Why the environment failed, or what provisioning or closing is
+   * waiting on.
+   */
+  stateMessage?: string | null;
+  status: EnvironmentStatusView;
+  updatedAtMs: number;
+}
+/**
+ * The envd build serving an environment, from its registration or
+ * Lightspeed's open handshake.
+ *
+ * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
+ * via the `definition` "EnvironmentDaemonView".
+ */
+export interface EnvironmentDaemonView {
+  gitSha?: string | null;
+  protocolVersion: number;
+  version?: string | null;
+}
+/**
+ * Staged idle policy the provider applies. Thresholds are milliseconds of
+ * envd-reported idle time (running processes, jobs and leftover process
+ * groups hold it at zero) and must be non-decreasing in the order pause,
+ * suspend, stop, close. Stages whose power state the template does not
+ * support are skipped.
+ *
+ * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
+ * via the `definition` "EnvironmentIdlePolicyView".
+ */
+export interface EnvironmentIdlePolicyView {
+  closeAfterMs?: number | null;
+  pauseAfterMs?: number | null;
+  stopAfterMs?: number | null;
+  suspendAfterMs?: number | null;
+}
+/**
+ * What the provider last reported about a provisioned environment's
+ * target. Display only: Lightspeed never converges it, and it may be up to
+ * a few minutes old.
+ *
+ * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
+ * via the `definition` "EnvironmentObservedTargetView".
+ */
+export interface EnvironmentObservedTargetView {
+  message?: string | null;
+  observedAtMs: number;
+  phase: EnvironmentTargetPhaseView;
+  /**
+   * Present only while `phase` is `active`.
+   */
+  power?: EnvironmentPowerStateView | null;
+}
 /**
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
  * via the `definition` "AgentApiOutcomeOfEnvironmentCreateResponse".
@@ -5169,21 +5195,6 @@ export interface AgentApiOutcomeOfEnvironmentExternalCreateResponse {
 export interface EnvironmentExternalCreateResponse {
   environment: EnvironmentView;
 }
-/**
- * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
- * via the `definition` "AgentApiOutcomeOfEnvironmentIdlePolicyPutResponse".
- */
-export interface AgentApiOutcomeOfEnvironmentIdlePolicyPutResponse {
-  notifications?: AgentNotification[];
-  result: EnvironmentIdlePolicyPutResponse;
-}
-/**
- * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
- * via the `definition` "EnvironmentIdlePolicyPutResponse".
- */
-export interface EnvironmentIdlePolicyPutResponse {
-  environment: EnvironmentView;
-}
 /**
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
  * via the `definition` "AgentApiOutcomeOfEnvironmentIngressPutResponse".
@@ -5388,7 +5399,14 @@ export interface AgentApiOutcomeOfEnvironmentListResponse {
  * via the `definition` "EnvironmentListResponse".
  */
 export interface EnvironmentListResponse {
+  /**
+   * Environments in environment id order.
+   */
   environments?: EnvironmentView[];
+  /**
+   * Pass as `after` to read the next page; absent on the last page.
+   */
+  nextAfter?: string | null;
 }
 /**
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
@@ -5490,11 +5508,16 @@ export interface EnvironmentRegistrationKeyView {
   expiresAtMs?: number | null;
   identityMode: EnvironmentIdentityModeView;
   /**
-   * First characters of the secret, for identification only.
+   * First characters of the key's live secret, for identification only.
    */
   keyPrefix: string;
   lastRegisteredAtMs?: number | null;
   maxActiveEnvironments?: number | null;
+  /**
+   * Persistent keys only: environments whose daemon has been away longer
+   * than this are closed; absent keeps them open.
+   */
+  offlineCloseAfterMs?: number | null;
   /**
    * Environments ever admitted by this key, closed included.
    */
@@ -5502,6 +5525,7 @@ export interface EnvironmentRegistrationKeyView {
   registrationKeyId: string;
   revokedAtMs?: number | null;
   status: EnvironmentRegistrationKeyStatusView;
+  updatedAtMs: number;
 }
 /**
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
@@ -5552,6 +5576,40 @@ export interface EnvironmentRegistrationKeyRevokeResponse {
   closedEnvironmentIds?: string[];
   registrationKey: EnvironmentRegistrationKeyView;
 }
+/**
+ * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
+ * via the `definition` "AgentApiOutcomeOfEnvironmentRegistrationKeyRotateResponse".
+ */
+export interface AgentApiOutcomeOfEnvironmentRegistrationKeyRotateResponse {
+  notifications?: AgentNotification[];
+  result: EnvironmentRegistrationKeyRotateResponse;
+}
+/**
+ * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
+ * via the `definition` "EnvironmentRegistrationKeyRotateResponse".
+ */
+export interface EnvironmentRegistrationKeyRotateResponse {
+  registrationKey: EnvironmentRegistrationKeyView;
+  /**
+   * The new plaintext secret, returned only here.
+   */
+  secret: EnvironmentRegistrationSecretView;
+}
+/**
+ * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
+ * via the `definition` "AgentApiOutcomeOfEnvironmentRegistrationKeyUpdateResponse".
+ */
+export interface AgentApiOutcomeOfEnvironmentRegistrationKeyUpdateResponse {
+  notifications?: AgentNotification[];
+  result: EnvironmentRegistrationKeyUpdateResponse;
+}
+/**
+ * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
+ * via the `definition` "EnvironmentRegistrationKeyUpdateResponse".
+ */
+export interface EnvironmentRegistrationKeyUpdateResponse {
+  registrationKey: EnvironmentRegistrationKeyView;
+}
 /**
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
  * via the `definition` "AgentApiOutcomeOfEnvironmentTemplateListResponse".
@@ -5572,14 +5630,26 @@ export interface EnvironmentTemplateListResponse {
  * via the `definition` "EnvironmentTemplateView".
  */
 export interface EnvironmentTemplateView {
-  bindingId: string;
   deprecated: boolean;
   description?: string | null;
   displayName: string;
+  /**
+   * Idle policy targets get when `environments/create` names none.
+   */
+  idle?: EnvironmentIdlePolicyView | null;
   metadata?: {
     [k: string]: string;
   };
+  /**
+   * Power states `environments/power/put` can move targets of this
+   * template to; empty without power control.
+   */
+  powerStates: EnvironmentPowerStateView[];
   providerId: string;
+  /**
+   * `environments/ingress/put` can enable public ingress on targets of
+   * this template.
+   */
   publicIngress: boolean;
   /**
    * Compute targets of this template get; absent when the provider does
@@ -5615,6 +5685,21 @@ export interface AgentApiOutcomeOfEnvironmentTemplateReadResponse {
 export interface EnvironmentTemplateReadResponse {
   template: EnvironmentTemplateView;
 }
+/**
+ * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
+ * via the `definition` "AgentApiOutcomeOfEnvironmentUpdateResponse".
+ */
+export interface AgentApiOutcomeOfEnvironmentUpdateResponse {
+  notifications?: AgentNotification[];
+  result: EnvironmentUpdateResponse;
+}
+/**
+ * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
+ * via the `definition` "EnvironmentUpdateResponse".
+ */
+export interface EnvironmentUpdateResponse {
+  environment: EnvironmentView;
+}
 /**
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
  * via the `definition` "AgentApiOutcomeOfInitializeResponse".
@@ -7488,32 +7573,6 @@ export interface DeploymentDeletedSessionsListParams {
   after?: string | null;
   universeId: string;
 }
-/**
- * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
- * via the `definition` "DeploymentEnvironmentAdoptParams".
- */
-export interface DeploymentEnvironmentAdoptParams {
-  bindingId: string;
-  displayName?: string | null;
-  metadata?: {
-    [k: string]: string;
-  };
-  /**
-   * Stable caller-generated retry identity inside the destination universe.
-   */
-  requestId: string;
-  /**
-   * Provider-native source reference. The Incus provider accepts
-   * `<project>/<instance>` or an instance name in the `default` project.
-   */
-  sourceTarget: string;
-  /**
-   * Required acknowledgement that Lightspeed will move, reconfigure, and
-   * delete the target as part of its ordinary managed lifecycle.
-   */
-  takeOwnership: boolean;
-  universeId: string;
-}
 /**
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
  * via the `definition` "DeploymentEnvironmentProviderDeleteParams".
@@ -7527,27 +7586,35 @@ export interface DeploymentEnvironmentProviderDeleteParams {
  */
 export interface DeploymentEnvironmentProviderListParams {}
 /**
- * Register or replace a provider. `credential` is the bearer token
- * Lightspeed presents to the provider's controller and data routes: it is
- * sealed on receipt and never returned by any method. `Debug` output
+ * Register or replace a provider. `credential` is the optional bearer
+ * token Lightspeed presents to the provider's controller and data routes:
+ * it is sealed on receipt and never returned by any method. `Debug` output
  * redacts it; request logging must never echo these params.
  *
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
  * via the `definition` "DeploymentEnvironmentProviderPutParams".
  */
 export interface DeploymentEnvironmentProviderPutParams {
+  /**
+   * Remove the stored credential. Excludes `credential`.
+   */
+  clearCredential?: boolean;
   /**
    * `ws://`, `wss://` or `unix://` URL of the provider controller.
    */
   controllerEndpoint: string;
   /**
-   * Required when the provider is new; omit to keep the stored one.
+   * A new bearer credential; omit to keep the stored one. A provider needs
+   * none. Excludes `clearCredential`.
    */
   credential?: string | null;
+  /**
+   * `ws://` or `wss://` base of the provider's data routes; omit to derive
+   * it from the controller endpoint. Required for a `unix://` controller,
+   * and must not be `ws://` for a `wss://` controller.
+   */
+  dataRouteBase?: string | null;
   displayName?: string | null;
-  metadata?: {
-    [k: string]: string;
-  };
   providerId: string;
 }
 /**
@@ -7562,21 +7629,21 @@ export interface DeploymentEnvironmentProviderReadParams {
  * via the `definition` "DeploymentProviderBindingDeleteParams".
  */
 export interface DeploymentProviderBindingDeleteParams {
-  bindingId: string;
+  providerId: string;
   universeId: string;
 }
 /**
+ * Create or replace a universe's binding to a deployment provider.
+ *
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
  * via the `definition` "DeploymentProviderBindingPutParams".
  */
 export interface DeploymentProviderBindingPutParams {
-  bindingId: string;
-  expectedRevision?: number | null;
-  metadata?: {
-    [k: string]: string;
-  };
+  /**
+   * Admits creates, template listing and data routes for the universe.
+   */
+  enabled: boolean;
   providerId: string;
-  status: EnvironmentProviderBindingStatusView;
   universeId: string;
 }
 /**
@@ -7649,21 +7716,27 @@ export interface EnvironmentCloseParams {
  * via the `definition` "EnvironmentCreateParams".
  */
 export interface EnvironmentCreateParams {
-  bindingId: string;
   displayName?: string | null;
   /**
-   * Optional staged idle policy applied by the power reaper.
+   * Idle policy passed to the provider in place of the template's `idle`.
+   * The provider runs the idle clock; it cannot be changed after create.
    */
-  idlePolicy?: EnvironmentIdlePolicyView | null;
+  idle?: EnvironmentIdlePolicyView | null;
   metadata?: {
     [k: string]: string;
   };
+  /**
+   * The provider to create the environment with; the universe needs an
+   * enabled binding to it.
+   */
+  providerId: string;
   /**
    * Stable caller-generated retry identity, unique inside the universe.
+   * Retrying with identical inputs returns the same environment.
    */
   requestId: string;
   /**
-   * Immutable provider template-version identity.
+   * The provider template to create the environment from.
    */
   templateId: string;
 }
@@ -7705,24 +7778,19 @@ export interface EnvironmentExternalCreateParams {
   metadata?: {
     [k: string]: string;
   };
-  requestId: string;
-}
-/**
- * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
- * via the `definition` "EnvironmentIdlePolicyPutParams".
- */
-export interface EnvironmentIdlePolicyPutParams {
-  environmentId: string;
   /**
-   * The complete new policy; omit to clear it.
+   * Stable caller-generated retry identity, unique inside the universe.
    */
-  idlePolicy?: EnvironmentIdlePolicyView | null;
+  requestId: string;
 }
 /**
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
  * via the `definition` "EnvironmentIngressPutParams".
  */
 export interface EnvironmentIngressPutParams {
+  /**
+   * Ensure (`true`) or remove (`false`) the provider's public ingress.
+   */
   enabled: boolean;
   environmentId: string;
 }
@@ -7803,7 +7871,18 @@ export interface EnvironmentJobReadParams {
  * via the `definition` "EnvironmentListParams".
  */
 export interface EnvironmentListParams {
-  bindingId?: string | null;
+  /**
+   * Exclusive environment id cursor: a previous page's `nextAfter`.
+   */
+  after?: string | null;
+  /**
+   * Also list closed environments; they are omitted by default.
+   */
+  includeClosed?: boolean;
+  /**
+   * Most environments per page; omit for 100.
+   */
+  limit?: number | null;
   /**
    * Only environments carrying every listed metadata pair (AND
    * semantics); the same filter `session/list` accepts.
@@ -7811,12 +7890,19 @@ export interface EnvironmentListParams {
   metadata?: {
     [k: string]: string;
   };
+  /**
+   * Only provisioned environments of this provider.
+   */
   providerId?: string | null;
   /**
    * Only registered environments admitted by this registration key.
    */
   registrationKeyId?: string | null;
-  status?: EnvironmentLifecycleStatusView | null;
+  /**
+   * Only environments in this lifecycle state. `closed` lists closed
+   * environments without `includeClosed`.
+   */
+  state?: EnvironmentStateView | null;
 }
 /**
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
@@ -7825,8 +7911,8 @@ export interface EnvironmentListParams {
 export interface EnvironmentPowerPutParams {
   environmentId: string;
   /**
-   * Desired steady power state. Must be one of the provider-reported
-   * `incarnation.powerStates`.
+   * Power state to move the target to; one of its template's
+   * `powerStates`.
    */
   power: EnvironmentPowerStateView;
 }
@@ -7840,7 +7926,7 @@ export interface EnvironmentProviderBindingListParams {}
  * via the `definition` "EnvironmentProviderBindingReadParams".
  */
 export interface EnvironmentProviderBindingReadParams {
-  bindingId: string;
+  providerId: string;
 }
 /**
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
@@ -7863,11 +7949,19 @@ export interface EnvironmentRegistrationKeyCreateParams {
    */
   ephemeralDisconnectGraceMs?: number | null;
   expiresAtMs?: number | null;
+  /**
+   * Immutable once the key exists.
+   */
   identityMode: EnvironmentIdentityModeView;
   /**
    * Non-closed environments the key may have at once; omit for unlimited.
    */
   maxActiveEnvironments?: number | null;
+  /**
+   * Persistent keys only: close environments whose daemon has been away
+   * longer than this; omit to keep them open.
+   */
+  offlineCloseAfterMs?: number | null;
 }
 /**
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
@@ -7892,21 +7986,78 @@ export interface EnvironmentRegistrationKeyRevokeParams {
   closeEnvironments?: boolean;
   registrationKeyId: string;
 }
+/**
+ * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
+ * via the `definition` "EnvironmentRegistrationKeyRotateParams".
+ */
+export interface EnvironmentRegistrationKeyRotateParams {
+  registrationKeyId: string;
+}
+/**
+ * The complete editable policy of a registration key; an absent field is
+ * unset. The identity mode is immutable.
+ *
+ * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
+ * via the `definition` "EnvironmentRegistrationKeyUpdateParams".
+ */
+export interface EnvironmentRegistrationKeyUpdateParams {
+  /**
+   * Group name for the environments this key admits.
+   */
+  displayName: string;
+  /**
+   * Disconnect grace for ephemeral environments; omit for the default.
+   */
+  ephemeralDisconnectGraceMs?: number | null;
+  expiresAtMs?: number | null;
+  /**
+   * Non-closed environments the key may have at once; omit for unlimited.
+   */
+  maxActiveEnvironments?: number | null;
+  /**
+   * Persistent keys only: close environments whose daemon has been away
+   * longer than this; omit to keep them open.
+   */
+  offlineCloseAfterMs?: number | null;
+  registrationKeyId: string;
+}
 /**
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
  * via the `definition` "EnvironmentTemplateListParams".
  */
 export interface EnvironmentTemplateListParams {
-  bindingId?: string | null;
+  /**
+   * Only this provider's templates; omit for every enabled binding.
+   */
+  providerId?: string | null;
 }
 /**
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
  * via the `definition` "EnvironmentTemplateReadParams".
  */
 export interface EnvironmentTemplateReadParams {
-  bindingId: string;
+  providerId: string;
   templateId: string;
 }
+/**
+ * Replace an environment's display name and caller metadata.
+ *
+ * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
+ * via the `definition` "EnvironmentUpdateParams".
+ */
+export interface EnvironmentUpdateParams {
+  /**
+   * The new display name; omit to clear it.
+   */
+  displayName?: string | null;
+  environmentId: string;
+  /**
+   * The complete new caller metadata; omit or `{}` to clear it.
+   */
+  metadata?: {
+    [k: string]: string;
+  };
+}
 /**
  * This interface was referenced by `LightspeedAgentAPI`'s JSON-Schema
  * via the `definition` "InitializeParams".
diff --git a/crates/api/contract/api-reference.md b/crates/api/contract/api-reference.md
index efde1c5b2..c17e5c12d 100644
--- a/crates/api/contract/api-reference.md
+++ b/crates/api/contract/api-reference.md
@@ -419,7 +419,7 @@ Removes one variable-to-credential mapping without deleting the underlying grant
 
 **Create an environment**
 
-Records an idempotent provisioning intent against an enabled universe binding, attributed to the caller. The provider validates its provider-wide template and provisions through its backend asynchronously.
+Creates a provisioned environment, attributed to the caller, from a template of a provider enabled for the universe. Idempotent per requestId: same inputs, same environment; others conflict. Provisioning until the target's first envd handshake, then open; idle overrides the template default.
 
 - Access: `{"kind":"universe","action":"configure_resource"}`
 - Group: `environments`
@@ -432,7 +432,7 @@ Records an idempotent provisioning intent against an enabled universe binding, a
 
 **Read an environment**
 
-Returns the durable universe resource, source binding, logical lifecycle state, and minimal current-incarnation identity.
+Returns one environment: its source, lifecycle state, derived display status, state message, close reason, daemon build, and the latest provider observation.
 
 - Access: `{"kind":"universe","action":"read"}`
 - Group: `environments`
@@ -441,11 +441,24 @@ Returns the durable universe resource, source binding, logical lifecycle state,
 - Params: `EnvironmentReadParams`
 - Result: `AgentApiOutcome<EnvironmentReadResponse>`
 
+### `environments/update`
+
+**Update an environment**
+
+Replaces the display name and caller metadata of an environment of any kind. Refused for a closed environment.
+
+- Access: `{"kind":"universe","action":"configure_resource"}`
+- Group: `environments`
+- Role: `operator`
+- Target: `none`
+- Params: `EnvironmentUpdateParams`
+- Result: `AgentApiOutcome<EnvironmentUpdateResponse>`
+
 ### `environments/list`
 
 **List environments**
 
-Lists the universe environments, optionally filtered by provider, binding, or logical lifecycle state.
+Lists the universe environments in id order, one page at a time, optionally filtered by provider, registration key, state, or metadata. Closed environments are omitted unless includeClosed is set or state is closed. Continue from nextAfter.
 
 - Access: `{"kind":"universe","action":"read"}`
 - Group: `environments`
@@ -458,7 +471,7 @@ Lists the universe environments, optionally filtered by provider, binding, or lo
 
 **Close an environment**
 
-Records an asynchronous idempotent close intent. Provider cleanup is resumed by lifecycle reconciliation; quota is released only after Closed.
+Closes an environment; idempotent. A provisioned environment moves to closing while Lightspeed asks its provider to remove the target, retrying until it is gone, then closed. External and registered environments close at once, and a connected registered daemon is told its environment closed.
 
 - Access: `{"kind":"universe","action":"configure_resource"}`
 - Group: `environments`
@@ -471,7 +484,7 @@ Records an asynchronous idempotent close intent. Provider cleanup is resumed by
 
 **Register an external environment**
 
-Creates an environment backed by a Lightspeed-reachable envd WebSocket endpoint, attributed to the caller. Reachability is checked on demand.
+Creates an open environment backed by a Lightspeed-reachable envd endpoint, attributed to the caller. Idempotent per requestId. Reachability is checked on use.
 
 - Access: `{"kind":"universe","action":"configure_resource"}`
 - Group: `environments`
@@ -484,7 +497,7 @@ Creates an environment backed by a Lightspeed-reachable envd WebSocket endpoint,
 
 **Configure environment public ingress**
 
-Records the public ingress intent of a provisioned environment; the lifecycle reconciler converges it while the environment is ready, and `publicEndpoint` shows the realized endpoint. Rejected when the provider does not offer ingress. The provider owns hostname, guest port, routing, TLS, and health; an intent its template refuses is dropped.
+Synchronously ensures or removes public ingress of an open provisioned environment through its provider; source.publicEndpoint carries the reported endpoint. Rejected when the provider offers no ingress; an internal error, safe to retry, when the provider is unreachable or times out. The provider owns hostname, guest port, routing, TLS, and health.
 
 - Access: `{"kind":"universe","action":"configure_resource"}`
 - Group: `environments`
@@ -495,9 +508,9 @@ Records the public ingress intent of a provisioned environment; the lifecycle re
 
 ### `environments/power/put`
 
-**Set environment power intent**
+**Set environment power**
 
-Records the desired power state (running, paused, suspended, or stopped) of a provisioned environment; the lifecycle reconciler converges the provider target asynchronously. Powered-down environments wake transparently on their next use. Rejected when the provider does not support the state.
+Synchronously moves an open provisioned environment's target to running, paused, suspended, or stopped via its provider and records the observation; the provider may also change power on idle. Rejected without provider power control or when the template lacks the state; an internal error, safe to retry, when the provider is unreachable or times out.
 
 - Access: `{"kind":"universe","action":"configure_resource"}`
 - Group: `environments`
@@ -506,24 +519,11 @@ Records the desired power state (running, paused, suspended, or stopped) of a pr
 - Params: `EnvironmentPowerPutParams`
 - Result: `AgentApiOutcome<EnvironmentPowerPutResponse>`
 
-### `environments/idle-policy/put`
-
-**Set environment idle policy**
-
-Replaces or clears the staged idle policy of a provisioned environment. The power reaper measures the daemon's idle duration against the pause/suspend/stop/close thresholds and escalates through the stages the provider supports.
-
-- Access: `{"kind":"universe","action":"configure_resource"}`
-- Group: `environments`
-- Role: `operator`
-- Target: `none`
-- Params: `EnvironmentIdlePolicyPutParams`
-- Result: `AgentApiOutcome<EnvironmentIdlePolicyPutResponse>`
-
 ### `environments/provider-bindings/list`
 
 **List environment provider bindings**
 
-Lists this universe's revisioned routing and admission bindings to deployment-scoped physical providers.
+Lists this universe's bindings to deployment providers and whether each is enabled.
 
 - Access: `{"kind":"universe","action":"read"}`
 - Group: `environments`
@@ -536,7 +536,7 @@ Lists this universe's revisioned routing and admission bindings to deployment-sc
 
 **Read an environment provider binding**
 
-Returns one universe routing and admission binding. Provider-wide templates and physical resource, network, and ingress policy remain provider-owned.
+Returns this universe's binding to one provider. Templates and physical resource, network, and ingress policy remain provider-owned.
 
 - Access: `{"kind":"universe","action":"read"}`
 - Group: `environments`
@@ -549,7 +549,7 @@ Returns one universe routing and admission binding. Provider-wide templates and
 
 **List environment templates**
 
-Reads immutable templates directly from the selected bound provider controller.
+Reads templates live from the controllers of the universe's enabled provider bindings, or of one provider: compute, power states, public ingress, and default idle policy.
 
 - Access: `{"kind":"universe","action":"read"}`
 - Group: `environments`
@@ -562,7 +562,7 @@ Reads immutable templates directly from the selected bound provider controller.
 
 **Read an environment template**
 
-Returns one immutable template version from the selected bound provider controller.
+Returns one template, read live from a bound provider's controller.
 
 - Access: `{"kind":"universe","action":"read"}`
 - Group: `environments`
@@ -575,7 +575,7 @@ Returns one immutable template version from the selected bound provider controll
 
 **Create environment jobs**
 
-Starts a dependency-aware job group on one environment instance, injecting the environment's configured credentials at provider start. requestId is the retry identity; jobs are owned by the instance rather than a session. A powered-down environment is woken on use: the call fails with environment_not_ready while the wake is in progress; retry with backoff.
+Starts a dependency-aware job group on one environment instance, injecting its configured credentials at provider start. requestId is the retry identity; jobs are owned by the instance, not a session. A powered-down environment wakes on its data route; the call fails with environment_not_ready while it wakes or reconnects; retry with backoff.
 
 - Access: `{"kind":"universe","action":"use_resource"}`
 - Group: `environments`
@@ -614,7 +614,7 @@ Requests cancellation for selected jobs, optionally including dependents. Force
 
 **Mint an environment registration key**
 
-Creates a reusable universe-scoped key that lets outbound envd daemons register as environments. The plaintext secret is returned exactly once; only its hash is stored. Identity mode, active limit, disconnect grace, and expiry are the key's policy. Treat the secret like a cluster-join credential.
+Creates a reusable universe-scoped key that lets outbound envd daemons register as environments. The plaintext secret is returned exactly once; only its hash is stored. Identity mode (immutable), active limit, disconnect grace, offline close-after, and expiry are the key's policy. Treat the secret like a cluster-join credential.
 
 - Access: `{"kind":"universe","action":"configure_resource"}`
 - Group: `environments`
@@ -649,6 +649,32 @@ Lists this universe's registration keys with policy, status, and derived counts.
 - Params: `EnvironmentRegistrationKeyListParams`
 - Result: `AgentApiOutcome<EnvironmentRegistrationKeyListResponse>`
 
+### `environments/registration-keys/update`
+
+**Update an environment registration key**
+
+Replaces a key's editable policy: display name, active limit, disconnect grace, offline close-after, and expiry; an omitted field is unset. The identity mode is immutable. The active limit and expiry apply to later admissions; a changed disconnect grace or offline close-after applies at the next sweep to environments whose daemon is away.
+
+- Access: `{"kind":"universe","action":"configure_resource"}`
+- Group: `environments`
+- Role: `operator`
+- Target: `none`
+- Params: `EnvironmentRegistrationKeyUpdateParams`
+- Result: `AgentApiOutcome<EnvironmentRegistrationKeyUpdateResponse>`
+
+### `environments/registration-keys/rotate`
+
+**Rotate an environment registration key**
+
+Replaces the key's secret and display prefix and retires the old secret at once. The key keeps its id, group, policy, and the environments it admitted; daemons already registered are unaffected because they never present the key again. Returns the new secret once. Refused for a revoked key.
+
+- Access: `{"kind":"universe","action":"configure_resource"}`
+- Group: `environments`
+- Role: `operator`
+- Target: `none`
+- Params: `EnvironmentRegistrationKeyRotateParams`
+- Result: `AgentApiOutcome<EnvironmentRegistrationKeyRotateResponse>`
+
 ### `environments/registration-keys/revoke`
 
 **Revoke an environment registration key**
@@ -1747,7 +1773,7 @@ Revokes the key with this display prefix; revoking a revoked key keeps its first
 
 **Put an environment provider**
 
-Registers or replaces one deployment provider: its controller endpoint URL and the bearer credential Lightspeed presents to the controller and data routes. The credential is write-only: required for a new provider, kept when omitted, never returned. The provider does not call this API or require access to Lightspeed.
+Registers or replaces a deployment provider: controller endpoint, optional data route base, and optional bearer credential for controller and data routes (write-only: kept when omitted, removed by clearCredential, never returned). The controller is probed: a definitive refusal is invalid_request, unreachable is accepted. The provider never calls Lightspeed.
 
 - Access: `{"kind":"deployment"}`
 - Group: `deployment/environment-providers`
@@ -1760,7 +1786,7 @@ Registers or replaces one deployment provider: its controller endpoint URL and t
 
 **List environment providers**
 
-Returns every deployment-registered provider with its controller endpoint and the optional features its controller last advertised.
+Returns every deployment-registered provider with its controller endpoint, data route base, and whether a credential is stored.
 
 - Access: `{"kind":"deployment"}`
 - Group: `deployment/environment-providers`
@@ -1773,7 +1799,7 @@ Returns every deployment-registered provider with its controller endpoint and th
 
 **Read an environment provider**
 
-Returns one deployment-registered provider with its controller endpoint and the optional features its controller last advertised.
+Returns one deployment-registered provider with its controller endpoint, data route base, and whether a credential is stored.
 
 - Access: `{"kind":"deployment"}`
 - Group: `deployment/environment-providers`
@@ -1786,7 +1812,7 @@ Returns one deployment-registered provider with its controller endpoint and the
 
 **Delete an environment provider**
 
-Deletes a deployment provider only when no universe binding references it.
+Deletes a deployment provider only when no universe binding and no non-closed environment references it.
 
 - Access: `{"kind":"deployment"}`
 - Group: `deployment/environment-providers`
@@ -1799,7 +1825,7 @@ Deletes a deployment provider only when no universe binding references it.
 
 **Put an environment provider binding**
 
-Creates or replaces one universe's complete revisioned routing and admission binding. A deployment provider may have at most one binding in a universe.
+Creates or replaces one universe's binding to a deployment provider. Only an enabled binding admits creates, template listing, and data routes for the universe.
 
 - Access: `{"kind":"deployment"}`
 - Group: `deployment/environment-providers`
@@ -1812,7 +1838,7 @@ Creates or replaces one universe's complete revisioned routing and admission bin
 
 **Delete an environment provider binding**
 
-Deletes a universe provider binding only after every referencing environment has reached Closed.
+Deletes a universe's binding to a provider only when the universe has no non-closed environment of that provider.
 
 - Access: `{"kind":"deployment"}`
 - Group: `deployment/environment-providers`
@@ -1821,19 +1847,6 @@ Deletes a universe provider binding only after every referencing environment has
 - Params: `DeploymentProviderBindingDeleteParams`
 - Result: `AgentApiOutcome<DeploymentProviderBindingDeleteResponse>`
 
-### `deployment/environments/adopt`
-
-**Adopt a provider environment**
-
-Creates a universe environment by transferring an existing provider target into Lightspeed's managed lifecycle. The caller must explicitly accept ownership transfer.
-
-- Access: `{"kind":"deployment"}`
-- Group: `deployment/environment-providers`
-- Role: `none`
-- Target: `none`
-- Params: `DeploymentEnvironmentAdoptParams`
-- Result: `AgentApiOutcome<DeploymentEnvironmentAdoptResponse>`
-
 ### `deployment/channels/accounts/list`
 
 **List channel accounts across universes**
diff --git a/crates/api/contract/api.schema.json b/crates/api/contract/api.schema.json
index f36246cf9..2fa7322b8 100644
--- a/crates/api/contract/api.schema.json
+++ b/crates/api/contract/api.schema.json
@@ -139,7 +139,7 @@
         },
         {
           "const": "environment_not_ready",
-          "description": "The environment exists but is not reachable yet: it is still\nprovisioning/booting, or it was powered down and a wake (desired\npower `running`) has been initiated by this request. Distinct from\n`Rejected` so clients retry with backoff instead of failing —\npolling and automation callers lean on this for wake-on-use.",
+          "description": "The environment exists but is not reachable yet: it is still\nprovisioning, its provider is waking or booting it after a data\nroute dial, or its registered daemon is reconnecting. Distinct from\n`Rejected` so clients retry with backoff instead of failing —\npolling and automation callers lean on this for wake-on-use.",
           "type": "string"
         },
         {
@@ -1084,23 +1084,6 @@
       ],
       "type": "object"
     },
-    "AgentApiOutcomeOfDeploymentEnvironmentAdoptResponse": {
-      "properties": {
-        "notifications": {
-          "items": {
-            "$ref": "#/definitions/AgentNotification"
-          },
-          "type": "array"
-        },
-        "result": {
-          "$ref": "#/definitions/DeploymentEnvironmentAdoptResponse"
-        }
-      },
-      "required": [
-        "result"
-      ],
-      "type": "object"
-    },
     "AgentApiOutcomeOfDeploymentEnvironmentProviderDeleteResponse": {
       "properties": {
         "notifications": {
@@ -1390,23 +1373,6 @@
       ],
       "type": "object"
     },
-    "AgentApiOutcomeOfEnvironmentIdlePolicyPutResponse": {
-      "properties": {
-        "notifications": {
-          "items": {
-            "$ref": "#/definitions/AgentNotification"
-          },
-          "type": "array"
-        },
-        "result": {
-          "$ref": "#/definitions/EnvironmentIdlePolicyPutResponse"
-        }
-      },
-      "required": [
-        "result"
-      ],
-      "type": "object"
-    },
     "AgentApiOutcomeOfEnvironmentIngressPutResponse": {
       "properties": {
         "notifications": {
@@ -1628,6 +1594,40 @@
       ],
       "type": "object"
     },
+    "AgentApiOutcomeOfEnvironmentRegistrationKeyRotateResponse": {
+      "properties": {
+        "notifications": {
+          "items": {
+            "$ref": "#/definitions/AgentNotification"
+          },
+          "type": "array"
+        },
+        "result": {
+          "$ref": "#/definitions/EnvironmentRegistrationKeyRotateResponse"
+        }
+      },
+      "required": [
+        "result"
+      ],
+      "type": "object"
+    },
+    "AgentApiOutcomeOfEnvironmentRegistrationKeyUpdateResponse": {
+      "properties": {
+        "notifications": {
+          "items": {
+            "$ref": "#/definitions/AgentNotification"
+          },
+          "type": "array"
+        },
+        "result": {
+          "$ref": "#/definitions/EnvironmentRegistrationKeyUpdateResponse"
+        }
+      },
+      "required": [
+        "result"
+      ],
+      "type": "object"
+    },
     "AgentApiOutcomeOfEnvironmentTemplateListResponse": {
       "properties": {
         "notifications": {
@@ -1662,6 +1662,23 @@
       ],
       "type": "object"
     },
+    "AgentApiOutcomeOfEnvironmentUpdateResponse": {
+      "properties": {
+        "notifications": {
+          "items": {
+            "$ref": "#/definitions/AgentNotification"
+          },
+          "type": "array"
+        },
+        "result": {
+          "$ref": "#/definitions/EnvironmentUpdateResponse"
+        }
+      },
+      "required": [
+        "result"
+      ],
+      "type": "object"
+    },
     "AgentApiOutcomeOfInitializeResponse": {
       "properties": {
         "notifications": {
@@ -8710,59 +8727,6 @@
       ],
       "type": "object"
     },
-    "DeploymentEnvironmentAdoptParams": {
-      "properties": {
-        "bindingId": {
-          "type": "string"
-        },
-        "displayName": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "metadata": {
-          "additionalProperties": {
-            "type": "string"
-          },
-          "type": "object"
-        },
-        "requestId": {
-          "description": "Stable caller-generated retry identity inside the destination universe.",
-          "type": "string"
-        },
-        "sourceTarget": {
-          "description": "Provider-native source reference. The Incus provider accepts\n`<project>/<instance>` or an instance name in the `default` project.",
-          "type": "string"
-        },
-        "takeOwnership": {
-          "description": "Required acknowledgement that Lightspeed will move, reconfigure, and\ndelete the target as part of its ordinary managed lifecycle.",
-          "type": "boolean"
-        },
-        "universeId": {
-          "type": "string"
-        }
-      },
-      "required": [
-        "universeId",
-        "requestId",
-        "bindingId",
-        "sourceTarget",
-        "takeOwnership"
-      ],
-      "type": "object"
-    },
-    "DeploymentEnvironmentAdoptResponse": {
-      "properties": {
-        "environment": {
-          "$ref": "#/definitions/EnvironmentView"
-        }
-      },
-      "required": [
-        "environment"
-      ],
-      "type": "object"
-    },
     "DeploymentEnvironmentProviderDeleteParams": {
       "properties": {
         "providerId": {
@@ -8785,24 +8749,6 @@
       ],
       "type": "object"
     },
-    "DeploymentEnvironmentProviderFeaturesView": {
-      "description": "Optional controller methods the provider's controller advertised.",
-      "properties": {
-        "adoptTarget": {
-          "description": "Existing targets can be adopted (`environment/adopt`).",
-          "type": "boolean"
-        },
-        "ingress": {
-          "description": "Public ingress can be enabled on environments.",
-          "type": "boolean"
-        }
-      },
-      "required": [
-        "adoptTarget",
-        "ingress"
-      ],
-      "type": "object"
-    },
     "DeploymentEnvironmentProviderListParams": {
       "type": "object"
     },
@@ -8821,30 +8767,35 @@
       "type": "object"
     },
     "DeploymentEnvironmentProviderPutParams": {
-      "description": "Register or replace a provider. `credential` is the bearer token\nLightspeed presents to the provider's controller and data routes: it is\nsealed on receipt and never returned by any method. `Debug` output\nredacts it; request logging must never echo these params.",
+      "description": "Register or replace a provider. `credential` is the optional bearer\ntoken Lightspeed presents to the provider's controller and data routes:\nit is sealed on receipt and never returned by any method. `Debug` output\nredacts it; request logging must never echo these params.",
       "properties": {
+        "clearCredential": {
+          "description": "Remove the stored credential. Excludes `credential`.",
+          "type": "boolean"
+        },
         "controllerEndpoint": {
           "description": "`ws://`, `wss://` or `unix://` URL of the provider controller.",
           "type": "string"
         },
         "credential": {
-          "description": "Required when the provider is new; omit to keep the stored one.",
+          "description": "A new bearer credential; omit to keep the stored one. A provider needs\nnone. Excludes `clearCredential`.",
           "type": [
             "string",
             "null"
           ]
         },
-        "displayName": {
+        "dataRouteBase": {
+          "description": "`ws://` or `wss://` base of the provider's data routes; omit to derive\nit from the controller endpoint. Required for a `unix://` controller,\nand must not be `ws://` for a `wss://` controller.",
           "type": [
             "string",
             "null"
           ]
         },
-        "metadata": {
-          "additionalProperties": {
-            "type": "string"
-          },
-          "type": "object"
+        "displayName": {
+          "type": [
+            "string",
+            "null"
+          ]
         },
         "providerId": {
           "type": "string"
@@ -8895,23 +8846,12 @@
           "description": "`ws://`, `wss://` or `unix://` URL of the provider controller.",
           "type": "string"
         },
-        "controllerFeatures": {
-          "anyOf": [
-            {
-              "$ref": "#/definitions/DeploymentEnvironmentProviderFeaturesView"
-            },
-            {
-              "type": "null"
-            }
-          ],
-          "description": "What the controller advertised at its last successful handshake;\nabsent until Lightspeed first reached it at this endpoint."
-        },
         "createdAtMs": {
           "format": "int64",
           "type": "integer"
         },
         "dataRouteBase": {
-          "description": "Base URL of the provider's data routes, as its controller advertised\nit; absent until then.",
+          "description": "Operator-configured `ws://` or `wss://` base of the provider's data\nroutes; absent derives it from the controller endpoint.",
           "type": [
             "string",
             "null"
@@ -8923,11 +8863,16 @@
             "null"
           ]
         },
-        "metadata": {
-          "additionalProperties": {
-            "type": "string"
-          },
-          "type": "object"
+        "effectiveDataRouteBase": {
+          "description": "The data route base Lightspeed dials: `dataRouteBase`, or the\ncontroller endpoint's origin followed by `/routes`. Absent only when it\ncannot be derived.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "hasCredential": {
+          "description": "A bearer credential is stored and presented to the controller and\ndata routes; without one no `Authorization` header is sent.",
+          "type": "boolean"
         },
         "providerId": {
           "type": "string"
@@ -8940,6 +8885,7 @@
       "required": [
         "providerId",
         "controllerEndpoint",
+        "hasCredential",
         "createdAtMs",
         "updatedAtMs"
       ],
@@ -8947,7 +8893,7 @@
     },
     "DeploymentProviderBindingDeleteParams": {
       "properties": {
-        "bindingId": {
+        "providerId": {
           "type": "string"
         },
         "universeId": {
@@ -8956,7 +8902,7 @@
       },
       "required": [
         "universeId",
-        "bindingId"
+        "providerId"
       ],
       "type": "object"
     },
@@ -8972,39 +8918,23 @@
       "type": "object"
     },
     "DeploymentProviderBindingPutParams": {
+      "description": "Create or replace a universe's binding to a deployment provider.",
       "properties": {
-        "bindingId": {
-          "type": "string"
-        },
-        "expectedRevision": {
-          "format": "uint64",
-          "minimum": 0,
-          "type": [
-            "integer",
-            "null"
-          ]
-        },
-        "metadata": {
-          "additionalProperties": {
-            "type": "string"
-          },
-          "type": "object"
+        "enabled": {
+          "description": "Admits creates, template listing and data routes for the universe.",
+          "type": "boolean"
         },
         "providerId": {
           "type": "string"
         },
-        "status": {
-          "$ref": "#/definitions/EnvironmentProviderBindingStatusView"
-        },
         "universeId": {
           "type": "string"
         }
       },
       "required": [
         "universeId",
-        "bindingId",
         "providerId",
-        "status"
+        "enabled"
       ],
       "type": "object"
     },
@@ -9291,6 +9221,41 @@
       ],
       "type": "object"
     },
+    "EnvironmentCloseReasonView": {
+      "description": "Why an environment is closing or closed.",
+      "oneOf": [
+        {
+          "const": "requested",
+          "description": "`environments/close`.",
+          "type": "string"
+        },
+        {
+          "const": "keyRevoked",
+          "description": "Its registration key was revoked with `closeEnvironments`.",
+          "type": "string"
+        },
+        {
+          "const": "ephemeralGrace",
+          "description": "Its ephemeral daemon stayed away longer than the key's disconnect\ngrace.",
+          "type": "string"
+        },
+        {
+          "const": "departed",
+          "description": "Its ephemeral daemon said goodbye.",
+          "type": "string"
+        },
+        {
+          "const": "offlineTimeout",
+          "description": "Its persistent daemon stayed away longer than the key's\n`offlineCloseAfterMs`.",
+          "type": "string"
+        },
+        {
+          "const": "providerEnded",
+          "description": "The provider reported the target closed or gone.",
+          "type": "string"
+        }
+      ]
+    },
     "EnvironmentCloseResponse": {
       "properties": {
         "environment": {
@@ -9304,16 +9269,13 @@
     },
     "EnvironmentCreateParams": {
       "properties": {
-        "bindingId": {
-          "type": "string"
-        },
         "displayName": {
           "type": [
             "string",
             "null"
           ]
         },
-        "idlePolicy": {
+        "idle": {
           "anyOf": [
             {
               "$ref": "#/definitions/EnvironmentIdlePolicyView"
@@ -9322,7 +9284,7 @@
               "type": "null"
             }
           ],
-          "description": "Optional staged idle policy applied by the power reaper."
+          "description": "Idle policy passed to the provider in place of the template's `idle`.\nThe provider runs the idle clock; it cannot be changed after create."
         },
         "metadata": {
           "additionalProperties": {
@@ -9330,18 +9292,22 @@
           },
           "type": "object"
         },
+        "providerId": {
+          "description": "The provider to create the environment with; the universe needs an\nenabled binding to it.",
+          "type": "string"
+        },
         "requestId": {
-          "description": "Stable caller-generated retry identity, unique inside the universe.",
+          "description": "Stable caller-generated retry identity, unique inside the universe.\nRetrying with identical inputs returns the same environment.",
           "type": "string"
         },
         "templateId": {
-          "description": "Immutable provider template-version identity.",
+          "description": "The provider template to create the environment from.",
           "type": "string"
         }
       },
       "required": [
         "requestId",
-        "bindingId",
+        "providerId",
         "templateId"
       ],
       "type": "object"
@@ -9548,6 +9514,32 @@
       ],
       "type": "object"
     },
+    "EnvironmentDaemonView": {
+      "description": "The envd build serving an environment, from its registration or\nLightspeed's open handshake.",
+      "properties": {
+        "gitSha": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "protocolVersion": {
+          "format": "uint32",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "version": {
+          "type": [
+            "string",
+            "null"
+          ]
+        }
+      },
+      "required": [
+        "protocolVersion"
+      ],
+      "type": "object"
+    },
     "EnvironmentExternalCreateParams": {
       "properties": {
         "displayName": {
@@ -9567,6 +9559,7 @@
           "type": "object"
         },
         "requestId": {
+          "description": "Stable caller-generated retry identity, unique inside the universe.",
           "type": "string"
         }
       },
@@ -9588,63 +9581,31 @@
       "type": "object"
     },
     "EnvironmentIdentityModeView": {
-      "description": "What Lightspeed does with a registered environment while its daemon is\ndisconnected. Registration-key policy, copied onto each environment.",
+      "description": "What happens to a registered environment while its daemon is\ndisconnected. Policy of the registration key that admitted it.",
       "oneOf": [
         {
           "const": "persistent",
-          "description": "Stays offline until explicitly closed.",
+          "description": "Stays open: tools wait up to two minutes for the daemon to reconnect.\nClosed explicitly, or after the key's `offlineCloseAfterMs`.",
           "type": "string"
         },
         {
           "const": "ephemeral",
-          "description": "Closed once the daemon has been away longer than the key's\ndisconnect grace.",
+          "description": "Unusable while disconnected; closed once the daemon has been away\nlonger than the key's disconnect grace, or at once when it says\ngoodbye.",
           "type": "string"
         }
       ]
     },
-    "EnvironmentIdlePolicyPutParams": {
+    "EnvironmentIdlePolicyView": {
+      "additionalProperties": false,
+      "description": "Staged idle policy the provider applies. Thresholds are milliseconds of\nenvd-reported idle time (running processes, jobs and leftover process\ngroups hold it at zero) and must be non-decreasing in the order pause,\nsuspend, stop, close. Stages whose power state the template does not\nsupport are skipped.",
       "properties": {
-        "environmentId": {
-          "type": "string"
-        },
-        "idlePolicy": {
-          "anyOf": [
-            {
-              "$ref": "#/definitions/EnvironmentIdlePolicyView"
-            },
-            {
-              "type": "null"
-            }
-          ],
-          "description": "The complete new policy; omit to clear it."
-        }
-      },
-      "required": [
-        "environmentId"
-      ],
-      "type": "object"
-    },
-    "EnvironmentIdlePolicyPutResponse": {
-      "properties": {
-        "environment": {
-          "$ref": "#/definitions/EnvironmentView"
-        }
-      },
-      "required": [
-        "environment"
-      ],
-      "type": "object"
-    },
-    "EnvironmentIdlePolicyView": {
-      "description": "Staged idle policy. Thresholds are milliseconds of daemon-reported idle\ntime and must be non-decreasing in the order pause, suspend, stop, close.\nStages whose power state the provider does not support are skipped.",
-      "properties": {
-        "closeAfterMs": {
-          "format": "uint64",
-          "minimum": 0,
-          "type": [
-            "integer",
-            "null"
-          ]
+        "closeAfterMs": {
+          "format": "uint64",
+          "minimum": 0,
+          "type": [
+            "integer",
+            "null"
+          ]
         },
         "pauseAfterMs": {
           "format": "uint64",
@@ -9673,55 +9634,10 @@
       },
       "type": "object"
     },
-    "EnvironmentIncarnationView": {
-      "properties": {
-        "createdAtMs": {
-          "format": "int64",
-          "type": "integer"
-        },
-        "incarnationId": {
-          "type": "string"
-        },
-        "powerStates": {
-          "description": "Power states the provider reported for this target; empty until\nobserved or when the provider offers no power control.",
-          "items": {
-            "$ref": "#/definitions/EnvironmentPowerStateView"
-          },
-          "type": "array"
-        },
-        "providerTargetId": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "provisionRequestId": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "templateId": {
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "updatedAtMs": {
-          "format": "int64",
-          "type": "integer"
-        }
-      },
-      "required": [
-        "incarnationId",
-        "createdAtMs",
-        "updatedAtMs"
-      ],
-      "type": "object"
-    },
     "EnvironmentIngressPutParams": {
       "properties": {
         "enabled": {
+          "description": "Ensure (`true`) or remove (`false`) the provider's public ingress.",
           "type": "boolean"
         },
         "environmentId": {
@@ -9880,68 +9796,29 @@
       },
       "type": "object"
     },
-    "EnvironmentLifecycleErrorView": {
-      "properties": {
-        "firstAtMs": {
-          "description": "When the current run of errors began.",
-          "format": "int64",
-          "type": "integer"
-        },
-        "lastAtMs": {
-          "description": "When `message` was recorded.",
-          "format": "int64",
-          "type": "integer"
-        },
-        "message": {
-          "type": "string"
-        }
-      },
-      "required": [
-        "message",
-        "firstAtMs",
-        "lastAtMs"
-      ],
-      "type": "object"
-    },
-    "EnvironmentLifecycleStatusView": {
-      "oneOf": [
-        {
-          "enum": [
-            "provisioning",
-            "booting",
-            "ready",
-            "closing",
-            "closed",
-            "failed",
-            "unknown"
-          ],
-          "type": "string"
-        },
-        {
-          "const": "paused",
-          "description": "Execution frozen; wakes on next use.",
-          "type": "string"
-        },
-        {
-          "const": "suspended",
-          "description": "Execution state saved to disk; wakes on next use.",
-          "type": "string"
-        },
-        {
-          "const": "offline",
-          "description": "Powered off; provisioned environments wake on next use when the\nprovider supports power control.",
-          "type": "string"
-        }
-      ]
-    },
     "EnvironmentListParams": {
       "properties": {
-        "bindingId": {
+        "after": {
+          "description": "Exclusive environment id cursor: a previous page's `nextAfter`.",
           "type": [
             "string",
             "null"
           ]
         },
+        "includeClosed": {
+          "description": "Also list closed environments; they are omitted by default.",
+          "type": "boolean"
+        },
+        "limit": {
+          "description": "Most environments per page; omit for 100.",
+          "format": "uint32",
+          "maximum": 500,
+          "minimum": 1,
+          "type": [
+            "integer",
+            "null"
+          ]
+        },
         "metadata": {
           "additionalProperties": {
             "type": "string"
@@ -9950,6 +9827,7 @@
           "type": "object"
         },
         "providerId": {
+          "description": "Only provisioned environments of this provider.",
           "type": [
             "string",
             "null"
@@ -9962,15 +9840,16 @@
             "null"
           ]
         },
-        "status": {
+        "state": {
           "anyOf": [
             {
-              "$ref": "#/definitions/EnvironmentLifecycleStatusView"
+              "$ref": "#/definitions/EnvironmentStateView"
             },
             {
               "type": "null"
             }
-          ]
+          ],
+          "description": "Only environments in this lifecycle state. `closed` lists closed\nenvironments without `includeClosed`."
         }
       },
       "type": "object"
@@ -9979,14 +9858,56 @@
       "properties": {
         "environments": {
           "default": [],
+          "description": "Environments in environment id order.",
           "items": {
             "$ref": "#/definitions/EnvironmentView"
           },
           "type": "array"
+        },
+        "nextAfter": {
+          "description": "Pass as `after` to read the next page; absent on the last page.",
+          "type": [
+            "string",
+            "null"
+          ]
         }
       },
       "type": "object"
     },
+    "EnvironmentObservedTargetView": {
+      "description": "What the provider last reported about a provisioned environment's\ntarget. Display only: Lightspeed never converges it, and it may be up to\na few minutes old.",
+      "properties": {
+        "message": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "observedAtMs": {
+          "format": "int64",
+          "type": "integer"
+        },
+        "phase": {
+          "$ref": "#/definitions/EnvironmentTargetPhaseView"
+        },
+        "power": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/EnvironmentPowerStateView"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Present only while `phase` is `active`."
+        }
+      },
+      "required": [
+        "phase",
+        "observedAtMs"
+      ],
+      "type": "object"
+    },
     "EnvironmentPowerPutParams": {
       "properties": {
         "environmentId": {
@@ -9998,7 +9919,7 @@
               "$ref": "#/definitions/EnvironmentPowerStateView"
             }
           ],
-          "description": "Desired steady power state. Must be one of the provider-reported\n`incarnation.powerStates`."
+          "description": "Power state to move the target to; one of its template's\n`powerStates`."
         }
       },
       "required": [
@@ -10019,7 +9940,7 @@
       "type": "object"
     },
     "EnvironmentPowerStateView": {
-      "description": "Steady power state of a provisioned environment.",
+      "description": "Power state of a provisioned environment's target.",
       "oneOf": [
         {
           "enum": [
@@ -10081,12 +10002,12 @@
     },
     "EnvironmentProviderBindingReadParams": {
       "properties": {
-        "bindingId": {
+        "providerId": {
           "type": "string"
         }
       },
       "required": [
-        "bindingId"
+        "providerId"
       ],
       "type": "object"
     },
@@ -10101,49 +10022,27 @@
       ],
       "type": "object"
     },
-    "EnvironmentProviderBindingStatusView": {
-      "enum": [
-        "enabled",
-        "disabled"
-      ],
-      "type": "string"
-    },
     "EnvironmentProviderBindingView": {
+      "description": "A universe's binding to a deployment provider. Creates, templates and\ndata routes of the provider need it enabled.",
       "properties": {
-        "bindingId": {
-          "type": "string"
-        },
         "createdAtMs": {
           "format": "int64",
           "type": "integer"
         },
-        "metadata": {
-          "additionalProperties": {
-            "type": "string"
-          },
-          "type": "object"
+        "enabled": {
+          "type": "boolean"
         },
         "providerId": {
           "type": "string"
         },
-        "revision": {
-          "format": "uint64",
-          "minimum": 0,
-          "type": "integer"
-        },
-        "status": {
-          "$ref": "#/definitions/EnvironmentProviderBindingStatusView"
-        },
         "updatedAtMs": {
           "format": "int64",
           "type": "integer"
         }
       },
       "required": [
-        "bindingId",
         "providerId",
-        "status",
-        "revision",
+        "enabled",
         "createdAtMs",
         "updatedAtMs"
       ],
@@ -10194,7 +10093,12 @@
           ]
         },
         "identityMode": {
-          "$ref": "#/definitions/EnvironmentIdentityModeView"
+          "allOf": [
+            {
+              "$ref": "#/definitions/EnvironmentIdentityModeView"
+            }
+          ],
+          "description": "Immutable once the key exists."
         },
         "maxActiveEnvironments": {
           "description": "Non-closed environments the key may have at once; omit for unlimited.",
@@ -10204,6 +10108,15 @@
             "integer",
             "null"
           ]
+        },
+        "offlineCloseAfterMs": {
+          "description": "Persistent keys only: close environments whose daemon has been away\nlonger than this; omit to keep them open.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": [
+            "integer",
+            "null"
+          ]
         }
       },
       "required": [
@@ -10303,6 +10216,37 @@
       ],
       "type": "object"
     },
+    "EnvironmentRegistrationKeyRotateParams": {
+      "properties": {
+        "registrationKeyId": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "registrationKeyId"
+      ],
+      "type": "object"
+    },
+    "EnvironmentRegistrationKeyRotateResponse": {
+      "properties": {
+        "registrationKey": {
+          "$ref": "#/definitions/EnvironmentRegistrationKeyView"
+        },
+        "secret": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/EnvironmentRegistrationSecretView"
+            }
+          ],
+          "description": "The new plaintext secret, returned only here."
+        }
+      },
+      "required": [
+        "registrationKey",
+        "secret"
+      ],
+      "type": "object"
+    },
     "EnvironmentRegistrationKeyStatusView": {
       "enum": [
         "active",
@@ -10311,6 +10255,68 @@
       ],
       "type": "string"
     },
+    "EnvironmentRegistrationKeyUpdateParams": {
+      "description": "The complete editable policy of a registration key; an absent field is\nunset. The identity mode is immutable.",
+      "properties": {
+        "displayName": {
+          "description": "Group name for the environments this key admits.",
+          "type": "string"
+        },
+        "ephemeralDisconnectGraceMs": {
+          "description": "Disconnect grace for ephemeral environments; omit for the default.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": [
+            "integer",
+            "null"
+          ]
+        },
+        "expiresAtMs": {
+          "format": "int64",
+          "type": [
+            "integer",
+            "null"
+          ]
+        },
+        "maxActiveEnvironments": {
+          "description": "Non-closed environments the key may have at once; omit for unlimited.",
+          "format": "uint32",
+          "minimum": 0,
+          "type": [
+            "integer",
+            "null"
+          ]
+        },
+        "offlineCloseAfterMs": {
+          "description": "Persistent keys only: close environments whose daemon has been away\nlonger than this; omit to keep them open.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": [
+            "integer",
+            "null"
+          ]
+        },
+        "registrationKeyId": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "registrationKeyId",
+        "displayName"
+      ],
+      "type": "object"
+    },
+    "EnvironmentRegistrationKeyUpdateResponse": {
+      "properties": {
+        "registrationKey": {
+          "$ref": "#/definitions/EnvironmentRegistrationKeyView"
+        }
+      },
+      "required": [
+        "registrationKey"
+      ],
+      "type": "object"
+    },
     "EnvironmentRegistrationKeyView": {
       "properties": {
         "activeEnvironmentCount": {
@@ -10344,7 +10350,7 @@
           "$ref": "#/definitions/EnvironmentIdentityModeView"
         },
         "keyPrefix": {
-          "description": "First characters of the secret, for identification only.",
+          "description": "First characters of the key's live secret, for identification only.",
           "type": "string"
         },
         "lastRegisteredAtMs": {
@@ -10362,6 +10368,15 @@
             "null"
           ]
         },
+        "offlineCloseAfterMs": {
+          "description": "Persistent keys only: environments whose daemon has been away longer\nthan this are closed; absent keeps them open.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": [
+            "integer",
+            "null"
+          ]
+        },
         "registeredEnvironmentCount": {
           "description": "Environments ever admitted by this key, closed included.",
           "format": "uint64",
@@ -10380,6 +10395,10 @@
         },
         "status": {
           "$ref": "#/definitions/EnvironmentRegistrationKeyStatusView"
+        },
+        "updatedAtMs": {
+          "format": "int64",
+          "type": "integer"
         }
       },
       "required": [
@@ -10391,7 +10410,8 @@
         "status",
         "registeredEnvironmentCount",
         "activeEnvironmentCount",
-        "createdAtMs"
+        "createdAtMs",
+        "updatedAtMs"
       ],
       "type": "object"
     },
@@ -10420,13 +10440,50 @@
     "EnvironmentSourceView": {
       "oneOf": [
         {
+          "description": "A target a deployment provider created from a template. The provider\nowns its power, idle policy and ingress.",
           "properties": {
-            "bindingId": {
-              "type": "string"
+            "idle": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/EnvironmentIdlePolicyView"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "description": "The create-time idle policy, when one replaced the template's."
+            },
+            "observed": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/EnvironmentObservedTargetView"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "description": "Absent until the provider first reported the target."
             },
             "providerId": {
               "type": "string"
             },
+            "publicEndpoint": {
+              "description": "The public endpoint the provider last reported.",
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "targetId": {
+              "description": "The provider's handle for the target; absent until the provider\naccepted the create.",
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "templateId": {
+              "type": "string"
+            },
             "type": {
               "const": "provisioned",
               "type": "string"
@@ -10435,7 +10492,7 @@
           "required": [
             "type",
             "providerId",
-            "bindingId"
+            "templateId"
           ],
           "type": "object"
         },
@@ -10459,11 +10516,30 @@
         {
           "description": "An envd that dialed the gateway outbound and was admitted by a\nregistration key. The key is the environment's group; the daemon id\nis derived from the daemon's public key and is its identity.",
           "properties": {
+            "connected": {
+              "description": "The daemon's control connection is up.",
+              "type": "boolean"
+            },
+            "connectionChangedAtMs": {
+              "description": "When the daemon last connected or disconnected.",
+              "format": "int64",
+              "type": "integer"
+            },
             "daemonId": {
               "type": "string"
             },
             "identityMode": {
-              "$ref": "#/definitions/EnvironmentIdentityModeView"
+              "allOf": [
+                {
+                  "$ref": "#/definitions/EnvironmentIdentityModeView"
+                }
+              ],
+              "description": "The admitting key's identity mode."
+            },
+            "lastSeenAtMs": {
+              "description": "When the gateway last recorded the daemon's control connection:\nat connect, at disconnect, and at most every five minutes while\nconnected.",
+              "format": "int64",
+              "type": "integer"
             },
             "registrationKeyId": {
               "type": "string"
@@ -10477,15 +10553,98 @@
             "type",
             "registrationKeyId",
             "daemonId",
-            "identityMode"
+            "identityMode",
+            "connected",
+            "connectionChangedAtMs",
+            "lastSeenAtMs"
           ],
           "type": "object"
         }
       ]
     },
+    "EnvironmentStateView": {
+      "description": "The lifecycle Lightspeed owns. External and registered environments are\nonly ever `open` or `closed`.",
+      "oneOf": [
+        {
+          "enum": [
+            "open",
+            "closed"
+          ],
+          "type": "string"
+        },
+        {
+          "const": "provisioning",
+          "description": "The provider is creating the target; the environment opens after\nLightspeed's first handshake with its envd.",
+          "type": "string"
+        },
+        {
+          "const": "closing",
+          "description": "The provider is removing the target.",
+          "type": "string"
+        },
+        {
+          "const": "failed",
+          "description": "Provisioning or the provider failed; `stateMessage` says why.",
+          "type": "string"
+        }
+      ]
+    },
+    "EnvironmentStatusView": {
+      "description": "Display status derived from `state` and the latest observation; never\nstored. Tools that use a paused, suspended or stopped environment wake\nit.",
+      "oneOf": [
+        {
+          "enum": [
+            "provisioning",
+            "ready",
+            "closing",
+            "closed",
+            "failed"
+          ],
+          "type": "string"
+        },
+        {
+          "const": "paused",
+          "description": "Execution frozen with RAM resident.",
+          "type": "string"
+        },
+        {
+          "const": "suspended",
+          "description": "Execution state saved to disk.",
+          "type": "string"
+        },
+        {
+          "const": "stopped",
+          "description": "Powered off with disk retained.",
+          "type": "string"
+        },
+        {
+          "const": "unknown",
+          "description": "Open, but the provider's latest observation is inconclusive.",
+          "type": "string"
+        },
+        {
+          "const": "away",
+          "description": "Registered, open, and its daemon is not connected.",
+          "type": "string"
+        }
+      ]
+    },
+    "EnvironmentTargetPhaseView": {
+      "description": "Lifecycle phase of a provider target, as the provider reports it.",
+      "enum": [
+        "provisioning",
+        "active",
+        "closing",
+        "closed",
+        "failed",
+        "unknown"
+      ],
+      "type": "string"
+    },
     "EnvironmentTemplateListParams": {
       "properties": {
-        "bindingId": {
+        "providerId": {
+          "description": "Only this provider's templates; omit for every enabled binding.",
           "type": [
             "string",
             "null"
@@ -10510,7 +10669,7 @@
     },
     "EnvironmentTemplateReadParams": {
       "properties": {
-        "bindingId": {
+        "providerId": {
           "type": "string"
         },
         "templateId": {
@@ -10518,7 +10677,7 @@
         }
       },
       "required": [
-        "bindingId",
+        "providerId",
         "templateId"
       ],
       "type": "object"
@@ -10566,9 +10725,6 @@
     },
     "EnvironmentTemplateView": {
       "properties": {
-        "bindingId": {
-          "type": "string"
-        },
         "deprecated": {
           "type": "boolean"
         },
@@ -10581,16 +10737,35 @@
         "displayName": {
           "type": "string"
         },
+        "idle": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/EnvironmentIdlePolicyView"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Idle policy targets get when `environments/create` names none."
+        },
         "metadata": {
           "additionalProperties": {
             "type": "string"
           },
           "type": "object"
         },
+        "powerStates": {
+          "description": "Power states `environments/power/put` can move targets of this\ntemplate to; empty without power control.",
+          "items": {
+            "$ref": "#/definitions/EnvironmentPowerStateView"
+          },
+          "type": "array"
+        },
         "providerId": {
           "type": "string"
         },
         "publicIngress": {
+          "description": "`environments/ingress/put` can enable public ingress on targets of\nthis template.",
           "type": "boolean"
         },
         "resources": {
@@ -10611,28 +10786,18 @@
       "required": [
         "templateId",
         "providerId",
-        "bindingId",
         "displayName",
         "publicIngress",
-        "deprecated"
+        "deprecated",
+        "powerStates"
       ],
       "type": "object"
     },
-    "EnvironmentView": {
+    "EnvironmentUpdateParams": {
+      "description": "Replace an environment's display name and caller metadata.",
       "properties": {
-        "createdAtMs": {
-          "format": "int64",
-          "type": "integer"
-        },
-        "desiredPower": {
-          "allOf": [
-            {
-              "$ref": "#/definitions/EnvironmentPowerStateView"
-            }
-          ],
-          "description": "Lightspeed-owned power intent; `status` is the observed state."
-        },
         "displayName": {
+          "description": "The new display name; omit to clear it.",
           "type": [
             "string",
             "null"
@@ -10641,63 +10806,108 @@
         "environmentId": {
           "type": "string"
         },
-        "idlePolicy": {
+        "metadata": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "The complete new caller metadata; omit or `{}` to clear it.",
+          "type": "object"
+        }
+      },
+      "required": [
+        "environmentId"
+      ],
+      "type": "object"
+    },
+    "EnvironmentUpdateResponse": {
+      "properties": {
+        "environment": {
+          "$ref": "#/definitions/EnvironmentView"
+        }
+      },
+      "required": [
+        "environment"
+      ],
+      "type": "object"
+    },
+    "EnvironmentView": {
+      "properties": {
+        "closeReason": {
           "anyOf": [
             {
-              "$ref": "#/definitions/EnvironmentIdlePolicyView"
+              "$ref": "#/definitions/EnvironmentCloseReasonView"
             },
             {
               "type": "null"
             }
-          ]
-        },
-        "incarnation": {
-          "$ref": "#/definitions/EnvironmentIncarnationView"
+          ],
+          "description": "Present exactly while `state` is `closing` or `closed`."
         },
-        "lastSeenAtMs": {
-          "description": "Registered environments only: when the gateway last saw the daemon's\ncontrol connection.",
+        "closedAtMs": {
           "format": "int64",
           "type": [
             "integer",
             "null"
           ]
         },
-        "lifecycleError": {
+        "createdAtMs": {
+          "format": "int64",
+          "type": "integer"
+        },
+        "daemon": {
           "anyOf": [
             {
-              "$ref": "#/definitions/EnvironmentLifecycleErrorView"
+              "$ref": "#/definitions/EnvironmentDaemonView"
             },
             {
               "type": "null"
             }
           ],
-          "description": "Why the environment failed, or the latest error (or what the\nprovider reports it is waiting on) while its lifecycle converges;\nabsent once it reaches a steady state."
+          "description": "The envd build serving the environment; absent until known."
+        },
+        "displayName": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "environmentId": {
+          "type": "string"
         },
         "metadata": {
           "additionalProperties": {
             "type": "string"
           },
+          "description": "Caller metadata.",
           "type": "object"
         },
-        "publicEndpoint": {
-          "description": "The public endpoint the provider last reported. It lags\n`publicIngressEnabled` while the lifecycle reconciler converges.",
+        "requestId": {
+          "description": "The caller's retry identity; absent for registered environments.",
           "type": [
             "string",
             "null"
           ]
         },
-        "publicIngressEnabled": {
-          "description": "Lightspeed-owned public ingress intent; `publicEndpoint` is what the\nprovider realized.",
-          "type": "boolean"
-        },
-        "requestId": {
-          "type": "string"
-        },
         "source": {
           "$ref": "#/definitions/EnvironmentSourceView"
         },
+        "state": {
+          "$ref": "#/definitions/EnvironmentStateView"
+        },
+        "stateChangedAtMs": {
+          "description": "When `state` last changed.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "stateMessage": {
+          "description": "Why the environment failed, or what provisioning or closing is\nwaiting on.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
         "status": {
-          "$ref": "#/definitions/EnvironmentLifecycleStatusView"
+          "$ref": "#/definitions/EnvironmentStatusView"
         },
         "updatedAtMs": {
           "format": "int64",
@@ -10706,12 +10916,10 @@
       },
       "required": [
         "environmentId",
-        "requestId",
         "source",
+        "state",
         "status",
-        "desiredPower",
-        "incarnation",
-        "publicIngressEnabled",
+        "stateChangedAtMs",
         "createdAtMs",
         "updatedAtMs"
       ],
@@ -12282,7 +12490,7 @@
         },
         {
           "const": "deployment/environment-providers",
-          "description": "Environment providers, their bindings and adoption.",
+          "description": "Environment providers and their universe bindings.",
           "type": "string"
         },
         {
diff --git a/crates/api/contract/methods.json b/crates/api/contract/methods.json
index 201b46ab2..3f3e262ba 100644
--- a/crates/api/contract/methods.json
+++ b/crates/api/contract/methods.json
@@ -779,7 +779,7 @@
         "action": "configure_resource",
         "kind": "universe"
       },
-      "description": "Records an idempotent provisioning intent against an enabled universe binding, attributed to the caller. The provider validates its provider-wide template and provisions through its backend asynchronously.",
+      "description": "Creates a provisioned environment, attributed to the caller, from a template of a provider enabled for the universe. Idempotent per requestId: same inputs, same environment; others conflict. Provisioning until the target's first envd handshake, then open; idle overrides the template default.",
       "group": "environments",
       "method": "environments/create",
       "params": {
@@ -804,7 +804,7 @@
         "action": "read",
         "kind": "universe"
       },
-      "description": "Returns the durable universe resource, source binding, logical lifecycle state, and minimal current-incarnation identity.",
+      "description": "Returns one environment: its source, lifecycle state, derived display status, state message, close reason, daemon build, and the latest provider observation.",
       "group": "environments",
       "method": "environments/read",
       "params": {
@@ -824,12 +824,37 @@
       "summary": "Read an environment",
       "target": null
     },
+    {
+      "access": {
+        "action": "configure_resource",
+        "kind": "universe"
+      },
+      "description": "Replaces the display name and caller metadata of an environment of any kind. Refused for a closed environment.",
+      "group": "environments",
+      "method": "environments/update",
+      "params": {
+        "schema": {
+          "$ref": "#/definitions/EnvironmentUpdateParams"
+        },
+        "type": "EnvironmentUpdateParams"
+      },
+      "result": {
+        "schema": {
+          "$ref": "#/definitions/AgentApiOutcomeOfEnvironmentUpdateResponse"
+        },
+        "type": "AgentApiOutcome<EnvironmentUpdateResponse>"
+      },
+      "role": "operator",
+      "scope": "universe",
+      "summary": "Update an environment",
+      "target": null
+    },
     {
       "access": {
         "action": "read",
         "kind": "universe"
       },
-      "description": "Lists the universe environments, optionally filtered by provider, binding, or logical lifecycle state.",
+      "description": "Lists the universe environments in id order, one page at a time, optionally filtered by provider, registration key, state, or metadata. Closed environments are omitted unless includeClosed is set or state is closed. Continue from nextAfter.",
       "group": "environments",
       "method": "environments/list",
       "params": {
@@ -854,7 +879,7 @@
         "action": "configure_resource",
         "kind": "universe"
       },
-      "description": "Records an asynchronous idempotent close intent. Provider cleanup is resumed by lifecycle reconciliation; quota is released only after Closed.",
+      "description": "Closes an environment; idempotent. A provisioned environment moves to closing while Lightspeed asks its provider to remove the target, retrying until it is gone, then closed. External and registered environments close at once, and a connected registered daemon is told its environment closed.",
       "group": "environments",
       "method": "environments/close",
       "params": {
@@ -879,7 +904,7 @@
         "action": "configure_resource",
         "kind": "universe"
       },
-      "description": "Creates an environment backed by a Lightspeed-reachable envd WebSocket endpoint, attributed to the caller. Reachability is checked on demand.",
+      "description": "Creates an open environment backed by a Lightspeed-reachable envd endpoint, attributed to the caller. Idempotent per requestId. Reachability is checked on use.",
       "group": "environments",
       "method": "environments/external/create",
       "params": {
@@ -904,7 +929,7 @@
         "action": "configure_resource",
         "kind": "universe"
       },
-      "description": "Records the public ingress intent of a provisioned environment; the lifecycle reconciler converges it while the environment is ready, and `publicEndpoint` shows the realized endpoint. Rejected when the provider does not offer ingress. The provider owns hostname, guest port, routing, TLS, and health; an intent its template refuses is dropped.",
+      "description": "Synchronously ensures or removes public ingress of an open provisioned environment through its provider; source.publicEndpoint carries the reported endpoint. Rejected when the provider offers no ingress; an internal error, safe to retry, when the provider is unreachable or times out. The provider owns hostname, guest port, routing, TLS, and health.",
       "group": "environments",
       "method": "environments/ingress/put",
       "params": {
@@ -929,7 +954,7 @@
         "action": "configure_resource",
         "kind": "universe"
       },
-      "description": "Records the desired power state (running, paused, suspended, or stopped) of a provisioned environment; the lifecycle reconciler converges the provider target asynchronously. Powered-down environments wake transparently on their next use. Rejected when the provider does not support the state.",
+      "description": "Synchronously moves an open provisioned environment's target to running, paused, suspended, or stopped via its provider and records the observation; the provider may also change power on idle. Rejected without provider power control or when the template lacks the state; an internal error, safe to retry, when the provider is unreachable or times out.",
       "group": "environments",
       "method": "environments/power/put",
       "params": {
@@ -946,32 +971,7 @@
       },
       "role": "operator",
       "scope": "universe",
-      "summary": "Set environment power intent",
-      "target": null
-    },
-    {
-      "access": {
-        "action": "configure_resource",
-        "kind": "universe"
-      },
-      "description": "Replaces or clears the staged idle policy of a provisioned environment. The power reaper measures the daemon's idle duration against the pause/suspend/stop/close thresholds and escalates through the stages the provider supports.",
-      "group": "environments",
-      "method": "environments/idle-policy/put",
-      "params": {
-        "schema": {
-          "$ref": "#/definitions/EnvironmentIdlePolicyPutParams"
-        },
-        "type": "EnvironmentIdlePolicyPutParams"
-      },
-      "result": {
-        "schema": {
-          "$ref": "#/definitions/AgentApiOutcomeOfEnvironmentIdlePolicyPutResponse"
-        },
-        "type": "AgentApiOutcome<EnvironmentIdlePolicyPutResponse>"
-      },
-      "role": "operator",
-      "scope": "universe",
-      "summary": "Set environment idle policy",
+      "summary": "Set environment power",
       "target": null
     },
     {
@@ -979,7 +979,7 @@
         "action": "read",
         "kind": "universe"
       },
-      "description": "Lists this universe's revisioned routing and admission bindings to deployment-scoped physical providers.",
+      "description": "Lists this universe's bindings to deployment providers and whether each is enabled.",
       "group": "environments",
       "method": "environments/provider-bindings/list",
       "params": {
@@ -1004,7 +1004,7 @@
         "action": "read",
         "kind": "universe"
       },
-      "description": "Returns one universe routing and admission binding. Provider-wide templates and physical resource, network, and ingress policy remain provider-owned.",
+      "description": "Returns this universe's binding to one provider. Templates and physical resource, network, and ingress policy remain provider-owned.",
       "group": "environments",
       "method": "environments/provider-bindings/read",
       "params": {
@@ -1029,7 +1029,7 @@
         "action": "read",
         "kind": "universe"
       },
-      "description": "Reads immutable templates directly from the selected bound provider controller.",
+      "description": "Reads templates live from the controllers of the universe's enabled provider bindings, or of one provider: compute, power states, public ingress, and default idle policy.",
       "group": "environments",
       "method": "environments/templates/list",
       "params": {
@@ -1054,7 +1054,7 @@
         "action": "read",
         "kind": "universe"
       },
-      "description": "Returns one immutable template version from the selected bound provider controller.",
+      "description": "Returns one template, read live from a bound provider's controller.",
       "group": "environments",
       "method": "environments/templates/read",
       "params": {
@@ -1079,7 +1079,7 @@
         "action": "use_resource",
         "kind": "universe"
       },
-      "description": "Starts a dependency-aware job group on one environment instance, injecting the environment's configured credentials at provider start. requestId is the retry identity; jobs are owned by the instance rather than a session. A powered-down environment is woken on use: the call fails with environment_not_ready while the wake is in progress; retry with backoff.",
+      "description": "Starts a dependency-aware job group on one environment instance, injecting its configured credentials at provider start. requestId is the retry identity; jobs are owned by the instance, not a session. A powered-down environment wakes on its data route; the call fails with environment_not_ready while it wakes or reconnects; retry with backoff.",
       "group": "environments",
       "method": "environments/jobs/create",
       "params": {
@@ -1154,7 +1154,7 @@
         "action": "configure_resource",
         "kind": "universe"
       },
-      "description": "Creates a reusable universe-scoped key that lets outbound envd daemons register as environments. The plaintext secret is returned exactly once; only its hash is stored. Identity mode, active limit, disconnect grace, and expiry are the key's policy. Treat the secret like a cluster-join credential.",
+      "description": "Creates a reusable universe-scoped key that lets outbound envd daemons register as environments. The plaintext secret is returned exactly once; only its hash is stored. Identity mode (immutable), active limit, disconnect grace, offline close-after, and expiry are the key's policy. Treat the secret like a cluster-join credential.",
       "group": "environments",
       "method": "environments/registration-keys/create",
       "params": {
@@ -1224,6 +1224,56 @@
       "summary": "List environment registration keys",
       "target": null
     },
+    {
+      "access": {
+        "action": "configure_resource",
+        "kind": "universe"
+      },
+      "description": "Replaces a key's editable policy: display name, active limit, disconnect grace, offline close-after, and expiry; an omitted field is unset. The identity mode is immutable. The active limit and expiry apply to later admissions; a changed disconnect grace or offline close-after applies at the next sweep to environments whose daemon is away.",
+      "group": "environments",
+      "method": "environments/registration-keys/update",
+      "params": {
+        "schema": {
+          "$ref": "#/definitions/EnvironmentRegistrationKeyUpdateParams"
+        },
+        "type": "EnvironmentRegistrationKeyUpdateParams"
+      },
+      "result": {
+        "schema": {
+          "$ref": "#/definitions/AgentApiOutcomeOfEnvironmentRegistrationKeyUpdateResponse"
+        },
+        "type": "AgentApiOutcome<EnvironmentRegistrationKeyUpdateResponse>"
+      },
+      "role": "operator",
+      "scope": "universe",
+      "summary": "Update an environment registration key",
+      "target": null
+    },
+    {
+      "access": {
+        "action": "configure_resource",
+        "kind": "universe"
+      },
+      "description": "Replaces the key's secret and display prefix and retires the old secret at once. The key keeps its id, group, policy, and the environments it admitted; daemons already registered are unaffected because they never present the key again. Returns the new secret once. Refused for a revoked key.",
+      "group": "environments",
+      "method": "environments/registration-keys/rotate",
+      "params": {
+        "schema": {
+          "$ref": "#/definitions/EnvironmentRegistrationKeyRotateParams"
+        },
+        "type": "EnvironmentRegistrationKeyRotateParams"
+      },
+      "result": {
+        "schema": {
+          "$ref": "#/definitions/AgentApiOutcomeOfEnvironmentRegistrationKeyRotateResponse"
+        },
+        "type": "AgentApiOutcome<EnvironmentRegistrationKeyRotateResponse>"
+      },
+      "role": "operator",
+      "scope": "universe",
+      "summary": "Rotate an environment registration key",
+      "target": null
+    },
     {
       "access": {
         "action": "configure_resource",
@@ -3289,7 +3339,7 @@
       "access": {
         "kind": "deployment"
       },
-      "description": "Registers or replaces one deployment provider: its controller endpoint URL and the bearer credential Lightspeed presents to the controller and data routes. The credential is write-only: required for a new provider, kept when omitted, never returned. The provider does not call this API or require access to Lightspeed.",
+      "description": "Registers or replaces a deployment provider: controller endpoint, optional data route base, and optional bearer credential for controller and data routes (write-only: kept when omitted, removed by clearCredential, never returned). The controller is probed: a definitive refusal is invalid_request, unreachable is accepted. The provider never calls Lightspeed.",
       "group": "deployment/environment-providers",
       "method": "deployment/environment-providers/put",
       "params": {
@@ -3313,7 +3363,7 @@
       "access": {
         "kind": "deployment"
       },
-      "description": "Returns every deployment-registered provider with its controller endpoint and the optional features its controller last advertised.",
+      "description": "Returns every deployment-registered provider with its controller endpoint, data route base, and whether a credential is stored.",
       "group": "deployment/environment-providers",
       "method": "deployment/environment-providers/list",
       "params": {
@@ -3337,7 +3387,7 @@
       "access": {
         "kind": "deployment"
       },
-      "description": "Returns one deployment-registered provider with its controller endpoint and the optional features its controller last advertised.",
+      "description": "Returns one deployment-registered provider with its controller endpoint, data route base, and whether a credential is stored.",
       "group": "deployment/environment-providers",
       "method": "deployment/environment-providers/read",
       "params": {
@@ -3361,7 +3411,7 @@
       "access": {
         "kind": "deployment"
       },
-      "description": "Deletes a deployment provider only when no universe binding references it.",
+      "description": "Deletes a deployment provider only when no universe binding and no non-closed environment references it.",
       "group": "deployment/environment-providers",
       "method": "deployment/environment-providers/delete",
       "params": {
@@ -3385,7 +3435,7 @@
       "access": {
         "kind": "deployment"
       },
-      "description": "Creates or replaces one universe's complete revisioned routing and admission binding. A deployment provider may have at most one binding in a universe.",
+      "description": "Creates or replaces one universe's binding to a deployment provider. Only an enabled binding admits creates, template listing, and data routes for the universe.",
       "group": "deployment/environment-providers",
       "method": "deployment/environment-providers/bindings/put",
       "params": {
@@ -3409,7 +3459,7 @@
       "access": {
         "kind": "deployment"
       },
-      "description": "Deletes a universe provider binding only after every referencing environment has reached Closed.",
+      "description": "Deletes a universe's binding to a provider only when the universe has no non-closed environment of that provider.",
       "group": "deployment/environment-providers",
       "method": "deployment/environment-providers/bindings/delete",
       "params": {
@@ -3429,30 +3479,6 @@
       "summary": "Delete an environment provider binding",
       "target": null
     },
-    {
-      "access": {
-        "kind": "deployment"
-      },
-      "description": "Creates a universe environment by transferring an existing provider target into Lightspeed's managed lifecycle. The caller must explicitly accept ownership transfer.",
-      "group": "deployment/environment-providers",
-      "method": "deployment/environments/adopt",
-      "params": {
-        "schema": {
-          "$ref": "#/definitions/DeploymentEnvironmentAdoptParams"
-        },
-        "type": "DeploymentEnvironmentAdoptParams"
-      },
-      "result": {
-        "schema": {
-          "$ref": "#/definitions/AgentApiOutcomeOfDeploymentEnvironmentAdoptResponse"
-        },
-        "type": "AgentApiOutcome<DeploymentEnvironmentAdoptResponse>"
-      },
-      "role": null,
-      "scope": "deployment",
-      "summary": "Adopt a provider environment",
-      "target": null
-    },
     {
       "access": {
         "kind": "deployment"
diff --git a/crates/api/contract/openrpc.json b/crates/api/contract/openrpc.json
index 59903a515..8065eaf39 100644
--- a/crates/api/contract/openrpc.json
+++ b/crates/api/contract/openrpc.json
@@ -139,7 +139,7 @@
           },
           {
             "const": "environment_not_ready",
-            "description": "The environment exists but is not reachable yet: it is still\nprovisioning/booting, or it was powered down and a wake (desired\npower `running`) has been initiated by this request. Distinct from\n`Rejected` so clients retry with backoff instead of failing —\npolling and automation callers lean on this for wake-on-use.",
+            "description": "The environment exists but is not reachable yet: it is still\nprovisioning, its provider is waking or booting it after a data\nroute dial, or its registered daemon is reconnecting. Distinct from\n`Rejected` so clients retry with backoff instead of failing —\npolling and automation callers lean on this for wake-on-use.",
             "type": "string"
           },
           {
@@ -1084,23 +1084,6 @@
         ],
         "type": "object"
       },
-      "AgentApiOutcomeOfDeploymentEnvironmentAdoptResponse": {
-        "properties": {
-          "notifications": {
-            "items": {
-              "$ref": "#/components/schemas/AgentNotification"
-            },
-            "type": "array"
-          },
-          "result": {
-            "$ref": "#/components/schemas/DeploymentEnvironmentAdoptResponse"
-          }
-        },
-        "required": [
-          "result"
-        ],
-        "type": "object"
-      },
       "AgentApiOutcomeOfDeploymentEnvironmentProviderDeleteResponse": {
         "properties": {
           "notifications": {
@@ -1390,23 +1373,6 @@
         ],
         "type": "object"
       },
-      "AgentApiOutcomeOfEnvironmentIdlePolicyPutResponse": {
-        "properties": {
-          "notifications": {
-            "items": {
-              "$ref": "#/components/schemas/AgentNotification"
-            },
-            "type": "array"
-          },
-          "result": {
-            "$ref": "#/components/schemas/EnvironmentIdlePolicyPutResponse"
-          }
-        },
-        "required": [
-          "result"
-        ],
-        "type": "object"
-      },
       "AgentApiOutcomeOfEnvironmentIngressPutResponse": {
         "properties": {
           "notifications": {
@@ -1628,6 +1594,40 @@
         ],
         "type": "object"
       },
+      "AgentApiOutcomeOfEnvironmentRegistrationKeyRotateResponse": {
+        "properties": {
+          "notifications": {
+            "items": {
+              "$ref": "#/components/schemas/AgentNotification"
+            },
+            "type": "array"
+          },
+          "result": {
+            "$ref": "#/components/schemas/EnvironmentRegistrationKeyRotateResponse"
+          }
+        },
+        "required": [
+          "result"
+        ],
+        "type": "object"
+      },
+      "AgentApiOutcomeOfEnvironmentRegistrationKeyUpdateResponse": {
+        "properties": {
+          "notifications": {
+            "items": {
+              "$ref": "#/components/schemas/AgentNotification"
+            },
+            "type": "array"
+          },
+          "result": {
+            "$ref": "#/components/schemas/EnvironmentRegistrationKeyUpdateResponse"
+          }
+        },
+        "required": [
+          "result"
+        ],
+        "type": "object"
+      },
       "AgentApiOutcomeOfEnvironmentTemplateListResponse": {
         "properties": {
           "notifications": {
@@ -1662,6 +1662,23 @@
         ],
         "type": "object"
       },
+      "AgentApiOutcomeOfEnvironmentUpdateResponse": {
+        "properties": {
+          "notifications": {
+            "items": {
+              "$ref": "#/components/schemas/AgentNotification"
+            },
+            "type": "array"
+          },
+          "result": {
+            "$ref": "#/components/schemas/EnvironmentUpdateResponse"
+          }
+        },
+        "required": [
+          "result"
+        ],
+        "type": "object"
+      },
       "AgentApiOutcomeOfInitializeResponse": {
         "properties": {
           "notifications": {
@@ -8710,59 +8727,6 @@
         ],
         "type": "object"
       },
-      "DeploymentEnvironmentAdoptParams": {
-        "properties": {
-          "bindingId": {
-            "type": "string"
-          },
-          "displayName": {
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "metadata": {
-            "additionalProperties": {
-              "type": "string"
-            },
-            "type": "object"
-          },
-          "requestId": {
-            "description": "Stable caller-generated retry identity inside the destination universe.",
-            "type": "string"
-          },
-          "sourceTarget": {
-            "description": "Provider-native source reference. The Incus provider accepts\n`<project>/<instance>` or an instance name in the `default` project.",
-            "type": "string"
-          },
-          "takeOwnership": {
-            "description": "Required acknowledgement that Lightspeed will move, reconfigure, and\ndelete the target as part of its ordinary managed lifecycle.",
-            "type": "boolean"
-          },
-          "universeId": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "universeId",
-          "requestId",
-          "bindingId",
-          "sourceTarget",
-          "takeOwnership"
-        ],
-        "type": "object"
-      },
-      "DeploymentEnvironmentAdoptResponse": {
-        "properties": {
-          "environment": {
-            "$ref": "#/components/schemas/EnvironmentView"
-          }
-        },
-        "required": [
-          "environment"
-        ],
-        "type": "object"
-      },
       "DeploymentEnvironmentProviderDeleteParams": {
         "properties": {
           "providerId": {
@@ -8785,24 +8749,6 @@
         ],
         "type": "object"
       },
-      "DeploymentEnvironmentProviderFeaturesView": {
-        "description": "Optional controller methods the provider's controller advertised.",
-        "properties": {
-          "adoptTarget": {
-            "description": "Existing targets can be adopted (`environment/adopt`).",
-            "type": "boolean"
-          },
-          "ingress": {
-            "description": "Public ingress can be enabled on environments.",
-            "type": "boolean"
-          }
-        },
-        "required": [
-          "adoptTarget",
-          "ingress"
-        ],
-        "type": "object"
-      },
       "DeploymentEnvironmentProviderListParams": {
         "type": "object"
       },
@@ -8821,30 +8767,35 @@
         "type": "object"
       },
       "DeploymentEnvironmentProviderPutParams": {
-        "description": "Register or replace a provider. `credential` is the bearer token\nLightspeed presents to the provider's controller and data routes: it is\nsealed on receipt and never returned by any method. `Debug` output\nredacts it; request logging must never echo these params.",
+        "description": "Register or replace a provider. `credential` is the optional bearer\ntoken Lightspeed presents to the provider's controller and data routes:\nit is sealed on receipt and never returned by any method. `Debug` output\nredacts it; request logging must never echo these params.",
         "properties": {
+          "clearCredential": {
+            "description": "Remove the stored credential. Excludes `credential`.",
+            "type": "boolean"
+          },
           "controllerEndpoint": {
             "description": "`ws://`, `wss://` or `unix://` URL of the provider controller.",
             "type": "string"
           },
           "credential": {
-            "description": "Required when the provider is new; omit to keep the stored one.",
+            "description": "A new bearer credential; omit to keep the stored one. A provider needs\nnone. Excludes `clearCredential`.",
             "type": [
               "string",
               "null"
             ]
           },
-          "displayName": {
+          "dataRouteBase": {
+            "description": "`ws://` or `wss://` base of the provider's data routes; omit to derive\nit from the controller endpoint. Required for a `unix://` controller,\nand must not be `ws://` for a `wss://` controller.",
             "type": [
               "string",
               "null"
             ]
           },
-          "metadata": {
-            "additionalProperties": {
-              "type": "string"
-            },
-            "type": "object"
+          "displayName": {
+            "type": [
+              "string",
+              "null"
+            ]
           },
           "providerId": {
             "type": "string"
@@ -8895,23 +8846,12 @@
             "description": "`ws://`, `wss://` or `unix://` URL of the provider controller.",
             "type": "string"
           },
-          "controllerFeatures": {
-            "anyOf": [
-              {
-                "$ref": "#/components/schemas/DeploymentEnvironmentProviderFeaturesView"
-              },
-              {
-                "type": "null"
-              }
-            ],
-            "description": "What the controller advertised at its last successful handshake;\nabsent until Lightspeed first reached it at this endpoint."
-          },
           "createdAtMs": {
             "format": "int64",
             "type": "integer"
           },
           "dataRouteBase": {
-            "description": "Base URL of the provider's data routes, as its controller advertised\nit; absent until then.",
+            "description": "Operator-configured `ws://` or `wss://` base of the provider's data\nroutes; absent derives it from the controller endpoint.",
             "type": [
               "string",
               "null"
@@ -8923,11 +8863,16 @@
               "null"
             ]
           },
-          "metadata": {
-            "additionalProperties": {
-              "type": "string"
-            },
-            "type": "object"
+          "effectiveDataRouteBase": {
+            "description": "The data route base Lightspeed dials: `dataRouteBase`, or the\ncontroller endpoint's origin followed by `/routes`. Absent only when it\ncannot be derived.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "hasCredential": {
+            "description": "A bearer credential is stored and presented to the controller and\ndata routes; without one no `Authorization` header is sent.",
+            "type": "boolean"
           },
           "providerId": {
             "type": "string"
@@ -8940,6 +8885,7 @@
         "required": [
           "providerId",
           "controllerEndpoint",
+          "hasCredential",
           "createdAtMs",
           "updatedAtMs"
         ],
@@ -8947,7 +8893,7 @@
       },
       "DeploymentProviderBindingDeleteParams": {
         "properties": {
-          "bindingId": {
+          "providerId": {
             "type": "string"
           },
           "universeId": {
@@ -8956,7 +8902,7 @@
         },
         "required": [
           "universeId",
-          "bindingId"
+          "providerId"
         ],
         "type": "object"
       },
@@ -8972,39 +8918,23 @@
         "type": "object"
       },
       "DeploymentProviderBindingPutParams": {
+        "description": "Create or replace a universe's binding to a deployment provider.",
         "properties": {
-          "bindingId": {
-            "type": "string"
-          },
-          "expectedRevision": {
-            "format": "uint64",
-            "minimum": 0,
-            "type": [
-              "integer",
-              "null"
-            ]
-          },
-          "metadata": {
-            "additionalProperties": {
-              "type": "string"
-            },
-            "type": "object"
+          "enabled": {
+            "description": "Admits creates, template listing and data routes for the universe.",
+            "type": "boolean"
           },
           "providerId": {
             "type": "string"
           },
-          "status": {
-            "$ref": "#/components/schemas/EnvironmentProviderBindingStatusView"
-          },
           "universeId": {
             "type": "string"
           }
         },
         "required": [
           "universeId",
-          "bindingId",
           "providerId",
-          "status"
+          "enabled"
         ],
         "type": "object"
       },
@@ -9291,6 +9221,41 @@
         ],
         "type": "object"
       },
+      "EnvironmentCloseReasonView": {
+        "description": "Why an environment is closing or closed.",
+        "oneOf": [
+          {
+            "const": "requested",
+            "description": "`environments/close`.",
+            "type": "string"
+          },
+          {
+            "const": "keyRevoked",
+            "description": "Its registration key was revoked with `closeEnvironments`.",
+            "type": "string"
+          },
+          {
+            "const": "ephemeralGrace",
+            "description": "Its ephemeral daemon stayed away longer than the key's disconnect\ngrace.",
+            "type": "string"
+          },
+          {
+            "const": "departed",
+            "description": "Its ephemeral daemon said goodbye.",
+            "type": "string"
+          },
+          {
+            "const": "offlineTimeout",
+            "description": "Its persistent daemon stayed away longer than the key's\n`offlineCloseAfterMs`.",
+            "type": "string"
+          },
+          {
+            "const": "providerEnded",
+            "description": "The provider reported the target closed or gone.",
+            "type": "string"
+          }
+        ]
+      },
       "EnvironmentCloseResponse": {
         "properties": {
           "environment": {
@@ -9304,16 +9269,13 @@
       },
       "EnvironmentCreateParams": {
         "properties": {
-          "bindingId": {
-            "type": "string"
-          },
           "displayName": {
             "type": [
               "string",
               "null"
             ]
           },
-          "idlePolicy": {
+          "idle": {
             "anyOf": [
               {
                 "$ref": "#/components/schemas/EnvironmentIdlePolicyView"
@@ -9322,7 +9284,7 @@
                 "type": "null"
               }
             ],
-            "description": "Optional staged idle policy applied by the power reaper."
+            "description": "Idle policy passed to the provider in place of the template's `idle`.\nThe provider runs the idle clock; it cannot be changed after create."
           },
           "metadata": {
             "additionalProperties": {
@@ -9330,18 +9292,22 @@
             },
             "type": "object"
           },
+          "providerId": {
+            "description": "The provider to create the environment with; the universe needs an\nenabled binding to it.",
+            "type": "string"
+          },
           "requestId": {
-            "description": "Stable caller-generated retry identity, unique inside the universe.",
+            "description": "Stable caller-generated retry identity, unique inside the universe.\nRetrying with identical inputs returns the same environment.",
             "type": "string"
           },
           "templateId": {
-            "description": "Immutable provider template-version identity.",
+            "description": "The provider template to create the environment from.",
             "type": "string"
           }
         },
         "required": [
           "requestId",
-          "bindingId",
+          "providerId",
           "templateId"
         ],
         "type": "object"
@@ -9548,6 +9514,32 @@
         ],
         "type": "object"
       },
+      "EnvironmentDaemonView": {
+        "description": "The envd build serving an environment, from its registration or\nLightspeed's open handshake.",
+        "properties": {
+          "gitSha": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "protocolVersion": {
+            "format": "uint32",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "version": {
+            "type": [
+              "string",
+              "null"
+            ]
+          }
+        },
+        "required": [
+          "protocolVersion"
+        ],
+        "type": "object"
+      },
       "EnvironmentExternalCreateParams": {
         "properties": {
           "displayName": {
@@ -9567,6 +9559,7 @@
             "type": "object"
           },
           "requestId": {
+            "description": "Stable caller-generated retry identity, unique inside the universe.",
             "type": "string"
           }
         },
@@ -9588,63 +9581,31 @@
         "type": "object"
       },
       "EnvironmentIdentityModeView": {
-        "description": "What Lightspeed does with a registered environment while its daemon is\ndisconnected. Registration-key policy, copied onto each environment.",
+        "description": "What happens to a registered environment while its daemon is\ndisconnected. Policy of the registration key that admitted it.",
         "oneOf": [
           {
             "const": "persistent",
-            "description": "Stays offline until explicitly closed.",
+            "description": "Stays open: tools wait up to two minutes for the daemon to reconnect.\nClosed explicitly, or after the key's `offlineCloseAfterMs`.",
             "type": "string"
           },
           {
             "const": "ephemeral",
-            "description": "Closed once the daemon has been away longer than the key's\ndisconnect grace.",
+            "description": "Unusable while disconnected; closed once the daemon has been away\nlonger than the key's disconnect grace, or at once when it says\ngoodbye.",
             "type": "string"
           }
         ]
       },
-      "EnvironmentIdlePolicyPutParams": {
+      "EnvironmentIdlePolicyView": {
+        "additionalProperties": false,
+        "description": "Staged idle policy the provider applies. Thresholds are milliseconds of\nenvd-reported idle time (running processes, jobs and leftover process\ngroups hold it at zero) and must be non-decreasing in the order pause,\nsuspend, stop, close. Stages whose power state the template does not\nsupport are skipped.",
         "properties": {
-          "environmentId": {
-            "type": "string"
-          },
-          "idlePolicy": {
-            "anyOf": [
-              {
-                "$ref": "#/components/schemas/EnvironmentIdlePolicyView"
-              },
-              {
-                "type": "null"
-              }
-            ],
-            "description": "The complete new policy; omit to clear it."
-          }
-        },
-        "required": [
-          "environmentId"
-        ],
-        "type": "object"
-      },
-      "EnvironmentIdlePolicyPutResponse": {
-        "properties": {
-          "environment": {
-            "$ref": "#/components/schemas/EnvironmentView"
-          }
-        },
-        "required": [
-          "environment"
-        ],
-        "type": "object"
-      },
-      "EnvironmentIdlePolicyView": {
-        "description": "Staged idle policy. Thresholds are milliseconds of daemon-reported idle\ntime and must be non-decreasing in the order pause, suspend, stop, close.\nStages whose power state the provider does not support are skipped.",
-        "properties": {
-          "closeAfterMs": {
-            "format": "uint64",
-            "minimum": 0,
-            "type": [
-              "integer",
-              "null"
-            ]
+          "closeAfterMs": {
+            "format": "uint64",
+            "minimum": 0,
+            "type": [
+              "integer",
+              "null"
+            ]
           },
           "pauseAfterMs": {
             "format": "uint64",
@@ -9673,55 +9634,10 @@
         },
         "type": "object"
       },
-      "EnvironmentIncarnationView": {
-        "properties": {
-          "createdAtMs": {
-            "format": "int64",
-            "type": "integer"
-          },
-          "incarnationId": {
-            "type": "string"
-          },
-          "powerStates": {
-            "description": "Power states the provider reported for this target; empty until\nobserved or when the provider offers no power control.",
-            "items": {
-              "$ref": "#/components/schemas/EnvironmentPowerStateView"
-            },
-            "type": "array"
-          },
-          "providerTargetId": {
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "provisionRequestId": {
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "templateId": {
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "updatedAtMs": {
-            "format": "int64",
-            "type": "integer"
-          }
-        },
-        "required": [
-          "incarnationId",
-          "createdAtMs",
-          "updatedAtMs"
-        ],
-        "type": "object"
-      },
       "EnvironmentIngressPutParams": {
         "properties": {
           "enabled": {
+            "description": "Ensure (`true`) or remove (`false`) the provider's public ingress.",
             "type": "boolean"
           },
           "environmentId": {
@@ -9880,68 +9796,29 @@
         },
         "type": "object"
       },
-      "EnvironmentLifecycleErrorView": {
-        "properties": {
-          "firstAtMs": {
-            "description": "When the current run of errors began.",
-            "format": "int64",
-            "type": "integer"
-          },
-          "lastAtMs": {
-            "description": "When `message` was recorded.",
-            "format": "int64",
-            "type": "integer"
-          },
-          "message": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "message",
-          "firstAtMs",
-          "lastAtMs"
-        ],
-        "type": "object"
-      },
-      "EnvironmentLifecycleStatusView": {
-        "oneOf": [
-          {
-            "enum": [
-              "provisioning",
-              "booting",
-              "ready",
-              "closing",
-              "closed",
-              "failed",
-              "unknown"
-            ],
-            "type": "string"
-          },
-          {
-            "const": "paused",
-            "description": "Execution frozen; wakes on next use.",
-            "type": "string"
-          },
-          {
-            "const": "suspended",
-            "description": "Execution state saved to disk; wakes on next use.",
-            "type": "string"
-          },
-          {
-            "const": "offline",
-            "description": "Powered off; provisioned environments wake on next use when the\nprovider supports power control.",
-            "type": "string"
-          }
-        ]
-      },
       "EnvironmentListParams": {
         "properties": {
-          "bindingId": {
+          "after": {
+            "description": "Exclusive environment id cursor: a previous page's `nextAfter`.",
             "type": [
               "string",
               "null"
             ]
           },
+          "includeClosed": {
+            "description": "Also list closed environments; they are omitted by default.",
+            "type": "boolean"
+          },
+          "limit": {
+            "description": "Most environments per page; omit for 100.",
+            "format": "uint32",
+            "maximum": 500,
+            "minimum": 1,
+            "type": [
+              "integer",
+              "null"
+            ]
+          },
           "metadata": {
             "additionalProperties": {
               "type": "string"
@@ -9950,6 +9827,7 @@
             "type": "object"
           },
           "providerId": {
+            "description": "Only provisioned environments of this provider.",
             "type": [
               "string",
               "null"
@@ -9962,15 +9840,16 @@
               "null"
             ]
           },
-          "status": {
+          "state": {
             "anyOf": [
               {
-                "$ref": "#/components/schemas/EnvironmentLifecycleStatusView"
+                "$ref": "#/components/schemas/EnvironmentStateView"
               },
               {
                 "type": "null"
               }
-            ]
+            ],
+            "description": "Only environments in this lifecycle state. `closed` lists closed\nenvironments without `includeClosed`."
           }
         },
         "type": "object"
@@ -9979,12 +9858,54 @@
         "properties": {
           "environments": {
             "default": [],
+            "description": "Environments in environment id order.",
             "items": {
               "$ref": "#/components/schemas/EnvironmentView"
             },
             "type": "array"
+          },
+          "nextAfter": {
+            "description": "Pass as `after` to read the next page; absent on the last page.",
+            "type": [
+              "string",
+              "null"
+            ]
+          }
+        },
+        "type": "object"
+      },
+      "EnvironmentObservedTargetView": {
+        "description": "What the provider last reported about a provisioned environment's\ntarget. Display only: Lightspeed never converges it, and it may be up to\na few minutes old.",
+        "properties": {
+          "message": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "observedAtMs": {
+            "format": "int64",
+            "type": "integer"
+          },
+          "phase": {
+            "$ref": "#/components/schemas/EnvironmentTargetPhaseView"
+          },
+          "power": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/EnvironmentPowerStateView"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "Present only while `phase` is `active`."
           }
         },
+        "required": [
+          "phase",
+          "observedAtMs"
+        ],
         "type": "object"
       },
       "EnvironmentPowerPutParams": {
@@ -9998,7 +9919,7 @@
                 "$ref": "#/components/schemas/EnvironmentPowerStateView"
               }
             ],
-            "description": "Desired steady power state. Must be one of the provider-reported\n`incarnation.powerStates`."
+            "description": "Power state to move the target to; one of its template's\n`powerStates`."
           }
         },
         "required": [
@@ -10019,7 +9940,7 @@
         "type": "object"
       },
       "EnvironmentPowerStateView": {
-        "description": "Steady power state of a provisioned environment.",
+        "description": "Power state of a provisioned environment's target.",
         "oneOf": [
           {
             "enum": [
@@ -10081,12 +10002,12 @@
       },
       "EnvironmentProviderBindingReadParams": {
         "properties": {
-          "bindingId": {
+          "providerId": {
             "type": "string"
           }
         },
         "required": [
-          "bindingId"
+          "providerId"
         ],
         "type": "object"
       },
@@ -10101,49 +10022,27 @@
         ],
         "type": "object"
       },
-      "EnvironmentProviderBindingStatusView": {
-        "enum": [
-          "enabled",
-          "disabled"
-        ],
-        "type": "string"
-      },
       "EnvironmentProviderBindingView": {
+        "description": "A universe's binding to a deployment provider. Creates, templates and\ndata routes of the provider need it enabled.",
         "properties": {
-          "bindingId": {
-            "type": "string"
-          },
           "createdAtMs": {
             "format": "int64",
             "type": "integer"
           },
-          "metadata": {
-            "additionalProperties": {
-              "type": "string"
-            },
-            "type": "object"
+          "enabled": {
+            "type": "boolean"
           },
           "providerId": {
             "type": "string"
           },
-          "revision": {
-            "format": "uint64",
-            "minimum": 0,
-            "type": "integer"
-          },
-          "status": {
-            "$ref": "#/components/schemas/EnvironmentProviderBindingStatusView"
-          },
           "updatedAtMs": {
             "format": "int64",
             "type": "integer"
           }
         },
         "required": [
-          "bindingId",
           "providerId",
-          "status",
-          "revision",
+          "enabled",
           "createdAtMs",
           "updatedAtMs"
         ],
@@ -10194,7 +10093,12 @@
             ]
           },
           "identityMode": {
-            "$ref": "#/components/schemas/EnvironmentIdentityModeView"
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/EnvironmentIdentityModeView"
+              }
+            ],
+            "description": "Immutable once the key exists."
           },
           "maxActiveEnvironments": {
             "description": "Non-closed environments the key may have at once; omit for unlimited.",
@@ -10204,6 +10108,15 @@
               "integer",
               "null"
             ]
+          },
+          "offlineCloseAfterMs": {
+            "description": "Persistent keys only: close environments whose daemon has been away\nlonger than this; omit to keep them open.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": [
+              "integer",
+              "null"
+            ]
           }
         },
         "required": [
@@ -10303,6 +10216,37 @@
         ],
         "type": "object"
       },
+      "EnvironmentRegistrationKeyRotateParams": {
+        "properties": {
+          "registrationKeyId": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "registrationKeyId"
+        ],
+        "type": "object"
+      },
+      "EnvironmentRegistrationKeyRotateResponse": {
+        "properties": {
+          "registrationKey": {
+            "$ref": "#/components/schemas/EnvironmentRegistrationKeyView"
+          },
+          "secret": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/EnvironmentRegistrationSecretView"
+              }
+            ],
+            "description": "The new plaintext secret, returned only here."
+          }
+        },
+        "required": [
+          "registrationKey",
+          "secret"
+        ],
+        "type": "object"
+      },
       "EnvironmentRegistrationKeyStatusView": {
         "enum": [
           "active",
@@ -10311,6 +10255,68 @@
         ],
         "type": "string"
       },
+      "EnvironmentRegistrationKeyUpdateParams": {
+        "description": "The complete editable policy of a registration key; an absent field is\nunset. The identity mode is immutable.",
+        "properties": {
+          "displayName": {
+            "description": "Group name for the environments this key admits.",
+            "type": "string"
+          },
+          "ephemeralDisconnectGraceMs": {
+            "description": "Disconnect grace for ephemeral environments; omit for the default.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": [
+              "integer",
+              "null"
+            ]
+          },
+          "expiresAtMs": {
+            "format": "int64",
+            "type": [
+              "integer",
+              "null"
+            ]
+          },
+          "maxActiveEnvironments": {
+            "description": "Non-closed environments the key may have at once; omit for unlimited.",
+            "format": "uint32",
+            "minimum": 0,
+            "type": [
+              "integer",
+              "null"
+            ]
+          },
+          "offlineCloseAfterMs": {
+            "description": "Persistent keys only: close environments whose daemon has been away\nlonger than this; omit to keep them open.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": [
+              "integer",
+              "null"
+            ]
+          },
+          "registrationKeyId": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "registrationKeyId",
+          "displayName"
+        ],
+        "type": "object"
+      },
+      "EnvironmentRegistrationKeyUpdateResponse": {
+        "properties": {
+          "registrationKey": {
+            "$ref": "#/components/schemas/EnvironmentRegistrationKeyView"
+          }
+        },
+        "required": [
+          "registrationKey"
+        ],
+        "type": "object"
+      },
       "EnvironmentRegistrationKeyView": {
         "properties": {
           "activeEnvironmentCount": {
@@ -10344,7 +10350,7 @@
             "$ref": "#/components/schemas/EnvironmentIdentityModeView"
           },
           "keyPrefix": {
-            "description": "First characters of the secret, for identification only.",
+            "description": "First characters of the key's live secret, for identification only.",
             "type": "string"
           },
           "lastRegisteredAtMs": {
@@ -10362,6 +10368,15 @@
               "null"
             ]
           },
+          "offlineCloseAfterMs": {
+            "description": "Persistent keys only: environments whose daemon has been away longer\nthan this are closed; absent keeps them open.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": [
+              "integer",
+              "null"
+            ]
+          },
           "registeredEnvironmentCount": {
             "description": "Environments ever admitted by this key, closed included.",
             "format": "uint64",
@@ -10380,6 +10395,10 @@
           },
           "status": {
             "$ref": "#/components/schemas/EnvironmentRegistrationKeyStatusView"
+          },
+          "updatedAtMs": {
+            "format": "int64",
+            "type": "integer"
           }
         },
         "required": [
@@ -10391,7 +10410,8 @@
           "status",
           "registeredEnvironmentCount",
           "activeEnvironmentCount",
-          "createdAtMs"
+          "createdAtMs",
+          "updatedAtMs"
         ],
         "type": "object"
       },
@@ -10420,13 +10440,50 @@
       "EnvironmentSourceView": {
         "oneOf": [
           {
+            "description": "A target a deployment provider created from a template. The provider\nowns its power, idle policy and ingress.",
             "properties": {
-              "bindingId": {
-                "type": "string"
+              "idle": {
+                "anyOf": [
+                  {
+                    "$ref": "#/components/schemas/EnvironmentIdlePolicyView"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "The create-time idle policy, when one replaced the template's."
+              },
+              "observed": {
+                "anyOf": [
+                  {
+                    "$ref": "#/components/schemas/EnvironmentObservedTargetView"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "Absent until the provider first reported the target."
               },
               "providerId": {
                 "type": "string"
               },
+              "publicEndpoint": {
+                "description": "The public endpoint the provider last reported.",
+                "type": [
+                  "string",
+                  "null"
+                ]
+              },
+              "targetId": {
+                "description": "The provider's handle for the target; absent until the provider\naccepted the create.",
+                "type": [
+                  "string",
+                  "null"
+                ]
+              },
+              "templateId": {
+                "type": "string"
+              },
               "type": {
                 "const": "provisioned",
                 "type": "string"
@@ -10435,57 +10492,159 @@
             "required": [
               "type",
               "providerId",
-              "bindingId"
+              "templateId"
+            ],
+            "type": "object"
+          },
+          {
+            "properties": {
+              "endpoint": {
+                "description": "`ws://`, `wss://` or `unix://` URL Lightspeed dials envd at.",
+                "type": "string"
+              },
+              "type": {
+                "const": "external",
+                "type": "string"
+              }
+            },
+            "required": [
+              "type",
+              "endpoint"
             ],
             "type": "object"
           },
           {
-            "properties": {
-              "endpoint": {
-                "description": "`ws://`, `wss://` or `unix://` URL Lightspeed dials envd at.",
-                "type": "string"
-              },
-              "type": {
-                "const": "external",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type",
-              "endpoint"
-            ],
-            "type": "object"
+            "description": "An envd that dialed the gateway outbound and was admitted by a\nregistration key. The key is the environment's group; the daemon id\nis derived from the daemon's public key and is its identity.",
+            "properties": {
+              "connected": {
+                "description": "The daemon's control connection is up.",
+                "type": "boolean"
+              },
+              "connectionChangedAtMs": {
+                "description": "When the daemon last connected or disconnected.",
+                "format": "int64",
+                "type": "integer"
+              },
+              "daemonId": {
+                "type": "string"
+              },
+              "identityMode": {
+                "allOf": [
+                  {
+                    "$ref": "#/components/schemas/EnvironmentIdentityModeView"
+                  }
+                ],
+                "description": "The admitting key's identity mode."
+              },
+              "lastSeenAtMs": {
+                "description": "When the gateway last recorded the daemon's control connection:\nat connect, at disconnect, and at most every five minutes while\nconnected.",
+                "format": "int64",
+                "type": "integer"
+              },
+              "registrationKeyId": {
+                "type": "string"
+              },
+              "type": {
+                "const": "registered",
+                "type": "string"
+              }
+            },
+            "required": [
+              "type",
+              "registrationKeyId",
+              "daemonId",
+              "identityMode",
+              "connected",
+              "connectionChangedAtMs",
+              "lastSeenAtMs"
+            ],
+            "type": "object"
+          }
+        ]
+      },
+      "EnvironmentStateView": {
+        "description": "The lifecycle Lightspeed owns. External and registered environments are\nonly ever `open` or `closed`.",
+        "oneOf": [
+          {
+            "enum": [
+              "open",
+              "closed"
+            ],
+            "type": "string"
+          },
+          {
+            "const": "provisioning",
+            "description": "The provider is creating the target; the environment opens after\nLightspeed's first handshake with its envd.",
+            "type": "string"
+          },
+          {
+            "const": "closing",
+            "description": "The provider is removing the target.",
+            "type": "string"
+          },
+          {
+            "const": "failed",
+            "description": "Provisioning or the provider failed; `stateMessage` says why.",
+            "type": "string"
+          }
+        ]
+      },
+      "EnvironmentStatusView": {
+        "description": "Display status derived from `state` and the latest observation; never\nstored. Tools that use a paused, suspended or stopped environment wake\nit.",
+        "oneOf": [
+          {
+            "enum": [
+              "provisioning",
+              "ready",
+              "closing",
+              "closed",
+              "failed"
+            ],
+            "type": "string"
+          },
+          {
+            "const": "paused",
+            "description": "Execution frozen with RAM resident.",
+            "type": "string"
+          },
+          {
+            "const": "suspended",
+            "description": "Execution state saved to disk.",
+            "type": "string"
+          },
+          {
+            "const": "stopped",
+            "description": "Powered off with disk retained.",
+            "type": "string"
           },
           {
-            "description": "An envd that dialed the gateway outbound and was admitted by a\nregistration key. The key is the environment's group; the daemon id\nis derived from the daemon's public key and is its identity.",
-            "properties": {
-              "daemonId": {
-                "type": "string"
-              },
-              "identityMode": {
-                "$ref": "#/components/schemas/EnvironmentIdentityModeView"
-              },
-              "registrationKeyId": {
-                "type": "string"
-              },
-              "type": {
-                "const": "registered",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type",
-              "registrationKeyId",
-              "daemonId",
-              "identityMode"
-            ],
-            "type": "object"
+            "const": "unknown",
+            "description": "Open, but the provider's latest observation is inconclusive.",
+            "type": "string"
+          },
+          {
+            "const": "away",
+            "description": "Registered, open, and its daemon is not connected.",
+            "type": "string"
           }
         ]
       },
+      "EnvironmentTargetPhaseView": {
+        "description": "Lifecycle phase of a provider target, as the provider reports it.",
+        "enum": [
+          "provisioning",
+          "active",
+          "closing",
+          "closed",
+          "failed",
+          "unknown"
+        ],
+        "type": "string"
+      },
       "EnvironmentTemplateListParams": {
         "properties": {
-          "bindingId": {
+          "providerId": {
+            "description": "Only this provider's templates; omit for every enabled binding.",
             "type": [
               "string",
               "null"
@@ -10510,7 +10669,7 @@
       },
       "EnvironmentTemplateReadParams": {
         "properties": {
-          "bindingId": {
+          "providerId": {
             "type": "string"
           },
           "templateId": {
@@ -10518,7 +10677,7 @@
           }
         },
         "required": [
-          "bindingId",
+          "providerId",
           "templateId"
         ],
         "type": "object"
@@ -10566,9 +10725,6 @@
       },
       "EnvironmentTemplateView": {
         "properties": {
-          "bindingId": {
-            "type": "string"
-          },
           "deprecated": {
             "type": "boolean"
           },
@@ -10581,16 +10737,35 @@
           "displayName": {
             "type": "string"
           },
+          "idle": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/EnvironmentIdlePolicyView"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "Idle policy targets get when `environments/create` names none."
+          },
           "metadata": {
             "additionalProperties": {
               "type": "string"
             },
             "type": "object"
           },
+          "powerStates": {
+            "description": "Power states `environments/power/put` can move targets of this\ntemplate to; empty without power control.",
+            "items": {
+              "$ref": "#/components/schemas/EnvironmentPowerStateView"
+            },
+            "type": "array"
+          },
           "providerId": {
             "type": "string"
           },
           "publicIngress": {
+            "description": "`environments/ingress/put` can enable public ingress on targets of\nthis template.",
             "type": "boolean"
           },
           "resources": {
@@ -10611,28 +10786,18 @@
         "required": [
           "templateId",
           "providerId",
-          "bindingId",
           "displayName",
           "publicIngress",
-          "deprecated"
+          "deprecated",
+          "powerStates"
         ],
         "type": "object"
       },
-      "EnvironmentView": {
+      "EnvironmentUpdateParams": {
+        "description": "Replace an environment's display name and caller metadata.",
         "properties": {
-          "createdAtMs": {
-            "format": "int64",
-            "type": "integer"
-          },
-          "desiredPower": {
-            "allOf": [
-              {
-                "$ref": "#/components/schemas/EnvironmentPowerStateView"
-              }
-            ],
-            "description": "Lightspeed-owned power intent; `status` is the observed state."
-          },
           "displayName": {
+            "description": "The new display name; omit to clear it.",
             "type": [
               "string",
               "null"
@@ -10641,63 +10806,108 @@
           "environmentId": {
             "type": "string"
           },
-          "idlePolicy": {
+          "metadata": {
+            "additionalProperties": {
+              "type": "string"
+            },
+            "description": "The complete new caller metadata; omit or `{}` to clear it.",
+            "type": "object"
+          }
+        },
+        "required": [
+          "environmentId"
+        ],
+        "type": "object"
+      },
+      "EnvironmentUpdateResponse": {
+        "properties": {
+          "environment": {
+            "$ref": "#/components/schemas/EnvironmentView"
+          }
+        },
+        "required": [
+          "environment"
+        ],
+        "type": "object"
+      },
+      "EnvironmentView": {
+        "properties": {
+          "closeReason": {
             "anyOf": [
               {
-                "$ref": "#/components/schemas/EnvironmentIdlePolicyView"
+                "$ref": "#/components/schemas/EnvironmentCloseReasonView"
               },
               {
                 "type": "null"
               }
-            ]
-          },
-          "incarnation": {
-            "$ref": "#/components/schemas/EnvironmentIncarnationView"
+            ],
+            "description": "Present exactly while `state` is `closing` or `closed`."
           },
-          "lastSeenAtMs": {
-            "description": "Registered environments only: when the gateway last saw the daemon's\ncontrol connection.",
+          "closedAtMs": {
             "format": "int64",
             "type": [
               "integer",
               "null"
             ]
           },
-          "lifecycleError": {
+          "createdAtMs": {
+            "format": "int64",
+            "type": "integer"
+          },
+          "daemon": {
             "anyOf": [
               {
-                "$ref": "#/components/schemas/EnvironmentLifecycleErrorView"
+                "$ref": "#/components/schemas/EnvironmentDaemonView"
               },
               {
                 "type": "null"
               }
             ],
-            "description": "Why the environment failed, or the latest error (or what the\nprovider reports it is waiting on) while its lifecycle converges;\nabsent once it reaches a steady state."
+            "description": "The envd build serving the environment; absent until known."
+          },
+          "displayName": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "environmentId": {
+            "type": "string"
           },
           "metadata": {
             "additionalProperties": {
               "type": "string"
             },
+            "description": "Caller metadata.",
             "type": "object"
           },
-          "publicEndpoint": {
-            "description": "The public endpoint the provider last reported. It lags\n`publicIngressEnabled` while the lifecycle reconciler converges.",
+          "requestId": {
+            "description": "The caller's retry identity; absent for registered environments.",
             "type": [
               "string",
               "null"
             ]
           },
-          "publicIngressEnabled": {
-            "description": "Lightspeed-owned public ingress intent; `publicEndpoint` is what the\nprovider realized.",
-            "type": "boolean"
-          },
-          "requestId": {
-            "type": "string"
-          },
           "source": {
             "$ref": "#/components/schemas/EnvironmentSourceView"
           },
+          "state": {
+            "$ref": "#/components/schemas/EnvironmentStateView"
+          },
+          "stateChangedAtMs": {
+            "description": "When `state` last changed.",
+            "format": "int64",
+            "type": "integer"
+          },
+          "stateMessage": {
+            "description": "Why the environment failed, or what provisioning or closing is\nwaiting on.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
           "status": {
-            "$ref": "#/components/schemas/EnvironmentLifecycleStatusView"
+            "$ref": "#/components/schemas/EnvironmentStatusView"
           },
           "updatedAtMs": {
             "format": "int64",
@@ -10706,12 +10916,10 @@
         },
         "required": [
           "environmentId",
-          "requestId",
           "source",
+          "state",
           "status",
-          "desiredPower",
-          "incarnation",
-          "publicIngressEnabled",
+          "stateChangedAtMs",
           "createdAtMs",
           "updatedAtMs"
         ],
@@ -12282,7 +12490,7 @@
           },
           {
             "const": "deployment/environment-providers",
-            "description": "Environment providers, their bindings and adoption.",
+            "description": "Environment providers and their universe bindings.",
             "type": "string"
           },
           {
@@ -19911,7 +20119,7 @@
       "x-lightspeed-target": null
     },
     {
-      "description": "Records an idempotent provisioning intent against an enabled universe binding, attributed to the caller. The provider validates its provider-wide template and provisions through its backend asynchronously.",
+      "description": "Creates a provisioned environment, attributed to the caller, from a template of a provider enabled for the universe. Idempotent per requestId: same inputs, same environment; others conflict. Provisioning until the target's first envd handshake, then open; idle overrides the template default.",
       "name": "environments/create",
       "paramStructure": "by-name",
       "params": [
@@ -19939,7 +20147,7 @@
       "x-lightspeed-target": null
     },
     {
-      "description": "Returns the durable universe resource, source binding, logical lifecycle state, and minimal current-incarnation identity.",
+      "description": "Returns one environment: its source, lifecycle state, derived display status, state message, close reason, daemon build, and the latest provider observation.",
       "name": "environments/read",
       "paramStructure": "by-name",
       "params": [
@@ -19967,81 +20175,81 @@
       "x-lightspeed-target": null
     },
     {
-      "description": "Lists the universe environments, optionally filtered by provider, binding, or logical lifecycle state.",
-      "name": "environments/list",
+      "description": "Replaces the display name and caller metadata of an environment of any kind. Refused for a closed environment.",
+      "name": "environments/update",
       "paramStructure": "by-name",
       "params": [
         {
           "name": "params",
           "required": true,
           "schema": {
-            "$ref": "#/components/schemas/EnvironmentListParams"
+            "$ref": "#/components/schemas/EnvironmentUpdateParams"
           }
         }
       ],
       "result": {
         "name": "result",
         "schema": {
-          "$ref": "#/components/schemas/AgentApiOutcomeOfEnvironmentListResponse"
+          "$ref": "#/components/schemas/AgentApiOutcomeOfEnvironmentUpdateResponse"
         }
       },
-      "summary": "List environments",
+      "summary": "Update an environment",
       "x-lightspeed-access": {
-        "action": "read",
+        "action": "configure_resource",
         "kind": "universe"
       },
       "x-lightspeed-group": "environments",
-      "x-lightspeed-role": "viewer",
+      "x-lightspeed-role": "operator",
       "x-lightspeed-target": null
     },
     {
-      "description": "Records an asynchronous idempotent close intent. Provider cleanup is resumed by lifecycle reconciliation; quota is released only after Closed.",
-      "name": "environments/close",
+      "description": "Lists the universe environments in id order, one page at a time, optionally filtered by provider, registration key, state, or metadata. Closed environments are omitted unless includeClosed is set or state is closed. Continue from nextAfter.",
+      "name": "environments/list",
       "paramStructure": "by-name",
       "params": [
         {
           "name": "params",
           "required": true,
           "schema": {
-            "$ref": "#/components/schemas/EnvironmentCloseParams"
+            "$ref": "#/components/schemas/EnvironmentListParams"
           }
         }
       ],
       "result": {
         "name": "result",
         "schema": {
-          "$ref": "#/components/schemas/AgentApiOutcomeOfEnvironmentCloseResponse"
+          "$ref": "#/components/schemas/AgentApiOutcomeOfEnvironmentListResponse"
         }
       },
-      "summary": "Close an environment",
+      "summary": "List environments",
       "x-lightspeed-access": {
-        "action": "configure_resource",
+        "action": "read",
         "kind": "universe"
       },
       "x-lightspeed-group": "environments",
-      "x-lightspeed-role": "operator",
+      "x-lightspeed-role": "viewer",
       "x-lightspeed-target": null
     },
     {
-      "description": "Creates an environment backed by a Lightspeed-reachable envd WebSocket endpoint, attributed to the caller. Reachability is checked on demand.",
-      "name": "environments/external/create",
+      "description": "Closes an environment; idempotent. A provisioned environment moves to closing while Lightspeed asks its provider to remove the target, retrying until it is gone, then closed. External and registered environments close at once, and a connected registered daemon is told its environment closed.",
+      "name": "environments/close",
       "paramStructure": "by-name",
       "params": [
         {
           "name": "params",
           "required": true,
           "schema": {
-            "$ref": "#/components/schemas/EnvironmentExternalCreateParams"
+            "$ref": "#/components/schemas/EnvironmentCloseParams"
           }
         }
       ],
       "result": {
         "name": "result",
         "schema": {
-          "$ref": "#/components/schemas/AgentApiOutcomeOfEnvironmentExternalCreateResponse"
+          "$ref": "#/components/schemas/AgentApiOutcomeOfEnvironmentCloseResponse"
         }
       },
-      "summary": "Register an external environment",
+      "summary": "Close an environment",
       "x-lightspeed-access": {
         "action": "configure_resource",
         "kind": "universe"
@@ -20051,25 +20259,25 @@
       "x-lightspeed-target": null
     },
     {
-      "description": "Records the public ingress intent of a provisioned environment; the lifecycle reconciler converges it while the environment is ready, and `publicEndpoint` shows the realized endpoint. Rejected when the provider does not offer ingress. The provider owns hostname, guest port, routing, TLS, and health; an intent its template refuses is dropped.",
-      "name": "environments/ingress/put",
+      "description": "Creates an open environment backed by a Lightspeed-reachable envd endpoint, attributed to the caller. Idempotent per requestId. Reachability is checked on use.",
+      "name": "environments/external/create",
       "paramStructure": "by-name",
       "params": [
         {
           "name": "params",
           "required": true,
           "schema": {
-            "$ref": "#/components/schemas/EnvironmentIngressPutParams"
+            "$ref": "#/components/schemas/EnvironmentExternalCreateParams"
           }
         }
       ],
       "result": {
         "name": "result",
         "schema": {
-          "$ref": "#/components/schemas/AgentApiOutcomeOfEnvironmentIngressPutResponse"
+          "$ref": "#/components/schemas/AgentApiOutcomeOfEnvironmentExternalCreateResponse"
         }
       },
-      "summary": "Configure environment public ingress",
+      "summary": "Register an external environment",
       "x-lightspeed-access": {
         "action": "configure_resource",
         "kind": "universe"
@@ -20079,25 +20287,25 @@
       "x-lightspeed-target": null
     },
     {
-      "description": "Records the desired power state (running, paused, suspended, or stopped) of a provisioned environment; the lifecycle reconciler converges the provider target asynchronously. Powered-down environments wake transparently on their next use. Rejected when the provider does not support the state.",
-      "name": "environments/power/put",
+      "description": "Synchronously ensures or removes public ingress of an open provisioned environment through its provider; source.publicEndpoint carries the reported endpoint. Rejected when the provider offers no ingress; an internal error, safe to retry, when the provider is unreachable or times out. The provider owns hostname, guest port, routing, TLS, and health.",
+      "name": "environments/ingress/put",
       "paramStructure": "by-name",
       "params": [
         {
           "name": "params",
           "required": true,
           "schema": {
-            "$ref": "#/components/schemas/EnvironmentPowerPutParams"
+            "$ref": "#/components/schemas/EnvironmentIngressPutParams"
           }
         }
       ],
       "result": {
         "name": "result",
         "schema": {
-          "$ref": "#/components/schemas/AgentApiOutcomeOfEnvironmentPowerPutResponse"
+          "$ref": "#/components/schemas/AgentApiOutcomeOfEnvironmentIngressPutResponse"
         }
       },
-      "summary": "Set environment power intent",
+      "summary": "Configure environment public ingress",
       "x-lightspeed-access": {
         "action": "configure_resource",
         "kind": "universe"
@@ -20107,25 +20315,25 @@
       "x-lightspeed-target": null
     },
     {
-      "description": "Replaces or clears the staged idle policy of a provisioned environment. The power reaper measures the daemon's idle duration against the pause/suspend/stop/close thresholds and escalates through the stages the provider supports.",
-      "name": "environments/idle-policy/put",
+      "description": "Synchronously moves an open provisioned environment's target to running, paused, suspended, or stopped via its provider and records the observation; the provider may also change power on idle. Rejected without provider power control or when the template lacks the state; an internal error, safe to retry, when the provider is unreachable or times out.",
+      "name": "environments/power/put",
       "paramStructure": "by-name",
       "params": [
         {
           "name": "params",
           "required": true,
           "schema": {
-            "$ref": "#/components/schemas/EnvironmentIdlePolicyPutParams"
+            "$ref": "#/components/schemas/EnvironmentPowerPutParams"
           }
         }
       ],
       "result": {
         "name": "result",
         "schema": {
-          "$ref": "#/components/schemas/AgentApiOutcomeOfEnvironmentIdlePolicyPutResponse"
+          "$ref": "#/components/schemas/AgentApiOutcomeOfEnvironmentPowerPutResponse"
         }
       },
-      "summary": "Set environment idle policy",
+      "summary": "Set environment power",
       "x-lightspeed-access": {
         "action": "configure_resource",
         "kind": "universe"
@@ -20135,7 +20343,7 @@
       "x-lightspeed-target": null
     },
     {
-      "description": "Lists this universe's revisioned routing and admission bindings to deployment-scoped physical providers.",
+      "description": "Lists this universe's bindings to deployment providers and whether each is enabled.",
       "name": "environments/provider-bindings/list",
       "paramStructure": "by-name",
       "params": [
@@ -20163,7 +20371,7 @@
       "x-lightspeed-target": null
     },
     {
-      "description": "Returns one universe routing and admission binding. Provider-wide templates and physical resource, network, and ingress policy remain provider-owned.",
+      "description": "Returns this universe's binding to one provider. Templates and physical resource, network, and ingress policy remain provider-owned.",
       "name": "environments/provider-bindings/read",
       "paramStructure": "by-name",
       "params": [
@@ -20191,7 +20399,7 @@
       "x-lightspeed-target": null
     },
     {
-      "description": "Reads immutable templates directly from the selected bound provider controller.",
+      "description": "Reads templates live from the controllers of the universe's enabled provider bindings, or of one provider: compute, power states, public ingress, and default idle policy.",
       "name": "environments/templates/list",
       "paramStructure": "by-name",
       "params": [
@@ -20219,7 +20427,7 @@
       "x-lightspeed-target": null
     },
     {
-      "description": "Returns one immutable template version from the selected bound provider controller.",
+      "description": "Returns one template, read live from a bound provider's controller.",
       "name": "environments/templates/read",
       "paramStructure": "by-name",
       "params": [
@@ -20247,7 +20455,7 @@
       "x-lightspeed-target": null
     },
     {
-      "description": "Starts a dependency-aware job group on one environment instance, injecting the environment's configured credentials at provider start. requestId is the retry identity; jobs are owned by the instance rather than a session. A powered-down environment is woken on use: the call fails with environment_not_ready while the wake is in progress; retry with backoff.",
+      "description": "Starts a dependency-aware job group on one environment instance, injecting its configured credentials at provider start. requestId is the retry identity; jobs are owned by the instance, not a session. A powered-down environment wakes on its data route; the call fails with environment_not_ready while it wakes or reconnects; retry with backoff.",
       "name": "environments/jobs/create",
       "paramStructure": "by-name",
       "params": [
@@ -20331,7 +20539,7 @@
       "x-lightspeed-target": null
     },
     {
-      "description": "Creates a reusable universe-scoped key that lets outbound envd daemons register as environments. The plaintext secret is returned exactly once; only its hash is stored. Identity mode, active limit, disconnect grace, and expiry are the key's policy. Treat the secret like a cluster-join credential.",
+      "description": "Creates a reusable universe-scoped key that lets outbound envd daemons register as environments. The plaintext secret is returned exactly once; only its hash is stored. Identity mode (immutable), active limit, disconnect grace, offline close-after, and expiry are the key's policy. Treat the secret like a cluster-join credential.",
       "name": "environments/registration-keys/create",
       "paramStructure": "by-name",
       "params": [
@@ -20414,6 +20622,62 @@
       "x-lightspeed-role": "operator",
       "x-lightspeed-target": null
     },
+    {
+      "description": "Replaces a key's editable policy: display name, active limit, disconnect grace, offline close-after, and expiry; an omitted field is unset. The identity mode is immutable. The active limit and expiry apply to later admissions; a changed disconnect grace or offline close-after applies at the next sweep to environments whose daemon is away.",
+      "name": "environments/registration-keys/update",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "params",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/EnvironmentRegistrationKeyUpdateParams"
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/AgentApiOutcomeOfEnvironmentRegistrationKeyUpdateResponse"
+        }
+      },
+      "summary": "Update an environment registration key",
+      "x-lightspeed-access": {
+        "action": "configure_resource",
+        "kind": "universe"
+      },
+      "x-lightspeed-group": "environments",
+      "x-lightspeed-role": "operator",
+      "x-lightspeed-target": null
+    },
+    {
+      "description": "Replaces the key's secret and display prefix and retires the old secret at once. The key keeps its id, group, policy, and the environments it admitted; daemons already registered are unaffected because they never present the key again. Returns the new secret once. Refused for a revoked key.",
+      "name": "environments/registration-keys/rotate",
+      "paramStructure": "by-name",
+      "params": [
+        {
+          "name": "params",
+          "required": true,
+          "schema": {
+            "$ref": "#/components/schemas/EnvironmentRegistrationKeyRotateParams"
+          }
+        }
+      ],
+      "result": {
+        "name": "result",
+        "schema": {
+          "$ref": "#/components/schemas/AgentApiOutcomeOfEnvironmentRegistrationKeyRotateResponse"
+        }
+      },
+      "summary": "Rotate an environment registration key",
+      "x-lightspeed-access": {
+        "action": "configure_resource",
+        "kind": "universe"
+      },
+      "x-lightspeed-group": "environments",
+      "x-lightspeed-role": "operator",
+      "x-lightspeed-target": null
+    },
     {
       "description": "Stops the key from admitting new daemon identities; already registered daemons keep reconnecting. With closeEnvironments, also closes every non-closed environment the key admitted. Idempotent.",
       "name": "environments/registration-keys/revoke",
@@ -22725,7 +22989,7 @@
       "x-lightspeed-target": null
     },
     {
-      "description": "Registers or replaces one deployment provider: its controller endpoint URL and the bearer credential Lightspeed presents to the controller and data routes. The credential is write-only: required for a new provider, kept when omitted, never returned. The provider does not call this API or require access to Lightspeed.",
+      "description": "Registers or replaces a deployment provider: controller endpoint, optional data route base, and optional bearer credential for controller and data routes (write-only: kept when omitted, removed by clearCredential, never returned). The controller is probed: a definitive refusal is invalid_request, unreachable is accepted. The provider never calls Lightspeed.",
       "name": "deployment/environment-providers/put",
       "paramStructure": "by-name",
       "params": [
@@ -22752,7 +23016,7 @@
       "x-lightspeed-target": null
     },
     {
-      "description": "Returns every deployment-registered provider with its controller endpoint and the optional features its controller last advertised.",
+      "description": "Returns every deployment-registered provider with its controller endpoint, data route base, and whether a credential is stored.",
       "name": "deployment/environment-providers/list",
       "paramStructure": "by-name",
       "params": [
@@ -22779,7 +23043,7 @@
       "x-lightspeed-target": null
     },
     {
-      "description": "Returns one deployment-registered provider with its controller endpoint and the optional features its controller last advertised.",
+      "description": "Returns one deployment-registered provider with its controller endpoint, data route base, and whether a credential is stored.",
       "name": "deployment/environment-providers/read",
       "paramStructure": "by-name",
       "params": [
@@ -22806,7 +23070,7 @@
       "x-lightspeed-target": null
     },
     {
-      "description": "Deletes a deployment provider only when no universe binding references it.",
+      "description": "Deletes a deployment provider only when no universe binding and no non-closed environment references it.",
       "name": "deployment/environment-providers/delete",
       "paramStructure": "by-name",
       "params": [
@@ -22833,7 +23097,7 @@
       "x-lightspeed-target": null
     },
     {
-      "description": "Creates or replaces one universe's complete revisioned routing and admission binding. A deployment provider may have at most one binding in a universe.",
+      "description": "Creates or replaces one universe's binding to a deployment provider. Only an enabled binding admits creates, template listing, and data routes for the universe.",
       "name": "deployment/environment-providers/bindings/put",
       "paramStructure": "by-name",
       "params": [
@@ -22860,7 +23124,7 @@
       "x-lightspeed-target": null
     },
     {
-      "description": "Deletes a universe provider binding only after every referencing environment has reached Closed.",
+      "description": "Deletes a universe's binding to a provider only when the universe has no non-closed environment of that provider.",
       "name": "deployment/environment-providers/bindings/delete",
       "paramStructure": "by-name",
       "params": [
@@ -22886,33 +23150,6 @@
       "x-lightspeed-role": null,
       "x-lightspeed-target": null
     },
-    {
-      "description": "Creates a universe environment by transferring an existing provider target into Lightspeed's managed lifecycle. The caller must explicitly accept ownership transfer.",
-      "name": "deployment/environments/adopt",
-      "paramStructure": "by-name",
-      "params": [
-        {
-          "name": "params",
-          "required": true,
-          "schema": {
-            "$ref": "#/components/schemas/DeploymentEnvironmentAdoptParams"
-          }
-        }
-      ],
-      "result": {
-        "name": "result",
-        "schema": {
-          "$ref": "#/components/schemas/AgentApiOutcomeOfDeploymentEnvironmentAdoptResponse"
-        }
-      },
-      "summary": "Adopt a provider environment",
-      "x-lightspeed-access": {
-        "kind": "deployment"
-      },
-      "x-lightspeed-group": "deployment/environment-providers",
-      "x-lightspeed-role": null,
-      "x-lightspeed-target": null
-    },
     {
       "description": "The connector host's discovery call: every enabled provider account of the deployment with its universe id and credential grant reference. Re-poll to pick up accounts created or disabled since.",
       "name": "deployment/channels/accounts/list",
diff --git a/crates/api/src/access.rs b/crates/api/src/access.rs
index feac11115..ea560607c 100644
--- a/crates/api/src/access.rs
+++ b/crates/api/src/access.rs
@@ -85,7 +85,7 @@ pub enum MethodGroup {
     DeploymentUniverses,
     #[serde(rename = "deployment/api-keys")]
     DeploymentApiKeys,
-    /// Environment providers, their bindings and adoption.
+    /// Environment providers and their universe bindings.
     #[serde(rename = "deployment/environment-providers")]
     DeploymentEnvironmentProviders,
     /// `deployment/channels/accounts/list`: a connector host's discovery.
@@ -208,7 +208,7 @@ impl MethodGroup {
             Self::DeploymentUniverses
         } else if group("deployment/api-keys/") {
             Self::DeploymentApiKeys
-        } else if group("deployment/environment-provider") || group("deployment/environments/") {
+        } else if group("deployment/environment-provider") {
             Self::DeploymentEnvironmentProviders
         } else if group("deployment/channels/") {
             Self::DeploymentChannels
@@ -514,10 +514,6 @@ mod tests {
                 "deployment/environment-provider-bindings/list",
                 Some(MethodGroup::DeploymentEnvironmentProviders),
             ),
-            (
-                "deployment/environments/adopt",
-                Some(MethodGroup::DeploymentEnvironmentProviders),
-            ),
             (
                 "deployment/channels/accounts/list",
                 Some(MethodGroup::DeploymentChannels),
diff --git a/crates/api/src/constants.rs b/crates/api/src/constants.rs
index 8d3b51385..0ba4b711a 100644
--- a/crates/api/src/constants.rs
+++ b/crates/api/src/constants.rs
@@ -98,12 +98,12 @@ pub const METHOD_MCP_SERVERS_DELETE: &str = "mcp/servers/delete";
 
 pub const METHOD_ENVIRONMENTS_CREATE: &str = "environments/create";
 pub const METHOD_ENVIRONMENTS_READ: &str = "environments/read";
+pub const METHOD_ENVIRONMENTS_UPDATE: &str = "environments/update";
 pub const METHOD_ENVIRONMENTS_LIST: &str = "environments/list";
 pub const METHOD_ENVIRONMENTS_CLOSE: &str = "environments/close";
 pub const METHOD_ENVIRONMENTS_EXTERNAL_CREATE: &str = "environments/external/create";
 pub const METHOD_ENVIRONMENTS_INGRESS_PUT: &str = "environments/ingress/put";
 pub const METHOD_ENVIRONMENTS_POWER_PUT: &str = "environments/power/put";
-pub const METHOD_ENVIRONMENTS_IDLE_POLICY_PUT: &str = "environments/idle-policy/put";
 pub const METHOD_ENVIRONMENTS_PROVIDER_BINDINGS_LIST: &str = "environments/provider-bindings/list";
 pub const METHOD_ENVIRONMENTS_PROVIDER_BINDINGS_READ: &str = "environments/provider-bindings/read";
 pub const METHOD_ENVIRONMENTS_TEMPLATES_LIST: &str = "environments/templates/list";
@@ -115,6 +115,10 @@ pub const METHOD_ENVIRONMENTS_REGISTRATION_KEYS_CREATE: &str =
     "environments/registration-keys/create";
 pub const METHOD_ENVIRONMENTS_REGISTRATION_KEYS_READ: &str = "environments/registration-keys/read";
 pub const METHOD_ENVIRONMENTS_REGISTRATION_KEYS_LIST: &str = "environments/registration-keys/list";
+pub const METHOD_ENVIRONMENTS_REGISTRATION_KEYS_UPDATE: &str =
+    "environments/registration-keys/update";
+pub const METHOD_ENVIRONMENTS_REGISTRATION_KEYS_ROTATE: &str =
+    "environments/registration-keys/rotate";
 pub const METHOD_ENVIRONMENTS_REGISTRATION_KEYS_REVOKE: &str =
     "environments/registration-keys/revoke";
 
diff --git a/crates/api/src/deployment.rs b/crates/api/src/deployment.rs
index d6aecc5c0..b5581efbe 100644
--- a/crates/api/src/deployment.rs
+++ b/crates/api/src/deployment.rs
@@ -37,7 +37,6 @@ pub const METHOD_DEPLOYMENT_PROVIDER_BINDINGS_PUT: &str =
     "deployment/environment-providers/bindings/put";
 pub const METHOD_DEPLOYMENT_PROVIDER_BINDINGS_DELETE: &str =
     "deployment/environment-providers/bindings/delete";
-pub const METHOD_DEPLOYMENT_ENVIRONMENTS_ADOPT: &str = "deployment/environments/adopt";
 pub const METHOD_DEPLOYMENT_CHANNELS_ACCOUNTS_LIST: &str = "deployment/channels/accounts/list";
 
 pub const METHOD_DEPLOYMENT_SESSIONS_DELETED_LIST: &str = "deployment/sessions/deleted/list";
@@ -272,16 +271,6 @@ pub struct DeploymentApiKeyRevokeResponse {
     pub api_key: DeploymentApiKeyView,
 }
 
-/// Optional controller methods the provider's controller advertised.
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
-#[serde(rename_all = "camelCase")]
-pub struct DeploymentEnvironmentProviderFeaturesView {
-    /// Existing targets can be adopted (`environment/adopt`).
-    pub adopt_target: bool,
-    /// Public ingress can be enabled on environments.
-    pub ingress: bool,
-}
-
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
 #[serde(rename_all = "camelCase")]
 pub struct DeploymentEnvironmentProviderView {
@@ -290,23 +279,25 @@ pub struct DeploymentEnvironmentProviderView {
     pub display_name: Option<String>,
     /// `ws://`, `wss://` or `unix://` URL of the provider controller.
     pub controller_endpoint: String,
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    pub metadata: BTreeMap<String, String>,
-    /// What the controller advertised at its last successful handshake;
-    /// absent until Lightspeed first reached it at this endpoint.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub controller_features: Option<DeploymentEnvironmentProviderFeaturesView>,
-    /// Base URL of the provider's data routes, as its controller advertised
-    /// it; absent until then.
+    /// Operator-configured `ws://` or `wss://` base of the provider's data
+    /// routes; absent derives it from the controller endpoint.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub data_route_base: Option<String>,
+    /// The data route base Lightspeed dials: `dataRouteBase`, or the
+    /// controller endpoint's origin followed by `/routes`. Absent only when it
+    /// cannot be derived.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub effective_data_route_base: Option<String>,
+    /// A bearer credential is stored and presented to the controller and
+    /// data routes; without one no `Authorization` header is sent.
+    pub has_credential: bool,
     pub created_at_ms: i64,
     pub updated_at_ms: i64,
 }
 
-/// Register or replace a provider. `credential` is the bearer token
-/// Lightspeed presents to the provider's controller and data routes: it is
-/// sealed on receipt and never returned by any method. `Debug` output
+/// Register or replace a provider. `credential` is the optional bearer
+/// token Lightspeed presents to the provider's controller and data routes:
+/// it is sealed on receipt and never returned by any method. `Debug` output
 /// redacts it; request logging must never echo these params.
 #[derive(Clone, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
 #[serde(rename_all = "camelCase")]
@@ -316,11 +307,18 @@ pub struct DeploymentEnvironmentProviderPutParams {
     pub display_name: Option<String>,
     /// `ws://`, `wss://` or `unix://` URL of the provider controller.
     pub controller_endpoint: String,
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    pub metadata: BTreeMap<String, String>,
-    /// Required when the provider is new; omit to keep the stored one.
+    /// `ws://` or `wss://` base of the provider's data routes; omit to derive
+    /// it from the controller endpoint. Required for a `unix://` controller,
+    /// and must not be `ws://` for a `wss://` controller.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub data_route_base: Option<String>,
+    /// A new bearer credential; omit to keep the stored one. A provider needs
+    /// none. Excludes `clearCredential`.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub credential: Option<String>,
+    /// Remove the stored credential. Excludes `credential`.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub clear_credential: bool,
 }
 
 impl fmt::Debug for DeploymentEnvironmentProviderPutParams {
@@ -329,11 +327,12 @@ impl fmt::Debug for DeploymentEnvironmentProviderPutParams {
             .field("provider_id", &self.provider_id)
             .field("display_name", &self.display_name)
             .field("controller_endpoint", &self.controller_endpoint)
-            .field("metadata", &self.metadata)
+            .field("data_route_base", &self.data_route_base)
             .field(
                 "credential",
                 &self.credential.as_ref().map(|_| "<redacted>"),
             )
+            .field("clear_credential", &self.clear_credential)
             .finish()
     }
 }
@@ -378,17 +377,14 @@ pub struct DeploymentEnvironmentProviderDeleteResponse {
     pub provider: DeploymentEnvironmentProviderView,
 }
 
+/// Create or replace a universe's binding to a deployment provider.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
 #[serde(rename_all = "camelCase")]
 pub struct DeploymentProviderBindingPutParams {
     pub universe_id: String,
-    pub binding_id: EnvironmentProviderBindingId,
     pub provider_id: EnvironmentProviderId,
-    pub status: EnvironmentProviderBindingStatusView,
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    pub metadata: BTreeMap<String, String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub expected_revision: Option<u64>,
+    /// Admits creates, template listing and data routes for the universe.
+    pub enabled: bool,
 }
 
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
@@ -401,7 +397,7 @@ pub struct DeploymentProviderBindingPutResponse {
 #[serde(rename_all = "camelCase")]
 pub struct DeploymentProviderBindingDeleteParams {
     pub universe_id: String,
-    pub binding_id: EnvironmentProviderBindingId,
+    pub provider_id: EnvironmentProviderId,
 }
 
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
@@ -410,31 +406,6 @@ pub struct DeploymentProviderBindingDeleteResponse {
     pub binding: EnvironmentProviderBindingView,
 }
 
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
-#[serde(rename_all = "camelCase")]
-pub struct DeploymentEnvironmentAdoptParams {
-    pub universe_id: String,
-    /// Stable caller-generated retry identity inside the destination universe.
-    pub request_id: EnvironmentProvisionRequestId,
-    pub binding_id: EnvironmentProviderBindingId,
-    /// Provider-native source reference. The Incus provider accepts
-    /// `<project>/<instance>` or an instance name in the `default` project.
-    pub source_target: String,
-    /// Required acknowledgement that Lightspeed will move, reconfigure, and
-    /// delete the target as part of its ordinary managed lifecycle.
-    pub take_ownership: bool,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub display_name: Option<String>,
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    pub metadata: BTreeMap<String, String>,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
-#[serde(rename_all = "camelCase")]
-pub struct DeploymentEnvironmentAdoptResponse {
-    pub environment: EnvironmentView,
-}
-
 /// One channel account of any universe, for the connector host's discovery
 /// pass.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
@@ -588,15 +559,6 @@ pub trait DeploymentApiService: Send + Sync {
         ))
     }
 
-    async fn adopt_environment(
-        &self,
-        _params: DeploymentEnvironmentAdoptParams,
-    ) -> Result<AgentApiOutcome<DeploymentEnvironmentAdoptResponse>, AgentApiError> {
-        Err(AgentApiError::internal(
-            "managed environment adoption is unavailable",
-        ))
-    }
-
     async fn list_deployment_channel_accounts(
         &self,
         _params: DeploymentChannelAccountListParams,
@@ -685,19 +647,17 @@ deployment_api_methods! {
     METHOD_DEPLOYMENT_API_KEYS_REVOKE => revoke_api_key(DeploymentApiKeyRevokeParams) -> DeploymentApiKeyRevokeResponse =>
         ["Revoke a scoped API key", "Revokes the key with this display prefix; revoking a revoked key keeps its first revocation time. An unknown prefix is not found."], access: MethodAccess::Deployment,
     METHOD_DEPLOYMENT_ENVIRONMENT_PROVIDERS_PUT => put_environment_provider(DeploymentEnvironmentProviderPutParams) -> DeploymentEnvironmentProviderPutResponse =>
-        ["Put an environment provider", "Registers or replaces one deployment provider: its controller endpoint URL and the bearer credential Lightspeed presents to the controller and data routes. The credential is write-only: required for a new provider, kept when omitted, never returned. The provider does not call this API or require access to Lightspeed."], access: MethodAccess::Deployment,
+        ["Put an environment provider", "Registers or replaces a deployment provider: controller endpoint, optional data route base, and optional bearer credential for controller and data routes (write-only: kept when omitted, removed by clearCredential, never returned). The controller is probed: a definitive refusal is invalid_request, unreachable is accepted. The provider never calls Lightspeed."], access: MethodAccess::Deployment,
     METHOD_DEPLOYMENT_ENVIRONMENT_PROVIDERS_LIST => list_environment_providers(DeploymentEnvironmentProviderListParams) -> DeploymentEnvironmentProviderListResponse =>
-        ["List environment providers", "Returns every deployment-registered provider with its controller endpoint and the optional features its controller last advertised."], access: MethodAccess::Deployment,
+        ["List environment providers", "Returns every deployment-registered provider with its controller endpoint, data route base, and whether a credential is stored."], access: MethodAccess::Deployment,
     METHOD_DEPLOYMENT_ENVIRONMENT_PROVIDERS_READ => read_environment_provider(DeploymentEnvironmentProviderReadParams) -> DeploymentEnvironmentProviderReadResponse =>
-        ["Read an environment provider", "Returns one deployment-registered provider with its controller endpoint and the optional features its controller last advertised."], access: MethodAccess::Deployment,
+        ["Read an environment provider", "Returns one deployment-registered provider with its controller endpoint, data route base, and whether a credential is stored."], access: MethodAccess::Deployment,
     METHOD_DEPLOYMENT_ENVIRONMENT_PROVIDERS_DELETE => delete_environment_provider(DeploymentEnvironmentProviderDeleteParams) -> DeploymentEnvironmentProviderDeleteResponse =>
-        ["Delete an environment provider", "Deletes a deployment provider only when no universe binding references it."], access: MethodAccess::Deployment,
+        ["Delete an environment provider", "Deletes a deployment provider only when no universe binding and no non-closed environment references it."], access: MethodAccess::Deployment,
     METHOD_DEPLOYMENT_PROVIDER_BINDINGS_PUT => put_environment_provider_binding(DeploymentProviderBindingPutParams) -> DeploymentProviderBindingPutResponse =>
-        ["Put an environment provider binding", "Creates or replaces one universe's complete revisioned routing and admission binding. A deployment provider may have at most one binding in a universe."], access: MethodAccess::Deployment,
+        ["Put an environment provider binding", "Creates or replaces one universe's binding to a deployment provider. Only an enabled binding admits creates, template listing, and data routes for the universe."], access: MethodAccess::Deployment,
     METHOD_DEPLOYMENT_PROVIDER_BINDINGS_DELETE => delete_environment_provider_binding(DeploymentProviderBindingDeleteParams) -> DeploymentProviderBindingDeleteResponse =>
-        ["Delete an environment provider binding", "Deletes a universe provider binding only after every referencing environment has reached Closed."], access: MethodAccess::Deployment,
-    METHOD_DEPLOYMENT_ENVIRONMENTS_ADOPT => adopt_environment(DeploymentEnvironmentAdoptParams) -> DeploymentEnvironmentAdoptResponse =>
-        ["Adopt a provider environment", "Creates a universe environment by transferring an existing provider target into Lightspeed's managed lifecycle. The caller must explicitly accept ownership transfer."], access: MethodAccess::Deployment,
+        ["Delete an environment provider binding", "Deletes a universe's binding to a provider only when the universe has no non-closed environment of that provider."], access: MethodAccess::Deployment,
     METHOD_DEPLOYMENT_CHANNELS_ACCOUNTS_LIST => list_deployment_channel_accounts(DeploymentChannelAccountListParams) -> DeploymentChannelAccountListResponse =>
         ["List channel accounts across universes", "The connector host's discovery call: every enabled provider account of the deployment with its universe id and credential grant reference. Re-poll to pick up accounts created or disabled since."], access: MethodAccess::Deployment,
 }
diff --git a/crates/api/src/environments.rs b/crates/api/src/environments.rs
index 6273cf3c5..3d17dcc65 100644
--- a/crates/api/src/environments.rs
+++ b/crates/api/src/environments.rs
@@ -29,17 +29,21 @@ pub struct SessionEnvironmentDeactivateResponse {
 #[serde(rename_all = "camelCase")]
 pub struct EnvironmentCreateParams {
     /// Stable caller-generated retry identity, unique inside the universe.
+    /// Retrying with identical inputs returns the same environment.
     pub request_id: EnvironmentProvisionRequestId,
-    pub binding_id: EnvironmentProviderBindingId,
-    /// Immutable provider template-version identity.
+    /// The provider to create the environment with; the universe needs an
+    /// enabled binding to it.
+    pub provider_id: EnvironmentProviderId,
+    /// The provider template to create the environment from.
     pub template_id: EnvironmentTemplateId,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub display_name: Option<String>,
     #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
     pub metadata: BTreeMap<String, String>,
-    /// Optional staged idle policy applied by the power reaper.
+    /// Idle policy passed to the provider in place of the template's `idle`.
+    /// The provider runs the idle clock; it cannot be changed after create.
     #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub idle_policy: Option<EnvironmentIdlePolicyView>,
+    pub idle: Option<EnvironmentIdlePolicyView>,
 }
 
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
@@ -60,29 +64,63 @@ pub struct EnvironmentReadResponse {
     pub environment: EnvironmentView,
 }
 
+/// Replace an environment's display name and caller metadata.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct EnvironmentUpdateParams {
+    pub environment_id: EnvironmentId,
+    /// The new display name; omit to clear it.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub display_name: Option<String>,
+    /// The complete new caller metadata; omit or `{}` to clear it.
+    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+    pub metadata: BTreeMap<String, String>,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct EnvironmentUpdateResponse {
+    pub environment: EnvironmentView,
+}
+
 #[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
 #[serde(rename_all = "camelCase")]
 pub struct EnvironmentListParams {
+    /// Only provisioned environments of this provider.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub provider_id: Option<EnvironmentProviderId>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub binding_id: Option<EnvironmentProviderBindingId>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub status: Option<EnvironmentLifecycleStatusView>,
     /// Only registered environments admitted by this registration key.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub registration_key_id: Option<EnvironmentRegistrationKeyId>,
+    /// Only environments in this lifecycle state. `closed` lists closed
+    /// environments without `includeClosed`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub state: Option<EnvironmentStateView>,
+    /// Also list closed environments; they are omitted by default.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub include_closed: bool,
     /// Only environments carrying every listed metadata pair (AND
     /// semantics); the same filter `session/list` accepts.
     #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
     pub metadata: BTreeMap<String, String>,
+    /// Most environments per page; omit for 100.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[schemars(range(min = 1, max = 500))]
+    pub limit: Option<u32>,
+    /// Exclusive environment id cursor: a previous page's `nextAfter`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub after: Option<EnvironmentId>,
 }
 
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
 #[serde(rename_all = "camelCase")]
 pub struct EnvironmentListResponse {
+    /// Environments in environment id order.
     #[serde(default)]
     pub environments: Vec<EnvironmentView>,
+    /// Pass as `after` to read the next page; absent on the last page.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub next_after: Option<EnvironmentId>,
 }
 
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
@@ -101,6 +139,7 @@ pub struct EnvironmentCloseResponse {
 #[serde(rename_all = "camelCase")]
 pub struct EnvironmentIngressPutParams {
     pub environment_id: EnvironmentId,
+    /// Ensure (`true`) or remove (`false`) the provider's public ingress.
     pub enabled: bool,
 }
 
@@ -110,7 +149,7 @@ pub struct EnvironmentIngressPutResponse {
     pub environment: EnvironmentView,
 }
 
-/// Steady power state of a provisioned environment.
+/// Power state of a provisioned environment's target.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
 #[serde(rename_all = "camelCase")]
 pub enum EnvironmentPowerStateView {
@@ -123,11 +162,13 @@ pub enum EnvironmentPowerStateView {
     Stopped,
 }
 
-/// Staged idle policy. Thresholds are milliseconds of daemon-reported idle
-/// time and must be non-decreasing in the order pause, suspend, stop, close.
-/// Stages whose power state the provider does not support are skipped.
+/// Staged idle policy the provider applies. Thresholds are milliseconds of
+/// envd-reported idle time (running processes, jobs and leftover process
+/// groups hold it at zero) and must be non-decreasing in the order pause,
+/// suspend, stop, close. Stages whose power state the template does not
+/// support are skipped.
 #[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
-#[serde(rename_all = "camelCase")]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct EnvironmentIdlePolicyView {
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub pause_after_ms: Option<u64>,
@@ -143,8 +184,8 @@ pub struct EnvironmentIdlePolicyView {
 #[serde(rename_all = "camelCase")]
 pub struct EnvironmentPowerPutParams {
     pub environment_id: EnvironmentId,
-    /// Desired steady power state. Must be one of the provider-reported
-    /// `incarnation.powerStates`.
+    /// Power state to move the target to; one of its template's
+    /// `powerStates`.
     pub power: EnvironmentPowerStateView,
 }
 
@@ -154,24 +195,10 @@ pub struct EnvironmentPowerPutResponse {
     pub environment: EnvironmentView,
 }
 
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
-#[serde(rename_all = "camelCase")]
-pub struct EnvironmentIdlePolicyPutParams {
-    pub environment_id: EnvironmentId,
-    /// The complete new policy; omit to clear it.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub idle_policy: Option<EnvironmentIdlePolicyView>,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
-#[serde(rename_all = "camelCase")]
-pub struct EnvironmentIdlePolicyPutResponse {
-    pub environment: EnvironmentView,
-}
-
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
 #[serde(rename_all = "camelCase")]
 pub struct EnvironmentExternalCreateParams {
+    /// Stable caller-generated retry identity, unique inside the universe.
     pub request_id: EnvironmentProvisionRequestId,
     /// `ws://`, `wss://` or `unix://` URL of an envd instance reachable from
     /// Lightspeed.
@@ -188,25 +215,104 @@ pub struct EnvironmentExternalCreateResponse {
     pub environment: EnvironmentView,
 }
 
+/// The lifecycle Lightspeed owns. External and registered environments are
+/// only ever `open` or `closed`.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
 #[serde(rename_all = "camelCase")]
-pub enum EnvironmentLifecycleStatusView {
+pub enum EnvironmentStateView {
+    /// The provider is creating the target; the environment opens after
+    /// Lightspeed's first handshake with its envd.
+    Provisioning,
+    Open,
+    /// The provider is removing the target.
+    Closing,
+    Closed,
+    /// Provisioning or the provider failed; `stateMessage` says why.
+    Failed,
+}
+
+/// Display status derived from `state` and the latest observation; never
+/// stored. Tools that use a paused, suspended or stopped environment wake
+/// it.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+pub enum EnvironmentStatusView {
     Provisioning,
-    Booting,
     Ready,
-    /// Execution frozen; wakes on next use.
+    /// Execution frozen with RAM resident.
     Paused,
-    /// Execution state saved to disk; wakes on next use.
+    /// Execution state saved to disk.
     Suspended,
-    /// Powered off; provisioned environments wake on next use when the
-    /// provider supports power control.
-    Offline,
+    /// Powered off with disk retained.
+    Stopped,
+    /// Open, but the provider's latest observation is inconclusive.
+    Unknown,
+    /// Registered, open, and its daemon is not connected.
+    Away,
+    Closing,
+    Closed,
+    Failed,
+}
+
+/// Why an environment is closing or closed.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+pub enum EnvironmentCloseReasonView {
+    /// `environments/close`.
+    Requested,
+    /// Its registration key was revoked with `closeEnvironments`.
+    KeyRevoked,
+    /// Its ephemeral daemon stayed away longer than the key's disconnect
+    /// grace.
+    EphemeralGrace,
+    /// Its ephemeral daemon said goodbye.
+    Departed,
+    /// Its persistent daemon stayed away longer than the key's
+    /// `offlineCloseAfterMs`.
+    OfflineTimeout,
+    /// The provider reported the target closed or gone.
+    ProviderEnded,
+}
+
+/// Lifecycle phase of a provider target, as the provider reports it.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+pub enum EnvironmentTargetPhaseView {
+    Provisioning,
+    Active,
     Closing,
     Closed,
     Failed,
     Unknown,
 }
 
+/// What the provider last reported about a provisioned environment's
+/// target. Display only: Lightspeed never converges it, and it may be up to
+/// a few minutes old.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct EnvironmentObservedTargetView {
+    pub phase: EnvironmentTargetPhaseView,
+    /// Present only while `phase` is `active`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub power: Option<EnvironmentPowerStateView>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub message: Option<String>,
+    pub observed_at_ms: i64,
+}
+
+/// The envd build serving an environment, from its registration or
+/// Lightspeed's open handshake.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct EnvironmentDaemonView {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub version: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub git_sha: Option<String>,
+    pub protocol_version: u32,
+}
+
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
 #[serde(
     tag = "type",
@@ -214,9 +320,24 @@ pub enum EnvironmentLifecycleStatusView {
     rename_all_fields = "camelCase"
 )]
 pub enum EnvironmentSourceView {
+    /// A target a deployment provider created from a template. The provider
+    /// owns its power, idle policy and ingress.
     Provisioned {
         provider_id: EnvironmentProviderId,
-        binding_id: EnvironmentProviderBindingId,
+        template_id: EnvironmentTemplateId,
+        /// The provider's handle for the target; absent until the provider
+        /// accepted the create.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        target_id: Option<EnvironmentTargetId>,
+        /// The create-time idle policy, when one replaced the template's.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        idle: Option<EnvironmentIdlePolicyView>,
+        /// Absent until the provider first reported the target.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        observed: Option<EnvironmentObservedTargetView>,
+        /// The public endpoint the provider last reported.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        public_endpoint: Option<String>,
     },
     External {
         /// `ws://`, `wss://` or `unix://` URL Lightspeed dials envd at.
@@ -228,19 +349,30 @@ pub enum EnvironmentSourceView {
     Registered {
         registration_key_id: EnvironmentRegistrationKeyId,
         daemon_id: EnvironmentDaemonId,
+        /// The admitting key's identity mode.
         identity_mode: EnvironmentIdentityModeView,
+        /// The daemon's control connection is up.
+        connected: bool,
+        /// When the daemon last connected or disconnected.
+        connection_changed_at_ms: i64,
+        /// When the gateway last recorded the daemon's control connection:
+        /// at connect, at disconnect, and at most every five minutes while
+        /// connected.
+        last_seen_at_ms: i64,
     },
 }
 
-/// What Lightspeed does with a registered environment while its daemon is
-/// disconnected. Registration-key policy, copied onto each environment.
+/// What happens to a registered environment while its daemon is
+/// disconnected. Policy of the registration key that admitted it.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
 #[serde(rename_all = "camelCase")]
 pub enum EnvironmentIdentityModeView {
-    /// Stays offline until explicitly closed.
+    /// Stays open: tools wait up to two minutes for the daemon to reconnect.
+    /// Closed explicitly, or after the key's `offlineCloseAfterMs`.
     Persistent,
-    /// Closed once the daemon has been away longer than the key's
-    /// disconnect grace.
+    /// Unusable while disconnected; closed once the daemon has been away
+    /// longer than the key's disconnect grace, or at once when it says
+    /// goodbye.
     Ephemeral,
 }
 
@@ -258,13 +390,17 @@ pub struct EnvironmentRegistrationKeyView {
     pub registration_key_id: EnvironmentRegistrationKeyId,
     /// The group name shown wherever registered environments are listed.
     pub display_name: String,
-    /// First characters of the secret, for identification only.
+    /// First characters of the key's live secret, for identification only.
     pub key_prefix: String,
     pub identity_mode: EnvironmentIdentityModeView,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub max_active_environments: Option<u32>,
     /// Effective disconnect grace for ephemeral environments.
     pub ephemeral_disconnect_grace_ms: u64,
+    /// Persistent keys only: environments whose daemon has been away longer
+    /// than this are closed; absent keeps them open.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub offline_close_after_ms: Option<u64>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub expires_at_ms: Option<i64>,
     pub status: EnvironmentRegistrationKeyStatusView,
@@ -275,6 +411,7 @@ pub struct EnvironmentRegistrationKeyView {
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub last_registered_at_ms: Option<i64>,
     pub created_at_ms: i64,
+    pub updated_at_ms: i64,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub revoked_at_ms: Option<i64>,
 }
@@ -296,6 +433,7 @@ impl fmt::Debug for EnvironmentRegistrationSecretView {
 pub struct EnvironmentRegistrationKeyCreateParams {
     /// Group name for the environments this key admits.
     pub display_name: String,
+    /// Immutable once the key exists.
     pub identity_mode: EnvironmentIdentityModeView,
     /// Non-closed environments the key may have at once; omit for unlimited.
     #[serde(default, skip_serializing_if = "Option::is_none")]
@@ -303,6 +441,10 @@ pub struct EnvironmentRegistrationKeyCreateParams {
     /// Disconnect grace for ephemeral environments; omit for the default.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub ephemeral_disconnect_grace_ms: Option<u64>,
+    /// Persistent keys only: close environments whose daemon has been away
+    /// longer than this; omit to keep them open.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub offline_close_after_ms: Option<u64>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub expires_at_ms: Option<i64>,
 }
@@ -315,6 +457,48 @@ pub struct EnvironmentRegistrationKeyCreateResponse {
     pub secret: EnvironmentRegistrationSecretView,
 }
 
+/// The complete editable policy of a registration key; an absent field is
+/// unset. The identity mode is immutable.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct EnvironmentRegistrationKeyUpdateParams {
+    pub registration_key_id: EnvironmentRegistrationKeyId,
+    /// Group name for the environments this key admits.
+    pub display_name: String,
+    /// Non-closed environments the key may have at once; omit for unlimited.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub max_active_environments: Option<u32>,
+    /// Disconnect grace for ephemeral environments; omit for the default.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub ephemeral_disconnect_grace_ms: Option<u64>,
+    /// Persistent keys only: close environments whose daemon has been away
+    /// longer than this; omit to keep them open.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub offline_close_after_ms: Option<u64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub expires_at_ms: Option<i64>,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct EnvironmentRegistrationKeyUpdateResponse {
+    pub registration_key: EnvironmentRegistrationKeyView,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct EnvironmentRegistrationKeyRotateParams {
+    pub registration_key_id: EnvironmentRegistrationKeyId,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct EnvironmentRegistrationKeyRotateResponse {
+    pub registration_key: EnvironmentRegistrationKeyView,
+    /// The new plaintext secret, returned only here.
+    pub secret: EnvironmentRegistrationSecretView,
+}
+
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
 #[serde(rename_all = "camelCase")]
 pub struct EnvironmentRegistrationKeyReadParams {
@@ -356,86 +540,46 @@ pub struct EnvironmentRegistrationKeyRevokeResponse {
     pub closed_environment_ids: Vec<EnvironmentId>,
 }
 
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
-#[serde(rename_all = "camelCase")]
-pub struct EnvironmentIncarnationView {
-    pub incarnation_id: EnvironmentIncarnationId,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub provision_request_id: Option<EnvironmentProvisionRequestId>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub provider_target_id: Option<EnvironmentTargetId>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub template_id: Option<EnvironmentTemplateId>,
-    /// Power states the provider reported for this target; empty until
-    /// observed or when the provider offers no power control.
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub power_states: Vec<EnvironmentPowerStateView>,
-    pub created_at_ms: i64,
-    pub updated_at_ms: i64,
-}
-
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
 #[serde(rename_all = "camelCase")]
 pub struct EnvironmentView {
     pub environment_id: EnvironmentId,
-    pub request_id: EnvironmentProvisionRequestId,
+    /// The caller's retry identity; absent for registered environments.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub request_id: Option<EnvironmentProvisionRequestId>,
     pub source: EnvironmentSourceView,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub display_name: Option<String>,
-    pub status: EnvironmentLifecycleStatusView,
-    /// Lightspeed-owned power intent; `status` is the observed state.
-    pub desired_power: EnvironmentPowerStateView,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub idle_policy: Option<EnvironmentIdlePolicyView>,
-    pub incarnation: EnvironmentIncarnationView,
-    /// Lightspeed-owned public ingress intent; `publicEndpoint` is what the
-    /// provider realized.
-    pub public_ingress_enabled: bool,
-    /// The public endpoint the provider last reported. It lags
-    /// `publicIngressEnabled` while the lifecycle reconciler converges.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub public_endpoint: Option<String>,
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    pub metadata: BTreeMap<String, String>,
-    /// Registered environments only: when the gateway last saw the daemon's
-    /// control connection.
+    pub state: EnvironmentStateView,
+    pub status: EnvironmentStatusView,
+    /// Why the environment failed, or what provisioning or closing is
+    /// waiting on.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub state_message: Option<String>,
+    /// Present exactly while `state` is `closing` or `closed`.
     #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub last_seen_at_ms: Option<i64>,
-    /// Why the environment failed, or the latest error (or what the
-    /// provider reports it is waiting on) while its lifecycle converges;
-    /// absent once it reaches a steady state.
+    pub close_reason: Option<EnvironmentCloseReasonView>,
+    /// When `state` last changed.
+    pub state_changed_at_ms: i64,
+    /// The envd build serving the environment; absent until known.
     #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub lifecycle_error: Option<EnvironmentLifecycleErrorView>,
+    pub daemon: Option<EnvironmentDaemonView>,
+    /// Caller metadata.
+    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+    pub metadata: BTreeMap<String, String>,
     pub created_at_ms: i64,
     pub updated_at_ms: i64,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub closed_at_ms: Option<i64>,
 }
 
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
-#[serde(rename_all = "camelCase")]
-pub struct EnvironmentLifecycleErrorView {
-    pub message: String,
-    /// When the current run of errors began.
-    pub first_at_ms: i64,
-    /// When `message` was recorded.
-    pub last_at_ms: i64,
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
-#[serde(rename_all = "camelCase")]
-pub enum EnvironmentProviderBindingStatusView {
-    Enabled,
-    Disabled,
-}
-
+/// A universe's binding to a deployment provider. Creates, templates and
+/// data routes of the provider need it enabled.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
 #[serde(rename_all = "camelCase")]
 pub struct EnvironmentProviderBindingView {
-    pub binding_id: EnvironmentProviderBindingId,
     pub provider_id: EnvironmentProviderId,
-    pub status: EnvironmentProviderBindingStatusView,
-    pub revision: u64,
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    pub metadata: BTreeMap<String, String>,
+    pub enabled: bool,
     pub created_at_ms: i64,
     pub updated_at_ms: i64,
 }
@@ -453,7 +597,7 @@ pub struct EnvironmentProviderBindingListResponse {
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
 #[serde(rename_all = "camelCase")]
 pub struct EnvironmentProviderBindingReadParams {
-    pub binding_id: EnvironmentProviderBindingId,
+    pub provider_id: EnvironmentProviderId,
 }
 
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
@@ -467,16 +611,23 @@ pub struct EnvironmentProviderBindingReadResponse {
 pub struct EnvironmentTemplateView {
     pub template_id: EnvironmentTemplateId,
     pub provider_id: EnvironmentProviderId,
-    pub binding_id: EnvironmentProviderBindingId,
     pub display_name: String,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub description: Option<String>,
+    /// `environments/ingress/put` can enable public ingress on targets of
+    /// this template.
     pub public_ingress: bool,
     pub deprecated: bool,
     /// Compute targets of this template get; absent when the provider does
     /// not fix it.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub resources: Option<EnvironmentTemplateResourcesView>,
+    /// Power states `environments/power/put` can move targets of this
+    /// template to; empty without power control.
+    pub power_states: Vec<EnvironmentPowerStateView>,
+    /// Idle policy targets get when `environments/create` names none.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub idle: Option<EnvironmentIdlePolicyView>,
     #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
     pub metadata: BTreeMap<String, String>,
 }
@@ -497,8 +648,9 @@ pub struct EnvironmentTemplateResourcesView {
 #[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
 #[serde(rename_all = "camelCase")]
 pub struct EnvironmentTemplateListParams {
+    /// Only this provider's templates; omit for every enabled binding.
     #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub binding_id: Option<EnvironmentProviderBindingId>,
+    pub provider_id: Option<EnvironmentProviderId>,
 }
 
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
@@ -510,7 +662,7 @@ pub struct EnvironmentTemplateListResponse {
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
 #[serde(rename_all = "camelCase")]
 pub struct EnvironmentTemplateReadParams {
-    pub binding_id: EnvironmentProviderBindingId,
+    pub provider_id: EnvironmentProviderId,
     pub template_id: EnvironmentTemplateId,
 }
 
diff --git a/crates/api/src/ids.rs b/crates/api/src/ids.rs
index e6aaeaca3..09425304c 100644
--- a/crates/api/src/ids.rs
+++ b/crates/api/src/ids.rs
@@ -6,9 +6,7 @@ pub type ItemId = String;
 pub type SkillId = String;
 pub type EnvironmentId = String;
 pub type EnvironmentProviderId = String;
-pub type EnvironmentProviderBindingId = String;
 pub type EnvironmentProvisionRequestId = String;
-pub type EnvironmentIncarnationId = String;
 pub type EnvironmentTemplateId = String;
 pub type EnvironmentTargetId = String;
 pub type EnvironmentJobGroupId = String;
diff --git a/crates/api/src/rpc.rs b/crates/api/src/rpc.rs
index e4320e92f..ad40d6161 100644
--- a/crates/api/src/rpc.rs
+++ b/crates/api/src/rpc.rs
@@ -22,8 +22,8 @@ pub enum AgentApiErrorKind {
     /// rather than an ordinary "answer this message" failure.
     SessionBootstrapFailed,
     /// The environment exists but is not reachable yet: it is still
-    /// provisioning/booting, or it was powered down and a wake (desired
-    /// power `running`) has been initiated by this request. Distinct from
+    /// provisioning, its provider is waking or booting it after a data
+    /// route dial, or its registered daemon is reconnecting. Distinct from
     /// `Rejected` so clients retry with backoff instead of failing —
     /// polling and automation callers lean on this for wake-on-use.
     EnvironmentNotReady,
@@ -395,41 +395,45 @@ api_methods! {
     METHOD_ENVIRONMENTS_CREDENTIALS_UNBIND => unbind_environment_credential(EnvironmentCredentialUnbindParams) -> EnvironmentCredentialUnbindResponse =>
         ["Unbind an environment credential", "Removes one variable-to-credential mapping without deleting the underlying grant, provider credential, or secret."], access: MethodAccess::Universe(UniverseAction::ConfigureResource),
     METHOD_ENVIRONMENTS_CREATE => create_environment(EnvironmentCreateParams) -> EnvironmentCreateResponse =>
-        ["Create an environment", "Records an idempotent provisioning intent against an enabled universe binding, attributed to the caller. The provider validates its provider-wide template and provisions through its backend asynchronously."], access: MethodAccess::Universe(UniverseAction::ConfigureResource),
+        ["Create an environment", "Creates a provisioned environment, attributed to the caller, from a template of a provider enabled for the universe. Idempotent per requestId: same inputs, same environment; others conflict. Provisioning until the target's first envd handshake, then open; idle overrides the template default."], access: MethodAccess::Universe(UniverseAction::ConfigureResource),
     METHOD_ENVIRONMENTS_READ => read_environment(EnvironmentReadParams) -> EnvironmentReadResponse =>
-        ["Read an environment", "Returns the durable universe resource, source binding, logical lifecycle state, and minimal current-incarnation identity."], access: MethodAccess::Universe(UniverseAction::Read),
+        ["Read an environment", "Returns one environment: its source, lifecycle state, derived display status, state message, close reason, daemon build, and the latest provider observation."], access: MethodAccess::Universe(UniverseAction::Read),
+    METHOD_ENVIRONMENTS_UPDATE => update_environment(EnvironmentUpdateParams) -> EnvironmentUpdateResponse =>
+        ["Update an environment", "Replaces the display name and caller metadata of an environment of any kind. Refused for a closed environment."], access: MethodAccess::Universe(UniverseAction::ConfigureResource),
     METHOD_ENVIRONMENTS_LIST => list_environments(EnvironmentListParams) -> EnvironmentListResponse =>
-        ["List environments", "Lists the universe environments, optionally filtered by provider, binding, or logical lifecycle state."], access: MethodAccess::Universe(UniverseAction::Read),
+        ["List environments", "Lists the universe environments in id order, one page at a time, optionally filtered by provider, registration key, state, or metadata. Closed environments are omitted unless includeClosed is set or state is closed. Continue from nextAfter."], access: MethodAccess::Universe(UniverseAction::Read),
     METHOD_ENVIRONMENTS_CLOSE => close_environment(EnvironmentCloseParams) -> EnvironmentCloseResponse =>
-        ["Close an environment", "Records an asynchronous idempotent close intent. Provider cleanup is resumed by lifecycle reconciliation; quota is released only after Closed."], access: MethodAccess::Universe(UniverseAction::ConfigureResource),
+        ["Close an environment", "Closes an environment; idempotent. A provisioned environment moves to closing while Lightspeed asks its provider to remove the target, retrying until it is gone, then closed. External and registered environments close at once, and a connected registered daemon is told its environment closed."], access: MethodAccess::Universe(UniverseAction::ConfigureResource),
     METHOD_ENVIRONMENTS_EXTERNAL_CREATE => create_external_environment(EnvironmentExternalCreateParams) -> EnvironmentExternalCreateResponse =>
-        ["Register an external environment", "Creates an environment backed by a Lightspeed-reachable envd WebSocket endpoint, attributed to the caller. Reachability is checked on demand."], access: MethodAccess::Universe(UniverseAction::ConfigureResource),
+        ["Register an external environment", "Creates an open environment backed by a Lightspeed-reachable envd endpoint, attributed to the caller. Idempotent per requestId. Reachability is checked on use."], access: MethodAccess::Universe(UniverseAction::ConfigureResource),
     METHOD_ENVIRONMENTS_INGRESS_PUT => put_environment_ingress(EnvironmentIngressPutParams) -> EnvironmentIngressPutResponse =>
-        ["Configure environment public ingress", "Records the public ingress intent of a provisioned environment; the lifecycle reconciler converges it while the environment is ready, and `publicEndpoint` shows the realized endpoint. Rejected when the provider does not offer ingress. The provider owns hostname, guest port, routing, TLS, and health; an intent its template refuses is dropped."], access: MethodAccess::Universe(UniverseAction::ConfigureResource),
+        ["Configure environment public ingress", "Synchronously ensures or removes public ingress of an open provisioned environment through its provider; source.publicEndpoint carries the reported endpoint. Rejected when the provider offers no ingress; an internal error, safe to retry, when the provider is unreachable or times out. The provider owns hostname, guest port, routing, TLS, and health."], access: MethodAccess::Universe(UniverseAction::ConfigureResource),
     METHOD_ENVIRONMENTS_POWER_PUT => put_environment_power(EnvironmentPowerPutParams) -> EnvironmentPowerPutResponse =>
-        ["Set environment power intent", "Records the desired power state (running, paused, suspended, or stopped) of a provisioned environment; the lifecycle reconciler converges the provider target asynchronously. Powered-down environments wake transparently on their next use. Rejected when the provider does not support the state."], access: MethodAccess::Universe(UniverseAction::ConfigureResource),
-    METHOD_ENVIRONMENTS_IDLE_POLICY_PUT => put_environment_idle_policy(EnvironmentIdlePolicyPutParams) -> EnvironmentIdlePolicyPutResponse =>
-        ["Set environment idle policy", "Replaces or clears the staged idle policy of a provisioned environment. The power reaper measures the daemon's idle duration against the pause/suspend/stop/close thresholds and escalates through the stages the provider supports."], access: MethodAccess::Universe(UniverseAction::ConfigureResource),
+        ["Set environment power", "Synchronously moves an open provisioned environment's target to running, paused, suspended, or stopped via its provider and records the observation; the provider may also change power on idle. Rejected without provider power control or when the template lacks the state; an internal error, safe to retry, when the provider is unreachable or times out."], access: MethodAccess::Universe(UniverseAction::ConfigureResource),
     METHOD_ENVIRONMENTS_PROVIDER_BINDINGS_LIST => list_environment_provider_bindings(EnvironmentProviderBindingListParams) -> EnvironmentProviderBindingListResponse =>
-        ["List environment provider bindings", "Lists this universe's revisioned routing and admission bindings to deployment-scoped physical providers."], access: MethodAccess::Universe(UniverseAction::Read),
+        ["List environment provider bindings", "Lists this universe's bindings to deployment providers and whether each is enabled."], access: MethodAccess::Universe(UniverseAction::Read),
     METHOD_ENVIRONMENTS_PROVIDER_BINDINGS_READ => read_environment_provider_binding(EnvironmentProviderBindingReadParams) -> EnvironmentProviderBindingReadResponse =>
-        ["Read an environment provider binding", "Returns one universe routing and admission binding. Provider-wide templates and physical resource, network, and ingress policy remain provider-owned."], access: MethodAccess::Universe(UniverseAction::Read),
+        ["Read an environment provider binding", "Returns this universe's binding to one provider. Templates and physical resource, network, and ingress policy remain provider-owned."], access: MethodAccess::Universe(UniverseAction::Read),
     METHOD_ENVIRONMENTS_TEMPLATES_LIST => list_environment_templates(EnvironmentTemplateListParams) -> EnvironmentTemplateListResponse =>
-        ["List environment templates", "Reads immutable templates directly from the selected bound provider controller."], access: MethodAccess::Universe(UniverseAction::Read),
+        ["List environment templates", "Reads templates live from the controllers of the universe's enabled provider bindings, or of one provider: compute, power states, public ingress, and default idle policy."], access: MethodAccess::Universe(UniverseAction::Read),
     METHOD_ENVIRONMENTS_TEMPLATES_READ => read_environment_template(EnvironmentTemplateReadParams) -> EnvironmentTemplateReadResponse =>
-        ["Read an environment template", "Returns one immutable template version from the selected bound provider controller."], access: MethodAccess::Universe(UniverseAction::Read),
+        ["Read an environment template", "Returns one template, read live from a bound provider's controller."], access: MethodAccess::Universe(UniverseAction::Read),
     METHOD_ENVIRONMENTS_JOBS_CREATE => create_environment_jobs(EnvironmentJobCreateParams) -> EnvironmentJobCreateResponse =>
-        ["Create environment jobs", "Starts a dependency-aware job group on one environment instance, injecting the environment's configured credentials at provider start. requestId is the retry identity; jobs are owned by the instance rather than a session. A powered-down environment is woken on use: the call fails with environment_not_ready while the wake is in progress; retry with backoff."], access: MethodAccess::Universe(UniverseAction::UseResource),
+        ["Create environment jobs", "Starts a dependency-aware job group on one environment instance, injecting its configured credentials at provider start. requestId is the retry identity; jobs are owned by the instance, not a session. A powered-down environment wakes on its data route; the call fails with environment_not_ready while it wakes or reconnects; retry with backoff."], access: MethodAccess::Universe(UniverseAction::UseResource),
     METHOD_ENVIRONMENTS_JOBS_READ => read_environment_jobs(EnvironmentJobReadParams) -> EnvironmentJobReadResponse =>
         ["Read environment jobs", "Reads selected job handles with bounded output from a byte offset or the output tail; continue from each entry's outputNext and poll on the returned status."], access: MethodAccess::Universe(UniverseAction::Read),
     METHOD_ENVIRONMENTS_JOBS_CANCEL => cancel_environment_jobs(EnvironmentJobCancelParams) -> EnvironmentJobCancelResponse =>
         ["Cancel environment jobs", "Requests cancellation for selected jobs, optionally including dependents. Force is provider-specific escalation; inspect each per-job result."], access: MethodAccess::Universe(UniverseAction::UseResource),
     METHOD_ENVIRONMENTS_REGISTRATION_KEYS_CREATE => create_environment_registration_key(EnvironmentRegistrationKeyCreateParams) -> EnvironmentRegistrationKeyCreateResponse =>
-        ["Mint an environment registration key", "Creates a reusable universe-scoped key that lets outbound envd daemons register as environments. The plaintext secret is returned exactly once; only its hash is stored. Identity mode, active limit, disconnect grace, and expiry are the key's policy. Treat the secret like a cluster-join credential."], access: MethodAccess::Universe(UniverseAction::ConfigureResource),
+        ["Mint an environment registration key", "Creates a reusable universe-scoped key that lets outbound envd daemons register as environments. The plaintext secret is returned exactly once; only its hash is stored. Identity mode (immutable), active limit, disconnect grace, offline close-after, and expiry are the key's policy. Treat the secret like a cluster-join credential."], access: MethodAccess::Universe(UniverseAction::ConfigureResource),
     METHOD_ENVIRONMENTS_REGISTRATION_KEYS_READ => read_environment_registration_key(EnvironmentRegistrationKeyReadParams) -> EnvironmentRegistrationKeyReadResponse =>
         ["Read an environment registration key", "Returns the key's display prefix, policy, status, and derived environment counts; never the secret or its hash."], access: MethodAccess::Universe(UniverseAction::ConfigureResource),
     METHOD_ENVIRONMENTS_REGISTRATION_KEYS_LIST => list_environment_registration_keys(EnvironmentRegistrationKeyListParams) -> EnvironmentRegistrationKeyListResponse =>
         ["List environment registration keys", "Lists this universe's registration keys with policy, status, and derived counts. Each key is the group of the environments it admitted."], access: MethodAccess::Universe(UniverseAction::ConfigureResource),
+    METHOD_ENVIRONMENTS_REGISTRATION_KEYS_UPDATE => update_environment_registration_key(EnvironmentRegistrationKeyUpdateParams) -> EnvironmentRegistrationKeyUpdateResponse =>
+        ["Update an environment registration key", "Replaces a key's editable policy: display name, active limit, disconnect grace, offline close-after, and expiry; an omitted field is unset. The identity mode is immutable. The active limit and expiry apply to later admissions; a changed disconnect grace or offline close-after applies at the next sweep to environments whose daemon is away."], access: MethodAccess::Universe(UniverseAction::ConfigureResource),
+    METHOD_ENVIRONMENTS_REGISTRATION_KEYS_ROTATE => rotate_environment_registration_key(EnvironmentRegistrationKeyRotateParams) -> EnvironmentRegistrationKeyRotateResponse =>
+        ["Rotate an environment registration key", "Replaces the key's secret and display prefix and retires the old secret at once. The key keeps its id, group, policy, and the environments it admitted; daemons already registered are unaffected because they never present the key again. Returns the new secret once. Refused for a revoked key."], access: MethodAccess::Universe(UniverseAction::ConfigureResource),
     METHOD_ENVIRONMENTS_REGISTRATION_KEYS_REVOKE => revoke_environment_registration_key(EnvironmentRegistrationKeyRevokeParams) -> EnvironmentRegistrationKeyRevokeResponse =>
         ["Revoke an environment registration key", "Stops the key from admitting new daemon identities; already registered daemons keep reconnecting. With closeEnvironments, also closes every non-closed environment the key admitted. Idempotent."], access: MethodAccess::Universe(UniverseAction::ConfigureResource),
     METHOD_TRANSCRIPTIONS_START => start_transcription(TranscriptionStartParams) -> TranscriptionResponse =>
diff --git a/crates/api/src/schema_export.rs b/crates/api/src/schema_export.rs
index e3f5e6065..57c4f1c5f 100644
--- a/crates/api/src/schema_export.rs
+++ b/crates/api/src/schema_export.rs
@@ -205,13 +205,13 @@ mod tests {
         methods.sort_unstable();
         methods.dedup();
         assert_eq!(methods.len(), total, "duplicate method in manifest");
-        assert_eq!(total, 140);
+        assert_eq!(total, 141);
         assert_eq!(
             manifest
                 .iter()
                 .filter(|spec| spec.scope == crate::MethodScope::Deployment)
                 .count(),
-            20
+            19
         );
     }
 
diff --git a/crates/api/src/service.rs b/crates/api/src/service.rs
index 34cb75a32..1d59cb0dc 100644
--- a/crates/api/src/service.rs
+++ b/crates/api/src/service.rs
@@ -222,6 +222,11 @@ pub trait AgentApiService: Send + Sync {
         params: EnvironmentReadParams,
     ) -> Result<AgentApiOutcome<EnvironmentReadResponse>, AgentApiError>;
 
+    async fn update_environment(
+        &self,
+        params: EnvironmentUpdateParams,
+    ) -> Result<AgentApiOutcome<EnvironmentUpdateResponse>, AgentApiError>;
+
     async fn list_environments(
         &self,
         params: EnvironmentListParams,
@@ -247,11 +252,6 @@ pub trait AgentApiService: Send + Sync {
         params: EnvironmentPowerPutParams,
     ) -> Result<AgentApiOutcome<EnvironmentPowerPutResponse>, AgentApiError>;
 
-    async fn put_environment_idle_policy(
-        &self,
-        params: EnvironmentIdlePolicyPutParams,
-    ) -> Result<AgentApiOutcome<EnvironmentIdlePolicyPutResponse>, AgentApiError>;
-
     async fn list_environment_provider_bindings(
         &self,
         _params: EnvironmentProviderBindingListParams,
@@ -333,6 +333,16 @@ pub trait AgentApiService: Send + Sync {
         params: EnvironmentRegistrationKeyListParams,
     ) -> Result<AgentApiOutcome<EnvironmentRegistrationKeyListResponse>, AgentApiError>;
 
+    async fn update_environment_registration_key(
+        &self,
+        params: EnvironmentRegistrationKeyUpdateParams,
+    ) -> Result<AgentApiOutcome<EnvironmentRegistrationKeyUpdateResponse>, AgentApiError>;
+
+    async fn rotate_environment_registration_key(
+        &self,
+        params: EnvironmentRegistrationKeyRotateParams,
+    ) -> Result<AgentApiOutcome<EnvironmentRegistrationKeyRotateResponse>, AgentApiError>;
+
     async fn revoke_environment_registration_key(
         &self,
         params: EnvironmentRegistrationKeyRevokeParams,
diff --git a/crates/api/src/tests.rs b/crates/api/src/tests.rs
index f74b8695d..5244c66cc 100644
--- a/crates/api/src/tests.rs
+++ b/crates/api/src/tests.rs
@@ -910,9 +910,9 @@ async fn dispatch_json_rpc_routes_environments_create() {
             method: METHOD_ENVIRONMENTS_CREATE.to_owned(),
             params: Some(json!({
                 "requestId": "request-1",
-                "bindingId": "primary",
+                "providerId": "bridge-local",
                 "templateId": "rust-v1",
-                "resources": { "cpu": 2, "memoryBytes": 2147483648_u64, "diskBytes": 10737418240_u64 }
+                "idle": { "pauseAfterMs": 60000 }
             })),
         },
     )
@@ -926,7 +926,7 @@ async fn dispatch_json_rpc_routes_environments_create() {
 }
 
 #[tokio::test(flavor = "current_thread")]
-async fn dispatch_json_rpc_routes_environment_power_and_idle_policy_put() {
+async fn dispatch_json_rpc_routes_environment_power_put() {
     let response = dispatch_json_rpc(
         &TestService,
         JsonRpcRequest {
@@ -941,30 +941,77 @@ async fn dispatch_json_rpc_routes_environment_power_and_idle_policy_put() {
     .await;
     assert!(response.error.is_none(), "{:?}", response.error);
     let environment = &response.result.expect("result")["result"]["environment"];
-    assert_eq!(environment["desiredPower"], json!("paused"));
+    assert_eq!(environment["status"], json!("paused"));
     assert_eq!(
-        environment["incarnation"]["powerStates"],
-        json!(["running", "paused"])
+        environment["source"]["observed"],
+        json!({"phase": "active", "power": "paused", "observedAtMs": 20})
     );
+    assert!(environment.get("desiredPower").is_none());
+}
 
+#[tokio::test(flavor = "current_thread")]
+async fn environment_create_rejects_unknown_idle_fields() {
     let response = dispatch_json_rpc(
         &TestService,
         JsonRpcRequest {
-            id: RequestId::Number(2),
-            method: METHOD_ENVIRONMENTS_IDLE_POLICY_PUT.to_owned(),
+            id: RequestId::Number(1),
+            method: METHOD_ENVIRONMENTS_CREATE.to_owned(),
+            params: Some(json!({
+                "requestId": "request-1",
+                "providerId": "bridge-local",
+                "templateId": "rust-v1",
+                "idle": { "hibernateAfterMs": 60000 }
+            })),
+        },
+    )
+    .await;
+    assert_eq!(
+        response.error.expect("invalid params").code,
+        JsonRpcError::invalid_params("").code
+    );
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn dispatch_json_rpc_routes_environment_update() {
+    let response = dispatch_json_rpc(
+        &TestService,
+        JsonRpcRequest {
+            id: RequestId::Number(1),
+            method: METHOD_ENVIRONMENTS_UPDATE.to_owned(),
             params: Some(json!({
                 "environmentId": "evi_test",
-                "idlePolicy": {"pauseAfterMs": 60000, "closeAfterMs": 3600000}
+                "displayName": "Renamed",
+                "metadata": {"team": "build"}
             })),
         },
     )
     .await;
     assert!(response.error.is_none(), "{:?}", response.error);
     let environment = &response.result.expect("result")["result"]["environment"];
-    assert_eq!(
-        environment["idlePolicy"],
-        json!({"pauseAfterMs": 60000, "closeAfterMs": 3600000})
-    );
+    assert_eq!(environment["displayName"], json!("Renamed"));
+    assert_eq!(environment["metadata"], json!({"team": "build"}));
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn dispatch_json_rpc_routes_environment_list_pages() {
+    let response = dispatch_json_rpc(
+        &TestService,
+        JsonRpcRequest {
+            id: RequestId::Number(1),
+            method: METHOD_ENVIRONMENTS_LIST.to_owned(),
+            params: Some(json!({
+                "state": "open",
+                "includeClosed": true,
+                "limit": 1,
+                "after": "evi_a"
+            })),
+        },
+    )
+    .await;
+    assert!(response.error.is_none(), "{:?}", response.error);
+    let result = &response.result.expect("result")["result"];
+    assert_eq!(result["environments"][0]["state"], json!("open"));
+    assert_eq!(result["nextAfter"], json!("evi_test"));
 }
 
 #[tokio::test(flavor = "current_thread")]
@@ -984,9 +1031,9 @@ async fn dispatch_json_rpc_routes_environment_ingress_put() {
 
     assert!(response.error.is_none());
     let environment = &response.result.expect("result")["result"]["environment"];
-    assert_eq!(environment["publicIngressEnabled"], json!(true));
+    assert!(environment.get("publicIngressEnabled").is_none());
     assert_eq!(
-        environment["publicEndpoint"],
+        environment["source"]["publicEndpoint"],
         json!("https://opaque.env.example")
     );
 }
@@ -2233,7 +2280,14 @@ impl AgentApiService for TestService {
         &self,
         params: EnvironmentCreateParams,
     ) -> Result<AgentApiOutcome<EnvironmentCreateResponse>, AgentApiError> {
-        assert_eq!(params.binding_id, "primary");
+        assert_eq!(params.provider_id, "bridge-local");
+        assert_eq!(
+            params.idle,
+            Some(EnvironmentIdlePolicyView {
+                pause_after_ms: Some(60_000),
+                ..EnvironmentIdlePolicyView::default()
+            })
+        );
         Ok(AgentApiOutcome::new(EnvironmentCreateResponse {
             environment: test_environment_instance(),
         }))
@@ -2248,12 +2302,29 @@ impl AgentApiService for TestService {
         }))
     }
 
+    async fn update_environment(
+        &self,
+        params: EnvironmentUpdateParams,
+    ) -> Result<AgentApiOutcome<EnvironmentUpdateResponse>, AgentApiError> {
+        let mut environment = test_environment_instance();
+        environment.display_name = params.display_name;
+        environment.metadata = params.metadata;
+        Ok(AgentApiOutcome::new(EnvironmentUpdateResponse {
+            environment,
+        }))
+    }
+
     async fn list_environments(
         &self,
-        _params: EnvironmentListParams,
+        params: EnvironmentListParams,
     ) -> Result<AgentApiOutcome<EnvironmentListResponse>, AgentApiError> {
+        let next_after = params
+            .limit
+            .is_some()
+            .then(|| test_environment_instance().environment_id);
         Ok(AgentApiOutcome::new(EnvironmentListResponse {
             environments: vec![test_environment_instance()],
+            next_after,
         }))
     }
 
@@ -2280,10 +2351,14 @@ impl AgentApiService for TestService {
         params: EnvironmentIngressPutParams,
     ) -> Result<AgentApiOutcome<EnvironmentIngressPutResponse>, AgentApiError> {
         let mut environment = test_environment_instance();
-        environment.public_ingress_enabled = params.enabled;
-        environment.public_endpoint = params
-            .enabled
-            .then(|| "https://opaque.env.example".to_owned());
+        if let EnvironmentSourceView::Provisioned {
+            public_endpoint, ..
+        } = &mut environment.source
+        {
+            *public_endpoint = params
+                .enabled
+                .then(|| "https://opaque.env.example".to_owned());
+        }
         Ok(AgentApiOutcome::new(EnvironmentIngressPutResponse {
             environment,
         }))
@@ -2293,24 +2368,22 @@ impl AgentApiService for TestService {
         &self,
         params: EnvironmentPowerPutParams,
     ) -> Result<AgentApiOutcome<EnvironmentPowerPutResponse>, AgentApiError> {
+        assert_eq!(params.power, EnvironmentPowerStateView::Paused);
         let mut environment = test_environment_instance();
-        environment.desired_power = params.power;
+        environment.status = EnvironmentStatusView::Paused;
+        if let EnvironmentSourceView::Provisioned { observed, .. } = &mut environment.source {
+            *observed = Some(EnvironmentObservedTargetView {
+                phase: EnvironmentTargetPhaseView::Active,
+                power: Some(params.power),
+                message: None,
+                observed_at_ms: 20,
+            });
+        }
         Ok(AgentApiOutcome::new(EnvironmentPowerPutResponse {
             environment,
         }))
     }
 
-    async fn put_environment_idle_policy(
-        &self,
-        params: EnvironmentIdlePolicyPutParams,
-    ) -> Result<AgentApiOutcome<EnvironmentIdlePolicyPutResponse>, AgentApiError> {
-        let mut environment = test_environment_instance();
-        environment.idle_policy = params.idle_policy;
-        Ok(AgentApiOutcome::new(EnvironmentIdlePolicyPutResponse {
-            environment,
-        }))
-    }
-
     async fn activate_session_environment(
         &self,
         params: SessionEnvironmentActivateParams,
@@ -2439,6 +2512,36 @@ impl AgentApiService for TestService {
         ))
     }
 
+    async fn update_environment_registration_key(
+        &self,
+        params: EnvironmentRegistrationKeyUpdateParams,
+    ) -> Result<AgentApiOutcome<EnvironmentRegistrationKeyUpdateResponse>, AgentApiError> {
+        let mut key = test_registration_key();
+        key.display_name = params.display_name;
+        key.max_active_environments = params.max_active_environments;
+        key.offline_close_after_ms = params.offline_close_after_ms;
+        Ok(AgentApiOutcome::new(
+            EnvironmentRegistrationKeyUpdateResponse {
+                registration_key: key,
+            },
+        ))
+    }
+
+    async fn rotate_environment_registration_key(
+        &self,
+        params: EnvironmentRegistrationKeyRotateParams,
+    ) -> Result<AgentApiOutcome<EnvironmentRegistrationKeyRotateResponse>, AgentApiError> {
+        assert_eq!(params.registration_key_id, "rk_harbor");
+        let mut key = test_registration_key();
+        key.key_prefix = "lsrk_rotated".to_owned();
+        Ok(AgentApiOutcome::new(
+            EnvironmentRegistrationKeyRotateResponse {
+                registration_key: key,
+                secret: EnvironmentRegistrationSecretView("lsrk_rotated-secret".to_owned()),
+            },
+        ))
+    }
+
     async fn revoke_environment_registration_key(
         &self,
         params: EnvironmentRegistrationKeyRevokeParams,
@@ -3253,34 +3356,30 @@ fn test_environment_credential(
 fn test_environment_instance() -> EnvironmentView {
     EnvironmentView {
         environment_id: "evi_test".to_owned(),
-        request_id: "request-1".to_owned(),
+        request_id: Some("request-1".to_owned()),
         source: EnvironmentSourceView::Provisioned {
             provider_id: "bridge-local".to_owned(),
-            binding_id: "primary".to_owned(),
+            template_id: "rust-v1".to_owned(),
+            target_id: Some("local".to_owned()),
+            idle: None,
+            observed: None,
+            public_endpoint: None,
         },
         display_name: Some("Local".to_owned()),
-        status: EnvironmentLifecycleStatusView::Ready,
-        desired_power: EnvironmentPowerStateView::Running,
-        idle_policy: None,
-        incarnation: EnvironmentIncarnationView {
-            incarnation_id: "incarnation-1".to_owned(),
-            provision_request_id: Some("request-1".to_owned()),
-            provider_target_id: Some("local".to_owned()),
-            template_id: Some("rust-v1".to_owned()),
-            power_states: vec![
-                EnvironmentPowerStateView::Running,
-                EnvironmentPowerStateView::Paused,
-            ],
-            created_at_ms: 10,
-            updated_at_ms: 10,
-        },
-        public_ingress_enabled: false,
-        public_endpoint: None,
+        state: EnvironmentStateView::Open,
+        status: EnvironmentStatusView::Ready,
+        state_message: None,
+        close_reason: None,
+        state_changed_at_ms: 10,
+        daemon: Some(EnvironmentDaemonView {
+            version: Some("0.1.0".to_owned()),
+            git_sha: None,
+            protocol_version: 4,
+        }),
         metadata: BTreeMap::new(),
-        last_seen_at_ms: None,
-        lifecycle_error: None,
         created_at_ms: 10,
         updated_at_ms: 10,
+        closed_at_ms: None,
     }
 }
 
@@ -3292,16 +3391,57 @@ fn test_registration_key() -> EnvironmentRegistrationKeyView {
         identity_mode: EnvironmentIdentityModeView::Ephemeral,
         max_active_environments: Some(8),
         ephemeral_disconnect_grace_ms: 300_000,
+        offline_close_after_ms: None,
         expires_at_ms: None,
         status: EnvironmentRegistrationKeyStatusView::Active,
         registered_environment_count: 1,
         active_environment_count: 1,
         last_registered_at_ms: Some(10),
         created_at_ms: 5,
+        updated_at_ms: 5,
         revoked_at_ms: None,
     }
 }
 
+#[tokio::test(flavor = "current_thread")]
+async fn dispatch_json_rpc_routes_registration_key_update_and_rotate() {
+    let response = dispatch_json_rpc(
+        &TestService,
+        JsonRpcRequest {
+            id: RequestId::Number(1),
+            method: METHOD_ENVIRONMENTS_REGISTRATION_KEYS_UPDATE.to_owned(),
+            params: Some(json!({
+                "registrationKeyId": "rk_harbor",
+                "displayName": "harbor-fleet",
+                "offlineCloseAfterMs": 86400000
+            })),
+        },
+    )
+    .await;
+    assert!(response.error.is_none(), "{:?}", response.error);
+    let key = &response.result.expect("result")["result"]["registrationKey"];
+    assert_eq!(key["displayName"], json!("harbor-fleet"));
+    assert_eq!(key["offlineCloseAfterMs"], json!(86_400_000));
+    assert!(key.get("maxActiveEnvironments").is_none());
+
+    let response = dispatch_json_rpc(
+        &TestService,
+        JsonRpcRequest {
+            id: RequestId::Number(2),
+            method: METHOD_ENVIRONMENTS_REGISTRATION_KEYS_ROTATE.to_owned(),
+            params: Some(json!({ "registrationKeyId": "rk_harbor" })),
+        },
+    )
+    .await;
+    assert!(response.error.is_none(), "{:?}", response.error);
+    let result = &response.result.expect("result")["result"];
+    assert_eq!(
+        result["registrationKey"]["keyPrefix"],
+        json!("lsrk_rotated")
+    );
+    assert_eq!(result["secret"], json!("lsrk_rotated-secret"));
+}
+
 #[test]
 fn registration_secret_views_redact_debug_output() {
     let response = EnvironmentRegistrationKeyCreateResponse {
@@ -3318,30 +3458,21 @@ fn registration_secret_views_redact_debug_output() {
 fn test_external_environment() -> EnvironmentView {
     EnvironmentView {
         environment_id: "evi_enrolled".to_owned(),
-        request_id: "request-enrolled".to_owned(),
+        request_id: Some("request-enrolled".to_owned()),
         source: EnvironmentSourceView::External {
             endpoint: "ws://envd.test:19091".to_owned(),
         },
         display_name: Some("External".to_owned()),
-        status: EnvironmentLifecycleStatusView::Ready,
-        desired_power: EnvironmentPowerStateView::Running,
-        idle_policy: None,
-        incarnation: EnvironmentIncarnationView {
-            incarnation_id: "incarnation-enrolled".to_owned(),
-            provision_request_id: None,
-            provider_target_id: None,
-            template_id: None,
-            power_states: Vec::new(),
-            created_at_ms: 10,
-            updated_at_ms: 10,
-        },
-        public_ingress_enabled: false,
-        public_endpoint: None,
+        state: EnvironmentStateView::Open,
+        status: EnvironmentStatusView::Ready,
+        state_message: None,
+        close_reason: None,
+        state_changed_at_ms: 10,
+        daemon: None,
         metadata: BTreeMap::new(),
-        last_seen_at_ms: None,
-        lifecycle_error: None,
         created_at_ms: 10,
         updated_at_ms: 10,
+        closed_at_ms: None,
     }
 }
 
@@ -3419,12 +3550,9 @@ fn test_deployment_environment_provider(provider_id: &str) -> DeploymentEnvironm
         provider_id: provider_id.to_owned(),
         display_name: Some("Local Incus".to_owned()),
         controller_endpoint: "ws://127.0.0.1:19090/control".to_owned(),
-        metadata: BTreeMap::new(),
-        controller_features: Some(DeploymentEnvironmentProviderFeaturesView {
-            adopt_target: true,
-            ingress: true,
-        }),
-        data_route_base: Some("ws://127.0.0.1:19090/data".to_owned()),
+        data_route_base: None,
+        effective_data_route_base: Some("ws://127.0.0.1:19090/routes".to_owned()),
+        has_credential: false,
         created_at_ms: 10,
         updated_at_ms: 20,
     }
@@ -3567,22 +3695,40 @@ impl DeploymentApiService for TestDeploymentService {
         ))
     }
 
-    async fn adopt_environment(
+    async fn put_environment_provider_binding(
         &self,
-        params: DeploymentEnvironmentAdoptParams,
-    ) -> Result<AgentApiOutcome<DeploymentEnvironmentAdoptResponse>, AgentApiError> {
-        let mut environment = test_environment_instance();
-        environment.request_id = params.request_id;
-        environment.display_name = params.display_name;
-        environment.incarnation.template_id = None;
-        Ok(AgentApiOutcome::new(DeploymentEnvironmentAdoptResponse {
-            environment,
+        params: DeploymentProviderBindingPutParams,
+    ) -> Result<AgentApiOutcome<DeploymentProviderBindingPutResponse>, AgentApiError> {
+        Ok(AgentApiOutcome::new(DeploymentProviderBindingPutResponse {
+            binding: EnvironmentProviderBindingView {
+                provider_id: params.provider_id,
+                enabled: params.enabled,
+                created_at_ms: 10,
+                updated_at_ms: 20,
+            },
         }))
     }
+
+    async fn delete_environment_provider_binding(
+        &self,
+        params: DeploymentProviderBindingDeleteParams,
+    ) -> Result<AgentApiOutcome<DeploymentProviderBindingDeleteResponse>, AgentApiError> {
+        Ok(AgentApiOutcome::new(
+            DeploymentProviderBindingDeleteResponse {
+                binding: EnvironmentProviderBindingView {
+                    provider_id: params.provider_id,
+                    enabled: false,
+                    created_at_ms: 10,
+                    updated_at_ms: 20,
+                },
+            },
+        ))
+    }
 }
 
 #[tokio::test(flavor = "current_thread")]
 async fn deployment_environment_provider_methods_dispatch() {
+    let universe_id = "6f3a1a52-58c1-4f0e-9c2d-1a2b3c4d5e6f";
     let requests = [
         (
             METHOD_DEPLOYMENT_ENVIRONMENT_PROVIDERS_PUT,
@@ -3591,18 +3737,45 @@ async fn deployment_environment_provider_methods_dispatch() {
                 "displayName": "Local Incus",
                 "controllerEndpoint": "ws://127.0.0.1:19090/control"
             }),
+            "provider",
+        ),
+        (
+            METHOD_DEPLOYMENT_ENVIRONMENT_PROVIDERS_PUT,
+            json!({
+                "providerId": "incus-local",
+                "controllerEndpoint": "unix:///run/incus-provider.sock",
+                "dataRouteBase": "ws://127.0.0.1:19090/routes",
+                "clearCredential": true
+            }),
+            "provider",
+        ),
+        (
+            METHOD_DEPLOYMENT_ENVIRONMENT_PROVIDERS_LIST,
+            json!({}),
+            "providers",
         ),
-        (METHOD_DEPLOYMENT_ENVIRONMENT_PROVIDERS_LIST, json!({})),
         (
             METHOD_DEPLOYMENT_ENVIRONMENT_PROVIDERS_READ,
             json!({ "providerId": "incus-local" }),
+            "provider",
         ),
         (
             METHOD_DEPLOYMENT_ENVIRONMENT_PROVIDERS_DELETE,
             json!({ "providerId": "incus-local" }),
+            "provider",
+        ),
+        (
+            METHOD_DEPLOYMENT_PROVIDER_BINDINGS_PUT,
+            json!({ "universeId": universe_id, "providerId": "incus-local", "enabled": true }),
+            "binding",
+        ),
+        (
+            METHOD_DEPLOYMENT_PROVIDER_BINDINGS_DELETE,
+            json!({ "universeId": universe_id, "providerId": "incus-local" }),
+            "binding",
         ),
     ];
-    for (index, (method, params)) in requests.into_iter().enumerate() {
+    for (index, (method, params, field)) in requests.into_iter().enumerate() {
         let response = dispatch_deployment_json_rpc(
             &TestDeploymentService,
             JsonRpcRequest {
@@ -3615,40 +3788,33 @@ async fn deployment_environment_provider_methods_dispatch() {
         assert!(response.error.is_none(), "{method}: {:?}", response.error);
         assert!(
             response.result.expect("result")["result"]
-                .get(if method.ends_with("/list") {
-                    "providers"
-                } else {
-                    "provider"
-                })
+                .get(field)
                 .is_some(),
             "{method}"
         );
     }
 }
 
-#[tokio::test(flavor = "current_thread")]
-async fn deployment_environment_adoption_dispatches_explicit_ownership_transfer() {
-    let response = dispatch_deployment_json_rpc(
-        &TestDeploymentService,
-        JsonRpcRequest {
-            id: RequestId::Number(1),
-            method: METHOD_DEPLOYMENT_ENVIRONMENTS_ADOPT.to_owned(),
-            params: Some(json!({
-                "universeId": "6f3a1a52-58c1-4f0e-9c2d-1a2b3c4d5e6f",
-                "requestId": "adopt-1",
-                "bindingId": "primary",
-                "sourceTarget": "legacy/hand-built-vm",
-                "takeOwnership": true,
-                "displayName": "Imported VM"
-            })),
-        },
-    )
-    .await;
-    assert!(response.error.is_none(), "{:?}", response.error);
-    let environment = &response.result.expect("result")["result"]["environment"];
-    assert_eq!(environment["requestId"], "adopt-1");
-    assert_eq!(environment["displayName"], "Imported VM");
-    assert!(environment["incarnation"].get("templateId").is_none());
+#[test]
+fn environment_provider_put_params_redact_credential_and_view_omits_it() {
+    let params: DeploymentEnvironmentProviderPutParams = serde_json::from_value(json!({
+        "providerId": "incus-local",
+        "controllerEndpoint": "wss://provider.example/control",
+        "credential": "provider-bearer-secret"
+    }))
+    .expect("put params");
+    assert!(!params.clear_credential);
+    assert!(params.data_route_base.is_none());
+    assert!(!format!("{params:?}").contains("provider-bearer-secret"));
+    let view = serde_json::to_value(test_deployment_environment_provider("incus-local"))
+        .expect("serialize view");
+    assert_eq!(view["hasCredential"], json!(false));
+    assert!(view.get("credential").is_none());
+    assert!(view.get("dataRouteBase").is_none());
+    assert_eq!(
+        view["effectiveDataRouteBase"],
+        json!("ws://127.0.0.1:19090/routes")
+    );
 }
 
 #[tokio::test(flavor = "current_thread")]
diff --git a/crates/cli/src/api_client.rs b/crates/cli/src/api_client.rs
index 85d34cfb6..e530ca843 100644
--- a/crates/cli/src/api_client.rs
+++ b/crates/cli/src/api_client.rs
@@ -15,8 +15,7 @@ use api::{
     BlobPutParams, BlobPutResponse, BlobReadParams, BlobReadResponse, EnvironmentCloseParams,
     EnvironmentCloseResponse, EnvironmentCredentialBindParams, EnvironmentCredentialBindResponse,
     EnvironmentCredentialListParams, EnvironmentCredentialListResponse,
-    EnvironmentCredentialUnbindParams, EnvironmentCredentialUnbindResponse,
-    EnvironmentIdlePolicyPutParams, EnvironmentIdlePolicyPutResponse, EnvironmentListParams,
+    EnvironmentCredentialUnbindParams, EnvironmentCredentialUnbindResponse, EnvironmentListParams,
     EnvironmentListResponse, EnvironmentPowerPutParams, EnvironmentPowerPutResponse,
     EnvironmentProviderBindingListParams, EnvironmentProviderBindingListResponse,
     EnvironmentReadParams, EnvironmentReadResponse, JsonRpcRequest, JsonRpcResponse,
@@ -28,7 +27,7 @@ use api::{
     METHOD_AUTH_PROVIDERS_LIST, METHOD_AUTH_PROVIDERS_READ, METHOD_BLOBS_HAS, METHOD_BLOBS_PUT,
     METHOD_BLOBS_READ, METHOD_ENVIRONMENTS_CLOSE, METHOD_ENVIRONMENTS_CREDENTIALS_BIND,
     METHOD_ENVIRONMENTS_CREDENTIALS_LIST, METHOD_ENVIRONMENTS_CREDENTIALS_UNBIND,
-    METHOD_ENVIRONMENTS_IDLE_POLICY_PUT, METHOD_ENVIRONMENTS_LIST, METHOD_ENVIRONMENTS_POWER_PUT,
+    METHOD_ENVIRONMENTS_LIST, METHOD_ENVIRONMENTS_POWER_PUT,
     METHOD_ENVIRONMENTS_PROVIDER_BINDINGS_LIST, METHOD_ENVIRONMENTS_READ,
     METHOD_MCP_SERVERS_DELETE, METHOD_MCP_SERVERS_LIST, METHOD_MCP_SERVERS_PUT,
     METHOD_MCP_SERVERS_READ, METHOD_MODELS_LIST, METHOD_PROFILES_DELETE, METHOD_PROFILES_LIST,
@@ -578,12 +577,11 @@ impl HttpAgentApi {
         self.request(METHOD_ENVIRONMENTS_POWER_PUT, params).await
     }
 
-    pub(crate) async fn put_environment_idle_policy(
+    pub(crate) async fn update_environment(
         &self,
-        params: EnvironmentIdlePolicyPutParams,
-    ) -> Result<AgentApiOutcome<EnvironmentIdlePolicyPutResponse>, AgentApiError> {
-        self.request(METHOD_ENVIRONMENTS_IDLE_POLICY_PUT, params)
-            .await
+        params: api::EnvironmentUpdateParams,
+    ) -> Result<AgentApiOutcome<api::EnvironmentUpdateResponse>, AgentApiError> {
+        self.request(api::METHOD_ENVIRONMENTS_UPDATE, params).await
     }
 
     pub(crate) async fn create_environment_registration_key(
@@ -610,6 +608,22 @@ impl HttpAgentApi {
             .await
     }
 
+    pub(crate) async fn update_environment_registration_key(
+        &self,
+        params: api::EnvironmentRegistrationKeyUpdateParams,
+    ) -> Result<AgentApiOutcome<api::EnvironmentRegistrationKeyUpdateResponse>, AgentApiError> {
+        self.request(api::METHOD_ENVIRONMENTS_REGISTRATION_KEYS_UPDATE, params)
+            .await
+    }
+
+    pub(crate) async fn rotate_environment_registration_key(
+        &self,
+        params: api::EnvironmentRegistrationKeyRotateParams,
+    ) -> Result<AgentApiOutcome<api::EnvironmentRegistrationKeyRotateResponse>, AgentApiError> {
+        self.request(api::METHOD_ENVIRONMENTS_REGISTRATION_KEYS_ROTATE, params)
+            .await
+    }
+
     pub(crate) async fn revoke_environment_registration_key(
         &self,
         params: api::EnvironmentRegistrationKeyRevokeParams,
diff --git a/crates/cli/src/env_cli.rs b/crates/cli/src/env_cli.rs
index 600dd1f4e..c405533ae 100644
--- a/crates/cli/src/env_cli.rs
+++ b/crates/cli/src/env_cli.rs
@@ -14,14 +14,14 @@ enum EnvCommand {
     /// Administer deployment-wide environment provider controllers (deployment key).
     #[command(visible_alias = "providers")]
     Provider(ProviderArgs),
-    /// Provision an environment using an immutable template on a bound provider.
+    /// Provision an environment from a provider template.
     Create(CreateArgs),
     /// Register an existing, Lightspeed-reachable envd WebSocket endpoint.
     Register(RegisterArgs),
-    /// Inspect the current universe's routing bindings to environment providers.
+    /// Inspect or set the current universe's bindings to environment providers.
     #[command(visible_alias = "bindings")]
     Binding(BindingArgs),
-    /// Browse immutable templates offered by bound environment providers.
+    /// Browse templates offered by the universe's enabled providers.
     #[command(visible_alias = "templates")]
     Template(TemplateArgs),
     /// Enable or disable provider-authorized public HTTPS ingress.
@@ -30,19 +30,19 @@ enum EnvCommand {
     List(EnvListArgs),
     /// Read one universe environment.
     Read(EnvironmentResourceArgs),
+    /// Replace the display name and metadata of one universe environment.
+    Update(EnvUpdateArgs),
     /// Close one universe environment.
     Close(EnvironmentResourceArgs),
-    /// Set the desired power state (running, paused, suspended, stopped) of
-    /// a provisioned environment; the runtime converges it asynchronously and
-    /// a powered-down environment wakes on its next use.
+    /// Move a provisioned environment to a power state (running, paused,
+    /// suspended, stopped) through its provider; the provider owns every
+    /// later transition, and a powered-down environment wakes when used.
     Power(PowerArgs),
-    /// Replace or clear the staged idle policy of a provisioned environment.
-    IdlePolicy(IdlePolicyArgs),
     /// Bind, list, or unbind universe environment credentials.
     #[command(name = "credential", visible_alias = "credentials")]
     Credentials(CredentialArgs),
-    /// Mint, list, read, or revoke registration keys that let outbound
-    /// `lightspeed-envd` daemons register as environments.
+    /// Mint, list, read, update, rotate, or revoke registration keys that let
+    /// outbound `lightspeed-envd` daemons register as environments.
     #[command(name = "registration-key", visible_alias = "registration-keys")]
     RegistrationKeys(RegistrationKeyArgs),
 }
@@ -61,6 +61,11 @@ enum RegistrationKeyCommand {
     List(ResourceArgs),
     /// Read one registration key.
     Read(RegistrationKeyResourceArgs),
+    /// Replace a key's editable policy; unset flags clear their setting.
+    Update(RegistrationKeyUpdateArgs),
+    /// Retire the key's live secret and mint a new one, printed exactly
+    /// once. Daemons it already admitted keep reconnecting.
+    Rotate(RegistrationKeyResourceArgs),
     /// Stop a key from admitting new daemons; optionally close its
     /// environments.
     Revoke(RegistrationKeyRevokeArgs),
@@ -72,24 +77,70 @@ struct RegistrationKeyCreateArgs {
     api_url: String,
     #[arg(long)]
     json: bool,
+    /// persistent: environments wait for their daemon to reconnect;
+    /// ephemeral: they close once their daemon has been away longer than the
+    /// grace. Immutable once the key exists.
+    #[arg(long, value_enum, default_value_t = IdentityModeArg::Persistent)]
+    mode: IdentityModeArg,
+    #[command(flatten)]
+    policy: RegistrationKeyPolicyArgs,
+}
+
+#[derive(Args, Debug, Clone)]
+struct RegistrationKeyPolicyArgs {
     /// Group name shown for every environment this key admits.
     #[arg(long)]
     name: String,
-    /// persistent: environments stay offline until closed; ephemeral: they
-    /// close once their daemon has been away longer than the grace.
-    #[arg(long, value_enum, default_value_t = IdentityModeArg::Persistent)]
-    mode: IdentityModeArg,
     /// Non-closed environments the key may have at once.
     #[arg(long = "max-active")]
     max_active: Option<u32>,
     /// Ephemeral disconnect grace in minutes (default: 5).
     #[arg(long = "grace-min")]
     grace_min: Option<u64>,
+    /// Persistent keys only: close an environment whose daemon has been
+    /// away longer than this many minutes.
+    #[arg(long = "offline-close-after-min")]
+    offline_close_after_min: Option<u64>,
     /// Stop admitting new daemons after this many hours.
     #[arg(long = "expires-in-hours")]
     expires_in_hours: Option<u64>,
 }
 
+impl RegistrationKeyPolicyArgs {
+    fn expires_at_ms(&self) -> Result<Option<i64>> {
+        let Some(hours) = self.expires_in_hours else {
+            return Ok(None);
+        };
+        let now_ms = i64::try_from(
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)?
+                .as_millis(),
+        )?;
+        Ok(Some(
+            now_ms.saturating_add(
+                i64::try_from(hours)
+                    .unwrap_or(i64::MAX)
+                    .saturating_mul(3_600_000),
+            ),
+        ))
+    }
+}
+
+#[derive(Args, Debug, Clone)]
+struct RegistrationKeyUpdateArgs {
+    #[arg(skip)]
+    api_url: String,
+    #[arg(long)]
+    json: bool,
+    registration_key_id: String,
+    #[command(flatten)]
+    policy: RegistrationKeyPolicyArgs,
+}
+
+fn minutes_ms(minutes: Option<u64>) -> Option<u64> {
+    minutes.map(|minutes| minutes.saturating_mul(60_000))
+}
+
 #[derive(clap::ValueEnum, Debug, Clone, Copy)]
 enum IdentityModeArg {
     Persistent,
@@ -142,27 +193,6 @@ impl From<PowerArg> for api::EnvironmentPowerStateView {
     }
 }
 
-#[derive(Args, Debug, Clone)]
-struct IdlePolicyArgs {
-    #[command(flatten)]
-    common: EnvironmentResourceArgs,
-    /// Pause after this many minutes idle.
-    #[arg(long = "pause-after-min")]
-    pause_after_min: Option<u64>,
-    /// Suspend after this many minutes idle (providers that support it).
-    #[arg(long = "suspend-after-min")]
-    suspend_after_min: Option<u64>,
-    /// Stop after this many minutes idle.
-    #[arg(long = "stop-after-min")]
-    stop_after_min: Option<u64>,
-    /// Close after this many minutes idle.
-    #[arg(long = "close-after-min")]
-    close_after_min: Option<u64>,
-    /// Remove the idle policy entirely.
-    #[arg(long, conflicts_with_all = ["pause_after_min", "suspend_after_min", "stop_after_min", "close_after_min"])]
-    clear: bool,
-}
-
 #[derive(Args, Debug, Clone)]
 struct ResourceArgs {
     #[arg(skip)]
@@ -176,15 +206,34 @@ struct EnvListArgs {
     #[arg(long)]
     provider: Option<String>,
     #[arg(long)]
-    binding: Option<String>,
-    #[arg(long)]
     registration_key: Option<String>,
+    /// Also list closed environments.
+    #[arg(long)]
+    include_closed: bool,
+    /// Most environments per page (1-500; default 100).
+    #[arg(long)]
+    limit: Option<u32>,
+    /// Start after this environment id: a previous page's `nextAfter`.
+    #[arg(long)]
+    after: Option<String>,
     #[command(flatten)]
     common: ResourceArgs,
     #[command(flatten)]
     metadata: crate::session_cli::MetadataPairs,
 }
 
+#[derive(Args, Debug, Clone)]
+struct EnvUpdateArgs {
+    #[command(flatten)]
+    common: EnvironmentResourceArgs,
+    /// The new display name; omit to clear it.
+    #[arg(long)]
+    name: Option<String>,
+    /// The complete new metadata; omit every pair to clear it.
+    #[command(flatten)]
+    metadata: crate::session_cli::MetadataPairs,
+}
+
 #[derive(Args, Debug, Clone)]
 struct EnvironmentResourceArgs {
     #[arg(skip)]
@@ -248,9 +297,9 @@ pub(crate) async fn handle(args: EnvArgs) -> Result<()> {
         EnvCommand::Ingress(args) => ingress(args).await,
         EnvCommand::List(args) => list(args).await,
         EnvCommand::Read(args) => read(args).await,
+        EnvCommand::Update(args) => update(args).await,
         EnvCommand::Close(args) => close(args).await,
         EnvCommand::Power(args) => power(args).await,
-        EnvCommand::IdlePolicy(args) => idle_policy(args).await,
         EnvCommand::Credentials(args) => credentials(args).await,
         EnvCommand::RegistrationKeys(args) => registration_keys(args).await,
     }
@@ -259,45 +308,54 @@ pub(crate) async fn handle(args: EnvArgs) -> Result<()> {
 async fn registration_keys(args: RegistrationKeyArgs) -> Result<()> {
     match args.command {
         RegistrationKeyCommand::Create(args) => {
-            let now_ms = i64::try_from(
-                std::time::SystemTime::now()
-                    .duration_since(std::time::UNIX_EPOCH)?
-                    .as_millis(),
-            )?;
+            let expires_at_ms = args.policy.expires_at_ms()?;
             let response = HttpAgentApi::new(args.api_url)
                 .create_environment_registration_key(api::EnvironmentRegistrationKeyCreateParams {
-                    display_name: args.name,
+                    display_name: args.policy.name,
                     identity_mode: match args.mode {
                         IdentityModeArg::Persistent => api::EnvironmentIdentityModeView::Persistent,
                         IdentityModeArg::Ephemeral => api::EnvironmentIdentityModeView::Ephemeral,
                     },
-                    max_active_environments: args.max_active,
-                    ephemeral_disconnect_grace_ms: args
-                        .grace_min
-                        .map(|minutes| minutes.saturating_mul(60_000)),
-                    expires_at_ms: args.expires_in_hours.map(|hours| {
-                        now_ms.saturating_add(
-                            i64::try_from(hours)
-                                .unwrap_or(i64::MAX)
-                                .saturating_mul(3_600_000),
-                        )
-                    }),
+                    max_active_environments: args.policy.max_active,
+                    ephemeral_disconnect_grace_ms: minutes_ms(args.policy.grace_min),
+                    offline_close_after_ms: minutes_ms(args.policy.offline_close_after_min),
+                    expires_at_ms,
                 })
                 .await
                 .map_err(crate::api_client::api_error)?
                 .result;
             print_json_or(args.json, &response, || {
-                print_registration_key(&response.registration_key);
-                println!();
-                println!("Registration key (shown once, store it now):");
-                println!("  {}", response.secret.0);
-                println!();
-                println!("Bootstrap a daemon with:");
-                println!(
-                    "  LIGHTSPEED_ENVD_GATEWAY_URL=wss://<gateway>/environment-gateway/connect"
-                );
-                println!("  LIGHTSPEED_ENVD_REGISTRATION_KEY_FILE=<file holding the key>");
-                println!("  lightspeed-envd");
+                print_registration_secret(&response.registration_key, &response.secret.0)
+            })
+        }
+        RegistrationKeyCommand::Update(args) => {
+            let expires_at_ms = args.policy.expires_at_ms()?;
+            let response = HttpAgentApi::new(args.api_url)
+                .update_environment_registration_key(api::EnvironmentRegistrationKeyUpdateParams {
+                    registration_key_id: args.registration_key_id,
+                    display_name: args.policy.name,
+                    max_active_environments: args.policy.max_active,
+                    ephemeral_disconnect_grace_ms: minutes_ms(args.policy.grace_min),
+                    offline_close_after_ms: minutes_ms(args.policy.offline_close_after_min),
+                    expires_at_ms,
+                })
+                .await
+                .map_err(crate::api_client::api_error)?
+                .result;
+            print_json_or(args.json, &response, || {
+                print_registration_key(&response.registration_key)
+            })
+        }
+        RegistrationKeyCommand::Rotate(args) => {
+            let response = HttpAgentApi::new(args.api_url)
+                .rotate_environment_registration_key(api::EnvironmentRegistrationKeyRotateParams {
+                    registration_key_id: args.registration_key_id,
+                })
+                .await
+                .map_err(crate::api_client::api_error)?
+                .result;
+            print_json_or(args.json, &response, || {
+                print_registration_secret(&response.registration_key, &response.secret.0)
             })
         }
         RegistrationKeyCommand::List(args) => {
@@ -350,6 +408,18 @@ fn print_registration_key(key: &api::EnvironmentRegistrationKeyView) {
     crate::output::show(false, key).expect("serializable registration key metadata");
 }
 
+fn print_registration_secret(key: &api::EnvironmentRegistrationKeyView, secret: &str) {
+    print_registration_key(key);
+    println!();
+    println!("Registration key (shown once, store it now):");
+    println!("  {secret}");
+    println!();
+    println!("Bootstrap a daemon with:");
+    println!("  LIGHTSPEED_ENVD_GATEWAY_URL=wss://<gateway>/environment-gateway/connect");
+    println!("  LIGHTSPEED_ENVD_REGISTRATION_KEY_FILE=<file holding the key>");
+    println!("  lightspeed-envd");
+}
+
 async fn power(args: PowerArgs) -> Result<()> {
     let response = HttpAgentApi::new(args.common.api_url)
         .put_environment_power(api::EnvironmentPowerPutParams {
@@ -362,46 +432,24 @@ async fn power(args: PowerArgs) -> Result<()> {
     if args.common.json {
         crate::output::show(true, &response)
     } else {
-        println!("Power change requested; the runtime converges it asynchronously.");
         crate::output::show(
             false,
-            &serde_json::json!({"environmentId":response.environment.environment_id,"desiredPower":response.environment.desired_power,"observedStatus":response.environment.status}),
+            &serde_json::json!({"environmentId":response.environment.environment_id,"status":response.environment.status}),
         )
     }
 }
 
-async fn idle_policy(args: IdlePolicyArgs) -> Result<()> {
-    let minutes = |value: Option<u64>| value.map(|minutes| minutes.saturating_mul(60_000));
-    let idle_policy = if args.clear {
-        None
-    } else {
-        let policy = api::EnvironmentIdlePolicyView {
-            pause_after_ms: minutes(args.pause_after_min),
-            suspend_after_ms: minutes(args.suspend_after_min),
-            stop_after_ms: minutes(args.stop_after_min),
-            close_after_ms: minutes(args.close_after_min),
-        };
-        if policy == api::EnvironmentIdlePolicyView::default() {
-            anyhow::bail!("set at least one --*-after-min stage or pass --clear");
-        }
-        Some(policy)
-    };
+async fn update(args: EnvUpdateArgs) -> Result<()> {
     let response = HttpAgentApi::new(args.common.api_url)
-        .put_environment_idle_policy(api::EnvironmentIdlePolicyPutParams {
+        .update_environment(api::EnvironmentUpdateParams {
             environment_id: args.common.environment_id,
-            idle_policy,
+            display_name: args.name,
+            metadata: args.metadata.map(),
         })
         .await
         .map_err(crate::api_client::api_error)?
         .result;
-    if args.common.json {
-        crate::output::show(true, &response)
-    } else {
-        crate::output::show(
-            false,
-            &serde_json::json!({"environmentId":response.environment.environment_id,"idlePolicy":response.environment.idle_policy}),
-        )
-    }
+    crate::output::show(args.common.json, &response.environment)
 }
 
 async fn list(args: EnvListArgs) -> Result<()> {
@@ -409,8 +457,10 @@ async fn list(args: EnvListArgs) -> Result<()> {
         .list_environments(api::EnvironmentListParams {
             metadata: args.metadata.map(),
             provider_id: args.provider,
-            binding_id: args.binding,
             registration_key_id: args.registration_key,
+            include_closed: args.include_closed,
+            limit: args.limit,
+            after: args.after,
             ..Default::default()
         })
         .await
@@ -425,10 +475,14 @@ async fn list(args: EnvListArgs) -> Result<()> {
                 ("environmentId", "ID"),
                 ("displayName", "NAME"),
                 ("status", "STATUS"),
-                ("desiredPower", "DESIRED POWER"),
+                ("state", "STATE"),
             ],
             "No environments found.",
-        )
+        )?;
+        if let Some(after) = &response.next_after {
+            println!("More environments: pass --after {after}");
+        }
+        Ok(())
     }
 }
 
@@ -451,10 +505,14 @@ async fn close(args: EnvironmentResourceArgs) -> Result<()> {
         .map_err(crate::api_client::api_error)?
         .result;
     print_json_or(args.json, &response, || {
-        println!(
-            "Close requested for {}. Use environment read to inspect completion.",
-            response.environment.environment_id
-        )
+        if response.environment.state == api::EnvironmentStateView::Closed {
+            println!("Closed {}.", response.environment.environment_id);
+        } else {
+            println!(
+                "Closing {}; the provider removes its target. Use environment read to inspect completion.",
+                response.environment.environment_id
+            );
+        }
     })
 }
 
@@ -540,8 +598,10 @@ pub(crate) fn print_json_or<T: serde::Serialize>(
 struct CreateArgs {
     #[command(flatten)]
     common: ResourceArgs,
+    /// The provider to create the environment with; the universe needs an
+    /// enabled binding to it.
     #[arg(long)]
-    binding: String,
+    provider: String,
     #[arg(long)]
     template: String,
     /// Supply the same request ID when retrying an uncertain creation.
@@ -573,17 +633,30 @@ struct BindingArgs {
 }
 #[derive(Subcommand, Debug, Clone)]
 enum BindingCommand {
-    /// Create or replace a universe binding from DeploymentProviderBindingPutParams JSON (deployment key).
-    Put(DocumentArgs),
-    /// Delete a binding from the selected universe (deployment key).
+    /// Bind the selected universe to a provider, enabled or disabled
+    /// (deployment key).
+    Put {
+        provider_id: String,
+        #[arg(
+            long,
+            conflicts_with = "disabled",
+            required_unless_present = "disabled"
+        )]
+        enabled: bool,
+        #[arg(long)]
+        disabled: bool,
+        #[arg(long)]
+        json: bool,
+    },
+    /// Delete the selected universe's binding to a provider (deployment key).
     Delete {
-        binding_id: String,
+        provider_id: String,
         #[arg(long)]
         json: bool,
     },
     List(ResourceArgs),
     Read {
-        binding_id: String,
+        provider_id: String,
         #[arg(long)]
         json: bool,
     },
@@ -596,15 +669,16 @@ struct TemplateArgs {
 #[derive(Subcommand, Debug, Clone)]
 enum TemplateCommand {
     List {
+        /// Only this provider's templates; omit for every enabled binding.
         #[arg(long)]
-        binding: Option<String>,
+        provider: Option<String>,
         #[arg(long)]
         json: bool,
     },
     Read {
         template_id: String,
         #[arg(long)]
-        binding: String,
+        provider: String,
         #[arg(long)]
         json: bool,
     },
@@ -624,11 +698,11 @@ async fn create(args: CreateArgs) -> Result<()> {
             api::METHOD_ENVIRONMENTS_CREATE,
             api::EnvironmentCreateParams {
                 request_id: args.request_id,
-                binding_id: args.binding,
+                provider_id: args.provider,
                 template_id: args.template,
                 display_name: args.display_name,
                 metadata: args.metadata.map(),
-                idle_policy: None,
+                idle: None,
             },
         )
         .await?
@@ -662,25 +736,32 @@ async fn register(args: RegisterArgs) -> Result<()> {
 async fn binding(args: BindingArgs) -> Result<()> {
     let client = HttpAgentApi::new("");
     match args.command {
-        BindingCommand::Put(args) => {
-            let params: api::DeploymentProviderBindingPutParams = read_document(&args.file)?;
+        BindingCommand::Put {
+            provider_id,
+            enabled,
+            disabled: _,
+            json,
+        } => {
             let response: api::DeploymentProviderBindingPutResponse = client
-                .request(api::METHOD_DEPLOYMENT_PROVIDER_BINDINGS_PUT, params)
+                .request(
+                    api::METHOD_DEPLOYMENT_PROVIDER_BINDINGS_PUT,
+                    api::DeploymentProviderBindingPutParams {
+                        universe_id: selected_universe_id("binding a provider")?,
+                        provider_id,
+                        enabled,
+                    },
+                )
                 .await?
                 .result;
-            crate::output::show(args.json, &response.binding)
+            crate::output::show(json, &response.binding)
         }
-        BindingCommand::Delete { binding_id, json } => {
-            let universe_id = crate::connection::ACTIVE
-                .get()
-                .and_then(|c| c.active_universe_id())
-                .ok_or_else(|| anyhow::anyhow!("select a universe before deleting a binding"))?;
+        BindingCommand::Delete { provider_id, json } => {
             let response: api::DeploymentProviderBindingDeleteResponse = client
                 .request(
                     api::METHOD_DEPLOYMENT_PROVIDER_BINDINGS_DELETE,
                     api::DeploymentProviderBindingDeleteParams {
-                        universe_id,
-                        binding_id,
+                        universe_id: selected_universe_id("deleting a binding")?,
+                        provider_id,
                     },
                 )
                 .await?
@@ -703,21 +784,16 @@ async fn binding(args: BindingArgs) -> Result<()> {
             } else {
                 crate::output::table(
                     &response.bindings,
-                    &[
-                        ("bindingId", "ID"),
-                        ("providerId", "PROVIDER"),
-                        ("status", "STATUS"),
-                        ("revision", "REVISION"),
-                    ],
+                    &[("providerId", "PROVIDER"), ("enabled", "ENABLED")],
                     "No environment provider bindings available.",
                 )
             }
         }
-        BindingCommand::Read { binding_id, json } => {
+        BindingCommand::Read { provider_id, json } => {
             let response: api::EnvironmentProviderBindingReadResponse = client
                 .request(
                     api::METHOD_ENVIRONMENTS_PROVIDER_BINDINGS_READ,
-                    api::EnvironmentProviderBindingReadParams { binding_id },
+                    api::EnvironmentProviderBindingReadParams { provider_id },
                 )
                 .await?
                 .result;
@@ -728,12 +804,12 @@ async fn binding(args: BindingArgs) -> Result<()> {
 async fn template(args: TemplateArgs) -> Result<()> {
     let client = HttpAgentApi::new("");
     match args.command {
-        TemplateCommand::List { binding, json } => {
+        TemplateCommand::List { provider, json } => {
             let response: api::EnvironmentTemplateListResponse = client
                 .request(
                     api::METHOD_ENVIRONMENTS_TEMPLATES_LIST,
                     api::EnvironmentTemplateListParams {
-                        binding_id: binding,
+                        provider_id: provider,
                     },
                 )
                 .await?
@@ -746,7 +822,8 @@ async fn template(args: TemplateArgs) -> Result<()> {
                     &[
                         ("templateId", "ID"),
                         ("displayName", "NAME"),
-                        ("bindingId", "BINDING"),
+                        ("providerId", "PROVIDER"),
+                        ("powerStates", "POWER"),
                         ("deprecated", "DEPRECATED"),
                     ],
                     "No environment templates available.",
@@ -755,14 +832,14 @@ async fn template(args: TemplateArgs) -> Result<()> {
         }
         TemplateCommand::Read {
             template_id,
-            binding,
+            provider,
             json,
         } => {
             let response: api::EnvironmentTemplateReadResponse = client
                 .request(
                     api::METHOD_ENVIRONMENTS_TEMPLATES_READ,
                     api::EnvironmentTemplateReadParams {
-                        binding_id: binding,
+                        provider_id: provider,
                         template_id,
                     },
                 )
@@ -787,19 +864,34 @@ async fn ingress(args: IngressArgs) -> Result<()> {
 }
 
 #[derive(Args, Debug, Clone)]
-struct DocumentArgs {
-    /// Typed API request JSON document. See the public API reference for fields.
+struct ProviderPutArgs {
+    provider_id: String,
+    /// `ws://`, `wss://` or `unix://` URL of the provider controller.
+    #[arg(long)]
+    controller_endpoint: String,
+    #[arg(long)]
+    display_name: Option<String>,
+    /// `ws://` or `wss://` base of the provider's data routes; omit to derive
+    /// it from the controller endpoint. Required for a `unix://` controller.
+    #[arg(long)]
+    data_route_base: Option<String>,
+    /// File holding the bearer credential the provider expects; omit to keep
+    /// the stored one. A provider needs none.
+    #[arg(long, conflicts_with = "clear_credential")]
+    credential_file: Option<std::path::PathBuf>,
+    /// Remove the stored credential.
     #[arg(long)]
-    file: std::path::PathBuf,
+    clear_credential: bool,
     #[arg(long)]
     json: bool,
 }
-fn read_document<T: serde::de::DeserializeOwned>(path: &std::path::Path) -> Result<T> {
-    use anyhow::Context;
-    serde_json::from_slice(
-        &std::fs::read(path).with_context(|| format!("read {}", path.display()))?,
-    )
-    .context("invalid API request document")
+
+/// The universe a deployment-scoped binding command addresses.
+fn selected_universe_id(action: &str) -> Result<String> {
+    crate::connection::ACTIVE
+        .get()
+        .and_then(|c| c.active_universe_id())
+        .ok_or_else(|| anyhow::anyhow!("select a universe before {action}"))
 }
 #[derive(Args, Debug, Clone)]
 struct ProviderArgs {
@@ -817,8 +909,8 @@ enum ProviderCommand {
         #[arg(long)]
         json: bool,
     },
-    /// Create or replace a controller using DeploymentEnvironmentProviderPutParams JSON.
-    Put(DocumentArgs),
+    /// Register or replace a provider controller.
+    Put(ProviderPutArgs),
     Delete {
         provider_id: String,
         #[arg(long)]
@@ -844,7 +936,8 @@ async fn provider(args: ProviderArgs) -> Result<()> {
                     &[
                         ("providerId", "ID"),
                         ("displayName", "NAME"),
-                        ("controllerConnection", "CONTROLLER"),
+                        ("controllerEndpoint", "CONTROLLER"),
+                        ("hasCredential", "CREDENTIAL"),
                     ],
                     "No environment provider controllers configured.",
                 )
@@ -861,9 +954,23 @@ async fn provider(args: ProviderArgs) -> Result<()> {
             crate::output::show(json, &response.provider)
         }
         ProviderCommand::Put(args) => {
-            let params: api::DeploymentEnvironmentProviderPutParams = read_document(&args.file)?;
+            let credential = args
+                .credential_file
+                .as_deref()
+                .map(crate::connection::read_secret)
+                .transpose()?;
             let response: api::DeploymentEnvironmentProviderPutResponse = client
-                .request(api::METHOD_DEPLOYMENT_ENVIRONMENT_PROVIDERS_PUT, params)
+                .request(
+                    api::METHOD_DEPLOYMENT_ENVIRONMENT_PROVIDERS_PUT,
+                    api::DeploymentEnvironmentProviderPutParams {
+                        provider_id: args.provider_id,
+                        display_name: args.display_name,
+                        controller_endpoint: args.controller_endpoint,
+                        data_route_base: args.data_route_base,
+                        credential,
+                        clear_credential: args.clear_credential,
+                    },
+                )
                 .await?
                 .result;
             crate::output::show(args.json, &response.provider)
diff --git a/crates/cli/src/main.rs b/crates/cli/src/main.rs
index 6bc8870f5..5ed093a80 100644
--- a/crates/cli/src/main.rs
+++ b/crates/cli/src/main.rs
@@ -221,7 +221,7 @@ mod tests {
             vec![
                 "environment",
                 "create",
-                "--binding",
+                "--provider",
                 "local",
                 "--template",
                 "linux-v1",
@@ -235,9 +235,16 @@ mod tests {
                 "--request-id",
                 "retry-2",
             ],
-            vec!["environment", "provider", "put", "--file", "provider.json"],
-            vec!["environment", "binding", "put", "--file", "binding.json"],
-            vec!["environment", "template", "list", "--binding", "local"],
+            vec![
+                "environment",
+                "provider",
+                "put",
+                "local",
+                "--controller-endpoint",
+                "wss://provider.example/control",
+            ],
+            vec!["environment", "binding", "put", "local", "--enabled"],
+            vec!["environment", "template", "list", "--provider", "local"],
             vec!["profile", "--json", "read", "reviewer"],
         ] {
             let mut command = vec![
@@ -646,7 +653,7 @@ mod tests {
     }
 
     #[test]
-    fn env_power_and_idle_policy_parse() {
+    fn env_power_update_and_paging_parse() {
         let cli = Cli::try_parse_from([
             "lightspeed",
             "env",
@@ -661,16 +668,30 @@ mod tests {
         let cli = Cli::try_parse_from([
             "lightspeed",
             "env",
-            "idle-policy",
+            "update",
             "--api-url",
             "http://127.0.0.1:18080/rpc",
             "local-host",
-            "--pause-after-min",
-            "15",
-            "--close-after-min",
-            "240",
+            "--name",
+            "Build box",
+            "--metadata",
+            "team=platform",
+        ])
+        .expect("parse env update");
+        assert!(matches!(cli.command, Command::Env(_)));
+        let cli = Cli::try_parse_from([
+            "lightspeed",
+            "env",
+            "list",
+            "--api-url",
+            "http://127.0.0.1:18080/rpc",
+            "--include-closed",
+            "--limit",
+            "50",
+            "--after",
+            "env-1",
         ])
-        .expect("parse env idle-policy");
+        .expect("parse env list paging");
         assert!(matches!(cli.command, Command::Env(_)));
         assert!(
             Cli::try_parse_from([
@@ -680,9 +701,67 @@ mod tests {
                 "--api-url",
                 "http://127.0.0.1:18080/rpc",
                 "local-host",
-                "--clear",
-                "--pause-after-min",
-                "15",
+            ])
+            .is_err()
+        );
+    }
+
+    #[test]
+    fn env_registration_key_and_binding_parse() {
+        for command in [
+            vec![
+                "registration-key",
+                "create",
+                "--name",
+                "Pods",
+                "--offline-close-after-min",
+                "60",
+            ],
+            vec![
+                "registration-key",
+                "update",
+                "registration_key_1",
+                "--name",
+                "Pods",
+                "--max-active",
+                "3",
+            ],
+            vec!["registration-key", "rotate", "registration_key_1"],
+            vec!["binding", "put", "incus", "--disabled"],
+            vec!["binding", "delete", "incus"],
+            vec![
+                "provider",
+                "put",
+                "incus",
+                "--controller-endpoint",
+                "unix:///run/provider.sock",
+                "--data-route-base",
+                "ws://127.0.0.1:19090/routes",
+                "--clear-credential",
+            ],
+        ] {
+            let mut args = vec!["lightspeed", "env"];
+            args.extend(command);
+            let cli =
+                Cli::try_parse_from(&args).unwrap_or_else(|error| panic!("{args:?}: {error}"));
+            assert!(matches!(cli.command, Command::Env(_)));
+        }
+        assert!(
+            Cli::try_parse_from(["lightspeed", "env", "binding", "put", "incus"]).is_err(),
+            "a binding put states enabled or disabled"
+        );
+        assert!(
+            Cli::try_parse_from([
+                "lightspeed",
+                "env",
+                "provider",
+                "put",
+                "incus",
+                "--controller-endpoint",
+                "wss://provider.example/control",
+                "--credential-file",
+                "token",
+                "--clear-credential",
             ])
             .is_err()
         );
diff --git a/crates/cli/src/profile_cli.rs b/crates/cli/src/profile_cli.rs
index 306c2b17d..05e92ed05 100644
--- a/crates/cli/src/profile_cli.rs
+++ b/crates/cli/src/profile_cli.rs
@@ -5,9 +5,9 @@ use std::path::{Path, PathBuf};
 
 use anyhow::{Context, Result, anyhow, bail};
 use api::{
-    AgentApiErrorKind, AgentProfile, AgentProfileInput, EnvironmentLifecycleStatusView,
-    EnvironmentProviderBindingListParams, EnvironmentProviderBindingStatusView,
-    EnvironmentSourceView, InlineAgentProfile, ProfileApplyParams, ProfileDeleteParams, ProfileId,
+    AgentApiErrorKind, AgentProfile, AgentProfileInput, EnvironmentIdentityModeView,
+    EnvironmentProviderBindingListParams, EnvironmentSourceView, EnvironmentStateView,
+    EnvironmentStatusView, InlineAgentProfile, ProfileApplyParams, ProfileDeleteParams, ProfileId,
     ProfileListParams, ProfilePutParams, ProfileReadParams, ProfileSource, WorkspaceAccess,
     WorkspaceAttachment,
 };
@@ -126,6 +126,8 @@ enum ProvisionVfsMode {
 struct ValidationReport {
     errors: Vec<String>,
     warnings: Vec<String>,
+    /// Facts worth knowing that need no action.
+    notes: Vec<String>,
 }
 
 impl ValidationReport {
@@ -137,25 +139,37 @@ impl ValidationReport {
         self.warnings.push(message.into());
     }
 
+    fn note(&mut self, message: impl Into<String>) {
+        self.notes.push(message.into());
+    }
+
     fn extend(&mut self, other: ValidationReport) {
         self.errors.extend(other.errors);
         self.warnings.extend(other.warnings);
+        self.notes.extend(other.notes);
+    }
+
+    fn print_notices(&self) {
+        for note in &self.notes {
+            eprintln!("note: {note}");
+        }
+        for warning in &self.warnings {
+            eprintln!("warning: {warning}");
+        }
     }
 
     fn finish(self, json: bool) -> Result<()> {
         if json {
             crate::output::show(
                 true,
-                &serde_json::json!({"valid":self.errors.is_empty(),"warnings":self.warnings,"errors":self.errors}),
+                &serde_json::json!({"valid":self.errors.is_empty(),"notes":self.notes,"warnings":self.warnings,"errors":self.errors}),
             )?;
             if !self.errors.is_empty() {
                 bail!("profile validation failed");
             }
             return Ok(());
         }
-        for warning in &self.warnings {
-            eprintln!("warning: {warning}");
-        }
+        self.print_notices();
         if self.errors.is_empty() {
             println!("Profile validation passed.");
             return Ok(());
@@ -167,9 +181,7 @@ impl ValidationReport {
     }
 
     fn ensure_success(self) -> Result<()> {
-        for warning in &self.warnings {
-            eprintln!("warning: {warning}");
-        }
+        self.print_notices();
         if self.errors.is_empty() {
             return Ok(());
         }
@@ -443,16 +455,11 @@ async fn validate_import_documents(
 }
 
 fn prefix_validation_report(profile_id: &str, mut report: ValidationReport) -> ValidationReport {
-    report.warnings = report
-        .warnings
-        .into_iter()
-        .map(|message| format!("profile {profile_id}: {message}"))
-        .collect();
-    report.errors = report
-        .errors
-        .into_iter()
-        .map(|message| format!("profile {profile_id}: {message}"))
-        .collect();
+    for messages in [&mut report.notes, &mut report.warnings, &mut report.errors] {
+        for message in messages.iter_mut() {
+            *message = format!("profile {profile_id}: {message}");
+        }
+    }
     report
 }
 
@@ -624,7 +631,7 @@ async fn validate_environments(
     };
     let bindings = bindings
         .into_iter()
-        .map(|binding| (binding.binding_id.clone(), binding))
+        .map(|binding| (binding.provider_id.clone(), binding))
         .collect::<BTreeMap<_, _>>();
     for environment_id in environment_ids {
         validate_environment_attachment(api, &environment_id, &bindings, report).await;
@@ -653,47 +660,80 @@ async fn validate_environment_attachment(
             return;
         }
     };
-    match environment.status {
-        EnvironmentLifecycleStatusView::Ready => {}
-        EnvironmentLifecycleStatusView::Closing
-        | EnvironmentLifecycleStatusView::Closed
-        | EnvironmentLifecycleStatusView::Failed => report.error(format!(
+    match environment.state {
+        EnvironmentStateView::Closing
+        | EnvironmentStateView::Closed
+        | EnvironmentStateView::Failed => report.error(format!(
             "profile environment {environment_id} is {:?}; applying the profile will be rejected until it points at an open environment",
-            environment.status
+            environment.state
         )),
-        status => report.warning(format!(
-            "profile environment {environment_id} is {status:?}, not ready"
+        EnvironmentStateView::Provisioning => report.warning(format!(
+            "profile environment {environment_id} is still provisioning"
         )),
+        EnvironmentStateView::Open => match environment.status {
+            EnvironmentStatusView::Paused
+            | EnvironmentStatusView::Suspended
+            | EnvironmentStatusView::Stopped => report.note(format!(
+                "profile environment {environment_id} is {:?}; it wakes on use",
+                environment.status
+            )),
+            EnvironmentStatusView::Away => report.warning(match &environment.source {
+                EnvironmentSourceView::Registered {
+                    identity_mode: EnvironmentIdentityModeView::Persistent,
+                    ..
+                } => format!(
+                    "profile environment {environment_id}: daemon disconnected (persistent key); uses wait up to two minutes for it to reconnect"
+                ),
+                EnvironmentSourceView::Registered {
+                    identity_mode: EnvironmentIdentityModeView::Ephemeral,
+                    ..
+                } => format!(
+                    "profile environment {environment_id}: daemon disconnected (ephemeral key); uses are refused, and it closes unless the daemon reconnects within the key's disconnect grace"
+                ),
+                _ => format!("profile environment {environment_id}: daemon disconnected"),
+            }),
+            EnvironmentStatusView::Unknown => report.warning(format!(
+                "profile environment {environment_id} is open, but its provider's latest observation is inconclusive"
+            )),
+            EnvironmentStatusView::Ready
+            | EnvironmentStatusView::Provisioning
+            | EnvironmentStatusView::Closing
+            | EnvironmentStatusView::Closed
+            | EnvironmentStatusView::Failed => {}
+        },
     }
-    // A long-lived box (a bot's, or one shared by several sessions) sleeps
-    // only through its own idle policy; nothing on the profile can add one.
-    match &environment.source {
-        EnvironmentSourceView::Provisioned { .. } if environment.idle_policy.is_none() => {
-            report.warning(format!(
-                "profile environment {environment_id} has no idle policy: it never pauses, suspends, or stops while idle (set one with `env idle-policy` or on the Environments page)"
-            ));
-        }
-        EnvironmentSourceView::External { .. } => {
+    if let EnvironmentSourceView::External { .. } = &environment.source {
+        report.warning(format!(
+            "profile environment {environment_id} is external: no power control, so it can never be paused or stopped while idle"
+        ));
+    }
+    if let EnvironmentSourceView::Provisioned { provider_id, .. } = &environment.source {
+        warn_unusable_binding(
+            bindings,
+            provider_id,
+            &format!("profile environment {environment_id}"),
+            report,
+        );
+    }
+}
+
+fn warn_unusable_binding(
+    bindings: &BTreeMap<String, api::EnvironmentProviderBindingView>,
+    provider_id: &str,
+    subject: &str,
+    report: &mut ValidationReport,
+) {
+    match bindings.get(provider_id) {
+        Some(binding) if !binding.enabled => {
             report.warning(format!(
-                "profile environment {environment_id} is external: no power control, so it can never be paused or stopped while idle"
+                "{subject}: provider binding {provider_id} is disabled"
             ));
         }
+        None => report.warning(format!(
+            "{subject}: provider binding {provider_id} is missing"
+        )),
         _ => {}
     }
-    if let EnvironmentSourceView::Provisioned { binding_id, .. } = &environment.source {
-        match bindings.get(binding_id) {
-            Some(binding) if binding.status != EnvironmentProviderBindingStatusView::Enabled => {
-                report.warning(format!(
-                    "profile environment binding {binding_id} is {:?}",
-                    binding.status
-                ));
-            }
-            None => report.warning(format!(
-                "profile environment binding {binding_id} is missing"
-            )),
-            _ => {}
-        }
-    }
 }
 
 /// Inserts the attachment or repoints the existing one at the same path,
diff --git a/crates/cli/tests/resource_commands.rs b/crates/cli/tests/resource_commands.rs
index 8fed2de50..7fdbf85b9 100644
--- a/crates/cli/tests/resource_commands.rs
+++ b/crates/cli/tests/resource_commands.rs
@@ -546,22 +546,41 @@ fn oauth_no_wait_and_empty_lists_have_useful_output_and_clean_json() {
 fn provisioning_and_template_commands_send_current_typed_requests() {
     let runtime = Runtime::start(|method, params| match method {
         "environments/templates/list" => {
-            assert_eq!(params["bindingId"], "local");
-            json!({"templates":[{"templateId":"linux-v1","providerId":"incus","bindingId":"local","displayName":"Linux","publicIngress":false,"deprecated":false}]})
+            assert_eq!(params["providerId"], "incus");
+            json!({"templates":[{"templateId":"linux-v1","providerId":"incus","displayName":"Linux","powerStates":["running","paused"],"publicIngress":false,"deprecated":false}]})
         }
         "environments/create" | "environments/external/create" => {
-            let source = if method == "environments/create" {
+            let (source, state, status) = if method == "environments/create" {
                 assert_eq!(params["templateId"], "linux-v1");
-                assert_eq!(params["bindingId"], "local");
+                assert_eq!(params["providerId"], "incus");
                 assert_eq!(params["metadata"], json!({"project":"audit"}));
-                json!({"type":"provisioned","providerId":"incus","bindingId":"local"})
+                (
+                    json!({"type":"provisioned","providerId":"incus","templateId":"linux-v1"}),
+                    "provisioning",
+                    "provisioning",
+                )
             } else {
                 assert_eq!(params["endpoint"], "wss://env.example/ws");
                 assert!(params.get("connection").is_none(), "{params}");
-                json!({"type":"external","endpoint":params["endpoint"]})
+                (
+                    json!({"type":"external","endpoint":params["endpoint"]}),
+                    "open",
+                    "ready",
+                )
             };
             assert_eq!(params["requestId"], "retry-1");
-            json!({"environment":{"environmentId":"env1","requestId":params["requestId"],"source":source,"status":"provisioning","desiredPower":"running","incarnation":{"incarnationId":"i1","createdAtMs":0,"updatedAtMs":0},"publicIngressEnabled":false,"createdAtMs":0,"updatedAtMs":0}})
+            json!({"environment":{"environmentId":"env1","requestId":params["requestId"],"source":source,"state":state,"status":status,"stateChangedAtMs":0,"createdAtMs":0,"updatedAtMs":0}})
+        }
+        "environments/list" => {
+            assert_eq!(params["includeClosed"], true);
+            assert_eq!(params["after"], "env0");
+            json!({"environments":[{"environmentId":"env1","source":{"type":"external","endpoint":"wss://env.example/ws"},"state":"closed","status":"closed","closeReason":"requested","stateChangedAtMs":0,"closedAtMs":0,"createdAtMs":0,"updatedAtMs":0}],"nextAfter":"env1"})
+        }
+        "environments/update" => {
+            assert_eq!(params["environmentId"], "env1");
+            assert_eq!(params["displayName"], "Build box");
+            assert_eq!(params["metadata"], json!({"team":"platform"}));
+            json!({"environment":{"environmentId":"env1","displayName":"Build box","metadata":{"team":"platform"},"source":{"type":"external","endpoint":"wss://env.example/ws"},"state":"open","status":"ready","stateChangedAtMs":0,"createdAtMs":0,"updatedAtMs":1}})
         }
         "deployment/environment-providers/list" => json!({"providers":[]}),
         "environments/provider-bindings/list" => json!({"bindings":[]}),
@@ -571,16 +590,16 @@ fn provisioning_and_template_commands_send_current_typed_requests() {
         "environments",
         "templates",
         "list",
-        "--binding",
-        "local",
+        "--provider",
+        "incus",
         "--json",
     ]);
     assert_eq!(templates["templates"][0]["templateId"], "linux-v1");
     let created = runtime.json(&[
         "environment",
         "create",
-        "--binding",
-        "local",
+        "--provider",
+        "incus",
         "--template",
         "linux-v1",
         "--request-id",
@@ -611,6 +630,20 @@ fn provisioning_and_template_commands_send_current_typed_requests() {
             .success(&["environment", "binding", "list"])
             .contains("No environment provider bindings")
     );
+    let page = runtime.success(&["environment", "list", "--include-closed", "--after", "env0"]);
+    assert!(page.contains("STATE"), "{page}");
+    assert!(page.contains("--after env1"), "{page}");
+    let updated = runtime.json(&[
+        "environment",
+        "update",
+        "env1",
+        "--name",
+        "Build box",
+        "--metadata",
+        "team=platform",
+        "--json",
+    ]);
+    assert_eq!(updated["displayName"], "Build box");
 }
 
 #[test]
diff --git a/crates/environment-client/Cargo.toml b/crates/environment-client/Cargo.toml
index a1e1ddd70..f408d7b22 100644
--- a/crates/environment-client/Cargo.toml
+++ b/crates/environment-client/Cargo.toml
@@ -5,7 +5,8 @@ edition = "2024"
 
 [features]
 # `conformance::controller`: a suite that drives any controller endpoint
-# through `ControllerClient` and checks the controller-plane contract.
+# through `ControllerClient` and checks the controller-plane contract;
+# `conformance::data_route`: checks of a data route's typed refusals.
 conformance = []
 
 [dependencies]
diff --git a/crates/environment-client/src/conformance/controller.rs b/crates/environment-client/src/conformance/controller.rs
index ac61c60bb..f550dab2c 100644
--- a/crates/environment-client/src/conformance/controller.rs
+++ b/crates/environment-client/src/conformance/controller.rs
@@ -7,19 +7,34 @@
 //!   `protocolVersion` with `versionMismatch` (leaving the connection open
 //!   and uninitialized), refuses requests before it with `notInitialized`,
 //!   and refuses a repeat with `invalidRequest`;
-//! - a missing or wrong bearer credential is refused with HTTP 401 before
-//!   the upgrade;
-//! - `routes.data` passes the downgrade rule for the controller URL;
+//! - when the suite is given a bearer credential, a missing or wrong one is
+//!   refused with HTTP 401 before the upgrade (a provider registered
+//!   without a credential is not checked for one);
 //! - `target/get` never creates and answers `notFound` for an unknown
 //!   owner or id; a foreign owner on a known `targetId` is
 //!   `failedPrecondition` (`ownerMismatch`);
 //! - `target/create` answers promptly and is idempotent per owner;
-//! - `target/close` by owner without a `targetId` closes, is idempotent,
-//!   and answers `closed` without `targetId` for an owner with nothing;
-//! - optional methods answer `capabilityUnavailable` when not advertised.
+//! - `target/close` by owner without a `targetId` closes, is idempotent
+//!   (a repeat answers `closed`), and answers `closed` without `targetId`
+//!   for an owner with nothing;
+//! - optional methods (`target/setPower` without `capabilities.power`,
+//!   `ingress/*` without `capabilities.ingress`) answer
+//!   `capabilityUnavailable`;
+//! - when the suite is given the provider's data route base, the created
+//!   target's data route ([`provider_data_route`]) upgrades, refusing at
+//!   most `waking` or `booting` with `Retry-After` on the way; with
+//!   `capabilities.power` and a template that lists a powered-down state,
+//!   a target moved there by `target/setPower` wakes on the next dial
+//!   (obligation 2); and once the target is closed the route refuses
+//!   410 `gone`.
+//!
+//! Every answer is decoded strictly, so an observation that carries a
+//! member this protocol version does not define fails the check that read
+//! it. Owners are `{universeId, environmentId}`.
 //!
 //! The suite creates one target from the configured template and closes it
-//! again; every other check uses fresh owners that hold nothing.
+//! again; every other check uses fresh owners that hold nothing. The data
+//! route checks are built on [`data_route`](super::data_route).
 //!
 //! ```no_run
 //! # async fn example(options: environment_client::ConnectOptions,
@@ -45,19 +60,24 @@ use environment_protocol::{
         handshake::{ControllerInitializeParams, ControllerInitializeResponse},
         ingress::{EnsureIngressParams, RemoveIngressParams},
         target::{
-            AdoptTargetParams, CloseTargetParams, CreateTargetParams, GetTargetParams,
-            TargetObservation, TargetOwner, TargetPhase, TargetRef,
+            CloseTargetParams, CreateTargetParams, GetTargetParams, PowerState,
+            SetTargetPowerParams, TargetObservation, TargetOwner, TargetPhase, TargetRef,
         },
+        template::ListTemplatesParams,
     },
     error::{Capability, ErrorData, PreconditionReason, ProtocolErrorKind},
     handshake::Plane,
-    ids::{ProviderNativeRef, ProviderTargetId, TemplateId},
+    ids::{ProviderTargetId, TemplateId},
     manifest::{ControllerInitialize, TargetGet},
+    routes::{DataRouteBase, DataRouteRefusal, provider_data_route},
 };
 use thiserror::Error;
 
 use crate::{
-    ClientError, ConnectOptions, ControllerClient, connection::Connection, controller::initialize,
+    ClientError, ConnectOptions, ControllerClient,
+    conformance::data_route::{await_upgrade, expect_refusal},
+    connection::Connection,
+    controller::initialize,
 };
 
 /// What to run the suite against.
@@ -65,13 +85,19 @@ use crate::{
 pub struct ControllerConformance {
     /// The controller URL, as registered for the provider.
     pub endpoint: String,
-    /// Connect options carrying the provider credential as `bearer_token`.
+    /// Connect options carrying the provider credential, when the provider
+    /// is registered with one, as `bearer_token`.
     pub options: ConnectOptions,
     /// A template the suite may create one target from.
     pub template_id: TemplateId,
-    /// Returns a fresh owner on every call, valid for the provider's
-    /// binding and never used before.
+    /// Returns a fresh owner on every call, in a universe the provider
+    /// serves and never used before.
     pub owner: Arc<dyn Fn() -> TargetOwner + Send + Sync>,
+    /// The provider's data route base, as Lightspeed dials it: configured,
+    /// or [`DataRouteBase::derived_from_controller`]. When set, the suite
+    /// also dials the created target's data route with `options`. Default
+    /// none.
+    pub data_route_base: Option<DataRouteBase>,
     /// Bound on every answer: target methods answer promptly and continue
     /// slow work in the background. Default 15 s.
     pub prompt_bound: Duration,
@@ -94,6 +120,7 @@ impl ControllerConformance {
             options,
             template_id,
             owner,
+            data_route_base: None,
             prompt_bound: Duration::from_secs(15),
             settle_timeout: Duration::from_secs(600),
             poll_interval: Duration::from_secs(2),
@@ -107,6 +134,7 @@ impl fmt::Debug for ControllerConformance {
             .debug_struct("ControllerConformance")
             .field("endpoint", &self.endpoint)
             .field("template_id", &self.template_id)
+            .field("data_route_base", &self.data_route_base)
             .field("prompt_bound", &self.prompt_bound)
             .field("settle_timeout", &self.settle_timeout)
             .finish_non_exhaustive()
@@ -203,15 +231,9 @@ pub async fn run(suite: &ControllerConformance) -> ConformanceReport {
         check_repeat_initialize(suite, &client).await,
     );
     report.record("initialize.order", check_initialize_order(suite).await);
-    report.record("credential", check_credential(suite).await);
-    report.record(
-        "routes.data",
-        initialize
-            .routes
-            .data
-            .check_for_controller(&suite.endpoint)
-            .map_err(|error| error.to_string()),
-    );
+    if suite.options.bearer_token.is_some() {
+        report.record("credential", check_credential(suite).await);
+    }
     report.record(
         "target.get.unknown",
         check_get_unknown(suite, &client).await,
@@ -229,16 +251,42 @@ pub async fn run(suite: &ControllerConformance) -> ConformanceReport {
     let created = check_create(suite, &client, &owner).await;
     let created_target = created.as_ref().ok().cloned().flatten();
     report.record("target.create", created.map(|_| ()));
-    if let Some(target_id) = created_target {
+    let route = created_target.as_ref().and_then(|target_id| {
+        suite
+            .data_route_base
+            .as_ref()
+            .map(|base| provider_data_route(base, &owner, target_id))
+    });
+    if let Some(target_id) = &created_target {
         report.record(
             "target.get.foreignOwner",
-            check_foreign_owner(suite, &client, &target_id).await,
+            check_foreign_owner(suite, &client, target_id).await,
         );
     }
-    report.record(
+    if let (Some(target_id), Some(route)) = (&created_target, &route) {
+        let upgraded = report.record("dataRoute.upgrade", check_upgrade(suite, route).await);
+        if upgraded && initialize.capabilities.power {
+            match power_down_state(suite, &client, &owner).await {
+                Ok(Some(power)) => {
+                    report.record(
+                        "dataRoute.wake",
+                        check_wake(suite, &client, &owner, target_id, route, power).await,
+                    );
+                }
+                Ok(None) => {}
+                Err(error) => {
+                    report.record("dataRoute.wake", Err(error));
+                }
+            }
+        }
+    }
+    let closed = report.record(
         "target.close.byOwner",
         check_close_by_owner(suite, &client, &owner).await,
     );
+    if closed && let Some(route) = &route {
+        report.record("dataRoute.gone", check_gone(suite, route).await);
+    }
     let _ = client.close().await;
     report
 }
@@ -336,7 +384,7 @@ async fn check_credential(suite: &ControllerConformance) -> Check {
     wrong.bearer_token = Some(SecretString::new("lightspeed-conformance-wrong-credential"));
     for (label, options) in [("missing", missing), ("wrong", wrong)] {
         match ControllerClient::connect_initialized(&suite.endpoint, options).await {
-            Err(ClientError::UpgradeRejected { status: 401 }) => {}
+            Err(ClientError::UpgradeRejected { status: 401, .. }) => {}
             Err(error) => {
                 return Err(format!(
                     "{label} credential: expected HTTP 401, got {error}"
@@ -371,11 +419,11 @@ async fn check_close_nothing(suite: &ControllerConformance, client: &ControllerC
     let observation = close(client, &owner)
         .await
         .map_err(|error| format!("target/close of an owner with nothing: {error}"))?;
-    if observation.state.phase != TargetPhase::Closed || observation.target_id.is_some() {
+    if observation.phase != TargetPhase::Closed || observation.target_id.is_some() {
         return Err(format!(
             "target/close of an owner with nothing answered phase {:?} with targetId {:?}; \
              expected closed without targetId",
-            observation.state.phase, observation.target_id
+            observation.phase, observation.target_id
         ));
     }
     check_owner_echo(&observation, &owner)
@@ -386,17 +434,18 @@ async fn check_optional_methods(
     client: &ControllerClient,
     initialize: &ControllerInitializeResponse,
 ) -> Check {
-    if !initialize.capabilities.adopt_target {
-        let source = ProviderNativeRef::new("lightspeed-conformance-source")
-            .map_err(|error| error.to_string())?;
-        let adopted = client
-            .adopt_target(&AdoptTargetParams {
-                owner: (suite.owner)(),
-                source_target: source,
+    if !initialize.capabilities.power {
+        let powered = client
+            .set_target_power(&SetTargetPowerParams {
+                target: TargetRef {
+                    owner: (suite.owner)(),
+                    target_id: None,
+                },
+                power: PowerState::Running,
             })
             .await;
-        expect_capability(adopted.map(|_| ()), Capability::AdoptTarget)
-            .map_err(|error| format!("target/adopt without adoptTarget: {error}"))?;
+        expect_capability(powered.map(|_| ()), Capability::Power)
+            .map_err(|error| format!("target/setPower without power: {error}"))?;
     }
     if !initialize.capabilities.ingress {
         let target = TargetRef {
@@ -427,6 +476,8 @@ async fn check_create(
     let params = CreateTargetParams {
         owner: owner.clone(),
         template_id: suite.template_id.clone(),
+        display_name: None,
+        idle: None,
     };
     let first = timed(suite, "target/create", client.create_target(&params)).await?;
     let second = timed(
@@ -496,7 +547,7 @@ async fn check_foreign_owner(
         )),
         Ok(observation) => Err(format!(
             "a foreign owner observed the target (phase {:?})",
-            observation.state.phase
+            observation.phase
         )),
     }
 }
@@ -522,7 +573,7 @@ async fn check_close_by_owner(
         .await?
         .target;
         check_owner_echo(&observation, owner)?;
-        match observation.state.phase {
+        match observation.phase {
             TargetPhase::Closed => break,
             TargetPhase::Closing => {}
             phase => return Err(format!("target/close answered phase {phase:?}")),
@@ -538,15 +589,123 @@ async fn check_close_by_owner(
     let again = close(client, owner)
         .await
         .map_err(|error| format!("repeated target/close: {error}"))?;
-    if again.state.phase != TargetPhase::Closed {
+    if again.phase != TargetPhase::Closed {
         return Err(format!(
             "repeated target/close answered phase {:?}",
-            again.state.phase
+            again.phase
         ));
     }
     Ok(())
 }
 
+/// The created target's data route upgrades within the settle timeout,
+/// refusing at most `waking` or `booting` on the way.
+async fn check_upgrade(suite: &ControllerConformance, route: &str) -> Check {
+    let refusals = await_upgrade(route, suite.options.clone(), suite.settle_timeout).await?;
+    check_wait_refusals(&refusals)
+}
+
+/// The first powered-down state the configured template lists for
+/// `target/setPower`, if any.
+async fn power_down_state(
+    suite: &ControllerConformance,
+    client: &ControllerClient,
+    owner: &TargetOwner,
+) -> Result<Option<PowerState>, String> {
+    let templates = timed(
+        suite,
+        "template/list",
+        client.list_templates(&ListTemplatesParams {
+            universe_id: owner.universe_id.clone(),
+        }),
+    )
+    .await?;
+    let template = templates
+        .templates
+        .iter()
+        .find(|template| template.template_id == suite.template_id)
+        .ok_or_else(|| format!("template/list does not list {}", suite.template_id))?;
+    Ok([
+        PowerState::Paused,
+        PowerState::Suspended,
+        PowerState::Stopped,
+    ]
+    .into_iter()
+    .find(|power| template.power_states.contains(power)))
+}
+
+/// Move the target to `power`, wait until it is observed there, then dial
+/// its data route: the dial wakes it and upgrades within the settle
+/// timeout, refusing at most `waking` or `booting` on the way.
+async fn check_wake(
+    suite: &ControllerConformance,
+    client: &ControllerClient,
+    owner: &TargetOwner,
+    target_id: &ProviderTargetId,
+    route: &str,
+    power: PowerState,
+) -> Check {
+    let target = TargetRef {
+        owner: owner.clone(),
+        target_id: Some(target_id.clone()),
+    };
+    timed(
+        suite,
+        "target/setPower",
+        client.set_target_power(&SetTargetPowerParams {
+            target: target.clone(),
+            power,
+        }),
+    )
+    .await?;
+    let deadline = Instant::now() + suite.settle_timeout;
+    loop {
+        let observation = get(client, owner, Some(target_id.clone()))
+            .await
+            .map_err(|error| format!("target/get after target/setPower {power}: {error}"))?;
+        if observation.power == Some(power) {
+            break;
+        }
+        if Instant::now() >= deadline {
+            return Err(format!(
+                "the target was not observed {power} within {:?} (last {:?})",
+                suite.settle_timeout, observation.power
+            ));
+        }
+        tokio::time::sleep(suite.poll_interval).await;
+    }
+    let refusals = await_upgrade(route, suite.options.clone(), suite.settle_timeout)
+        .await
+        .map_err(|error| format!("dialing the {power} target: {error}"))?;
+    check_wait_refusals(&refusals)
+}
+
+/// Once the target is closed its data route refuses 410 `gone`.
+async fn check_gone(suite: &ControllerConformance, route: &str) -> Check {
+    match expect_refusal(route, suite.options.clone()).await? {
+        DataRouteRefusal::Gone {} => Ok(()),
+        refusal => Err(format!(
+            "the closed target's data route refused {refusal}, expected gone"
+        )),
+    }
+}
+
+/// A provider data route waits only with `waking` or `booting`; the other
+/// 503 refusals are the gateway's.
+fn check_wait_refusals(refusals: &[DataRouteRefusal]) -> Check {
+    match refusals.iter().find(|refusal| {
+        !matches!(
+            refusal,
+            DataRouteRefusal::Waking {} | DataRouteRefusal::Booting {}
+        )
+    }) {
+        Some(refusal) => Err(format!(
+            "the provider data route refused {refusal}; a provider waits only with waking or booting"
+        )),
+        None => Ok(()),
+    }
+}
+
 async fn get(
     client: &ControllerClient,
     owner: &TargetOwner,
diff --git a/crates/environment-client/src/conformance/data_route.rs b/crates/environment-client/src/conformance/data_route.rs
new file mode 100644
index 000000000..0b482092e
--- /dev/null
+++ b/crates/environment-client/src/conformance/data_route.rs
@@ -0,0 +1,178 @@
+//! Data-route refusal conformance: a provider data route that does not
+//! upgrade answers a typed [`DataRouteRefusal`] body with the status that
+//! refusal names, a 503 carries `Retry-After`, and the route answers within
+//! [`MAX_DATA_ROUTE_HOLD_MS`]. [`await_upgrade`] dials until the route
+//! upgrades, waiting out each conforming 503 at its `Retry-After`; the
+//! [`controller`](super::controller) suite runs both against a created
+//! target when it is given the provider's data route base.
+//!
+//! ```no_run
+//! # async fn example(options: environment_client::ConnectOptions) {
+//! use environment_client::conformance::data_route::expect_refusal;
+//!
+//! // A data route of a target the provider was just told to pause.
+//! let refusal = expect_refusal("wss://provider.example/routes/u1/env_1/ls-3f2a", options)
+//!     .await
+//!     .expect("the route refuses with a typed body");
+//! # let _ = refusal;
+//! # }
+//! ```
+
+use std::time::{Duration, Instant};
+
+use environment_protocol::{limits::MAX_DATA_ROUTE_HOLD_MS, routes::DataRouteRefusal};
+
+use crate::{ClientError, ConnectOptions, DataClient};
+
+/// Slack on top of [`MAX_DATA_ROUTE_HOLD_MS`] for the dial itself.
+const HOLD_SLACK: Duration = Duration::from_secs(2);
+
+/// Check one refused upgrade: it is typed as a [`DataRouteRefusal`], its
+/// status is the one the refusal names (503, 410 or 409), and a 503
+/// carries `Retry-After` of at least one second. The client types a
+/// refusal from its status when the body was not read with the headers
+/// ([`ClientError::UpgradeRejected`]), so this check cannot tell a missing
+/// body from one the transport split off.
+pub fn check_refusal(error: &ClientError) -> Result<&DataRouteRefusal, String> {
+    let ClientError::UpgradeRejected {
+        status,
+        refusal,
+        retry_after_ms,
+    } = error
+    else {
+        return Err(format!("expected a refused upgrade, got {error}"));
+    };
+    let refusal = refusal
+        .as_ref()
+        .ok_or_else(|| format!("HTTP {status} carries no data route refusal body"))?;
+    if *status != refusal.status() {
+        return Err(format!(
+            "refusal {} answered with HTTP {status}, expected {}",
+            refusal.state(),
+            refusal.status()
+        ));
+    }
+    if refusal.is_retryable() && !retry_after_ms.is_some_and(|ms| ms >= 1_000) {
+        return Err(format!(
+            "refusal {} carries no Retry-After of at least 1 s",
+            refusal.state()
+        ));
+    }
+    Ok(refusal)
+}
+
+/// Dial `url` as a data route and require a conforming refusal within
+/// [`MAX_DATA_ROUTE_HOLD_MS`] (plus dial slack). Returns the refusal.
+pub async fn expect_refusal(
+    url: &str,
+    options: ConnectOptions,
+) -> Result<DataRouteRefusal, String> {
+    let started = Instant::now();
+    let outcome = DataClient::connect_initialized(url, options).await;
+    let elapsed = started.elapsed();
+    let error = match outcome {
+        Ok((client, _)) => {
+            let _ = client.close().await;
+            return Err("the data route upgraded instead of refusing".to_owned());
+        }
+        Err(error) => error,
+    };
+    let refusal = check_refusal(&error)?.clone();
+    check_hold(elapsed)?;
+    Ok(refusal)
+}
+
+/// Dial `url` as a data route until it upgrades, within `timeout`. Every
+/// refusal on the way must conform ([`check_refusal`]), be a 503 and answer
+/// within [`MAX_DATA_ROUTE_HOLD_MS`]; the next dial follows its
+/// `Retry-After`. Returns the 503 refusals seen, in order: `waking` for a
+/// powered-down target the dial woke, `booting` while envd starts.
+pub async fn await_upgrade(
+    url: &str,
+    options: ConnectOptions,
+    timeout: Duration,
+) -> Result<Vec<DataRouteRefusal>, String> {
+    let deadline = Instant::now() + timeout;
+    let mut refusals = Vec::new();
+    loop {
+        let started = Instant::now();
+        let outcome = DataClient::connect_initialized(url, options.clone()).await;
+        let elapsed = started.elapsed();
+        let error = match outcome {
+            Ok((client, _)) => {
+                let _ = client.close().await;
+                return Ok(refusals);
+            }
+            Err(error) => error,
+        };
+        let refusal = check_refusal(&error)?.clone();
+        check_hold(elapsed)?;
+        if !refusal.is_retryable() {
+            return Err(format!(
+                "the data route refused {refusal} instead of upgrading"
+            ));
+        }
+        let retry_after = Duration::from_millis(error.retry_after_ms().unwrap_or(1_000));
+        if Instant::now() + retry_after > deadline {
+            return Err(format!(
+                "the data route did not upgrade within {timeout:?}; last refusal {refusal}"
+            ));
+        }
+        refusals.push(refusal);
+        tokio::time::sleep(retry_after).await;
+    }
+}
+
+/// A dial that refused must answer within [`MAX_DATA_ROUTE_HOLD_MS`] plus
+/// [`HOLD_SLACK`].
+fn check_hold(elapsed: Duration) -> Result<(), String> {
+    let bound = Duration::from_millis(MAX_DATA_ROUTE_HOLD_MS) + HOLD_SLACK;
+    if elapsed > bound {
+        return Err(format!(
+            "the data route held the dial for {elapsed:?}, over the {bound:?} bound"
+        ));
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use environment_protocol::metadata::DescriptiveText;
+
+    use super::*;
+
+    fn rejected(
+        status: u16,
+        refusal: Option<DataRouteRefusal>,
+        retry_after_ms: Option<u64>,
+    ) -> ClientError {
+        ClientError::UpgradeRejected {
+            status,
+            refusal,
+            retry_after_ms,
+        }
+    }
+
+    #[test]
+    fn refusals_must_match_their_status_and_carry_retry_after() {
+        assert_eq!(
+            check_refusal(&rejected(
+                503,
+                Some(DataRouteRefusal::Waking {}),
+                Some(2_000)
+            )),
+            Ok(&DataRouteRefusal::Waking {})
+        );
+        assert!(check_refusal(&rejected(503, Some(DataRouteRefusal::Waking {}), None)).is_err());
+        assert!(check_refusal(&rejected(503, Some(DataRouteRefusal::Gone {}), None)).is_err());
+        assert!(check_refusal(&rejected(410, None, None)).is_err());
+        assert!(check_refusal(&ClientError::Transport("x".to_owned())).is_err());
+        let failed = DataRouteRefusal::Failed {
+            message: DescriptiveText::lossy("disk lost").unwrap(),
+        };
+        assert_eq!(
+            check_refusal(&rejected(409, Some(failed.clone()), None)),
+            Ok(&failed)
+        );
+    }
+}
diff --git a/crates/environment-client/src/conformance/mod.rs b/crates/environment-client/src/conformance/mod.rs
index ec2c07fe7..77d2dae53 100644
--- a/crates/environment-client/src/conformance/mod.rs
+++ b/crates/environment-client/src/conformance/mod.rs
@@ -3,6 +3,8 @@
 //! feature.
 //!
 //! - [`controller`]: any provider controller, through
-//!   [`ControllerClient`](crate::ControllerClient).
+//!   [`ControllerClient`](crate::ControllerClient);
+//! - [`data_route`]: a provider data route's refusals before the upgrade.
 
 pub mod controller;
+pub mod data_route;
diff --git a/crates/environment-client/src/connection.rs b/crates/environment-client/src/connection.rs
index 82134b217..bfed3ce08 100644
--- a/crates/environment-client/src/connection.rs
+++ b/crates/environment-client/src/connection.rs
@@ -733,10 +733,7 @@ mod tests {
     async fn methods_of_another_plane_are_refused_before_sending() {
         let connection = Connection::in_process(Plane::Data, idle_handler(serde_json::json!({})));
         let params = serde_json::from_value(serde_json::json!({
-            "target": {"owner": {
-                "universeId": "u", "bindingId": "b",
-                "environmentId": "e", "incarnationId": "i"
-            }}
+            "target": {"owner": {"universeId": "u", "environmentId": "e"}}
         }))
         .unwrap();
         assert!(matches!(
diff --git a/crates/environment-client/src/controller.rs b/crates/environment-client/src/controller.rs
index 4a0b577c2..7a0afbc54 100644
--- a/crates/environment-client/src/controller.rs
+++ b/crates/environment-client/src/controller.rs
@@ -9,8 +9,8 @@ use environment_protocol::{
     handshake::Plane,
     jsonrpc::{Request, Response},
     manifest::{
-        ControllerInitialize, IngressEnsure, IngressRemove, RequestMethod, TargetAdopt,
-        TargetClose, TargetCreate, TargetGet, TargetSetPower, TemplateList,
+        ControllerInitialize, IngressEnsure, IngressRemove, RequestMethod, TargetClose,
+        TargetCreate, TargetGet, TargetSetPower, TemplateList,
     },
 };
 use futures_util::future::BoxFuture;
@@ -40,12 +40,11 @@ struct Inner {
 
 impl ControllerClient {
     /// Dial the controller URL and run `initialize` with
-    /// [`CONTROLLER_PROTOCOL_VERSION`]. Pass the provider credential as
-    /// [`ConnectOptions::bearer_token`]. Fails with
+    /// [`CONTROLLER_PROTOCOL_VERSION`]. Pass the provider credential, when
+    /// one is configured, as [`ConnectOptions::bearer_token`]; without one
+    /// no `Authorization` header is sent. Fails with
     /// [`ClientError::VersionMismatch`] or [`ClientError::WrongPlane`]
-    /// before the connection is used. The caller still checks
-    /// `routes.data` against the controller URL
-    /// (`DataRouteBase::check_for_controller`).
+    /// before the connection is used.
     pub async fn connect_initialized(
         endpoint: &str,
         options: ConnectOptions,
@@ -87,7 +86,7 @@ impl ControllerClient {
         }
     }
 
-    /// The controller's `initialize` response: capabilities and routes.
+    /// The controller's `initialize` response: its capabilities.
     pub fn initialize_response(&self) -> &ControllerInitializeResponse {
         &self.inner.initialize
     }
@@ -125,8 +124,6 @@ impl ControllerClient {
         list_templates => TemplateList;
         /// `target/create`.
         create_target => TargetCreate;
-        /// `target/adopt`.
-        adopt_target => TargetAdopt;
         /// `target/get`.
         get_target => TargetGet;
         /// `target/setPower`.
diff --git a/crates/environment-client/src/dial.rs b/crates/environment-client/src/dial.rs
index 544fe68d8..e75f94d32 100644
--- a/crates/environment-client/src/dial.rs
+++ b/crates/environment-client/src/dial.rs
@@ -3,7 +3,10 @@
 
 use std::time::Duration;
 
-use environment_protocol::limits::MAX_MESSAGE_BYTES;
+use environment_protocol::{
+    limits::MAX_MESSAGE_BYTES,
+    routes::{DataRouteRefusal, parse_retry_after_ms},
+};
 use tokio::{
     io::{AsyncRead, AsyncWrite},
     net::UnixStream,
@@ -15,8 +18,8 @@ use tokio_tungstenite::{
         client::IntoClientRequest,
         handshake::client::Request,
         http::{
-            HeaderName, HeaderValue,
-            header::{AUTHORIZATION, USER_AGENT},
+            HeaderMap, HeaderName, HeaderValue,
+            header::{AUTHORIZATION, RETRY_AFTER, USER_AGENT},
         },
         protocol::WebSocketConfig,
     },
@@ -97,9 +100,20 @@ fn upgrade_request(
 
 fn dial_error(endpoint: &str, error: tungstenite::Error) -> ClientError {
     match error {
-        tungstenite::Error::Http(response) => ClientError::UpgradeRejected {
-            status: response.status().as_u16(),
-        },
+        tungstenite::Error::Http(response) => {
+            let status = response.status().as_u16();
+            let retry_after_ms = retry_after_ms(response.headers());
+            let refusal = DataRouteRefusal::from_refused_upgrade(
+                status,
+                response.body().as_deref(),
+                retry_after_ms,
+            );
+            ClientError::UpgradeRejected {
+                status,
+                refusal,
+                retry_after_ms,
+            }
+        }
         tungstenite::Error::Url(error) => configuration(endpoint, error.to_string()),
         error => ClientError::Connect {
             endpoint: endpoint.to_owned(),
@@ -108,6 +122,10 @@ fn dial_error(endpoint: &str, error: tungstenite::Error) -> ClientError {
     }
 }
 
+fn retry_after_ms(headers: &HeaderMap) -> Option<u64> {
+    parse_retry_after_ms(headers.get(RETRY_AFTER)?.to_str().ok()?)
+}
+
 async fn bounded<T>(
     endpoint: &str,
     timeout: Duration,
@@ -183,7 +201,7 @@ where
 
 #[cfg(test)]
 mod tests {
-    use environment_protocol::handshake::ImplementationInfo;
+    use environment_protocol::{handshake::ImplementationInfo, limits::RETRY_AFTER_MAX_SECS};
 
     use super::*;
 
@@ -217,6 +235,104 @@ mod tests {
         }
     }
 
+    #[test]
+    fn retry_after_is_whole_seconds_clamped_to_the_maximum() {
+        let header = |value: &str| {
+            let mut headers = HeaderMap::new();
+            headers.insert(RETRY_AFTER, HeaderValue::from_str(value).unwrap());
+            retry_after_ms(&headers)
+        };
+        assert_eq!(header("3"), Some(3_000));
+        assert_eq!(header("3600"), Some(RETRY_AFTER_MAX_SECS * 1_000));
+        assert_eq!(header("Wed, 21 Oct 2026 07:28:00 GMT"), None);
+        assert_eq!(retry_after_ms(&HeaderMap::new()), None);
+    }
+
+    #[test]
+    fn rejected_upgrades_decode_a_refusal_body() {
+        let response = tungstenite::http::Response::builder()
+            .status(503)
+            .header(RETRY_AFTER, "2")
+            .body(Some(br#"{"state":"booting"}"#.to_vec()))
+            .unwrap();
+        let error = dial_error("ws://h/", tungstenite::Error::Http(Box::new(response)));
+        assert!(
+            matches!(
+                &error,
+                ClientError::UpgradeRejected {
+                    status: 503,
+                    refusal: Some(DataRouteRefusal::Booting {}),
+                    retry_after_ms: Some(2_000),
+                }
+            ),
+            "{error:?}"
+        );
+        let garbled = tungstenite::http::Response::builder()
+            .status(503)
+            .body(Some(b"<html>busy</html>".to_vec()))
+            .unwrap();
+        assert!(matches!(
+            dial_error("ws://h/", tungstenite::Error::Http(Box::new(garbled))),
+            ClientError::UpgradeRejected {
+                status: 503,
+                refusal: None,
+                retry_after_ms: None,
+            }
+        ));
+    }
+
+    #[test]
+    fn a_refusal_whose_body_was_not_read_falls_back_on_its_status() {
+        let refused = |status: u16, retry_after: Option<&str>, body: Option<Vec<u8>>| {
+            let mut response = tungstenite::http::Response::builder().status(status);
+            if let Some(retry_after) = retry_after {
+                response = response.header(RETRY_AFTER, retry_after);
+            }
+            match dial_error(
+                "ws://h/",
+                tungstenite::Error::Http(Box::new(response.body(body).unwrap())),
+            ) {
+                ClientError::UpgradeRejected {
+                    refusal,
+                    retry_after_ms,
+                    ..
+                } => (refusal, retry_after_ms),
+                error => panic!("expected a refused upgrade, got {error:?}"),
+            }
+        };
+        // The tail read with the headers is empty, or there is none.
+        assert_eq!(
+            refused(410, None, Some(Vec::new())),
+            (Some(DataRouteRefusal::Gone {}), None)
+        );
+        assert_eq!(
+            refused(410, None, None),
+            (Some(DataRouteRefusal::Gone {}), None)
+        );
+        assert!(matches!(
+            refused(409, None, Some(Vec::new())),
+            (Some(DataRouteRefusal::Failed { .. }), None)
+        ));
+        assert_eq!(
+            refused(503, Some("4"), Some(Vec::new())),
+            (Some(DataRouteRefusal::Booting {}), Some(4_000))
+        );
+        // A partial body does not decode either.
+        assert_eq!(
+            refused(503, Some("4"), Some(br#"{"state":"wak"#.to_vec())),
+            (Some(DataRouteRefusal::Booting {}), Some(4_000))
+        );
+        // A decoded body wins over the status.
+        assert_eq!(
+            refused(503, Some("4"), Some(br#"{"state":"waking"}"#.to_vec())),
+            (Some(DataRouteRefusal::Waking {}), Some(4_000))
+        );
+        // Statuses that name no refusal.
+        assert_eq!(refused(503, None, Some(Vec::new())), (None, None));
+        assert_eq!(refused(401, None, None), (None, None));
+        assert_eq!(refused(404, Some("4"), None), (None, Some(4_000)));
+    }
+
     #[test]
     fn upgrade_requests_carry_agent_credential_and_headers() {
         let request = upgrade_request(
diff --git a/crates/environment-client/src/error.rs b/crates/environment-client/src/error.rs
index 3008d7c30..bdc541d31 100644
--- a/crates/environment-client/src/error.rs
+++ b/crates/environment-client/src/error.rs
@@ -3,6 +3,7 @@
 use environment_protocol::{
     error::{ProtocolError, ProtocolErrorKind},
     handshake::Plane,
+    routes::DataRouteRefusal,
 };
 use thiserror::Error;
 
@@ -30,10 +31,20 @@ pub enum ClientError {
     ConnectTimeout { endpoint: String },
 
     /// The server answered the upgrade with an HTTP status instead of
-    /// switching protocols: 401 for a missing or wrong credential, 503 for
-    /// a route that is not ready yet.
-    #[error("upgrade refused with HTTP {status}")]
-    UpgradeRejected { status: u16 },
+    /// switching protocols: 401 for a missing or wrong credential, or a
+    /// data route's 503, 410 or 409. `refusal` is the response body when it
+    /// decodes as a [`DataRouteRefusal`], else the refusal the status alone
+    /// names (410 `gone`, 409 `failed`, a 503 with `Retry-After` `booting`),
+    /// so a body split from the headers by the transport still types the
+    /// refusal; `retry_after_ms` is the
+    /// `Retry-After` header in milliseconds, clamped to
+    /// [`RETRY_AFTER_MAX_SECS`](environment_protocol::limits::RETRY_AFTER_MAX_SECS).
+    #[error("upgrade refused with HTTP {status}{}", describe_refusal(refusal.as_ref()))]
+    UpgradeRejected {
+        status: u16,
+        refusal: Option<DataRouteRefusal>,
+        retry_after_ms: Option<u64>,
+    },
 
     /// The server speaks another protocol version on this plane: it
     /// answered `initialize` with `versionMismatch`, or with a different
@@ -115,6 +126,24 @@ impl ClientError {
         }
     }
 
+    /// The data route's typed refusal, for an
+    /// [`UpgradeRejected`](Self::UpgradeRejected) whose body or status
+    /// names one.
+    pub fn data_route_refusal(&self) -> Option<&DataRouteRefusal> {
+        match self {
+            Self::UpgradeRejected { refusal, .. } => refusal.as_ref(),
+            _ => None,
+        }
+    }
+
+    /// The refused upgrade's `Retry-After`, in milliseconds.
+    pub fn retry_after_ms(&self) -> Option<u64> {
+        match self {
+            Self::UpgradeRejected { retry_after_ms, .. } => *retry_after_ms,
+            _ => None,
+        }
+    }
+
     /// True when the same call may succeed later without any change: a
     /// retryable protocol kind (`busy`, `unavailable`, `aborted`), a
     /// connection failure, a closed connection, a deadline, or an upgrade
@@ -128,7 +157,7 @@ impl ClientError {
             | Self::Closed { .. }
             | Self::Transport(_)
             | Self::DeadlineExceeded { .. } => true,
-            Self::UpgradeRejected { status } => *status == 429 || (500..600).contains(status),
+            Self::UpgradeRejected { status, .. } => *status == 429 || (500..600).contains(status),
             Self::Configuration { .. }
             | Self::VersionMismatch { .. }
             | Self::WrongPlane { .. }
@@ -140,6 +169,10 @@ impl ClientError {
     }
 }
 
+fn describe_refusal(refusal: Option<&DataRouteRefusal>) -> String {
+    refusal.map_or_else(String::new, |refusal| format!(": {refusal}"))
+}
+
 fn describe_close(code: Option<u16>, reason: Option<&str>) -> String {
     match (code, reason) {
         (Some(code), Some(reason)) if !reason.is_empty() => format!(" ({code}: {reason})"),
@@ -178,29 +211,58 @@ mod tests {
             .is_retryable()
         );
         assert!(ClientError::DeadlineExceeded { elapsed_ms: 10 }.is_retryable());
-        assert!(ClientError::UpgradeRejected { status: 503 }.is_retryable());
-        assert!(ClientError::UpgradeRejected { status: 429 }.is_retryable());
-        assert!(!ClientError::UpgradeRejected { status: 401 }.is_retryable());
+        assert!(rejected(503, None).is_retryable());
+        assert!(rejected(429, None).is_retryable());
+        assert!(!rejected(401, None).is_retryable());
+        assert!(!rejected(410, Some(DataRouteRefusal::Gone {})).is_retryable());
         assert!(!ClientError::Decode("x".to_owned()).is_retryable());
         assert!(
             !ClientError::VersionMismatch {
                 plane: Plane::Data,
-                local: 3,
-                remote: 2
+                local: 4,
+                remote: 3
             }
             .is_retryable()
         );
         assert_eq!(
             ClientError::VersionMismatch {
                 plane: Plane::Controller,
-                local: 3,
-                remote: 4
+                local: 4,
+                remote: 5
             }
             .protocol_kind(),
             Some(ProtocolErrorKind::VersionMismatch)
         );
     }
 
+    fn rejected(status: u16, refusal: Option<DataRouteRefusal>) -> ClientError {
+        ClientError::UpgradeRejected {
+            status,
+            refusal,
+            retry_after_ms: None,
+        }
+    }
+
+    #[test]
+    fn upgrade_refusals_display_their_state() {
+        assert_eq!(
+            rejected(401, None).to_string(),
+            "upgrade refused with HTTP 401"
+        );
+        let waking = ClientError::UpgradeRejected {
+            status: 503,
+            refusal: Some(DataRouteRefusal::Waking {}),
+            retry_after_ms: Some(3_000),
+        };
+        assert_eq!(waking.to_string(), "upgrade refused with HTTP 503: waking");
+        assert_eq!(
+            waking.data_route_refusal(),
+            Some(&DataRouteRefusal::Waking {})
+        );
+        assert_eq!(waking.retry_after_ms(), Some(3_000));
+        assert_eq!(rejected(401, None).data_route_refusal(), None);
+    }
+
     #[test]
     fn close_display_names_code_and_reason() {
         assert_eq!(
diff --git a/crates/environment-client/tests/client.rs b/crates/environment-client/tests/client.rs
index d03b08f77..55075f7e9 100644
--- a/crates/environment-client/tests/client.rs
+++ b/crates/environment-client/tests/client.rs
@@ -26,11 +26,12 @@ use environment_protocol::{
     },
     error::{ProtocolError, ProtocolErrorKind},
     handshake::{ImplementationInfo, Plane},
-    ids::{BindingId, EnvironmentId, IncarnationId, ProcessId, TemplateId, UniverseId},
+    ids::{EnvironmentId, ProcessId, TemplateId, UniverseId},
     jsonrpc::{self, CancelRequestParams, Id, Message as RpcMessage, Request, Response},
-    limits::MAX_MESSAGE_BYTES,
+    limits::{MAX_MESSAGE_BYTES, RETRY_AFTER_MAX_SECS},
     manifest::{CancelRequest, EnvGetIdle},
     paths::EnvironmentPath,
+    routes::DataRouteRefusal,
 };
 use futures_util::{SinkExt, StreamExt};
 use serde_json::{Value, json};
@@ -555,10 +556,116 @@ async fn an_upgrade_refusal_reports_its_status() {
         .await
         .expect_err("refused");
     assert!(
-        matches!(error, ClientError::UpgradeRejected { status: 401 }),
+        matches!(
+            error,
+            ClientError::UpgradeRejected {
+                status: 401,
+                refusal: None,
+                retry_after_ms: None,
+            }
+        ),
+        "{error:?}"
+    );
+    assert!(!error.is_retryable());
+}
+
+/// Serve one data route refusal: `status`, `Retry-After` when given, and a
+/// JSON body.
+#[allow(clippy::result_large_err)]
+async fn refusing_route(
+    status: StatusCode,
+    retry_after: Option<&'static str>,
+    body: Value,
+) -> String {
+    let listener = TcpListener::bind("127.0.0.1:0").await.expect("listener");
+    let url = format!("ws://{}", listener.local_addr().expect("address"));
+    tokio::spawn(async move {
+        let (stream, _) = listener.accept().await.expect("accept");
+        let _ = accept_hdr_async(stream, move |_: &UpgradeRequest, _: UpgradeResponse| {
+            let mut response = ErrorResponse::new(Some(body.to_string()));
+            *response.status_mut() = status;
+            let headers = response.headers_mut();
+            headers.insert("content-type", "application/json".parse().unwrap());
+            if let Some(retry_after) = retry_after {
+                headers.insert("retry-after", retry_after.parse().unwrap());
+            }
+            Err(response)
+        })
+        .await;
+    });
+    url
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn a_data_route_refusal_is_typed_with_its_retry_after() {
+    let url = refusing_route(
+        StatusCode::SERVICE_UNAVAILABLE,
+        Some("3"),
+        json!({"state": "waking"}),
+    )
+    .await;
+    let error = DataClient::connect_initialized(&url, options())
+        .await
+        .expect_err("refused");
+    assert!(
+        matches!(
+            &error,
+            ClientError::UpgradeRejected {
+                status: 503,
+                refusal: Some(DataRouteRefusal::Waking {}),
+                retry_after_ms: Some(3_000),
+            }
+        ),
         "{error:?}"
     );
+    assert!(error.is_retryable());
+    assert_eq!(error.to_string(), "upgrade refused with HTTP 503: waking");
+
+    let url = refusing_route(
+        StatusCode::SERVICE_UNAVAILABLE,
+        Some("86400"),
+        json!({"state": "booting"}),
+    )
+    .await;
+    let error = DataClient::connect_initialized(&url, options())
+        .await
+        .expect_err("refused");
+    assert_eq!(error.retry_after_ms(), Some(RETRY_AFTER_MAX_SECS * 1_000));
+
+    let url = refusing_route(StatusCode::GONE, None, json!({"state": "gone"})).await;
+    let error = DataClient::connect_initialized(&url, options())
+        .await
+        .expect_err("refused");
+    assert_eq!(error.data_route_refusal(), Some(&DataRouteRefusal::Gone {}));
     assert!(!error.is_retryable());
+    assert_eq!(
+        environment_client::conformance::data_route::check_refusal(&error),
+        Ok(&DataRouteRefusal::Gone {})
+    );
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn an_undecodable_refusal_body_keeps_the_status() {
+    let url = refusing_route(
+        StatusCode::SERVICE_UNAVAILABLE,
+        None,
+        json!({"state": "sleeping"}),
+    )
+    .await;
+    let error = DataClient::connect_initialized(&url, options())
+        .await
+        .expect_err("refused");
+    assert!(
+        matches!(
+            error,
+            ClientError::UpgradeRejected {
+                status: 503,
+                refusal: None,
+                retry_after_ms: None,
+            }
+        ),
+        "{error:?}"
+    );
 }
 
 #[tokio::test(flavor = "current_thread")]
@@ -626,9 +733,7 @@ async fn conformance_reports_an_unreachable_controller() {
     drop(listener);
     let owner = Arc::new(|| TargetOwner {
         universe_id: UniverseId::new("u1").unwrap(),
-        binding_id: BindingId::new("b1").unwrap(),
         environment_id: EnvironmentId::new("e1").unwrap(),
-        incarnation_id: IncarnationId::new("i1").unwrap(),
     });
     let report = run(&ControllerConformance::new(
         url,
diff --git a/crates/environment-daemon/src/config.rs b/crates/environment-daemon/src/config.rs
index e9abbe912..65b596ac8 100644
--- a/crates/environment-daemon/src/config.rs
+++ b/crates/environment-daemon/src/config.rs
@@ -8,7 +8,7 @@ use std::{
 };
 
 use anyhow::{Context, Result, bail};
-use clap::{Parser, Subcommand};
+use clap::{Parser, Subcommand, ValueEnum};
 use environment_protocol::{
     bytes::SecretString,
     metadata::{DisplayName, Metadata},
@@ -61,6 +61,30 @@ pub struct DaemonArgs {
     #[arg(long, env = "LIGHTSPEED_ENVD_DISCOVERY_URL", global = true)]
     pub discovery_url: Option<String>,
 
+    /// Accept a plain `ws://` gateway URL toward a non-loopback host, such
+    /// as a cluster-internal service inside one trusted network. The
+    /// registration key and every stream then cross that network in the
+    /// clear.
+    #[arg(
+        long,
+        env = "LIGHTSPEED_ENVD_ALLOW_INSECURE_GATEWAY",
+        default_value_t = false
+    )]
+    pub allow_insecure_gateway: bool,
+
+    /// What the daemon does once the gateway reports its environment
+    /// closed: `exit` with status 4, or `park` (stop registering and
+    /// listening, then wait for `SIGTERM` or `SIGINT` and exit 0) so a
+    /// supervisor that restarts on every exit does not restart a spent
+    /// identity.
+    #[arg(
+        long,
+        env = "LIGHTSPEED_ENVD_ON_CLOSED",
+        value_enum,
+        default_value_t = OnClosed::Exit
+    )]
+    pub on_closed: OnClosed,
+
     /// Upgrade automatically when an outbound gateway challenges with a
     /// different environment protocol version.
     #[arg(long, env = "LIGHTSPEED_ENVD_AUTO_UPGRADE", default_value_t = false)]
@@ -117,6 +141,17 @@ pub struct DaemonArgs {
     pub print_build: bool,
 }
 
+/// What a registered daemon does once its environment is closed. Either
+/// way it never reconnects: a closed identity is spent.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, ValueEnum)]
+pub enum OnClosed {
+    /// End the process with status 4.
+    #[default]
+    Exit,
+    /// Stop registering and listening, and wait for `SIGTERM` or `SIGINT`.
+    Park,
+}
+
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Subcommand)]
 pub enum DaemonCommand {
     /// Install the envd build published by the configured gateway.
@@ -201,6 +236,10 @@ pub struct RegistrationConfig {
     /// Absolute discovery URL reported on mismatch and used by automatic
     /// upgrade.
     pub discovery_url: String,
+    /// Accept a plain `ws://` gateway URL toward a non-loopback host.
+    pub allow_insecure_gateway: bool,
+    /// What the daemon does once its environment is closed.
+    pub on_closed: OnClosed,
     /// Present only when mismatch-triggered replacement and re-exec is opted
     /// in. The argument vector is captured before the daemon starts serving.
     pub(crate) auto_upgrade: Option<RestartInvocation>,
@@ -229,6 +268,8 @@ impl std::fmt::Debug for RegistrationConfig {
             .field("receipt_path", &self.receipt_path)
             .field("ca_file", &self.ca_file)
             .field("discovery_url", &self.discovery_url)
+            .field("allow_insecure_gateway", &self.allow_insecure_gateway)
+            .field("on_closed", &self.on_closed)
             .field("auto_upgrade", &self.auto_upgrade.is_some())
             .field("upgrade_attempted_for", &self.upgrade_attempted_for)
             .finish()
@@ -248,7 +289,8 @@ pub struct GatewayUrls {
 
 impl RegistrationConfig {
     /// Registration that never replaces the running binary: no key, name,
-    /// metadata, receipt, or CA file until the caller sets them. The CLI
+    /// metadata, receipt, or CA file until the caller sets them; `wss://`
+    /// (or loopback `ws://`) only; exits once closed. The CLI
     /// attaches the restart invocation for automatic upgrade itself, so it
     /// stays crate-private.
     pub fn new(gateway_url: String, discovery_url: String) -> Self {
@@ -260,32 +302,48 @@ impl RegistrationConfig {
             receipt_path: None,
             ca_file: None,
             discovery_url,
+            allow_insecure_gateway: false,
+            on_closed: OnClosed::Exit,
             auto_upgrade: None,
             upgrade_attempted_for: None,
         }
     }
 
+    /// The discovery URL must be HTTPS (or HTTP toward loopback) whenever
+    /// it can download a build. With an insecure gateway and no automatic
+    /// upgrade it is only named in mismatch reports, so the plain `http://`
+    /// URL derived from a `ws://` gateway is accepted there.
     pub fn validate(&self) -> Result<GatewayUrls> {
-        let urls = gateway_urls(&self.gateway_url)?;
+        let urls = gateway_urls(&self.gateway_url, self.allow_insecure_gateway)?;
         if let Some(key) = &self.registration_key
             && (key.is_empty() || key.expose().chars().any(char::is_whitespace))
         {
             bail!("registration key must be a single non-empty token");
         }
-        crate::upgrade::validate_discovery_url(&self.discovery_url)?;
+        if !self.allow_insecure_gateway || self.auto_upgrade.is_some() {
+            crate::upgrade::validate_discovery_url(&self.discovery_url).with_context(|| {
+                if self.allow_insecure_gateway {
+                    "automatic upgrade downloads over https: set LIGHTSPEED_ENVD_DISCOVERY_URL"
+                } else {
+                    "discovery URL"
+                }
+            })?;
+        }
         Ok(urls)
     }
 }
 
 /// Validate a gateway connect URL and derive what it determines. Plain
-/// `ws://` is accepted only toward loopback; everything else must be
-/// `wss://`, so neither the registration key nor any stream crosses a
-/// network in the clear. The path must end with `CONNECT_PATH` (a prefix
-/// before it is kept), with no query or fragment.
-pub fn gateway_urls(url: &str) -> Result<GatewayUrls> {
+/// `ws://` is accepted toward loopback, and toward any other host only when
+/// `allow_insecure` opts in; otherwise the URL must be `wss://`, so neither
+/// the registration key nor any stream crosses a network in the clear. The
+/// path must end with `CONNECT_PATH` (a prefix before it is kept), with no
+/// query or fragment.
+pub fn gateway_urls(url: &str, allow_insecure: bool) -> Result<GatewayUrls> {
     let scheme = url.split_once("://").map(|(scheme, _)| scheme);
     match scheme {
         Some("wss") => {}
+        Some("ws") if allow_insecure => {}
         Some("ws") => {
             let origin = canonical_origin(url)?;
             let host = origin
@@ -304,7 +362,10 @@ pub fn gateway_urls(url: &str) -> Result<GatewayUrls> {
                     .parse::<std::net::IpAddr>()
                     .is_ok_and(|ip| ip.is_loopback());
             if !loopback {
-                bail!("gateway URL must use wss:// except toward loopback: {url}");
+                bail!(
+                    "gateway URL must use wss:// except toward loopback \
+                     (or set LIGHTSPEED_ENVD_ALLOW_INSECURE_GATEWAY): {url}"
+                );
             }
         }
         _ => bail!("gateway URL must start with wss:// (or ws:// toward loopback): {url}"),
@@ -371,6 +432,8 @@ impl DaemonArgs {
             Some(gateway_url) => Some(registration_config(
                 gateway_url,
                 self.discovery_url,
+                self.allow_insecure_gateway,
+                self.on_closed,
                 self.auto_upgrade,
                 self.registration_key,
                 self.registration_key_file,
@@ -386,6 +449,12 @@ impl DaemonArgs {
                 if self.auto_upgrade {
                     bail!("automatic upgrade needs LIGHTSPEED_ENVD_GATEWAY_URL to dial");
                 }
+                if self.allow_insecure_gateway {
+                    bail!("an insecure gateway needs LIGHTSPEED_ENVD_GATEWAY_URL to dial");
+                }
+                if self.on_closed == OnClosed::Park {
+                    bail!("parking on close needs LIGHTSPEED_ENVD_GATEWAY_URL to register");
+                }
                 None
             }
         };
@@ -411,6 +480,8 @@ impl DaemonArgs {
 fn registration_config(
     gateway_url: String,
     discovery_url: Option<String>,
+    allow_insecure_gateway: bool,
+    on_closed: OnClosed,
     auto_upgrade: bool,
     registration_key: Option<String>,
     registration_key_file: Option<PathBuf>,
@@ -419,8 +490,15 @@ fn registration_config(
     registration_receipt: Option<PathBuf>,
     ca_file: Option<PathBuf>,
 ) -> Result<RegistrationConfig> {
-    let discovery_url =
-        crate::upgrade::resolve_discovery_url(Some(&gateway_url), discovery_url.as_deref())?;
+    // An explicit discovery URL is checked here; a derived one by
+    // `validate`, which knows whether this configuration can download.
+    let discovery_url = match discovery_url {
+        Some(url) => {
+            crate::upgrade::validate_discovery_url(&url)?;
+            url
+        }
+        None => crate::upgrade::derive_discovery_url(&gateway_url)?,
+    };
     let auto_upgrade = auto_upgrade
         .then(|| -> Result<RestartInvocation> {
             Ok(RestartInvocation {
@@ -477,6 +555,8 @@ fn registration_config(
         receipt_path: registration_receipt,
         ca_file,
         discovery_url,
+        allow_insecure_gateway,
+        on_closed,
         auto_upgrade,
         upgrade_attempted_for,
     };
@@ -613,6 +693,8 @@ mod tests {
             listen: None,
             gateway_url: None,
             discovery_url: None,
+            allow_insecure_gateway: false,
+            on_closed: OnClosed::Exit,
             auto_upgrade: false,
             registration_key: None,
             registration_key_file: None,
@@ -729,7 +811,11 @@ mod tests {
 
     #[test]
     fn gateway_urls_are_loopback_only_in_the_clear_and_end_with_the_connect_path() {
-        let urls = gateway_urls("wss://Gateway.example/ls/environment-gateway/connect").unwrap();
+        let urls = gateway_urls(
+            "wss://Gateway.example/ls/environment-gateway/connect",
+            false,
+        )
+        .unwrap();
         assert_eq!(urls.origin.as_str(), "wss://gateway.example");
         assert_eq!(
             urls.stream,
@@ -740,7 +826,7 @@ mod tests {
             "ws://localhost:18080/environment-gateway/connect",
             "ws://[::1]:18080/environment-gateway/connect",
         ] {
-            assert!(gateway_urls(good).is_ok(), "{good}");
+            assert!(gateway_urls(good, false).is_ok(), "{good}");
         }
         for bad in [
             "ws://gateway.example/environment-gateway/connect",
@@ -750,8 +836,124 @@ mod tests {
             "wss://gateway.example/environment-gateway/connect?x=1",
             "wss://user@gateway.example/environment-gateway/connect",
         ] {
-            assert!(gateway_urls(bad).is_err(), "{bad}");
+            assert!(gateway_urls(bad, false).is_err(), "{bad}");
+            if !bad.starts_with("ws://") {
+                assert!(gateway_urls(bad, true).is_err(), "{bad} stays refused");
+            }
+        }
+    }
+
+    #[test]
+    fn an_opt_in_accepts_a_cluster_internal_gateway_in_the_clear() {
+        let url = "ws://lightspeed-gateway.lightspeed.svc:8080/environment-gateway/connect";
+        let urls = gateway_urls(url, true).expect("opted in");
+        assert_eq!(
+            urls.origin.as_str(),
+            "ws://lightspeed-gateway.lightspeed.svc:8080"
+        );
+        assert_eq!(
+            urls.stream,
+            "ws://lightspeed-gateway.lightspeed.svc:8080/environment-gateway/data"
+        );
+
+        let temp = temp();
+        let refused = DaemonArgs {
+            gateway_url: Some(url.to_owned()),
+            ..args(&temp)
+        }
+        .into_config();
+        assert!(refused.is_err(), "refused without the opt-in");
+
+        let config = DaemonArgs {
+            gateway_url: Some(url.to_owned()),
+            allow_insecure_gateway: true,
+            ..args(&temp)
         }
+        .into_config()
+        .expect("config");
+        let registration = config.registration.expect("registration");
+        assert!(registration.allow_insecure_gateway);
+        assert_eq!(
+            registration.discovery_url,
+            "http://lightspeed-gateway.lightspeed.svc:8080/.well-known/lightspeed-envd",
+            "a report-only discovery URL may be plain HTTP"
+        );
+
+        // Downloading a build still needs HTTPS discovery.
+        let downloading = DaemonArgs {
+            gateway_url: Some(url.to_owned()),
+            allow_insecure_gateway: true,
+            auto_upgrade: true,
+            ..args(&temp)
+        }
+        .into_config();
+        assert!(downloading.is_err());
+        let explicit = DaemonArgs {
+            gateway_url: Some(url.to_owned()),
+            allow_insecure_gateway: true,
+            auto_upgrade: true,
+            discovery_url: Some("https://downloads.example/envd.json".to_owned()),
+            ..args(&temp)
+        }
+        .into_config()
+        .expect("https discovery");
+        assert!(
+            explicit
+                .registration
+                .expect("registration")
+                .auto_upgrade
+                .is_some()
+        );
+
+        let without_gateway = DaemonArgs {
+            allow_insecure_gateway: true,
+            ..args(&temp)
+        }
+        .into_config();
+        assert!(without_gateway.is_err());
+    }
+
+    #[test]
+    fn on_closed_defaults_to_exit_and_parking_needs_a_gateway() {
+        let parsed = DaemonArgs::try_parse_from([
+            "lightspeed-envd",
+            "--gateway-url",
+            "wss://gateway.example/environment-gateway/connect",
+        ])
+        .expect("args");
+        assert_eq!(parsed.on_closed, OnClosed::Exit);
+        assert!(!parsed.allow_insecure_gateway);
+        let parked = DaemonArgs::try_parse_from([
+            "lightspeed-envd",
+            "--gateway-url",
+            "wss://gateway.example/environment-gateway/connect",
+            "--on-closed",
+            "park",
+            "--allow-insecure-gateway",
+        ])
+        .expect("args");
+        assert_eq!(parked.on_closed, OnClosed::Park);
+        assert!(parked.allow_insecure_gateway);
+        assert!(DaemonArgs::try_parse_from(["lightspeed-envd", "--on-closed", "linger"]).is_err());
+
+        let temp = temp();
+        let config = DaemonArgs {
+            gateway_url: Some("wss://gateway.example/environment-gateway/connect".to_owned()),
+            on_closed: OnClosed::Park,
+            ..args(&temp)
+        }
+        .into_config()
+        .expect("config");
+        assert_eq!(
+            config.registration.expect("registration").on_closed,
+            OnClosed::Park
+        );
+        let without_gateway = DaemonArgs {
+            on_closed: OnClosed::Park,
+            ..args(&temp)
+        }
+        .into_config();
+        assert!(without_gateway.is_err());
     }
 
     #[test]
diff --git a/crates/environment-daemon/src/dispatch.rs b/crates/environment-daemon/src/dispatch.rs
index f9aca14bd..a1b5d0ecc 100644
--- a/crates/environment-daemon/src/dispatch.rs
+++ b/crates/environment-daemon/src/dispatch.rs
@@ -273,6 +273,6 @@ pub(crate) fn has_capability(
             .as_ref()
             .is_some_and(|process| process.pty),
         Capability::Job => capabilities.job.is_some(),
-        Capability::AdoptTarget | Capability::Ingress => false,
+        Capability::Power | Capability::Ingress => false,
     }
 }
diff --git a/crates/environment-daemon/src/lib.rs b/crates/environment-daemon/src/lib.rs
index 0ce58c8f3..53ff43904 100644
--- a/crates/environment-daemon/src/lib.rs
+++ b/crates/environment-daemon/src/lib.rs
@@ -187,19 +187,22 @@ impl DaemonRuntime {
     }
 
     /// `env/getIdle`: zero idle time while any process or job is still
-    /// executing, otherwise the time since the last `use` request. Live
-    /// work keeps the clock fresh so a long-running job that finishes
-    /// starts the idle countdown from its end, not its start. Leftover
-    /// process groups are counted but are not work: a server waiting for
-    /// requests must not keep the environment awake.
+    /// executing or any leftover process group has live members, otherwise
+    /// the time since the last `use` request. Live work keeps the clock
+    /// fresh so a long-running job that finishes starts the idle countdown
+    /// from its end, not its start. A leftover group is a service a command
+    /// started and left running, such as a dev server, so it holds the
+    /// environment awake like running work.
     pub async fn idle_report(&self) -> GetIdleResponse {
         let running_process_count = self.inner.processes.running_count().await;
         let running_job_count = self.inner.jobs.running_count().await;
         let leftover_process_group_count = self.inner.processes.leftover_group_count();
-        if running_process_count > 0 || running_job_count > 0 {
+        let working =
+            running_process_count > 0 || running_job_count > 0 || leftover_process_group_count > 0;
+        if working {
             self.inner.activity.touch();
         }
-        let idle_for_ms = if running_process_count > 0 || running_job_count > 0 {
+        let idle_for_ms = if working {
             0
         } else {
             u64::try_from(self.inner.activity.idle_for().as_millis()).unwrap_or(u64::MAX)
@@ -376,7 +379,7 @@ fn capability_name(capability: Capability) -> &'static str {
         Capability::Process => "the process family",
         Capability::ProcessPty => "process PTYs",
         Capability::Job => "the job family",
-        Capability::AdoptTarget => "target adoption",
+        Capability::Power => "power control",
         Capability::Ingress => "ingress",
     }
 }
@@ -602,6 +605,65 @@ mod tests {
         assert!(after.idle_for_ms < 5_000);
     }
 
+    #[cfg(unix)]
+    #[tokio::test(flavor = "current_thread")]
+    async fn a_leftover_process_group_holds_the_idle_clock_like_running_work() {
+        let (_temp, runtime) = runtime();
+        call(
+            &runtime,
+            ProcessStart::NAME,
+            json!({
+                "processId": "service",
+                "command": {
+                    "argv": ["/bin/sh", "-c", "nohup sleep 30 >/dev/null 2>&1 & echo $! > leftover.pid; exit 0"],
+                    "timeoutMs": 60000,
+                },
+            }),
+        )
+        .await;
+        let mut held = runtime.idle_report().await;
+        for _ in 0..250 {
+            if held.running_process_count == 0 && held.leftover_process_group_count == 1 {
+                break;
+            }
+            tokio::time::sleep(std::time::Duration::from_millis(20)).await;
+            held = runtime.idle_report().await;
+        }
+        assert_eq!(held.running_process_count, 0, "the root exited");
+        assert_eq!(held.leftover_process_group_count, 1);
+        tokio::time::sleep(std::time::Duration::from_millis(50)).await;
+        assert_eq!(
+            runtime.idle_report().await.idle_for_ms,
+            0,
+            "a leftover service keeps the environment awake"
+        );
+
+        let pid: i32 = std::fs::read_to_string(runtime.config().cwd.join("leftover.pid"))
+            .expect("pid file")
+            .trim()
+            .parse()
+            .expect("pid");
+        let _ = rustix::process::kill_process(
+            rustix::process::Pid::from_raw(pid).expect("pid"),
+            rustix::process::Signal::KILL,
+        );
+        let mut released = runtime.idle_report().await;
+        for _ in 0..250 {
+            if released.leftover_process_group_count == 0 {
+                break;
+            }
+            tokio::time::sleep(std::time::Duration::from_millis(20)).await;
+            released = runtime.idle_report().await;
+        }
+        assert_eq!(released.leftover_process_group_count, 0);
+        tokio::time::sleep(std::time::Duration::from_millis(30)).await;
+        let idle = runtime.idle_report().await.idle_for_ms;
+        assert!(
+            (30..5_000).contains(&idle),
+            "the clock restarts when the last leftover ends: idle_for_ms={idle}"
+        );
+    }
+
     #[tokio::test(flavor = "current_thread")]
     async fn observation_methods_leave_the_idle_clock_alone() {
         let (_temp, runtime) = runtime();
diff --git a/crates/environment-daemon/src/process.rs b/crates/environment-daemon/src/process.rs
index f17d29805..4979890e5 100644
--- a/crates/environment-daemon/src/process.rs
+++ b/crates/environment-daemon/src/process.rs
@@ -202,8 +202,8 @@ impl ProcessManager {
     }
 
     /// Process groups whose root exited while members still run, adopted
-    /// groups of an earlier instance included. Leftovers are not running
-    /// work: they never hold the idle clock.
+    /// groups of an earlier instance included. They hold the idle clock
+    /// like running work.
     pub fn leftover_group_count(&self) -> u32 {
         let live = {
             let table = self.table();
diff --git a/crates/environment-daemon/src/registration.rs b/crates/environment-daemon/src/registration.rs
index 5bbacbe69..7e99a13d5 100644
--- a/crates/environment-daemon/src/registration.rs
+++ b/crates/environment-daemon/src/registration.rs
@@ -10,7 +10,9 @@
 //! ([`DaemonExit`]): a deliberate shutdown says goodbye first, a terminal
 //! refusal or an unsupported gateway protocol is `Refused`, and a
 //! `registration/closed` notification ends it as `EnvironmentClosed` or
-//! `Superseded`.
+//! `Superseded`. `EnvironmentClosed`, from that notification or an
+//! `environmentClosed` admission refusal, ends only this loop: the server
+//! exits or parks, as `--on-closed` says.
 
 use std::{
     path::{Path, PathBuf},
@@ -935,7 +937,7 @@ mod tests {
     };
 
     use super::*;
-    use crate::test_support::runtime_with;
+    use crate::{config::OnClosed, test_support::runtime_with};
 
     type GatewaySocket = WebSocketStream<TcpStream>;
 
@@ -1035,7 +1037,6 @@ mod tests {
     fn receipt(admission: &str) -> Value {
         json!({
             "environmentId": "environment_a",
-            "incarnationId": "incarnation_a",
             "daemonId": "daemon_a",
             "controlConnectionId": "connection_a",
             "identityMode": "ephemeral",
@@ -1239,6 +1240,101 @@ mod tests {
         }
     }
 
+    /// Close the session of a freshly dialed control connection: admit and
+    /// send `registration/closed`, or refuse admission, both as
+    /// `environmentClosed`.
+    async fn close_environment(gateway: &FakeGateway, by_notification: bool) -> Accepted {
+        let mut control = gateway.accept().await;
+        challenge(&mut control.socket, [9u8; 32]).await;
+        let register = recv(&mut control.socket).await;
+        if by_notification {
+            admit(&mut control.socket, &register, 30_000).await;
+            send(
+                &mut control.socket,
+                json!({"jsonrpc": "2.0", "method": "registration/closed", "params": {
+                    "reason": "environmentClosed",
+                }}),
+            )
+            .await;
+        } else {
+            refuse(
+                &mut control.socket,
+                &register,
+                ProtocolError::failed_precondition(PreconditionReason::EnvironmentClosed, "closed"),
+            )
+            .await;
+        }
+        control
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn a_closed_environment_exits_or_parks_as_configured() {
+        for by_notification in [true, false] {
+            let gateway = FakeGateway::start("").await;
+            let (_temp, runtime, _) = daemon(&gateway, |_| {});
+            let server = tokio::spawn(crate::server::run(runtime.clone()));
+            let _control = close_environment(&gateway, by_notification).await;
+            let exit = tokio::time::timeout(Duration::from_secs(10), server)
+                .await
+                .expect("the daemon ends")
+                .unwrap();
+            assert_eq!(exit.status(), 4, "exit by default: {exit}");
+
+            let gateway = FakeGateway::start("").await;
+            let (_temp, runtime, _) = daemon(&gateway, |registration| {
+                registration.on_closed = OnClosed::Park;
+            });
+            let server = tokio::spawn(crate::server::run(runtime.clone()));
+            let _control = close_environment(&gateway, by_notification).await;
+            let redial =
+                tokio::time::timeout(Duration::from_millis(1_500), gateway.listener.accept()).await;
+            assert!(redial.is_err(), "a parked daemon never dials again");
+            assert!(!server.is_finished(), "a parked daemon keeps running");
+            runtime.shutdown().cancel();
+            let exit = tokio::time::timeout(Duration::from_secs(10), server)
+                .await
+                .expect("the parked daemon stops on a signal")
+                .unwrap();
+            assert_eq!(exit.status(), 0, "{exit}");
+        }
+    }
+
+    #[cfg(unix)]
+    #[tokio::test(flavor = "current_thread")]
+    async fn parking_also_stops_the_passive_listener() {
+        let gateway = FakeGateway::start("").await;
+        let socket_dir = tempfile::tempdir().unwrap();
+        let socket = socket_dir.path().join("envd.sock");
+        let mut registration = RegistrationConfig::new(
+            gateway.connect_url.clone(),
+            crate::upgrade::resolve_discovery_url(Some(&gateway.connect_url), None).unwrap(),
+        );
+        registration.on_closed = OnClosed::Park;
+        let listen = socket.clone();
+        let (_temp, runtime) = runtime_with(move |config| {
+            config.registration = Some(registration);
+            config.listen = Some(crate::config::ListenAddr::Unix(listen));
+        });
+        let server = tokio::spawn(crate::server::run(runtime.clone()));
+        let _control = close_environment(&gateway, true).await;
+        let mut stopped = false;
+        for _ in 0..500 {
+            if socket.exists() && tokio::net::UnixStream::connect(&socket).await.is_err() {
+                stopped = true;
+                break;
+            }
+            tokio::time::sleep(Duration::from_millis(10)).await;
+        }
+        assert!(stopped, "the listener stopped accepting");
+        assert!(!server.is_finished(), "a parked daemon keeps running");
+        runtime.shutdown().cancel();
+        let exit = tokio::time::timeout(Duration::from_secs(10), server)
+            .await
+            .expect("the parked daemon stops on a signal")
+            .unwrap();
+        assert_eq!(exit.status(), 0, "{exit}");
+    }
+
     #[tokio::test(flavor = "current_thread")]
     async fn register_errors_are_terminal_unless_retryable() {
         let terminal = [
diff --git a/crates/environment-daemon/src/server.rs b/crates/environment-daemon/src/server.rs
index 2f4d8be54..eac083ebf 100644
--- a/crates/environment-daemon/src/server.rs
+++ b/crates/environment-daemon/src/server.rs
@@ -39,7 +39,7 @@ use tokio_util::sync::CancellationToken;
 
 use crate::{
     DaemonRuntime,
-    config::ListenAddr,
+    config::{ListenAddr, OnClosed},
     dispatch::{self, ConnectionInfo, RequestContext, WrittenHook},
 };
 
@@ -48,14 +48,16 @@ use crate::{
 /// identity.
 #[derive(Debug)]
 pub enum DaemonExit {
-    /// `SIGTERM` or `SIGINT`; a registered daemon said goodbye first.
+    /// `SIGTERM` or `SIGINT`; a registered daemon said goodbye first, and
+    /// a parked one had already stopped registering.
     Shutdown,
     /// Local configuration, state or receipt-file error.
     Configuration(anyhow::Error),
     /// The gateway refused registration for good, or it speaks another
     /// protocol and no automatic upgrade succeeded.
     Refused(String),
-    /// The gateway closed the identity's environment.
+    /// The gateway closed the identity's environment, and the daemon is
+    /// configured to exit rather than park.
     EnvironmentClosed,
     /// Another process with this daemon identity connected and won.
     Superseded { daemon_public_key: String },
@@ -104,8 +106,30 @@ pub(crate) fn websocket_config() -> WebSocketConfig {
 
 /// Serve the daemon until it stops: the passive listener when one is
 /// configured, the outbound registration loop when a gateway URL is
-/// configured, or both.
+/// configured, or both. A daemon configured to park once its environment
+/// is closed stops both and waits for a deliberate stop instead of exiting.
 pub async fn run(runtime: DaemonRuntime) -> DaemonExit {
+    let shutdown = runtime.shutdown().clone();
+    let on_closed = runtime
+        .config()
+        .registration
+        .as_ref()
+        .map_or(OnClosed::Exit, |registration| registration.on_closed);
+    match (serve(runtime).await, on_closed) {
+        (DaemonExit::EnvironmentClosed, OnClosed::Park) => park(&shutdown).await,
+        (exit, _) => exit,
+    }
+}
+
+/// Wait for `SIGTERM` or `SIGINT` after the registration loop and the
+/// listener have ended. Data connections already open run until then.
+async fn park(shutdown: &CancellationToken) -> DaemonExit {
+    tracing_line("the environment was closed; parked until SIGTERM or SIGINT");
+    shutdown.cancelled().await;
+    DaemonExit::Shutdown
+}
+
+async fn serve(runtime: DaemonRuntime) -> DaemonExit {
     let listen = runtime.config().listen.clone();
     let registration = runtime.config().registration.clone();
     match (listen, registration) {
@@ -693,7 +717,7 @@ mod tests {
 
         send(
             &mut client,
-            json!({"jsonrpc": "2.0", "id": 2, "method": "initialize", "params": {"protocolVersion": 4, "clientInfo": {"name": "x"}, "fromTheFuture": true}}),
+            json!({"jsonrpc": "2.0", "id": 2, "method": "initialize", "params": {"protocolVersion": ENVD_PROTOCOL_VERSION + 1, "clientInfo": {"name": "x"}, "fromTheFuture": true}}),
         )
         .await;
         let mismatch: ProtocolError =
@@ -702,7 +726,7 @@ mod tests {
             mismatch.data,
             ErrorData::VersionMismatch {
                 expected: ENVD_PROTOCOL_VERSION,
-                received: 4
+                received: ENVD_PROTOCOL_VERSION + 1
             }
         );
 
diff --git a/crates/environment-daemon/src/upgrade.rs b/crates/environment-daemon/src/upgrade.rs
index 331dcfa30..2735de706 100644
--- a/crates/environment-daemon/src/upgrade.rs
+++ b/crates/environment-daemon/src/upgrade.rs
@@ -113,19 +113,25 @@ pub fn resolve_discovery_url(
     let gateway_url = gateway_url.ok_or_else(|| {
         anyhow!("upgrade needs LIGHTSPEED_ENVD_GATEWAY_URL or LIGHTSPEED_ENVD_DISCOVERY_URL")
     })?;
+    let resolved = derive_discovery_url(gateway_url)?;
+    validate_discovery_url(&resolved)?;
+    Ok(resolved)
+}
+
+/// The discovery endpoint a gateway URL implies, not yet checked for
+/// transport security: `https` for `wss://`, plain `http` for `ws://`.
+pub fn derive_discovery_url(gateway_url: &str) -> anyhow::Result<String> {
     if !gateway_url.starts_with("ws://") && !gateway_url.starts_with("wss://") {
         anyhow::bail!("cannot derive a discovery URL from gateway URL {gateway_url}");
     }
     let origin = canonical_origin(gateway_url).context("parse environment gateway URL")?;
-    let resolved = match origin.as_str().strip_prefix("wss://") {
+    Ok(match origin.as_str().strip_prefix("wss://") {
         Some(authority) => format!("https://{authority}{DISCOVERY_PATH}"),
         None => format!(
             "http://{}{DISCOVERY_PATH}",
             origin.as_str().trim_start_matches("ws://")
         ),
-    };
-    validate_discovery_url(&resolved)?;
-    Ok(resolved)
+    })
 }
 
 /// Discovery and archive downloads require HTTPS. Plain HTTP exists only for
diff --git a/crates/environment-protocol/contract/controller.openrpc.json b/crates/environment-protocol/contract/controller.openrpc.json
index 706c453a7..d3d08f019 100644
--- a/crates/environment-protocol/contract/controller.openrpc.json
+++ b/crates/environment-protocol/contract/controller.openrpc.json
@@ -16,52 +16,6 @@
           }
         ]
       },
-      "AdoptTargetParams": {
-        "additionalProperties": false,
-        "description": "`target/adopt` params: take ownership of an existing provider target.\nIdempotent per owner. Requires `capabilities.adoptTarget`. A source that\nbelongs to another owner, or an owner that already holds a different\ntarget, is `failedPrecondition` (`ownerMismatch`); a source the provider\ncannot take over is `failedPrecondition` (`notAdoptable`).",
-        "properties": {
-          "owner": {
-            "$ref": "#/components/schemas/TargetOwner"
-          },
-          "sourceTarget": {
-            "allOf": [
-              {
-                "$ref": "#/components/schemas/ProviderNativeRef"
-              }
-            ],
-            "description": "Provider-native reference to the existing target; the provider\ndefines its format."
-          }
-        },
-        "required": [
-          "owner",
-          "sourceTarget"
-        ],
-        "type": "object"
-      },
-      "BindingId": {
-        "description": "`bindingId` of a provider binding within a universe.",
-        "maxLength": 128,
-        "minLength": 1,
-        "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$",
-        "type": "string"
-      },
-      "BindingRef": {
-        "additionalProperties": false,
-        "description": "The provider binding a call is scoped to, for calls that concern no\nparticular target.",
-        "properties": {
-          "bindingId": {
-            "$ref": "#/components/schemas/BindingId"
-          },
-          "universeId": {
-            "$ref": "#/components/schemas/UniverseId"
-          }
-        },
-        "required": [
-          "universeId",
-          "bindingId"
-        ],
-        "type": "object"
-      },
       "BusyReason": {
         "description": "What limit a `busy` request hit.",
         "oneOf": [
@@ -116,8 +70,8 @@
             "type": "string"
           },
           {
-            "const": "adoptTarget",
-            "description": "The controller's `adoptTarget` capability.",
+            "const": "power",
+            "description": "The controller's `power` capability.",
             "type": "string"
           },
           {
@@ -129,7 +83,7 @@
       },
       "CloseTargetParams": {
         "additionalProperties": false,
-        "description": "`target/close` params: destroy the owner's target and every resource it\nholds, public ingress included. Graceful within the provider's own bound,\nthen forced. Answers `closing` until the target is gone, then `closed`;\n`closed` also when the provider holds no target for the owner.",
+        "description": "`target/close` params: destroy the owner's target and every resource it\nholds, public ingress included. Idempotent. Graceful within the\nprovider's own bound, then forced. Answers `closing` until the target is\ngone, then `closed`; `closed` also when the provider holds no target for\nthe owner.",
         "properties": {
           "target": {
             "$ref": "#/components/schemas/TargetRef"
@@ -144,13 +98,13 @@
         "additionalProperties": false,
         "description": "Optional controller methods. Calling an absent one is\n`capabilityUnavailable`.",
         "properties": {
-          "adoptTarget": {
-            "description": "`target/adopt` is served.",
-            "type": "boolean"
-          },
           "ingress": {
             "description": "`ingress/ensure` and `ingress/remove` are served.",
             "type": "boolean"
+          },
+          "power": {
+            "description": "`target/setPower` is served.",
+            "type": "boolean"
           }
         },
         "type": "object"
@@ -195,9 +149,6 @@
             "minimum": 0,
             "type": "integer"
           },
-          "routes": {
-            "$ref": "#/components/schemas/ControllerRoutes"
-          },
           "serverInfo": {
             "$ref": "#/components/schemas/ImplementationInfo"
           }
@@ -206,33 +157,30 @@
           "protocolVersion",
           "plane",
           "serverInfo",
-          "capabilities",
-          "routes"
+          "capabilities"
         ],
         "type": "object"
       },
-      "ControllerRoutes": {
+      "CreateTargetParams": {
         "additionalProperties": false,
-        "description": "Where Lightspeed reaches a target's data plane through this provider.",
+        "description": "`target/create` params. Idempotent per owner: when the owner already\nhas a target, the provider returns its observation and applies no\ncreation policy (template deprecation, image checks). Handing out a\ntarget from a warm pool counts as a create.",
         "properties": {
-          "data": {
-            "allOf": [
+          "displayName": {
+            "anyOf": [
               {
-                "$ref": "#/components/schemas/DataRouteBase"
+                "$ref": "#/components/schemas/DisplayName"
               }
             ],
-            "description": "Base URL of the data routes. A target's data route is this base\nfollowed by\n`/{universeId}/{bindingId}/{environmentId}/{incarnationId}/{targetId}`,\neach segment percent-encoded\n(`provider_data_route`), and is\ndialed with the same bearer credential as the controller. A\ncontroller reached over `wss` must advertise a `wss` base."
-          }
-        },
-        "required": [
-          "data"
-        ],
-        "type": "object"
-      },
-      "CreateTargetParams": {
-        "additionalProperties": false,
-        "description": "`target/create` params. Idempotent per owner: when the owner already\nhas a target, the provider returns its observation and applies no\ncreation policy (template deprecation, binding or image checks).",
-        "properties": {
+            "description": "Label for the target, where the provider shows one."
+          },
+          "idle": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/IdlePolicy"
+              }
+            ],
+            "description": "Overrides the template's `idle` for this target. A policy that does\nnot validate (`IdlePolicy::validate`) is `invalidParams`."
+          },
           "owner": {
             "$ref": "#/components/schemas/TargetOwner"
           },
@@ -246,12 +194,112 @@
         ],
         "type": "object"
       },
-      "DataRouteBase": {
-        "description": "`routes.data` of a controller's `initialize`: the absolute `ws://` or\n`wss://` base URL of the provider's data routes, validated on decode and\nnever rewritten. Lowercase scheme, a host and optional port, an optional\npath that does not end with `/`, no user information, query or\nfragment, at most 2048 bytes. A controller reached over `wss` must\nadvertise a `wss` base, so the provider credential never travels in\ncleartext; the runtime checks it with\n`DataRouteBase::check_for_controller`.",
-        "maxLength": 2048,
-        "minLength": 1,
-        "pattern": "^wss?://[^/?#@\\s]+(/[^?#\\s]*[^/?#\\s])?$",
-        "type": "string"
+      "DataRouteRefusal": {
+        "description": "Body of the HTTP refusal a data route answers instead of upgrading, with\n`Content-Type: application/json`. A provider data route uses `waking`,\n`booting`, `gone` and `failed`; the gateway's worker route adds\n`provisioning`, `disconnected` and `away` and forwards a provider's\nrefusal unchanged. Every 503 carries `Retry-After` in whole seconds,\n1 to `RETRY_AFTER_MAX_SECS`.\nThe body is an HTTP refusal, not a JSON-RPC message, and is tagged by\n`state`.",
+        "oneOf": [
+          {
+            "additionalProperties": false,
+            "description": "503: resuming from a powered-down state.",
+            "properties": {
+              "state": {
+                "const": "waking",
+                "type": "string"
+              }
+            },
+            "required": [
+              "state"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "description": "503: running, envd not answering yet.",
+            "properties": {
+              "state": {
+                "const": "booting",
+                "type": "string"
+              }
+            },
+            "required": [
+              "state"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "description": "503 (gateway): the environment is still provisioning.",
+            "properties": {
+              "state": {
+                "const": "provisioning",
+                "type": "string"
+              }
+            },
+            "required": [
+              "state"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "description": "503 (gateway): the registered daemon is not connected.",
+            "properties": {
+              "state": {
+                "const": "disconnected",
+                "type": "string"
+              }
+            },
+            "required": [
+              "state"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "description": "410 (gateway): the registered daemon has been away past its\nreconnect bound.",
+            "properties": {
+              "state": {
+                "const": "away",
+                "type": "string"
+              }
+            },
+            "required": [
+              "state"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "description": "410: the target no longer exists.",
+            "properties": {
+              "state": {
+                "const": "gone",
+                "type": "string"
+              }
+            },
+            "required": [
+              "state"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "description": "409: broken beyond the provider's recovery.",
+            "properties": {
+              "message": {
+                "$ref": "#/components/schemas/DescriptiveText"
+              },
+              "state": {
+                "const": "failed",
+                "type": "string"
+              }
+            },
+            "required": [
+              "state",
+              "message"
+            ],
+            "type": "object"
+          }
+        ]
       },
       "DescriptiveText": {
         "description": "A short human-readable text: 1 to 1024 bytes without control characters\nother than line feed and tab. Never parsed.",
@@ -305,6 +353,14 @@
           "displayName": {
             "$ref": "#/components/schemas/DisplayName"
           },
+          "idle": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/IdlePolicy"
+              }
+            ],
+            "description": "Idle policy targets get when `target/create` names none; absent when\nthe provider applies none by default."
+          },
           "metadata": {
             "allOf": [
               {
@@ -313,6 +369,13 @@
             ],
             "description": "Provider-specific display facts, such as an image fingerprint."
           },
+          "powerStates": {
+            "description": "Power states `target/setPower` can move this template's targets to.\nEmpty when the provider offers no power control beyond create and\nclose.",
+            "items": {
+              "$ref": "#/components/schemas/PowerState"
+            },
+            "type": "array"
+          },
           "publicIngress": {
             "description": "Targets of this template can serve public ingress.",
             "type": "boolean"
@@ -682,6 +745,37 @@
         ],
         "type": "object"
       },
+      "IdlePolicy": {
+        "additionalProperties": false,
+        "description": "Staged idle policy. Each set threshold is measured against envd\n`env/getIdle` `idleForMs`, and the set thresholds are non-decreasing in\nthe order pause → suspend → stop → close. Every stage is optional; a\npolicy sets at least one.",
+        "properties": {
+          "closeAfterMs": {
+            "description": "Close the target after this long idle; the provider then reports it\n`closed`.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "pauseAfterMs": {
+            "description": "Pause the target after this long idle.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "stopAfterMs": {
+            "description": "Stop the target after this long idle.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "suspendAfterMs": {
+            "description": "Suspend the target after this long idle.",
+            "format": "uint64",
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "type": "object"
+      },
       "ImplementationInfo": {
         "additionalProperties": false,
         "description": "What a peer says about its own build: `clientInfo`, `serverInfo` and a\ndaemon's registration `implementation`. Descriptive only; the protocol\nversion alone decides whether two peers can talk, and nothing here\nselects, authenticates or gates. Every field is 1 to 256 bytes without control characters,\nchecked on decode and by every constructor, so a value that would be\nrefused can never be built or sent.",
@@ -720,13 +814,6 @@
         ],
         "type": "object"
       },
-      "IncarnationId": {
-        "description": "`incarnationId` of one incarnation of an environment.",
-        "maxLength": 128,
-        "minLength": 1,
-        "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$",
-        "type": "string"
-      },
       "IngressObservation": {
         "additionalProperties": false,
         "description": "Realized public ingress of a target.",
@@ -747,14 +834,14 @@
       },
       "ListTemplatesParams": {
         "additionalProperties": false,
-        "description": "`template/list` params.",
+        "description": "`template/list` params: the universe whose targets the templates would\ncreate. A provider may offer each universe a different set.",
         "properties": {
-          "binding": {
-            "$ref": "#/components/schemas/BindingRef"
+          "universeId": {
+            "$ref": "#/components/schemas/UniverseId"
           }
         },
         "required": [
-          "binding"
+          "universeId"
         ],
         "type": "object"
       },
@@ -991,7 +1078,7 @@
           },
           {
             "const": "ownerMismatch",
-            "description": "The target belongs to another owner, or (`target/adopt`) the owner\nalready holds a different target.",
+            "description": "The target belongs to another owner.",
             "type": "string"
           },
           {
@@ -1008,11 +1095,6 @@
             "const": "targetNotActive",
             "description": "A power change on a target whose `phase` is not `active`\n(provisioning, closing, closed or failed).",
             "type": "string"
-          },
-          {
-            "const": "notAdoptable",
-            "description": "`target/adopt`: the source target exists but the provider cannot take\nit over, for example an instance of a kind it does not manage.",
-            "type": "string"
           }
         ]
       },
@@ -1040,13 +1122,6 @@
         ],
         "type": "object"
       },
-      "ProviderNativeRef": {
-        "description": "`sourceTarget` of `target/adopt`: a provider-native reference to an\nexisting target, in a format the provider defines.",
-        "maxLength": 255,
-        "minLength": 1,
-        "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
-        "type": "string"
-      },
       "ProviderTargetId": {
         "description": "`targetId`: the provider's own id for a target, opaque to Lightspeed.",
         "maxLength": 255,
@@ -1076,7 +1151,7 @@
       },
       "SetTargetPowerParams": {
         "additionalProperties": false,
-        "description": "`target/setPower` params: converge the target toward `power`. A target\nalready in, or moving toward, that state is observed without further\naction. Resuming may replace the underlying host process. A target whose\n`phase` is not `active` is `failedPrecondition` (`targetNotActive`); a\nstate outside `supportedPowerStates` is `invalidParams`.",
+        "description": "`target/setPower` params: move the target to `power`. Requires\n`capabilities.power`. A target already in, or moving toward, that state\nis observed without further action. Resuming may replace the underlying\nhost process. A state outside the template's `powerStates` is\n`invalidParams`; a target whose `phase` is not `active` is\n`failedPrecondition` (`targetNotActive`). The provider stays the owner\nof power afterwards: its own idle policy may move the target again.",
         "properties": {
           "power": {
             "allOf": [
@@ -1084,7 +1159,7 @@
                 "$ref": "#/components/schemas/PowerState"
               }
             ],
-            "description": "One of the target's `supportedPowerStates`."
+            "description": "One of the template's `powerStates`."
           },
           "target": {
             "$ref": "#/components/schemas/TargetRef"
@@ -1098,15 +1173,8 @@
       },
       "TargetObservation": {
         "additionalProperties": false,
-        "description": "What the provider observes about a target. Every target method answers\nwith one.",
+        "description": "What the provider observes about a target. Every target and ingress\nmethod answers with one; Lightspeed records it for display only.",
         "properties": {
-          "displayName": {
-            "anyOf": [
-              {
-                "$ref": "#/components/schemas/DisplayName"
-              }
-            ]
-          },
           "ingress": {
             "anyOf": [
               {
@@ -1115,13 +1183,13 @@
             ],
             "description": "Public ingress as realized; absent when disabled."
           },
-          "metadata": {
-            "allOf": [
+          "message": {
+            "anyOf": [
               {
-                "$ref": "#/components/schemas/Metadata"
+                "$ref": "#/components/schemas/DescriptiveText"
               }
             ],
-            "description": "Provider-specific display facts."
+            "description": "Why the target is `failed` or `unknown`, or what a transition waits\nfor. Providers build it with `DescriptiveText::lossy` from\nwhatever their backend reports."
           },
           "owner": {
             "allOf": [
@@ -1131,15 +1199,16 @@
             ],
             "description": "Echoed from the request."
           },
-          "state": {
-            "$ref": "#/components/schemas/TargetState"
+          "phase": {
+            "$ref": "#/components/schemas/TargetPhase"
           },
-          "supportedPowerStates": {
-            "description": "Power states `target/setPower` can move this target to. Empty when\nthe provider offers no power control beyond create and close.",
-            "items": {
-              "$ref": "#/components/schemas/PowerState"
-            },
-            "type": "array"
+          "power": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/PowerState"
+              }
+            ],
+            "description": "Present exactly when `phase` is `active`."
           },
           "targetId": {
             "anyOf": [
@@ -1152,32 +1221,24 @@
         },
         "required": [
           "owner",
-          "state"
+          "phase"
         ],
         "type": "object"
       },
       "TargetOwner": {
         "additionalProperties": false,
-        "description": "The Lightspeed incarnation a target belongs to. A provider owns at most\none target per owner.",
+        "description": "The Lightspeed environment a target belongs to. A provider owns at most\none target per owner.",
         "properties": {
-          "bindingId": {
-            "$ref": "#/components/schemas/BindingId"
-          },
           "environmentId": {
             "$ref": "#/components/schemas/EnvironmentId"
           },
-          "incarnationId": {
-            "$ref": "#/components/schemas/IncarnationId"
-          },
           "universeId": {
             "$ref": "#/components/schemas/UniverseId"
           }
         },
         "required": [
           "universeId",
-          "bindingId",
-          "environmentId",
-          "incarnationId"
+          "environmentId"
         ],
         "type": "object"
       },
@@ -1249,39 +1310,6 @@
         ],
         "type": "object"
       },
-      "TargetState": {
-        "additionalProperties": false,
-        "description": "A target's state on two axes: lifecycle `phase`, and `power` while\nactive.",
-        "properties": {
-          "daemonReady": {
-            "description": "envd answers on the target's data route (running targets only).",
-            "type": "boolean"
-          },
-          "message": {
-            "anyOf": [
-              {
-                "$ref": "#/components/schemas/DescriptiveText"
-              }
-            ],
-            "description": "Why the target is `failed` or `unknown`, or what a transition waits\nfor. Providers build it with\n`DescriptiveText::lossy` from whatever their backend reports."
-          },
-          "phase": {
-            "$ref": "#/components/schemas/TargetPhase"
-          },
-          "power": {
-            "anyOf": [
-              {
-                "$ref": "#/components/schemas/PowerState"
-              }
-            ],
-            "description": "Present exactly when `phase` is `active`."
-          }
-        },
-        "required": [
-          "phase"
-        ],
-        "type": "object"
-      },
       "TemplateId": {
         "description": "`templateId`: the provider's own id for a template.",
         "maxLength": 255,
@@ -1321,9 +1349,9 @@
     }
   },
   "info": {
-    "description": "JSON-RPC 2.0 over WebSocket text frames of at most 16777216 bytes. Exact-match protocolVersion 3. Errors carry code, message and data.kind; see x-lightspeed-error-kinds.",
+    "description": "JSON-RPC 2.0 over WebSocket text frames of at most 16777216 bytes. Exact-match protocolVersion 4. Errors carry code, message and data.kind; see x-lightspeed-error-kinds.",
     "title": "Lightspeed environment controller plane",
-    "version": "3"
+    "version": "4"
   },
   "methods": [
     {
@@ -1354,7 +1382,7 @@
           "$ref": "#/components/schemas/ControllerInitializeResponse"
         }
       },
-      "summary": "Check the protocol version and read the controller's capabilities and routes.",
+      "summary": "Check the protocol version and read the controller's capabilities.",
       "x-lightspeed-direction": "clientToServer",
       "x-lightspeed-family": "handshake",
       "x-lightspeed-kind": "request",
@@ -1366,10 +1394,10 @@
       "paramStructure": "by-name",
       "params": [
         {
-          "name": "binding",
+          "name": "universeId",
           "required": true,
           "schema": {
-            "$ref": "#/components/schemas/BindingRef"
+            "$ref": "#/components/schemas/UniverseId"
           }
         }
       ],
@@ -1379,7 +1407,7 @@
           "$ref": "#/components/schemas/ListTemplatesResponse"
         }
       },
-      "summary": "List the templates a binding may create targets from.",
+      "summary": "List the templates a universe may create targets from.",
       "x-lightspeed-direction": "clientToServer",
       "x-lightspeed-family": "template",
       "x-lightspeed-kind": "request",
@@ -1391,37 +1419,29 @@
       "paramStructure": "by-name",
       "params": [
         {
-          "name": "owner",
-          "required": true,
+          "name": "displayName",
+          "required": false,
           "schema": {
-            "$ref": "#/components/schemas/TargetOwner"
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/DisplayName"
+              }
+            ],
+            "description": "Label for the target, where the provider shows one."
           }
         },
         {
-          "name": "templateId",
-          "required": true,
+          "name": "idle",
+          "required": false,
           "schema": {
-            "$ref": "#/components/schemas/TemplateId"
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/IdlePolicy"
+              }
+            ],
+            "description": "Overrides the template's `idle` for this target. A policy that does\nnot validate (`IdlePolicy::validate`) is `invalidParams`."
           }
-        }
-      ],
-      "result": {
-        "name": "result",
-        "schema": {
-          "$ref": "#/components/schemas/TargetResponse"
-        }
-      },
-      "summary": "Create the owner's target, or observe the one it has.",
-      "x-lightspeed-direction": "clientToServer",
-      "x-lightspeed-family": "target",
-      "x-lightspeed-kind": "request",
-      "x-lightspeed-params-type": "CreateTargetParams",
-      "x-lightspeed-result-type": "TargetResponse"
-    },
-    {
-      "name": "target/adopt",
-      "paramStructure": "by-name",
-      "params": [
+        },
         {
           "name": "owner",
           "required": true,
@@ -1430,15 +1450,10 @@
           }
         },
         {
-          "name": "sourceTarget",
+          "name": "templateId",
           "required": true,
           "schema": {
-            "allOf": [
-              {
-                "$ref": "#/components/schemas/ProviderNativeRef"
-              }
-            ],
-            "description": "Provider-native reference to the existing target; the provider\ndefines its format."
+            "$ref": "#/components/schemas/TemplateId"
           }
         }
       ],
@@ -1448,12 +1463,11 @@
           "$ref": "#/components/schemas/TargetResponse"
         }
       },
-      "summary": "Take ownership of an existing provider target.",
-      "x-lightspeed-capability": "adoptTarget",
+      "summary": "Create the owner's target, or observe the one it has.",
       "x-lightspeed-direction": "clientToServer",
       "x-lightspeed-family": "target",
       "x-lightspeed-kind": "request",
-      "x-lightspeed-params-type": "AdoptTargetParams",
+      "x-lightspeed-params-type": "CreateTargetParams",
       "x-lightspeed-result-type": "TargetResponse"
     },
     {
@@ -1494,7 +1508,7 @@
                 "$ref": "#/components/schemas/PowerState"
               }
             ],
-            "description": "One of the target's `supportedPowerStates`."
+            "description": "One of the template's `powerStates`."
           }
         },
         {
@@ -1511,7 +1525,8 @@
           "$ref": "#/components/schemas/TargetResponse"
         }
       },
-      "summary": "Converge a target toward a power state.",
+      "summary": "Move a target to a power state.",
+      "x-lightspeed-capability": "power",
       "x-lightspeed-direction": "clientToServer",
       "x-lightspeed-family": "target",
       "x-lightspeed-kind": "request",
@@ -1597,6 +1612,13 @@
     }
   ],
   "openrpc": "1.3.2",
+  "x-lightspeed-data-route": {
+    "maxHoldMs": 5000,
+    "refusal": {
+      "$ref": "#/components/schemas/DataRouteRefusal"
+    },
+    "retryAfterMaxSecs": 60
+  },
   "x-lightspeed-error": {
     "$ref": "#/components/schemas/ProtocolError"
   },
@@ -1697,5 +1719,8 @@
       "retryable": false
     }
   ],
+  "x-lightspeed-idle-policy": {
+    "$ref": "#/components/schemas/IdlePolicy"
+  },
   "x-lightspeed-plane": "controller"
 }
diff --git a/crates/environment-protocol/contract/controller.schema.json b/crates/environment-protocol/contract/controller.schema.json
index 136d04fa5..bc4b3af69 100644
--- a/crates/environment-protocol/contract/controller.schema.json
+++ b/crates/environment-protocol/contract/controller.schema.json
@@ -16,52 +16,6 @@
         }
       ]
     },
-    "AdoptTargetParams": {
-      "additionalProperties": false,
-      "description": "`target/adopt` params: take ownership of an existing provider target.\nIdempotent per owner. Requires `capabilities.adoptTarget`. A source that\nbelongs to another owner, or an owner that already holds a different\ntarget, is `failedPrecondition` (`ownerMismatch`); a source the provider\ncannot take over is `failedPrecondition` (`notAdoptable`).",
-      "properties": {
-        "owner": {
-          "$ref": "#/definitions/TargetOwner"
-        },
-        "sourceTarget": {
-          "allOf": [
-            {
-              "$ref": "#/definitions/ProviderNativeRef"
-            }
-          ],
-          "description": "Provider-native reference to the existing target; the provider\ndefines its format."
-        }
-      },
-      "required": [
-        "owner",
-        "sourceTarget"
-      ],
-      "type": "object"
-    },
-    "BindingId": {
-      "description": "`bindingId` of a provider binding within a universe.",
-      "maxLength": 128,
-      "minLength": 1,
-      "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$",
-      "type": "string"
-    },
-    "BindingRef": {
-      "additionalProperties": false,
-      "description": "The provider binding a call is scoped to, for calls that concern no\nparticular target.",
-      "properties": {
-        "bindingId": {
-          "$ref": "#/definitions/BindingId"
-        },
-        "universeId": {
-          "$ref": "#/definitions/UniverseId"
-        }
-      },
-      "required": [
-        "universeId",
-        "bindingId"
-      ],
-      "type": "object"
-    },
     "BusyReason": {
       "description": "What limit a `busy` request hit.",
       "oneOf": [
@@ -116,8 +70,8 @@
           "type": "string"
         },
         {
-          "const": "adoptTarget",
-          "description": "The controller's `adoptTarget` capability.",
+          "const": "power",
+          "description": "The controller's `power` capability.",
           "type": "string"
         },
         {
@@ -129,7 +83,7 @@
     },
     "CloseTargetParams": {
       "additionalProperties": false,
-      "description": "`target/close` params: destroy the owner's target and every resource it\nholds, public ingress included. Graceful within the provider's own bound,\nthen forced. Answers `closing` until the target is gone, then `closed`;\n`closed` also when the provider holds no target for the owner.",
+      "description": "`target/close` params: destroy the owner's target and every resource it\nholds, public ingress included. Idempotent. Graceful within the\nprovider's own bound, then forced. Answers `closing` until the target is\ngone, then `closed`; `closed` also when the provider holds no target for\nthe owner.",
       "properties": {
         "target": {
           "$ref": "#/definitions/TargetRef"
@@ -144,13 +98,13 @@
       "additionalProperties": false,
       "description": "Optional controller methods. Calling an absent one is\n`capabilityUnavailable`.",
       "properties": {
-        "adoptTarget": {
-          "description": "`target/adopt` is served.",
-          "type": "boolean"
-        },
         "ingress": {
           "description": "`ingress/ensure` and `ingress/remove` are served.",
           "type": "boolean"
+        },
+        "power": {
+          "description": "`target/setPower` is served.",
+          "type": "boolean"
         }
       },
       "type": "object"
@@ -195,9 +149,6 @@
           "minimum": 0,
           "type": "integer"
         },
-        "routes": {
-          "$ref": "#/definitions/ControllerRoutes"
-        },
         "serverInfo": {
           "$ref": "#/definitions/ImplementationInfo"
         }
@@ -206,33 +157,30 @@
         "protocolVersion",
         "plane",
         "serverInfo",
-        "capabilities",
-        "routes"
+        "capabilities"
       ],
       "type": "object"
     },
-    "ControllerRoutes": {
+    "CreateTargetParams": {
       "additionalProperties": false,
-      "description": "Where Lightspeed reaches a target's data plane through this provider.",
+      "description": "`target/create` params. Idempotent per owner: when the owner already\nhas a target, the provider returns its observation and applies no\ncreation policy (template deprecation, image checks). Handing out a\ntarget from a warm pool counts as a create.",
       "properties": {
-        "data": {
-          "allOf": [
+        "displayName": {
+          "anyOf": [
             {
-              "$ref": "#/definitions/DataRouteBase"
+              "$ref": "#/definitions/DisplayName"
             }
           ],
-          "description": "Base URL of the data routes. A target's data route is this base\nfollowed by\n`/{universeId}/{bindingId}/{environmentId}/{incarnationId}/{targetId}`,\neach segment percent-encoded\n(`provider_data_route`), and is\ndialed with the same bearer credential as the controller. A\ncontroller reached over `wss` must advertise a `wss` base."
-        }
-      },
-      "required": [
-        "data"
-      ],
-      "type": "object"
-    },
-    "CreateTargetParams": {
-      "additionalProperties": false,
-      "description": "`target/create` params. Idempotent per owner: when the owner already\nhas a target, the provider returns its observation and applies no\ncreation policy (template deprecation, binding or image checks).",
-      "properties": {
+          "description": "Label for the target, where the provider shows one."
+        },
+        "idle": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/IdlePolicy"
+            }
+          ],
+          "description": "Overrides the template's `idle` for this target. A policy that does\nnot validate (`IdlePolicy::validate`) is `invalidParams`."
+        },
         "owner": {
           "$ref": "#/definitions/TargetOwner"
         },
@@ -246,12 +194,112 @@
       ],
       "type": "object"
     },
-    "DataRouteBase": {
-      "description": "`routes.data` of a controller's `initialize`: the absolute `ws://` or\n`wss://` base URL of the provider's data routes, validated on decode and\nnever rewritten. Lowercase scheme, a host and optional port, an optional\npath that does not end with `/`, no user information, query or\nfragment, at most 2048 bytes. A controller reached over `wss` must\nadvertise a `wss` base, so the provider credential never travels in\ncleartext; the runtime checks it with\n`DataRouteBase::check_for_controller`.",
-      "maxLength": 2048,
-      "minLength": 1,
-      "pattern": "^wss?://[^/?#@\\s]+(/[^?#\\s]*[^/?#\\s])?$",
-      "type": "string"
+    "DataRouteRefusal": {
+      "description": "Body of the HTTP refusal a data route answers instead of upgrading, with\n`Content-Type: application/json`. A provider data route uses `waking`,\n`booting`, `gone` and `failed`; the gateway's worker route adds\n`provisioning`, `disconnected` and `away` and forwards a provider's\nrefusal unchanged. Every 503 carries `Retry-After` in whole seconds,\n1 to `RETRY_AFTER_MAX_SECS`.\nThe body is an HTTP refusal, not a JSON-RPC message, and is tagged by\n`state`.",
+      "oneOf": [
+        {
+          "additionalProperties": false,
+          "description": "503: resuming from a powered-down state.",
+          "properties": {
+            "state": {
+              "const": "waking",
+              "type": "string"
+            }
+          },
+          "required": [
+            "state"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "description": "503: running, envd not answering yet.",
+          "properties": {
+            "state": {
+              "const": "booting",
+              "type": "string"
+            }
+          },
+          "required": [
+            "state"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "description": "503 (gateway): the environment is still provisioning.",
+          "properties": {
+            "state": {
+              "const": "provisioning",
+              "type": "string"
+            }
+          },
+          "required": [
+            "state"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "description": "503 (gateway): the registered daemon is not connected.",
+          "properties": {
+            "state": {
+              "const": "disconnected",
+              "type": "string"
+            }
+          },
+          "required": [
+            "state"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "description": "410 (gateway): the registered daemon has been away past its\nreconnect bound.",
+          "properties": {
+            "state": {
+              "const": "away",
+              "type": "string"
+            }
+          },
+          "required": [
+            "state"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "description": "410: the target no longer exists.",
+          "properties": {
+            "state": {
+              "const": "gone",
+              "type": "string"
+            }
+          },
+          "required": [
+            "state"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "description": "409: broken beyond the provider's recovery.",
+          "properties": {
+            "message": {
+              "$ref": "#/definitions/DescriptiveText"
+            },
+            "state": {
+              "const": "failed",
+              "type": "string"
+            }
+          },
+          "required": [
+            "state",
+            "message"
+          ],
+          "type": "object"
+        }
+      ]
     },
     "DescriptiveText": {
       "description": "A short human-readable text: 1 to 1024 bytes without control characters\nother than line feed and tab. Never parsed.",
@@ -305,6 +353,14 @@
         "displayName": {
           "$ref": "#/definitions/DisplayName"
         },
+        "idle": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/IdlePolicy"
+            }
+          ],
+          "description": "Idle policy targets get when `target/create` names none; absent when\nthe provider applies none by default."
+        },
         "metadata": {
           "allOf": [
             {
@@ -313,6 +369,13 @@
           ],
           "description": "Provider-specific display facts, such as an image fingerprint."
         },
+        "powerStates": {
+          "description": "Power states `target/setPower` can move this template's targets to.\nEmpty when the provider offers no power control beyond create and\nclose.",
+          "items": {
+            "$ref": "#/definitions/PowerState"
+          },
+          "type": "array"
+        },
         "publicIngress": {
           "description": "Targets of this template can serve public ingress.",
           "type": "boolean"
@@ -682,6 +745,37 @@
       ],
       "type": "object"
     },
+    "IdlePolicy": {
+      "additionalProperties": false,
+      "description": "Staged idle policy. Each set threshold is measured against envd\n`env/getIdle` `idleForMs`, and the set thresholds are non-decreasing in\nthe order pause → suspend → stop → close. Every stage is optional; a\npolicy sets at least one.",
+      "properties": {
+        "closeAfterMs": {
+          "description": "Close the target after this long idle; the provider then reports it\n`closed`.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "pauseAfterMs": {
+          "description": "Pause the target after this long idle.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "stopAfterMs": {
+          "description": "Stop the target after this long idle.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "suspendAfterMs": {
+          "description": "Suspend the target after this long idle.",
+          "format": "uint64",
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "type": "object"
+    },
     "ImplementationInfo": {
       "additionalProperties": false,
       "description": "What a peer says about its own build: `clientInfo`, `serverInfo` and a\ndaemon's registration `implementation`. Descriptive only; the protocol\nversion alone decides whether two peers can talk, and nothing here\nselects, authenticates or gates. Every field is 1 to 256 bytes without control characters,\nchecked on decode and by every constructor, so a value that would be\nrefused can never be built or sent.",
@@ -720,13 +814,6 @@
       ],
       "type": "object"
     },
-    "IncarnationId": {
-      "description": "`incarnationId` of one incarnation of an environment.",
-      "maxLength": 128,
-      "minLength": 1,
-      "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$",
-      "type": "string"
-    },
     "IngressObservation": {
       "additionalProperties": false,
       "description": "Realized public ingress of a target.",
@@ -747,14 +834,14 @@
     },
     "ListTemplatesParams": {
       "additionalProperties": false,
-      "description": "`template/list` params.",
+      "description": "`template/list` params: the universe whose targets the templates would\ncreate. A provider may offer each universe a different set.",
       "properties": {
-        "binding": {
-          "$ref": "#/definitions/BindingRef"
+        "universeId": {
+          "$ref": "#/definitions/UniverseId"
         }
       },
       "required": [
-        "binding"
+        "universeId"
       ],
       "type": "object"
     },
@@ -991,7 +1078,7 @@
         },
         {
           "const": "ownerMismatch",
-          "description": "The target belongs to another owner, or (`target/adopt`) the owner\nalready holds a different target.",
+          "description": "The target belongs to another owner.",
           "type": "string"
         },
         {
@@ -1008,11 +1095,6 @@
           "const": "targetNotActive",
           "description": "A power change on a target whose `phase` is not `active`\n(provisioning, closing, closed or failed).",
           "type": "string"
-        },
-        {
-          "const": "notAdoptable",
-          "description": "`target/adopt`: the source target exists but the provider cannot take\nit over, for example an instance of a kind it does not manage.",
-          "type": "string"
         }
       ]
     },
@@ -1040,13 +1122,6 @@
       ],
       "type": "object"
     },
-    "ProviderNativeRef": {
-      "description": "`sourceTarget` of `target/adopt`: a provider-native reference to an\nexisting target, in a format the provider defines.",
-      "maxLength": 255,
-      "minLength": 1,
-      "pattern": "^[^\\u0000-\\u001F\\u007F-\\u009F]+$",
-      "type": "string"
-    },
     "ProviderTargetId": {
       "description": "`targetId`: the provider's own id for a target, opaque to Lightspeed.",
       "maxLength": 255,
@@ -1076,7 +1151,7 @@
     },
     "SetTargetPowerParams": {
       "additionalProperties": false,
-      "description": "`target/setPower` params: converge the target toward `power`. A target\nalready in, or moving toward, that state is observed without further\naction. Resuming may replace the underlying host process. A target whose\n`phase` is not `active` is `failedPrecondition` (`targetNotActive`); a\nstate outside `supportedPowerStates` is `invalidParams`.",
+      "description": "`target/setPower` params: move the target to `power`. Requires\n`capabilities.power`. A target already in, or moving toward, that state\nis observed without further action. Resuming may replace the underlying\nhost process. A state outside the template's `powerStates` is\n`invalidParams`; a target whose `phase` is not `active` is\n`failedPrecondition` (`targetNotActive`). The provider stays the owner\nof power afterwards: its own idle policy may move the target again.",
       "properties": {
         "power": {
           "allOf": [
@@ -1084,7 +1159,7 @@
               "$ref": "#/definitions/PowerState"
             }
           ],
-          "description": "One of the target's `supportedPowerStates`."
+          "description": "One of the template's `powerStates`."
         },
         "target": {
           "$ref": "#/definitions/TargetRef"
@@ -1098,15 +1173,8 @@
     },
     "TargetObservation": {
       "additionalProperties": false,
-      "description": "What the provider observes about a target. Every target method answers\nwith one.",
+      "description": "What the provider observes about a target. Every target and ingress\nmethod answers with one; Lightspeed records it for display only.",
       "properties": {
-        "displayName": {
-          "anyOf": [
-            {
-              "$ref": "#/definitions/DisplayName"
-            }
-          ]
-        },
         "ingress": {
           "anyOf": [
             {
@@ -1115,13 +1183,13 @@
           ],
           "description": "Public ingress as realized; absent when disabled."
         },
-        "metadata": {
-          "allOf": [
+        "message": {
+          "anyOf": [
             {
-              "$ref": "#/definitions/Metadata"
+              "$ref": "#/definitions/DescriptiveText"
             }
           ],
-          "description": "Provider-specific display facts."
+          "description": "Why the target is `failed` or `unknown`, or what a transition waits\nfor. Providers build it with `DescriptiveText::lossy` from\nwhatever their backend reports."
         },
         "owner": {
           "allOf": [
@@ -1131,15 +1199,16 @@
           ],
           "description": "Echoed from the request."
         },
-        "state": {
-          "$ref": "#/definitions/TargetState"
+        "phase": {
+          "$ref": "#/definitions/TargetPhase"
         },
-        "supportedPowerStates": {
-          "description": "Power states `target/setPower` can move this target to. Empty when\nthe provider offers no power control beyond create and close.",
-          "items": {
-            "$ref": "#/definitions/PowerState"
-          },
-          "type": "array"
+        "power": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/PowerState"
+            }
+          ],
+          "description": "Present exactly when `phase` is `active`."
         },
         "targetId": {
           "anyOf": [
@@ -1152,32 +1221,24 @@
       },
       "required": [
         "owner",
-        "state"
+        "phase"
       ],
       "type": "object"
     },
     "TargetOwner": {
       "additionalProperties": false,
-      "description": "The Lightspeed incarnation a target belongs to. A provider owns at most\none target per owner.",
+      "description": "The Lightspeed environment a target belongs to. A provider owns at most\none target per owner.",
       "properties": {
-        "bindingId": {
-          "$ref": "#/definitions/BindingId"
-        },
         "environmentId": {
           "$ref": "#/definitions/EnvironmentId"
         },
-        "incarnationId": {
-          "$ref": "#/definitions/IncarnationId"
-        },
         "universeId": {
           "$ref": "#/definitions/UniverseId"
         }
       },
       "required": [
         "universeId",
-        "bindingId",
-        "environmentId",
-        "incarnationId"
+        "environmentId"
       ],
       "type": "object"
     },
@@ -1249,39 +1310,6 @@
       ],
       "type": "object"
     },
-    "TargetState": {
-      "additionalProperties": false,
-      "description": "A target's state on two axes: lifecycle `phase`, and `power` while\nactive.",
-      "properties": {
-        "daemonReady": {
-          "description": "envd answers on the target's data route (running targets only).",
-          "type": "boolean"
-        },
-        "message": {
-          "anyOf": [
-            {
-              "$ref": "#/definitions/DescriptiveText"
-            }
-          ],
-          "description": "Why the target is `failed` or `unknown`, or what a transition waits\nfor. Providers build it with\n`DescriptiveText::lossy` from whatever their backend reports."
-        },
-        "phase": {
-          "$ref": "#/definitions/TargetPhase"
-        },
-        "power": {
-          "anyOf": [
-            {
-              "$ref": "#/definitions/PowerState"
-            }
-          ],
-          "description": "Present exactly when `phase` is `active`."
-        }
-      },
-      "required": [
-        "phase"
-      ],
-      "type": "object"
-    },
     "TemplateId": {
       "description": "`templateId`: the provider's own id for a template.",
       "maxLength": 255,
@@ -1319,6 +1347,16 @@
       "type": "string"
     }
   },
-  "description": "Every wire type of the controller plane, protocol version 3.",
-  "title": "Lightspeed environment controller plane"
+  "description": "Every wire type of the controller plane, protocol version 4.",
+  "title": "Lightspeed environment controller plane",
+  "x-lightspeed-data-route": {
+    "maxHoldMs": 5000,
+    "refusal": {
+      "$ref": "#/definitions/DataRouteRefusal"
+    },
+    "retryAfterMaxSecs": 60
+  },
+  "x-lightspeed-idle-policy": {
+    "$ref": "#/definitions/IdlePolicy"
+  }
 }
diff --git a/crates/environment-protocol/contract/data.openrpc.json b/crates/environment-protocol/contract/data.openrpc.json
index 8612aa09f..d92332897 100644
--- a/crates/environment-protocol/contract/data.openrpc.json
+++ b/crates/environment-protocol/contract/data.openrpc.json
@@ -199,8 +199,8 @@
             "type": "string"
           },
           {
-            "const": "adoptTarget",
-            "description": "The controller's `adoptTarget` capability.",
+            "const": "power",
+            "description": "The controller's `power` capability.",
             "type": "string"
           },
           {
@@ -1007,13 +1007,13 @@
         "description": "`env/getIdle` response.",
         "properties": {
           "idleForMs": {
-            "description": "Milliseconds since the last `use` request, or since running work\nlast ended, whichever is later. Zero while any process or job runs.",
+            "description": "Milliseconds since the last `use` request, or since running work\nlast ended, whichever is later. Zero while any process or job runs\nor any leftover process group has live members; the clock restarts\nwhen the last of them ends.",
             "format": "uint64",
             "minimum": 0,
             "type": "integer"
           },
           "leftoverProcessGroupCount": {
-            "description": "Process groups of exited processes that still have members alive:\nservices a command started and left running. They are not running\nwork and do not hold `idleForMs` at zero.",
+            "description": "Process groups of exited processes that still have members alive:\nservices a command started and left running. They hold `idleForMs`\nat zero like running work.",
             "format": "uint32",
             "minimum": 0,
             "type": "integer"
@@ -2212,7 +2212,7 @@
           },
           {
             "const": "ownerMismatch",
-            "description": "The target belongs to another owner, or (`target/adopt`) the owner\nalready holds a different target.",
+            "description": "The target belongs to another owner.",
             "type": "string"
           },
           {
@@ -2229,11 +2229,6 @@
             "const": "targetNotActive",
             "description": "A power change on a target whose `phase` is not `active`\n(provisioning, closing, closed or failed).",
             "type": "string"
-          },
-          {
-            "const": "notAdoptable",
-            "description": "`target/adopt`: the source target exists but the provider cannot take\nit over, for example an instance of a kind it does not manage.",
-            "type": "string"
           }
         ]
       },
@@ -4282,9 +4277,9 @@
     }
   },
   "info": {
-    "description": "JSON-RPC 2.0 over WebSocket text frames of at most 16777216 bytes. Exact-match protocolVersion 3. Errors carry code, message and data.kind; see x-lightspeed-error-kinds.",
+    "description": "JSON-RPC 2.0 over WebSocket text frames of at most 16777216 bytes. Exact-match protocolVersion 4. Errors carry code, message and data.kind; see x-lightspeed-error-kinds.",
     "title": "Lightspeed environment data plane",
-    "version": "3"
+    "version": "4"
   },
   "methods": [
     {
diff --git a/crates/environment-protocol/contract/data.schema.json b/crates/environment-protocol/contract/data.schema.json
index 40e77831e..e6475ab20 100644
--- a/crates/environment-protocol/contract/data.schema.json
+++ b/crates/environment-protocol/contract/data.schema.json
@@ -199,8 +199,8 @@
           "type": "string"
         },
         {
-          "const": "adoptTarget",
-          "description": "The controller's `adoptTarget` capability.",
+          "const": "power",
+          "description": "The controller's `power` capability.",
           "type": "string"
         },
         {
@@ -1007,13 +1007,13 @@
       "description": "`env/getIdle` response.",
       "properties": {
         "idleForMs": {
-          "description": "Milliseconds since the last `use` request, or since running work\nlast ended, whichever is later. Zero while any process or job runs.",
+          "description": "Milliseconds since the last `use` request, or since running work\nlast ended, whichever is later. Zero while any process or job runs\nor any leftover process group has live members; the clock restarts\nwhen the last of them ends.",
           "format": "uint64",
           "minimum": 0,
           "type": "integer"
         },
         "leftoverProcessGroupCount": {
-          "description": "Process groups of exited processes that still have members alive:\nservices a command started and left running. They are not running\nwork and do not hold `idleForMs` at zero.",
+          "description": "Process groups of exited processes that still have members alive:\nservices a command started and left running. They hold `idleForMs`\nat zero like running work.",
           "format": "uint32",
           "minimum": 0,
           "type": "integer"
@@ -2212,7 +2212,7 @@
         },
         {
           "const": "ownerMismatch",
-          "description": "The target belongs to another owner, or (`target/adopt`) the owner\nalready holds a different target.",
+          "description": "The target belongs to another owner.",
           "type": "string"
         },
         {
@@ -2229,11 +2229,6 @@
           "const": "targetNotActive",
           "description": "A power change on a target whose `phase` is not `active`\n(provisioning, closing, closed or failed).",
           "type": "string"
-        },
-        {
-          "const": "notAdoptable",
-          "description": "`target/adopt`: the source target exists but the provider cannot take\nit over, for example an instance of a kind it does not manage.",
-          "type": "string"
         }
       ]
     },
@@ -4280,6 +4275,6 @@
       "type": "object"
     }
   },
-  "description": "Every wire type of the data plane, protocol version 3.",
+  "description": "Every wire type of the data plane, protocol version 4.",
   "title": "Lightspeed environment data plane"
 }
diff --git a/crates/environment-protocol/contract/registration.openrpc.json b/crates/environment-protocol/contract/registration.openrpc.json
index e5299c57b..b5f1f91d6 100644
--- a/crates/environment-protocol/contract/registration.openrpc.json
+++ b/crates/environment-protocol/contract/registration.openrpc.json
@@ -123,8 +123,8 @@
             "type": "string"
           },
           {
-            "const": "adoptTarget",
-            "description": "The controller's `adoptTarget` capability.",
+            "const": "power",
+            "description": "The controller's `power` capability.",
             "type": "string"
           },
           {
@@ -160,7 +160,7 @@
       },
       "ClosedParams": {
         "additionalProperties": false,
-        "description": "`registration/closed` params: the gateway ends the session for good and\ncloses the socket after this frame. The daemon exits and does not\nreconnect.",
+        "description": "`registration/closed` params: the gateway ends the session for good and\ncloses the socket after this frame. The daemon exits or parks, as\nconfigured, and does not reconnect.",
         "properties": {
           "message": {
             "anyOf": [
@@ -700,13 +700,6 @@
         ],
         "type": "object"
       },
-      "IncarnationId": {
-        "description": "`incarnationId` of one incarnation of an environment.",
-        "maxLength": 128,
-        "minLength": 1,
-        "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$",
-        "type": "string"
-      },
       "Metadata": {
         "additionalProperties": {
           "maxLength": 256,
@@ -908,7 +901,7 @@
           },
           {
             "const": "ownerMismatch",
-            "description": "The target belongs to another owner, or (`target/adopt`) the owner\nalready holds a different target.",
+            "description": "The target belongs to another owner.",
             "type": "string"
           },
           {
@@ -925,11 +918,6 @@
             "const": "targetNotActive",
             "description": "A power change on a target whose `phase` is not `active`\n(provisioning, closing, closed or failed).",
             "type": "string"
-          },
-          {
-            "const": "notAdoptable",
-            "description": "`target/adopt`: the source target exists but the provider cannot take\nit over, for example an instance of a kind it does not manage.",
-            "type": "string"
           }
         ]
       },
@@ -1065,14 +1053,10 @@
           },
           "identityMode": {
             "$ref": "#/components/schemas/RegistrationIdentityMode"
-          },
-          "incarnationId": {
-            "$ref": "#/components/schemas/IncarnationId"
           }
         },
         "required": [
           "environmentId",
-          "incarnationId",
           "daemonId",
           "controlConnectionId",
           "identityMode",
@@ -1106,9 +1090,9 @@
     }
   },
   "info": {
-    "description": "JSON-RPC 2.0 over WebSocket text frames of at most 16777216 bytes. Exact-match protocolVersion 3. Errors carry code, message and data.kind; see x-lightspeed-error-kinds.",
+    "description": "JSON-RPC 2.0 over WebSocket text frames of at most 16777216 bytes. Exact-match protocolVersion 4. Errors carry code, message and data.kind; see x-lightspeed-error-kinds.",
     "title": "Lightspeed environment registration channel",
-    "version": "3"
+    "version": "4"
   },
   "methods": [
     {
diff --git a/crates/environment-protocol/contract/registration.schema.json b/crates/environment-protocol/contract/registration.schema.json
index 2749b1691..826980f46 100644
--- a/crates/environment-protocol/contract/registration.schema.json
+++ b/crates/environment-protocol/contract/registration.schema.json
@@ -123,8 +123,8 @@
           "type": "string"
         },
         {
-          "const": "adoptTarget",
-          "description": "The controller's `adoptTarget` capability.",
+          "const": "power",
+          "description": "The controller's `power` capability.",
           "type": "string"
         },
         {
@@ -160,7 +160,7 @@
     },
     "ClosedParams": {
       "additionalProperties": false,
-      "description": "`registration/closed` params: the gateway ends the session for good and\ncloses the socket after this frame. The daemon exits and does not\nreconnect.",
+      "description": "`registration/closed` params: the gateway ends the session for good and\ncloses the socket after this frame. The daemon exits or parks, as\nconfigured, and does not reconnect.",
       "properties": {
         "message": {
           "anyOf": [
@@ -700,13 +700,6 @@
       ],
       "type": "object"
     },
-    "IncarnationId": {
-      "description": "`incarnationId` of one incarnation of an environment.",
-      "maxLength": 128,
-      "minLength": 1,
-      "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$",
-      "type": "string"
-    },
     "Metadata": {
       "additionalProperties": {
         "maxLength": 256,
@@ -908,7 +901,7 @@
         },
         {
           "const": "ownerMismatch",
-          "description": "The target belongs to another owner, or (`target/adopt`) the owner\nalready holds a different target.",
+          "description": "The target belongs to another owner.",
           "type": "string"
         },
         {
@@ -925,11 +918,6 @@
           "const": "targetNotActive",
           "description": "A power change on a target whose `phase` is not `active`\n(provisioning, closing, closed or failed).",
           "type": "string"
-        },
-        {
-          "const": "notAdoptable",
-          "description": "`target/adopt`: the source target exists but the provider cannot take\nit over, for example an instance of a kind it does not manage.",
-          "type": "string"
         }
       ]
     },
@@ -1065,14 +1053,10 @@
         },
         "identityMode": {
           "$ref": "#/definitions/RegistrationIdentityMode"
-        },
-        "incarnationId": {
-          "$ref": "#/definitions/IncarnationId"
         }
       },
       "required": [
         "environmentId",
-        "incarnationId",
         "daemonId",
         "controlConnectionId",
         "identityMode",
@@ -1104,7 +1088,7 @@
       ]
     }
   },
-  "description": "Every wire type of the registration plane, protocol version 3.",
+  "description": "Every wire type of the registration plane, protocol version 4.",
   "title": "Lightspeed environment registration channel",
   "x-lightspeed-bootstrap": {
     "buildFacts": {
diff --git a/crates/environment-protocol/fixtures/bootstrap/build-facts.json b/crates/environment-protocol/fixtures/bootstrap/build-facts.json
index e4dd66a6b..33e5ecbcb 100644
--- a/crates/environment-protocol/fixtures/bootstrap/build-facts.json
+++ b/crates/environment-protocol/fixtures/bootstrap/build-facts.json
@@ -3,5 +3,5 @@
   "version": "0.5.0",
   "gitSha": "86f6adf3",
   "target": "x86_64-unknown-linux-musl",
-  "protocolVersion": 3
+  "protocolVersion": 4
 }
diff --git a/crates/environment-protocol/fixtures/bootstrap/discovery-document.json b/crates/environment-protocol/fixtures/bootstrap/discovery-document.json
index b02b13851..5113877fb 100644
--- a/crates/environment-protocol/fixtures/bootstrap/discovery-document.json
+++ b/crates/environment-protocol/fixtures/bootstrap/discovery-document.json
@@ -2,7 +2,7 @@
   "version": "0.5.0",
   "gitSha": "86f6adf3",
   "channel": "stable",
-  "protocolVersion": 3,
+  "protocolVersion": 4,
   "builtAtMs": 1761400000000,
   "artifacts": {
     "x86_64-unknown-linux-musl": {
diff --git a/crates/environment-protocol/fixtures/controller/ingress.ensure.json b/crates/environment-protocol/fixtures/controller/ingress.ensure.json
index a594e5383..524079bee 100644
--- a/crates/environment-protocol/fixtures/controller/ingress.ensure.json
+++ b/crates/environment-protocol/fixtures/controller/ingress.ensure.json
@@ -3,9 +3,7 @@
     "target": {
       "owner": {
         "universeId": "u1",
-        "bindingId": "primary",
-        "environmentId": "env_1",
-        "incarnationId": "inc_1"
+        "environmentId": "env_1"
       },
       "targetId": "ls-3f2a"
     }
@@ -15,24 +13,10 @@
       "targetId": "ls-3f2a",
       "owner": {
         "universeId": "u1",
-        "bindingId": "primary",
-        "environmentId": "env_1",
-        "incarnationId": "inc_1"
-      },
-      "displayName": "env_1",
-      "state": {
-        "phase": "active",
-        "power": "running",
-        "daemonReady": true
-      },
-      "supportedPowerStates": [
-        "running",
-        "paused",
-        "stopped"
-      ],
-      "metadata": {
-        "incusMember": "node-1"
+        "environmentId": "env_1"
       },
+      "phase": "active",
+      "power": "running",
       "ingress": {
         "endpoint": "https://env-1.apps.example.com"
       }
diff --git a/crates/environment-protocol/fixtures/controller/ingress.remove.json b/crates/environment-protocol/fixtures/controller/ingress.remove.json
index f5ab1d2d7..5486656a9 100644
--- a/crates/environment-protocol/fixtures/controller/ingress.remove.json
+++ b/crates/environment-protocol/fixtures/controller/ingress.remove.json
@@ -3,9 +3,7 @@
     "target": {
       "owner": {
         "universeId": "u1",
-        "bindingId": "primary",
-        "environmentId": "env_1",
-        "incarnationId": "inc_1"
+        "environmentId": "env_1"
       },
       "targetId": "ls-3f2a"
     }
@@ -15,24 +13,10 @@
       "targetId": "ls-3f2a",
       "owner": {
         "universeId": "u1",
-        "bindingId": "primary",
-        "environmentId": "env_1",
-        "incarnationId": "inc_1"
+        "environmentId": "env_1"
       },
-      "displayName": "env_1",
-      "state": {
-        "phase": "active",
-        "power": "running",
-        "daemonReady": true
-      },
-      "supportedPowerStates": [
-        "running",
-        "paused",
-        "stopped"
-      ],
-      "metadata": {
-        "incusMember": "node-1"
-      }
+      "phase": "active",
+      "power": "running"
     }
   },
   "error": {
diff --git a/crates/environment-protocol/fixtures/controller/initialize.json b/crates/environment-protocol/fixtures/controller/initialize.json
index a449dd0cf..6492d8b24 100644
--- a/crates/environment-protocol/fixtures/controller/initialize.json
+++ b/crates/environment-protocol/fixtures/controller/initialize.json
@@ -1,33 +1,30 @@
 {
   "params": {
-    "protocolVersion": 3,
+    "protocolVersion": 4,
     "clientInfo": {
       "name": "lightspeed-runtime",
       "version": "0.5.0"
     }
   },
   "response": {
-    "protocolVersion": 3,
+    "protocolVersion": 4,
     "plane": "controller",
     "serverInfo": {
       "name": "lightspeed-provider-incus",
       "version": "0.5.0"
     },
     "capabilities": {
-      "adoptTarget": true,
+      "power": true,
       "ingress": true
-    },
-    "routes": {
-      "data": "wss://incus.example.com:19090/routes"
     }
   },
   "error": {
     "code": -32005,
-    "message": "protocol version 4 is not supported; this peer speaks 3",
+    "message": "protocol version 5 is not supported; this peer speaks 4",
     "data": {
       "kind": "versionMismatch",
-      "expected": 3,
-      "received": 4
+      "expected": 4,
+      "received": 5
     }
   }
 }
diff --git a/crates/environment-protocol/fixtures/controller/target.adopt.json b/crates/environment-protocol/fixtures/controller/target.adopt.json
deleted file mode 100644
index a8dc7100a..000000000
--- a/crates/environment-protocol/fixtures/controller/target.adopt.json
+++ /dev/null
@@ -1,44 +0,0 @@
-{
-  "params": {
-    "owner": {
-      "universeId": "u1",
-      "bindingId": "primary",
-      "environmentId": "env_1",
-      "incarnationId": "inc_1"
-    },
-    "sourceTarget": "default/legacy-vm"
-  },
-  "response": {
-    "target": {
-      "targetId": "ls-3f2a",
-      "owner": {
-        "universeId": "u1",
-        "bindingId": "primary",
-        "environmentId": "env_1",
-        "incarnationId": "inc_1"
-      },
-      "displayName": "env_1",
-      "state": {
-        "phase": "active",
-        "power": "running",
-        "daemonReady": true
-      },
-      "supportedPowerStates": [
-        "running",
-        "paused",
-        "stopped"
-      ],
-      "metadata": {
-        "incusMember": "node-1"
-      }
-    }
-  },
-  "error": {
-    "code": -32006,
-    "message": "this provider does not adopt targets",
-    "data": {
-      "kind": "capabilityUnavailable",
-      "capability": "adoptTarget"
-    }
-  }
-}
diff --git a/crates/environment-protocol/fixtures/controller/target.close.json b/crates/environment-protocol/fixtures/controller/target.close.json
index 06dd35918..66c8695a0 100644
--- a/crates/environment-protocol/fixtures/controller/target.close.json
+++ b/crates/environment-protocol/fixtures/controller/target.close.json
@@ -3,9 +3,7 @@
     "target": {
       "owner": {
         "universeId": "u1",
-        "bindingId": "primary",
-        "environmentId": "env_1",
-        "incarnationId": "inc_1"
+        "environmentId": "env_1"
       }
     }
   },
@@ -13,13 +11,9 @@
     "target": {
       "owner": {
         "universeId": "u1",
-        "bindingId": "primary",
-        "environmentId": "env_1",
-        "incarnationId": "inc_1"
+        "environmentId": "env_1"
       },
-      "state": {
-        "phase": "closed"
-      }
+      "phase": "closed"
     }
   },
   "error": {
diff --git a/crates/environment-protocol/fixtures/controller/target.create.json b/crates/environment-protocol/fixtures/controller/target.create.json
index 48700553e..6ea8b5539 100644
--- a/crates/environment-protocol/fixtures/controller/target.create.json
+++ b/crates/environment-protocol/fixtures/controller/target.create.json
@@ -2,25 +2,24 @@
   "params": {
     "owner": {
       "universeId": "u1",
-      "bindingId": "primary",
-      "environmentId": "env_1",
-      "incarnationId": "inc_1"
+      "environmentId": "env_1"
     },
-    "templateId": "ubuntu-24.04-small"
+    "templateId": "ubuntu-24.04-small",
+    "displayName": "build box",
+    "idle": {
+      "pauseAfterMs": 600000,
+      "stopAfterMs": 3600000
+    }
   },
   "response": {
     "target": {
       "targetId": "ls-3f2a",
       "owner": {
         "universeId": "u1",
-        "bindingId": "primary",
-        "environmentId": "env_1",
-        "incarnationId": "inc_1"
+        "environmentId": "env_1"
       },
-      "state": {
-        "phase": "provisioning",
-        "message": "pulling image"
-      }
+      "phase": "provisioning",
+      "message": "pulling image"
     }
   },
   "error": {
diff --git a/crates/environment-protocol/fixtures/controller/target.get.json b/crates/environment-protocol/fixtures/controller/target.get.json
index edf6ab717..19ed2292b 100644
--- a/crates/environment-protocol/fixtures/controller/target.get.json
+++ b/crates/environment-protocol/fixtures/controller/target.get.json
@@ -3,9 +3,7 @@
     "target": {
       "owner": {
         "universeId": "u1",
-        "bindingId": "primary",
-        "environmentId": "env_1",
-        "incarnationId": "inc_1"
+        "environmentId": "env_1"
       },
       "targetId": "ls-3f2a"
     }
@@ -15,24 +13,10 @@
       "targetId": "ls-3f2a",
       "owner": {
         "universeId": "u1",
-        "bindingId": "primary",
-        "environmentId": "env_1",
-        "incarnationId": "inc_1"
-      },
-      "displayName": "env_1",
-      "state": {
-        "phase": "active",
-        "power": "running",
-        "daemonReady": true
-      },
-      "supportedPowerStates": [
-        "running",
-        "paused",
-        "stopped"
-      ],
-      "metadata": {
-        "incusMember": "node-1"
+        "environmentId": "env_1"
       },
+      "phase": "active",
+      "power": "running",
       "ingress": {
         "endpoint": "https://env-1.apps.example.com"
       }
diff --git a/crates/environment-protocol/fixtures/controller/target.setPower.json b/crates/environment-protocol/fixtures/controller/target.setPower.json
index 9f9da2c9b..1601082b7 100644
--- a/crates/environment-protocol/fixtures/controller/target.setPower.json
+++ b/crates/environment-protocol/fixtures/controller/target.setPower.json
@@ -3,9 +3,7 @@
     "target": {
       "owner": {
         "universeId": "u1",
-        "bindingId": "primary",
-        "environmentId": "env_1",
-        "incarnationId": "inc_1"
+        "environmentId": "env_1"
       },
       "targetId": "ls-3f2a"
     },
@@ -16,28 +14,15 @@
       "targetId": "ls-3f2a",
       "owner": {
         "universeId": "u1",
-        "bindingId": "primary",
-        "environmentId": "env_1",
-        "incarnationId": "inc_1"
+        "environmentId": "env_1"
       },
-      "displayName": "env_1",
-      "state": {
-        "phase": "active",
-        "power": "paused"
-      },
-      "supportedPowerStates": [
-        "running",
-        "paused",
-        "stopped"
-      ],
-      "metadata": {
-        "incusMember": "node-1"
-      }
+      "phase": "active",
+      "power": "paused"
     }
   },
   "error": {
     "code": -32007,
-    "message": "target ls-3f2a belongs to another incarnation",
+    "message": "target ls-3f2a belongs to another environment",
     "data": {
       "kind": "failedPrecondition",
       "reason": "ownerMismatch"
diff --git a/crates/environment-protocol/fixtures/controller/template.list.json b/crates/environment-protocol/fixtures/controller/template.list.json
index e0126e578..69d4f497c 100644
--- a/crates/environment-protocol/fixtures/controller/template.list.json
+++ b/crates/environment-protocol/fixtures/controller/template.list.json
@@ -1,9 +1,6 @@
 {
   "params": {
-    "binding": {
-      "universeId": "u1",
-      "bindingId": "primary"
-    }
+    "universeId": "u1"
   },
   "response": {
     "templates": [
@@ -11,7 +8,16 @@
         "templateId": "ubuntu-24.04-small",
         "displayName": "Ubuntu 24.04 (small)",
         "description": "2 vCPU, 4 GiB",
+        "powerStates": [
+          "running",
+          "paused",
+          "stopped"
+        ],
         "publicIngress": true,
+        "idle": {
+          "pauseAfterMs": 900000,
+          "stopAfterMs": 7200000
+        },
         "deprecated": true,
         "resources": {
           "vcpus": 2,
diff --git a/crates/environment-protocol/fixtures/data/initialize.json b/crates/environment-protocol/fixtures/data/initialize.json
index 2c98620d0..e9bdeddce 100644
--- a/crates/environment-protocol/fixtures/data/initialize.json
+++ b/crates/environment-protocol/fixtures/data/initialize.json
@@ -1,13 +1,13 @@
 {
   "params": {
-    "protocolVersion": 3,
+    "protocolVersion": 4,
     "clientInfo": {
       "name": "lightspeed-runtime",
       "version": "0.5.0"
     }
   },
   "response": {
-    "protocolVersion": 3,
+    "protocolVersion": 4,
     "plane": "data",
     "daemonInstanceId": "envd_01jb8x7k2m",
     "serverInfo": {
@@ -87,11 +87,11 @@
   },
   "error": {
     "code": -32005,
-    "message": "protocol version 2 is not supported; this peer speaks 3",
+    "message": "protocol version 3 is not supported; this peer speaks 4",
     "data": {
       "kind": "versionMismatch",
-      "expected": 3,
-      "received": 2
+      "expected": 4,
+      "received": 3
     }
   }
 }
diff --git a/crates/environment-protocol/fixtures/registration/registration.challenge.json b/crates/environment-protocol/fixtures/registration/registration.challenge.json
index 055bcd29d..0716d92bb 100644
--- a/crates/environment-protocol/fixtures/registration/registration.challenge.json
+++ b/crates/environment-protocol/fixtures/registration/registration.challenge.json
@@ -1,6 +1,6 @@
 {
   "params": {
-    "protocolVersion": 3,
+    "protocolVersion": 4,
     "nonce": "0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f"
   }
 }
diff --git a/crates/environment-protocol/fixtures/registration/registration.register.json b/crates/environment-protocol/fixtures/registration/registration.register.json
index aeaaa0f3b..84f2e1294 100644
--- a/crates/environment-protocol/fixtures/registration/registration.register.json
+++ b/crates/environment-protocol/fixtures/registration/registration.register.json
@@ -1,6 +1,6 @@
 {
   "params": {
-    "protocolVersion": 3,
+    "protocolVersion": 4,
     "registrationKey": "lsrk_0123456789abcdef",
     "daemonPublicKey": "3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b",
     "signature": "9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c9c",
@@ -18,7 +18,6 @@
   "response": {
     "receipt": {
       "environmentId": "env_1",
-      "incarnationId": "inc_1",
       "daemonId": "daemon_3b3b",
       "controlConnectionId": "connection_7",
       "identityMode": "ephemeral",
diff --git a/crates/environment-protocol/src/contract.rs b/crates/environment-protocol/src/contract.rs
index 191b1ea6a..0c6e269be 100644
--- a/crates/environment-protocol/src/contract.rs
+++ b/crates/environment-protocol/src/contract.rs
@@ -6,6 +6,10 @@
 //!   by-name params, the manifest facts as `x-lightspeed-*` members, and the
 //!   error kinds.
 //!
+//! The controller plane also names two types no method carries as a whole:
+//! `x-lightspeed-data-route` (the data route refusal body and its bounds)
+//! and `x-lightspeed-idle-policy` (the policy providers run).
+//!
 //! The committed copies under `crates/environment-protocol/contract/` are
 //! checked by the `contract` integration test; regenerate them with
 //! `cargo run -p environment-protocol --features schema --bin export-contract`.
@@ -20,8 +24,10 @@ use crate::{
     bootstrap::{BuildFacts, DiscoveryDocument},
     error::{ProtocolError, ProtocolErrorKind},
     handshake::Plane,
-    limits::MAX_MESSAGE_BYTES,
+    idle::IdlePolicy,
+    limits::{MAX_DATA_ROUTE_HOLD_MS, MAX_MESSAGE_BYTES, RETRY_AFTER_MAX_SECS},
     manifest::{MessageKind, plane_methods},
+    routes::DataRouteRefusal,
 };
 
 /// The exported documents of one plane.
@@ -57,6 +63,16 @@ fn export_plane(plane: Plane) -> PlaneContract {
             "buildFacts": to_value(generator.subschema_for::<BuildFacts>()),
         })
     });
+    let controller_types = (plane == Plane::Controller).then(|| {
+        (
+            json!({
+                "refusal": to_value(generator.subschema_for::<DataRouteRefusal>()),
+                "maxHoldMs": MAX_DATA_ROUTE_HOLD_MS,
+                "retryAfterMaxSecs": RETRY_AFTER_MAX_SECS,
+            }),
+            to_value(generator.subschema_for::<IdlePolicy>()),
+        )
+    });
     let mut entries = Vec::new();
     for spec in plane_methods(plane) {
         let schemas = (spec.schemas)(&mut generator);
@@ -137,6 +153,10 @@ fn export_plane(plane: Plane) -> PlaneContract {
     if let Some(bootstrap) = &bootstrap {
         schema_bundle["x-lightspeed-bootstrap"] = bootstrap.clone();
     }
+    if let Some((data_route, idle_policy)) = &controller_types {
+        schema_bundle["x-lightspeed-data-route"] = data_route.clone();
+        schema_bundle["x-lightspeed-idle-policy"] = idle_policy.clone();
+    }
 
     let mut openrpc = json!({
         "openrpc": "1.3.2",
@@ -160,6 +180,10 @@ fn export_plane(plane: Plane) -> PlaneContract {
     if let Some(bootstrap) = bootstrap {
         openrpc["x-lightspeed-bootstrap"] = bootstrap;
     }
+    if let Some((data_route, idle_policy)) = controller_types {
+        openrpc["x-lightspeed-data-route"] = data_route;
+        openrpc["x-lightspeed-idle-policy"] = idle_policy;
+    }
     rewrite_refs(&mut openrpc, "#/definitions/", "#/components/schemas/");
 
     PlaneContract {
diff --git a/crates/environment-protocol/src/control/handshake.rs b/crates/environment-protocol/src/control/handshake.rs
index 727a97c86..07ae9f7b7 100644
--- a/crates/environment-protocol/src/control/handshake.rs
+++ b/crates/environment-protocol/src/control/handshake.rs
@@ -3,15 +3,14 @@
 //! The same handshake rules as the data plane apply: `initialize` first
 //! (`notInitialized` otherwise), once (`invalidRequest` on a repeat), with
 //! [`CONTROLLER_PROTOCOL_VERSION`](crate::CONTROLLER_PROTOCOL_VERSION)
-//! (`versionMismatch` otherwise). The core methods (`template/list` and
-//! every `target/*` method except `target/adopt`) are mandatory at this
-//! version; the capabilities name the optional ones.
+//! (`versionMismatch` otherwise). `template/list`, `target/create`,
+//! `target/get` and `target/close` are mandatory at this version; the
+//! capabilities name the optional ones.
 
 use serde::{Deserialize, Serialize};
 
 use crate::{
     handshake::{ImplementationInfo, Plane},
-    routes::DataRouteBase,
     serde_util::is_false,
 };
 
@@ -35,7 +34,6 @@ pub struct ControllerInitializeResponse {
     pub plane: Plane,
     pub server_info: ImplementationInfo,
     pub capabilities: ControllerCapabilities,
-    pub routes: ControllerRoutes,
 }
 
 /// Optional controller methods. Calling an absent one is
@@ -44,25 +42,10 @@ pub struct ControllerInitializeResponse {
 #[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct ControllerCapabilities {
-    /// `target/adopt` is served.
+    /// `target/setPower` is served.
     #[serde(default, skip_serializing_if = "is_false")]
-    pub adopt_target: bool,
+    pub power: bool,
     /// `ingress/ensure` and `ingress/remove` are served.
     #[serde(default, skip_serializing_if = "is_false")]
     pub ingress: bool,
 }
-
-/// Where Lightspeed reaches a target's data plane through this provider.
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
-#[serde(rename_all = "camelCase", deny_unknown_fields)]
-pub struct ControllerRoutes {
-    /// Base URL of the data routes. A target's data route is this base
-    /// followed by
-    /// `/{universeId}/{bindingId}/{environmentId}/{incarnationId}/{targetId}`,
-    /// each segment percent-encoded
-    /// ([`provider_data_route`](crate::routes::provider_data_route)), and is
-    /// dialed with the same bearer credential as the controller. A
-    /// controller reached over `wss` must advertise a `wss` base.
-    pub data: DataRouteBase,
-}
diff --git a/crates/environment-protocol/src/control/ingress.rs b/crates/environment-protocol/src/control/ingress.rs
index 519681232..ae481553f 100644
--- a/crates/environment-protocol/src/control/ingress.rs
+++ b/crates/environment-protocol/src/control/ingress.rs
@@ -2,8 +2,9 @@
 //! `capabilities.ingress`. `target/close` removes ingress by contract, so
 //! `ingress/remove` exists only to disable ingress on a target that stays.
 //! Both answer [`TargetResponse`](crate::control::target::TargetResponse)
-//! with the realized ingress in the observation; the runtime converges its
-//! recorded intent against that observation.
+//! with the realized ingress in the observation. The runtime calls them
+//! synchronously on a user's request and caches the observed endpoint; it
+//! records no ingress intent and retries nothing.
 
 use serde::{Deserialize, Serialize};
 
diff --git a/crates/environment-protocol/src/control/mod.rs b/crates/environment-protocol/src/control/mod.rs
index d13749385..146c54431 100644
--- a/crates/environment-protocol/src/control/mod.rs
+++ b/crates/environment-protocol/src/control/mod.rs
@@ -1,20 +1,42 @@
 //! The controller plane: a provider controller creating, observing,
 //! powering and closing targets for Lightspeed environments. The runtime
-//! is the client; the provider is the server.
+//! is the client; the provider is the server. Calls go from Lightspeed to
+//! the provider only: the provider never calls Lightspeed.
 //!
-//! The runtime connects with the provider credential as an
-//! `Authorization: Bearer` header, on the controller URL and on every data
-//! route the controller advertises; the provider checks it in constant time
-//! before the WebSocket upgrade.
+//! **Credential.** When the provider is registered with a bearer
+//! credential, the runtime sends it as an `Authorization: Bearer` header on
+//! the controller URL and on every data route; the provider checks it in
+//! constant time before the WebSocket upgrade. Without a credential no
+//! `Authorization` header is sent.
 //!
 //! **Bounded calls.** Every target method answers `{target: observation}`
 //! promptly. Slow work (an image pull, a VM boot, a graceful shutdown)
 //! continues in the background and is followed with `target/get`.
 //!
-//! **Ownership.** A target belongs to exactly one [`TargetOwner`](target::TargetOwner). Every
-//! target method carries the owner; a provider resolves the target from
-//! the owner when no `targetId` is given, and refuses a target that belongs
-//! to another owner with `failedPrecondition` (`ownerMismatch`).
+//! **Ownership.** A target belongs to exactly one
+//! [`TargetOwner`](target::TargetOwner), `{universeId, environmentId}`.
+//! Every target method carries the owner; a provider resolves the target
+//! from the owner when no `targetId` is given, and refuses a target that
+//! belongs to another owner with `failedPrecondition` (`ownerMismatch`).
+//!
+//! **Provider obligations.** The provider owns its targets' power, idle
+//! policy and ingress; Lightspeed decides only create and close. Every
+//! provider:
+//!
+//! 1. makes `target/create` and `target/close` idempotent per owner;
+//! 2. wakes a powered-down target when its data route is dialed, holding
+//!    the upgrade at most
+//!    [`MAX_DATA_ROUTE_HOLD_MS`](crate::limits::MAX_DATA_ROUTE_HOLD_MS)
+//!    before it answers a [`DataRouteRefusal`](crate::routes::DataRouteRefusal);
+//! 3. decides idleness from envd `env/getIdle`, so running processes, jobs
+//!    and leftover process groups keep the target awake
+//!    ([`idle`](crate::idle));
+//! 4. never powers a target down while it relays a data connection to it;
+//! 5. reports a target it removed on its own, such as by a lifetime limit
+//!    or an idle `closeAfterMs`, as `closed`, or answers `notFound` from
+//!    `target/get` once it no longer holds it;
+//! 6. never snapshots or clones an envd state directory that holds a
+//!    daemon identity.
 
 pub mod handshake;
 pub mod ingress;
diff --git a/crates/environment-protocol/src/control/target.rs b/crates/environment-protocol/src/control/target.rs
index f3b7e49fe..c31bb6b6f 100644
--- a/crates/environment-protocol/src/control/target.rs
+++ b/crates/environment-protocol/src/control/target.rs
@@ -1,37 +1,22 @@
-//! `target/*`: create, adopt, observe, power and close provider targets.
+//! `target/*`: create, observe, power and close provider targets.
 
 use serde::{Deserialize, Serialize};
 
 use crate::{
-    ids::{
-        BindingId, EnvironmentId, IncarnationId, ProviderNativeRef, ProviderTargetId, TemplateId,
-        UniverseId,
-    },
-    metadata::{DescriptiveText, DisplayName, Metadata},
+    idle::IdlePolicy,
+    ids::{EnvironmentId, ProviderTargetId, TemplateId, UniverseId},
+    metadata::{DescriptiveText, DisplayName},
     routes::PublicUrl,
-    serde_util::is_false,
 };
 
-/// The Lightspeed incarnation a target belongs to. A provider owns at most
+/// The Lightspeed environment a target belongs to. A provider owns at most
 /// one target per owner.
 #[derive(Clone, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, Serialize, Deserialize)]
 #[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct TargetOwner {
     pub universe_id: UniverseId,
-    pub binding_id: BindingId,
     pub environment_id: EnvironmentId,
-    pub incarnation_id: IncarnationId,
-}
-
-/// The provider binding a call is scoped to, for calls that concern no
-/// particular target.
-#[derive(Clone, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
-#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
-#[serde(rename_all = "camelCase", deny_unknown_fields)]
-pub struct BindingRef {
-    pub universe_id: UniverseId,
-    pub binding_id: BindingId,
 }
 
 /// A reference to an existing target: its owner and, once known, its id.
@@ -45,8 +30,8 @@ pub struct TargetRef {
     pub target_id: Option<ProviderTargetId>,
 }
 
-/// What the provider observes about a target. Every target method answers
-/// with one.
+/// What the provider observes about a target. Every target and ingress
+/// method answers with one; Lightspeed records it for display only.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 #[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
@@ -60,19 +45,18 @@ pub struct TargetObservation {
     pub target_id: Option<ProviderTargetId>,
     /// Echoed from the request.
     pub owner: TargetOwner,
+    pub phase: TargetPhase,
+    /// Present exactly when `phase` is `active`.
     #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub display_name: Option<DisplayName>,
-    pub state: TargetState,
-    /// Power states `target/setPower` can move this target to. Empty when
-    /// the provider offers no power control beyond create and close.
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub supported_power_states: Vec<PowerState>,
+    pub power: Option<PowerState>,
+    /// Why the target is `failed` or `unknown`, or what a transition waits
+    /// for. Providers build it with [`DescriptiveText::lossy`] from
+    /// whatever their backend reports.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub message: Option<DescriptiveText>,
     /// Public ingress as realized; absent when disabled.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub ingress: Option<IngressObservation>,
-    /// Provider-specific display facts.
-    #[serde(default, skip_serializing_if = "Metadata::is_empty")]
-    pub metadata: Metadata,
 }
 
 /// Realized public ingress of a target.
@@ -84,26 +68,6 @@ pub struct IngressObservation {
     pub endpoint: PublicUrl,
 }
 
-/// A target's state on two axes: lifecycle `phase`, and `power` while
-/// active.
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
-#[serde(rename_all = "camelCase", deny_unknown_fields)]
-pub struct TargetState {
-    pub phase: TargetPhase,
-    /// Present exactly when `phase` is `active`.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub power: Option<PowerState>,
-    /// envd answers on the target's data route (running targets only).
-    #[serde(default, skip_serializing_if = "is_false")]
-    pub daemon_ready: bool,
-    /// Why the target is `failed` or `unknown`, or what a transition waits
-    /// for. Providers build it with
-    /// [`DescriptiveText::lossy`] from whatever their backend reports.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub message: Option<DescriptiveText>,
-}
-
 /// Lifecycle phase of a target.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
 #[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
@@ -163,28 +127,21 @@ impl std::fmt::Display for PowerState {
 
 /// `target/create` params. Idempotent per owner: when the owner already
 /// has a target, the provider returns its observation and applies no
-/// creation policy (template deprecation, binding or image checks).
+/// creation policy (template deprecation, image checks). Handing out a
+/// target from a warm pool counts as a create.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 #[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct CreateTargetParams {
     pub owner: TargetOwner,
     pub template_id: TemplateId,
-}
-
-/// `target/adopt` params: take ownership of an existing provider target.
-/// Idempotent per owner. Requires `capabilities.adoptTarget`. A source that
-/// belongs to another owner, or an owner that already holds a different
-/// target, is `failedPrecondition` (`ownerMismatch`); a source the provider
-/// cannot take over is `failedPrecondition` (`notAdoptable`).
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
-#[serde(rename_all = "camelCase", deny_unknown_fields)]
-pub struct AdoptTargetParams {
-    pub owner: TargetOwner,
-    /// Provider-native reference to the existing target; the provider
-    /// defines its format.
-    pub source_target: ProviderNativeRef,
+    /// Label for the target, where the provider shows one.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub display_name: Option<DisplayName>,
+    /// Overrides the template's `idle` for this target. A policy that does
+    /// not validate ([`IdlePolicy::validate`]) is `invalidParams`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub idle: Option<IdlePolicy>,
 }
 
 /// `target/get` params. A pure read: it never creates or changes anything.
@@ -196,24 +153,27 @@ pub struct GetTargetParams {
     pub target: TargetRef,
 }
 
-/// `target/setPower` params: converge the target toward `power`. A target
-/// already in, or moving toward, that state is observed without further
-/// action. Resuming may replace the underlying host process. A target whose
-/// `phase` is not `active` is `failedPrecondition` (`targetNotActive`); a
-/// state outside `supportedPowerStates` is `invalidParams`.
+/// `target/setPower` params: move the target to `power`. Requires
+/// `capabilities.power`. A target already in, or moving toward, that state
+/// is observed without further action. Resuming may replace the underlying
+/// host process. A state outside the template's `powerStates` is
+/// `invalidParams`; a target whose `phase` is not `active` is
+/// `failedPrecondition` (`targetNotActive`). The provider stays the owner
+/// of power afterwards: its own idle policy may move the target again.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 #[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct SetTargetPowerParams {
     pub target: TargetRef,
-    /// One of the target's `supportedPowerStates`.
+    /// One of the template's `powerStates`.
     pub power: PowerState,
 }
 
 /// `target/close` params: destroy the owner's target and every resource it
-/// holds, public ingress included. Graceful within the provider's own bound,
-/// then forced. Answers `closing` until the target is gone, then `closed`;
-/// `closed` also when the provider holds no target for the owner.
+/// holds, public ingress included. Idempotent. Graceful within the
+/// provider's own bound, then forced. Answers `closing` until the target is
+/// gone, then `closed`; `closed` also when the provider holds no target for
+/// the owner.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 #[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
diff --git a/crates/environment-protocol/src/control/template.rs b/crates/environment-protocol/src/control/template.rs
index 03a4504a9..56ab76caa 100644
--- a/crates/environment-protocol/src/control/template.rs
+++ b/crates/environment-protocol/src/control/template.rs
@@ -1,20 +1,22 @@
-//! `template/list`: the templates a binding may create targets from.
+//! `template/list`: the templates a universe may create targets from.
 
 use serde::{Deserialize, Serialize};
 
 use crate::{
-    control::target::BindingRef,
-    ids::TemplateId,
+    control::target::PowerState,
+    idle::IdlePolicy,
+    ids::{TemplateId, UniverseId},
     metadata::{DescriptiveText, DisplayName, Metadata},
     serde_util::is_false,
 };
 
-/// `template/list` params.
+/// `template/list` params: the universe whose targets the templates would
+/// create. A provider may offer each universe a different set.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 #[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct ListTemplatesParams {
-    pub binding: BindingRef,
+    pub universe_id: UniverseId,
 }
 
 /// `template/list` response.
@@ -35,9 +37,18 @@ pub struct EnvironmentTemplate {
     pub display_name: DisplayName,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub description: Option<DescriptiveText>,
+    /// Power states `target/setPower` can move this template's targets to.
+    /// Empty when the provider offers no power control beyond create and
+    /// close.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub power_states: Vec<PowerState>,
     /// Targets of this template can serve public ingress.
     #[serde(default, skip_serializing_if = "is_false")]
     pub public_ingress: bool,
+    /// Idle policy targets get when `target/create` names none; absent when
+    /// the provider applies none by default.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub idle: Option<IdlePolicy>,
     /// Creates no new targets; existing targets keep working.
     #[serde(default, skip_serializing_if = "is_false")]
     pub deprecated: bool,
diff --git a/crates/environment-protocol/src/data/idle.rs b/crates/environment-protocol/src/data/idle.rs
index d95831bbe..e92bb1e3e 100644
--- a/crates/environment-protocol/src/data/idle.rs
+++ b/crates/environment-protocol/src/data/idle.rs
@@ -3,8 +3,9 @@
 //! The daemon reports a monotonic idle duration, never a wall-clock
 //! timestamp: after a freeze, stateful stop or snapshot restore the guest
 //! clock is stale until it resyncs, while a monotonic duration stays
-//! correct. Policy decides on `idleForMs` alone; the counts are
-//! diagnostics.
+//! correct. The policy is the provider's
+//! ([`IdlePolicy`](crate::idle::IdlePolicy)); it decides on `idleForMs`
+//! alone, and the counts are diagnostics.
 
 use serde::{Deserialize, Serialize};
 
@@ -22,7 +23,9 @@ pub struct GetIdleParams {}
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct GetIdleResponse {
     /// Milliseconds since the last `use` request, or since running work
-    /// last ended, whichever is later. Zero while any process or job runs.
+    /// last ended, whichever is later. Zero while any process or job runs
+    /// or any leftover process group has live members; the clock restarts
+    /// when the last of them ends.
     pub idle_for_ms: u64,
     /// Processes started with `process/start` whose root has not exited.
     #[serde(default, skip_serializing_if = "is_zero_u32")]
@@ -31,8 +34,8 @@ pub struct GetIdleResponse {
     #[serde(default, skip_serializing_if = "is_zero_u32")]
     pub running_job_count: u32,
     /// Process groups of exited processes that still have members alive:
-    /// services a command started and left running. They are not running
-    /// work and do not hold `idleForMs` at zero.
+    /// services a command started and left running. They hold `idleForMs`
+    /// at zero like running work.
     #[serde(default, skip_serializing_if = "is_zero_u32")]
     pub leftover_process_group_count: u32,
 }
diff --git a/crates/environment-protocol/src/error.rs b/crates/environment-protocol/src/error.rs
index 8cb49c8d1..36561c1a3 100644
--- a/crates/environment-protocol/src/error.rs
+++ b/crates/environment-protocol/src/error.rs
@@ -232,8 +232,7 @@ pub enum PreconditionReason {
     EnvironmentClosed,
     /// The daemon identity is bound to another universe.
     IdentityInUse,
-    /// The target belongs to another owner, or (`target/adopt`) the owner
-    /// already holds a different target.
+    /// The target belongs to another owner.
     OwnerMismatch,
     /// The template is deprecated and creates no new targets.
     TemplateDeprecated,
@@ -242,9 +241,6 @@ pub enum PreconditionReason {
     /// A power change on a target whose `phase` is not `active`
     /// (provisioning, closing, closed or failed).
     TargetNotActive,
-    /// `target/adopt`: the source target exists but the provider cannot take
-    /// it over, for example an instance of a kind it does not manage.
-    NotAdoptable,
 }
 
 /// Why a `permissionDenied` request was refused.
@@ -308,8 +304,8 @@ pub enum Capability {
     ProcessPty,
     /// The `job` family.
     Job,
-    /// The controller's `adoptTarget` capability.
-    AdoptTarget,
+    /// The controller's `power` capability.
+    Power,
     /// The controller's `ingress` capability.
     Ingress,
 }
diff --git a/crates/environment-protocol/src/idle.rs b/crates/environment-protocol/src/idle.rs
new file mode 100644
index 000000000..ea4cf538a
--- /dev/null
+++ b/crates/environment-protocol/src/idle.rs
@@ -0,0 +1,244 @@
+//! Idle policy: when a provider powers down or closes an idle target.
+//!
+//! The policy belongs to the provider. A template names a default
+//! (`template/list` `idle`), `target/create` may override it (`idle`), and
+//! the provider runs the clock: it reads envd `env/getIdle` over its own
+//! guest channel and applies [`IdlePolicy::due_action`] to `idleForMs`.
+//! Running processes, jobs and leftover process groups hold `idleForMs` at
+//! zero, so they keep the target awake. A provider never powers a target
+//! down while it relays a data connection to it. Lightspeed only validates
+//! a policy and passes it through.
+
+use std::fmt;
+
+use serde::{Deserialize, Serialize};
+use thiserror::Error;
+
+use crate::control::target::PowerState;
+
+/// Staged idle policy. Each set threshold is measured against envd
+/// `env/getIdle` `idleForMs`, and the set thresholds are non-decreasing in
+/// the order pause → suspend → stop → close. Every stage is optional; a
+/// policy sets at least one.
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct IdlePolicy {
+    /// Pause the target after this long idle.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub pause_after_ms: Option<u64>,
+    /// Suspend the target after this long idle.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub suspend_after_ms: Option<u64>,
+    /// Stop the target after this long idle.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub stop_after_ms: Option<u64>,
+    /// Close the target after this long idle; the provider then reports it
+    /// `closed`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub close_after_ms: Option<u64>,
+}
+
+/// One stage of an idle policy, in escalation order.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum IdleAction {
+    Pause,
+    Suspend,
+    Stop,
+    Close,
+}
+
+impl IdleAction {
+    /// The power state this stage moves a target to; `None` for close.
+    pub fn power_state(self) -> Option<PowerState> {
+        match self {
+            Self::Pause => Some(PowerState::Paused),
+            Self::Suspend => Some(PowerState::Suspended),
+            Self::Stop => Some(PowerState::Stopped),
+            Self::Close => None,
+        }
+    }
+
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Pause => "pause",
+            Self::Suspend => "suspend",
+            Self::Stop => "stop",
+            Self::Close => "close",
+        }
+    }
+}
+
+impl fmt::Display for IdleAction {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(self.as_str())
+    }
+}
+
+/// Why an idle policy is invalid.
+#[derive(Clone, Debug, PartialEq, Eq, Error)]
+pub enum IdlePolicyError {
+    #[error("idle policy sets no stage")]
+    Empty,
+
+    #[error("idle policy {0} threshold must be positive")]
+    ZeroThreshold(IdleAction),
+
+    #[error("idle policy {later} threshold must not be below {earlier}")]
+    OutOfOrder {
+        earlier: IdleAction,
+        later: IdleAction,
+    },
+}
+
+impl IdlePolicy {
+    pub fn is_empty(&self) -> bool {
+        self.pause_after_ms.is_none()
+            && self.suspend_after_ms.is_none()
+            && self.stop_after_ms.is_none()
+            && self.close_after_ms.is_none()
+    }
+
+    /// The set stages in escalation order, with their thresholds.
+    pub fn stages(&self) -> Vec<(IdleAction, u64)> {
+        [
+            (IdleAction::Pause, self.pause_after_ms),
+            (IdleAction::Suspend, self.suspend_after_ms),
+            (IdleAction::Stop, self.stop_after_ms),
+            (IdleAction::Close, self.close_after_ms),
+        ]
+        .into_iter()
+        .filter_map(|(action, threshold)| threshold.map(|threshold| (action, threshold)))
+        .collect()
+    }
+
+    /// At least one stage, every threshold positive, thresholds
+    /// non-decreasing in escalation order.
+    pub fn validate(&self) -> Result<(), IdlePolicyError> {
+        if self.is_empty() {
+            return Err(IdlePolicyError::Empty);
+        }
+        let mut previous: Option<(IdleAction, u64)> = None;
+        for (action, threshold) in self.stages() {
+            if threshold == 0 {
+                return Err(IdlePolicyError::ZeroThreshold(action));
+            }
+            if let Some((earlier, earlier_threshold)) = previous
+                && threshold < earlier_threshold
+            {
+                return Err(IdlePolicyError::OutOfOrder {
+                    earlier,
+                    later: action,
+                });
+            }
+            previous = Some((action, threshold));
+        }
+        Ok(())
+    }
+
+    /// The most escalated stage whose threshold `idle_for_ms` has crossed
+    /// and whose power state is in `supported` (`close` always qualifies);
+    /// `None` while no stage applies.
+    pub fn due_action(&self, idle_for_ms: u64, supported: &[PowerState]) -> Option<IdleAction> {
+        self.stages()
+            .into_iter()
+            .filter(|(_, threshold)| idle_for_ms >= *threshold)
+            .filter(|(action, _)| {
+                action
+                    .power_state()
+                    .is_none_or(|state| supported.contains(&state))
+            })
+            .map(|(action, _)| action)
+            .next_back()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use serde_json::json;
+
+    use super::*;
+
+    fn full() -> IdlePolicy {
+        IdlePolicy {
+            pause_after_ms: Some(10),
+            suspend_after_ms: Some(20),
+            stop_after_ms: Some(30),
+            close_after_ms: Some(40),
+        }
+    }
+
+    #[test]
+    fn validation_requires_a_positive_non_decreasing_stage() {
+        assert_eq!(full().validate(), Ok(()));
+        assert_eq!(
+            IdlePolicy::default().validate(),
+            Err(IdlePolicyError::Empty)
+        );
+        assert_eq!(
+            IdlePolicy {
+                pause_after_ms: Some(0),
+                ..IdlePolicy::default()
+            }
+            .validate(),
+            Err(IdlePolicyError::ZeroThreshold(IdleAction::Pause))
+        );
+        assert_eq!(
+            IdlePolicy {
+                pause_after_ms: Some(30),
+                stop_after_ms: Some(10),
+                ..IdlePolicy::default()
+            }
+            .validate(),
+            Err(IdlePolicyError::OutOfOrder {
+                earlier: IdleAction::Pause,
+                later: IdleAction::Stop
+            })
+        );
+        assert_eq!(
+            IdlePolicy {
+                stop_after_ms: Some(10),
+                close_after_ms: Some(10),
+                ..IdlePolicy::default()
+            }
+            .validate(),
+            Ok(()),
+            "equal thresholds are allowed"
+        );
+    }
+
+    #[test]
+    fn the_most_escalated_supported_stage_is_due() {
+        let policy = full();
+        let incus = [PowerState::Running, PowerState::Paused, PowerState::Stopped];
+        assert_eq!(policy.due_action(5, &incus), None);
+        assert_eq!(policy.due_action(10, &incus), Some(IdleAction::Pause));
+        // Suspend is due but unsupported: pause stays the most escalated
+        // applicable stage.
+        assert_eq!(policy.due_action(25, &incus), Some(IdleAction::Pause));
+        assert_eq!(policy.due_action(30, &incus), Some(IdleAction::Stop));
+        assert_eq!(policy.due_action(40, &incus), Some(IdleAction::Close));
+        // Close needs no power support.
+        assert_eq!(policy.due_action(40, &[]), Some(IdleAction::Close));
+        assert_eq!(policy.due_action(30, &[]), None);
+    }
+
+    #[test]
+    fn the_wire_shape_is_camel_case_and_strict() {
+        let policy = IdlePolicy {
+            pause_after_ms: Some(600_000),
+            close_after_ms: Some(86_400_000),
+            ..IdlePolicy::default()
+        };
+        let value = serde_json::to_value(&policy).unwrap();
+        assert_eq!(
+            value,
+            json!({"pauseAfterMs": 600_000, "closeAfterMs": 86_400_000})
+        );
+        assert_eq!(serde_json::from_value::<IdlePolicy>(value).unwrap(), policy);
+        assert!(serde_json::from_value::<IdlePolicy>(json!({"pauseAfter": 1})).is_err());
+        assert_eq!(IdleAction::Suspend.to_string(), "suspend");
+        assert_eq!(IdleAction::Close.power_state(), None);
+    }
+}
diff --git a/crates/environment-protocol/src/ids.rs b/crates/environment-protocol/src/ids.rs
index f94d60a61..f913540e4 100644
--- a/crates/environment-protocol/src/ids.rs
+++ b/crates/environment-protocol/src/ids.rs
@@ -239,21 +239,11 @@ protocol_id!(
     UniverseId,
     general
 );
-protocol_id!(
-    /// `bindingId` of a provider binding within a universe.
-    BindingId,
-    general
-);
 protocol_id!(
     /// `environmentId` of a Lightspeed environment.
     EnvironmentId,
     general
 );
-protocol_id!(
-    /// `incarnationId` of one incarnation of an environment.
-    IncarnationId,
-    general
-);
 protocol_id!(
     /// `daemonId` the gateway assigns to an admitted daemon identity.
     DaemonId,
@@ -274,12 +264,6 @@ protocol_id!(
     TemplateId,
     opaque
 );
-protocol_id!(
-    /// `sourceTarget` of `target/adopt`: a provider-native reference to an
-    /// existing target, in a format the provider defines.
-    ProviderNativeRef,
-    opaque
-);
 protocol_id!(
     /// `name` of a job and `dependsOn {kind: name}`: a caller-chosen name,
     /// unique within one `job/start`, 1 to 128 bytes without control
diff --git a/crates/environment-protocol/src/lib.rs b/crates/environment-protocol/src/lib.rs
index a0cbca96f..35e589400 100644
--- a/crates/environment-protocol/src/lib.rs
+++ b/crates/environment-protocol/src/lib.rs
@@ -11,9 +11,11 @@
 //!   with the gateway and is asked for reverse-dialed streams; versioned by
 //!   [`ENVD_PROTOCOL_VERSION`].
 //!
-//! [`manifest`] lists every method with its types. The crate is
-//! transport-free: it defines messages and the rules both sides follow,
-//! not sockets.
+//! [`manifest`] lists every method with its types; [`idle`] holds the idle
+//! policy providers run against envd's `env/getIdle`, and
+//! [`routes::DataRouteRefusal`] the body a data route answers instead of
+//! upgrading. The crate is transport-free: it defines messages and the
+//! rules both sides follow, not sockets.
 //!
 //! # Conventions
 //!
@@ -86,6 +88,7 @@ pub mod control;
 pub mod data;
 pub mod error;
 pub mod handshake;
+pub mod idle;
 pub mod ids;
 pub mod jsonrpc;
 pub mod limits;
diff --git a/crates/environment-protocol/src/limits.rs b/crates/environment-protocol/src/limits.rs
index 7f3767f10..8fcbffdf4 100644
--- a/crates/environment-protocol/src/limits.rs
+++ b/crates/environment-protocol/src/limits.rs
@@ -40,8 +40,8 @@ pub const MAX_PATH_BYTES: u32 = 4096;
 /// `registration/closed` message.
 pub const MAX_DESCRIPTIVE_TEXT_BYTES: u32 = 1024;
 
-/// Longest URL a peer advertises or reports (`routes.data`, an ingress
-/// `endpoint`), in bytes.
+/// Longest URL a peer reports or is configured with (a data route base,
+/// an ingress `endpoint`), in bytes.
 pub const MAX_URL_BYTES: u32 = 2048;
 
 /// Longest error `message` in bytes. [`ProtocolError::new`] cuts longer
@@ -50,6 +50,16 @@ pub const MAX_URL_BYTES: u32 = 2048;
 /// [`ProtocolError::new`]: crate::error::ProtocolError::new
 pub const MAX_ERROR_MESSAGE_BYTES: u32 = 4096;
 
+/// Longest a provider data route holds a dial before it upgrades or
+/// answers a [`DataRouteRefusal`](crate::routes::DataRouteRefusal), in
+/// milliseconds: long enough to resume a paused target, short enough that
+/// the caller's own wait stays in charge.
+pub const MAX_DATA_ROUTE_HOLD_MS: u64 = 5_000;
+
+/// Largest `Retry-After` a data route refusal names, in whole seconds.
+/// Receivers clamp a larger value to it.
+pub const RETRY_AFTER_MAX_SECS: u64 = 60;
+
 /// Most chunks plus gaps in one `process/read` page, and across all entries
 /// of one `job/read` response. A page that reaches it ends early and loses
 /// nothing: `next` says where to continue.
diff --git a/crates/environment-protocol/src/manifest.rs b/crates/environment-protocol/src/manifest.rs
index c894b09d9..be27d664b 100644
--- a/crates/environment-protocol/src/manifest.rs
+++ b/crates/environment-protocol/src/manifest.rs
@@ -20,8 +20,8 @@ use crate::{
         handshake::{ControllerInitializeParams, ControllerInitializeResponse},
         ingress::{EnsureIngressParams, RemoveIngressParams},
         target::{
-            AdoptTargetParams, CloseTargetParams, CreateTargetParams, GetTargetParams,
-            SetTargetPowerParams, TargetResponse,
+            CloseTargetParams, CreateTargetParams, GetTargetParams, SetTargetPowerParams,
+            TargetResponse,
         },
         template::{ListTemplatesParams, ListTemplatesResponse},
     },
@@ -512,13 +512,13 @@ requests! {
         plane: Controller, direction: ClientToServer, family: Handshake, activity: None,
         capability: None, abortable: false,
         params: ControllerInitializeParams, response: ControllerInitializeResponse,
-        summary: "Check the protocol version and read the controller's capabilities and routes.",
+        summary: "Check the protocol version and read the controller's capabilities.",
     }
     TemplateList = "template/list" {
         plane: Controller, direction: ClientToServer, family: Template, activity: None,
         capability: None, abortable: false,
         params: ListTemplatesParams, response: ListTemplatesResponse,
-        summary: "List the templates a binding may create targets from.",
+        summary: "List the templates a universe may create targets from.",
     }
     TargetCreate = "target/create" {
         plane: Controller, direction: ClientToServer, family: Target, activity: None,
@@ -526,12 +526,6 @@ requests! {
         params: CreateTargetParams, response: TargetResponse,
         summary: "Create the owner's target, or observe the one it has.",
     }
-    TargetAdopt = "target/adopt" {
-        plane: Controller, direction: ClientToServer, family: Target, activity: None,
-        capability: Some(Capability::AdoptTarget), abortable: false,
-        params: AdoptTargetParams, response: TargetResponse,
-        summary: "Take ownership of an existing provider target.",
-    }
     TargetGet = "target/get" {
         plane: Controller, direction: ClientToServer, family: Target, activity: None,
         capability: None, abortable: false,
@@ -540,9 +534,9 @@ requests! {
     }
     TargetSetPower = "target/setPower" {
         plane: Controller, direction: ClientToServer, family: Target, activity: None,
-        capability: None, abortable: false,
+        capability: Some(Capability::Power), abortable: false,
         params: SetTargetPowerParams, response: TargetResponse,
-        summary: "Converge a target toward a power state.",
+        summary: "Move a target to a power state.",
     }
     TargetClose = "target/close" {
         plane: Controller, direction: ClientToServer, family: Target, activity: None,
diff --git a/crates/environment-protocol/src/registration.rs b/crates/environment-protocol/src/registration.rs
index ff7adf296..36695ab1b 100644
--- a/crates/environment-protocol/src/registration.rs
+++ b/crates/environment-protocol/src/registration.rs
@@ -62,7 +62,7 @@ use crate::{
     bytes::{SecretString, hex_value},
     error::ProtocolError,
     handshake::ImplementationInfo,
-    ids::{ControlConnectionId, DaemonId, EnvironmentId, IncarnationId},
+    ids::{ControlConnectionId, DaemonId, EnvironmentId},
     jsonrpc::decode_params,
     metadata::{
         DescriptiveText, DisplayName, Metadata, validate_caller_metadata, validate_display_name,
@@ -217,7 +217,6 @@ pub struct RegisterResponse {
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct RegistrationReceipt {
     pub environment_id: EnvironmentId,
-    pub incarnation_id: IncarnationId,
     pub daemon_id: DaemonId,
     /// The gateway's id for this control connection.
     pub control_connection_id: ControlConnectionId,
@@ -298,8 +297,8 @@ pub enum GoodbyeReason {
 }
 
 /// `registration/closed` params: the gateway ends the session for good and
-/// closes the socket after this frame. The daemon exits and does not
-/// reconnect.
+/// closes the socket after this frame. The daemon exits or parks, as
+/// configured, and does not reconnect.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 #[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
@@ -365,12 +364,12 @@ mod tests {
     #[test]
     fn the_challenge_decodes_tolerantly() {
         let params: ChallengeParams = serde_json::from_value(json!({
-            "protocolVersion": 3,
+            "protocolVersion": 4,
             "nonce": "00".repeat(32),
             "addedLater": true,
         }))
         .unwrap();
-        assert_eq!(params.protocol_version, 3);
+        assert_eq!(params.protocol_version, 4);
     }
 
     #[test]
@@ -419,7 +418,7 @@ mod tests {
 
     fn register_params() -> Value {
         json!({
-            "protocolVersion": 3,
+            "protocolVersion": 4,
             "daemonPublicKey": "ab".repeat(32),
             "signature": "cd".repeat(64),
             "implementation": {"name": "lightspeed-envd", "version": "0.5.0"},
diff --git a/crates/environment-protocol/src/routes.rs b/crates/environment-protocol/src/routes.rs
index 70bef6aff..ae09a789e 100644
--- a/crates/environment-protocol/src/routes.rs
+++ b/crates/environment-protocol/src/routes.rs
@@ -6,7 +6,12 @@ use std::fmt;
 use serde::{Deserialize, Deserializer, Serialize, Serializer, de::Error as _};
 use thiserror::Error;
 
-use crate::{control::target::TargetOwner, ids::ProviderTargetId, limits::MAX_URL_BYTES};
+use crate::{
+    control::target::TargetOwner,
+    ids::ProviderTargetId,
+    limits::{MAX_URL_BYTES, RETRY_AFTER_MAX_SECS},
+    metadata::DescriptiveText,
+};
 
 /// Gateway route an envd dials to register and hold its control connection.
 /// A gateway may be served under a path prefix (`wss://host/ls` plus this
@@ -22,6 +27,11 @@ pub const DATA_PATH: &str = "/environment-gateway/data";
 /// Gateway route serving the envd discovery document.
 pub const DISCOVERY_PATH: &str = "/.well-known/lightspeed-envd";
 
+/// Path of the data routes under a controller's origin when the provider
+/// is registered without a data route base
+/// ([`DataRouteBase::derived_from_controller`]).
+pub const DEFAULT_DATA_ROUTE_PATH: &str = "/routes";
+
 /// JSON Schema pattern of [`DataRouteBase`].
 pub const DATA_ROUTE_BASE_PATTERN: &str = "^wss?://[^/?#@\\s]+(/[^?#\\s]*[^/?#\\s])?$";
 
@@ -57,7 +67,7 @@ pub enum UrlError {
     #[error("gateway connect URL path must end with {CONNECT_PATH}: {0}")]
     NotConnectPath(String),
 
-    #[error("a controller reached over wss must advertise a wss data route: {0}")]
+    #[error("a controller reached over wss needs a wss data route base: {0}")]
     Downgrade(String),
 }
 
@@ -178,13 +188,15 @@ pub fn gateway_stream_url(gateway_connect_url: &str) -> Result<String, UrlError>
     ))
 }
 
-/// `routes.data` of a controller's `initialize`: the absolute `ws://` or
-/// `wss://` base URL of the provider's data routes, validated on decode and
-/// never rewritten. Lowercase scheme, a host and optional port, an optional
-/// path that does not end with `/`, no user information, query or
-/// fragment, at most 2048 bytes. A controller reached over `wss` must
-/// advertise a `wss` base, so the provider credential never travels in
-/// cleartext; the runtime checks it with
+/// The absolute `ws://` or `wss://` base URL of a provider's data routes,
+/// validated on decode and never rewritten: lowercase scheme, a host and
+/// optional port, an optional path that does not end with `/`, no user
+/// information, query or fragment, at most 2048 bytes. The operator may
+/// configure one when registering the provider; without one the runtime
+/// derives it from the controller URL
+/// ([`DataRouteBase::derived_from_controller`]). A controller reached over
+/// `wss` needs a `wss` base, so a provider credential never travels in
+/// cleartext; the runtime checks a configured base with
 /// [`DataRouteBase::check_for_controller`].
 #[derive(Clone, Debug, PartialEq, Eq, Hash)]
 #[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
@@ -220,9 +232,32 @@ impl DataRouteBase {
         self.0.starts_with("wss://")
     }
 
+    /// The base a provider registered without one uses: the controller
+    /// URL's scheme, host and port as written, followed by
+    /// [`DEFAULT_DATA_ROUTE_PATH`]; the controller URL's path, query and
+    /// fragment are dropped. Only a `ws` or `wss` controller URL has one;
+    /// any other scheme (such as `unix`) is [`UrlError::Scheme`].
+    pub fn derived_from_controller(controller_url: &str) -> Result<Self, UrlError> {
+        // The scheme decides first: a `unix://` controller endpoint has no
+        // network origin to derive from, so it needs an explicit base.
+        let scheme = controller_url.split_once("://").map(|(scheme, _)| scheme);
+        if !matches!(scheme, Some("ws" | "wss")) {
+            return Err(UrlError::Scheme(controller_url.to_owned()));
+        }
+        let parts = split_url(controller_url)?;
+        let authority = match parts.port {
+            Some(port) => format!("{}:{port}", parts.host),
+            None => parts.host.to_owned(),
+        };
+        Self::new(format!(
+            "{}://{authority}{DEFAULT_DATA_ROUTE_PATH}",
+            parts.scheme
+        ))
+    }
+
     /// The downgrade rule: a controller whose URL is `wss` (or `https`) may
-    /// only advertise a `wss` base. The runtime checks it at every
-    /// `initialize` before it records the base.
+    /// only use a `wss` base. The runtime checks a configured base when the
+    /// provider is registered.
     pub fn check_for_controller(&self, controller_url: &str) -> Result<(), UrlError> {
         if canonical_origin(controller_url)?.is_secure() && !self.is_secure() {
             return Err(UrlError::Downgrade(self.0.clone()));
@@ -297,26 +332,136 @@ macro_rules! url_impls {
 url_impls!(DataRouteBase);
 url_impls!(PublicUrl);
 
-/// A target's data route under a controller's advertised `routes.data`
-/// base: the base followed by
-/// `/{universeId}/{bindingId}/{environmentId}/{incarnationId}/{targetId}`,
-/// each segment percent-encoded.
+/// A target's data route under a provider's data route base: the base
+/// followed by `/{universeId}/{environmentId}/{targetId}`, each segment
+/// percent-encoded. The runtime dials it with the provider credential, when
+/// one is configured. Before the upgrade the provider may hold the dial up
+/// to [`MAX_DATA_ROUTE_HOLD_MS`](crate::limits::MAX_DATA_ROUTE_HOLD_MS)
+/// while it wakes the target, then answers a [`DataRouteRefusal`].
 pub fn provider_data_route(
     base: &DataRouteBase,
     owner: &TargetOwner,
     target_id: &ProviderTargetId,
 ) -> String {
     format!(
-        "{}/{}/{}/{}/{}/{}",
+        "{}/{}/{}/{}",
         base.as_str(),
         encode_path_segment(owner.universe_id.as_str()),
-        encode_path_segment(owner.binding_id.as_str()),
         encode_path_segment(owner.environment_id.as_str()),
-        encode_path_segment(owner.incarnation_id.as_str()),
         encode_path_segment(target_id.as_str()),
     )
 }
 
+/// Body of the HTTP refusal a data route answers instead of upgrading, with
+/// `Content-Type: application/json`. A provider data route uses `waking`,
+/// `booting`, `gone` and `failed`; the gateway's worker route adds
+/// `provisioning`, `disconnected` and `away` and forwards a provider's
+/// refusal unchanged. Every 503 carries `Retry-After` in whole seconds,
+/// 1 to [`RETRY_AFTER_MAX_SECS`](crate::limits::RETRY_AFTER_MAX_SECS).
+/// The body is an HTTP refusal, not a JSON-RPC message, and is tagged by
+/// `state`.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
+#[serde(
+    tag = "state",
+    rename_all = "camelCase",
+    rename_all_fields = "camelCase",
+    deny_unknown_fields
+)]
+pub enum DataRouteRefusal {
+    /// 503: resuming from a powered-down state.
+    Waking {},
+    /// 503: running, envd not answering yet.
+    Booting {},
+    /// 503 (gateway): the environment is still provisioning.
+    Provisioning {},
+    /// 503 (gateway): the registered daemon is not connected.
+    Disconnected {},
+    /// 410 (gateway): the registered daemon has been away past its
+    /// reconnect bound.
+    Away {},
+    /// 410: the target no longer exists.
+    Gone {},
+    /// 409: broken beyond the provider's recovery.
+    Failed { message: DescriptiveText },
+}
+
+impl DataRouteRefusal {
+    /// The HTTP status the refusal is answered with.
+    pub fn status(&self) -> u16 {
+        match self {
+            Self::Waking {} | Self::Booting {} | Self::Provisioning {} | Self::Disconnected {} => {
+                503
+            }
+            Self::Away {} | Self::Gone {} => 410,
+            Self::Failed { .. } => 409,
+        }
+    }
+
+    /// True for the 503 refusals: the same dial may succeed after
+    /// `Retry-After`.
+    pub fn is_retryable(&self) -> bool {
+        self.status() == 503
+    }
+
+    /// The refusal a refused upgrade names: its body when that decodes,
+    /// else what its status alone names. The upgrade response carries only
+    /// the bytes read along with its headers, so a body that arrives in a
+    /// later TCP segment or TLS record is missing; the refusal then must not
+    /// depend on how the transport split the bytes. 410 is `gone`, 409 is
+    /// `failed`, and a 503 with `Retry-After` is `booting`, a wait. Any other
+    /// status, such as a 503 without `Retry-After` from a proxy, names no
+    /// refusal.
+    pub fn from_refused_upgrade(
+        status: u16,
+        body: Option<&[u8]>,
+        retry_after_ms: Option<u64>,
+    ) -> Option<Self> {
+        if let Some(refusal) = body.and_then(|body| serde_json::from_slice::<Self>(body).ok()) {
+            return Some(refusal);
+        }
+        match status {
+            410 => Some(Self::Gone {}),
+            409 => Some(Self::Failed {
+                message: DescriptiveText::new("the data route reports the target failed")
+                    .expect("a fixed failure message is valid text"),
+            }),
+            503 if retry_after_ms.is_some() => Some(Self::Booting {}),
+            _ => None,
+        }
+    }
+
+    /// The `state` tag.
+    pub fn state(&self) -> &'static str {
+        match self {
+            Self::Waking {} => "waking",
+            Self::Booting {} => "booting",
+            Self::Provisioning {} => "provisioning",
+            Self::Disconnected {} => "disconnected",
+            Self::Away {} => "away",
+            Self::Gone {} => "gone",
+            Self::Failed { .. } => "failed",
+        }
+    }
+}
+
+impl fmt::Display for DataRouteRefusal {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::Failed { message } => write!(formatter, "failed: {message}"),
+            refusal => formatter.write_str(refusal.state()),
+        }
+    }
+}
+
+/// A `Retry-After` header value in whole seconds, clamped to
+/// [`RETRY_AFTER_MAX_SECS`], as milliseconds. The HTTP-date form is not
+/// used by the protocol and names no delay.
+pub fn parse_retry_after_ms(value: &str) -> Option<u64> {
+    let seconds: u64 = value.trim().parse().ok()?;
+    Some(seconds.min(RETRY_AFTER_MAX_SECS) * 1_000)
+}
+
 /// Percent-encode one URL path segment: everything except RFC 3986
 /// unreserved characters.
 pub fn encode_path_segment(segment: &str) -> String {
@@ -423,7 +568,7 @@ mod tests {
     }
 
     #[test]
-    fn a_wss_controller_cannot_advertise_a_ws_data_route() {
+    fn a_wss_controller_cannot_use_a_ws_data_route_base() {
         let plain = DataRouteBase::new("ws://p.example/routes").unwrap();
         assert!(matches!(
             plain.check_for_controller("wss://p.example/control"),
@@ -450,15 +595,118 @@ mod tests {
     fn data_routes_encode_opaque_target_ids() {
         let owner = TargetOwner {
             universe_id: "u1".parse().unwrap(),
-            binding_id: "primary".parse().unwrap(),
             environment_id: "env_1".parse().unwrap(),
-            incarnation_id: "inc_1".parse().unwrap(),
         };
         let target = ProviderTargetId::new("default/pod abc").unwrap();
         let base = DataRouteBase::new("wss://p.example/routes").unwrap();
         assert_eq!(
             provider_data_route(&base, &owner, &target),
-            "wss://p.example/routes/u1/primary/env_1/inc_1/default%2Fpod%20abc"
+            "wss://p.example/routes/u1/env_1/default%2Fpod%20abc"
+        );
+    }
+
+    #[test]
+    fn data_route_bases_derive_from_the_controller_origin() {
+        for (controller, base) in [
+            ("wss://p.example/control", "wss://p.example/routes"),
+            (
+                "wss://p.example:19090/x/y?z=1",
+                "wss://p.example:19090/routes",
+            ),
+            ("ws://127.0.0.1:9000", "ws://127.0.0.1:9000/routes"),
+            ("ws://[::1]:9000/control", "ws://[::1]:9000/routes"),
+        ] {
+            assert_eq!(
+                DataRouteBase::derived_from_controller(controller)
+                    .unwrap()
+                    .as_str(),
+                base,
+                "{controller}"
+            );
+        }
+        for bad in ["unix:///run/provider.sock", "https://p.example", "wss://"] {
+            assert!(
+                DataRouteBase::derived_from_controller(bad).is_err(),
+                "{bad}"
+            );
+        }
+        assert!(matches!(
+            DataRouteBase::derived_from_controller("unix:///run/provider.sock"),
+            Err(UrlError::Scheme(_))
+        ));
+    }
+
+    #[test]
+    fn refusals_are_state_tagged_with_fixed_statuses() {
+        use serde_json::json;
+
+        let cases = [
+            (json!({"state": "waking"}), 503),
+            (json!({"state": "booting"}), 503),
+            (json!({"state": "provisioning"}), 503),
+            (json!({"state": "disconnected"}), 503),
+            (json!({"state": "away"}), 410),
+            (json!({"state": "gone"}), 410),
+            (json!({"state": "failed", "message": "disk lost"}), 409),
+        ];
+        for (body, status) in cases {
+            let refusal: DataRouteRefusal = serde_json::from_value(body.clone()).unwrap();
+            assert_eq!(refusal.status(), status, "{body}");
+            assert_eq!(refusal.is_retryable(), status == 503, "{body}");
+            assert_eq!(body["state"], refusal.state());
+            assert_eq!(serde_json::to_value(&refusal).unwrap(), body);
+        }
+        for bad in [
+            json!({"state": "waking", "retryAfterMs": 1}),
+            json!({"state": "failed"}),
+            json!({"state": "sleeping"}),
+            json!({}),
+        ] {
+            assert!(
+                serde_json::from_value::<DataRouteRefusal>(bad.clone()).is_err(),
+                "{bad}"
+            );
+        }
+        assert_eq!(
+            DataRouteRefusal::Failed {
+                message: DescriptiveText::lossy("disk lost").unwrap()
+            }
+            .to_string(),
+            "failed: disk lost"
+        );
+    }
+
+    #[test]
+    fn refused_upgrades_decode_their_body_or_fall_back_on_their_status() {
+        let refused = DataRouteRefusal::from_refused_upgrade;
+        assert_eq!(
+            refused(503, Some(br#"{"state":"waking"}"#), Some(2_000)),
+            Some(DataRouteRefusal::Waking {})
+        );
+        assert_eq!(refused(410, None, None), Some(DataRouteRefusal::Gone {}));
+        assert_eq!(
+            refused(410, Some(br#"{"state":"aw"#), None),
+            Some(DataRouteRefusal::Gone {})
+        );
+        assert!(matches!(
+            refused(409, Some(b""), None),
+            Some(DataRouteRefusal::Failed { .. })
+        ));
+        assert_eq!(
+            refused(503, None, Some(4_000)),
+            Some(DataRouteRefusal::Booting {})
+        );
+        assert_eq!(refused(503, None, None), None);
+        assert_eq!(refused(502, None, Some(4_000)), None);
+    }
+
+    #[test]
+    fn retry_after_is_whole_seconds_clamped_to_the_maximum() {
+        assert_eq!(parse_retry_after_ms(" 3 "), Some(3_000));
+        assert_eq!(
+            parse_retry_after_ms("3600"),
+            Some(RETRY_AFTER_MAX_SECS * 1_000)
         );
+        assert_eq!(parse_retry_after_ms("Wed, 21 Oct 2026 07:28:00 GMT"), None);
     }
 }
diff --git a/crates/environment-protocol/src/version.rs b/crates/environment-protocol/src/version.rs
index 00a8406a1..8ab3c45a6 100644
--- a/crates/environment-protocol/src/version.rs
+++ b/crates/environment-protocol/src/version.rs
@@ -11,7 +11,7 @@
 /// Both share one number so a data-plane change also changes the number in
 /// the gateway's `registration/challenge`, which is what triggers a
 /// registered daemon's automatic upgrade.
-pub const ENVD_PROTOCOL_VERSION: u32 = 3;
+pub const ENVD_PROTOCOL_VERSION: u32 = 4;
 
 /// Version of the provider controller plane.
-pub const CONTROLLER_PROTOCOL_VERSION: u32 = 3;
+pub const CONTROLLER_PROTOCOL_VERSION: u32 = 4;
diff --git a/crates/environment-protocol/tests/serde.rs b/crates/environment-protocol/tests/serde.rs
index a49ad17db..7476c770f 100644
--- a/crates/environment-protocol/tests/serde.rs
+++ b/crates/environment-protocol/tests/serde.rs
@@ -3,8 +3,9 @@
 use environment_protocol::{
     CONTROLLER_PROTOCOL_VERSION, ENVD_PROTOCOL_VERSION,
     control::{
-        handshake::ControllerInitializeParams,
-        target::{TargetObservation, TargetPhase, TargetResponse},
+        handshake::{ControllerInitializeParams, ControllerInitializeResponse},
+        target::{CreateTargetParams, PowerState, TargetObservation, TargetPhase, TargetResponse},
+        template::ListTemplatesResponse,
     },
     data::{
         exec::{ExecInput, ExitStatus, GapReason, OutputPage},
@@ -33,9 +34,9 @@ fn decode<T: DeserializeOwned>(value: &Value) -> T {
 }
 
 #[test]
-fn both_numbers_are_three() {
-    assert_eq!(ENVD_PROTOCOL_VERSION, 3);
-    assert_eq!(CONTROLLER_PROTOCOL_VERSION, 3);
+fn both_numbers_are_four() {
+    assert_eq!(ENVD_PROTOCOL_VERSION, 4);
+    assert_eq!(CONTROLLER_PROTOCOL_VERSION, 4);
 }
 
 #[test]
@@ -150,11 +151,49 @@ fn scan_roots_are_reported_independently() {
 fn close_by_owner_answers_closed_without_a_target_id() {
     let response: TargetResponse = decode(&fixture("controller/target.close.json")["response"]);
     let TargetObservation {
-        target_id, state, ..
+        target_id,
+        phase,
+        power,
+        ..
     } = response.target;
     assert!(target_id.is_none());
-    assert_eq!(state.phase, TargetPhase::Closed);
-    assert!(state.power.is_none());
+    assert_eq!(phase, TargetPhase::Closed);
+    assert!(power.is_none());
+}
+
+#[test]
+fn owners_name_only_the_universe_and_environment() {
+    let mut params = fixture("controller/target.get.json")["params"].clone();
+    params["target"]["owner"]["bindingId"] = json!("primary");
+    assert!(
+        serde_json::from_value::<environment_protocol::control::target::GetTargetParams>(params)
+            .is_err()
+    );
+    let mut observation = fixture("controller/target.get.json")["response"].clone();
+    observation["target"]["daemonReady"] = json!(true);
+    assert!(serde_json::from_value::<TargetResponse>(observation).is_err());
+}
+
+#[test]
+fn templates_carry_power_states_and_a_default_idle_policy() {
+    let response: ListTemplatesResponse =
+        decode(&fixture("controller/template.list.json")["response"]);
+    let template = &response.templates[0];
+    assert!(template.power_states.contains(&PowerState::Paused));
+    let idle = template.idle.as_ref().expect("default idle policy");
+    assert_eq!(idle.validate(), Ok(()));
+    let create: CreateTargetParams = decode(&fixture("controller/target.create.json")["params"]);
+    assert_eq!(create.idle.expect("override").pause_after_ms, Some(600_000));
+}
+
+#[test]
+fn controller_capabilities_name_power_and_ingress_only() {
+    let response: ControllerInitializeResponse =
+        decode(&fixture("controller/initialize.json")["response"]);
+    assert!(response.capabilities.power && response.capabilities.ingress);
+    let mut routed = fixture("controller/initialize.json")["response"].clone();
+    routed["routes"] = json!({"data": "wss://p.example/routes"});
+    assert!(serde_json::from_value::<ControllerInitializeResponse>(routed).is_err());
 }
 
 #[test]
diff --git a/crates/environment-provider-incus/CLUSTER.md b/crates/environment-provider-incus/CLUSTER.md
index adcc873fb..81bd0ec7b 100644
--- a/crates/environment-provider-incus/CLUSTER.md
+++ b/crates/environment-provider-incus/CLUSTER.md
@@ -49,10 +49,10 @@ incus cluster unset member-a scheduler.instance
 
 ## Verification
 
-The live tests are opt-in. The topology and reconciliation test is
-non-destructive; `the_controller_conforms_on_live_incus` runs the controller
-conformance suite and creates and deletes one VM in the universe
-`lightspeed-conformance`, binding `incus-live`:
+The live tests are opt-in. The topology and inventory test is
+non-destructive; every other test in `tests/incus_live.rs` creates and
+deletes one VM in the universe `lightspeed-conformance`, covering controller
+and data conformance, waking on dial, and the idle loop:
 
 ```bash
 LIGHTSPEED_INCUS_PROVIDER_CONFIG=/absolute/path/provider.json \
@@ -60,7 +60,7 @@ LIGHTSPEED_INCUS_PROVIDER_CONFIG=/absolute/path/provider.json \
 ```
 
 Before production rollout, also provision an expendable environment, verify
-its `incusMember` target metadata, disable the serving API endpoint, exercise
-filesystem/process/PTY/job and public-ingress traffic through another API
-endpoint, and close the environment. Repeat with a `clusterGroup`-constrained
-template and a cordoned member.
+its placement with `incus list` (the `LOCATION` column), disable the serving
+API endpoint, exercise filesystem/process/PTY/job and public-ingress traffic
+through another API endpoint, and close the environment. Repeat with a
+`clusterGroup`-constrained template and a cordoned member.
diff --git a/crates/environment-provider-incus/README.md b/crates/environment-provider-incus/README.md
index 144fe2c1f..3a357f8a9 100644
--- a/crates/environment-provider-incus/README.md
+++ b/crates/environment-provider-incus/README.md
@@ -1,22 +1,25 @@
 # Incus environment provider
 
-`lightspeed-provider-incus` is a stateless controller, data-route relay,
-optional application edge, and single-node/cluster Incus adapter. It serves
-the controller plane of the environment protocol and depends on the public
-protocol crate, not Lightspeed's database, API implementation, harness, or
-Temporal runtime.
+`lightspeed-provider-incus` is a stateless controller, data-route relay that
+wakes powered-down targets, idle power manager, optional application edge,
+and single-node/cluster Incus adapter. It serves the controller plane of the
+environment protocol and depends on the public protocol crate, not
+Lightspeed's database, API implementation, harness, or Temporal runtime.
 
 Start from `config.example.json`. The listener serves the controller on
-`/control` and the data routes under `/routes/...`. Both require the provider
-credential: `credentialFile` names a file holding a secret of at least 32
-bytes without whitespace (a trailing newline is ignored), which Lightspeed
-presents as `Authorization: Bearer` and the provider compares in constant
-time. A missing or wrong credential is refused with HTTP 401 before the
-WebSocket upgrade. `GET /health` needs no credential. Register the same
-credential with the provider in Lightspeed. The guest envd listener has no
-authentication of its own; keep guest networks private. The Incus client
-certificate and key remain deployment files mounted into the provider
-process.
+`/control` and the data routes under
+`/routes/{universeId}/{environmentId}/{targetId}`. With `credentialFile`
+set, both require the provider credential: the file holds a secret of at
+least 32 bytes without whitespace (a trailing newline is ignored), which
+Lightspeed presents as `Authorization: Bearer` and the provider compares in
+constant time. A missing or wrong credential is refused with HTTP 401 before
+the WebSocket upgrade. Register the same credential with the provider in
+Lightspeed. Without `credentialFile` the listener checks no credential and
+Lightspeed sends none; only run it that way on a network where nothing but
+Lightspeed can reach the listener. `GET /health` needs no credential. The
+guest envd listener has no authentication of its own; keep guest networks
+private. The Incus client certificate and key remain deployment files
+mounted into the provider process.
 
 ## Incus topology
 
@@ -37,7 +40,7 @@ The provider does not form the cluster, join or remove members, initialize
 member-local storage/uplinks, evacuate instances, or recover quorum. Perform
 those operations with deployment tooling and the Incus CLI.
 
-Cluster mode uses one provider-managed OVN network per binding over the
+Cluster mode uses one provider-managed OVN network per universe over the
 existing `incus.clusterNetworkUplink`. The provider and optional public edge
 must be able to route to addresses on those networks. Standalone mode retains
 provider-managed bridge networks.
@@ -80,27 +83,30 @@ cargo run -p environment-provider-incus -- \
   --config crates/environment-provider-incus/config.example.json
 ```
 
-Register its controller as `ws://127.0.0.1:19090/control` with the credential.
-`dataRouteBase` is advertised as `routes.data` in the controller's
-`initialize`: it must reach this listener's `/routes` from the environment
-gateway, and it must use `wss://` when Lightspeed reaches the controller over
-TLS. Lightspeed connects to a data route only while an environment is being
-used; the provider then dials private envd and relays frames unchanged. The
-relay forwards WebSocket pings, counts every frame as activity, and closes a
-connection only after `relayIdleSeconds` without frames, which cannot be set
-below 60.
-Registering the provider and creating an enabled binding in Lightspeed is
-sufficient to use it. Provider configuration contains no universe or binding
-allowlist. Every request carries a binding context, and the provider lazily
-creates a deterministic restricted Incus project, managed network, ACL, and
-profile for that ownership namespace. Incus chooses and persists an unused
-subnet, so adding a universe does not require editing or restarting the
-provider.
+Register its controller as `ws://127.0.0.1:19090/control`, with the credential
+when one is configured. Lightspeed derives the data route base from the
+controller URL (`ws://127.0.0.1:19090/routes`), which is where this listener
+serves its data routes. When the environment gateway reaches the listener
+under another address, set the data route base on the provider record in
+Lightspeed instead; it must use `wss://` when Lightspeed reaches the
+controller over TLS. Lightspeed connects to a data route only while an
+environment is being used; the provider then dials private envd and relays
+frames unchanged. The relay forwards WebSocket pings, counts every frame as
+activity, and closes a connection only after `relayIdleSeconds` without
+frames, which cannot be set below 60.
+
+Registering the provider and enabling it for a universe in Lightspeed is
+sufficient to use it. Provider configuration contains no universe allowlist.
+Every request carries its universe, and the provider lazily creates a
+deterministic restricted Incus project, managed network, ACL, and profile
+for that universe; every environment of the universe lives in it. Incus
+chooses and persists an unused subnet, so adding a universe does not
+require editing or restarting the provider.
 
 The provider configuration owns only provider-wide offerings and physical
 policy: templates, blocked egress destinations, Incus topology, storage, and
 optional ingress. A blocked CIDR must not overlap a subnet Incus assigns to a
-binding network; the provider rejects that conflict during lazy reconciliation.
+universe network; the provider rejects that conflict during lazy reconciliation.
 The provider also derives sibling-network ACL rules from live Incus inventory.
 Lightspeed owns whether a universe may route to this provider. Per-universe
 commercial quotas or specialized offerings would need a future provider
@@ -129,45 +135,98 @@ runs as one background job per target, serialized per target; later calls
 report `provisioning` or `closing` while it runs, and a failed create reports
 `failed` with the Incus error as the target's `message`. Job state is in
 memory; Incus itself, read through the deterministic owner name, is the record
-of every target, so a provider restart loses nothing.
-
-- `target/create` looks up the owner's instance before applying any creation
-  policy, so deprecating a template never affects existing targets.
-- `target/get` only reads. A missing instance is `notFound`.
+of every target, so a provider restart loses nothing but the idle clock of
+powered-down targets (see below).
+
+- A target belongs to `{universeId, environmentId}`, and its instance name,
+  which is its `targetId`, is derived from that owner. `target/create` looks
+  up the owner's instance before applying any creation policy, so
+  deprecating a template never affects existing targets.
+- `target/get` only reads. A missing instance is `notFound`. Whether envd
+  answers is not part of an observation: Lightspeed proves it by dialing the
+  data route.
 - `target/close` resolves the instance by owner when no target id is given,
   stops it gracefully for up to 30 seconds, then forces the stop and deletes
   the instance, its disk, and its ingress metadata.
-- Templates report typed `resources`. `memory` and `disk` must be whole Incus
-  sizes such as `4GiB`; the provider converts them to bytes at startup.
+- `target/setPower` moves a target to `running`, `paused` (an Incus freeze)
+  or `stopped`; Incus targets cannot be `suspended`. Lightspeed calls it only
+  for a manual power change, and the provider stays the owner of power
+  afterwards.
+- Templates report typed `resources`, their `powerStates`, and their default
+  `idle` policy. `memory` and `disk` must be whole Incus sizes such as
+  `4GiB`; the provider converts them to bytes at startup.
 - Cloud-init sets `LIGHTSPEED_ENVD_STATE_DIR=/var/lib/lightspeed-envd`, so the
   daemon key and job records live outside the agent's `/workspace`.
 - Incus API failures answer `unavailable`, which the runtime retries.
-- The provider advertises `adoptTarget`, and `ingress` when an `ingress` block
-  is configured.
-
-## Adoption
-
-`target/adopt` takes over an existing Incus VM as a managed environment. The
-`sourceTarget` is `instance` or `project/instance`; the project defaults to
-`default`. Project and instance names are 1 to 63 ASCII letters, digits, and
-hyphens, without a leading or trailing hyphen. Only persistent virtual
-machines that are not already Lightspeed-managed can be adopted; containers
-and ephemeral instances are refused with `notAdoptable`.
-
-Adoption moves the VM into the binding's project under the owner's
-deterministic name and records ownership metadata. It replaces the VM's
-profiles with the binding baseline, rewrites `eth0` onto the binding's managed
-network, and disables every other local NIC. A running source is stopped
-first. A later close destroys the adopted VM like any other target, so adopt
-only machines whose disk Lightspeed may delete.
+- The provider advertises `power`, and `ingress` when an `ingress` block is
+  configured.
+
+## Waking on dial
+
+A dial of a paused or stopped target's data route wakes it: the provider
+unfreezes or starts the instance and then tries envd until it answers. The
+dial is held for at most five seconds, and a dial that arrives while a pause
+or stop is still running waits for that power-down and the wake after it
+before it tries envd. When envd answers in time the
+connection upgrades and relays as usual; otherwise the provider refuses with
+a typed JSON body and lets Lightspeed retry:
+
+| Situation | Answer |
+| --- | --- |
+| The target was powered down and is waking | 503 `{"state":"waking"}`, `Retry-After: 2` |
+| The target runs but envd does not answer yet | 503 `{"state":"booting"}`, `Retry-After: 2` |
+| No instance exists for the owner, or it is being closed | 410 `{"state":"gone"}` |
+| Incus reports the instance in its `Error` state | 409 `{"state":"failed","message":…}` |
+
+An Incus API failure during the dial answers 502 without a body.
+
+## Idle policy
+
+The provider powers idle targets down on its own clock. A template may set a
+default `idle` policy, and Lightspeed may pass another one on
+`target/create`; the target keeps the policy it was created with, recorded
+as the `user.lightspeed.idle` instance key. A policy names thresholds in
+milliseconds, non-decreasing in the order `pauseAfterMs`, `stopAfterMs`,
+`closeAfterMs`; `suspendAfterMs` is not accepted in a template here and
+never fires, because Incus targets cannot be suspended.
+
+Every `idleCheckSeconds` (default 60) the provider visits each target with a
+policy:
+
+- A running target's idle time is envd's `env/getIdle` report, read over
+  the guest network. Running processes, jobs and processes a command left
+  running hold it at zero, so they keep the target awake.
+- A paused or stopped target has no envd to ask. The provider continues
+  from the idle time it measured when it powered the target down, kept in
+  memory; after a provider restart, or for a target someone else powered
+  down, it starts from zero.
+- A target with a data connection in progress, or with a dial waking it, is
+  never powered down or closed.
+- A target a dial woke is left alone for a grace of `idleCheckSeconds`, at
+  least 30 seconds, after that dial's connection ends. Unpausing does not
+  reset envd's idle time, so the grace keeps the next pass from pausing the
+  target again before the caller's first call arrives.
+
+The most escalated threshold the idle time has reached is applied when it
+goes beyond the target's current power: pause, then stop, then close. An
+idle close deletes the instance like `target/close`; Lightspeed then sees the
+target gone and records the environment as ended by the provider. The next
+data route dial wakes a paused or stopped target.
 
 ## Conformance
 
-The ignored live test `the_controller_conforms_on_live_incus` runs the
-environment client's controller conformance suite against this provider on a
-live Incus server or cluster. It creates and deletes one VM from the first
-non-deprecated template, using the fixed universe `lightspeed-conformance` and
-binding `incus-live`:
+The ignored live tests in `tests/incus_live.rs` run against a live Incus
+server or cluster, each creating and deleting one VM from the first
+non-deprecated template in the fixed universe `lightspeed-conformance`:
+
+- `the_controller_conforms_on_live_incus` runs the environment client's
+  controller conformance suite;
+- `the_guest_envd_conforms_on_live_incus` runs the data conformance suite
+  against the guest's envd through the provider's data route;
+- `a_paused_target_wakes_on_dial_on_live_incus` pauses a target and dials it
+  awake;
+- `the_idle_loop_pauses_an_idle_target_on_live_incus` creates a target with
+  a short idle override and waits for the idle loop to pause it.
 
 ```bash
 LIGHTSPEED_INCUS_PROVIDER_CONFIG=/absolute/path/provider.json \
diff --git a/crates/environment-provider-incus/config.cluster.example.json b/crates/environment-provider-incus/config.cluster.example.json
index 779c8b2d1..a22eb87d1 100644
--- a/crates/environment-provider-incus/config.cluster.example.json
+++ b/crates/environment-provider-incus/config.cluster.example.json
@@ -1,7 +1,6 @@
 {
   "controllerListen": "127.0.0.1:19090",
   "credentialFile": "/run/secrets/lightspeed-provider-credential",
-  "dataRouteBase": "ws://127.0.0.1:19090/routes",
   "incus": {
     "mode": "cluster",
     "endpoints": [
@@ -18,6 +17,7 @@
   },
   "relayIdleSeconds": 60,
   "dialTimeoutSeconds": 10,
+  "idleCheckSeconds": 60,
   "envdPort": 19091,
   "ingress": {
     "publicBaseUrl": "https://env.example.com",
@@ -37,7 +37,11 @@
       "disk": "40GiB",
       "clusterGroup": "x86-production",
       "publicIngress": true,
-      "ingressPort": 8080
+      "ingressPort": 8080,
+      "idle": {
+        "pauseAfterMs": 1800000,
+        "stopAfterMs": 14400000
+      }
     }
   ]
 }
diff --git a/crates/environment-provider-incus/config.example.json b/crates/environment-provider-incus/config.example.json
index 8bfdedbb6..e451f619a 100644
--- a/crates/environment-provider-incus/config.example.json
+++ b/crates/environment-provider-incus/config.example.json
@@ -1,7 +1,6 @@
 {
   "controllerListen": "127.0.0.1:19090",
   "credentialFile": "/run/secrets/lightspeed-provider-credential",
-  "dataRouteBase": "ws://127.0.0.1:19090/routes",
   "incus": {
     "mode": "single",
     "endpoints": ["https://hz02.example.ts.net:8443"],
@@ -13,6 +12,7 @@
   },
   "relayIdleSeconds": 60,
   "dialTimeoutSeconds": 10,
+  "idleCheckSeconds": 60,
   "envdPort": 19091,
   "ingress": {
     "publicBaseUrl": "https://env.example.com",
@@ -31,7 +31,11 @@
       "memory": "4GiB",
       "disk": "40GiB",
       "publicIngress": true,
-      "ingressPort": 8080
+      "ingressPort": 8080,
+      "idle": {
+        "pauseAfterMs": 1800000,
+        "stopAfterMs": 14400000
+      }
     }
   ]
 }
diff --git a/crates/environment-provider-incus/image/lightspeed-envd.service b/crates/environment-provider-incus/image/lightspeed-envd.service
index 2527417f4..f7449e9c9 100644
--- a/crates/environment-provider-incus/image/lightspeed-envd.service
+++ b/crates/environment-provider-incus/image/lightspeed-envd.service
@@ -11,6 +11,9 @@ EnvironmentFile=/etc/lightspeed-envd/provider.env
 ExecStart=/usr/local/bin/lightspeed-envd
 Restart=always
 RestartSec=1
+# envd exits 3 (registration refused), 4 (environment closed) or 5
+# (superseded) when a restart cannot help.
+RestartPreventExitStatus=3 4 5
 NoNewPrivileges=true
 PrivateTmp=true
 ProtectSystem=strict
diff --git a/crates/environment-provider-incus/src/config.rs b/crates/environment-provider-incus/src/config.rs
index d15ac86e4..f338b2a4d 100644
--- a/crates/environment-provider-incus/src/config.rs
+++ b/crates/environment-provider-incus/src/config.rs
@@ -5,17 +5,22 @@ use clap::Parser;
 use environment_protocol::{
     bytes::SecretString,
     control::template::TemplateResources,
+    idle::IdlePolicy,
     ids::TemplateId,
     limits::MIN_INTERMEDIARY_IDLE_MS,
     metadata::{DescriptiveText, DisplayName},
-    routes::DataRouteBase,
 };
 use serde::{Deserialize, Serialize};
 use sha2::{Digest as _, Sha256};
 
+use crate::incus::unsupported_idle_stage;
+
 /// Shortest provider credential accepted, in bytes.
 const MIN_CREDENTIAL_BYTES: usize = 32;
 
+/// Default pause between two passes of the idle loop, in seconds.
+const DEFAULT_IDLE_CHECK_SECONDS: u64 = 60;
+
 #[derive(Parser, Debug)]
 #[command(name = "lightspeed-provider-incus", version = release_info::LONG_VERSION)]
 pub struct ProviderArgs {
@@ -28,17 +33,16 @@ pub struct ProviderArgs {
 struct RawConfig {
     controller_listen: SocketAddr,
     /// File holding the provider credential Lightspeed sends as
-    /// `Authorization: Bearer` on `/control` and every data route.
-    credential_file: PathBuf,
-    /// `routes.data` advertised in `initialize`: how Lightspeed reaches this
-    /// listener's `/routes`.
-    data_route_base: String,
+    /// `Authorization: Bearer` on `/control` and every data route. Without
+    /// one the listener checks no credential.
+    credential_file: Option<PathBuf>,
     incus: IncusConfig,
     templates: Vec<TemplatePolicy>,
     #[serde(default)]
     network: NetworkPolicy,
     relay_idle_seconds: Option<u64>,
     dial_timeout_seconds: Option<u64>,
+    idle_check_seconds: Option<u64>,
     envd_port: Option<u16>,
     ingress: Option<IngressConfig>,
 }
@@ -49,13 +53,15 @@ pub struct Config(pub(crate) Arc<ConfigInner>);
 #[derive(Debug)]
 pub struct ConfigInner {
     pub controller_listen: SocketAddr,
-    pub credential: ProviderCredential,
-    pub data_route_base: DataRouteBase,
+    /// `None`: requests are not authenticated.
+    pub credential: Option<ProviderCredential>,
     pub incus: IncusConfig,
     pub templates: BTreeMap<TemplateId, TemplatePolicy>,
     pub network: NetworkPolicy,
     pub relay_idle_seconds: u64,
     pub dial_timeout_seconds: u64,
+    /// Pause between two passes of the idle loop.
+    pub idle_check_seconds: u64,
     pub envd_port: u16,
     pub ingress: Option<IngressConfig>,
 }
@@ -70,7 +76,7 @@ pub struct IncusConfig {
     pub server_ca_pem: PathBuf,
     pub storage_pool: String,
     /// Existing physical/bridge uplink used when the provider creates its
-    /// per-binding OVN networks in cluster mode.
+    /// per-universe OVN networks in cluster mode.
     pub cluster_network_uplink: Option<String>,
     /// Trusted Incus image server used to lazily cache missing immutable
     /// fingerprints on the target node.
@@ -112,6 +118,10 @@ pub struct TemplatePolicy {
     pub ingress_port: Option<u16>,
     #[serde(default)]
     pub deprecated: bool,
+    /// Idle policy of targets whose `target/create` names none. Only stages
+    /// this provider can carry out (pause, stop, close) are accepted.
+    #[serde(default)]
+    pub idle: Option<IdlePolicy>,
     /// `cpu`, `memory` and `disk` in provider-neutral units, derived at load.
     #[serde(skip)]
     pub resources: TemplateResources,
@@ -149,9 +159,14 @@ impl ProviderArgs {
                 MIN_INTERMEDIARY_IDLE_MS / 1000
             )
         }
-        let data_route_base = DataRouteBase::new(raw.data_route_base.clone())
-            .with_context(|| format!("dataRouteBase {}", raw.data_route_base))?;
-        let credential = ProviderCredential::load(&raw.credential_file).await?;
+        let idle_check_seconds = raw.idle_check_seconds.unwrap_or(DEFAULT_IDLE_CHECK_SECONDS);
+        if idle_check_seconds == 0 {
+            bail!("idleCheckSeconds must be positive")
+        }
+        let credential = match &raw.credential_file {
+            Some(path) => Some(ProviderCredential::load(path).await?),
+            None => None,
+        };
         let mut templates = BTreeMap::new();
         for mut template in raw.templates {
             if template.cluster_group.is_some() && raw.incus.mode != IncusMode::Cluster {
@@ -170,6 +185,10 @@ impl ProviderArgs {
                     template.template_id
                 )
             }
+            if let Some(idle) = &template.idle {
+                validate_template_idle(idle)
+                    .with_context(|| format!("template {} idle", template.template_id))?;
+            }
             if let Some(port) = template.ingress_port {
                 if port == 0 || port == envd_port || matches!(port, 22 | 2375 | 2376) {
                     bail!(
@@ -217,12 +236,12 @@ impl ProviderArgs {
         Ok(Config(Arc::new(ConfigInner {
             controller_listen: raw.controller_listen,
             credential,
-            data_route_base,
             incus: raw.incus,
             templates,
             network: raw.network,
             relay_idle_seconds,
             dial_timeout_seconds: raw.dial_timeout_seconds.unwrap_or(10).max(1),
+            idle_check_seconds,
             envd_port,
             ingress: raw.ingress,
         })))
@@ -284,6 +303,16 @@ impl std::fmt::Debug for ProviderCredential {
     }
 }
 
+/// A template's default idle policy: valid, and every power stage it sets
+/// one this provider can move a target to.
+fn validate_template_idle(idle: &IdlePolicy) -> anyhow::Result<()> {
+    idle.validate()?;
+    if let Some(action) = unsupported_idle_stage(idle) {
+        bail!("the Incus provider cannot carry out the {action} stage")
+    }
+    Ok(())
+}
+
 /// Bytes of an Incus size string: a whole number with an optional unit
 /// (`B`, decimal `kB` to `EB`, binary `KiB` to `EiB`), as Incus accepts
 /// for `limits.memory` and disk `size`.
@@ -346,7 +375,7 @@ fn validate_incus(incus: &IncusConfig) -> anyhow::Result<()> {
             .as_deref()
             .is_none_or(str::is_empty)
     {
-        bail!("incus cluster mode requires clusterNetworkUplink for OVN binding networks")
+        bail!("incus cluster mode requires clusterNetworkUplink for OVN universe networks")
     }
     if incus.mode == IncusMode::Single && incus.cluster_network_uplink.is_some() {
         bail!("incus clusterNetworkUplink is only valid in cluster mode")
@@ -400,6 +429,8 @@ impl Config {
 
 #[cfg(test)]
 mod tests {
+    use environment_protocol::idle::IdlePolicyError;
+
     use super::*;
 
     const CREDENTIAL: &str = "0123456789abcdef0123456789abcdef";
@@ -407,25 +438,26 @@ mod tests {
     fn base() -> serde_json::Value {
         serde_json::json!({
             "controllerListen":"127.0.0.1:0",
-            "dataRouteBase":"ws://127.0.0.1:19090/routes",
             "incus":{"mode":"single","endpoints":["https://incus.test"],"clientCertificatePem":"cert","clientPrivateKeyPem":"key","serverCaPem":"ca","storagePool":"default"},
             "network":{"deniedEgressCidrs":["100.64.0.0/10"]},
             "templates":[{"templateId":"dev-small-v1","displayName":"Small","imageFingerprint":"abc","cpu":2,"memory":"4GiB","disk":"40GiB"}]
         })
     }
 
-    /// Write `document` (with `credentialFile` pointing at a fresh file
-    /// holding `credential`) and load it.
+    /// Write `document` and load it. With `credential`, `credentialFile`
+    /// points at a fresh file holding it.
     async fn load(
         directory: &tempfile::TempDir,
         mut document: serde_json::Value,
-        credential: &str,
+        credential: Option<&str>,
     ) -> anyhow::Result<Config> {
-        let credential_path = directory.path().join("credential");
-        tokio::fs::write(&credential_path, format!("{credential}\n"))
-            .await
-            .unwrap();
-        document["credentialFile"] = serde_json::json!(credential_path);
+        if let Some(credential) = credential {
+            let credential_path = directory.path().join("credential");
+            tokio::fs::write(&credential_path, format!("{credential}\n"))
+                .await
+                .unwrap();
+            document["credentialFile"] = serde_json::json!(credential_path);
+        }
         let path = directory.path().join("provider.json");
         tokio::fs::write(&path, serde_json::to_vec(&document).unwrap())
             .await
@@ -434,9 +466,11 @@ mod tests {
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn config_loads_provider_wide_templates_without_universe_bindings() {
+    async fn config_loads_provider_wide_templates_without_universe_lists() {
         let directory = tempfile::tempdir().expect("tempdir");
-        let config = load(&directory, base(), CREDENTIAL).await.expect("config");
+        let config = load(&directory, base(), Some(CREDENTIAL))
+            .await
+            .expect("config");
         let template = &config.templates[&TemplateId::new("dev-small-v1").unwrap()];
         assert_eq!(
             template.resources,
@@ -446,12 +480,11 @@ mod tests {
                 disk_bytes: Some(40 << 30),
             }
         );
+        assert_eq!(template.idle, None);
         assert_eq!(config.network.denied_egress_cidrs, ["100.64.0.0/10"]);
         assert_eq!(config.relay_idle_seconds, 60);
-        assert_eq!(
-            config.data_route_base.as_str(),
-            "ws://127.0.0.1:19090/routes"
-        );
+        assert_eq!(config.idle_check_seconds, 60);
+        assert!(config.credential.is_some());
 
         let mut duplicate = base();
         let first_template = duplicate["templates"][0].clone();
@@ -459,7 +492,7 @@ mod tests {
             .as_array_mut()
             .unwrap()
             .push(first_template);
-        assert!(load(&directory, duplicate, CREDENTIAL).await.is_err());
+        assert!(load(&directory, duplicate, Some(CREDENTIAL)).await.is_err());
     }
 
     #[tokio::test(flavor = "current_thread")]
@@ -467,7 +500,7 @@ mod tests {
         let directory = tempfile::tempdir().expect("tempdir");
         let mut document = base();
         document["network"]["deniedEgressCidrs"] = serde_json::json!(["not-a-cidr"]);
-        assert!(load(&directory, document, CREDENTIAL).await.is_err());
+        assert!(load(&directory, document, None).await.is_err());
     }
 
     #[tokio::test(flavor = "current_thread")]
@@ -476,41 +509,52 @@ mod tests {
         let mut document = base();
         document["incus"]["endpoints"] =
             serde_json::json!(["https://one.test", "https://two.test"]);
-        assert!(
-            load(&directory, document.clone(), CREDENTIAL)
-                .await
-                .is_err()
-        );
+        assert!(load(&directory, document.clone(), None).await.is_err());
 
         document["incus"]["mode"] = serde_json::json!("cluster");
         document["incus"]["clusterNetworkUplink"] = serde_json::json!("UPLINK");
         document["templates"][0]["clusterGroup"] = serde_json::json!("x86-production");
-        let config = load(&directory, document, CREDENTIAL)
+        let config = load(&directory, document, None)
             .await
             .expect("cluster config");
         assert_eq!(config.incus_mode_name(), "cluster");
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn config_requires_a_strong_credential_and_a_valid_route_base() {
+    async fn a_configured_credential_must_be_strong() {
         let directory = tempfile::tempdir().expect("tempdir");
-        assert!(load(&directory, base(), "short").await.is_err());
+        assert!(load(&directory, base(), Some("short")).await.is_err());
         assert!(
-            load(&directory, base(), "0123456789abcdef 0123456789abcdef")
-                .await
-                .is_err()
+            load(
+                &directory,
+                base(),
+                Some("0123456789abcdef 0123456789abcdef")
+            )
+            .await
+            .is_err()
         );
-        let mut document = base();
-        document["dataRouteBase"] = serde_json::json!("http://127.0.0.1:19090/routes/");
-        assert!(load(&directory, document, CREDENTIAL).await.is_err());
-        let mut document = base();
-        document.as_object_mut().unwrap().remove("credentialFile");
-        document.as_object_mut().unwrap().remove("dataRouteBase");
-        let path = directory.path().join("missing.json");
-        tokio::fs::write(&path, serde_json::to_vec(&document).unwrap())
+        let mut missing_file = base();
+        missing_file["credentialFile"] = serde_json::json!(directory.path().join("absent"));
+        assert!(load(&directory, missing_file, None).await.is_err());
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn the_credential_is_optional() {
+        let directory = tempfile::tempdir().expect("tempdir");
+        let config = load(&directory, base(), None)
             .await
-            .unwrap();
-        assert!(ProviderArgs { config: path }.load().await.is_err());
+            .expect("config without a credential");
+        assert!(config.credential.is_none());
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn the_data_route_base_is_not_provider_config() {
+        // Lightspeed derives the data route base from the controller URL or
+        // takes it from the provider record; the provider has no say.
+        let directory = tempfile::tempdir().expect("tempdir");
+        let mut document = base();
+        document["dataRouteBase"] = serde_json::json!("ws://127.0.0.1:19090/routes");
+        assert!(load(&directory, document, None).await.is_err());
     }
 
     #[tokio::test(flavor = "current_thread")]
@@ -518,18 +562,60 @@ mod tests {
         let directory = tempfile::tempdir().expect("tempdir");
         let mut document = base();
         document["relayIdleSeconds"] = serde_json::json!(59);
-        assert!(
-            load(&directory, document.clone(), CREDENTIAL)
-                .await
-                .is_err()
-        );
+        assert!(load(&directory, document.clone(), None).await.is_err());
         document["relayIdleSeconds"] = serde_json::json!(1900);
-        let config = load(&directory, document, CREDENTIAL)
-            .await
-            .expect("config");
+        let config = load(&directory, document, None).await.expect("config");
         assert_eq!(config.relay_idle_seconds, 1900);
     }
 
+    #[tokio::test(flavor = "current_thread")]
+    async fn the_idle_check_interval_is_positive() {
+        let directory = tempfile::tempdir().expect("tempdir");
+        let mut document = base();
+        document["idleCheckSeconds"] = serde_json::json!(0);
+        assert!(load(&directory, document.clone(), None).await.is_err());
+        document["idleCheckSeconds"] = serde_json::json!(15);
+        let config = load(&directory, document, None).await.expect("config");
+        assert_eq!(config.idle_check_seconds, 15);
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn template_idle_policies_are_validated_at_load() {
+        let directory = tempfile::tempdir().expect("tempdir");
+        let mut document = base();
+        document["templates"][0]["idle"] =
+            serde_json::json!({"pauseAfterMs": 600000, "stopAfterMs": 3600000});
+        let config = load(&directory, document, None).await.expect("config");
+        assert_eq!(
+            config.templates[&TemplateId::new("dev-small-v1").unwrap()].idle,
+            Some(IdlePolicy {
+                pause_after_ms: Some(600_000),
+                stop_after_ms: Some(3_600_000),
+                ..IdlePolicy::default()
+            })
+        );
+
+        for idle in [
+            serde_json::json!({}),
+            serde_json::json!({"pauseAfterMs": 0}),
+            serde_json::json!({"pauseAfterMs": 600000, "stopAfterMs": 60000}),
+            // Incus targets cannot be suspended.
+            serde_json::json!({"suspendAfterMs": 600000}),
+            serde_json::json!({"pauseAfterMs": 600000, "unknown": 1}),
+        ] {
+            let mut document = base();
+            document["templates"][0]["idle"] = idle.clone();
+            assert!(load(&directory, document, None).await.is_err(), "{idle}");
+        }
+        assert_eq!(
+            validate_template_idle(&IdlePolicy::default())
+                .unwrap_err()
+                .downcast::<IdlePolicyError>()
+                .unwrap(),
+            IdlePolicyError::Empty
+        );
+    }
+
     #[tokio::test(flavor = "current_thread")]
     async fn template_sizes_and_descriptions_are_validated_at_load() {
         let directory = tempfile::tempdir().expect("tempdir");
@@ -542,10 +628,7 @@ mod tests {
         ] {
             let mut document = base();
             document["templates"][0][field] = value;
-            assert!(
-                load(&directory, document, CREDENTIAL).await.is_err(),
-                "{field}"
-            );
+            assert!(load(&directory, document, None).await.is_err(), "{field}");
         }
     }
 
diff --git a/crates/environment-provider-incus/src/idle.rs b/crates/environment-provider-incus/src/idle.rs
new file mode 100644
index 000000000..c3c36c58d
--- /dev/null
+++ b/crates/environment-provider-incus/src/idle.rs
@@ -0,0 +1,604 @@
+//! The provider's idle loop: it powers idle targets down and closes them on
+//! the provider's own clock.
+//!
+//! Every `idleCheckSeconds` the loop visits each owned instance that has an
+//! idle policy (recorded as `user.lightspeed.idle` at `target/create`) and
+//! no data connection in progress. A running instance's idle duration is
+//! envd's `env/getIdle` `idleForMs`, read over the guest network, so running
+//! processes, jobs and leftover process groups keep it awake. A paused or
+//! stopped instance has no envd to ask: the loop continues from the idle
+//! duration it recorded when it powered the instance down, plus the time
+//! since, kept in memory. A provider restart, or an instance powered down
+//! by anyone else, starts that clock at zero.
+//!
+//! A data route dial that woke an instance gives it a grace of at least one
+//! `idleCheckSeconds` once the dial's connection ends ([`Wakes`]). Unpausing
+//! does not reset envd's clock, and a dial that only observes (the
+//! readiness probe's `initialize`) is no `use`, so without the grace the
+//! next pass could power the instance down again before the caller's first
+//! call arrives.
+//!
+//! The most escalated due stage ([`IdlePolicy::due_action`]) beyond the
+//! instance's current power runs as the target's background job, so it is
+//! serialized with controller calls and with the wake a data route dial
+//! starts. An idle close deletes the instance; `target/get` then answers
+//! `notFound`, which Lightspeed records as the provider ending the target.
+
+use std::{
+    collections::HashMap,
+    sync::{Arc, Mutex},
+    time::{Duration, Instant},
+};
+
+use anyhow::{Context as _, bail};
+use environment_protocol::{
+    ENVD_PROTOCOL_VERSION,
+    control::target::PowerState,
+    data::{
+        handshake::InitializeParams,
+        idle::{GetIdleParams, GetIdleResponse},
+    },
+    idle::{IdleAction, IdlePolicy},
+    jsonrpc::{self, Id, Request},
+    manifest::{DataInitialize, EnvGetIdle},
+};
+use futures_util::{SinkExt as _, StreamExt as _};
+use serde::{Serialize, de::DeserializeOwned};
+use serde_json::Value;
+use tokio_tungstenite::tungstenite::Message;
+
+use crate::{
+    Config, IncusBackend,
+    incus::{InstanceStatus, OwnedTarget, SUPPORTED_POWER_STATES},
+    relay::{self, GuestSocket},
+    server::{self, App, WorkKind},
+};
+
+/// Bound on one guest's whole `initialize` and `env/getIdle` exchange.
+const IDLE_READ_TIMEOUT: Duration = Duration::from_secs(10);
+
+/// The least wake grace, whatever `idleCheckSeconds`: room for a caller's
+/// retries after a `waking` refusal and its first call.
+const MIN_WAKE_GRACE: Duration = Duration::from_secs(30);
+
+/// The wake grace for an idle loop that looks every `idle_check_seconds`.
+pub(crate) fn wake_grace(idle_check_seconds: u64) -> Duration {
+    Duration::from_secs(idle_check_seconds).max(MIN_WAKE_GRACE)
+}
+
+/// When data route dials last woke instances, by instance name. The idle
+/// loop leaves an instance alone for the grace after its last wake.
+#[derive(Clone, Debug)]
+pub(crate) struct Wakes {
+    grace: Duration,
+    at: Arc<Mutex<HashMap<String, Instant>>>,
+}
+
+impl Wakes {
+    pub(crate) fn new(grace: Duration) -> Self {
+        Self {
+            grace,
+            at: Arc::default(),
+        }
+    }
+
+    /// Record that a dial which woke `name` ended at `at`.
+    pub(crate) fn record(&self, name: &str, at: Instant) {
+        let mut wakes = self.lock();
+        let entry = wakes.entry(name.to_owned()).or_insert(at);
+        *entry = (*entry).max(at);
+    }
+
+    /// True while `name` is within the grace of its last wake at `now`.
+    pub(crate) fn within_grace(&self, name: &str, now: Instant) -> bool {
+        self.lock()
+            .get(name)
+            .is_some_and(|at| now.saturating_duration_since(*at) < self.grace)
+    }
+
+    /// Forget the wakes whose grace ended by `now`.
+    fn prune(&self, now: Instant) {
+        self.lock()
+            .retain(|_, at| now.saturating_duration_since(*at) < self.grace);
+    }
+
+    fn lock(&self) -> std::sync::MutexGuard<'_, HashMap<String, Instant>> {
+        self.at
+            .lock()
+            .unwrap_or_else(|poisoned| poisoned.into_inner())
+    }
+}
+
+/// Run the idle loop until the task is aborted.
+pub(crate) async fn run<B: IncusBackend>(app: App<B>) {
+    let interval = Duration::from_secs(app.config.idle_check_seconds);
+    let mut clock = IdleClock::default();
+    loop {
+        tokio::time::sleep(interval).await;
+        if let Err(error) = check_once(&app, &mut clock, Instant::now()).await {
+            eprintln!("warning: idle check failed: {error:#}");
+        }
+    }
+}
+
+/// Idle durations of the instances the loop powered down, by instance name.
+#[derive(Debug, Default)]
+pub(crate) struct IdleClock(HashMap<String, PoweredDown>);
+
+#[derive(Clone, Copy, Debug)]
+struct PoweredDown {
+    /// The idle duration when the clock started.
+    idle_for_ms: u64,
+    since: Instant,
+}
+
+impl IdleClock {
+    /// The idle duration of a powered-down instance at `now`, starting its
+    /// clock at zero when none runs.
+    fn powered_down_idle(&mut self, name: &str, now: Instant) -> u64 {
+        let entry = *self.0.entry(name.to_owned()).or_insert(PoweredDown {
+            idle_for_ms: 0,
+            since: now,
+        });
+        let elapsed = u64::try_from(now.saturating_duration_since(entry.since).as_millis())
+            .unwrap_or(u64::MAX);
+        entry.idle_for_ms.saturating_add(elapsed)
+    }
+}
+
+/// One pass over every owned instance.
+pub(crate) async fn check_once<B: IncusBackend>(
+    app: &App<B>,
+    clock: &mut IdleClock,
+    now: Instant,
+) -> anyhow::Result<()> {
+    let targets = app.backend.list_all_owned().await?;
+    app.wakes.prune(now);
+    clock
+        .0
+        .retain(|name, _| targets.iter().any(|target| target.name() == name));
+    for target in targets {
+        let name = target.name().to_owned();
+        let Some(policy) = target.idle.as_ref() else {
+            clock.0.remove(&name);
+            continue;
+        };
+        if app.relays.active(&name) {
+            // In use; a dial wakes the instance, so no powered-down clock
+            // applies any more.
+            clock.0.remove(&name);
+            continue;
+        }
+        if app.work.busy(&name) {
+            continue;
+        }
+        if app.wakes.within_grace(&name, now) {
+            // Just woken; its powered-down clock ended with the wake.
+            clock.0.remove(&name);
+            continue;
+        }
+        let (current, idle_for_ms) = match target.status {
+            InstanceStatus::Running => {
+                clock.0.remove(&name);
+                match read_idle(&app.config, &target).await {
+                    Ok(report) => (PowerState::Running, report.idle_for_ms),
+                    // Booting, or envd not answering: nothing to decide on.
+                    Err(_) => continue,
+                }
+            }
+            InstanceStatus::Frozen => (PowerState::Paused, clock.powered_down_idle(&name, now)),
+            InstanceStatus::Stopped => (PowerState::Stopped, clock.powered_down_idle(&name, now)),
+            // Transitional, failed or unknown: look again next pass.
+            _ => continue,
+        };
+        let Some(action) = escalation(policy, current, idle_for_ms) else {
+            continue;
+        };
+        // A data connection may have started while envd was asked.
+        if app.relays.active(&name) || app.work.busy(&name) {
+            continue;
+        }
+        apply(app, &target, action);
+        match action.power_state() {
+            Some(_) => {
+                clock.0.insert(
+                    name,
+                    PoweredDown {
+                        idle_for_ms,
+                        since: now,
+                    },
+                );
+            }
+            None => {
+                clock.0.remove(&name);
+            }
+        }
+    }
+    Ok(())
+}
+
+/// The due stage of `policy` that takes a target beyond `current`, if any:
+/// a paused target may still be stopped or closed, a stopped one only
+/// closed.
+fn escalation(policy: &IdlePolicy, current: PowerState, idle_for_ms: u64) -> Option<IdleAction> {
+    let action = policy.due_action(idle_for_ms, &SUPPORTED_POWER_STATES)?;
+    let depth = |power: PowerState| match power {
+        PowerState::Running => 0,
+        PowerState::Paused => 1,
+        PowerState::Suspended => 2,
+        PowerState::Stopped => 3,
+    };
+    let target_depth = action.power_state().map_or(4, depth);
+    (target_depth > depth(current)).then_some(action)
+}
+
+/// Start `action` as the target's background job.
+fn apply<B: IncusBackend>(app: &App<B>, target: &OwnedTarget, action: IdleAction) {
+    let universe_id = target.universe();
+    let name = target.name();
+    match action.power_state() {
+        Some(power) => app.work.start(
+            name,
+            WorkKind::Power(power),
+            server::power_job(&app.backend, universe_id, name, power),
+        ),
+        None => app.work.start(
+            name,
+            WorkKind::Close,
+            server::close_job(&app.backend, universe_id, name),
+        ),
+    }
+}
+
+/// envd's idle report of a running guest, over a data connection of the
+/// provider's own. `initialize` and `env/getIdle` are observations, so the
+/// exchange does not reset the idle clock it reads.
+pub(crate) async fn read_idle(
+    config: &Config,
+    target: &OwnedTarget,
+) -> anyhow::Result<GetIdleResponse> {
+    tokio::time::timeout(IDLE_READ_TIMEOUT, async {
+        let mut guest = relay::dial_guest(config, target).await?;
+        let report = exchange(&mut guest).await;
+        let _ = guest.close(None).await;
+        report
+    })
+    .await
+    .context("env/getIdle timed out")?
+}
+
+async fn exchange(guest: &mut GuestSocket) -> anyhow::Result<GetIdleResponse> {
+    let initialized: Value = call(
+        guest,
+        1,
+        DataInitialize::NAME,
+        &InitializeParams {
+            protocol_version: ENVD_PROTOCOL_VERSION,
+            client_info: server::server_info(),
+        },
+    )
+    .await
+    .context("initialize")?;
+    // envd refuses another version with `versionMismatch`; a matching
+    // version is all the provider needs from the handshake.
+    let version = initialized.get("protocolVersion").and_then(Value::as_u64);
+    if version != Some(u64::from(ENVD_PROTOCOL_VERSION)) {
+        bail!("envd answered initialize with protocol version {version:?}")
+    }
+    call(guest, 2, EnvGetIdle::NAME, &GetIdleParams::default())
+        .await
+        .context("env/getIdle")
+}
+
+/// Send one request and read frames until its response arrives.
+async fn call<P: Serialize, R: DeserializeOwned>(
+    guest: &mut GuestSocket,
+    id: i64,
+    method: &str,
+    params: &P,
+) -> anyhow::Result<R> {
+    let request = Request::new(Id::Number(id), method, params)?;
+    guest.send(Message::Text(request.to_text().into())).await?;
+    while let Some(frame) = guest.next().await {
+        let Message::Text(text) = frame? else {
+            continue;
+        };
+        match jsonrpc::parse(text.as_str()) {
+            Ok(jsonrpc::Message::Response(response)) if response.id == Some(Id::Number(id)) => {
+                return Ok(response.decode()?);
+            }
+            // Notifications, and anything not answering this request.
+            Ok(_) => {}
+            Err(rejection) => bail!("envd sent an unreadable frame: {}", rejection.error),
+        }
+    }
+    bail!("envd closed the connection before answering {method}")
+}
+
+#[cfg(test)]
+mod tests {
+    use environment_protocol::jsonrpc::Response;
+
+    use super::*;
+    use crate::{
+        policy::{self, tests::owner},
+        server::tests::{CREDENTIAL, FakeBackend, config_with},
+    };
+
+    fn policy() -> IdlePolicy {
+        IdlePolicy {
+            pause_after_ms: Some(1_000),
+            stop_after_ms: Some(10_000),
+            close_after_ms: Some(100_000),
+            ..IdlePolicy::default()
+        }
+    }
+
+    #[test]
+    fn only_stages_beyond_the_current_power_are_due() {
+        let policy = policy();
+        assert_eq!(escalation(&policy, PowerState::Running, 999), None);
+        assert_eq!(
+            escalation(&policy, PowerState::Running, 1_000),
+            Some(IdleAction::Pause)
+        );
+        assert_eq!(escalation(&policy, PowerState::Paused, 5_000), None);
+        assert_eq!(
+            escalation(&policy, PowerState::Paused, 10_000),
+            Some(IdleAction::Stop)
+        );
+        assert_eq!(
+            escalation(&policy, PowerState::Running, 10_000),
+            Some(IdleAction::Stop)
+        );
+        assert_eq!(escalation(&policy, PowerState::Stopped, 50_000), None);
+        assert_eq!(
+            escalation(&policy, PowerState::Stopped, 100_000),
+            Some(IdleAction::Close)
+        );
+        // Incus cannot suspend, so a suspend stage never fires here.
+        let suspend = IdlePolicy {
+            suspend_after_ms: Some(1_000),
+            ..IdlePolicy::default()
+        };
+        assert_eq!(escalation(&suspend, PowerState::Running, 5_000), None);
+    }
+
+    #[test]
+    fn the_powered_down_clock_starts_at_zero_and_advances() {
+        let mut clock = IdleClock::default();
+        let start = Instant::now();
+        assert_eq!(clock.powered_down_idle("a", start), 0);
+        assert_eq!(
+            clock.powered_down_idle("a", start + Duration::from_millis(1_500)),
+            1_500
+        );
+        clock.0.insert(
+            "b".to_owned(),
+            PoweredDown {
+                idle_for_ms: 4_000,
+                since: start,
+            },
+        );
+        assert_eq!(
+            clock.powered_down_idle("b", start + Duration::from_secs(1)),
+            5_000
+        );
+    }
+
+    fn app_with(port: u16) -> (App<FakeBackend>, FakeBackend) {
+        let backend = FakeBackend::default();
+        (
+            App::new(config_with(port, Some(CREDENTIAL)), backend.clone()),
+            backend,
+        )
+    }
+
+    async fn settle(app: &App<FakeBackend>, name: &str) {
+        tokio::time::timeout(Duration::from_secs(2), async {
+            while app.work.busy(name) {
+                tokio::time::sleep(Duration::from_millis(5)).await;
+            }
+        })
+        .await
+        .expect("the idle job finishes");
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn a_powered_down_target_escalates_on_the_provider_clock_and_closes() {
+        let (app, backend) = app_with(19091);
+        let owner = owner("u", "e");
+        let name = policy::instance_name(&owner);
+        backend.insert(&owner, "small", InstanceStatus::Frozen);
+        backend.update(&owner, |target| target.idle = Some(policy()));
+        let mut clock = IdleClock::default();
+        let start = Instant::now();
+
+        // The first look starts the clock; nothing is due at zero.
+        check_once(&app, &mut clock, start).await.unwrap();
+        assert!(backend.power_calls.lock().unwrap().is_empty());
+
+        check_once(&app, &mut clock, start + Duration::from_secs(10))
+            .await
+            .unwrap();
+        settle(&app, &name).await;
+        assert_eq!(
+            backend.power_calls.lock().unwrap().as_slice(),
+            [PowerState::Stopped]
+        );
+        assert_eq!(backend.get(&owner).unwrap().status, InstanceStatus::Stopped);
+
+        // The clock continues from the stop, not from zero.
+        check_once(&app, &mut clock, start + Duration::from_secs(100))
+            .await
+            .unwrap();
+        settle(&app, &name).await;
+        assert!(backend.get(&owner).is_none());
+        assert_eq!(backend.deletes.load(std::sync::atomic::Ordering::SeqCst), 1);
+        assert!(clock.0.is_empty());
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn targets_without_a_policy_or_in_use_are_left_alone() {
+        let (app, backend) = app_with(19091);
+        let unpoliced = owner("u", "unpoliced");
+        backend.insert(&unpoliced, "small", InstanceStatus::Frozen);
+        let relayed = owner("u", "relayed");
+        backend.insert(&relayed, "small", InstanceStatus::Frozen);
+        backend.update(&relayed, |target| target.idle = Some(policy()));
+        let _hold = app.relays.hold(&policy::instance_name(&relayed));
+        let mut clock = IdleClock::default();
+        let start = Instant::now();
+        for offset in [0, 1_000] {
+            check_once(&app, &mut clock, start + Duration::from_secs(offset))
+                .await
+                .unwrap();
+        }
+        assert!(backend.power_calls.lock().unwrap().is_empty());
+        assert!(backend.get(&unpoliced).is_some());
+        assert!(backend.get(&relayed).is_some());
+    }
+
+    /// A guest envd stand-in that answers `initialize` and reports
+    /// `idle_for_ms` from `env/getIdle`. Returns its port.
+    async fn idle_envd(idle_for_ms: u64) -> u16 {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let port = listener.local_addr().unwrap().port();
+        tokio::spawn(async move {
+            while let Ok((stream, _)) = listener.accept().await {
+                tokio::spawn(async move {
+                    let Ok(mut socket) = tokio_tungstenite::accept_async(stream).await else {
+                        return;
+                    };
+                    while let Some(Ok(Message::Text(text))) = socket.next().await {
+                        let Ok(jsonrpc::Message::Request(request)) = jsonrpc::parse(text.as_str())
+                        else {
+                            continue;
+                        };
+                        let result = match request.method.as_str() {
+                            DataInitialize::NAME => {
+                                serde_json::json!({"protocolVersion": ENVD_PROTOCOL_VERSION})
+                            }
+                            EnvGetIdle::NAME => serde_json::to_value(GetIdleResponse {
+                                idle_for_ms,
+                                ..GetIdleResponse::default()
+                            })
+                            .unwrap(),
+                            _ => continue,
+                        };
+                        let response = Response::success(request.id, &result);
+                        if socket
+                            .send(Message::Text(response.to_text().into()))
+                            .await
+                            .is_err()
+                        {
+                            return;
+                        }
+                    }
+                });
+            }
+        });
+        port
+    }
+
+    fn running(backend: &FakeBackend, environment: &str) -> crate::incus::OwnedTarget {
+        let owner = owner("u", environment);
+        backend.insert(&owner, "small", InstanceStatus::Running);
+        backend.update(&owner, |target| {
+            target.idle = Some(policy());
+            target.ipv4_address = Some("127.0.0.1".to_owned());
+        });
+        backend.get(&owner).unwrap()
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn a_running_target_is_paused_by_its_envd_idle_report() {
+        let port = idle_envd(5_000).await;
+        let (app, backend) = app_with(port);
+        let target = running(&backend, "e");
+        assert_eq!(
+            read_idle(&app.config, &target).await.unwrap().idle_for_ms,
+            5_000
+        );
+        let mut clock = IdleClock::default();
+        let now = Instant::now();
+        check_once(&app, &mut clock, now).await.unwrap();
+        settle(&app, target.name()).await;
+        assert_eq!(
+            backend.power_calls.lock().unwrap().as_slice(),
+            [PowerState::Paused]
+        );
+        // The provider clock continues from envd's report.
+        assert_eq!(
+            clock.powered_down_idle(target.name(), now + Duration::from_secs(5)),
+            10_000
+        );
+    }
+
+    #[test]
+    fn the_wake_grace_covers_at_least_one_idle_check() {
+        assert_eq!(wake_grace(1), MIN_WAKE_GRACE);
+        assert_eq!(wake_grace(600), Duration::from_secs(600));
+        let wakes = Wakes::new(Duration::from_secs(60));
+        let start = Instant::now();
+        wakes.record("a", start + Duration::from_secs(10));
+        // An earlier record does not shorten the grace.
+        wakes.record("a", start);
+        assert!(wakes.within_grace("a", start + Duration::from_secs(69)));
+        assert!(!wakes.within_grace("a", start + Duration::from_secs(70)));
+        assert!(!wakes.within_grace("b", start));
+        wakes.prune(start + Duration::from_secs(70));
+        assert!(wakes.lock().is_empty());
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn a_freshly_woken_target_is_left_alone_for_the_wake_grace() {
+        // Unpausing keeps envd's idle clock from before the pause.
+        let port = idle_envd(5_000).await;
+        let (app, backend) = app_with(port);
+        let target = running(&backend, "e");
+        let woke = Instant::now();
+        app.wakes.record(target.name(), woke);
+        let mut clock = IdleClock::default();
+        check_once(&app, &mut clock, woke).await.unwrap();
+        assert!(backend.power_calls.lock().unwrap().is_empty());
+
+        check_once(
+            &app,
+            &mut clock,
+            woke + wake_grace(app.config.idle_check_seconds),
+        )
+        .await
+        .unwrap();
+        settle(&app, target.name()).await;
+        assert_eq!(
+            backend.power_calls.lock().unwrap().as_slice(),
+            [PowerState::Paused]
+        );
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn running_work_reported_by_envd_keeps_a_target_awake() {
+        // envd holds idleForMs at zero while processes, jobs or leftover
+        // process groups run.
+        let port = idle_envd(0).await;
+        let (app, backend) = app_with(port);
+        running(&backend, "e");
+        let mut clock = IdleClock::default();
+        check_once(&app, &mut clock, Instant::now()).await.unwrap();
+        assert!(backend.power_calls.lock().unwrap().is_empty());
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn a_running_target_without_a_listening_envd_is_left_alone() {
+        let port = {
+            let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+            listener.local_addr().unwrap().port()
+        };
+        let (app, backend) = app_with(port);
+        running(&backend, "e");
+        let mut clock = IdleClock::default();
+        check_once(&app, &mut clock, Instant::now()).await.unwrap();
+        assert!(backend.power_calls.lock().unwrap().is_empty());
+    }
+}
diff --git a/crates/environment-provider-incus/src/incus.rs b/crates/environment-provider-incus/src/incus.rs
index d256a7091..3877af87e 100644
--- a/crates/environment-provider-incus/src/incus.rs
+++ b/crates/environment-provider-incus/src/incus.rs
@@ -15,10 +15,9 @@ use serde_json::{Value, json};
 use thiserror::Error;
 
 use environment_protocol::{
-    control::target::{BindingRef, PowerState, TargetOwner},
-    ids::{
-        BindingId, EnvironmentId, IncarnationId, ProviderNativeRef, ProviderTargetId, UniverseId,
-    },
+    control::target::{PowerState, TargetOwner},
+    idle::{IdleAction, IdlePolicy},
+    ids::{EnvironmentId, ProviderTargetId, UniverseId},
 };
 
 use crate::{
@@ -33,8 +32,9 @@ pub struct OwnedTarget {
     pub target_id: ProviderTargetId,
     pub owner: TargetOwner,
     pub template_id: String,
-    pub image_fingerprint: String,
-    pub adoption_source: Option<String>,
+    /// The idle policy the target was created with: the `target/create`
+    /// override or the template's default. `None` keeps it awake.
+    pub idle: Option<IdlePolicy>,
     pub status: InstanceStatus,
     pub ipv4_address: Option<String>,
     pub ingress_hostname: Option<String>,
@@ -49,8 +49,8 @@ impl OwnedTarget {
         self.target_id.as_str()
     }
 
-    pub fn binding(&self) -> BindingRef {
-        policy::binding_of(&self.owner)
+    pub fn universe(&self) -> &UniverseId {
+        &self.owner.universe_id
     }
 }
 
@@ -82,44 +82,33 @@ impl InstanceStatus {
     }
 }
 
-/// What an adoption source is, checked before any change is made.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub enum AdoptionSource {
-    Missing,
-    /// A stopped or running, persistent, unmanaged virtual machine.
-    Adoptable,
-    /// Already managed by Lightspeed, so it belongs to some owner.
-    Managed,
-    /// It exists but cannot be taken over; the text says why.
-    NotAdoptable(&'static str),
-}
-
 /// The Incus operations the controller needs. Mutations are slow (image
 /// pulls, boots, graceful shutdowns); the controller runs them in the
 /// background and observes the result with [`IncusBackend::get_owned`].
 #[async_trait]
 pub trait IncusBackend: Clone + Send + Sync + 'static {
     async fn topology(&self) -> anyhow::Result<IncusTopology>;
-    async fn reconcile_binding(&self, binding: &BindingRef) -> anyhow::Result<()>;
+    /// Ensure the universe's project, network, ACL and profile exist.
+    async fn reconcile_universe(&self, universe_id: &UniverseId) -> anyhow::Result<()>;
     async fn ensure_image(&self, fingerprint: &str) -> anyhow::Result<()>;
     async fn list_all_owned(&self) -> anyhow::Result<Vec<OwnedTarget>>;
-    /// The managed instance `name` in the binding's project. `None` when the
-    /// project or instance does not exist, when `name` is not an Incus
+    /// The managed instance `name` in the universe's project. `None` when
+    /// the project or instance does not exist, when `name` is not an Incus
     /// instance name, or when the instance carries no valid ownership
     /// metadata.
     async fn get_owned(
         &self,
-        binding: &BindingRef,
+        universe_id: &UniverseId,
         name: &str,
     ) -> anyhow::Result<Option<OwnedTarget>>;
-    /// Create the owner's instance from the template and start it.
-    async fn create_vm(&self, owner: &TargetOwner, template: &TemplatePolicy)
-    -> anyhow::Result<()>;
-    async fn adoption_source(&self, source: &ProviderNativeRef) -> anyhow::Result<AdoptionSource>;
-    /// Move the source into the owner's project under the owner's name and
-    /// start it.
-    async fn adopt_vm(&self, owner: &TargetOwner, source: &ProviderNativeRef)
-    -> anyhow::Result<()>;
+    /// Create the owner's instance from the template, recording `idle` as
+    /// its idle policy, and start it.
+    async fn create_vm(
+        &self,
+        owner: &TargetOwner,
+        template: &TemplatePolicy,
+        idle: Option<&IdlePolicy>,
+    ) -> anyhow::Result<()>;
     /// Destroy the instance: a graceful stop within 30 s, then a forced stop,
     /// then delete. Its ingress metadata goes with it.
     async fn delete_vm(&self, target: &OwnedTarget) -> anyhow::Result<()>;
@@ -139,6 +128,19 @@ pub trait IncusBackend: Clone + Send + Sync + 'static {
 pub const SUPPORTED_POWER_STATES: [PowerState; 3] =
     [PowerState::Running, PowerState::Paused, PowerState::Stopped];
 
+/// The first stage of `idle` that moves a target to a power state this
+/// provider cannot reach; such a stage would never fire.
+pub fn unsupported_idle_stage(idle: &IdlePolicy) -> Option<IdleAction> {
+    idle.stages()
+        .into_iter()
+        .map(|(action, _)| action)
+        .find(|action| {
+            action
+                .power_state()
+                .is_some_and(|state| !SUPPORTED_POWER_STATES.contains(&state))
+        })
+}
+
 /// envd's state directory inside every VM: outside the agent's working tree
 /// and writable by the service (`ReadWritePaths` in the image's unit).
 pub const ENVD_STATE_DIR: &str = "/var/lib/lightspeed-envd";
@@ -146,9 +148,6 @@ pub const ENVD_STATE_DIR: &str = "/var/lib/lightspeed-envd";
 /// Bound on one graceful Incus state action, in seconds.
 const STATE_ACTION_TIMEOUT_SECONDS: i64 = 30;
 
-/// `template` and `image` metadata of an adopted target.
-pub const ADOPTED: &str = "adopted";
-
 #[derive(Clone, Debug, serde::Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct IncusTopology {
@@ -574,33 +573,16 @@ impl IncusClient {
         Ok(())
     }
 
-    async fn raw_instance(&self, project: &str, name: &str) -> anyhow::Result<Option<Instance>> {
-        if !self
-            .exists(&format!("/instances/{name}"), Some(project))
-            .await?
-        {
-            return Ok(None);
-        }
-        self.request(
-            Method::GET,
-            &format!("/instances/{name}"),
-            Some(project),
-            None,
-        )
-        .await
-        .map(Some)
-    }
-
     async fn reconcile_network_acls(&self) -> anyhow::Result<()> {
         let projects: Vec<Project> = self
             .request(Method::GET, "/projects?recursion=1", None, None)
             .await?;
         let mut networks = Vec::new();
         for project in projects {
-            let Some(binding) = project.binding() else {
+            let Some(universe_id) = project.universe() else {
                 continue;
             };
-            let network_name = policy::network_name(&binding);
+            let network_name = policy::network_name(&universe_id);
             let network_project = network_resource_project(self.config.incus.mode, &project.name);
             if !self
                 .exists(&format!("/networks/{network_name}"), network_project)
@@ -636,7 +618,7 @@ impl IncusClient {
                 .find(|denied| ipv4_cidrs_overlap(own_cidr, denied))
             {
                 anyhow::bail!(
-                    "provider denied egress CIDR {denied} overlaps Incus-assigned binding network {own_cidr}"
+                    "provider denied egress CIDR {denied} overlaps Incus-assigned universe network {own_cidr}"
                 )
             }
         }
@@ -654,7 +636,7 @@ impl IncusClient {
                         "action":"reject",
                         "state":"enabled",
                         "source":source,
-                        "description":"block sibling Lightspeed binding network"
+                        "description":"block sibling Lightspeed universe network"
                     })
                 })
                 .collect();
@@ -676,7 +658,7 @@ impl IncusClient {
                         "action":"reject",
                         "state":"enabled",
                         "destination":destination,
-                        "description":"block sibling Lightspeed binding network"
+                        "description":"block sibling Lightspeed universe network"
                     })
                 }))
                 .collect();
@@ -685,7 +667,7 @@ impl IncusClient {
                 &format!("/network-acls/{project}-acl"),
                 network_project,
                 Some(json!({
-                    "description":"Lightspeed binding baseline",
+                    "description":"Lightspeed universe baseline",
                     "ingress":ingress,
                     "egress":egress,
                     "config":{}
@@ -732,30 +714,30 @@ impl IncusBackend for IncusClient {
         })
     }
 
-    async fn reconcile_binding(&self, binding: &BindingRef) -> anyhow::Result<()> {
+    async fn reconcile_universe(&self, universe_id: &UniverseId) -> anyhow::Result<()> {
         let _reconcile_guard = self.reconcile_lock.lock().await;
-        let project = policy::project_name(binding);
+        let project = policy::project_name(universe_id);
         let isolated_project_networks = self.config.incus.mode == IncusMode::Cluster;
         let network_project = network_resource_project(self.config.incus.mode, &project);
-        self.ensure_resource(&format!("/projects/{project}"), "/projects", None, json!({"name":project,"description":"Lightspeed managed binding","config":{"features.images":"false","features.networks":isolated_project_networks.to_string(),"features.profiles":"true","restricted":"true","restricted.devices.nic":"managed","restricted.devices.disk":"managed","restricted.networks.access":policy::network_name(binding),"user.lightspeed.managed":"true","user.lightspeed.universe":binding.universe_id.as_str(),"user.lightspeed.binding":binding.binding_id.as_str()}})).await?;
-        self.ensure_resource(&format!("/network-acls/{}", policy::acl_name(binding)), "/network-acls", network_project, json!({"name":policy::acl_name(binding),"description":"Lightspeed binding baseline","ingress":[],"egress":[],"config":{}})).await?;
+        self.ensure_resource(&format!("/projects/{project}"), "/projects", None, json!({"name":project,"description":"Lightspeed managed universe","config":{"features.images":"false","features.networks":isolated_project_networks.to_string(),"features.profiles":"true","restricted":"true","restricted.devices.nic":"managed","restricted.devices.disk":"managed","restricted.networks.access":policy::network_name(universe_id),"user.lightspeed.managed":"true","user.lightspeed.universe":universe_id.as_str()}})).await?;
+        self.ensure_resource(&format!("/network-acls/{}", policy::acl_name(universe_id)), "/network-acls", network_project, json!({"name":policy::acl_name(universe_id),"description":"Lightspeed universe baseline","ingress":[],"egress":[],"config":{}})).await?;
         let network = match self.config.incus.mode {
             IncusMode::Single => {
-                json!({"name":policy::network_name(binding),"type":"bridge","config":{"ipv4.address":"auto","ipv4.nat":"true","ipv6.address":"none","security.acls":policy::acl_name(binding),"security.acls.default.ingress.action":"allow","security.acls.default.egress.action":"allow"}})
+                json!({"name":policy::network_name(universe_id),"type":"bridge","config":{"ipv4.address":"auto","ipv4.nat":"true","ipv6.address":"none","security.acls":policy::acl_name(universe_id),"security.acls.default.ingress.action":"allow","security.acls.default.egress.action":"allow"}})
             }
             IncusMode::Cluster => {
-                json!({"name":policy::network_name(binding),"type":"ovn","config":{"network":self.config.incus.cluster_network_uplink.as_deref().expect("validated cluster uplink"),"ipv4.address":"auto","ipv4.nat":"true","ipv6.address":"none","security.acls":policy::acl_name(binding),"security.acls.default.ingress.action":"allow","security.acls.default.egress.action":"allow"}})
+                json!({"name":policy::network_name(universe_id),"type":"ovn","config":{"network":self.config.incus.cluster_network_uplink.as_deref().expect("validated cluster uplink"),"ipv4.address":"auto","ipv4.nat":"true","ipv6.address":"none","security.acls":policy::acl_name(universe_id),"security.acls.default.ingress.action":"allow","security.acls.default.egress.action":"allow"}})
             }
         };
         self.ensure_resource(
-            &format!("/networks/{}", policy::network_name(binding)),
+            &format!("/networks/{}", policy::network_name(universe_id)),
             "/networks",
             network_project,
             network,
         )
         .await?;
         self.reconcile_network_acls().await?;
-        self.ensure_resource(&format!("/profiles/{}", policy::profile_name(binding)), "/profiles", Some(&project), json!({"name":policy::profile_name(binding),"description":"Lightspeed VM baseline","config":{},"devices":{"eth0":{"type":"nic","network":policy::network_name(binding),"security.port_isolation":"true","security.ipv4_filtering":"true"},"root":{"type":"disk","pool":self.config.incus.storage_pool,"path":"/"}}})).await
+        self.ensure_resource(&format!("/profiles/{}", policy::profile_name(universe_id)), "/profiles", Some(&project), json!({"name":policy::profile_name(universe_id),"description":"Lightspeed VM baseline","config":{},"devices":{"eth0":{"type":"nic","network":policy::network_name(universe_id),"security.port_isolation":"true","security.ipv4_filtering":"true"},"root":{"type":"disk","pool":self.config.incus.storage_pool,"path":"/"}}})).await
     }
 
     async fn ensure_image(&self, fingerprint: &str) -> anyhow::Result<()> {
@@ -799,7 +781,7 @@ impl IncusBackend for IncusClient {
                     .await
                     .unwrap_or_default();
                 if let Some(target) = owned_from_instance(instance, state)
-                    && project.name == policy::project_name(&target.binding())
+                    && project.name == policy::project_name(target.universe())
                 {
                     targets.push(target);
                 }
@@ -810,29 +792,29 @@ impl IncusBackend for IncusClient {
 
     async fn get_owned(
         &self,
-        binding: &BindingRef,
+        universe_id: &UniverseId,
         name: &str,
     ) -> anyhow::Result<Option<OwnedTarget>> {
         if !policy::is_instance_name(name) {
             return Ok(None);
         }
-        let project = policy::project_name(binding);
+        let project = policy::project_name(universe_id);
         if !self.exists(&format!("/projects/{project}"), None).await? {
             return Ok(None);
         }
         Ok(self
             .instance(&project, name)
             .await?
-            .filter(|target| target.binding() == *binding))
+            .filter(|target| target.universe() == universe_id))
     }
 
     async fn create_vm(
         &self,
         owner: &TargetOwner,
         template: &TemplatePolicy,
+        idle: Option<&IdlePolicy>,
     ) -> anyhow::Result<()> {
-        let binding = policy::binding_of(owner);
-        let project = policy::project_name(&binding);
+        let project = policy::project_name(&owner.universe_id);
         let name = policy::instance_name(owner);
         let created_at = std::time::SystemTime::now()
             .duration_since(std::time::UNIX_EPOCH)?
@@ -857,6 +839,12 @@ impl IncusBackend for IncusClient {
             ),
             (format!("{}created_at_ms", policy::META_PREFIX), created_at),
         ]);
+        if let Some(idle) = idle {
+            config.insert(
+                format!("{}idle", policy::META_PREFIX),
+                serde_json::to_string(idle).context("encode the idle policy")?,
+            );
+        }
         let path = if let Some(group) = &template.cluster_group {
             if !self
                 .exists(&format!("/cluster/groups/{group}"), None)
@@ -868,7 +856,7 @@ impl IncusBackend for IncusClient {
         } else {
             "/instances".to_owned()
         };
-        if let Err(create_error) = self.request_unit(Method::POST, &path, Some(&project), Some(json!({"name":name,"type":"virtual-machine","start":false,"profiles":[policy::profile_name(&binding)],"source":{"type":"image","fingerprint":template.image_fingerprint},"config":config,"devices":{"root":{"type":"disk","pool":self.config.incus.storage_pool,"path":"/","size":template.disk}}}))).await
+        if let Err(create_error) = self.request_unit(Method::POST, &path, Some(&project), Some(json!({"name":name,"type":"virtual-machine","start":false,"profiles":[policy::profile_name(&owner.universe_id)],"source":{"type":"image","fingerprint":template.image_fingerprint},"config":config,"devices":{"root":{"type":"disk","pool":self.config.incus.storage_pool,"path":"/","size":template.disk}}}))).await
             // A transport can fail after Incus accepted the deterministic
             // create. Resolve that uncertainty before returning an error.
             && self.instance(&project, &name).await?.is_none()
@@ -878,127 +866,8 @@ impl IncusBackend for IncusClient {
         start_instance(self, &project, &name).await
     }
 
-    async fn adoption_source(&self, source: &ProviderNativeRef) -> anyhow::Result<AdoptionSource> {
-        let (source_project, source_name) = parse_source_target(source.as_str())?;
-        let Some(source) = self.raw_instance(source_project, source_name).await? else {
-            return Ok(AdoptionSource::Missing);
-        };
-        Ok(classify_adoption_source(&source))
-    }
-
-    async fn adopt_vm(
-        &self,
-        owner: &TargetOwner,
-        source_target: &ProviderNativeRef,
-    ) -> anyhow::Result<()> {
-        let binding = policy::binding_of(owner);
-        let project = policy::project_name(&binding);
-        let destination = policy::instance_name(owner);
-        if self.instance(&project, &destination).await?.is_some() {
-            return start_instance(self, &project, &destination).await;
-        }
-
-        let (source_project, source_name) = parse_source_target(source_target.as_str())?;
-        let source = self
-            .raw_instance(source_project, source_name)
-            .await?
-            .ok_or_else(|| anyhow::anyhow!("Incus adoption source target not found"))?;
-        match classify_adoption_source(&source) {
-            AdoptionSource::Adoptable => {}
-            AdoptionSource::Managed => {
-                anyhow::bail!("Incus source target is already Lightspeed-managed")
-            }
-            AdoptionSource::NotAdoptable(reason) => {
-                anyhow::bail!("Incus source target cannot be adopted: {reason}")
-            }
-            AdoptionSource::Missing => anyhow::bail!("Incus adoption source target not found"),
-        }
-
-        // Incus merges these overrides with the instance's existing local
-        // configuration during a cross-project move. User configuration is
-        // therefore preserved while ownership metadata is added.
-        let mut config = ownership_config(owner);
-        config.extend([
-            (
-                format!("{}template", policy::META_PREFIX),
-                ADOPTED.to_owned(),
-            ),
-            (format!("{}image", policy::META_PREFIX), ADOPTED.to_owned()),
-            (
-                format!("{}adoption_source", policy::META_PREFIX),
-                source_target.to_string(),
-            ),
-        ]);
-
-        // Replace arbitrary source profiles with the binding baseline. Local
-        // NICs would override its managed eth0, so explicitly disable all
-        // source-local NICs except an eth0 override, which is rewritten onto
-        // the managed binding network.
-        let mut devices = BTreeMap::new();
-        for (name, device) in &source.devices {
-            if device.get("type").and_then(Value::as_str) != Some("nic") {
-                continue;
-            }
-            let replacement = if name == "eth0" {
-                json!({
-                    "type":"nic",
-                    "network":policy::network_name(&binding),
-                    "security.port_isolation":"true",
-                    "security.ipv4_filtering":"true"
-                })
-            } else {
-                json!({"type":"none"})
-            };
-            devices.insert(name.clone(), replacement);
-        }
-
-        if source.status != "Stopped" {
-            self.request_unit(
-                Method::PUT,
-                &format!("/instances/{source_name}/state"),
-                Some(source_project),
-                Some(json!({"action":"stop","timeout":STATE_ACTION_TIMEOUT_SECONDS,"force":true})),
-            )
-            .await
-            .context("stop Incus source target before adoption")?;
-        }
-
-        if let Err(move_error) = self
-            .request_unit(
-                Method::POST,
-                &format!("/instances/{source_name}"),
-                Some(source_project),
-                Some(json!({
-                    "name":destination,
-                    "migration":true,
-                    "live":false,
-                    "project":project,
-                    "pool":self.config.incus.storage_pool,
-                    "instance_only":false,
-                    "config":config,
-                    "devices":devices,
-                    "profiles":[policy::profile_name(&binding)]
-                })),
-            )
-            .await
-            && self.instance(&project, &destination).await?.is_none()
-        {
-            return Err(move_error);
-        }
-        let target = self
-            .instance(&project, &destination)
-            .await?
-            .ok_or_else(|| anyhow::anyhow!("adopted Incus target is not visible"))?;
-        if target.owner != *owner
-            || target.adoption_source.as_deref() != Some(source_target.as_str())
-        {
-            anyhow::bail!("adopted Incus target carries unexpected ownership metadata")
-        }
-        start_instance(self, &project, &destination).await
-    }
-
     async fn delete_vm(&self, target: &OwnedTarget) -> anyhow::Result<()> {
-        let project = policy::project_name(&target.binding());
+        let project = policy::project_name(target.universe());
         let name = target.name();
         if target.status != InstanceStatus::Stopped {
             // Graceful first; a guest that ignores ACPI power-down (a hung
@@ -1032,7 +901,7 @@ impl IncusBackend for IncusClient {
         if !SUPPORTED_POWER_STATES.contains(&power) {
             anyhow::bail!("Incus provider does not support power state {power}")
         }
-        let project = policy::project_name(&target.binding());
+        let project = policy::project_name(target.universe());
         let name = target.name();
         match (target.status, power) {
             // Already there or already on the way.
@@ -1083,7 +952,7 @@ impl IncusBackend for IncusClient {
         target: &OwnedTarget,
         route: Option<(&str, u16)>,
     ) -> anyhow::Result<()> {
-        let project = policy::project_name(&target.binding());
+        let project = policy::project_name(target.universe());
         let name = target.name();
         let instance: Instance = self
             .request(
@@ -1134,8 +1003,6 @@ struct Envelope<T> {
 #[derive(Deserialize)]
 struct Instance {
     name: String,
-    #[serde(default, rename = "type")]
-    kind: String,
     #[serde(default)]
     description: String,
     #[serde(default)]
@@ -1177,7 +1044,9 @@ struct Project {
 }
 
 impl Project {
-    fn binding(&self) -> Option<BindingRef> {
+    /// The universe a provider-managed project isolates, or `None` for any
+    /// other project, including one whose name does not match its metadata.
+    fn universe(&self) -> Option<UniverseId> {
         if self
             .config
             .get("user.lightspeed.managed")
@@ -1185,17 +1054,13 @@ impl Project {
         {
             return None;
         }
-        let binding = BindingRef {
-            universe_id: UniverseId::new(self.config.get("user.lightspeed.universe")?.as_str())
-                .ok()?,
-            binding_id: BindingId::new(self.config.get("user.lightspeed.binding")?.as_str())
-                .ok()?,
-        };
-        (self.name == policy::project_name(&binding)).then_some(binding)
+        let universe_id =
+            UniverseId::new(self.config.get("user.lightspeed.universe")?.as_str()).ok()?;
+        (self.name == policy::project_name(&universe_id)).then_some(universe_id)
     }
 
     fn is_lightspeed_managed(&self) -> bool {
-        self.binding().is_some()
+        self.universe().is_some()
     }
 }
 
@@ -1305,25 +1170,6 @@ fn network_resource_project(mode: IncusMode, project: &str) -> Option<&str> {
     }
 }
 
-pub(crate) fn parse_source_target(value: &str) -> anyhow::Result<(&str, &str)> {
-    let (project, name) = value.split_once('/').unwrap_or(("default", value));
-    if project.is_empty()
-        || name.is_empty()
-        || name.contains('/')
-        || [project, name].into_iter().any(|part| {
-            part.len() > 63
-                || part.starts_with('-')
-                || part.ends_with('-')
-                || part
-                    .chars()
-                    .any(|character| !character.is_ascii_alphanumeric() && character != '-')
-        })
-    {
-        anyhow::bail!("invalid Incus source target; expected instance or project/instance")
-    }
-    Ok((project, name))
-}
-
 /// Start a stopped instance or unfreeze a frozen one; a running or starting
 /// one needs nothing.
 async fn start_instance(client: &IncusClient, project: &str, name: &str) -> anyhow::Result<()> {
@@ -1361,38 +1207,13 @@ fn ownership_config(owner: &TargetOwner) -> BTreeMap<String, String> {
             format!("{}universe", policy::META_PREFIX),
             owner.universe_id.to_string(),
         ),
-        (
-            format!("{}binding", policy::META_PREFIX),
-            owner.binding_id.to_string(),
-        ),
         (
             format!("{}environment", policy::META_PREFIX),
             owner.environment_id.to_string(),
         ),
-        (
-            format!("{}incarnation", policy::META_PREFIX),
-            owner.incarnation_id.to_string(),
-        ),
     ])
 }
 
-fn classify_adoption_source(source: &Instance) -> AdoptionSource {
-    if source
-        .config
-        .get(&format!("{}managed", policy::META_PREFIX))
-        .is_some_and(|value| value == "true")
-    {
-        return AdoptionSource::Managed;
-    }
-    if source.kind != "virtual-machine" {
-        return AdoptionSource::NotAdoptable("only Incus virtual machines can be adopted");
-    }
-    if source.ephemeral {
-        return AdoptionSource::NotAdoptable("ephemeral Incus instances cannot be adopted");
-    }
-    AdoptionSource::Adoptable
-}
-
 /// The owned target an instance describes, or `None` when its ownership
 /// metadata is missing, invalid or does not match its deterministic name.
 fn owned_from_instance(instance: Instance, state: InstanceState) -> Option<OwnedTarget> {
@@ -1407,9 +1228,7 @@ fn owned_from_instance(instance: Instance, state: InstanceState) -> Option<Owned
     }
     let owner = TargetOwner {
         universe_id: UniverseId::new(get("universe")?).ok()?,
-        binding_id: BindingId::new(get("binding")?).ok()?,
         environment_id: EnvironmentId::new(get("environment")?).ok()?,
-        incarnation_id: IncarnationId::new(get("incarnation")?).ok()?,
     };
     if instance.name != policy::instance_name(&owner) {
         return None;
@@ -1418,8 +1237,9 @@ fn owned_from_instance(instance: Instance, state: InstanceState) -> Option<Owned
         target_id: ProviderTargetId::new(instance.name.clone()).ok()?,
         owner,
         template_id: get("template")?,
-        image_fingerprint: get("image")?,
-        adoption_source: get("adoption_source"),
+        // The provider writes this key itself; a value that does not decode
+        // leaves the target without an idle policy rather than unowned.
+        idle: get("idle").and_then(|value| serde_json::from_str(&value).ok()),
         status: InstanceStatus::from_incus(&instance.status),
         ipv4_address: managed_ipv4_address(&state),
         ingress_hostname: get("ingress_hostname"),
@@ -1450,17 +1270,17 @@ mod tests {
     }
 
     #[test]
-    fn managed_projects_require_matching_binding_metadata() {
-        let binding = policy::binding_of(&policy::tests::owner("u", "b", "e"));
+    fn managed_projects_require_matching_universe_metadata() {
+        let universe_id = UniverseId::new("u").unwrap();
         let project = Project {
-            name: policy::project_name(&binding),
+            name: policy::project_name(&universe_id),
             config: BTreeMap::from([
                 ("user.lightspeed.managed".to_owned(), "true".to_owned()),
                 ("user.lightspeed.universe".to_owned(), "u".to_owned()),
-                ("user.lightspeed.binding".to_owned(), "b".to_owned()),
             ]),
         };
         assert!(project.is_lightspeed_managed());
+        assert_eq!(project.universe(), Some(universe_id));
         let spoofed = Project {
             name: "ls-spoofed".to_owned(),
             ..project
@@ -1471,7 +1291,6 @@ mod tests {
     fn instance(name: &str, config: BTreeMap<String, String>) -> Instance {
         Instance {
             name: name.to_owned(),
-            kind: "virtual-machine".to_owned(),
             description: String::new(),
             profiles: Vec::new(),
             devices: BTreeMap::new(),
@@ -1484,7 +1303,7 @@ mod tests {
 
     #[test]
     fn ownership_metadata_must_match_the_deterministic_name() {
-        let owner = policy::tests::owner("u", "b", "e");
+        let owner = policy::tests::owner("u", "e");
         let mut config = ownership_config(&owner);
         config.insert("user.lightspeed.template".to_owned(), "t".to_owned());
         config.insert("user.lightspeed.image".to_owned(), "f".to_owned());
@@ -1493,6 +1312,7 @@ mod tests {
             .expect("owned");
         assert_eq!(owned.owner, owner);
         assert_eq!(owned.status, InstanceStatus::Running);
+        assert_eq!(owned.idle, None);
         assert!(
             owned_from_instance(
                 instance("ls-other", config.clone()),
@@ -1505,49 +1325,40 @@ mod tests {
     }
 
     #[test]
-    fn adoption_sources_are_classified_before_any_change() {
-        let mut source = instance("manual-vm", BTreeMap::new());
-        assert_eq!(classify_adoption_source(&source), AdoptionSource::Adoptable);
-        source.ephemeral = true;
-        assert!(matches!(
-            classify_adoption_source(&source),
-            AdoptionSource::NotAdoptable(_)
-        ));
-        source.ephemeral = false;
-        source.kind = "container".to_owned();
-        assert!(matches!(
-            classify_adoption_source(&source),
-            AdoptionSource::NotAdoptable(_)
-        ));
-        source
-            .config
-            .insert("user.lightspeed.managed".to_owned(), "true".to_owned());
-        assert_eq!(classify_adoption_source(&source), AdoptionSource::Managed);
-    }
-
-    #[test]
-    fn adoption_source_defaults_to_the_default_project() {
+    fn standalone_network_resources_are_global_but_cluster_networks_are_project_local() {
         assert_eq!(
-            parse_source_target("manual-vm").unwrap(),
-            ("default", "manual-vm")
+            network_resource_project(IncusMode::Single, "universe-a"),
+            None
         );
         assert_eq!(
-            parse_source_target("staging/manual-vm").unwrap(),
-            ("staging", "manual-vm")
+            network_resource_project(IncusMode::Cluster, "universe-a"),
+            Some("universe-a")
         );
-        assert!(parse_source_target("too/many/parts").is_err());
     }
 
     #[test]
-    fn standalone_network_resources_are_global_but_cluster_networks_are_project_local() {
-        assert_eq!(
-            network_resource_project(IncusMode::Single, "binding-a"),
-            None
-        );
-        assert_eq!(
-            network_resource_project(IncusMode::Cluster, "binding-a"),
-            Some("binding-a")
+    fn the_recorded_idle_policy_is_read_back() {
+        let owner = policy::tests::owner("u", "e");
+        let mut config = ownership_config(&owner);
+        config.insert("user.lightspeed.template".to_owned(), "t".to_owned());
+        let idle = IdlePolicy {
+            pause_after_ms: Some(600_000),
+            close_after_ms: Some(86_400_000),
+            ..IdlePolicy::default()
+        };
+        config.insert(
+            "user.lightspeed.idle".to_owned(),
+            serde_json::to_string(&idle).unwrap(),
         );
+        let name = policy::instance_name(&owner);
+        let owned = owned_from_instance(instance(&name, config.clone()), InstanceState::default())
+            .expect("owned");
+        assert_eq!(owned.idle, Some(idle));
+
+        config.insert("user.lightspeed.idle".to_owned(), "not json".to_owned());
+        let owned = owned_from_instance(instance(&name, config), InstanceState::default())
+            .expect("an undecodable idle policy keeps ownership");
+        assert_eq!(owned.idle, None);
     }
 
     #[test]
diff --git a/crates/environment-provider-incus/src/ingress.rs b/crates/environment-provider-incus/src/ingress.rs
index 541e1e3d8..43c4b568b 100644
--- a/crates/environment-provider-incus/src/ingress.rs
+++ b/crates/environment-provider-incus/src/ingress.rs
@@ -13,7 +13,6 @@ pub fn hostname(target: &OwnedTarget, public_base_url: &str) -> anyhow::Result<S
         "ingress",
         &[
             target.owner.universe_id.as_str(),
-            target.owner.binding_id.as_str(),
             target.owner.environment_id.as_str(),
         ],
     );
@@ -46,13 +45,12 @@ pub(crate) mod tests {
     use crate::incus::InstanceStatus;
 
     pub(crate) fn target() -> OwnedTarget {
-        let owner = policy::tests::owner("universe-a", "binding-a", "environment-a");
+        let owner = policy::tests::owner("universe-a", "environment-a");
         OwnedTarget {
             target_id: policy::instance_name(&owner).try_into().unwrap(),
             owner,
             template_id: "template-a".to_owned(),
-            image_fingerprint: "fingerprint-a".to_owned(),
-            adoption_source: None,
+            idle: None,
             status: InstanceStatus::Running,
             ipv4_address: Some("10.0.0.2".to_owned()),
             ingress_hostname: None,
diff --git a/crates/environment-provider-incus/src/lib.rs b/crates/environment-provider-incus/src/lib.rs
index 26cf2add2..3e9cc1e6b 100644
--- a/crates/environment-provider-incus/src/lib.rs
+++ b/crates/environment-provider-incus/src/lib.rs
@@ -1,5 +1,6 @@
 pub mod config;
 pub mod edge;
+mod idle;
 pub mod incus;
 pub mod ingress;
 pub mod policy;
diff --git a/crates/environment-provider-incus/src/policy.rs b/crates/environment-provider-incus/src/policy.rs
index 6a7a8973a..0b72f7b93 100644
--- a/crates/environment-provider-incus/src/policy.rs
+++ b/crates/environment-provider-incus/src/policy.rs
@@ -1,6 +1,6 @@
 use sha2::{Digest as _, Sha256};
 
-use environment_protocol::control::target::{BindingRef, TargetOwner};
+use environment_protocol::{control::target::TargetOwner, ids::UniverseId};
 
 pub const META_PREFIX: &str = "user.lightspeed.";
 
@@ -18,54 +18,41 @@ pub fn stable_component(kind: &str, parts: &[&str]) -> String {
     hex(&hash.finalize()[..10])
 }
 
-pub fn binding_of(owner: &TargetOwner) -> BindingRef {
-    BindingRef {
-        universe_id: owner.universe_id.clone(),
-        binding_id: owner.binding_id.clone(),
-    }
-}
-
-fn binding_component(binding: &BindingRef) -> String {
-    stable_component(
-        "binding",
-        &[binding.universe_id.as_str(), binding.binding_id.as_str()],
-    )
+/// The isolation unit of every Incus resource the provider creates for a
+/// universe: its project, network, ACL and profile all derive from it.
+fn universe_component(universe_id: &UniverseId) -> String {
+    stable_component("universe", &[universe_id.as_str()])
 }
 
-pub fn project_name(binding: &BindingRef) -> String {
-    format!("ls-{}", binding_component(binding))
+pub fn project_name(universe_id: &UniverseId) -> String {
+    format!("ls-{}", universe_component(universe_id))
 }
 
-pub fn network_name(binding: &BindingRef) -> String {
+pub fn network_name(universe_id: &UniverseId) -> String {
     // A managed bridge's Incus network name also becomes its Linux interface
     // name, whose hard limit is 15 bytes. Keep 48 bits of the scoped digest
     // while making the resource kind visible within that limit.
-    format!("ls{}n", &binding_component(binding)[..12])
+    format!("ls{}n", &universe_component(universe_id)[..12])
 }
 
-pub fn profile_name(binding: &BindingRef) -> String {
-    format!("{}-vm", project_name(binding))
+pub fn profile_name(universe_id: &UniverseId) -> String {
+    format!("{}-vm", project_name(universe_id))
 }
 
-pub fn acl_name(binding: &BindingRef) -> String {
-    format!("{}-acl", project_name(binding))
+pub fn acl_name(universe_id: &UniverseId) -> String {
+    format!("{}-acl", project_name(universe_id))
 }
 
 /// The one instance name, and therefore `targetId`, an owner can hold. The
-/// provider's owner index is this deterministic name inside the binding's
-/// project, so create and adopt are idempotent per owner without any
+/// provider's owner index is this deterministic name inside the universe's
+/// project, so create and close are idempotent per owner without any
 /// provider-side state.
 pub fn instance_name(owner: &TargetOwner) -> String {
     format!(
         "ls-{}",
         stable_component(
             "instance",
-            &[
-                owner.universe_id.as_str(),
-                owner.binding_id.as_str(),
-                owner.environment_id.as_str(),
-                owner.incarnation_id.as_str(),
-            ]
+            &[owner.universe_id.as_str(), owner.environment_id.as_str()]
         )
     )
 }
@@ -96,42 +83,38 @@ fn hex(bytes: &[u8]) -> String {
 
 #[cfg(test)]
 pub(crate) mod tests {
-    use environment_protocol::ids::{BindingId, EnvironmentId, IncarnationId, UniverseId};
+    use environment_protocol::ids::EnvironmentId;
 
     use super::*;
 
-    pub(crate) fn owner(universe: &str, binding: &str, environment: &str) -> TargetOwner {
+    pub(crate) fn owner(universe: &str, environment: &str) -> TargetOwner {
         TargetOwner {
             universe_id: UniverseId::new(universe).unwrap(),
-            binding_id: BindingId::new(binding).unwrap(),
             environment_id: EnvironmentId::new(environment).unwrap(),
-            incarnation_id: IncarnationId::new("i").unwrap(),
         }
     }
 
     #[test]
     fn names_are_stable_and_scoped() {
-        let a = instance_name(&owner("u", "b", "e"));
-        assert_eq!(a, instance_name(&owner("u", "b", "e")));
-        assert_ne!(a, instance_name(&owner("u2", "b", "e")));
+        let a = instance_name(&owner("u", "e"));
+        assert_eq!(a, instance_name(&owner("u", "e")));
+        assert_ne!(a, instance_name(&owner("u2", "e")));
+        assert_ne!(a, instance_name(&owner("u", "e2")));
         assert!(is_instance_name(&a));
     }
 
     #[test]
-    fn binding_network_names_fit_the_linux_interface_limit() {
-        let binding = binding_of(&owner(
-            "0d3d9e5e-2428-4e60-b66e-8d4520f64e5d",
-            "hz02-incus",
-            "e",
-        ));
-        let other = binding_of(&owner(
-            "61092591-cd39-4504-b845-a817e3d9cb71",
-            "hz02-incus",
-            "e",
-        ));
-
-        assert_eq!(network_name(&binding).len(), 15);
-        assert_ne!(network_name(&binding), network_name(&other));
+    fn universe_resources_share_one_isolation_unit() {
+        let universe = UniverseId::new("0d3d9e5e-2428-4e60-b66e-8d4520f64e5d").unwrap();
+        let other = UniverseId::new("61092591-cd39-4504-b845-a817e3d9cb71").unwrap();
+
+        assert_eq!(network_name(&universe).len(), 15);
+        assert_ne!(network_name(&universe), network_name(&other));
+        assert_ne!(project_name(&universe), project_name(&other));
+        assert!(profile_name(&universe).starts_with(&project_name(&universe)));
+        assert!(acl_name(&universe).starts_with(&project_name(&universe)));
+        // The instance name never exposes the universe it belongs to.
+        assert!(!instance_name(&owner(universe.as_str(), "e")).contains(universe.as_str()));
     }
 
     #[test]
diff --git a/crates/environment-provider-incus/src/relay.rs b/crates/environment-provider-incus/src/relay.rs
index ff177fb54..c395b60b7 100644
--- a/crates/environment-provider-incus/src/relay.rs
+++ b/crates/environment-provider-incus/src/relay.rs
@@ -1,18 +1,27 @@
 //! On-demand provider data connections.
 //!
 //! Lightspeed opens one provider WebSocket for a specific current target. The
-//! provider validates the credential and ownership, dials the target's private
-//! envd, and proxies the connection until it closes or becomes idle. There is
-//! no provider-initiated connection and no provider route registry in
+//! provider validates the credential and ownership, wakes the target when it
+//! is powered down, dials the target's private envd, and proxies the
+//! connection until it closes or becomes idle. There is no
+//! provider-initiated connection and no provider route registry in
 //! Lightspeed.
 //!
+//! Every data connection, from the dial that may wake the target to the
+//! relay's end, holds a [`RelayHold`] on its instance. The idle loop never
+//! powers down or closes an instance while one is held.
+//!
 //! The relay is an intermediary under the protocol's liveness rule: it
 //! forwards pings and pongs, counts every frame in either direction as
 //! activity, and never idle-closes sooner than `relayIdleSeconds`, which
 //! config loading keeps at or above the protocol minimum. Both legs carry the
 //! protocol's message and frame limit.
 
-use std::time::Duration;
+use std::{
+    collections::HashMap,
+    sync::{Arc, Mutex},
+    time::Duration,
+};
 
 use anyhow::Context as _;
 use axum::extract::ws::{Message as AxumMessage, WebSocket};
@@ -28,9 +37,50 @@ use crate::{Config, incus::OwnedTarget};
 
 pub type GuestSocket = WebSocketStream<MaybeTlsStream<TcpStream>>;
 
-/// Bound on the readiness probe's dial, so an observation stays prompt while
-/// a guest boots.
-const PROBE_TIMEOUT: Duration = Duration::from_secs(3);
+/// Data connections in progress, by instance name.
+#[derive(Clone, Debug, Default)]
+pub struct Relays(Arc<Mutex<HashMap<String, usize>>>);
+
+impl Relays {
+    /// Count one data connection to `name` until the hold is dropped.
+    pub fn hold(&self, name: &str) -> RelayHold {
+        *self.lock().entry(name.to_owned()).or_default() += 1;
+        RelayHold {
+            relays: self.clone(),
+            name: name.to_owned(),
+        }
+    }
+
+    /// True while any data connection to `name` is held.
+    pub fn active(&self, name: &str) -> bool {
+        self.lock().get(name).is_some_and(|count| *count > 0)
+    }
+
+    fn lock(&self) -> std::sync::MutexGuard<'_, HashMap<String, usize>> {
+        self.0
+            .lock()
+            .unwrap_or_else(|poisoned| poisoned.into_inner())
+    }
+}
+
+/// One counted data connection; see [`Relays::hold`].
+#[derive(Debug)]
+pub struct RelayHold {
+    relays: Relays,
+    name: String,
+}
+
+impl Drop for RelayHold {
+    fn drop(&mut self) {
+        let mut relays = self.relays.lock();
+        if let Some(count) = relays.get_mut(&self.name) {
+            *count -= 1;
+            if *count == 0 {
+                relays.remove(&self.name);
+            }
+        }
+    }
+}
 
 /// The protocol's message limit, applied to both relay legs.
 pub fn websocket_config() -> WebSocketConfig {
@@ -48,7 +98,8 @@ pub async fn dial_guest(config: &Config, target: &OwnedTarget) -> anyhow::Result
     .await
 }
 
-async fn dial_guest_within(
+/// Dial the guest's envd listener, giving up after `timeout`.
+pub async fn dial_guest_within(
     config: &Config,
     target: &OwnedTarget,
     timeout: Duration,
@@ -67,25 +118,6 @@ async fn dial_guest_within(
     Ok(socket)
 }
 
-/// The provider's own liveness probe of envd: a WebSocket upgrade on the
-/// guest's data listener, without `initialize`, so the provider never
-/// depends on envd's protocol version.
-pub async fn probe_guest(config: &Config, target: &OwnedTarget) -> bool {
-    match dial_guest_within(
-        config,
-        target,
-        PROBE_TIMEOUT.min(Duration::from_secs(config.dial_timeout_seconds)),
-    )
-    .await
-    {
-        Ok(mut socket) => {
-            let _ = socket.close(None).await;
-            true
-        }
-        Err(_) => false,
-    }
-}
-
 pub async fn proxy(config: Config, mut lightspeed: WebSocket, mut guest: GuestSocket) {
     let idle = Duration::from_secs(config.relay_idle_seconds);
     proxy_with_idle(idle, &mut lightspeed, &mut guest).await;
@@ -166,6 +198,21 @@ mod tests {
 
     use super::*;
 
+    #[test]
+    fn relay_holds_count_per_instance_until_dropped() {
+        let relays = Relays::default();
+        assert!(!relays.active("a"));
+        let first = relays.hold("a");
+        let second = relays.hold("a");
+        assert!(relays.active("a"));
+        assert!(!relays.active("b"));
+        drop(first);
+        assert!(relays.active("a"));
+        drop(second);
+        assert!(!relays.active("a"));
+        assert!(relays.lock().is_empty());
+    }
+
     #[tokio::test(flavor = "current_thread")]
     async fn relay_closes_guest_when_lightspeed_disappears_without_a_close_frame() {
         let guest_listener = TcpListener::bind("127.0.0.1:0")
diff --git a/crates/environment-provider-incus/src/server.rs b/crates/environment-provider-incus/src/server.rs
index 7877d2e39..f543f8e6d 100644
--- a/crates/environment-provider-incus/src/server.rs
+++ b/crates/environment-provider-incus/src/server.rs
@@ -1,5 +1,6 @@
 //! The provider's listener: the controller plane on `/control` and the data
-//! routes under `/routes`, both behind the provider credential.
+//! routes under `/routes`, both behind the provider credential when one is
+//! configured.
 //!
 //! Every target method answers promptly with the current observation. Slow
 //! Incus work (an image pull, a boot, a graceful shutdown) runs as one
@@ -8,6 +9,11 @@
 //! `closing`, and a failed create `failed` with its error as the `message`.
 //! Job state is in memory; Incus itself, read through the deterministic owner
 //! name, is the record of every target.
+//!
+//! The provider owns its targets' power. `target/setPower` serves manual
+//! changes, the idle loop ([`crate::idle`]) powers idle targets down and
+//! closes them on its own clock, and a data route dial wakes a powered-down
+//! target before it relays.
 
 use std::{
     collections::{BTreeMap, HashMap},
@@ -16,7 +22,7 @@ use std::{
         Arc, Mutex as StdMutex,
         atomic::{AtomicU64, Ordering},
     },
-    time::Duration,
+    time::{Duration, Instant},
 };
 
 use axum::{
@@ -25,7 +31,7 @@ use axum::{
         Path, State, WebSocketUpgrade,
         ws::{Message, WebSocket, rejection::WebSocketUpgradeRejection},
     },
-    http::{HeaderMap, StatusCode, header},
+    http::{HeaderMap, HeaderValue, StatusCode, header},
     response::{IntoResponse, Response},
     routing::get,
 };
@@ -34,26 +40,27 @@ use environment_protocol::{
     control::{
         handshake::{
             ControllerCapabilities, ControllerInitializeParams, ControllerInitializeResponse,
-            ControllerRoutes,
         },
         ingress::{EnsureIngressParams, RemoveIngressParams},
         target::{
-            AdoptTargetParams, CloseTargetParams, CreateTargetParams, GetTargetParams,
-            IngressObservation, PowerState, SetTargetPowerParams, TargetObservation, TargetOwner,
-            TargetPhase, TargetRef, TargetResponse, TargetState,
+            CloseTargetParams, CreateTargetParams, GetTargetParams, IngressObservation, PowerState,
+            SetTargetPowerParams, TargetObservation, TargetOwner, TargetPhase, TargetRef,
+            TargetResponse,
         },
         template::{EnvironmentTemplate, ListTemplatesParams, ListTemplatesResponse},
     },
     error::{BusyReason, Capability, PreconditionReason, ProtocolError},
     handshake::{ImplementationInfo, Plane},
-    ids::{BindingId, EnvironmentId, IncarnationId, ProviderTargetId, TemplateId, UniverseId},
+    idle::IdleAction,
+    ids::{EnvironmentId, ProviderTargetId, TemplateId, UniverseId},
     jsonrpc::{self, Request, Response as RpcResponse},
-    limits::MAX_MESSAGE_BYTES,
+    limits::{MAX_DATA_ROUTE_HOLD_MS, MAX_MESSAGE_BYTES, RETRY_AFTER_MAX_SECS},
     manifest::{
-        self, ControllerInitialize, IngressEnsure, IngressRemove, MessageKind, TargetAdopt,
-        TargetClose, TargetCreate, TargetGet, TargetSetPower, TemplateList,
+        self, ControllerInitialize, IngressEnsure, IngressRemove, MessageKind, TargetClose,
+        TargetCreate, TargetGet, TargetSetPower, TemplateList,
     },
     metadata::{DescriptiveText, Metadata, validate_metadata_entry},
+    routes::DataRouteRefusal,
 };
 use futures_util::{FutureExt as _, SinkExt as _, StreamExt as _, future::BoxFuture};
 use serde::Serialize;
@@ -61,9 +68,10 @@ use serde_json::Value;
 use tokio::sync::{Mutex as AsyncMutex, Semaphore, mpsc, watch};
 
 use crate::{
-    Config, IncusBackend,
-    incus::{AdoptionSource, InstanceStatus, OwnedTarget, SUPPORTED_POWER_STATES},
-    ingress, policy, relay,
+    Config, IncusBackend, idle,
+    incus::{InstanceStatus, OwnedTarget, SUPPORTED_POWER_STATES, unsupported_idle_stage},
+    ingress, policy,
+    relay::{self, GuestSocket, Relays},
 };
 
 /// How long a mutation waits for its background job before it answers with
@@ -77,38 +85,56 @@ const _: () = assert!(
     MAX_CONCURRENT_REQUESTS >= environment_protocol::limits::MIN_CONCURRENT_REQUESTS as usize
 );
 
+/// `Retry-After` of a data route's 503 refusal: about one guest boot step.
+const RETRY_AFTER_SECS: u64 = 2;
+
+const _: () = assert!(RETRY_AFTER_SECS >= 1 && RETRY_AFTER_SECS <= RETRY_AFTER_MAX_SECS);
+
+/// Bound on one guest dial attempt while a data route dial waits, so the
+/// wait re-reads the instance between attempts.
+const DIAL_ATTEMPT: Duration = Duration::from_secs(1);
+
+/// Pause between two looks at the instance while a data route dial waits.
+const HOLD_POLL: Duration = Duration::from_millis(250);
+
 #[derive(Clone)]
-struct App<B> {
-    config: Config,
-    backend: B,
-    work: Arc<Work>,
+pub(crate) struct App<B> {
+    pub(crate) config: Config,
+    pub(crate) backend: B,
+    pub(crate) work: Arc<Work>,
+    pub(crate) relays: Relays,
+    /// When data route dials last woke instances.
+    pub(crate) wakes: idle::Wakes,
     initialize: Arc<ControllerInitializeResponse>,
+    /// How long a data route dial may wait for its target before it refuses.
+    data_route_hold: Duration,
 }
 
 impl<B: IncusBackend> App<B> {
-    fn new(config: Config, backend: B) -> Self {
+    pub(crate) fn new(config: Config, backend: B) -> Self {
         let initialize = ControllerInitializeResponse {
             protocol_version: CONTROLLER_PROTOCOL_VERSION,
             plane: Plane::Controller,
             server_info: server_info(),
             capabilities: ControllerCapabilities {
-                adopt_target: true,
+                power: true,
                 ingress: config.ingress.is_some(),
             },
-            routes: ControllerRoutes {
-                data: config.data_route_base.clone(),
-            },
         };
+        let wakes = idle::Wakes::new(idle::wake_grace(config.idle_check_seconds));
         Self {
             config,
             backend,
             work: Arc::default(),
+            relays: Relays::default(),
+            wakes,
             initialize: Arc::new(initialize),
+            data_route_hold: Duration::from_millis(MAX_DATA_ROUTE_HOLD_MS),
         }
     }
 }
 
-fn server_info() -> ImplementationInfo {
+pub(crate) fn server_info() -> ImplementationInfo {
     let info = ImplementationInfo::new("lightspeed-provider-incus")
         .expect("the provider name is a valid implementation name");
     let info = info
@@ -129,25 +155,30 @@ pub async fn serve<B: IncusBackend>(config: Config, backend: B) -> anyhow::Resul
     serve_on(listener, config, backend).await
 }
 
-/// Serve on an already bound listener.
+/// Serve on an already bound listener, with the idle loop running beside
+/// it.
 pub async fn serve_on<B: IncusBackend>(
     listener: tokio::net::TcpListener,
     config: Config,
     backend: B,
 ) -> anyhow::Result<()> {
-    axum::serve(listener, router(config, backend)).await?;
+    let app = App::new(config, backend);
+    let idle_loop = tokio::spawn(idle::run(app.clone()));
+    let served = axum::serve(listener, router(app)).await;
+    idle_loop.abort();
+    served?;
     Ok(())
 }
 
-fn router<B: IncusBackend>(config: Config, backend: B) -> Router {
+fn router<B: IncusBackend>(app: App<B>) -> Router {
     Router::new()
         .route("/health", get(health::<B>))
         .route("/control", get(control_upgrade::<B>))
         .route(
-            "/routes/{universe}/{binding}/{environment}/{incarnation}/{target}",
+            "/routes/{universe}/{environment}/{target}",
             get(data_upgrade::<B>),
         )
-        .with_state(App::new(config, backend))
+        .with_state(app)
 }
 
 async fn health<B: IncusBackend>(State(app): State<App<B>>) -> Response {
@@ -157,13 +188,17 @@ async fn health<B: IncusBackend>(State(app): State<App<B>>) -> Response {
     }
 }
 
-/// True when the request carries the provider credential as a bearer token.
+/// True when no credential is configured, or when the request carries it as
+/// a bearer token.
 fn authorized(config: &Config, headers: &HeaderMap) -> bool {
+    let Some(credential) = &config.credential else {
+        return true;
+    };
     headers
         .get(header::AUTHORIZATION)
         .and_then(|value| value.to_str().ok())
         .and_then(|value| value.strip_prefix("Bearer "))
-        .is_some_and(|token| config.credential.matches(token))
+        .is_some_and(|token| credential.matches(token))
 }
 
 fn unauthorized() -> Response {
@@ -196,60 +231,169 @@ async fn control_upgrade<B: IncusBackend>(
     }
 }
 
+/// A target's data route. A powered-down target is woken first; the dial
+/// then waits, at most the protocol's hold bound, until envd answers, and
+/// otherwise refuses with a typed [`DataRouteRefusal`]. The whole dial and
+/// the relay after it hold the instance's [`RelayHold`](relay::RelayHold),
+/// so the idle loop leaves it alone.
 async fn data_upgrade<B: IncusBackend>(
     State(app): State<App<B>>,
-    Path((universe, binding, environment, incarnation, target_id)): Path<(
-        String,
-        String,
-        String,
-        String,
-        String,
-    )>,
+    Path((universe, environment, target_id)): Path<(String, String, String)>,
     headers: HeaderMap,
     upgrade: Result<WebSocketUpgrade, WebSocketUpgradeRejection>,
 ) -> Response {
     if !authorized(&app.config, &headers) {
         return unauthorized();
     }
-    let owner = match (
-        UniverseId::new(universe),
-        BindingId::new(binding),
-        EnvironmentId::new(environment),
-        IncarnationId::new(incarnation),
-    ) {
-        (Ok(universe_id), Ok(binding_id), Ok(environment_id), Ok(incarnation_id)) => TargetOwner {
+    let owner = match (UniverseId::new(universe), EnvironmentId::new(environment)) {
+        (Ok(universe_id), Ok(environment_id)) => TargetOwner {
             universe_id,
-            binding_id,
             environment_id,
-            incarnation_id,
         },
         _ => return StatusCode::NOT_FOUND.into_response(),
     };
-    if target_id != policy::instance_name(&owner) {
-        return StatusCode::NOT_FOUND.into_response();
-    }
-    let target = match app
-        .backend
-        .get_owned(&policy::binding_of(&owner), &target_id)
-        .await
-    {
-        Ok(Some(target)) if target.owner == owner => target,
-        Ok(Some(_)) => return StatusCode::CONFLICT.into_response(),
-        Ok(None) => return StatusCode::NOT_FOUND.into_response(),
-        Err(_) => return StatusCode::BAD_GATEWAY.into_response(),
-    };
     let upgrade = match upgrade {
         Ok(upgrade) => upgrade,
         Err(rejection) => return rejection.into_response(),
     };
-    let guest = match relay::dial_guest(&app.config, &target).await {
-        Ok(guest) => guest,
-        Err(_) => return StatusCode::SERVICE_UNAVAILABLE.into_response(),
-    };
-    let config = app.config.clone();
-    with_limits(upgrade)
-        .on_upgrade(move |socket| relay::proxy(config, socket, guest))
-        .into_response()
+    // Any other id names no target this owner can hold.
+    if target_id != policy::instance_name(&owner) {
+        return refuse(DataRouteRefusal::Gone {});
+    }
+    let hold = app.relays.hold(&target_id);
+    let mut woke = false;
+    let dialed = tokio::time::timeout(
+        app.data_route_hold,
+        wake_and_dial(&app, &owner, &target_id, &mut woke),
+    )
+    .await;
+    // A woken instance gets the wake grace once this connection ends, so
+    // the caller's next dial, or its first `use`, arrives before the idle
+    // loop looks again.
+    if woke && !matches!(dialed, Ok(Ok(_))) {
+        app.wakes.record(&target_id, Instant::now());
+    }
+    match dialed {
+        Ok(Ok(guest)) => {
+            let config = app.config.clone();
+            let wakes = woke.then(|| app.wakes.clone());
+            with_limits(upgrade)
+                .on_upgrade(move |socket| async move {
+                    let _hold = hold;
+                    relay::proxy(config, socket, guest).await;
+                    if let Some(wakes) = wakes {
+                        wakes.record(&target_id, Instant::now());
+                    }
+                })
+                .into_response()
+        }
+        Ok(Err(DialRefusal::Refused(refusal))) => refuse(refusal),
+        Ok(Err(DialRefusal::Backend)) => StatusCode::BAD_GATEWAY.into_response(),
+        Err(_) if woke => refuse(DataRouteRefusal::Waking {}),
+        Err(_) => refuse(DataRouteRefusal::Booting {}),
+    }
+}
+
+/// Why a data route dial does not upgrade.
+enum DialRefusal {
+    Refused(DataRouteRefusal),
+    /// Incus could not be read; answered 502 without a body.
+    Backend,
+}
+
+/// Wake the owner's instance when it is powered down, then dial its envd
+/// until it answers. Runs until it succeeds or meets a terminal state; the
+/// caller bounds it. `woke` records that this dial started a wake.
+async fn wake_and_dial<B: IncusBackend>(
+    app: &App<B>,
+    owner: &TargetOwner,
+    name: &str,
+    woke: &mut bool,
+) -> Result<GuestSocket, DialRefusal> {
+    loop {
+        let job = app
+            .work
+            .view(name)
+            .filter(Slot::running)
+            .map(|slot| slot.kind);
+        if job == Some(WorkKind::Close) {
+            return Err(DialRefusal::Refused(DataRouteRefusal::Gone {}));
+        }
+        // A wake runs only after the power-down it superseded, which the
+        // slot no longer shows: until the wake finished, the instance may
+        // still read running while it is about to freeze or stop.
+        if job == Some(WorkKind::Power(PowerState::Running)) {
+            *woke = true;
+            tokio::time::sleep(HOLD_POLL).await;
+            continue;
+        }
+        let target = match app.backend.get_owned(&owner.universe_id, name).await {
+            Ok(Some(target)) if target.owner == *owner => Some(target),
+            // A create still running has no instance to show yet.
+            Ok(_) if job == Some(WorkKind::Create) => None,
+            Ok(_) => return Err(DialRefusal::Refused(DataRouteRefusal::Gone {})),
+            Err(_) => return Err(DialRefusal::Backend),
+        };
+        // A create still running starts the instance itself.
+        if let Some(target) = target.filter(|_| job != Some(WorkKind::Create)) {
+            let powering_down =
+                matches!(job, Some(WorkKind::Power(power)) if power != PowerState::Running);
+            match target.status {
+                InstanceStatus::Error => {
+                    return Err(DialRefusal::Refused(DataRouteRefusal::Failed {
+                        message: DescriptiveText::lossy(INSTANCE_ERROR)
+                            .expect("the error text is descriptive"),
+                    }));
+                }
+                InstanceStatus::Frozen | InstanceStatus::Stopped | InstanceStatus::Stopping => {
+                    wake(app, owner, name);
+                    *woke = true;
+                }
+                InstanceStatus::Running | InstanceStatus::Starting if powering_down => {
+                    wake(app, owner, name);
+                    *woke = true;
+                }
+                InstanceStatus::Running | InstanceStatus::Starting => {
+                    if target.ipv4_address.is_some() {
+                        let attempt =
+                            DIAL_ATTEMPT.min(Duration::from_secs(app.config.dial_timeout_seconds));
+                        if let Ok(guest) =
+                            relay::dial_guest_within(&app.config, &target, attempt).await
+                        {
+                            return Ok(guest);
+                        }
+                    }
+                }
+                InstanceStatus::Other => {}
+            }
+        }
+        tokio::time::sleep(HOLD_POLL).await;
+    }
+}
+
+/// Power the instance up as its background job, unless a wake is already
+/// running. A power-down job still running finishes first, then this one
+/// runs; [`wake_and_dial`] dials only once it finished.
+fn wake<B: IncusBackend>(app: &App<B>, owner: &TargetOwner, name: &str) {
+    app.work.start(
+        name,
+        WorkKind::Power(PowerState::Running),
+        power_job(&app.backend, &owner.universe_id, name, PowerState::Running),
+    );
+}
+
+/// A data route refusal: its status, its JSON body and, for a 503,
+/// `Retry-After`.
+fn refuse(refusal: DataRouteRefusal) -> Response {
+    let status = StatusCode::from_u16(refusal.status()).unwrap_or(StatusCode::SERVICE_UNAVAILABLE);
+    let retryable = refusal.is_retryable();
+    let mut response = (status, Json(refusal)).into_response();
+    if retryable {
+        response
+            .headers_mut()
+            .insert(header::RETRY_AFTER, HeaderValue::from(RETRY_AFTER_SECS));
+    }
+    response
 }
 
 /// One controller connection: the JSON-RPC envelope, the `initialize`-first
@@ -383,26 +527,15 @@ async fn route<B: IncusBackend>(app: &App<B>, request: &Request) -> Result<Value
     else {
         return Err(ProtocolError::method_not_found(&request.method));
     };
-    let capabilities = &app.initialize.capabilities;
-    match spec.capability {
-        Some(Capability::AdoptTarget) if !capabilities.adopt_target => {
-            return Err(ProtocolError::capability_unavailable(
-                Capability::AdoptTarget,
-                "this provider does not adopt targets",
-            ));
-        }
-        Some(Capability::Ingress) if !capabilities.ingress => {
-            return Err(ProtocolError::capability_unavailable(
-                Capability::Ingress,
-                "this provider has no public ingress configured",
-            ));
-        }
-        _ => {}
+    if spec.capability == Some(Capability::Ingress) && !app.initialize.capabilities.ingress {
+        return Err(ProtocolError::capability_unavailable(
+            Capability::Ingress,
+            "this provider has no public ingress configured",
+        ));
     }
     match request.method.as_str() {
         TemplateList::NAME => encode(list_templates(app, request.params()?)),
         TargetCreate::NAME => encode(create_target(app, request.params()?).await?),
-        TargetAdopt::NAME => encode(adopt_target(app, request.params()?).await?),
         TargetGet::NAME => encode(get_target(app, request.params()?).await?),
         TargetSetPower::NAME => encode(set_target_power(app, request.params()?).await?),
         TargetClose::NAME => encode(close_target(app, request.params()?).await?),
@@ -417,6 +550,7 @@ fn encode<T: Serialize>(value: T) -> Result<Value, ProtocolError> {
         .map_err(|error| ProtocolError::internal(format!("encode result: {error}")))
 }
 
+/// Every universe gets the same provider-wide templates.
 fn list_templates<B>(app: &App<B>, _params: ListTemplatesParams) -> ListTemplatesResponse {
     ListTemplatesResponse {
         templates: app
@@ -427,7 +561,9 @@ fn list_templates<B>(app: &App<B>, _params: ListTemplatesParams) -> ListTemplate
                 template_id: template.template_id.clone(),
                 display_name: template.display_name.clone(),
                 description: template.description.clone(),
+                power_states: SUPPORTED_POWER_STATES.to_vec(),
                 public_ingress: template.public_ingress,
+                idle: template.idle.clone(),
                 deprecated: template.deprecated,
                 resources: Some(template.resources.clone()),
                 metadata: display_metadata([(
@@ -446,23 +582,42 @@ async fn get_target<B: IncusBackend>(
     let owner = &params.target.owner;
     let name = resolve(app, &params.target).await?;
     let observed = observe(app, owner, &name).await?;
-    observation(app, owner, &name, &observed, true)
-        .await
+    observation(app, owner, &name, &observed)
         .map(|target| TargetResponse { target })
         .ok_or_else(|| ProtocolError::not_found(format!("no target exists for owner {name}")))
 }
 
+/// The wire path of an idle stage's threshold in `target/create` params.
+fn idle_stage_field(action: IdleAction) -> &'static str {
+    match action {
+        IdleAction::Pause => "idle.pauseAfterMs",
+        IdleAction::Suspend => "idle.suspendAfterMs",
+        IdleAction::Stop => "idle.stopAfterMs",
+        IdleAction::Close => "idle.closeAfterMs",
+    }
+}
+
 async fn create_target<B: IncusBackend>(
     app: &App<B>,
     params: CreateTargetParams,
 ) -> Result<TargetResponse, ProtocolError> {
+    if let Some(idle) = &params.idle {
+        idle.validate()
+            .map_err(|error| ProtocolError::invalid_field("idle", error.to_string()))?;
+        if let Some(action) = unsupported_idle_stage(idle) {
+            return Err(ProtocolError::invalid_field(
+                idle_stage_field(action),
+                format!("the Incus provider cannot carry out the {action} stage"),
+            ));
+        }
+    }
     let owner = params.owner;
     let name = policy::instance_name(&owner);
     let observed = observe(app, &owner, &name).await?;
     if observed.holds_target() {
         // Idempotent per owner: an owner that holds a target gets it back,
         // and no creation policy runs again.
-        return observed_response(app, &owner, &name, &observed).await;
+        return observed_response(app, &owner, &name, &observed);
     }
     let template = app
         .config
@@ -484,17 +639,22 @@ async fn create_target<B: IncusBackend>(
         ));
     }
     let template = template.clone();
+    // The target keeps the policy it was created with, even when the
+    // template's default changes later.
+    let idle = params.idle.or_else(|| template.idle.clone());
     let backend = app.backend.clone();
     let job_owner = owner.clone();
     let job_name = name.clone();
     let job = async move {
-        let binding = policy::binding_of(&job_owner);
-        if backend.get_owned(&binding, &job_name).await?.is_some() {
+        let universe_id = &job_owner.universe_id;
+        if backend.get_owned(universe_id, &job_name).await?.is_some() {
             return Ok(());
         }
-        backend.reconcile_binding(&binding).await?;
+        backend.reconcile_universe(universe_id).await?;
         backend.ensure_image(&template.image_fingerprint).await?;
-        backend.create_vm(&job_owner, &template).await
+        backend
+            .create_vm(&job_owner, &template, idle.as_ref())
+            .await
     };
     let target = mutate(app, &owner, &name, WorkKind::Create, job.boxed())
         .await?
@@ -502,74 +662,6 @@ async fn create_target<B: IncusBackend>(
     Ok(TargetResponse { target })
 }
 
-async fn adopt_target<B: IncusBackend>(
-    app: &App<B>,
-    params: AdoptTargetParams,
-) -> Result<TargetResponse, ProtocolError> {
-    let owner = params.owner;
-    let source = params.source_target;
-    let name = policy::instance_name(&owner);
-    let observed = observe(app, &owner, &name).await?;
-    let adopting_this = match (&observed.instance, &observed.slot) {
-        (_, Some(slot)) if slot.running() && slot.kind == WorkKind::Close => true,
-        (Some(instance), _) => instance.adoption_source.as_deref() == Some(source.as_str()),
-        (None, Some(slot)) if slot.running() => slot.kind == WorkKind::Adopt,
-        (None, _) => {
-            crate::incus::parse_source_target(source.as_str())
-                .map_err(|error| ProtocolError::invalid_field("sourceTarget", error.to_string()))?;
-            match app
-                .backend
-                .adoption_source(&source)
-                .await
-                .map_err(unavailable)?
-            {
-                AdoptionSource::Adoptable => {}
-                AdoptionSource::Missing => {
-                    return Err(ProtocolError::not_found(format!(
-                        "adoption source {source} does not exist"
-                    )));
-                }
-                AdoptionSource::Managed => {
-                    return Err(ProtocolError::failed_precondition(
-                        PreconditionReason::OwnerMismatch,
-                        format!("adoption source {source} already belongs to an owner"),
-                    ));
-                }
-                AdoptionSource::NotAdoptable(reason) => {
-                    return Err(ProtocolError::failed_precondition(
-                        PreconditionReason::NotAdoptable,
-                        format!("adoption source {source}: {reason}"),
-                    ));
-                }
-            }
-            let backend = app.backend.clone();
-            let job_owner = owner.clone();
-            let job_name = name.clone();
-            let job = async move {
-                let binding = policy::binding_of(&job_owner);
-                if backend.get_owned(&binding, &job_name).await?.is_some() {
-                    return Ok(());
-                }
-                backend.reconcile_binding(&binding).await?;
-                backend.adopt_vm(&job_owner, &source).await
-            };
-            let target = mutate(app, &owner, &name, WorkKind::Adopt, job.boxed())
-                .await?
-                .ok_or_else(|| {
-                    ProtocolError::unavailable("the adopted Incus instance is not visible")
-                })?;
-            return Ok(TargetResponse { target });
-        }
-    };
-    if !adopting_this {
-        return Err(ProtocolError::failed_precondition(
-            PreconditionReason::OwnerMismatch,
-            "the owner already holds a different target",
-        ));
-    }
-    observed_response(app, &owner, &name, &observed).await
-}
-
 async fn set_target_power<B: IncusBackend>(
     app: &App<B>,
     params: SetTargetPowerParams,
@@ -584,29 +676,19 @@ async fn set_target_power<B: IncusBackend>(
     let owner = &params.target.owner;
     let name = resolve(app, &params.target).await?;
     let observed = observe(app, owner, &name).await?;
-    let current = observation(app, owner, &name, &observed, false)
-        .await
+    let current = observation(app, owner, &name, &observed)
         .ok_or_else(|| ProtocolError::not_found(format!("target {name} does not exist")))?;
-    if current.state.phase != TargetPhase::Active {
+    if current.phase != TargetPhase::Active {
         return Err(ProtocolError::failed_precondition(
             PreconditionReason::TargetNotActive,
-            format!("target {name} is {:?}, not active", current.state.phase),
+            format!("target {name} is {:?}, not active", current.phase),
         ));
     }
-    if current.state.power == Some(power) && !observed.slot.as_ref().is_some_and(Slot::running) {
-        return observed_response(app, owner, &name, &observed).await;
+    if current.power == Some(power) && !observed.slot.as_ref().is_some_and(Slot::running) {
+        return observed_response(app, owner, &name, &observed);
     }
-    let backend = app.backend.clone();
-    let binding = policy::binding_of(owner);
-    let job_name = name.clone();
-    let job = async move {
-        let target = backend
-            .get_owned(&binding, &job_name)
-            .await?
-            .ok_or_else(|| anyhow::anyhow!("the Incus instance disappeared"))?;
-        backend.set_power(&target, power).await
-    };
-    let target = mutate(app, owner, &name, WorkKind::Power(power), job.boxed())
+    let job = power_job(&app.backend, &owner.universe_id, &name, power);
+    let target = mutate(app, owner, &name, WorkKind::Power(power), job)
         .await?
         .ok_or_else(|| ProtocolError::not_found(format!("target {name} disappeared")))?;
     Ok(TargetResponse { target })
@@ -625,16 +707,11 @@ async fn close_target<B: IncusBackend>(
             target: closed(owner),
         });
     }
-    let backend = app.backend.clone();
-    let binding = policy::binding_of(owner);
-    let job_name = name.clone();
-    let job = async move {
-        match backend.get_owned(&binding, &job_name).await? {
-            Some(target) => backend.delete_vm(&target).await,
-            None => Ok(()),
-        }
-    };
-    app.work.start(&name, WorkKind::Close, job.boxed());
+    app.work.start(
+        &name,
+        WorkKind::Close,
+        close_job(&app.backend, &owner.universe_id, &name),
+    );
     wait_for_work(app, &name).await;
     let observed = observe(app, owner, &name).await?;
     if !observed.holds_target() {
@@ -642,21 +719,53 @@ async fn close_target<B: IncusBackend>(
             target: closed(owner),
         });
     }
-    let mut target = observation(app, owner, &name, &observed, false)
-        .await
-        .unwrap_or_else(|| closed(owner));
+    let mut target = observation(app, owner, &name, &observed).unwrap_or_else(|| closed(owner));
     // Until the instance is gone, a close answers closing, with the error of
     // a failed attempt as its message; the next close tries again.
-    target.state = TargetState {
-        phase: TargetPhase::Closing,
-        power: None,
-        daemon_ready: false,
-        message: target.state.message,
-    };
-    target.supported_power_states.clear();
+    target.phase = TargetPhase::Closing;
+    target.power = None;
     Ok(TargetResponse { target })
 }
 
+/// The background job that moves the instance `name` toward `power`.
+pub(crate) fn power_job<B: IncusBackend>(
+    backend: &B,
+    universe_id: &UniverseId,
+    name: &str,
+    power: PowerState,
+) -> BoxFuture<'static, anyhow::Result<()>> {
+    let backend = backend.clone();
+    let universe_id = universe_id.clone();
+    let name = name.to_owned();
+    async move {
+        let target = backend
+            .get_owned(&universe_id, &name)
+            .await?
+            .ok_or_else(|| anyhow::anyhow!("the Incus instance disappeared"))?;
+        backend.set_power(&target, power).await
+    }
+    .boxed()
+}
+
+/// The background job that destroys the instance `name`, if it still
+/// exists.
+pub(crate) fn close_job<B: IncusBackend>(
+    backend: &B,
+    universe_id: &UniverseId,
+    name: &str,
+) -> BoxFuture<'static, anyhow::Result<()>> {
+    let backend = backend.clone();
+    let universe_id = universe_id.clone();
+    let name = name.to_owned();
+    async move {
+        match backend.get_owned(&universe_id, &name).await? {
+            Some(target) => backend.delete_vm(&target).await,
+            None => Ok(()),
+        }
+    }
+    .boxed()
+}
+
 async fn ensure_ingress<B: IncusBackend>(
     app: &App<B>,
     params: EnsureIngressParams,
@@ -664,8 +773,8 @@ async fn ensure_ingress<B: IncusBackend>(
     let owner = &params.target.owner;
     let name = resolve(app, &params.target).await?;
     let observed = observe(app, owner, &name).await?;
-    let Some(instance) = ingress_subject(app, owner, &name, &observed).await? else {
-        return observed_response(app, owner, &name, &observed).await;
+    let Some(instance) = ingress_subject(app, owner, &name, &observed)? else {
+        return observed_response(app, owner, &name, &observed);
     };
     let port = TemplateId::new(instance.template_id.as_str())
         .ok()
@@ -683,14 +792,14 @@ async fn ensure_ingress<B: IncusBackend>(
     if instance.ingress_hostname.as_deref() == Some(hostname.as_str())
         && instance.ingress_port == Some(port)
     {
-        return observed_response(app, owner, &name, &observed).await;
+        return observed_response(app, owner, &name, &observed);
     }
     let backend = app.backend.clone();
-    let binding = policy::binding_of(owner);
+    let universe_id = owner.universe_id.clone();
     let job_name = name.clone();
     let job = async move {
         let target = backend
-            .get_owned(&binding, &job_name)
+            .get_owned(&universe_id, &job_name)
             .await?
             .ok_or_else(|| anyhow::anyhow!("the Incus instance disappeared"))?;
         backend.set_ingress(&target, Some((&hostname, port))).await
@@ -714,18 +823,18 @@ async fn remove_ingress<B: IncusBackend>(
     let owner = &params.target.owner;
     let name = resolve(app, &params.target).await?;
     let observed = observe(app, owner, &name).await?;
-    let Some(instance) = ingress_subject(app, owner, &name, &observed).await? else {
-        return observed_response(app, owner, &name, &observed).await;
+    let Some(instance) = ingress_subject(app, owner, &name, &observed)? else {
+        return observed_response(app, owner, &name, &observed);
     };
     if instance.ingress_hostname.is_none() && instance.ingress_port.is_none() {
-        return observed_response(app, owner, &name, &observed).await;
+        return observed_response(app, owner, &name, &observed);
     }
     let backend = app.backend.clone();
-    let binding = policy::binding_of(owner);
+    let universe_id = owner.universe_id.clone();
     let job_name = name.clone();
     let job = async move {
         let target = backend
-            .get_owned(&binding, &job_name)
+            .get_owned(&universe_id, &job_name)
             .await?
             .ok_or_else(|| anyhow::anyhow!("the Incus instance disappeared"))?;
         backend.set_ingress(&target, None).await
@@ -745,16 +854,15 @@ async fn remove_ingress<B: IncusBackend>(
 /// The instance whose ingress may change, `None` when the target is closing
 /// (the caller answers with the observation), or an error when there is no
 /// instance yet or at all.
-async fn ingress_subject<B: IncusBackend>(
+fn ingress_subject<B>(
     app: &App<B>,
     owner: &TargetOwner,
     name: &str,
     observed: &Observed,
 ) -> Result<Option<OwnedTarget>, ProtocolError> {
-    let current = observation(app, owner, name, observed, false)
-        .await
+    let current = observation(app, owner, name, observed)
         .ok_or_else(|| ProtocolError::not_found(format!("target {name} does not exist")))?;
-    if current.state.phase == TargetPhase::Closing {
+    if current.phase == TargetPhase::Closing {
         return Ok(None);
     }
     observed.instance.clone().map(Some).ok_or_else(|| {
@@ -781,7 +889,7 @@ async fn resolve<B: IncusBackend>(
         let foreign = app.work.view(target_id.as_str()).is_some()
             || app
                 .backend
-                .get_owned(&policy::binding_of(&target.owner), target_id.as_str())
+                .get_owned(&target.owner.universe_id, target_id.as_str())
                 .await
                 .map_err(unavailable)?
                 .is_some();
@@ -814,7 +922,7 @@ async fn observe<B: IncusBackend>(
 ) -> Result<Observed, ProtocolError> {
     let instance = app
         .backend
-        .get_owned(&policy::binding_of(owner), name)
+        .get_owned(&owner.universe_id, name)
         .await
         .map_err(unavailable)?;
     if let Some(instance) = &instance
@@ -828,33 +936,49 @@ async fn observe<B: IncusBackend>(
     })
 }
 
-async fn observed_response<B: IncusBackend>(
+fn observed_response<B>(
     app: &App<B>,
     owner: &TargetOwner,
     name: &str,
     observed: &Observed,
 ) -> Result<TargetResponse, ProtocolError> {
-    observation(app, owner, name, observed, true)
-        .await
+    observation(app, owner, name, observed)
         .map(|target| TargetResponse { target })
         .ok_or_else(|| ProtocolError::not_found(format!("target {name} does not exist")))
 }
 
+/// The phase, power and message of an observation.
+struct Condition {
+    phase: TargetPhase,
+    power: Option<PowerState>,
+    message: Option<DescriptiveText>,
+}
+
+impl Condition {
+    fn phase(phase: TargetPhase, message: &str) -> Self {
+        Self {
+            phase,
+            power: None,
+            message: DescriptiveText::lossy(message),
+        }
+    }
+}
+
 /// The observation of a target, or `None` when the owner holds nothing.
-/// `probe` runs the envd liveness probe for a running instance.
 ///
 /// `targetId` is reported only once the Incus instance exists. Until then
-/// the runtime keeps sending the idempotent `target/create` (or
-/// `target/adopt`), which starts the job again when it failed or was lost
-/// with a provider restart; a failed attempt is reported as `provisioning`
-/// with its error as `message`, so the runtime retries it until its
-/// provisioning deadline instead of failing at the first Incus hiccup.
-async fn observation<B: IncusBackend>(
+/// the runtime keeps sending the idempotent `target/create`, which starts
+/// the job again when it failed or was lost with a provider restart; a
+/// failed attempt is reported as `provisioning` with its error as
+/// `message`, so the runtime retries it until its provisioning deadline
+/// instead of failing at the first Incus hiccup. Whether envd answers is
+/// not part of an observation: the runtime's open handshake over the data
+/// route proves it.
+fn observation<B>(
     app: &App<B>,
     owner: &TargetOwner,
     name: &str,
     observed: &Observed,
-    probe: bool,
 ) -> Option<TargetObservation> {
     let failure = observed.slot.as_ref().and_then(Slot::failure);
     let running = observed
@@ -865,114 +989,69 @@ async fn observation<B: IncusBackend>(
     let failed_creation = observed
         .slot
         .as_ref()
-        .filter(|slot| !slot.running())
-        .and_then(|slot| match slot.kind {
-            WorkKind::Create => Some("target/create"),
-            WorkKind::Adopt => Some("target/adopt"),
-            _ => None,
-        });
-    let state = match (running, &observed.instance) {
+        .is_some_and(|slot| !slot.running() && slot.kind == WorkKind::Create);
+    let condition = match (running, &observed.instance) {
         (Some(WorkKind::Close), _) => {
-            phase_state(TargetPhase::Closing, None, "closing the Incus instance")
+            Condition::phase(TargetPhase::Closing, "closing the Incus instance")
         }
-        (Some(WorkKind::Create), _) => phase_state(
+        (Some(WorkKind::Create), _) => Condition::phase(
             TargetPhase::Provisioning,
-            None,
             "creating and starting the Incus instance",
         ),
-        (Some(WorkKind::Adopt), _) => phase_state(
-            TargetPhase::Provisioning,
-            None,
-            "adopting the Incus instance",
-        ),
         (_, Some(instance)) => {
-            let mut state = instance_state(instance);
-            if probe && instance.status == InstanceStatus::Running {
-                state.daemon_ready = relay::probe_guest(&app.config, instance).await;
-            }
-            if state.message.is_none() {
-                state.message = failure.and_then(DescriptiveText::lossy);
+            let mut condition = instance_condition(instance);
+            if condition.message.is_none() {
+                condition.message = failure.and_then(DescriptiveText::lossy);
             }
-            state
-        }
-        (_, None) => {
-            let retried_by = failed_creation?;
-            phase_state(
-                TargetPhase::Provisioning,
-                None,
-                &format!(
-                    "the last attempt failed and the next {retried_by} retries it: {}",
-                    failure.unwrap_or("unknown error")
-                ),
-            )
+            condition
         }
+        (_, None) if failed_creation => Condition::phase(
+            TargetPhase::Provisioning,
+            &format!(
+                "the last attempt failed and the next target/create retries it: {}",
+                failure.unwrap_or("unknown error")
+            ),
+        ),
+        (_, None) => return None,
     };
     let target_id = match &observed.instance {
         Some(_) => Some(ProviderTargetId::new(name).ok()?),
         None => None,
     };
-    let instance = observed.instance.as_ref();
-    let ingress = instance
+    let ingress = observed
+        .instance
+        .as_ref()
         .and_then(|instance| instance.ingress_hostname.as_deref())
         .and_then(|hostname| ingress::public_endpoint(&app.config, hostname).ok())
         .map(|endpoint| IngressObservation { endpoint });
-    let metadata = instance.map_or_else(Metadata::default, |instance| {
-        display_metadata([
-            ("templateId", instance.template_id.as_str()),
-            ("imageFingerprint", instance.image_fingerprint.as_str()),
-            (
-                "incusMember",
-                instance.location.as_deref().unwrap_or_default(),
-            ),
-        ])
-    });
-    let supported_power_states = if state.phase == TargetPhase::Closing {
-        Vec::new()
-    } else {
-        SUPPORTED_POWER_STATES.to_vec()
-    };
     Some(TargetObservation {
         target_id,
         owner: owner.clone(),
-        display_name: None,
-        state,
-        supported_power_states,
+        phase: condition.phase,
+        power: condition.power,
+        message: condition.message,
         ingress,
-        metadata,
     })
 }
 
-fn phase_state(phase: TargetPhase, power: Option<PowerState>, message: &str) -> TargetState {
-    TargetState {
-        phase,
-        power,
-        daemon_ready: false,
-        message: DescriptiveText::lossy(message),
-    }
-}
+const INSTANCE_ERROR: &str = "Incus reports the instance in the Error state";
 
-/// The two-axis state an Incus instance status maps to. A starting VM is
+/// The phase and power an Incus instance status maps to. A starting VM is
 /// reported running and a stopping one stopped: `power` names where the
-/// target is going, and `daemonReady` says whether envd answers yet.
-fn instance_state(instance: &OwnedTarget) -> TargetState {
-    let active = |power| TargetState {
+/// target is going.
+fn instance_condition(instance: &OwnedTarget) -> Condition {
+    let active = |power| Condition {
         phase: TargetPhase::Active,
         power: Some(power),
-        daemon_ready: false,
         message: None,
     };
     match instance.status {
         InstanceStatus::Running | InstanceStatus::Starting => active(PowerState::Running),
         InstanceStatus::Frozen => active(PowerState::Paused),
         InstanceStatus::Stopped | InstanceStatus::Stopping => active(PowerState::Stopped),
-        InstanceStatus::Error => phase_state(
-            TargetPhase::Failed,
-            None,
-            "Incus reports the instance in the Error state",
-        ),
-        InstanceStatus::Other => phase_state(
+        InstanceStatus::Error => Condition::phase(TargetPhase::Failed, INSTANCE_ERROR),
+        InstanceStatus::Other => Condition::phase(
             TargetPhase::Unknown,
-            None,
             "Incus reports an instance status this provider does not recognize",
         ),
     }
@@ -982,16 +1061,10 @@ fn closed(owner: &TargetOwner) -> TargetObservation {
     TargetObservation {
         target_id: None,
         owner: owner.clone(),
-        display_name: None,
-        state: TargetState {
-            phase: TargetPhase::Closed,
-            power: None,
-            daemon_ready: false,
-            message: None,
-        },
-        supported_power_states: Vec::new(),
+        phase: TargetPhase::Closed,
+        power: None,
+        message: None,
         ingress: None,
-        metadata: Metadata::default(),
     }
 }
 
@@ -1028,7 +1101,7 @@ async fn mutate<B: IncusBackend>(
     app.work.start(name, kind, job);
     wait_for_work(app, name).await;
     let observed = observe(app, owner, name).await?;
-    Ok(observation(app, owner, name, &observed, true).await)
+    Ok(observation(app, owner, name, &observed))
 }
 
 async fn wait_for_work<B>(app: &App<B>, name: &str) {
@@ -1039,9 +1112,8 @@ async fn wait_for_work<B>(app: &App<B>, name: &str) {
 
 /// The background job kinds; at most one job per target is current.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
-enum WorkKind {
+pub(crate) enum WorkKind {
     Create,
-    Adopt,
     Power(PowerState),
     Ingress { enabled: bool },
     Close,
@@ -1081,7 +1153,7 @@ impl Slot {
 /// current slot (a close supersedes a running create) and its job runs once
 /// the earlier one finished.
 #[derive(Default)]
-struct Work {
+pub(crate) struct Work {
     next_id: AtomicU64,
     inner: StdMutex<WorkInner>,
 }
@@ -1101,7 +1173,7 @@ impl Work {
 
     /// Run `job` as the target's current job unless a job of the same kind
     /// is already running.
-    fn start(
+    pub(crate) fn start(
         self: &Arc<Self>,
         name: &str,
         kind: WorkKind,
@@ -1185,6 +1257,11 @@ impl Work {
         self.lock().slots.get(name).cloned()
     }
 
+    /// True while a job of the target runs.
+    pub(crate) fn busy(&self, name: &str) -> bool {
+        self.lock().slots.get(name).is_some_and(Slot::running)
+    }
+
     fn done(&self, name: &str) -> Option<watch::Receiver<bool>> {
         self.lock()
             .slots
@@ -1195,16 +1272,15 @@ impl Work {
 }
 
 #[cfg(test)]
-mod tests {
+pub(crate) mod tests {
     use std::sync::atomic::AtomicUsize;
 
     use async_trait::async_trait;
+    use environment_client::{ConnectOptions, DataClient, conformance::data_route::check_refusal};
     use environment_protocol::{
-        control::target::BindingRef,
         error::{ErrorData, ProtocolErrorKind},
-        ids::ProviderNativeRef,
+        idle::IdlePolicy,
         jsonrpc::Id,
-        routes::DataRouteBase,
     };
 
     use super::*;
@@ -1217,18 +1293,25 @@ mod tests {
         policy::tests::owner,
     };
 
-    const CREDENTIAL: &str = "0123456789abcdef0123456789abcdef";
+    pub(crate) const CREDENTIAL: &str = "0123456789abcdef0123456789abcdef";
 
     /// An in-memory Incus: instances by name, every mutation instant.
     #[derive(Clone, Default)]
-    struct FakeBackend {
-        instances: Arc<StdMutex<BTreeMap<String, OwnedTarget>>>,
-        creates: Arc<AtomicUsize>,
-        deletes: Arc<AtomicUsize>,
+    pub(crate) struct FakeBackend {
+        pub(crate) instances: Arc<StdMutex<BTreeMap<String, OwnedTarget>>>,
+        pub(crate) creates: Arc<AtomicUsize>,
+        pub(crate) deletes: Arc<AtomicUsize>,
+        /// Every `set_power` target state, in order.
+        pub(crate) power_calls: Arc<StdMutex<Vec<PowerState>>>,
     }
 
     impl FakeBackend {
-        fn insert(&self, owner: &TargetOwner, template_id: &str, status: InstanceStatus) {
+        pub(crate) fn insert(
+            &self,
+            owner: &TargetOwner,
+            template_id: &str,
+            status: InstanceStatus,
+        ) {
             let name = policy::instance_name(owner);
             self.instances.lock().unwrap().insert(
                 name.clone(),
@@ -1236,8 +1319,7 @@ mod tests {
                     target_id: ProviderTargetId::new(name).unwrap(),
                     owner: owner.clone(),
                     template_id: template_id.to_owned(),
-                    image_fingerprint: "fingerprint".to_owned(),
-                    adoption_source: None,
+                    idle: None,
                     status,
                     ipv4_address: None,
                     ingress_hostname: None,
@@ -1246,6 +1328,16 @@ mod tests {
                 },
             );
         }
+
+        pub(crate) fn update(&self, owner: &TargetOwner, change: impl FnOnce(&mut OwnedTarget)) {
+            let name = policy::instance_name(owner);
+            change(self.instances.lock().unwrap().get_mut(&name).unwrap());
+        }
+
+        pub(crate) fn get(&self, owner: &TargetOwner) -> Option<OwnedTarget> {
+            let name = policy::instance_name(owner);
+            self.instances.lock().unwrap().get(&name).cloned()
+        }
     }
 
     #[async_trait]
@@ -1261,7 +1353,7 @@ mod tests {
             })
         }
 
-        async fn reconcile_binding(&self, _binding: &BindingRef) -> anyhow::Result<()> {
+        async fn reconcile_universe(&self, _universe_id: &UniverseId) -> anyhow::Result<()> {
             Ok(())
         }
 
@@ -1275,7 +1367,7 @@ mod tests {
 
         async fn get_owned(
             &self,
-            binding: &BindingRef,
+            universe_id: &UniverseId,
             name: &str,
         ) -> anyhow::Result<Option<OwnedTarget>> {
             Ok(self
@@ -1283,7 +1375,7 @@ mod tests {
                 .lock()
                 .unwrap()
                 .get(name)
-                .filter(|target| target.binding() == *binding)
+                .filter(|target| target.universe() == universe_id)
                 .cloned())
         }
 
@@ -1291,6 +1383,7 @@ mod tests {
             &self,
             owner: &TargetOwner,
             template: &TemplatePolicy,
+            idle: Option<&IdlePolicy>,
         ) -> anyhow::Result<()> {
             self.creates.fetch_add(1, Ordering::SeqCst);
             self.insert(
@@ -1298,24 +1391,10 @@ mod tests {
                 template.template_id.as_str(),
                 InstanceStatus::Running,
             );
+            self.update(owner, |target| target.idle = idle.cloned());
             Ok(())
         }
 
-        async fn adoption_source(
-            &self,
-            _source: &ProviderNativeRef,
-        ) -> anyhow::Result<AdoptionSource> {
-            Ok(AdoptionSource::Missing)
-        }
-
-        async fn adopt_vm(
-            &self,
-            _owner: &TargetOwner,
-            _source: &ProviderNativeRef,
-        ) -> anyhow::Result<()> {
-            anyhow::bail!("the fake backend adopts nothing")
-        }
-
         async fn delete_vm(&self, target: &OwnedTarget) -> anyhow::Result<()> {
             self.deletes.fetch_add(1, Ordering::SeqCst);
             self.instances.lock().unwrap().remove(target.name());
@@ -1335,6 +1414,7 @@ mod tests {
         }
 
         async fn set_power(&self, target: &OwnedTarget, power: PowerState) -> anyhow::Result<()> {
+            self.power_calls.lock().unwrap().push(power);
             if let Some(instance) = self.instances.lock().unwrap().get_mut(target.name()) {
                 instance.status = match power {
                     PowerState::Running => InstanceStatus::Running,
@@ -1346,7 +1426,7 @@ mod tests {
         }
     }
 
-    fn template(id: &str, deprecated: bool) -> TemplatePolicy {
+    pub(crate) fn template(id: &str, deprecated: bool) -> TemplatePolicy {
         TemplatePolicy {
             template_id: TemplateId::new(id).unwrap(),
             display_name: environment_protocol::metadata::DisplayName::new("Small").unwrap(),
@@ -1359,19 +1439,25 @@ mod tests {
             public_ingress: false,
             ingress_port: None,
             deprecated,
+            idle: None,
             resources: Default::default(),
         }
     }
 
-    fn config() -> Config {
-        let templates = [template("small", false), template("retired", true)]
+    /// A provider config whose guests' envd listens on `envd_port`.
+    pub(crate) fn config_with(envd_port: u16, credential: Option<&str>) -> Config {
+        let mut idling = template("idling", false);
+        idling.idle = Some(IdlePolicy {
+            pause_after_ms: Some(600_000),
+            ..IdlePolicy::default()
+        });
+        let templates = [template("small", false), template("retired", true), idling]
             .into_iter()
             .map(|template| (template.template_id.clone(), template))
             .collect();
         Config(Arc::new(ConfigInner {
             controller_listen: "127.0.0.1:0".parse().unwrap(),
-            credential: ProviderCredential::new(CREDENTIAL).unwrap(),
-            data_route_base: DataRouteBase::new("ws://127.0.0.1:19090/routes").unwrap(),
+            credential: credential.map(|credential| ProviderCredential::new(credential).unwrap()),
             incus: IncusConfig {
                 mode: IncusMode::Single,
                 endpoints: vec!["https://incus.test".to_owned()],
@@ -1386,11 +1472,16 @@ mod tests {
             network: NetworkPolicy::default(),
             relay_idle_seconds: 60,
             dial_timeout_seconds: 1,
-            envd_port: 19091,
+            idle_check_seconds: 60,
+            envd_port,
             ingress: None,
         }))
     }
 
+    fn config() -> Config {
+        config_with(19091, Some(CREDENTIAL))
+    }
+
     fn app() -> (App<FakeBackend>, FakeBackend) {
         let backend = FakeBackend::default();
         (App::new(config(), backend.clone()), backend)
@@ -1415,6 +1506,15 @@ mod tests {
         }
     }
 
+    fn create(owner: &TargetOwner, template: &str) -> CreateTargetParams {
+        CreateTargetParams {
+            owner: owner.clone(),
+            template_id: TemplateId::new(template).unwrap(),
+            display_name: None,
+            idle: None,
+        }
+    }
+
     fn reason(error: &ProtocolError) -> Option<PreconditionReason> {
         match error.data {
             ErrorData::FailedPrecondition { reason } => Some(reason),
@@ -1427,7 +1527,8 @@ mod tests {
         let (app, _) = app();
         let mut initialized = false;
         let params = |version: u32| serde_json::json!({"protocolVersion": version, "clientInfo": {"name": "test"}});
-        let request = Request::new(Id::Number(1), "initialize", &params(4)).unwrap();
+        let other = CONTROLLER_PROTOCOL_VERSION + 1;
+        let request = Request::new(Id::Number(1), "initialize", &params(other)).unwrap();
         let mismatch = initialize(&app, &mut initialized, &request)
             .result
             .unwrap_err();
@@ -1435,20 +1536,24 @@ mod tests {
             mismatch.data,
             ErrorData::VersionMismatch {
                 expected: CONTROLLER_PROTOCOL_VERSION,
-                received: 4
+                received: other
             }
         );
         assert!(!initialized);
 
-        let request = Request::new(Id::Number(2), "initialize", &params(3)).unwrap();
+        let request = Request::new(
+            Id::Number(2),
+            "initialize",
+            &params(CONTROLLER_PROTOCOL_VERSION),
+        )
+        .unwrap();
         let response: ControllerInitializeResponse = initialize(&app, &mut initialized, &request)
             .decode()
             .unwrap();
         assert!(initialized);
         assert_eq!(response.plane, Plane::Controller);
-        assert!(response.capabilities.adopt_target);
+        assert!(response.capabilities.power);
         assert!(!response.capabilities.ingress);
-        assert_eq!(response.routes.data.as_str(), "ws://127.0.0.1:19090/routes");
 
         let repeat = initialize(&app, &mut initialized, &request)
             .result
@@ -1456,6 +1561,37 @@ mod tests {
         assert_eq!(repeat.kind(), ProtocolErrorKind::InvalidRequest);
     }
 
+    #[tokio::test(flavor = "current_thread")]
+    async fn templates_offer_power_states_and_their_idle_default() {
+        let (app, _) = app();
+        let request = Request::new(
+            Id::Number(1),
+            TemplateList::NAME,
+            &ListTemplatesParams {
+                universe_id: UniverseId::new("u").unwrap(),
+            },
+        )
+        .unwrap();
+        let listed: ListTemplatesResponse =
+            serde_json::from_value(route(&app, &request).await.unwrap()).unwrap();
+        let idling = listed
+            .templates
+            .iter()
+            .find(|template| template.template_id.as_str() == "idling")
+            .unwrap();
+        assert_eq!(idling.power_states, SUPPORTED_POWER_STATES);
+        assert_eq!(
+            idling.idle.as_ref().and_then(|idle| idle.pause_after_ms),
+            Some(600_000)
+        );
+        let small = listed
+            .templates
+            .iter()
+            .find(|template| template.template_id.as_str() == "small")
+            .unwrap();
+        assert_eq!(small.idle, None);
+    }
+
     #[tokio::test(flavor = "current_thread")]
     async fn unknown_and_unadvertised_methods_are_typed_errors() {
         let (app, _) = app();
@@ -1463,11 +1599,15 @@ mod tests {
             .await
             .unwrap_err();
         assert_eq!(unknown.kind(), ProtocolErrorKind::MethodNotFound);
+        let adopt = call(&app, "target/adopt", &serde_json::json!({}))
+            .await
+            .unwrap_err();
+        assert_eq!(adopt.kind(), ProtocolErrorKind::MethodNotFound);
         let ingress = call(
             &app,
             IngressEnsure::NAME,
             &EnsureIngressParams {
-                target: by_owner(&owner("u", "b", "e")),
+                target: by_owner(&owner("u", "e")),
             },
         )
         .await
@@ -1487,7 +1627,7 @@ mod tests {
     #[tokio::test(flavor = "current_thread")]
     async fn get_never_creates_and_answers_not_found() {
         let (app, backend) = app();
-        let owner = owner("u", "b", "e");
+        let owner = owner("u", "e");
         for _ in 0..2 {
             let error = call(
                 &app,
@@ -1520,11 +1660,8 @@ mod tests {
     #[tokio::test(flavor = "current_thread")]
     async fn create_is_idempotent_per_owner_and_applies_policy_only_once() {
         let (app, backend) = app();
-        let owner = owner("u", "b", "e");
-        let params = CreateTargetParams {
-            owner: owner.clone(),
-            template_id: TemplateId::new("small").unwrap(),
-        };
+        let owner = owner("u", "e");
+        let params = create(&owner, "small");
         let first = call(&app, TargetCreate::NAME, &params).await.unwrap();
         let second = call(&app, TargetCreate::NAME, &params).await.unwrap();
         assert_eq!(first.owner, owner);
@@ -1533,65 +1670,111 @@ mod tests {
             first.target_id.as_ref().map(ProviderTargetId::as_str),
             Some(policy::instance_name(&owner).as_str())
         );
-        assert_eq!(second.state.phase, TargetPhase::Active);
-        assert_eq!(second.state.power, Some(PowerState::Running));
+        assert_eq!(second.phase, TargetPhase::Active);
+        assert_eq!(second.power, Some(PowerState::Running));
         assert_eq!(backend.creates.load(Ordering::SeqCst), 1);
 
         // A target that already exists comes back even when its template
         // has been deprecated since: observation applies no creation policy.
-        let existing = crate::policy::tests::owner("u", "b", "old");
+        let existing = crate::policy::tests::owner("u", "old");
         backend.insert(&existing, "retired", InstanceStatus::Stopped);
-        let observed = call(
-            &app,
-            TargetCreate::NAME,
-            &CreateTargetParams {
-                owner: existing.clone(),
-                template_id: TemplateId::new("retired").unwrap(),
-            },
-        )
-        .await
-        .unwrap();
-        assert_eq!(observed.state.power, Some(PowerState::Stopped));
+        let observed = call(&app, TargetCreate::NAME, &create(&existing, "retired"))
+            .await
+            .unwrap();
+        assert_eq!(observed.power, Some(PowerState::Stopped));
         assert_eq!(backend.creates.load(Ordering::SeqCst), 1);
 
-        let refused = call(
-            &app,
-            TargetCreate::NAME,
-            &CreateTargetParams {
-                owner: crate::policy::tests::owner("u", "b", "new"),
-                template_id: TemplateId::new("retired").unwrap(),
-            },
-        )
-        .await
-        .unwrap_err();
+        let fresh = crate::policy::tests::owner("u", "new");
+        let refused = call(&app, TargetCreate::NAME, &create(&fresh, "retired"))
+            .await
+            .unwrap_err();
         assert_eq!(
             reason(&refused),
             Some(PreconditionReason::TemplateDeprecated)
         );
-        let missing = call(
-            &app,
-            TargetCreate::NAME,
-            &CreateTargetParams {
-                owner: crate::policy::tests::owner("u", "b", "new"),
-                template_id: TemplateId::new("absent").unwrap(),
-            },
-        )
-        .await
-        .unwrap_err();
+        let missing = call(&app, TargetCreate::NAME, &create(&fresh, "absent"))
+            .await
+            .unwrap_err();
         assert_eq!(missing.kind(), ProtocolErrorKind::NotFound);
     }
 
+    #[tokio::test(flavor = "current_thread")]
+    async fn create_records_the_override_or_the_template_idle_default() {
+        let (app, backend) = app();
+        let defaulted = owner("u", "defaulted");
+        call(&app, TargetCreate::NAME, &create(&defaulted, "idling"))
+            .await
+            .unwrap();
+        assert_eq!(
+            backend.get(&defaulted).unwrap().idle,
+            app.config.templates[&TemplateId::new("idling").unwrap()]
+                .idle
+                .clone()
+        );
+
+        let overridden = owner("u", "overridden");
+        let idle = IdlePolicy {
+            stop_after_ms: Some(1_800_000),
+            ..IdlePolicy::default()
+        };
+        let mut params = create(&overridden, "idling");
+        params.idle = Some(idle.clone());
+        call(&app, TargetCreate::NAME, &params).await.unwrap();
+        assert_eq!(backend.get(&overridden).unwrap().idle, Some(idle));
+
+        let none = owner("u", "none");
+        call(&app, TargetCreate::NAME, &create(&none, "small"))
+            .await
+            .unwrap();
+        assert_eq!(backend.get(&none).unwrap().idle, None);
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn create_refuses_an_invalid_idle_override() {
+        let (app, backend) = app();
+        let owner = owner("u", "e");
+        let mut params = create(&owner, "small");
+        params.idle = Some(IdlePolicy {
+            pause_after_ms: Some(600_000),
+            stop_after_ms: Some(60_000),
+            ..IdlePolicy::default()
+        });
+        let refused = call(&app, TargetCreate::NAME, &params).await.unwrap_err();
+        assert_eq!(refused.kind(), ProtocolErrorKind::InvalidParams);
+        assert_eq!(backend.creates.load(Ordering::SeqCst), 0);
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn create_refuses_an_idle_stage_incus_cannot_reach() {
+        let (app, backend) = app();
+        let owner = owner("u", "e");
+        let mut params = create(&owner, "small");
+        params.idle = Some(IdlePolicy {
+            pause_after_ms: Some(60_000),
+            suspend_after_ms: Some(600_000),
+            ..IdlePolicy::default()
+        });
+        let refused = call(&app, TargetCreate::NAME, &params).await.unwrap_err();
+        assert_eq!(refused.kind(), ProtocolErrorKind::InvalidParams);
+        assert!(matches!(
+            &refused.data,
+            ErrorData::InvalidParams { field: Some(field), .. } if field == "idle.suspendAfterMs"
+        ));
+        assert_eq!(backend.creates.load(Ordering::SeqCst), 0);
+        assert!(backend.get(&owner).is_none());
+    }
+
     #[tokio::test(flavor = "current_thread")]
     async fn a_foreign_target_id_is_an_owner_mismatch() {
         let (app, backend) = app();
-        let holder = owner("u", "b", "holder");
+        let holder = owner("u", "holder");
         backend.insert(&holder, "small", InstanceStatus::Running);
         let error = call(
             &app,
             TargetGet::NAME,
             &GetTargetParams {
                 target: TargetRef {
-                    owner: owner("u", "b", "other"),
+                    owner: owner("u", "other"),
                     target_id: Some(ProviderTargetId::new(policy::instance_name(&holder)).unwrap()),
                 },
             },
@@ -1604,7 +1787,7 @@ mod tests {
     #[tokio::test(flavor = "current_thread")]
     async fn close_by_owner_destroys_and_is_idempotent() {
         let (app, backend) = app();
-        let owner = owner("u", "b", "e");
+        let owner = owner("u", "e");
         backend.insert(&owner, "small", InstanceStatus::Running);
         let closed = call(
             &app,
@@ -1615,7 +1798,7 @@ mod tests {
         )
         .await
         .unwrap();
-        assert_eq!(closed.state.phase, TargetPhase::Closed);
+        assert_eq!(closed.phase, TargetPhase::Closed);
         assert_eq!(closed.target_id, None);
         assert_eq!(closed.owner, owner);
         let again = call(
@@ -1627,7 +1810,7 @@ mod tests {
         )
         .await
         .unwrap();
-        assert_eq!(again.state.phase, TargetPhase::Closed);
+        assert_eq!(again.phase, TargetPhase::Closed);
         assert_eq!(backend.deletes.load(Ordering::SeqCst), 1);
         let gone = call(
             &app,
@@ -1644,7 +1827,7 @@ mod tests {
     #[tokio::test(flavor = "current_thread")]
     async fn power_changes_need_an_active_target_and_a_supported_state() {
         let (app, backend) = app();
-        let owner = owner("u", "b", "e");
+        let owner = owner("u", "e");
         let set = |power| SetTargetPowerParams {
             target: by_owner(&owner),
             power,
@@ -1662,7 +1845,8 @@ mod tests {
         let paused = call(&app, TargetSetPower::NAME, &set(PowerState::Paused))
             .await
             .unwrap();
-        assert_eq!(paused.state.power, Some(PowerState::Paused));
+        assert_eq!(paused.phase, TargetPhase::Active);
+        assert_eq!(paused.power, Some(PowerState::Paused));
 
         backend.insert(&owner, "small", InstanceStatus::Error);
         let failed = call(&app, TargetSetPower::NAME, &set(PowerState::Running))
@@ -1671,10 +1855,36 @@ mod tests {
         assert_eq!(reason(&failed), Some(PreconditionReason::TargetNotActive));
     }
 
+    #[tokio::test(flavor = "current_thread")]
+    async fn observations_carry_power_only_while_active() {
+        let (app, backend) = app();
+        let owner = owner("u", "e");
+        let get = || GetTargetParams {
+            target: by_owner(&owner),
+        };
+        for (status, power) in [
+            (InstanceStatus::Running, Some(PowerState::Running)),
+            (InstanceStatus::Starting, Some(PowerState::Running)),
+            (InstanceStatus::Frozen, Some(PowerState::Paused)),
+            (InstanceStatus::Stopping, Some(PowerState::Stopped)),
+            (InstanceStatus::Stopped, Some(PowerState::Stopped)),
+        ] {
+            backend.insert(&owner, "small", status);
+            let observed = call(&app, TargetGet::NAME, &get()).await.unwrap();
+            assert_eq!(observed.phase, TargetPhase::Active, "{status:?}");
+            assert_eq!(observed.power, power, "{status:?}");
+        }
+        backend.insert(&owner, "small", InstanceStatus::Error);
+        let failed = call(&app, TargetGet::NAME, &get()).await.unwrap();
+        assert_eq!(failed.phase, TargetPhase::Failed);
+        assert_eq!(failed.power, None);
+        assert!(failed.message.is_some());
+    }
+
     #[tokio::test(flavor = "current_thread")]
     async fn a_failed_create_is_provisioning_without_an_id_and_retried_by_create() {
         let (app, backend) = app();
-        let owner = owner("u", "b", "e");
+        let owner = owner("u", "e");
         let name = policy::instance_name(&owner);
         app.work.start(
             &name,
@@ -1693,26 +1903,18 @@ mod tests {
         .unwrap();
         // No instance exists, so no id is handed out and the runtime keeps
         // sending target/create.
-        assert_eq!(observed.state.phase, TargetPhase::Provisioning);
+        assert_eq!(observed.phase, TargetPhase::Provisioning);
         assert_eq!(observed.target_id, None);
         assert!(
             observed
-                .state
                 .message
                 .as_ref()
                 .is_some_and(|message| message.as_str().contains("image server unreachable"))
         );
-        let created = call(
-            &app,
-            TargetCreate::NAME,
-            &CreateTargetParams {
-                owner: owner.clone(),
-                template_id: TemplateId::new("small").unwrap(),
-            },
-        )
-        .await
-        .unwrap();
-        assert_eq!(created.state.phase, TargetPhase::Active);
+        let created = call(&app, TargetCreate::NAME, &create(&owner, "small"))
+            .await
+            .unwrap();
+        assert_eq!(created.phase, TargetPhase::Active);
         assert_eq!(
             created.target_id.as_ref().map(ProviderTargetId::as_str),
             Some(name.as_str())
@@ -1723,7 +1925,7 @@ mod tests {
     #[tokio::test(flavor = "current_thread")]
     async fn closing_an_owner_whose_create_failed_forgets_the_failure() {
         let (app, _) = app();
-        let owner = owner("u", "b", "e");
+        let owner = owner("u", "e");
         let name = policy::instance_name(&owner);
         app.work.start(
             &name,
@@ -1742,7 +1944,7 @@ mod tests {
         )
         .await
         .unwrap();
-        assert_eq!(closed.state.phase, TargetPhase::Closed);
+        assert_eq!(closed.phase, TargetPhase::Closed);
         assert!(app.work.view(&name).is_none());
     }
 
@@ -1762,28 +1964,257 @@ mod tests {
         assert!(authorized(&config, &headers));
     }
 
+    #[test]
+    fn without_a_credential_every_request_is_authorized() {
+        let config = config_with(19091, None);
+        let mut headers = HeaderMap::new();
+        assert!(authorized(&config, &headers));
+        headers.insert(header::AUTHORIZATION, "Bearer anything".parse().unwrap());
+        assert!(authorized(&config, &headers));
+    }
+
+    /// A guest envd stand-in on loopback that accepts WebSocket upgrades
+    /// and answers nothing. Returns its port.
+    pub(crate) async fn silent_envd() -> u16 {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let port = listener.local_addr().unwrap().port();
+        tokio::spawn(async move {
+            while let Ok((stream, _)) = listener.accept().await {
+                tokio::spawn(async move {
+                    if let Ok(mut socket) = tokio_tungstenite::accept_async(stream).await {
+                        while let Some(Ok(_)) = socket.next().await {}
+                    }
+                });
+            }
+        });
+        port
+    }
+
+    /// Serve `app`'s routes on loopback with a short data route hold.
+    /// Returns the data route URL of `owner`'s target.
+    async fn serve_routes(mut app: App<FakeBackend>, owner: &TargetOwner) -> String {
+        app.data_route_hold = Duration::from_millis(1_000);
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let address = listener.local_addr().unwrap();
+        tokio::spawn(async move { axum::serve(listener, router(app)).await });
+        format!(
+            "ws://{address}/routes/{}/{}/{}",
+            owner.universe_id,
+            owner.environment_id,
+            policy::instance_name(owner)
+        )
+    }
+
+    fn data_options() -> ConnectOptions {
+        ConnectOptions::new(ImplementationInfo::new("test").unwrap()).with_bearer_token(CREDENTIAL)
+    }
+
+    /// Dial a data route that must refuse, and return its conforming refusal.
+    async fn refused(url: &str) -> DataRouteRefusal {
+        let error = match DataClient::connect_initialized(url, data_options()).await {
+            Ok(_) => panic!("the data route upgraded"),
+            Err(error) => error,
+        };
+        check_refusal(&error)
+            .unwrap_or_else(|problem| panic!("{problem}"))
+            .clone()
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn a_data_route_without_a_target_is_gone() {
+        let (app, _) = app();
+        let owner = owner("u", "e");
+        let url = serve_routes(app, &owner).await;
+        assert_eq!(refused(&url).await, DataRouteRefusal::Gone {});
+        let foreign = format!("{}x", url);
+        assert_eq!(refused(&foreign).await, DataRouteRefusal::Gone {});
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn a_broken_instance_refuses_as_failed() {
+        let (app, backend) = app();
+        let owner = owner("u", "e");
+        backend.insert(&owner, "small", InstanceStatus::Error);
+        let url = serve_routes(app, &owner).await;
+        assert!(matches!(
+            refused(&url).await,
+            DataRouteRefusal::Failed { .. }
+        ));
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn a_running_target_whose_envd_does_not_answer_is_booting() {
+        let (app, backend) = app();
+        let owner = owner("u", "e");
+        // No guest address yet: envd cannot be reached.
+        backend.insert(&owner, "small", InstanceStatus::Running);
+        let url = serve_routes(app, &owner).await;
+        assert_eq!(refused(&url).await, DataRouteRefusal::Booting {});
+        assert!(backend.power_calls.lock().unwrap().is_empty());
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn a_stopped_target_is_woken_and_waking_until_envd_answers() {
+        let (app, backend) = app();
+        let owner = owner("u", "e");
+        backend.insert(&owner, "small", InstanceStatus::Stopped);
+        let wakes = app.wakes.clone();
+        let url = serve_routes(app, &owner).await;
+        assert_eq!(refused(&url).await, DataRouteRefusal::Waking {});
+        assert_eq!(
+            backend.power_calls.lock().unwrap().as_slice(),
+            [PowerState::Running]
+        );
+        assert_eq!(backend.get(&owner).unwrap().status, InstanceStatus::Running);
+        assert!(wakes.within_grace(&policy::instance_name(&owner), Instant::now()));
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn a_paused_target_wakes_on_dial_and_relays() {
+        let port = silent_envd().await;
+        let backend = FakeBackend::default();
+        let app = App::new(config_with(port, Some(CREDENTIAL)), backend.clone());
+        let relays = app.relays.clone();
+        let owner = owner("u", "e");
+        backend.insert(&owner, "small", InstanceStatus::Frozen);
+        backend.update(&owner, |target| {
+            target.ipv4_address = Some("127.0.0.1".to_owned());
+        });
+        let wakes = app.wakes.clone();
+        let url = serve_routes(app, &owner).await;
+        let socket = dial_route(&url).await;
+        assert_eq!(backend.get(&owner).unwrap().status, InstanceStatus::Running);
+        assert_eq!(
+            backend.power_calls.lock().unwrap().as_slice(),
+            [PowerState::Running]
+        );
+        // The relay holds the instance while it runs.
+        let name = policy::instance_name(&owner);
+        assert!(relays.active(&name));
+        drop(socket);
+        tokio::time::timeout(Duration::from_secs(2), async {
+            while relays.active(&name) {
+                tokio::time::sleep(Duration::from_millis(10)).await;
+            }
+        })
+        .await
+        .expect("the relay releases the instance when it ends");
+        // The woken instance has its grace from the end of the connection.
+        assert!(wakes.within_grace(&name, Instant::now()));
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn a_dial_during_a_power_down_waits_for_the_wake_behind_it() {
+        let port = silent_envd().await;
+        let backend = FakeBackend::default();
+        let app = App::new(config_with(port, Some(CREDENTIAL)), backend.clone());
+        let owner = owner("u", "e");
+        let name = policy::instance_name(&owner);
+        backend.insert(&owner, "small", InstanceStatus::Running);
+        backend.update(&owner, |target| {
+            target.ipv4_address = Some("127.0.0.1".to_owned());
+        });
+        // A pause still in progress: the instance reads running until it
+        // freezes.
+        let pausing = backend.clone();
+        let target = backend.get(&owner).unwrap();
+        app.work.start(
+            &name,
+            WorkKind::Power(PowerState::Paused),
+            async move {
+                tokio::time::sleep(Duration::from_millis(300)).await;
+                pausing.set_power(&target, PowerState::Paused).await
+            }
+            .boxed(),
+        );
+        let url = serve_routes(app, &owner).await;
+        let _socket = dial_route(&url).await;
+        // The dial upgraded only after the wake that followed the pause.
+        assert_eq!(
+            backend.power_calls.lock().unwrap().as_slice(),
+            [PowerState::Paused, PowerState::Running]
+        );
+        assert_eq!(backend.get(&owner).unwrap().status, InstanceStatus::Running);
+    }
+
+    /// Open the data route `url` with the configured credential and expect
+    /// it to upgrade.
+    async fn dial_route(url: &str) -> GuestSocket {
+        let mut request =
+            tokio_tungstenite::tungstenite::client::IntoClientRequest::into_client_request(url)
+                .unwrap();
+        request.headers_mut().insert(
+            header::AUTHORIZATION,
+            format!("Bearer {CREDENTIAL}").parse().unwrap(),
+        );
+        let (socket, response) = tokio_tungstenite::connect_async(request)
+            .await
+            .expect("the target relays");
+        assert_eq!(response.status(), StatusCode::SWITCHING_PROTOCOLS);
+        socket
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn a_data_route_needs_the_configured_credential() {
+        let (app, backend) = app();
+        let owner = owner("u", "e");
+        backend.insert(&owner, "small", InstanceStatus::Running);
+        let url = serve_routes(app, &owner).await;
+        let options = ConnectOptions::new(ImplementationInfo::new("test").unwrap());
+        match DataClient::connect_initialized(&url, options).await {
+            Err(environment_client::ClientError::UpgradeRejected { status: 401, .. }) => {}
+            Err(error) => panic!("expected HTTP 401, got {error}"),
+            Ok(_) => panic!("the data route upgraded without the credential"),
+        }
+    }
+
     /// The client's controller conformance suite against this server over
     /// a real WebSocket, with the in-memory backend standing in for Incus.
     #[tokio::test(flavor = "current_thread")]
     async fn the_controller_passes_the_conformance_suite() {
-        use environment_client::{
-            ConnectOptions,
-            conformance::controller::{ControllerConformance, run},
-        };
+        use environment_client::conformance::controller::{ControllerConformance, run};
 
         let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
         let address = listener.local_addr().unwrap();
         let server = tokio::spawn(serve_on(listener, config(), FakeBackend::default()));
-        let options = ConnectOptions::new(ImplementationInfo::new("conformance").unwrap())
-            .with_bearer_token(CREDENTIAL);
         let counter = Arc::new(AtomicUsize::new(0));
         let owner_factory: Arc<dyn Fn() -> TargetOwner + Send + Sync> = Arc::new(move || {
             let environment = format!("env-{}", counter.fetch_add(1, Ordering::SeqCst));
-            owner("conformance", "fake", &environment)
+            owner("conformance", &environment)
+        });
+        let mut suite = ControllerConformance::new(
+            format!("ws://{address}/control"),
+            data_options(),
+            TemplateId::new("small").unwrap(),
+            owner_factory,
+        );
+        suite.poll_interval = Duration::from_millis(10);
+        suite.settle_timeout = Duration::from_secs(10);
+        let report = run(&suite).await;
+        server.abort();
+        report.into_result().expect("the controller conforms");
+    }
+
+    /// The same suite against a provider configured without a credential.
+    #[tokio::test(flavor = "current_thread")]
+    async fn the_controller_conforms_without_a_credential() {
+        use environment_client::conformance::controller::{ControllerConformance, run};
+
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let address = listener.local_addr().unwrap();
+        let server = tokio::spawn(serve_on(
+            listener,
+            config_with(19091, None),
+            FakeBackend::default(),
+        ));
+        let counter = Arc::new(AtomicUsize::new(0));
+        let owner_factory: Arc<dyn Fn() -> TargetOwner + Send + Sync> = Arc::new(move || {
+            let environment = format!("env-{}", counter.fetch_add(1, Ordering::SeqCst));
+            owner("conformance", &environment)
         });
         let mut suite = ControllerConformance::new(
             format!("ws://{address}/control"),
-            options,
+            ConnectOptions::new(ImplementationInfo::new("conformance").unwrap()),
             TemplateId::new("small").unwrap(),
             owner_factory,
         );
diff --git a/crates/environment-provider-incus/tests/incus_live.rs b/crates/environment-provider-incus/tests/incus_live.rs
index f4a4b116b..a7593ba3d 100644
--- a/crates/environment-provider-incus/tests/incus_live.rs
+++ b/crates/environment-provider-incus/tests/incus_live.rs
@@ -10,15 +10,18 @@ use environment_client::{
 };
 use environment_protocol::{
     control::target::{
-        CloseTargetParams, CreateTargetParams, GetTargetParams, PowerState, TargetOwner,
-        TargetPhase, TargetRef,
+        CloseTargetParams, CreateTargetParams, GetTargetParams, PowerState, SetTargetPowerParams,
+        TargetObservation, TargetOwner, TargetPhase, TargetRef,
     },
     handshake::ImplementationInfo,
-    ids::{BindingId, EnvironmentId, IncarnationId, ProviderTargetId, TemplateId, UniverseId},
+    idle::IdlePolicy,
+    ids::{EnvironmentId, ProviderTargetId, TemplateId, UniverseId},
     paths::EnvironmentPath,
-    routes::provider_data_route,
+    routes::{DataRouteBase, provider_data_route},
+};
+use environment_provider_incus::{
+    Config, IncusBackend as _, IncusClient, ProviderArgs, policy, server,
 };
-use environment_provider_incus::{Config, IncusBackend as _, IncusClient, ProviderArgs, server};
 use tools::environment_protocol::conformance::{self as data_conformance, DataConformance};
 
 async fn live_config() -> Config {
@@ -52,18 +55,18 @@ async fn configured_topology_and_owned_inventory_are_live() {
         if topology.mode == "cluster" {
             assert!(target.location.is_some());
         }
+        // Every owned instance carries its owner's deterministic name.
+        assert_eq!(target.name(), policy::instance_name(&target.owner));
     }
 }
 
-/// One owner in the fixed conformance universe and binding.
+/// One owner in the fixed conformance universe, so repeated runs reuse
+/// one Incus project and network.
 fn conformance_owner() -> TargetOwner {
     TargetOwner {
         universe_id: UniverseId::new("lightspeed-conformance").expect("universe id"),
-        binding_id: BindingId::new("incus-live").expect("binding id"),
         environment_id: EnvironmentId::new(uuid::Uuid::new_v4().to_string())
             .expect("environment id"),
-        incarnation_id: IncarnationId::new(uuid::Uuid::new_v4().to_string())
-            .expect("incarnation id"),
     }
 }
 
@@ -76,47 +79,91 @@ fn first_template(config: &Config) -> TemplateId {
         .expect("the live config offers a template")
 }
 
+/// Connect options carrying the provider credential when one is
+/// configured, as Lightspeed sends it.
+fn connect_options(config: &Config) -> ConnectOptions {
+    let options = ConnectOptions::new(
+        ImplementationInfo::new("environment-provider-incus-live").expect("client info"),
+    );
+    match &config.credential {
+        Some(credential) => options.with_bearer_token(credential.expose().to_owned()),
+        None => options,
+    }
+}
+
+/// A provider on loopback against live Incus, with its controller
+/// connected. Returns the controller, the data route base Lightspeed
+/// derives from its URL, and the server task.
+async fn start_provider(
+    config: &Config,
+) -> (
+    ControllerClient,
+    DataRouteBase,
+    tokio::task::JoinHandle<anyhow::Result<()>>,
+) {
+    let backend = IncusClient::new(config.clone())
+        .await
+        .expect("connect and validate live Incus topology");
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("bind the controller listener");
+    let address = listener.local_addr().expect("listener address");
+    let server = tokio::spawn(server::serve_on(listener, config.clone(), backend));
+    let endpoint = format!("ws://{address}/control");
+    let (controller, initialized) =
+        ControllerClient::connect_initialized(&endpoint, connect_options(config))
+            .await
+            .expect("controller handshake");
+    assert!(initialized.capabilities.power);
+    let base = DataRouteBase::derived_from_controller(&endpoint).expect("derived data route base");
+    (controller, base, server)
+}
+
+fn by_owner(owner: &TargetOwner, target_id: Option<&ProviderTargetId>) -> TargetRef {
+    TargetRef {
+        owner: owner.clone(),
+        target_id: target_id.cloned(),
+    }
+}
+
 /// Create a target for `owner` the way the runtime does: `target/create`
-/// until the observation carries a `targetId`, then `target/get` until the
-/// provider's own probe reaches envd.
-async fn create_until_daemon_ready(
+/// until the observation carries a `targetId`, then `target/get` until it
+/// is active.
+async fn create_until_active(
     controller: &ControllerClient,
     owner: &TargetOwner,
     template_id: &TemplateId,
+    idle: Option<IdlePolicy>,
     timeout: Duration,
 ) -> anyhow::Result<ProviderTargetId> {
     let deadline = Instant::now() + timeout;
     let params = CreateTargetParams {
         owner: owner.clone(),
         template_id: template_id.clone(),
+        display_name: None,
+        idle,
     };
     let mut observation = controller.create_target(&params).await?.target;
     loop {
-        if observation.state.phase == TargetPhase::Failed {
-            anyhow::bail!("the target failed: {:?}", observation.state.message);
+        if observation.phase == TargetPhase::Failed {
+            anyhow::bail!("the target failed: {:?}", observation.message);
         }
-        if observation.state.phase == TargetPhase::Active
-            && observation.state.power == Some(PowerState::Running)
-            && observation.state.daemon_ready
+        if observation.phase == TargetPhase::Active
             && let Some(target_id) = observation.target_id.clone()
         {
+            // The provider names the instance after its owner.
+            assert_eq!(target_id.as_str(), policy::instance_name(owner));
             return Ok(target_id);
         }
         if Instant::now() >= deadline {
-            anyhow::bail!(
-                "envd did not come up within {timeout:?}: {:?}",
-                observation.state
-            );
+            anyhow::bail!("the target did not become active within {timeout:?}: {observation:?}");
         }
         tokio::time::sleep(Duration::from_secs(2)).await;
         observation = match &observation.target_id {
             Some(target_id) => {
                 controller
                     .get_target(&GetTargetParams {
-                        target: TargetRef {
-                            owner: owner.clone(),
-                            target_id: Some(target_id.clone()),
-                        },
+                        target: by_owner(owner, Some(target_id)),
                     })
                     .await?
                     .target
@@ -126,6 +173,50 @@ async fn create_until_daemon_ready(
     }
 }
 
+async fn get(
+    controller: &ControllerClient,
+    owner: &TargetOwner,
+    target_id: &ProviderTargetId,
+) -> anyhow::Result<TargetObservation> {
+    Ok(controller
+        .get_target(&GetTargetParams {
+            target: by_owner(owner, Some(target_id)),
+        })
+        .await?
+        .target)
+}
+
+/// Dial the target's data route until envd answers, honoring the
+/// provider's `waking` and `booting` refusals and their `Retry-After`, as
+/// the runtime's open handshake does.
+async fn dial_until_ready(
+    route: &str,
+    options: ConnectOptions,
+    timeout: Duration,
+) -> anyhow::Result<(DataClient, Vec<String>)> {
+    let deadline = Instant::now() + timeout;
+    let mut refusals = Vec::new();
+    loop {
+        match DataClient::connect_initialized(route, options.clone()).await {
+            Ok((client, _)) => return Ok((client, refusals)),
+            Err(error) => {
+                let Some(refusal) = error.data_route_refusal() else {
+                    anyhow::bail!("the data route failed without a typed refusal: {error}");
+                };
+                if !refusal.is_retryable() {
+                    anyhow::bail!("the data route refused for good: {refusal}");
+                }
+                refusals.push(refusal.state().to_owned());
+                if Instant::now() >= deadline {
+                    anyhow::bail!("envd did not answer within {timeout:?}: {refusal}");
+                }
+                let wait = error.retry_after_ms().unwrap_or(2_000);
+                tokio::time::sleep(Duration::from_millis(wait)).await;
+            }
+        }
+    }
+}
+
 /// Close by owner until the provider answers `closed`.
 async fn close_until_closed(
     controller: &ControllerClient,
@@ -136,14 +227,11 @@ async fn close_until_closed(
     loop {
         let observation = controller
             .close_target(&CloseTargetParams {
-                target: TargetRef {
-                    owner: owner.clone(),
-                    target_id: None,
-                },
+                target: by_owner(owner, None),
             })
             .await?
             .target;
-        if observation.state.phase == TargetPhase::Closed {
+        if observation.phase == TargetPhase::Closed {
             return Ok(());
         }
         if Instant::now() >= deadline {
@@ -154,39 +242,29 @@ async fn close_until_closed(
 }
 
 /// The tools' data conformance suite against envd inside a live Incus VM,
-/// reached through this provider's data route and relay with the provider
-/// credential, exactly as the runtime reaches it. Creates one VM and
-/// closes it.
+/// reached through this provider's data route and relay, under the data
+/// route base Lightspeed derives from the controller URL, exactly as the
+/// runtime reaches it. Creates one VM and closes it.
 #[tokio::test(flavor = "current_thread")]
 #[ignore = "requires a reachable standalone Incus server or Incus cluster; creates and deletes one VM"]
 async fn the_guest_envd_conforms_on_live_incus() {
     let config = live_config().await;
     let template_id = first_template(&config);
-    let credential = config.credential.expose().to_owned();
-    let backend = IncusClient::new(config.clone())
-        .await
-        .expect("connect and validate live Incus topology");
-    let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
-        .await
-        .expect("bind the controller listener");
-    let address = listener.local_addr().expect("listener address");
-    let server = tokio::spawn(server::serve_on(listener, config, backend));
-
-    let options = ConnectOptions::new(
-        ImplementationInfo::new("environment-provider-incus-live").expect("client info"),
-    )
-    .with_bearer_token(credential);
-    let (controller, initialized) =
-        ControllerClient::connect_initialized(&format!("ws://{address}/control"), options.clone())
-            .await
-            .expect("controller handshake");
+    let options = connect_options(&config);
+    let (controller, base, server) = start_provider(&config).await;
     let owner = conformance_owner();
     let outcome = async {
-        let target_id =
-            create_until_daemon_ready(&controller, &owner, &template_id, Duration::from_secs(900))
-                .await?;
-        let route = provider_data_route(&initialized.routes.data, &owner, &target_id);
-        let (client, _) = DataClient::connect_initialized(&route, options.clone()).await?;
+        let target_id = create_until_active(
+            &controller,
+            &owner,
+            &template_id,
+            None,
+            Duration::from_secs(900),
+        )
+        .await?;
+        let route = provider_data_route(&base, &owner, &target_id);
+        let (client, _) =
+            dial_until_ready(&route, options.clone(), Duration::from_secs(600)).await?;
         let suite = DataConformance::new(
             client.clone(),
             EnvironmentPath::new("/workspace").expect("work directory"),
@@ -206,16 +284,126 @@ async fn the_guest_envd_conforms_on_live_incus() {
     closed.expect("the conformance target closes");
 }
 
+/// A paused target wakes when its data route is dialed: the dial holds or
+/// refuses `waking`, and then relays to envd. Creates one VM and closes it.
+#[tokio::test(flavor = "current_thread")]
+#[ignore = "requires a reachable standalone Incus server or Incus cluster; creates and deletes one VM"]
+async fn a_paused_target_wakes_on_dial_on_live_incus() {
+    let config = live_config().await;
+    let template_id = first_template(&config);
+    let options = connect_options(&config);
+    let (controller, base, server) = start_provider(&config).await;
+    let owner = conformance_owner();
+    let outcome = async {
+        let target_id = create_until_active(
+            &controller,
+            &owner,
+            &template_id,
+            None,
+            Duration::from_secs(900),
+        )
+        .await?;
+        let route = provider_data_route(&base, &owner, &target_id);
+        let (client, _) =
+            dial_until_ready(&route, options.clone(), Duration::from_secs(600)).await?;
+        let _ = client.close().await;
+
+        let paused = controller
+            .set_target_power(&SetTargetPowerParams {
+                target: by_owner(&owner, Some(&target_id)),
+                power: PowerState::Paused,
+            })
+            .await?
+            .target;
+        anyhow::ensure!(
+            paused.power == Some(PowerState::Paused),
+            "setPower did not pause the target: {paused:?}"
+        );
+
+        let (client, refusals) =
+            dial_until_ready(&route, options.clone(), Duration::from_secs(120)).await?;
+        let _ = client.close().await;
+        anyhow::ensure!(
+            refusals
+                .iter()
+                .all(|state| state == "waking" || state == "booting"),
+            "unexpected refusals while waking: {refusals:?}"
+        );
+        let woken = get(&controller, &owner, &target_id).await?;
+        anyhow::ensure!(
+            woken.power == Some(PowerState::Running),
+            "the dial did not wake the target: {woken:?}"
+        );
+        Ok(())
+    }
+    .await;
+    let closed = close_until_closed(&controller, &owner, Duration::from_secs(300)).await;
+    let _ = controller.close().await;
+    server.abort();
+    outcome.expect("the paused target wakes on dial");
+    closed.expect("the target closes");
+}
+
+/// The idle loop pauses a target whose envd reports it idle past the
+/// create-time `idle` override. Takes up to a few `idleCheckSeconds`.
+/// Creates one VM and closes it.
+#[tokio::test(flavor = "current_thread")]
+#[ignore = "requires a reachable standalone Incus server or Incus cluster; creates and deletes one VM"]
+async fn the_idle_loop_pauses_an_idle_target_on_live_incus() {
+    let config = live_config().await;
+    let template_id = first_template(&config);
+    let options = connect_options(&config);
+    let (controller, base, server) = start_provider(&config).await;
+    let owner = conformance_owner();
+    let idle = IdlePolicy {
+        pause_after_ms: Some(1_000),
+        ..IdlePolicy::default()
+    };
+    let wait = Duration::from_secs(config.idle_check_seconds * 3 + 60);
+    let outcome = async {
+        let target_id = create_until_active(
+            &controller,
+            &owner,
+            &template_id,
+            Some(idle),
+            Duration::from_secs(900),
+        )
+        .await?;
+        // Wait until envd answers, so the idle loop can read it.
+        let route = provider_data_route(&base, &owner, &target_id);
+        let (client, _) =
+            dial_until_ready(&route, options.clone(), Duration::from_secs(600)).await?;
+        let _ = client.close().await;
+        let deadline = Instant::now() + wait;
+        loop {
+            let observed = get(&controller, &owner, &target_id).await?;
+            if observed.power == Some(PowerState::Paused) {
+                return Ok(());
+            }
+            anyhow::ensure!(
+                Instant::now() < deadline,
+                "the idle loop did not pause the target within {wait:?}: {observed:?}"
+            );
+            tokio::time::sleep(Duration::from_secs(5)).await;
+        }
+    }
+    .await;
+    let closed = close_until_closed(&controller, &owner, Duration::from_secs(300)).await;
+    let _ = controller.close().await;
+    server.abort();
+    outcome.expect("the idle loop pauses the target");
+    closed.expect("the target closes");
+}
+
 /// The client's controller conformance suite against this provider on live
 /// Incus. It creates one VM from the first offered template and closes it;
-/// every owner lives in one fixed conformance universe and binding, so
-/// repeated runs reuse one Incus project and network.
+/// every owner lives in one fixed conformance universe, so repeated runs
+/// reuse one Incus project and network.
 #[tokio::test(flavor = "current_thread")]
 #[ignore = "requires a reachable standalone Incus server or Incus cluster; creates and deletes one VM"]
 async fn the_controller_conforms_on_live_incus() {
     let config = live_config().await;
     let template_id = first_template(&config);
-    let credential = config.credential.expose().to_owned();
     let backend = IncusClient::new(config.clone())
         .await
         .expect("connect and validate live Incus topology");
@@ -223,12 +411,9 @@ async fn the_controller_conforms_on_live_incus() {
         .await
         .expect("bind the controller listener");
     let address = listener.local_addr().expect("listener address");
+    let options = connect_options(&config);
     let server = tokio::spawn(server::serve_on(listener, config, backend));
 
-    let options = ConnectOptions::new(
-        ImplementationInfo::new("environment-provider-incus-live").expect("client info"),
-    )
-    .with_bearer_token(credential);
     let owner = Arc::new(conformance_owner);
     let mut suite = ControllerConformance::new(
         format!("ws://{address}/control"),
diff --git a/crates/environments/src/lib.rs b/crates/environments/src/lib.rs
index 7a10c655e..d4d7d2b4d 100644
--- a/crates/environments/src/lib.rs
+++ b/crates/environments/src/lib.rs
@@ -1,20 +1,35 @@
 //! Environment-compute domain contracts.
 //!
-//! Physical providers are deployment-scoped, provider bindings and
-//! environments are universe-scoped, and provider target facts live on an
-//! environment incarnation rather than on stable environment identity.
+//! Physical providers are deployment-scoped; provider bindings, registration
+//! keys and environments are universe-scoped. One `environments` row covers
+//! three kinds: provisioned (a provider target), external (an `envd`
+//! Lightspeed dials at a fixed endpoint) and registered (an `envd` that
+//! dialed the gateway). Lightspeed owns a five-state lifecycle and the
+//! decisions to create and to close; everything a provider does while a
+//! target runs (power, idle, wake, ingress) is the provider's, and the row
+//! only caches what the provider last reported, for display.
+//!
+//! Every write is a request type with a pure `apply` that the stores share:
+//! a lifecycle write whose expected `from` state no longer holds is skipped
+//! and leaves the record as it is, so a close accepted while a create was in
+//! flight wins. Nothing that only reads a row writes to it; whether a row
+//! may be used is [`EnvironmentRecord::use_gate`].
 
 use std::{collections::BTreeMap, fmt, str::FromStr};
 
 use async_trait::async_trait;
 use auth::{AuthGrantId, AuthProviderId, SecretId, SecretValue};
-pub use environment_protocol::control::target::PowerState;
+pub use environment_protocol::{
+    control::target::{PowerState, TargetPhase},
+    idle::IdlePolicy,
+};
 use environment_protocol::{
     control::template::EnvironmentTemplate,
     handshake::ImplementationInfo,
-    ids::{ProviderTargetId, validate_opaque_id},
-    metadata::{DescriptiveText, validate_descriptive_text, validate_stored_metadata},
-    routes::DataRouteBase,
+    ids::ProviderTargetId,
+    metadata::{DescriptiveText, validate_caller_metadata, validate_descriptive_text},
+    registration::DaemonPublicKey,
+    routes::{DataRouteBase, DataRouteRefusal},
 };
 pub use harness::EnvironmentId;
 use harness::{StringIdError, validate_general_string_id};
@@ -97,30 +112,12 @@ macro_rules! registry_string_id {
 }
 
 registry_string_id!(EnvironmentProviderId);
-registry_string_id!(EnvironmentProviderBindingId);
-registry_string_id!(EnvironmentIncarnationId);
 registry_string_id!(EnvironmentProvisionRequestId);
 registry_string_id!(EnvironmentTemplateId);
 registry_string_id!(EnvironmentJobGroupId);
 registry_string_id!(EnvironmentRegistrationKeyId);
 registry_string_id!(EnvironmentDaemonId);
 
-impl EnvironmentProvisionRequestId {
-    /// The deterministic request id of the one environment a daemon identity
-    /// may register, so a retried first registration converges on the same
-    /// environment through the `(universe, request_id)` unique key.
-    pub fn for_daemon(daemon_id: &EnvironmentDaemonId) -> Self {
-        Self::new(format!(
-            "{DAEMON_PROVISION_REQUEST_PREFIX}{}",
-            daemon_id.as_str()
-        ))
-    }
-}
-
-/// Prefix of the request id a registered environment derives from its daemon
-/// identity.
-pub const DAEMON_PROVISION_REQUEST_PREFIX: &str = "daemon:";
-
 /// Prefix of every daemon id derived from an `envd` public key.
 pub const DAEMON_ID_PREFIX: &str = "daemon_";
 
@@ -154,21 +151,13 @@ pub enum EnvironmentRegistryError {
     #[error("environment registry {kind} not found: {id}")]
     NotFound { kind: &'static str, id: String },
 
-    #[error(
-        "environment registry revision conflict for {kind} {id}: expected {expected:?}, actual {actual:?}"
-    )]
-    RevisionConflict {
-        kind: &'static str,
-        id: String,
-        expected: Option<u64>,
-        actual: Option<u64>,
-    },
-
     #[error("invalid environment registry request: {message}")]
     InvalidInput { message: String },
 
     /// The registration key exists but no longer admits new daemon
-    /// identities: revoked or past its expiry.
+    /// identities (revoked or past its expiry), the secret an admission
+    /// presented was retired by a rotation (`rotated`), or a revoked key
+    /// was asked to rotate.
     #[error("environment registration key {registration_key_id} is {reason}")]
     RegistrationKeyUnavailable {
         registration_key_id: String,
@@ -189,16 +178,46 @@ pub enum EnvironmentRegistryError {
     Store { message: String },
 }
 
-/// Optional controller methods a provider's controller advertised in its
-/// last successful `initialize`. Calls and API requests that need an absent
-/// feature are refused before they reach the provider.
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub struct ControllerFeatures {
-    /// `target/adopt` is served.
-    pub adopt_target: bool,
-    /// `ingress/ensure` and `ingress/remove` are served.
-    pub ingress: bool,
-}
+// ---------------------------------------------------------------------------
+// Timing constants
+// ---------------------------------------------------------------------------
+
+/// Default disconnect grace for ephemeral registered environments whose key
+/// does not set one: long enough for a pod restart or a brief network
+/// interruption, short enough that leaked benchmark sandboxes disappear.
+pub const DEFAULT_EPHEMERAL_DISCONNECT_GRACE_MS: u64 = 5 * 60 * 1_000;
+
+/// How long a caller waits for the disconnected daemon of a persistent
+/// registered environment to reconnect before the environment counts as
+/// away. Covers a rolling restart without hiding a dead pod. Ephemeral
+/// daemons get no wait.
+pub const REGISTERED_RECONNECT_WAIT_MS: i64 = 2 * 60 * 1_000;
+
+/// Default re-check interval of a [`EnvironmentUse::Wait`] when no
+/// `Retry-After` says otherwise.
+pub const WAIT_RETRY_AFTER_MS: u64 = 2_000;
+
+/// A connected registered environment's `last_seen_at_ms` is written at
+/// most this often; connects and disconnects are always written.
+pub const REGISTERED_LIVENESS_STAMP_MS: i64 = 5 * 60 * 1_000;
+
+/// The registered sweep marks a row disconnected when it reads connected but
+/// its `last_seen_at_ms` is older than this: the gateway that held the
+/// connection stopped without recording the disconnect.
+pub const REGISTERED_STALE_AFTER_MS: i64 = 15 * 60 * 1_000;
+
+/// Longest stored `state_message`, in bytes.
+pub const STATE_MESSAGE_MAX_BYTES: usize = 1024;
+
+/// Default page size of [`ListEnvironments`].
+pub const LIST_ENVIRONMENTS_DEFAULT_LIMIT: u32 = 100;
+
+/// Largest page size of [`ListEnvironments`].
+pub const LIST_ENVIRONMENTS_MAX_LIMIT: u32 = 500;
+
+// ---------------------------------------------------------------------------
+// Providers and bindings
+// ---------------------------------------------------------------------------
 
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub struct EnvironmentProviderRecord {
@@ -206,31 +225,59 @@ pub struct EnvironmentProviderRecord {
     pub display_name: Option<String>,
     /// Where Lightspeed dials the provider's controller.
     pub controller_endpoint: EnvironmentEndpoint,
-    pub metadata: BTreeMap<String, String>,
-    /// Recorded at the controller's last successful `initialize`, together
-    /// with `data_route_base`; absent until then and after the endpoint
-    /// changes.
-    pub controller_features: Option<ControllerFeatures>,
-    /// Base URL of the provider's data routes as its controller advertised
-    /// it (`routes.data`). The gateway builds every target's data route from
-    /// it; it is never derived from the controller endpoint.
+    /// Operator-configured base of the provider's data routes; `None`
+    /// derives it from the controller endpoint
+    /// ([`DataRouteBase::derived_from_controller`]).
     pub data_route_base: Option<DataRouteBase>,
+    /// A bearer credential is stored; without one no `Authorization` header
+    /// is sent on the controller or data routes.
+    pub has_credential: bool,
     pub created_at_ms: i64,
     pub updated_at_ms: i64,
 }
 
 impl EnvironmentProviderRecord {
+    /// The data route base the gateway and the reconciler dial: the
+    /// configured one, or the one derived from a `ws`/`wss` controller
+    /// endpoint. A `unix://` controller has no derivable base.
+    pub fn effective_data_route_base(&self) -> Result<DataRouteBase, EnvironmentRegistryError> {
+        if let Some(base) = &self.data_route_base {
+            return Ok(base.clone());
+        }
+        if self.controller_endpoint.scheme() == EndpointScheme::Unix {
+            return invalid(
+                "a provider with a unix:// controller endpoint needs a configured data route base",
+            );
+        }
+        DataRouteBase::derived_from_controller(self.controller_endpoint.as_str())
+            .map_err(|error| invalid_error(format!("data route base: {error}")))
+    }
+
     pub fn validate(&self) -> Result<(), EnvironmentRegistryError> {
         validate_nonempty_optional("display_name", self.display_name.as_deref())?;
-        validate_metadata(&self.metadata)?;
         validate_timestamps(self.created_at_ms, self.updated_at_ms)?;
-        if self.controller_features.is_some() != self.data_route_base.is_some() {
-            return invalid("controller features and data route base are recorded together");
+        self.effective_data_route_base()?;
+        if let Some(base) = &self.data_route_base
+            && self.controller_endpoint.scheme() != EndpointScheme::Unix
+        {
+            base.check_for_controller(self.controller_endpoint.as_str())
+                .map_err(|error| invalid_error(format!("data route base: {error}")))?;
         }
         Ok(())
     }
 }
 
+/// What a provider put does with the stored bearer credential.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum ProviderCredentialChange {
+    /// Keep the stored credential, or none for a new provider.
+    Keep,
+    /// Store this credential, replacing any stored one.
+    Set(SecretValue),
+    /// Remove the stored credential.
+    Clear,
+}
+
 /// Register or replace a provider. The provider credential is write-only:
 /// the store keeps it sealed and hands it out only through
 /// [`EnvironmentProviderStore::read_provider_credential`].
@@ -239,36 +286,35 @@ pub struct PutEnvironmentProvider {
     pub provider_id: EnvironmentProviderId,
     pub display_name: Option<String>,
     pub controller_endpoint: EnvironmentEndpoint,
-    pub metadata: BTreeMap<String, String>,
-    /// The bearer credential Lightspeed presents on the controller and data
-    /// routes. Required for a new provider; `None` keeps the stored one.
-    pub credential: Option<SecretValue>,
+    pub data_route_base: Option<DataRouteBase>,
+    pub credential: ProviderCredentialChange,
     pub updated_at_ms: i64,
 }
 
 impl PutEnvironmentProvider {
     /// The record this put writes for a provider whose current record is
-    /// `existing`: the creation time is kept, and the recorded controller
-    /// facts survive only while the endpoint stays the same.
+    /// `existing`: the creation time is kept, and `has_credential` follows
+    /// the credential change. A new provider needs no credential.
     pub fn into_record(
         self,
         existing: Option<&EnvironmentProviderRecord>,
     ) -> Result<EnvironmentProviderRecord, EnvironmentRegistryError> {
         validate_nonnegative_i64(self.updated_at_ms, "updated_at_ms")?;
-        if let Some(credential) = &self.credential {
-            validate_provider_credential(credential)?;
-        } else if existing.is_none() {
-            return invalid("a new environment provider requires a credential");
-        }
-        let kept = existing.filter(|record| record.controller_endpoint == self.controller_endpoint);
+        let has_credential = match &self.credential {
+            ProviderCredentialChange::Keep => existing.is_some_and(|record| record.has_credential),
+            ProviderCredentialChange::Set(credential) => {
+                validate_provider_credential(credential)?;
+                true
+            }
+            ProviderCredentialChange::Clear => false,
+        };
         let created_at_ms = existing.map_or(self.updated_at_ms, |record| record.created_at_ms);
         let record = EnvironmentProviderRecord {
             provider_id: self.provider_id,
             display_name: self.display_name,
             controller_endpoint: self.controller_endpoint,
-            metadata: self.metadata,
-            controller_features: kept.and_then(|record| record.controller_features),
-            data_route_base: kept.and_then(|record| record.data_route_base.clone()),
+            data_route_base: self.data_route_base,
+            has_credential,
             created_at_ms,
             updated_at_ms: self.updated_at_ms.max(created_at_ms),
         };
@@ -297,46 +343,19 @@ pub fn validate_provider_credential(
     Ok(())
 }
 
-/// What a controller advertised at a successful `initialize`. Written only
-/// while the provider is still registered at `controller_endpoint`, so an
-/// `initialize` against an endpoint the operator has since replaced cannot
-/// overwrite the new endpoint's facts.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct RecordProviderController {
-    pub provider_id: EnvironmentProviderId,
-    pub controller_endpoint: EnvironmentEndpoint,
-    pub features: ControllerFeatures,
-    pub data_route_base: DataRouteBase,
-}
-
-#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub struct ListEnvironmentProviders {}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum EnvironmentProviderBindingStatus {
-    Enabled,
-    Disabled,
-}
-
+/// A universe's use of a provider. At most one per `(universe, provider)`;
+/// `enabled` admits creates, template listing and data routes.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub struct EnvironmentProviderBindingRecord {
     pub universe_id: Uuid,
-    pub binding_id: EnvironmentProviderBindingId,
     pub provider_id: EnvironmentProviderId,
-    pub status: EnvironmentProviderBindingStatus,
-    pub revision: u64,
-    pub metadata: BTreeMap<String, String>,
+    pub enabled: bool,
     pub created_at_ms: i64,
     pub updated_at_ms: i64,
 }
 
 impl EnvironmentProviderBindingRecord {
     pub fn validate(&self) -> Result<(), EnvironmentRegistryError> {
-        if self.revision == 0 {
-            return invalid("provider binding revision must be positive");
-        }
-        validate_metadata(&self.metadata)?;
         validate_timestamps(self.created_at_ms, self.updated_at_ms)
     }
 }
@@ -344,24 +363,48 @@ impl EnvironmentProviderBindingRecord {
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub struct PutEnvironmentProviderBinding {
     pub universe_id: Uuid,
-    pub binding_id: EnvironmentProviderBindingId,
     pub provider_id: EnvironmentProviderId,
-    pub status: EnvironmentProviderBindingStatus,
-    pub metadata: BTreeMap<String, String>,
-    pub expected_revision: Option<u64>,
+    pub enabled: bool,
     pub updated_at_ms: i64,
 }
 
+impl PutEnvironmentProviderBinding {
+    /// The record this put writes over `existing`, keeping its creation
+    /// time.
+    pub fn into_record(
+        self,
+        existing: Option<&EnvironmentProviderBindingRecord>,
+    ) -> Result<EnvironmentProviderBindingRecord, EnvironmentRegistryError> {
+        validate_nonnegative_i64(self.updated_at_ms, "updated_at_ms")?;
+        let created_at_ms = existing.map_or(self.updated_at_ms, |record| record.created_at_ms);
+        let record = EnvironmentProviderBindingRecord {
+            universe_id: self.universe_id,
+            provider_id: self.provider_id,
+            enabled: self.enabled,
+            created_at_ms,
+            updated_at_ms: self.updated_at_ms.max(created_at_ms),
+        };
+        record.validate()?;
+        Ok(record)
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Registration keys
+// ---------------------------------------------------------------------------
+
 /// What Lightspeed does with a registered environment while its daemon is
-/// disconnected. A property of the registration key, copied onto every
-/// environment the key admits; `envd` neither knows nor chooses it.
+/// disconnected. A property of the registration key, read from the key for
+/// every environment it admitted; `envd` neither knows nor chooses it.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "snake_case")]
 pub enum RegisteredIdentityMode {
-    /// The environment stays `Offline` until it is explicitly closed.
+    /// The environment stays open while its daemon is away: callers wait up
+    /// to [`REGISTERED_RECONNECT_WAIT_MS`] for a reconnect, and the key's
+    /// `offline_close_after_ms` may close it eventually.
     Persistent,
     /// The environment is closed once its daemon has been away longer than
-    /// the key's disconnect grace.
+    /// the key's disconnect grace; callers never wait for a reconnect.
     Ephemeral,
 }
 
@@ -382,466 +425,6 @@ impl RegisteredIdentityMode {
     }
 }
 
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(tag = "type", rename_all = "snake_case")]
-pub enum EnvironmentSource {
-    Provisioned {
-        provider_id: EnvironmentProviderId,
-        binding_id: EnvironmentProviderBindingId,
-    },
-    /// An `envd` Lightspeed dials directly at a fixed endpoint.
-    External { endpoint: EnvironmentEndpoint },
-    /// An `envd` that dialed the gateway outbound and was admitted by a
-    /// registration key. The daemon public key is the identity: one key
-    /// maps to at most one environment in the deployment, ever, so a closed
-    /// environment's daemon can never register again without a new key.
-    Registered {
-        registration_key_id: EnvironmentRegistrationKeyId,
-        daemon_id: EnvironmentDaemonId,
-        /// Lowercase hex of the daemon's raw Ed25519 public key.
-        daemon_public_key: String,
-        identity_mode: RegisteredIdentityMode,
-    },
-}
-
-impl EnvironmentSource {
-    pub fn provider_id(&self) -> Option<&EnvironmentProviderId> {
-        match self {
-            Self::Provisioned { provider_id, .. } => Some(provider_id),
-            Self::External { .. } | Self::Registered { .. } => None,
-        }
-    }
-
-    pub fn binding_id(&self) -> Option<&EnvironmentProviderBindingId> {
-        match self {
-            Self::Provisioned { binding_id, .. } => Some(binding_id),
-            Self::External { .. } | Self::Registered { .. } => None,
-        }
-    }
-
-    pub fn registration_key_id(&self) -> Option<&EnvironmentRegistrationKeyId> {
-        match self {
-            Self::Registered {
-                registration_key_id,
-                ..
-            } => Some(registration_key_id),
-            Self::Provisioned { .. } | Self::External { .. } => None,
-        }
-    }
-
-    pub fn identity_mode(&self) -> Option<RegisteredIdentityMode> {
-        match self {
-            Self::Registered { identity_mode, .. } => Some(*identity_mode),
-            Self::Provisioned { .. } | Self::External { .. } => None,
-        }
-    }
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum EnvironmentStatus {
-    Provisioning,
-    Booting,
-    Ready,
-    /// Execution frozen with RAM resident; wakes on use.
-    Paused,
-    /// Execution state saved to disk; wakes on use.
-    Suspended,
-    /// Powered off with disk retained; wakes on use for provisioned
-    /// environments whose provider supports power control.
-    Offline,
-    Closing,
-    Closed,
-    Failed,
-    Unknown,
-}
-
-impl EnvironmentStatus {
-    /// The steady power state this observed status corresponds to, or `None`
-    /// while the environment is transitioning, failed, or gone.
-    pub fn power_state(self) -> Option<PowerState> {
-        match self {
-            Self::Ready => Some(PowerState::Running),
-            Self::Paused => Some(PowerState::Paused),
-            Self::Suspended => Some(PowerState::Suspended),
-            Self::Offline => Some(PowerState::Stopped),
-            Self::Provisioning
-            | Self::Booting
-            | Self::Closing
-            | Self::Closed
-            | Self::Failed
-            | Self::Unknown => None,
-        }
-    }
-
-    /// True for the observed states a power change can start from or wake
-    /// out of.
-    pub fn is_powered_down(self) -> bool {
-        matches!(self, Self::Paused | Self::Suspended | Self::Offline)
-    }
-
-    /// True once a close was accepted: no observation may change the status
-    /// any more except the close's own completion.
-    pub fn is_closing_or_closed(self) -> bool {
-        matches!(self, Self::Closing | Self::Closed)
-    }
-}
-
-/// Staged idle policy: each threshold is measured against the daemon's
-/// reported idle duration and must be non-decreasing in the order
-/// pause → suspend → stop → close. Every stage is optional.
-#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub struct EnvironmentIdlePolicy {
-    pub pause_after_ms: Option<u64>,
-    pub suspend_after_ms: Option<u64>,
-    pub stop_after_ms: Option<u64>,
-    pub close_after_ms: Option<u64>,
-}
-
-/// One stage of an idle policy in escalation order.
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum IdleAction {
-    Pause,
-    Suspend,
-    Stop,
-    Close,
-}
-
-impl IdleAction {
-    /// The power state this stage requests; `None` for close.
-    pub fn power_state(self) -> Option<PowerState> {
-        match self {
-            Self::Pause => Some(PowerState::Paused),
-            Self::Suspend => Some(PowerState::Suspended),
-            Self::Stop => Some(PowerState::Stopped),
-            Self::Close => None,
-        }
-    }
-}
-
-impl EnvironmentIdlePolicy {
-    pub fn is_empty(&self) -> bool {
-        self.pause_after_ms.is_none()
-            && self.suspend_after_ms.is_none()
-            && self.stop_after_ms.is_none()
-            && self.close_after_ms.is_none()
-    }
-
-    /// Stages in escalation order with their thresholds.
-    pub fn stages(&self) -> Vec<(IdleAction, u64)> {
-        [
-            (IdleAction::Pause, self.pause_after_ms),
-            (IdleAction::Suspend, self.suspend_after_ms),
-            (IdleAction::Stop, self.stop_after_ms),
-            (IdleAction::Close, self.close_after_ms),
-        ]
-        .into_iter()
-        .filter_map(|(action, threshold)| threshold.map(|threshold| (action, threshold)))
-        .collect()
-    }
-
-    pub fn validate(&self) -> Result<(), EnvironmentRegistryError> {
-        if self.is_empty() {
-            return invalid("idle policy must set at least one stage");
-        }
-        let mut previous: Option<(IdleAction, u64)> = None;
-        for (action, threshold) in self.stages() {
-            if threshold == 0 {
-                return invalid(format!("idle policy {action:?} threshold must be positive"));
-            }
-            if let Some((earlier, earlier_threshold)) = previous
-                && threshold < earlier_threshold
-            {
-                return invalid(format!(
-                    "idle policy {action:?} threshold must not be below {earlier:?}"
-                ));
-            }
-            previous = Some((action, threshold));
-        }
-        Ok(())
-    }
-
-    /// The most escalated stage whose threshold `idle_for_ms` has crossed and
-    /// whose power state the provider supports (`close` is always
-    /// supported). Returns `None` while no stage applies.
-    pub fn due_action(&self, idle_for_ms: u64, supported: &[PowerState]) -> Option<IdleAction> {
-        self.stages()
-            .into_iter()
-            .filter(|(_, threshold)| idle_for_ms >= *threshold)
-            .filter(|(action, _)| {
-                action
-                    .power_state()
-                    .is_none_or(|state| supported.contains(&state))
-            })
-            .map(|(action, _)| action)
-            .next_back()
-    }
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct EnvironmentIncarnationRecord {
-    pub incarnation_id: EnvironmentIncarnationId,
-    pub provision_request_id: Option<EnvironmentProvisionRequestId>,
-    pub provider_target_id: Option<ProviderTargetId>,
-    pub template_id: Option<EnvironmentTemplateId>,
-    /// Provider-native reference used only while explicitly adopting an
-    /// existing target. The provider converts it into `provider_target_id`.
-    pub adoption_source_target: Option<String>,
-    /// Power states the provider reported this target supports; observed
-    /// with the target, empty until first observation or when the provider
-    /// offers no power control.
-    pub power_states: Vec<PowerState>,
-    pub created_at_ms: i64,
-    pub updated_at_ms: i64,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct EnvironmentRecord {
-    pub environment_id: EnvironmentId,
-    pub request_id: EnvironmentProvisionRequestId,
-    pub source: EnvironmentSource,
-    pub display_name: Option<String>,
-    pub status: EnvironmentStatus,
-    /// Lightspeed-owned power intent. The lifecycle reconciler
-    /// converges the provider target toward it; observed state is `status`.
-    pub desired_power: PowerState,
-    /// Optional staged idle policy the power reaper applies from the
-    /// daemon's idle report.
-    pub idle_policy: Option<EnvironmentIdlePolicy>,
-    pub incarnation: EnvironmentIncarnationRecord,
-    /// Lightspeed-owned public ingress intent. The lifecycle reconciler
-    /// converges the provider target toward it while the environment is
-    /// ready; the realized endpoint is `public_endpoint`.
-    pub public_ingress_enabled: bool,
-    /// The public endpoint the provider last reported realized. It can lag
-    /// the intent in either direction while the reconciler converges.
-    pub public_endpoint: Option<String>,
-    pub metadata: BTreeMap<String, String>,
-    /// Registered environments only: when the gateway last saw the daemon's
-    /// control connection (connect, heartbeat). A stale stamp under `Ready`
-    /// means the gateway stopped without recording the disconnect.
-    pub last_seen_at_ms: Option<i64>,
-    /// Why the environment failed, or the latest error while its lifecycle
-    /// keeps retrying. Cleared once an observation reaches a steady state.
-    pub lifecycle_error: Option<EnvironmentLifecycleError>,
-    pub created_at_ms: i64,
-    pub updated_at_ms: i64,
-}
-
-/// The latest lifecycle error of an environment and how long errors have
-/// persisted.
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct EnvironmentLifecycleError {
-    /// 1 to 1024 bytes without control characters other than line feed and
-    /// tab.
-    pub message: String,
-    /// When the current run of errors began: the first error recorded since
-    /// the environment was last steady.
-    pub first_at_ms: i64,
-    /// When `message` was recorded.
-    pub last_at_ms: i64,
-}
-
-impl EnvironmentLifecycleError {
-    /// The error recorded at `at_ms`, continuing the run of `previous`.
-    /// `message` is cleaned and cut to the stored bound.
-    pub fn record(previous: Option<&Self>, message: &str, at_ms: i64) -> Self {
-        let message = DescriptiveText::lossy(message)
-            .map(DescriptiveText::into_string)
-            .unwrap_or_else(|| "unspecified lifecycle error".to_owned());
-        let first_at_ms = previous.map_or(at_ms, |previous| previous.first_at_ms.min(at_ms));
-        Self {
-            message,
-            first_at_ms,
-            last_at_ms: at_ms.max(first_at_ms),
-        }
-    }
-
-    pub fn validate(&self) -> Result<(), EnvironmentRegistryError> {
-        validate_descriptive_text(&self.message)
-            .map_err(|error| invalid_error(format!("lifecycle error message: {error}")))?;
-        validate_nonnegative_i64(self.first_at_ms, "lifecycle_error.first_at_ms")?;
-        if self.last_at_ms < self.first_at_ms {
-            return invalid("lifecycle_error.last_at_ms must be >= first_at_ms");
-        }
-        Ok(())
-    }
-}
-
-impl EnvironmentRecord {
-    pub fn registration_key_id(&self) -> Option<&EnvironmentRegistrationKeyId> {
-        self.source.registration_key_id()
-    }
-
-    pub fn is_registered(&self) -> bool {
-        matches!(self.source, EnvironmentSource::Registered { .. })
-    }
-
-    /// True for a registered environment whose daemon is not currently
-    /// connected as far as durable state knows, including a `Ready` row
-    /// whose heartbeat stamp is older than `stale_after_ms`.
-    pub fn registered_daemon_absent(&self, now_ms: i64, stale_after_ms: i64) -> bool {
-        if !self.is_registered() {
-            return false;
-        }
-        match self.status {
-            EnvironmentStatus::Ready => self
-                .last_seen_at_ms
-                .is_none_or(|seen| now_ms.saturating_sub(seen) > stale_after_ms),
-            EnvironmentStatus::Offline => true,
-            _ => false,
-        }
-    }
-    /// True when the observed steady power state differs from the desired
-    /// one and the environment is in a state a power change can act on.
-    pub fn power_diverges(&self) -> bool {
-        matches!(self.source, EnvironmentSource::Provisioned { .. })
-            && self
-                .status
-                .power_state()
-                .is_some_and(|observed| observed != self.desired_power)
-    }
-
-    /// True for a ready provisioned environment whose realized public
-    /// endpoint does not match its ingress intent yet.
-    pub fn ingress_diverges(&self) -> bool {
-        matches!(self.source, EnvironmentSource::Provisioned { .. })
-            && self.status == EnvironmentStatus::Ready
-            && self.public_ingress_enabled != self.public_endpoint.is_some()
-    }
-
-    /// True for a provisioned environment at rest in a power state whose
-    /// provider target is recorded: only a periodic observation notices a
-    /// target that changed or vanished out of band.
-    pub fn is_steady_provisioned(&self) -> bool {
-        matches!(self.source, EnvironmentSource::Provisioned { .. })
-            && self.status.power_state().is_some()
-            && self.incarnation.provider_target_id.is_some()
-    }
-
-    /// Whether a reconcile pass of `scope` visits this environment.
-    pub fn needs_reconcile(&self, scope: ReconcileScope) -> bool {
-        matches!(
-            self.status,
-            EnvironmentStatus::Provisioning
-                | EnvironmentStatus::Booting
-                | EnvironmentStatus::Closing
-                | EnvironmentStatus::Unknown
-        ) || self.power_diverges()
-            || self.ingress_diverges()
-            || (scope == ReconcileScope::WithSteady && self.is_steady_provisioned())
-    }
-
-    pub fn provider_id(&self) -> Option<&EnvironmentProviderId> {
-        self.source.provider_id()
-    }
-
-    pub fn binding_id(&self) -> Option<&EnvironmentProviderBindingId> {
-        self.source.binding_id()
-    }
-
-    pub fn observed_at_ms(&self) -> i64 {
-        self.updated_at_ms
-    }
-
-    pub fn validate(&self) -> Result<(), EnvironmentRegistryError> {
-        validate_nonempty_optional("display_name", self.display_name.as_deref())?;
-        validate_metadata(&self.metadata)?;
-        validate_timestamps(self.created_at_ms, self.updated_at_ms)?;
-        validate_timestamps(
-            self.incarnation.created_at_ms,
-            self.incarnation.updated_at_ms,
-        )?;
-        validate_nonempty_optional("public_endpoint", self.public_endpoint.as_deref())?;
-        if let Some(policy) = &self.idle_policy {
-            policy.validate()?;
-        }
-        if (self.public_ingress_enabled || self.public_endpoint.is_some())
-            && !matches!(self.source, EnvironmentSource::Provisioned { .. })
-        {
-            return invalid("only provisioned environments can have provider-managed ingress");
-        }
-        if self.last_seen_at_ms.is_some() && !self.is_registered() {
-            return invalid("only registered environments carry a last-seen stamp");
-        }
-        if let Some(seen) = self.last_seen_at_ms {
-            validate_nonnegative_i64(seen, "last_seen_at_ms")?;
-        }
-        if let Some(error) = &self.lifecycle_error {
-            error.validate()?;
-        }
-        match &self.source {
-            EnvironmentSource::Provisioned { .. } => {
-                if self.incarnation.provision_request_id.is_none() {
-                    return invalid("provisioned incarnation requires a provision request id");
-                }
-                if self.incarnation.template_id.is_some()
-                    == self.incarnation.adoption_source_target.is_some()
-                {
-                    return invalid(
-                        "provisioned incarnation requires exactly one template or adoption source",
-                    );
-                }
-                if let Some(source) = self.incarnation.adoption_source_target.as_deref() {
-                    validate_adoption_source(source)?;
-                }
-            }
-            EnvironmentSource::External { .. } => {
-                self.validate_no_provider_linkage("external")?;
-            }
-            EnvironmentSource::Registered {
-                daemon_id,
-                daemon_public_key,
-                ..
-            } => {
-                let public_key = parse_daemon_public_key(daemon_public_key)?;
-                if daemon_id != &EnvironmentDaemonId::from_public_key(public_key.as_bytes()) {
-                    return invalid("registered daemon id does not match its public key");
-                }
-                if self.request_id != EnvironmentProvisionRequestId::for_daemon(daemon_id) {
-                    return invalid(
-                        "registered environment request id must derive from its daemon id",
-                    );
-                }
-                if matches!(
-                    self.status,
-                    EnvironmentStatus::Provisioning
-                        | EnvironmentStatus::Booting
-                        | EnvironmentStatus::Paused
-                        | EnvironmentStatus::Suspended
-                ) {
-                    return invalid(
-                        "registered environments are ready, offline, closing, or closed",
-                    );
-                }
-                self.validate_no_provider_linkage("registered")?;
-            }
-        }
-        Ok(())
-    }
-
-    fn validate_no_provider_linkage(&self, kind: &str) -> Result<(), EnvironmentRegistryError> {
-        if self.incarnation.provision_request_id.is_some()
-            || self.incarnation.provider_target_id.is_some()
-            || self.incarnation.template_id.is_some()
-            || self.incarnation.adoption_source_target.is_some()
-            || !self.incarnation.power_states.is_empty()
-        {
-            return invalid(format!("{kind} incarnation must not have provider linkage"));
-        }
-        if self.desired_power != PowerState::Running || self.idle_policy.is_some() {
-            return invalid(format!("{kind} environments have no power control"));
-        }
-        Ok(())
-    }
-}
-
-/// Default disconnect grace for ephemeral registered environments whose key
-/// does not set one: long enough for a pod restart or a brief network
-/// interruption, short enough that leaked benchmark sandboxes disappear.
-pub const DEFAULT_EPHEMERAL_DISCONNECT_GRACE_MS: u64 = 5 * 60 * 1_000;
-
 /// Prefix of every environment registration key secret.
 pub const REGISTRATION_KEY_SECRET_PREFIX: &str = "lsrk_";
 
@@ -862,22 +445,30 @@ pub enum EnvironmentRegistrationKeyStatus {
 /// One reusable, universe-scoped admission policy for outbound `envd`
 /// registration, and the group of the environments it admitted. The row
 /// stores no counters: registration and active counts derive from
-/// environment rows carrying the key id.
+/// environment rows carrying the key id. Its secrets live beside it, so a
+/// rotation keeps the group, the allowlists naming the key and its identity
+/// mode.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub struct EnvironmentRegistrationKeyRecord {
     pub registration_key_id: EnvironmentRegistrationKeyId,
     /// Required: the group name shown wherever registered environments are
     /// listed.
     pub display_name: String,
+    /// Display prefix of the key's live secret.
     pub key_prefix: String,
+    /// Immutable.
     pub identity_mode: RegisteredIdentityMode,
     /// Non-closed environments this key may have at once; absent means
     /// unlimited.
     pub max_active_environments: Option<u32>,
     /// Absent means [`DEFAULT_EPHEMERAL_DISCONNECT_GRACE_MS`].
     pub ephemeral_disconnect_grace_ms: Option<u64>,
+    /// Persistent keys only: close an environment whose daemon has been
+    /// away longer than this.
+    pub offline_close_after_ms: Option<u64>,
     pub expires_at_ms: Option<i64>,
     pub created_at_ms: i64,
+    pub updated_at_ms: i64,
     pub revoked_at_ms: Option<i64>,
 }
 
@@ -896,18 +487,15 @@ impl EnvironmentRegistrationKeyRecord {
     pub fn check_admits(&self, now_ms: i64) -> Result<(), EnvironmentRegistryError> {
         match self.status(now_ms) {
             EnvironmentRegistrationKeyStatus::Active => Ok(()),
-            EnvironmentRegistrationKeyStatus::Revoked => {
-                Err(EnvironmentRegistryError::RegistrationKeyUnavailable {
-                    registration_key_id: self.registration_key_id.to_string(),
-                    reason: "revoked",
-                })
-            }
-            EnvironmentRegistrationKeyStatus::Expired => {
-                Err(EnvironmentRegistryError::RegistrationKeyUnavailable {
-                    registration_key_id: self.registration_key_id.to_string(),
-                    reason: "expired",
-                })
-            }
+            EnvironmentRegistrationKeyStatus::Revoked => Err(self.unavailable("revoked")),
+            EnvironmentRegistrationKeyStatus::Expired => Err(self.unavailable("expired")),
+        }
+    }
+
+    fn unavailable(&self, reason: &'static str) -> EnvironmentRegistryError {
+        EnvironmentRegistryError::RegistrationKeyUnavailable {
+            registration_key_id: self.registration_key_id.to_string(),
+            reason,
         }
     }
 
@@ -925,15 +513,22 @@ impl EnvironmentRegistrationKeyRecord {
         if self.ephemeral_disconnect_grace_ms == Some(0) {
             return invalid("ephemeral_disconnect_grace_ms must be positive when set");
         }
-        validate_nonnegative_i64(self.created_at_ms, "created_at_ms")?;
-        if let Some(expires) = self.expires_at_ms {
-            validate_nonnegative_i64(expires, "expires_at_ms")?;
+        if self.offline_close_after_ms == Some(0) {
+            return invalid("offline_close_after_ms must be positive when set");
         }
-        if let Some(revoked) = self.revoked_at_ms {
-            validate_nonnegative_i64(revoked, "revoked_at_ms")?;
-            if revoked < self.created_at_ms {
-                return invalid("revoked_at_ms must be >= created_at_ms");
-            }
+        if self.offline_close_after_ms.is_some()
+            && self.identity_mode != RegisteredIdentityMode::Persistent
+        {
+            return invalid("offline_close_after_ms applies only to persistent keys");
+        }
+        validate_timestamps(self.created_at_ms, self.updated_at_ms)?;
+        if let Some(expires) = self.expires_at_ms {
+            validate_nonnegative_i64(expires, "expires_at_ms")?;
+        }
+        if let Some(revoked) = self.revoked_at_ms
+            && revoked < self.created_at_ms
+        {
+            return invalid("revoked_at_ms must be >= created_at_ms");
         }
         Ok(())
     }
@@ -946,43 +541,72 @@ pub struct RegistrationKeyPolicy {
     pub identity_mode: RegisteredIdentityMode,
     pub max_active_environments: Option<u32>,
     pub ephemeral_disconnect_grace_ms: Option<u64>,
+    pub offline_close_after_ms: Option<u64>,
+    pub expires_at_ms: Option<i64>,
+}
+
+/// The editable part of a key's policy; a full replace (absent means
+/// unset). The identity mode is not part of it: it never changes.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct RegistrationKeySettings {
+    pub display_name: String,
+    pub max_active_environments: Option<u32>,
+    pub ephemeral_disconnect_grace_ms: Option<u64>,
+    pub offline_close_after_ms: Option<u64>,
     pub expires_at_ms: Option<i64>,
 }
 
-/// A freshly minted registration key: the one-time plaintext secret plus the
-/// record and hash to persist. The secret is structurally not persistable.
+/// A freshly minted registration secret: the one-time plaintext plus the
+/// hash and display prefix to persist. The secret is structurally not
+/// persistable.
 #[derive(Clone, Debug)]
-pub struct MintedRegistrationKey {
+pub struct MintedRegistrationSecret {
     pub secret: SecretValue,
     pub secret_hash: String,
+    pub key_prefix: String,
+}
+
+/// Mint a registration secret. Only its SHA-256 hash and display prefix are
+/// ever persisted.
+pub fn mint_registration_secret() -> MintedRegistrationSecret {
+    let secret = auth::generate_prefixed_secret(REGISTRATION_KEY_SECRET_PREFIX);
+    MintedRegistrationSecret {
+        secret_hash: auth::secret_sha256_hex(&secret),
+        key_prefix: auth::secret_display_prefix(&secret, REGISTRATION_KEY_DISPLAY_PREFIX_LEN),
+        secret: SecretValue::new(secret),
+    }
+}
+
+/// A freshly minted registration key: its first secret plus the record to
+/// persist.
+#[derive(Clone, Debug)]
+pub struct MintedRegistrationKey {
+    pub secret: MintedRegistrationSecret,
     pub record: EnvironmentRegistrationKeyRecord,
 }
 
-/// Mint a registration key. The secret is returned exactly once; only its
-/// SHA-256 hash and display prefix are persisted.
+/// Mint a registration key. The secret is returned exactly once.
 pub fn mint_registration_key(
     registration_key_id: EnvironmentRegistrationKeyId,
     policy: RegistrationKeyPolicy,
     created_at_ms: i64,
 ) -> Result<MintedRegistrationKey, EnvironmentRegistryError> {
-    let secret = auth::generate_prefixed_secret(REGISTRATION_KEY_SECRET_PREFIX);
+    let secret = mint_registration_secret();
     let record = EnvironmentRegistrationKeyRecord {
         registration_key_id,
         display_name: policy.display_name,
-        key_prefix: auth::secret_display_prefix(&secret, REGISTRATION_KEY_DISPLAY_PREFIX_LEN),
+        key_prefix: secret.key_prefix.clone(),
         identity_mode: policy.identity_mode,
         max_active_environments: policy.max_active_environments,
         ephemeral_disconnect_grace_ms: policy.ephemeral_disconnect_grace_ms,
+        offline_close_after_ms: policy.offline_close_after_ms,
         expires_at_ms: policy.expires_at_ms,
         created_at_ms,
+        updated_at_ms: created_at_ms,
         revoked_at_ms: None,
     };
     record.validate()?;
-    Ok(MintedRegistrationKey {
-        secret_hash: auth::secret_sha256_hex(&secret),
-        secret: SecretValue::new(secret),
-        record,
-    })
+    Ok(MintedRegistrationKey { secret, record })
 }
 
 /// Lowercase hex SHA-256 of a presented registration secret: the lookup key.
@@ -990,12 +614,77 @@ pub fn registration_key_hash(secret: &str) -> String {
     auth::secret_sha256_hex(secret)
 }
 
+/// Create a key with its first live secret.
 #[derive(Clone, Debug)]
 pub struct CreateEnvironmentRegistrationKey {
     pub secret_hash: String,
     pub record: EnvironmentRegistrationKeyRecord,
 }
 
+/// Replace the editable policy of a key.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct UpdateEnvironmentRegistrationKey {
+    pub registration_key_id: EnvironmentRegistrationKeyId,
+    pub settings: RegistrationKeySettings,
+    pub updated_at_ms: i64,
+}
+
+impl UpdateEnvironmentRegistrationKey {
+    /// Apply the settings to `record`; the result is validated, so an
+    /// `offline_close_after_ms` on an ephemeral key is refused.
+    pub fn apply(
+        &self,
+        record: &mut EnvironmentRegistrationKeyRecord,
+    ) -> Result<(), EnvironmentRegistryError> {
+        validate_nonnegative_i64(self.updated_at_ms, "updated_at_ms")?;
+        let settings = self.settings.clone();
+        let mut candidate = EnvironmentRegistrationKeyRecord {
+            display_name: settings.display_name,
+            max_active_environments: settings.max_active_environments,
+            ephemeral_disconnect_grace_ms: settings.ephemeral_disconnect_grace_ms,
+            offline_close_after_ms: settings.offline_close_after_ms,
+            expires_at_ms: settings.expires_at_ms,
+            ..record.clone()
+        };
+        candidate.updated_at_ms = candidate.updated_at_ms.max(self.updated_at_ms);
+        candidate.validate()?;
+        *record = candidate;
+        Ok(())
+    }
+}
+
+/// Retire every live secret of the key and make this one its only live
+/// secret. Daemons the key already admitted are unaffected: they never
+/// present the key again.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct RotateEnvironmentRegistrationKey {
+    pub registration_key_id: EnvironmentRegistrationKeyId,
+    pub secret_hash: String,
+    pub key_prefix: String,
+    pub rotated_at_ms: i64,
+}
+
+impl RotateEnvironmentRegistrationKey {
+    /// Apply the rotation to the key record: the new display prefix and
+    /// update time. A revoked key refuses with `RegistrationKeyUnavailable`.
+    pub fn apply(
+        &self,
+        record: &mut EnvironmentRegistrationKeyRecord,
+    ) -> Result<(), EnvironmentRegistryError> {
+        validate_nonnegative_i64(self.rotated_at_ms, "rotated_at_ms")?;
+        validate_secret_hash(&self.secret_hash)?;
+        if record.revoked_at_ms.is_some() {
+            return Err(record.unavailable("revoked"));
+        }
+        let mut candidate = record.clone();
+        candidate.key_prefix = self.key_prefix.clone();
+        candidate.updated_at_ms = candidate.updated_at_ms.max(self.rotated_at_ms);
+        candidate.validate()?;
+        *record = candidate;
+        Ok(())
+    }
+}
+
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub struct RevokeEnvironmentRegistrationKey {
     pub registration_key_id: EnvironmentRegistrationKeyId,
@@ -1025,13 +714,24 @@ pub trait EnvironmentRegistrationKeyStore: Send + Sync {
     async fn list_registration_keys(
         &self,
     ) -> Result<Vec<EnvironmentRegistrationKeyRecord>, EnvironmentRegistryError>;
+    async fn update_registration_key(
+        &self,
+        request: UpdateEnvironmentRegistrationKey,
+    ) -> Result<EnvironmentRegistrationKeyRecord, EnvironmentRegistryError>;
+    /// A revoked key refuses with `RegistrationKeyUnavailable { reason:
+    /// "revoked" }`.
+    async fn rotate_registration_key(
+        &self,
+        request: RotateEnvironmentRegistrationKey,
+    ) -> Result<EnvironmentRegistrationKeyRecord, EnvironmentRegistryError>;
     /// Idempotent: revoking a revoked key keeps the original revocation time.
     async fn revoke_registration_key(
         &self,
         request: RevokeEnvironmentRegistrationKey,
     ) -> Result<EnvironmentRegistrationKeyRecord, EnvironmentRegistryError>;
-    /// Resolve a presented secret by hash regardless of status; the caller
-    /// turns revoked/expired into typed refusals.
+    /// Resolve a presented secret by hash among live (not retired) secrets,
+    /// regardless of the key's status; the caller turns revoked or expired
+    /// into typed refusals.
     async fn resolve_registration_key(
         &self,
         secret_hash: &str,
@@ -1042,68 +742,155 @@ pub trait EnvironmentRegistrationKeyStore: Send + Sync {
     ) -> Result<RegistrationKeyUsage, EnvironmentRegistryError>;
 }
 
-/// Admission of a first-seen daemon identity. The store locks the key row,
-/// re-checks that the key still admits, counts the key's non-closed
-/// environments against its limit, and inserts the environment `Ready`, all
-/// in one transaction. A retry with the same daemon converges through the
-/// derived request id.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct CreateRegisteredEnvironment {
-    pub registration_key_id: EnvironmentRegistrationKeyId,
-    pub environment_id: EnvironmentId,
-    pub incarnation_id: EnvironmentIncarnationId,
-    /// Lowercase hex of the raw Ed25519 public key.
-    pub daemon_public_key: String,
-    pub display_name: Option<String>,
-    pub metadata: BTreeMap<String, String>,
-    pub created_at_ms: i64,
+// ---------------------------------------------------------------------------
+// Environment records
+// ---------------------------------------------------------------------------
+
+/// The lifecycle Lightspeed owns. External and registered environments are
+/// only ever `open` or `closed`.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum EnvironmentState {
+    /// A provisioned environment whose target is being created and has not
+    /// passed its open handshake yet.
+    Provisioning,
+    Open,
+    /// A provisioned environment whose target is being closed.
+    Closing,
+    Closed,
+    /// A provisioned environment broken beyond recovery; see
+    /// `state_message`.
+    Failed,
 }
 
-impl CreateRegisteredEnvironment {
-    pub fn daemon_id(&self) -> Result<EnvironmentDaemonId, EnvironmentRegistryError> {
-        let public_key = parse_daemon_public_key(&self.daemon_public_key)?;
-        Ok(EnvironmentDaemonId::from_public_key(public_key.as_bytes()))
+impl EnvironmentState {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Provisioning => "provisioning",
+            Self::Open => "open",
+            Self::Closing => "closing",
+            Self::Closed => "closed",
+            Self::Failed => "failed",
+        }
+    }
+
+    pub fn parse(value: &str) -> Option<Self> {
+        match value {
+            "provisioning" => Some(Self::Provisioning),
+            "open" => Some(Self::Open),
+            "closing" => Some(Self::Closing),
+            "closed" => Some(Self::Closed),
+            "failed" => Some(Self::Failed),
+            _ => None,
+        }
     }
 }
 
-/// A gateway observation of a registered daemon's control connection.
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+impl fmt::Display for EnvironmentState {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(self.as_str())
+    }
+}
+
+/// Why an environment is closing or closed.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
 #[serde(rename_all = "snake_case")]
-pub enum RegisteredConnectionObservation {
-    /// A control connection was admitted: `Ready` plus a fresh stamp.
-    Connected,
-    /// The connection is still alive: fresh stamp only.
-    Heartbeat,
-    /// The connection ended: `Offline`; the stamp keeps its last value.
-    Disconnected,
+pub enum EnvironmentCloseReason {
+    /// A caller closed it.
+    Requested,
+    /// Its registration key was revoked with its environments.
+    KeyRevoked,
+    /// Its ephemeral daemon stayed away past the key's disconnect grace.
+    EphemeralGrace,
+    /// Its ephemeral daemon said goodbye.
+    Departed,
+    /// Its persistent daemon stayed away past the key's
+    /// `offline_close_after_ms`.
+    OfflineTimeout,
+    /// The provider reported its target closed or gone.
+    ProviderEnded,
+}
+
+impl EnvironmentCloseReason {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Requested => "requested",
+            Self::KeyRevoked => "key_revoked",
+            Self::EphemeralGrace => "ephemeral_grace",
+            Self::Departed => "departed",
+            Self::OfflineTimeout => "offline_timeout",
+            Self::ProviderEnded => "provider_ended",
+        }
+    }
+
+    pub fn parse(value: &str) -> Option<Self> {
+        match value {
+            "requested" => Some(Self::Requested),
+            "key_revoked" => Some(Self::KeyRevoked),
+            "ephemeral_grace" => Some(Self::EphemeralGrace),
+            "departed" => Some(Self::Departed),
+            "offline_timeout" => Some(Self::OfflineTimeout),
+            "provider_ended" => Some(Self::ProviderEnded),
+            _ => None,
+        }
+    }
 }
 
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct ObserveRegisteredEnvironment {
-    pub environment_id: EnvironmentId,
-    pub observation: RegisteredConnectionObservation,
-    pub observed_at_ms: i64,
-    /// Reserved-prefix entries the gateway learned about the daemon at this
-    /// admission, merged into the row so a replaced daemon shows its new
-    /// build. Empty for heartbeats and disconnects. Ignored once the
-    /// environment is closing or closed.
-    #[serde(default)]
-    pub metadata: BTreeMap<String, String>,
+impl fmt::Display for EnvironmentCloseReason {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(self.as_str())
+    }
 }
 
-/// Metadata keys Lightspeed writes about the daemon serving an environment.
-/// They carry the reserved prefix, so a caller cannot set them.
-pub const ENVD_VERSION_METADATA_KEY: &str = "lightspeed.envd.version";
-pub const ENVD_GIT_SHA_METADATA_KEY: &str = "lightspeed.envd.gitSha";
-pub const ENVD_PROTOCOL_VERSION_METADATA_KEY: &str = "lightspeed.envd.protocolVersion";
+/// Display status derived from the state and the per-kind observations;
+/// never stored.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum EnvironmentDisplayStatus {
+    Provisioning,
+    Ready,
+    Paused,
+    Suspended,
+    Stopped,
+    /// The provider's last report gives no usable phase.
+    Unknown,
+    /// A registered daemon is disconnected.
+    Away,
+    Closing,
+    Closed,
+    Failed,
+}
+
+impl EnvironmentDisplayStatus {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Provisioning => "provisioning",
+            Self::Ready => "ready",
+            Self::Paused => "paused",
+            Self::Suspended => "suspended",
+            Self::Stopped => "stopped",
+            Self::Unknown => "unknown",
+            Self::Away => "away",
+            Self::Closing => "closing",
+            Self::Closed => "closed",
+            Self::Failed => "failed",
+        }
+    }
+}
+
+impl fmt::Display for EnvironmentDisplayStatus {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(self.as_str())
+    }
+}
 
 /// What Lightspeed learned about the daemon serving an environment: from
 /// `registration/register` for a registered daemon, from the data-plane
-/// `initialize` at the Ready transition for a provisioned one. Recorded on
-/// the environment row so an operator sees which build serves it, and which
-/// protocol version a mismatched daemon spoke. Never consulted for
-/// admission: the protocol version alone decides that.
-#[derive(Clone, Debug, PartialEq, Eq)]
+/// `initialize` of the open handshake for a provisioned one. Recorded so an
+/// operator sees which build serves it, and which protocol version a
+/// mismatched daemon spoke. Never consulted for admission: the protocol
+/// version alone decides that.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub struct DaemonBuild {
     pub version: Option<String>,
     pub git_sha: Option<String>,
@@ -1119,121 +906,622 @@ impl DaemonBuild {
         }
     }
 
-    /// The reserved entries for this build. A fact the daemon did not report
-    /// is left out, so the row keeps that key's last value.
-    pub fn metadata(&self) -> BTreeMap<String, String> {
-        let mut metadata = BTreeMap::new();
-        if let Some(version) = &self.version {
-            metadata.insert(ENVD_VERSION_METADATA_KEY.to_owned(), version.clone());
+    fn validate(&self) -> Result<(), EnvironmentRegistryError> {
+        validate_nonempty_optional("daemon version", self.version.as_deref())?;
+        validate_nonempty_optional("daemon git sha", self.git_sha.as_deref())
+    }
+}
+
+/// What the provider last reported about a provisioned environment's
+/// target. Display only: no loop selects on it.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ObservedTarget {
+    pub phase: TargetPhase,
+    /// Present only when `phase` is `active`.
+    pub power: Option<PowerState>,
+    pub message: Option<String>,
+    pub observed_at_ms: i64,
+}
+
+impl ObservedTarget {
+    fn validate(&self) -> Result<(), EnvironmentRegistryError> {
+        validate_nonnegative_i64(self.observed_at_ms, "observed_at_ms")?;
+        if self.power.is_some() && self.phase != TargetPhase::Active {
+            return invalid("an observed power state requires the active phase");
         }
-        if let Some(git_sha) = &self.git_sha {
-            metadata.insert(ENVD_GIT_SHA_METADATA_KEY.to_owned(), git_sha.clone());
+        if let Some(message) = &self.message {
+            validate_descriptive_text(message)
+                .map_err(|error| invalid_error(format!("observed message: {error}")))?;
         }
-        metadata.insert(
-            ENVD_PROTOCOL_VERSION_METADATA_KEY.to_owned(),
-            self.protocol_version.to_string(),
-        );
-        metadata
+        Ok(())
     }
 }
 
+/// The per-kind facts of a provisioned environment.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct CreateEnvironment {
-    pub request_id: EnvironmentProvisionRequestId,
-    pub environment_id: EnvironmentId,
-    pub incarnation_id: EnvironmentIncarnationId,
-    pub binding_id: EnvironmentProviderBindingId,
+pub struct ProvisionedSource {
+    pub provider_id: EnvironmentProviderId,
     pub template_id: EnvironmentTemplateId,
-    pub display_name: Option<String>,
-    pub metadata: BTreeMap<String, String>,
-    pub idle_policy: Option<EnvironmentIdlePolicy>,
-    pub created_at_ms: i64,
+    /// Create-time idle override, sent with every `target/create` retry.
+    /// Never interpreted by Lightspeed.
+    pub idle: Option<IdlePolicy>,
+    /// The provider's handle, once `target/create` answered with one.
+    pub provider_target_id: Option<ProviderTargetId>,
+    /// Display only; no loop selects on it.
+    pub observed: Option<ObservedTarget>,
+    /// The public endpoint the provider last reported.
+    pub public_endpoint: Option<String>,
+    /// Work schedule; `Some` exactly while `provisioning` or `closing`.
+    pub next_attempt_at_ms: Option<i64>,
+    /// Consecutive failed attempts of the current work; drives backoff.
+    pub attempts: u32,
 }
 
+/// The per-kind facts of a registered environment.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct AdoptEnvironment {
-    pub request_id: EnvironmentProvisionRequestId,
-    pub environment_id: EnvironmentId,
-    pub incarnation_id: EnvironmentIncarnationId,
-    pub binding_id: EnvironmentProviderBindingId,
-    pub source_target: String,
-    pub display_name: Option<String>,
-    pub metadata: BTreeMap<String, String>,
-    pub created_at_ms: i64,
+pub struct RegisteredSource {
+    pub registration_key_id: EnvironmentRegistrationKeyId,
+    /// Lowercase hex of the daemon's raw Ed25519 public key: the identity.
+    /// One key maps to at most one environment in the deployment, ever, so
+    /// a closed environment's daemon can never register again.
+    pub daemon_public_key: String,
+    /// Read from the key; not stored on the row.
+    pub identity_mode: RegisteredIdentityMode,
+    /// The gateway holds a control connection, as far as durable state
+    /// knows.
+    pub connected: bool,
+    /// When `connected` last changed (or the gateway restarted).
+    pub connection_changed_at_ms: i64,
+    /// Coarse liveness: written at connect and disconnect, and at most every
+    /// [`REGISTERED_LIVENESS_STAMP_MS`] while connected.
+    pub last_seen_at_ms: i64,
+}
+
+impl RegisteredSource {
+    /// The daemon id derived from the public key.
+    pub fn daemon_id(&self) -> EnvironmentDaemonId {
+        match DaemonPublicKey::parse(&self.daemon_public_key) {
+            Ok(key) => EnvironmentDaemonId::from_public_key(key.as_bytes()),
+            // A record that passed validation always parses; an unvalidated
+            // one still gets a stable id.
+            Err(_) => EnvironmentDaemonId::from_public_key(self.daemon_public_key.as_bytes()),
+        }
+    }
 }
 
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct CreateExternalEnvironment {
-    pub request_id: EnvironmentProvisionRequestId,
+#[serde(tag = "type", rename_all = "snake_case")]
+pub enum EnvironmentSource {
+    /// A provider target Lightspeed asked a provider to create.
+    Provisioned(ProvisionedSource),
+    /// An `envd` Lightspeed dials directly at a fixed endpoint.
+    External { endpoint: EnvironmentEndpoint },
+    /// An `envd` that dialed the gateway outbound and was admitted by a
+    /// registration key.
+    Registered(RegisteredSource),
+}
+
+impl EnvironmentSource {
+    pub fn provider_id(&self) -> Option<&EnvironmentProviderId> {
+        match self {
+            Self::Provisioned(source) => Some(&source.provider_id),
+            Self::External { .. } | Self::Registered(_) => None,
+        }
+    }
+
+    pub fn registration_key_id(&self) -> Option<&EnvironmentRegistrationKeyId> {
+        match self {
+            Self::Registered(source) => Some(&source.registration_key_id),
+            Self::Provisioned(_) | Self::External { .. } => None,
+        }
+    }
+
+    /// The stored `source_kind`: `provisioned`, `external` or `registered`.
+    pub fn kind_str(&self) -> &'static str {
+        match self {
+            Self::Provisioned(_) => "provisioned",
+            Self::External { .. } => "external",
+            Self::Registered(_) => "registered",
+        }
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct EnvironmentRecord {
     pub environment_id: EnvironmentId,
-    pub incarnation_id: EnvironmentIncarnationId,
-    pub endpoint: EnvironmentEndpoint,
+    /// Caller retry key; `None` for registered environments, whose daemon
+    /// public key makes a retried registration converge.
+    pub request_id: Option<EnvironmentProvisionRequestId>,
+    pub source: EnvironmentSource,
     pub display_name: Option<String>,
+    /// Caller metadata only.
     pub metadata: BTreeMap<String, String>,
+    pub state: EnvironmentState,
+    /// Why the row failed, or what provisioning or closing waits on. At most
+    /// [`STATE_MESSAGE_MAX_BYTES`].
+    pub state_message: Option<String>,
+    /// Set exactly while `closing` or `closed`.
+    pub close_reason: Option<EnvironmentCloseReason>,
+    pub state_changed_at_ms: i64,
+    /// The daemon that serves it: from `registration/register`, or the open
+    /// handshake.
+    pub daemon_build: Option<DaemonBuild>,
     pub created_at_ms: i64,
+    pub updated_at_ms: i64,
+    pub closed_at_ms: Option<i64>,
 }
 
-impl CreateEnvironment {
-    /// The validated record this create inserts for a binding of
-    /// `provider_id`.
-    pub fn record(
-        &self,
-        provider_id: EnvironmentProviderId,
-    ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
-        let record = new_record(
-            self.environment_id.clone(),
-            self.request_id.clone(),
-            EnvironmentSource::Provisioned {
-                provider_id,
-                binding_id: self.binding_id.clone(),
+/// Why an environment cannot be used yet.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum EnvironmentWaitReason {
+    /// Still provisioning.
+    Provisioning,
+    /// The registered daemon is not connected.
+    Disconnected,
+    /// The target is resuming from a powered-down state.
+    Waking,
+    /// The target runs but `envd` is not answering yet.
+    Booting,
+}
+
+impl EnvironmentWaitReason {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Provisioning => "provisioning",
+            Self::Disconnected => "disconnected",
+            Self::Waking => "waking",
+            Self::Booting => "booting",
+        }
+    }
+}
+
+impl fmt::Display for EnvironmentWaitReason {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(self.as_str())
+    }
+}
+
+/// Why an environment cannot be used at all.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum EnvironmentGoneReason {
+    Closing,
+    Closed,
+    Failed,
+    /// The registered daemon has been away past its reconnect bound.
+    Away,
+}
+
+impl EnvironmentGoneReason {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Closing => "closing",
+            Self::Closed => "closed",
+            Self::Failed => "failed",
+            Self::Away => "away",
+        }
+    }
+}
+
+impl fmt::Display for EnvironmentGoneReason {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(self.as_str())
+    }
+}
+
+/// The single answer to "may I use this environment now".
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum EnvironmentUse {
+    /// Dial it.
+    Use,
+    /// Not usable yet: re-check after `retry_after_ms`; `until_ms` bounds
+    /// the wait.
+    Wait {
+        reason: EnvironmentWaitReason,
+        retry_after_ms: u64,
+        until_ms: Option<i64>,
+    },
+    /// Not usable: closing, closed, failed, or a daemon away past its bound.
+    Gone {
+        reason: EnvironmentGoneReason,
+        message: Option<String>,
+    },
+}
+
+impl EnvironmentUse {
+    /// What a typed data-route refusal means for the caller. Callers that
+    /// hold the record use [`EnvironmentRecord::bound_route_refusal`].
+    pub fn from_route_refusal(refusal: &DataRouteRefusal, retry_after_ms: Option<u64>) -> Self {
+        let wait = |reason| Self::Wait {
+            reason,
+            retry_after_ms: retry_after_ms.unwrap_or(WAIT_RETRY_AFTER_MS),
+            until_ms: None,
+        };
+        match refusal {
+            DataRouteRefusal::Waking {} => wait(EnvironmentWaitReason::Waking),
+            DataRouteRefusal::Booting {} => wait(EnvironmentWaitReason::Booting),
+            DataRouteRefusal::Provisioning {} => wait(EnvironmentWaitReason::Provisioning),
+            DataRouteRefusal::Disconnected {} => wait(EnvironmentWaitReason::Disconnected),
+            DataRouteRefusal::Away {} => Self::Gone {
+                reason: EnvironmentGoneReason::Away,
+                message: None,
             },
-            self.display_name.clone(),
-            EnvironmentStatus::Provisioning,
-            EnvironmentIncarnationRecord {
-                provision_request_id: Some(self.request_id.clone()),
-                template_id: Some(self.template_id.clone()),
-                ..new_incarnation(self.incarnation_id.clone(), self.created_at_ms)
+            DataRouteRefusal::Gone {} => Self::Gone {
+                reason: EnvironmentGoneReason::Closed,
+                message: None,
             },
-            self.metadata.clone(),
-            self.created_at_ms,
-        );
-        let record = EnvironmentRecord {
-            idle_policy: self.idle_policy.clone(),
-            ..record
-        };
-        record.validate()?;
-        Ok(record)
+            DataRouteRefusal::Failed { message } => Self::Gone {
+                reason: EnvironmentGoneReason::Failed,
+                message: Some(message.as_str().to_owned()),
+            },
+        }
     }
 }
 
-impl AdoptEnvironment {
-    /// The validated record this adoption inserts for a binding of
-    /// `provider_id`.
-    pub fn record(
+impl EnvironmentRecord {
+    pub fn is_registered(&self) -> bool {
+        matches!(self.source, EnvironmentSource::Registered(_))
+    }
+
+    pub fn provider_id(&self) -> Option<&EnvironmentProviderId> {
+        self.source.provider_id()
+    }
+
+    pub fn registration_key_id(&self) -> Option<&EnvironmentRegistrationKeyId> {
+        self.source.registration_key_id()
+    }
+
+    pub fn provisioned(&self) -> Option<&ProvisionedSource> {
+        match &self.source {
+            EnvironmentSource::Provisioned(source) => Some(source),
+            EnvironmentSource::External { .. } | EnvironmentSource::Registered(_) => None,
+        }
+    }
+
+    pub fn registered(&self) -> Option<&RegisteredSource> {
+        match &self.source {
+            EnvironmentSource::Registered(source) => Some(source),
+            EnvironmentSource::Provisioned(_) | EnvironmentSource::External { .. } => None,
+        }
+    }
+
+    /// The display status: the state, refined on an open row by the
+    /// registered connection or the provider's last observation.
+    pub fn display_status(&self) -> EnvironmentDisplayStatus {
+        match self.state {
+            EnvironmentState::Provisioning => EnvironmentDisplayStatus::Provisioning,
+            EnvironmentState::Closing => EnvironmentDisplayStatus::Closing,
+            EnvironmentState::Closed => EnvironmentDisplayStatus::Closed,
+            EnvironmentState::Failed => EnvironmentDisplayStatus::Failed,
+            EnvironmentState::Open => match &self.source {
+                EnvironmentSource::External { .. } => EnvironmentDisplayStatus::Ready,
+                EnvironmentSource::Registered(source) => {
+                    if source.connected {
+                        EnvironmentDisplayStatus::Ready
+                    } else {
+                        EnvironmentDisplayStatus::Away
+                    }
+                }
+                EnvironmentSource::Provisioned(source) => match &source.observed {
+                    None => EnvironmentDisplayStatus::Ready,
+                    Some(observed) => match observed.phase {
+                        TargetPhase::Active => match observed.power {
+                            None | Some(PowerState::Running) => EnvironmentDisplayStatus::Ready,
+                            Some(PowerState::Paused) => EnvironmentDisplayStatus::Paused,
+                            Some(PowerState::Suspended) => EnvironmentDisplayStatus::Suspended,
+                            Some(PowerState::Stopped) => EnvironmentDisplayStatus::Stopped,
+                        },
+                        TargetPhase::Provisioning => EnvironmentDisplayStatus::Provisioning,
+                        TargetPhase::Closing => EnvironmentDisplayStatus::Closing,
+                        TargetPhase::Unknown | TargetPhase::Failed | TargetPhase::Closed => {
+                            EnvironmentDisplayStatus::Unknown
+                        }
+                    },
+                },
+            },
+        }
+    }
+
+    /// The use gate every consumer shares: selection, the resolver, job
+    /// activities, discovery and the gateway route. It only reads.
+    pub fn use_gate(&self, now_ms: i64) -> EnvironmentUse {
+        match self.state {
+            EnvironmentState::Closing => gone(EnvironmentGoneReason::Closing, None),
+            EnvironmentState::Closed => gone(EnvironmentGoneReason::Closed, None),
+            EnvironmentState::Failed => {
+                gone(EnvironmentGoneReason::Failed, self.state_message.clone())
+            }
+            EnvironmentState::Provisioning => EnvironmentUse::Wait {
+                reason: EnvironmentWaitReason::Provisioning,
+                retry_after_ms: WAIT_RETRY_AFTER_MS,
+                until_ms: None,
+            },
+            EnvironmentState::Open => match &self.source {
+                EnvironmentSource::Registered(source) if !source.connected => {
+                    let away = || {
+                        gone(
+                            EnvironmentGoneReason::Away,
+                            Some(format!(
+                                "daemon away for {}",
+                                compact_duration(
+                                    now_ms.saturating_sub(source.connection_changed_at_ms)
+                                )
+                            )),
+                        )
+                    };
+                    match source.identity_mode {
+                        RegisteredIdentityMode::Ephemeral => away(),
+                        RegisteredIdentityMode::Persistent => {
+                            let until = source
+                                .connection_changed_at_ms
+                                .saturating_add(REGISTERED_RECONNECT_WAIT_MS);
+                            if now_ms < until {
+                                EnvironmentUse::Wait {
+                                    reason: EnvironmentWaitReason::Disconnected,
+                                    retry_after_ms: WAIT_RETRY_AFTER_MS,
+                                    until_ms: Some(until),
+                                }
+                            } else {
+                                away()
+                            }
+                        }
+                    }
+                }
+                _ => EnvironmentUse::Use,
+            },
+        }
+    }
+
+    /// What a typed data-route refusal means for this environment:
+    /// [`EnvironmentUse::from_route_refusal`], except that a `disconnected`
+    /// refusal of a registered environment follows its identity mode. The
+    /// row read connected, but the gateway held no control handle: the
+    /// moment between a dropped connection and its disconnect write. An
+    /// ephemeral daemon is then away at once; a persistent one is waited
+    /// for, unbounded here, so the caller bounds consecutive waits by
+    /// [`REGISTERED_RECONNECT_WAIT_MS`] until the row records the
+    /// disconnect and the gate's own bound applies.
+    pub fn bound_route_refusal(
         &self,
-        provider_id: EnvironmentProviderId,
-    ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
-        validate_adoption_source(&self.source_target)?;
+        refusal: &DataRouteRefusal,
+        retry_after_ms: Option<u64>,
+    ) -> EnvironmentUse {
+        let answer = EnvironmentUse::from_route_refusal(refusal, retry_after_ms);
+        match (&self.source, refusal) {
+            (EnvironmentSource::Registered(source), DataRouteRefusal::Disconnected {})
+                if source.identity_mode == RegisteredIdentityMode::Ephemeral =>
+            {
+                gone(
+                    EnvironmentGoneReason::Away,
+                    Some("daemon is not connected".to_owned()),
+                )
+            }
+            _ => answer,
+        }
+    }
+
+    pub fn validate(&self) -> Result<(), EnvironmentRegistryError> {
+        validate_nonempty_optional("display_name", self.display_name.as_deref())?;
+        validate_caller_metadata(&self.metadata)
+            .map_err(|error| invalid_error(error.to_string()))?;
+        validate_timestamps(self.created_at_ms, self.updated_at_ms)?;
+        if self.state_changed_at_ms < self.created_at_ms {
+            return invalid("state_changed_at_ms must be >= created_at_ms");
+        }
+        if let Some(message) = &self.state_message {
+            validate_descriptive_text(message)
+                .map_err(|error| invalid_error(format!("state message: {error}")))?;
+        }
+        if let Some(build) = &self.daemon_build {
+            build.validate()?;
+        }
+        let closing_or_closed = matches!(
+            self.state,
+            EnvironmentState::Closing | EnvironmentState::Closed
+        );
+        if self.close_reason.is_some() != closing_or_closed {
+            return invalid("a close reason is recorded exactly while closing or closed");
+        }
+        match self.closed_at_ms {
+            Some(closed_at) if self.state == EnvironmentState::Closed => {
+                if closed_at < self.created_at_ms {
+                    return invalid("closed_at_ms must be >= created_at_ms");
+                }
+            }
+            None if self.state != EnvironmentState::Closed => {}
+            _ => return invalid("closed_at_ms is recorded exactly while closed"),
+        }
+        if self.request_id.is_some() == self.is_registered() {
+            return invalid(
+                "provisioned and external environments carry a request id; registered ones do not",
+            );
+        }
+        match &self.source {
+            EnvironmentSource::Provisioned(source) => {
+                let scheduled = matches!(
+                    self.state,
+                    EnvironmentState::Provisioning | EnvironmentState::Closing
+                );
+                if source.next_attempt_at_ms.is_some() != scheduled {
+                    return invalid(
+                        "a provisioned environment is scheduled exactly while provisioning or closing",
+                    );
+                }
+                if let Some(policy) = &source.idle {
+                    policy
+                        .validate()
+                        .map_err(|error| invalid_error(error.to_string()))?;
+                }
+                if let Some(observed) = &source.observed {
+                    observed.validate()?;
+                }
+                if let Some(endpoint) = &source.public_endpoint {
+                    if endpoint.is_empty() || endpoint.len() > MAX_ENDPOINT_BYTES {
+                        return invalid(format!(
+                            "public_endpoint must be 1..={MAX_ENDPOINT_BYTES} bytes"
+                        ));
+                    }
+                    if self.state == EnvironmentState::Closed {
+                        return invalid("a closed environment has no public_endpoint");
+                    }
+                }
+            }
+            EnvironmentSource::External { .. } => self.validate_open_or_closed("external")?,
+            EnvironmentSource::Registered(source) => {
+                self.validate_open_or_closed("registered")?;
+                parse_daemon_public_key(&source.daemon_public_key)?;
+                validate_nonnegative_i64(
+                    source.connection_changed_at_ms,
+                    "connection_changed_at_ms",
+                )?;
+                validate_nonnegative_i64(source.last_seen_at_ms, "last_seen_at_ms")?;
+            }
+        }
+        Ok(())
+    }
+
+    fn validate_open_or_closed(&self, kind: &str) -> Result<(), EnvironmentRegistryError> {
+        if !matches!(
+            self.state,
+            EnvironmentState::Open | EnvironmentState::Closed
+        ) {
+            return invalid(format!("{kind} environments are only open or closed"));
+        }
+        Ok(())
+    }
+
+    fn provisioned_mut(&mut self) -> Option<&mut ProvisionedSource> {
+        match &mut self.source {
+            EnvironmentSource::Provisioned(source) => Some(source),
+            EnvironmentSource::External { .. } | EnvironmentSource::Registered(_) => None,
+        }
+    }
+
+    fn registered_mut(&mut self) -> Option<&mut RegisteredSource> {
+        match &mut self.source {
+            EnvironmentSource::Registered(source) => Some(source),
+            EnvironmentSource::Provisioned(_) | EnvironmentSource::External { .. } => None,
+        }
+    }
+
+    /// Move to `state` at `at_ms`, clamped so the row's times stay ordered.
+    /// Returns the clamped time.
+    fn transition(&mut self, state: EnvironmentState, at_ms: i64) -> i64 {
+        let at = at_ms.max(self.created_at_ms).max(self.state_changed_at_ms);
+        self.state = state;
+        self.state_changed_at_ms = at;
+        self.touch(at);
+        at
+    }
+
+    fn touch(&mut self, at_ms: i64) {
+        self.updated_at_ms = self.updated_at_ms.max(at_ms);
+    }
+
+    /// Clear the work schedule of a provisioned row.
+    fn clear_schedule(&mut self) {
+        if let Some(source) = self.provisioned_mut() {
+            source.next_attempt_at_ms = None;
+            source.attempts = 0;
+        }
+    }
+
+    fn close(&mut self, reason: EnvironmentCloseReason, at_ms: i64) {
+        let at = self.transition(EnvironmentState::Closed, at_ms);
+        self.close_reason = Some(reason);
+        self.closed_at_ms = Some(at);
+        self.state_message = None;
+        self.clear_schedule();
+        // A closed target serves nothing.
+        if let Some(source) = self.provisioned_mut() {
+            source.public_endpoint = None;
+        }
+    }
+}
+
+fn gone(reason: EnvironmentGoneReason, message: Option<String>) -> EnvironmentUse {
+    EnvironmentUse::Gone { reason, message }
+}
+
+/// A `state_message` built from any text: control characters cleaned and
+/// cut to [`STATE_MESSAGE_MAX_BYTES`]. `None` when nothing is left.
+pub fn clean_state_message(text: &str) -> Option<String> {
+    DescriptiveText::lossy(text).map(DescriptiveText::into_string)
+}
+
+// ---------------------------------------------------------------------------
+// Creates
+// ---------------------------------------------------------------------------
+
+/// Create a provisioned environment. The store checks that the universe's
+/// binding of `provider_id` exists (`NotFound`) and is enabled
+/// (`InvalidInput`). The same `request_id` with identical inputs returns the
+/// stored row; with different inputs it is `AlreadyExists`.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct CreateEnvironment {
+    pub request_id: EnvironmentProvisionRequestId,
+    pub environment_id: EnvironmentId,
+    pub provider_id: EnvironmentProviderId,
+    pub template_id: EnvironmentTemplateId,
+    pub idle: Option<IdlePolicy>,
+    pub display_name: Option<String>,
+    pub metadata: BTreeMap<String, String>,
+    pub created_at_ms: i64,
+}
+
+impl CreateEnvironment {
+    /// The validated record this create inserts: `provisioning`, due at
+    /// once.
+    pub fn record(&self) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
         let record = new_record(
             self.environment_id.clone(),
-            self.request_id.clone(),
-            EnvironmentSource::Provisioned {
-                provider_id,
-                binding_id: self.binding_id.clone(),
-            },
+            Some(self.request_id.clone()),
+            EnvironmentSource::Provisioned(ProvisionedSource {
+                provider_id: self.provider_id.clone(),
+                template_id: self.template_id.clone(),
+                idle: self.idle.clone(),
+                provider_target_id: None,
+                observed: None,
+                public_endpoint: None,
+                next_attempt_at_ms: Some(self.created_at_ms),
+                attempts: 0,
+            }),
+            EnvironmentState::Provisioning,
             self.display_name.clone(),
-            EnvironmentStatus::Provisioning,
-            EnvironmentIncarnationRecord {
-                provision_request_id: Some(self.request_id.clone()),
-                adoption_source_target: Some(self.source_target.clone()),
-                ..new_incarnation(self.incarnation_id.clone(), self.created_at_ms)
-            },
             self.metadata.clone(),
+            None,
             self.created_at_ms,
         );
         record.validate()?;
         Ok(record)
     }
+
+    /// True when `record` is what this create made: a retry with the same
+    /// inputs. The environment id and the time of a retry are not inputs.
+    pub fn matches(&self, record: &EnvironmentRecord) -> bool {
+        record.request_id.as_ref() == Some(&self.request_id)
+            && record.display_name == self.display_name
+            && record.metadata == self.metadata
+            && record.provisioned().is_some_and(|source| {
+                source.provider_id == self.provider_id
+                    && source.template_id == self.template_id
+                    && source.idle == self.idle
+            })
+    }
+}
+
+/// Create an external environment, `open` at once. The same `request_id`
+/// with identical inputs returns the stored row; with different inputs it is
+/// `AlreadyExists`.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct CreateExternalEnvironment {
+    pub request_id: EnvironmentProvisionRequestId,
+    pub environment_id: EnvironmentId,
+    pub endpoint: EnvironmentEndpoint,
+    pub display_name: Option<String>,
+    pub metadata: BTreeMap<String, String>,
+    pub created_at_ms: i64,
 }
 
 impl CreateExternalEnvironment {
@@ -1241,77 +1529,105 @@ impl CreateExternalEnvironment {
     pub fn record(&self) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
         let record = new_record(
             self.environment_id.clone(),
-            self.request_id.clone(),
+            Some(self.request_id.clone()),
             EnvironmentSource::External {
                 endpoint: self.endpoint.clone(),
             },
+            EnvironmentState::Open,
             self.display_name.clone(),
-            EnvironmentStatus::Ready,
-            new_incarnation(self.incarnation_id.clone(), self.created_at_ms),
             self.metadata.clone(),
+            None,
             self.created_at_ms,
         );
         record.validate()?;
         Ok(record)
     }
+
+    /// True when `record` is what this create made.
+    pub fn matches(&self, record: &EnvironmentRecord) -> bool {
+        record.request_id.as_ref() == Some(&self.request_id)
+            && record.display_name == self.display_name
+            && record.metadata == self.metadata
+            && matches!(&record.source, EnvironmentSource::External { endpoint } if endpoint == &self.endpoint)
+    }
+}
+
+/// Admission of a first-seen daemon identity. The store locks the key,
+/// re-checks that it still admits and that the presented secret is still
+/// its live one, counts the key's non-closed environments against its
+/// limit, and inserts the environment `open` and connected, all in one
+/// transaction. Rotation takes the same lock, so a secret it retired admits
+/// nothing once the rotation commits. A retry with the same daemon public
+/// key returns the row it admitted (closed included: the identity is
+/// spent).
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct CreateRegisteredEnvironment {
+    pub registration_key_id: EnvironmentRegistrationKeyId,
+    /// [`registration_key_hash`] of the secret the daemon presented.
+    pub secret_hash: String,
+    pub environment_id: EnvironmentId,
+    /// Lowercase hex of the raw Ed25519 public key.
+    pub daemon_public_key: String,
+    pub display_name: Option<String>,
+    pub metadata: BTreeMap<String, String>,
+    pub daemon_build: DaemonBuild,
+    pub created_at_ms: i64,
 }
 
 impl CreateRegisteredEnvironment {
+    /// The refusal when the presented secret is no longer the key's live
+    /// one: a rotation retired it after the caller resolved the key.
+    pub fn secret_retired(&self) -> EnvironmentRegistryError {
+        EnvironmentRegistryError::RegistrationKeyUnavailable {
+            registration_key_id: self.registration_key_id.to_string(),
+            reason: "rotated",
+        }
+    }
+
+    pub fn daemon_id(&self) -> Result<EnvironmentDaemonId, EnvironmentRegistryError> {
+        let public_key = parse_daemon_public_key(&self.daemon_public_key)?;
+        Ok(EnvironmentDaemonId::from_public_key(public_key.as_bytes()))
+    }
+
     /// The validated record this admission inserts under `key`.
     pub fn record(
         &self,
         key: &EnvironmentRegistrationKeyRecord,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
-        let daemon_id = self.daemon_id()?;
+        if key.registration_key_id != self.registration_key_id {
+            return invalid("registered environment admitted under another key");
+        }
         let record = new_record(
             self.environment_id.clone(),
-            EnvironmentProvisionRequestId::for_daemon(&daemon_id),
-            EnvironmentSource::Registered {
+            None,
+            EnvironmentSource::Registered(RegisteredSource {
                 registration_key_id: key.registration_key_id.clone(),
-                daemon_id,
                 daemon_public_key: self.daemon_public_key.clone(),
                 identity_mode: key.identity_mode,
-            },
+                connected: true,
+                connection_changed_at_ms: self.created_at_ms,
+                last_seen_at_ms: self.created_at_ms,
+            }),
+            EnvironmentState::Open,
             self.display_name.clone(),
-            EnvironmentStatus::Ready,
-            new_incarnation(self.incarnation_id.clone(), self.created_at_ms),
             self.metadata.clone(),
+            Some(self.daemon_build.clone()),
             self.created_at_ms,
         );
-        let record = EnvironmentRecord {
-            last_seen_at_ms: Some(self.created_at_ms),
-            ..record
-        };
         record.validate()?;
         Ok(record)
     }
 }
 
-fn new_incarnation(
-    incarnation_id: EnvironmentIncarnationId,
-    created_at_ms: i64,
-) -> EnvironmentIncarnationRecord {
-    EnvironmentIncarnationRecord {
-        incarnation_id,
-        provision_request_id: None,
-        provider_target_id: None,
-        template_id: None,
-        adoption_source_target: None,
-        power_states: Vec::new(),
-        created_at_ms,
-        updated_at_ms: created_at_ms,
-    }
-}
-
 #[allow(clippy::too_many_arguments)]
 fn new_record(
     environment_id: EnvironmentId,
-    request_id: EnvironmentProvisionRequestId,
+    request_id: Option<EnvironmentProvisionRequestId>,
     source: EnvironmentSource,
+    state: EnvironmentState,
     display_name: Option<String>,
-    status: EnvironmentStatus,
-    incarnation: EnvironmentIncarnationRecord,
     metadata: BTreeMap<String, String>,
+    daemon_build: Option<DaemonBuild>,
     created_at_ms: i64,
 ) -> EnvironmentRecord {
     EnvironmentRecord {
@@ -1319,230 +1635,519 @@ fn new_record(
         request_id,
         source,
         display_name,
-        status,
-        desired_power: PowerState::Running,
-        idle_policy: None,
-        incarnation,
-        public_ingress_enabled: false,
-        public_endpoint: None,
         metadata,
-        last_seen_at_ms: None,
-        lifecycle_error: None,
+        state,
+        state_message: None,
+        close_reason: None,
+        state_changed_at_ms: created_at_ms,
+        daemon_build,
         created_at_ms,
         updated_at_ms: created_at_ms,
+        closed_at_ms: None,
     }
 }
 
-/// Which environments a lifecycle reconcile pass visits.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum ReconcileScope {
-    /// Environments with convergence pending: provisioning, booting,
-    /// closing or unknown, a power state that diverges from the intent, or
-    /// a ready environment whose public endpoint does not match its
-    /// ingress intent.
-    Converging,
-    /// Those plus every steady provisioned environment with a recorded
-    /// target, observed on a slower cadence.
-    WithSteady,
-}
+// ---------------------------------------------------------------------------
+// Writes
+//
+// Each `apply` changes `record` in place and returns whether it changed
+// anything; a write whose expected state no longer holds returns `false` and
+// leaves the record as it was. The stores validate the result before they
+// keep it.
+// ---------------------------------------------------------------------------
 
-#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub struct ListEnvironments {
-    pub provider_id: Option<EnvironmentProviderId>,
-    pub binding_id: Option<EnvironmentProviderBindingId>,
-    pub status: Option<EnvironmentStatus>,
-    /// Only environments admitted by this registration key.
-    pub registration_key_id: Option<EnvironmentRegistrationKeyId>,
-    /// Only environments carrying every listed metadata pair (containment).
-    #[serde(default)]
+/// Replace the display name and caller metadata. Refused for a closed
+/// environment.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct UpdateEnvironment {
+    pub environment_id: EnvironmentId,
+    pub display_name: Option<String>,
     pub metadata: BTreeMap<String, String>,
+    pub updated_at_ms: i64,
+}
+
+impl UpdateEnvironment {
+    pub fn apply(&self, record: &mut EnvironmentRecord) -> Result<bool, EnvironmentRegistryError> {
+        validate_nonnegative_i64(self.updated_at_ms, "updated_at_ms")?;
+        if record.state == EnvironmentState::Closed {
+            return invalid("environment closed");
+        }
+        record.display_name = self.display_name.clone();
+        record.metadata = self.metadata.clone();
+        record.touch(self.updated_at_ms);
+        Ok(true)
+    }
+}
+
+/// A known registered daemon reconnected: connected, both connection stamps
+/// set, and its build replaced (it may be a newer one). Refused with
+/// `InvalidInput` when the environment is closed: the identity is spent.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct MarkRegisteredConnected {
+    pub environment_id: EnvironmentId,
+    pub daemon_build: DaemonBuild,
+    pub at_ms: i64,
 }
 
-/// A provider observation of a provisioned environment's target. The target
-/// id and power states are recorded whatever the environment's status, so a
-/// close that raced the first create can still address the target. The
-/// status, the daemon build and the clearing of `lifecycle_error` apply only
-/// while the environment is not closing or closed: a close is never
-/// overwritten by an observation that was in flight when it was accepted.
+impl MarkRegisteredConnected {
+    pub fn apply(&self, record: &mut EnvironmentRecord) -> Result<bool, EnvironmentRegistryError> {
+        validate_nonnegative_i64(self.at_ms, "at_ms")?;
+        if record.state == EnvironmentState::Closed {
+            return invalid("environment closed");
+        }
+        let Some(source) = record.registered_mut() else {
+            return invalid("connection writes apply only to registered environments");
+        };
+        source.connected = true;
+        source.connection_changed_at_ms = self.at_ms;
+        source.last_seen_at_ms = self.at_ms;
+        record.daemon_build = Some(self.daemon_build.clone());
+        record.touch(self.at_ms);
+        Ok(true)
+    }
+}
+
+/// The current control connection of a registered daemon ended. Written
+/// only while the row reads connected.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct MarkRegisteredDisconnected {
+    pub environment_id: EnvironmentId,
+    pub at_ms: i64,
+}
+
+impl MarkRegisteredDisconnected {
+    pub fn apply(&self, record: &mut EnvironmentRecord) -> Result<bool, EnvironmentRegistryError> {
+        validate_nonnegative_i64(self.at_ms, "at_ms")?;
+        let Some(source) = record.registered_mut() else {
+            return invalid("connection writes apply only to registered environments");
+        };
+        if !source.connected {
+            return Ok(false);
+        }
+        source.connected = false;
+        source.connection_changed_at_ms = self.at_ms;
+        record.touch(self.at_ms);
+        Ok(true)
+    }
+}
+
+/// The coarse liveness stamp of a connected registered daemon: written only
+/// while open and connected, and only once the last stamp is at least
+/// [`REGISTERED_LIVENESS_STAMP_MS`] old.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct StampRegisteredSeen {
+    pub environment_id: EnvironmentId,
+    pub at_ms: i64,
+}
+
+impl StampRegisteredSeen {
+    pub fn apply(&self, record: &mut EnvironmentRecord) -> Result<bool, EnvironmentRegistryError> {
+        validate_nonnegative_i64(self.at_ms, "at_ms")?;
+        let open = record.state == EnvironmentState::Open;
+        let Some(source) = record.registered_mut() else {
+            return invalid("connection writes apply only to registered environments");
+        };
+        if !open
+            || !source.connected
+            || source.last_seen_at_ms > self.at_ms.saturating_sub(REGISTERED_LIVENESS_STAMP_MS)
+        {
+            return Ok(false);
+        }
+        source.last_seen_at_ms = self.at_ms;
+        record.touch(self.at_ms);
+        Ok(true)
+    }
+}
+
+/// What one registered sweep changed.
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct RegisteredSweep {
+    /// Rows that read connected with a stale liveness stamp, now
+    /// disconnected as of that stamp.
+    pub disconnected: Vec<EnvironmentId>,
+    /// Rows the sweep closed, with the reason.
+    pub closed: Vec<(EnvironmentId, EnvironmentCloseReason)>,
+}
+
+/// One registered sweep step for an open registered row under its key, at
+/// `now_ms`. In order:
+///
+/// 1. connected with `last_seen_at_ms < now - REGISTERED_STALE_AFTER_MS` →
+///    disconnected, `connection_changed_at_ms = last_seen_at_ms`;
+/// 2. disconnected, ephemeral, away longer than the key's grace → closed
+///    (`ephemeral_grace`);
+/// 3. disconnected, persistent, the key sets `offline_close_after_ms` and
+///    the daemon is away longer → closed (`offline_timeout`).
+///
+/// Returns whether step 1 applied and the close reason of step 2 or 3.
+pub fn sweep_registered_environment(
+    record: &mut EnvironmentRecord,
+    key: &EnvironmentRegistrationKeyRecord,
+    now_ms: i64,
+) -> (bool, Option<EnvironmentCloseReason>) {
+    if record.state != EnvironmentState::Open {
+        return (false, None);
+    }
+    let Some(source) = record.registered_mut() else {
+        return (false, None);
+    };
+    let mut disconnected = false;
+    if source.connected && source.last_seen_at_ms < now_ms.saturating_sub(REGISTERED_STALE_AFTER_MS)
+    {
+        source.connected = false;
+        source.connection_changed_at_ms = source.last_seen_at_ms;
+        disconnected = true;
+    }
+    let close = if source.connected {
+        None
+    } else {
+        let away_ms = now_ms.saturating_sub(source.connection_changed_at_ms);
+        match source.identity_mode {
+            RegisteredIdentityMode::Ephemeral
+                if away_ms > duration_ms(key.ephemeral_disconnect_grace_ms()) =>
+            {
+                Some(EnvironmentCloseReason::EphemeralGrace)
+            }
+            RegisteredIdentityMode::Persistent
+                if key
+                    .offline_close_after_ms
+                    .is_some_and(|after| away_ms > duration_ms(after)) =>
+            {
+                Some(EnvironmentCloseReason::OfflineTimeout)
+            }
+            _ => None,
+        }
+    };
+    if disconnected {
+        record.touch(now_ms);
+    }
+    if let Some(reason) = close {
+        record.close(reason, now_ms);
+    }
+    (disconnected, close)
+}
+
+fn duration_ms(value: u64) -> i64 {
+    i64::try_from(value).unwrap_or(i64::MAX)
+}
+
+/// A span for people to read, such as `45s`, `3m12s` or `1h5m`. Negative
+/// spans read as `0s`.
+fn compact_duration(ms: i64) -> String {
+    let seconds = ms.max(0) / 1_000;
+    let (hours, minutes, seconds) = (seconds / 3_600, seconds / 60 % 60, seconds % 60);
+    match (hours, minutes, seconds) {
+        (0, 0, seconds) => format!("{seconds}s"),
+        (0, minutes, 0) => format!("{minutes}m"),
+        (0, minutes, seconds) => format!("{minutes}m{seconds}s"),
+        (hours, 0, _) => format!("{hours}h"),
+        (hours, minutes, _) => format!("{hours}h{minutes}m"),
+    }
+}
+
+/// What the provider reported about a provisioned environment's target, in
+/// any state. The target id is recorded (a different id than the recorded
+/// one is refused); the observation and public endpoint replace the stored
+/// ones unless an observation stamped later is already stored. The stored
+/// observation is stamped with `observed_at_ms`. A closed row keeps no
+/// public endpoint. Never changes the state.
 #[derive(Clone, Debug, PartialEq, Eq)]
-pub struct ObserveProvisionedEnvironment {
+pub struct RecordTargetObservation {
     pub environment_id: EnvironmentId,
-    /// Recorded when present; absent while an asynchronous provider has not
-    /// assigned one yet, which keeps the recorded id. A different id than
-    /// the recorded one is refused.
+    /// Absent while an asynchronous provider has not assigned one yet; the
+    /// recorded id is kept.
     pub provider_target_id: Option<ProviderTargetId>,
-    pub status: EnvironmentStatus,
-    /// Provider-reported supported power states for this target.
-    pub power_states: Vec<PowerState>,
-    /// The daemon found by the data-plane `initialize` of a Ready
-    /// transition.
-    pub daemon_build: Option<DaemonBuild>,
+    pub observed: ObservedTarget,
+    pub public_endpoint: Option<String>,
     pub observed_at_ms: i64,
 }
 
-impl ObserveProvisionedEnvironment {
-    /// Apply this observation to `record`. Stale observations (older than
-    /// the incarnation's last update) leave it unchanged.
-    pub fn apply(&self, record: &mut EnvironmentRecord) -> Result<(), EnvironmentRegistryError> {
+impl RecordTargetObservation {
+    pub fn apply(&self, record: &mut EnvironmentRecord) -> Result<bool, EnvironmentRegistryError> {
         validate_nonnegative_i64(self.observed_at_ms, "observed_at_ms")?;
-        if !matches!(record.source, EnvironmentSource::Provisioned { .. }) {
+        let closed = record.state == EnvironmentState::Closed;
+        let Some(source) = record.provisioned_mut() else {
             return invalid("provider observations apply only to provisioned environments");
-        }
-        if self.observed_at_ms < record.incarnation.updated_at_ms {
-            return Ok(());
-        }
+        };
         if let (Some(recorded), Some(observed)) = (
-            record.incarnation.provider_target_id.as_ref(),
+            source.provider_target_id.as_ref(),
             self.provider_target_id.as_ref(),
         ) && recorded != observed
         {
-            return invalid("provider target conflicts with current incarnation");
-        }
-        if let Some(target_id) = &self.provider_target_id {
-            record.incarnation.provider_target_id = Some(target_id.clone());
+            return invalid("provider target conflicts with the recorded target");
         }
-        record.incarnation.power_states = self.power_states.clone();
-        record.incarnation.updated_at_ms = self.observed_at_ms;
-        if record.status.is_closing_or_closed() {
-            return Ok(());
+        let mut changed = false;
+        if source.provider_target_id.is_none() && self.provider_target_id.is_some() {
+            source.provider_target_id = self.provider_target_id.clone();
+            changed = true;
         }
-        record.status = self.status;
-        if let Some(build) = &self.daemon_build {
-            record.metadata.extend(build.metadata());
+        let fresh = source
+            .observed
+            .as_ref()
+            .is_none_or(|previous| self.observed_at_ms >= previous.observed_at_ms);
+        if fresh {
+            source.observed = Some(ObservedTarget {
+                observed_at_ms: self.observed_at_ms,
+                ..self.observed.clone()
+            });
+            if !closed {
+                source.public_endpoint = self.public_endpoint.clone();
+            }
+            changed = true;
         }
-        if self.status.power_state().is_some() {
-            record.lifecycle_error = None;
+        if changed {
+            record.touch(self.observed_at_ms);
         }
-        record.updated_at_ms = record.updated_at_ms.max(self.observed_at_ms);
-        Ok(())
+        Ok(changed)
     }
 }
 
-/// Set the Lightspeed-owned power intent. Rejected for external, closing,
-/// closed, and failed environments; the caller validates provider support.
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct SetEnvironmentPower {
+/// Reschedule the work of a provisioning or closing row: the next attempt,
+/// the attempt count and what it waits on.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct ScheduleEnvironmentAttempt {
     pub environment_id: EnvironmentId,
-    pub desired_power: PowerState,
-    pub updated_at_ms: i64,
+    /// The state of the row the step read, `provisioning` or `closing`. The
+    /// write is skipped when the row has moved on, so a close that lands
+    /// while a provision step is in flight keeps its own schedule.
+    pub expected_state: EnvironmentState,
+    pub next_attempt_at_ms: i64,
+    pub attempts: u32,
+    /// Cleaned and cut by [`clean_state_message`].
+    pub state_message: Option<String>,
+    pub at_ms: i64,
+}
+
+impl ScheduleEnvironmentAttempt {
+    pub fn apply(&self, record: &mut EnvironmentRecord) -> Result<bool, EnvironmentRegistryError> {
+        validate_nonnegative_i64(self.at_ms, "at_ms")?;
+        validate_nonnegative_i64(self.next_attempt_at_ms, "next_attempt_at_ms")?;
+        if record.state != self.expected_state
+            || !matches!(
+                record.state,
+                EnvironmentState::Provisioning | EnvironmentState::Closing
+            )
+        {
+            return Ok(false);
+        }
+        let Some(source) = record.provisioned_mut() else {
+            return Ok(false);
+        };
+        source.next_attempt_at_ms = Some(self.next_attempt_at_ms);
+        source.attempts = self.attempts;
+        record.state_message = self.state_message.as_deref().and_then(clean_state_message);
+        record.touch(self.at_ms);
+        Ok(true)
+    }
 }
 
-/// Replace (or clear) the idle policy of a provisioned environment.
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct SetEnvironmentIdlePolicy {
+/// The open handshake of a provisioning row succeeded: `open`, schedule and
+/// message cleared, the daemon's build recorded.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct OpenEnvironment {
     pub environment_id: EnvironmentId,
-    pub idle_policy: Option<EnvironmentIdlePolicy>,
-    pub updated_at_ms: i64,
+    pub daemon_build: DaemonBuild,
+    pub at_ms: i64,
+}
+
+impl OpenEnvironment {
+    pub fn apply(&self, record: &mut EnvironmentRecord) -> Result<bool, EnvironmentRegistryError> {
+        validate_nonnegative_i64(self.at_ms, "at_ms")?;
+        if record.provisioned().is_none() || record.state != EnvironmentState::Provisioning {
+            return Ok(false);
+        }
+        record.transition(EnvironmentState::Open, self.at_ms);
+        record.clear_schedule();
+        record.state_message = None;
+        record.daemon_build = Some(self.daemon_build.clone());
+        Ok(true)
+    }
 }
 
-/// Move an environment to `failed` with `message` as its lifecycle error.
-/// A closing or closed environment is left as it is.
+/// A provisioning or open provisioned row is broken: `failed` with
+/// `message`.
 #[derive(Clone, Debug, PartialEq, Eq)]
-pub struct FailEnvironmentLifecycle {
+pub struct FailEnvironment {
     pub environment_id: EnvironmentId,
     pub message: String,
     /// The daemon whose build made the environment unusable, such as one
     /// that speaks another protocol version.
     pub daemon_build: Option<DaemonBuild>,
-    pub observed_at_ms: i64,
+    pub at_ms: i64,
 }
 
-impl FailEnvironmentLifecycle {
-    pub fn apply(&self, record: &mut EnvironmentRecord) -> Result<(), EnvironmentRegistryError> {
-        validate_nonnegative_i64(self.observed_at_ms, "observed_at_ms")?;
-        if record.status.is_closing_or_closed() {
-            return Ok(());
-        }
-        record.status = EnvironmentStatus::Failed;
-        record.lifecycle_error = Some(EnvironmentLifecycleError::record(
-            record.lifecycle_error.as_ref(),
-            &self.message,
-            self.observed_at_ms,
-        ));
+impl FailEnvironment {
+    pub fn apply(&self, record: &mut EnvironmentRecord) -> Result<bool, EnvironmentRegistryError> {
+        validate_nonnegative_i64(self.at_ms, "at_ms")?;
+        if record.provisioned().is_none() {
+            return invalid("only provisioned environments fail");
+        }
+        if !matches!(
+            record.state,
+            EnvironmentState::Provisioning | EnvironmentState::Open
+        ) {
+            return Ok(false);
+        }
+        record.transition(EnvironmentState::Failed, self.at_ms);
+        record.clear_schedule();
+        record.state_message = Some(
+            clean_state_message(&self.message).unwrap_or_else(|| "unspecified failure".to_owned()),
+        );
         if let Some(build) = &self.daemon_build {
-            record.metadata.extend(build.metadata());
+            record.daemon_build = Some(build.clone());
         }
-        record.incarnation.updated_at_ms =
-            record.incarnation.updated_at_ms.max(self.observed_at_ms);
-        record.updated_at_ms = record.updated_at_ms.max(self.observed_at_ms);
-        Ok(())
+        Ok(true)
     }
 }
 
-/// Record a lifecycle error the reconciler will retry past, without
-/// changing the environment's status. A closed environment is left as it
-/// is.
+/// Begin closing. A provisioned row moves from provisioning, open or failed
+/// to `closing`, due at once; an external or registered row moves from open
+/// straight to `closed`. A closing or closed row is left as it is.
 #[derive(Clone, Debug, PartialEq, Eq)]
-pub struct RecordEnvironmentLifecycleError {
+pub struct BeginCloseEnvironment {
     pub environment_id: EnvironmentId,
-    pub message: String,
-    pub observed_at_ms: i64,
-}
-
-impl RecordEnvironmentLifecycleError {
-    pub fn apply(&self, record: &mut EnvironmentRecord) -> Result<(), EnvironmentRegistryError> {
-        validate_nonnegative_i64(self.observed_at_ms, "observed_at_ms")?;
-        if record.status == EnvironmentStatus::Closed {
-            return Ok(());
+    pub reason: EnvironmentCloseReason,
+    pub at_ms: i64,
+}
+
+impl BeginCloseEnvironment {
+    pub fn apply(&self, record: &mut EnvironmentRecord) -> Result<bool, EnvironmentRegistryError> {
+        validate_nonnegative_i64(self.at_ms, "at_ms")?;
+        if matches!(
+            record.state,
+            EnvironmentState::Closing | EnvironmentState::Closed
+        ) {
+            return Ok(false);
         }
-        record.lifecycle_error = Some(EnvironmentLifecycleError::record(
-            record.lifecycle_error.as_ref(),
-            &self.message,
-            self.observed_at_ms,
-        ));
-        record.updated_at_ms = record.updated_at_ms.max(self.observed_at_ms);
-        Ok(())
+        if record.provisioned().is_some() {
+            let at = record.transition(EnvironmentState::Closing, self.at_ms);
+            record.close_reason = Some(self.reason);
+            record.state_message = None;
+            if let Some(source) = record.provisioned_mut() {
+                source.next_attempt_at_ms = Some(at);
+                source.attempts = 0;
+            }
+        } else {
+            record.close(self.reason, self.at_ms);
+        }
+        Ok(true)
     }
 }
 
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct BeginCloseEnvironment {
+/// The provider confirmed a closing row's target gone: `closed`.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct FinishCloseEnvironment {
     pub environment_id: EnvironmentId,
-    pub updated_at_ms: i64,
+    pub at_ms: i64,
 }
 
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct FinishCloseEnvironment {
-    pub environment_id: EnvironmentId,
-    pub observed_at_ms: i64,
+impl FinishCloseEnvironment {
+    pub fn apply(&self, record: &mut EnvironmentRecord) -> Result<bool, EnvironmentRegistryError> {
+        validate_nonnegative_i64(self.at_ms, "at_ms")?;
+        if record.state != EnvironmentState::Closing {
+            return Ok(false);
+        }
+        let reason = record
+            .close_reason
+            .unwrap_or(EnvironmentCloseReason::Requested);
+        record.close(reason, self.at_ms);
+        Ok(true)
+    }
 }
 
-/// Record the public ingress intent of a provisioned environment; the
-/// lifecycle reconciler converges the provider toward it. Enabling is
-/// refused for a closing or closed environment.
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct SetEnvironmentIngress {
+/// The provider reported an open or failed row's target closed or not
+/// found: `closed` with `provider_ended`.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct EndProvisionedEnvironment {
     pub environment_id: EnvironmentId,
-    pub enabled: bool,
-    pub updated_at_ms: i64,
+    pub at_ms: i64,
+}
+
+impl EndProvisionedEnvironment {
+    pub fn apply(&self, record: &mut EnvironmentRecord) -> Result<bool, EnvironmentRegistryError> {
+        validate_nonnegative_i64(self.at_ms, "at_ms")?;
+        if record.provisioned().is_none()
+            || !matches!(
+                record.state,
+                EnvironmentState::Open | EnvironmentState::Failed
+            )
+        {
+            return Ok(false);
+        }
+        record.close(EnvironmentCloseReason::ProviderEnded, self.at_ms);
+        Ok(true)
+    }
 }
 
-/// Record the public endpoint a provider observation reports realized,
-/// `None` when the target has no public ingress. A closing or closed
-/// environment is left as it is.
+/// One page of environments, ordered by environment id. Closed rows are
+/// listed only with `include_closed` or `state == Closed`.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct RecordEnvironmentIngress {
-    pub environment_id: EnvironmentId,
-    pub public_endpoint: Option<String>,
-    pub observed_at_ms: i64,
+pub struct ListEnvironments {
+    pub provider_id: Option<EnvironmentProviderId>,
+    /// Only environments admitted by this registration key.
+    pub registration_key_id: Option<EnvironmentRegistrationKeyId>,
+    pub state: Option<EnvironmentState>,
+    pub include_closed: bool,
+    /// Only environments carrying every listed metadata pair (containment).
+    pub metadata: BTreeMap<String, String>,
+    /// 1 to [`LIST_ENVIRONMENTS_MAX_LIMIT`].
+    pub limit: u32,
+    /// Continue after this environment id (exclusive).
+    pub after: Option<EnvironmentId>,
 }
 
-impl RecordEnvironmentIngress {
-    pub fn apply(&self, record: &mut EnvironmentRecord) -> Result<(), EnvironmentRegistryError> {
-        validate_nonnegative_i64(self.observed_at_ms, "observed_at_ms")?;
-        validate_nonempty_optional("public_endpoint", self.public_endpoint.as_deref())?;
-        if !matches!(record.source, EnvironmentSource::Provisioned { .. }) {
-            return invalid("provider-managed ingress requires a provisioned environment");
+impl Default for ListEnvironments {
+    fn default() -> Self {
+        Self {
+            provider_id: None,
+            registration_key_id: None,
+            state: None,
+            include_closed: false,
+            metadata: BTreeMap::new(),
+            limit: LIST_ENVIRONMENTS_DEFAULT_LIMIT,
+            after: None,
         }
-        if record.status.is_closing_or_closed() {
-            return Ok(());
+    }
+}
+
+impl ListEnvironments {
+    pub fn validate(&self) -> Result<(), EnvironmentRegistryError> {
+        if !(1..=LIST_ENVIRONMENTS_MAX_LIMIT).contains(&self.limit) {
+            return invalid(format!(
+                "list limit must be 1..={LIST_ENVIRONMENTS_MAX_LIMIT}"
+            ));
         }
-        record.public_endpoint = self.public_endpoint.clone();
-        record.updated_at_ms = record.updated_at_ms.max(self.observed_at_ms);
         Ok(())
     }
+
+    /// Whether `record` passes every filter except the page bounds.
+    pub fn matches(&self, record: &EnvironmentRecord) -> bool {
+        let closed_listed = self.include_closed || self.state == Some(EnvironmentState::Closed);
+        (record.state != EnvironmentState::Closed || closed_listed)
+            && self.state.is_none_or(|state| state == record.state)
+            && self
+                .provider_id
+                .as_ref()
+                .is_none_or(|id| record.provider_id() == Some(id))
+            && self
+                .registration_key_id
+                .as_ref()
+                .is_none_or(|id| record.registration_key_id() == Some(id))
+            && harness::storage::metadata_matches(&record.metadata, &self.metadata)
+    }
 }
 
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct EnvironmentPage {
+    pub environments: Vec<EnvironmentRecord>,
+    /// Pass as `after` for the next page; `None` on the last page.
+    pub next_after: Option<EnvironmentId>,
+}
+
+// ---------------------------------------------------------------------------
+// Environment credentials
+// ---------------------------------------------------------------------------
+
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub struct EnvironmentCredentialRecord {
     pub environment_id: EnvironmentId,
@@ -1592,40 +2197,40 @@ pub struct ListEnvironmentCredentials {
     pub environment_id: EnvironmentId,
 }
 
+// ---------------------------------------------------------------------------
+// Store traits
+// ---------------------------------------------------------------------------
+
+/// Deployment-scoped providers.
 #[async_trait]
 pub trait EnvironmentProviderStore: Send + Sync {
     async fn put_provider(
         &self,
-        record: PutEnvironmentProvider,
+        request: PutEnvironmentProvider,
     ) -> Result<EnvironmentProviderRecord, EnvironmentRegistryError>;
     async fn read_provider(
         &self,
         provider_id: &EnvironmentProviderId,
     ) -> Result<EnvironmentProviderRecord, EnvironmentRegistryError>;
-    /// The provider's bearer credential, unsealed.
+    /// The provider's bearer credential, unsealed; `None` when it has none.
     async fn read_provider_credential(
         &self,
         provider_id: &EnvironmentProviderId,
-    ) -> Result<SecretValue, EnvironmentRegistryError>;
-    /// Record what the controller advertised at a successful `initialize`.
-    /// Returns the record unchanged when the provider has moved to another
-    /// endpoint since.
-    async fn record_provider_controller(
-        &self,
-        request: RecordProviderController,
-    ) -> Result<EnvironmentProviderRecord, EnvironmentRegistryError>;
+    ) -> Result<Option<SecretValue>, EnvironmentRegistryError>;
     async fn list_providers(
         &self,
-        request: ListEnvironmentProviders,
     ) -> Result<Vec<EnvironmentProviderRecord>, EnvironmentRegistryError>;
+    /// Refused while bindings or non-closed environments reference it.
     async fn delete_provider(
         &self,
         provider_id: &EnvironmentProviderId,
     ) -> Result<EnvironmentProviderRecord, EnvironmentRegistryError>;
 }
 
+/// A universe's provider bindings, one per provider.
 #[async_trait]
 pub trait EnvironmentProviderBindingStore: Send + Sync {
+    /// The provider must exist.
     async fn put_provider_binding(
         &self,
         request: PutEnvironmentProviderBinding,
@@ -1633,29 +2238,29 @@ pub trait EnvironmentProviderBindingStore: Send + Sync {
     async fn read_provider_binding(
         &self,
         universe_id: Uuid,
-        binding_id: &EnvironmentProviderBindingId,
+        provider_id: &EnvironmentProviderId,
     ) -> Result<EnvironmentProviderBindingRecord, EnvironmentRegistryError>;
     async fn list_provider_bindings(
         &self,
         universe_id: Uuid,
     ) -> Result<Vec<EnvironmentProviderBindingRecord>, EnvironmentRegistryError>;
+    /// Refused while the universe has non-closed environments of the
+    /// provider.
     async fn delete_provider_binding(
         &self,
         universe_id: Uuid,
-        binding_id: &EnvironmentProviderBindingId,
+        provider_id: &EnvironmentProviderId,
     ) -> Result<EnvironmentProviderBindingRecord, EnvironmentRegistryError>;
 }
 
+/// A universe's environments. Lifecycle writes return the current record,
+/// whether they applied or were skipped.
 #[async_trait]
 pub trait EnvironmentStore: Send + Sync {
     async fn create_environment(
         &self,
         request: CreateEnvironment,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError>;
-    async fn adopt_environment(
-        &self,
-        request: AdoptEnvironment,
-    ) -> Result<EnvironmentRecord, EnvironmentRegistryError>;
     async fn create_external_environment(
         &self,
         request: CreateExternalEnvironment,
@@ -1664,53 +2269,25 @@ pub trait EnvironmentStore: Send + Sync {
         &self,
         request: CreateRegisteredEnvironment,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError>;
+    async fn read_environment(
+        &self,
+        environment_id: &EnvironmentId,
+    ) -> Result<EnvironmentRecord, EnvironmentRegistryError>;
     /// The one environment (closed included) bound to a daemon public key in
     /// this universe.
     async fn read_environment_by_daemon_public_key(
         &self,
         daemon_public_key: &str,
     ) -> Result<Option<EnvironmentRecord>, EnvironmentRegistryError>;
-    async fn observe_registered_environment(
-        &self,
-        request: ObserveRegisteredEnvironment,
-    ) -> Result<EnvironmentRecord, EnvironmentRegistryError>;
-    /// Registered environments that are not closing or closed: the
-    /// lifecycle reconciler's candidates for stale repair and ephemeral
-    /// cleanup.
-    async fn list_open_registered_environments(
-        &self,
-    ) -> Result<Vec<EnvironmentRecord>, EnvironmentRegistryError>;
-    async fn read_environment(
-        &self,
-        environment_id: &EnvironmentId,
-    ) -> Result<EnvironmentRecord, EnvironmentRegistryError>;
-    async fn read_environment_by_request_id(
-        &self,
-        request_id: &EnvironmentProvisionRequestId,
-    ) -> Result<EnvironmentRecord, EnvironmentRegistryError>;
     /// Rows that no longer decode are left out and logged by the store, so
     /// one bad row never hides the others; every list method does the same.
     async fn list_environments(
         &self,
         request: ListEnvironments,
-    ) -> Result<Vec<EnvironmentRecord>, EnvironmentRegistryError>;
-    /// The environments a reconcile pass of `scope` visits; see
-    /// [`EnvironmentRecord::needs_reconcile`].
-    async fn list_environments_needing_reconcile(
-        &self,
-        scope: ReconcileScope,
-    ) -> Result<Vec<EnvironmentRecord>, EnvironmentRegistryError>;
-    async fn observe_provisioned_environment(
-        &self,
-        request: ObserveProvisionedEnvironment,
-    ) -> Result<EnvironmentRecord, EnvironmentRegistryError>;
-    async fn fail_environment_lifecycle(
-        &self,
-        request: FailEnvironmentLifecycle,
-    ) -> Result<EnvironmentRecord, EnvironmentRegistryError>;
-    async fn record_environment_lifecycle_error(
+    ) -> Result<EnvironmentPage, EnvironmentRegistryError>;
+    async fn update_environment(
         &self,
-        request: RecordEnvironmentLifecycleError,
+        request: UpdateEnvironment,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError>;
     async fn begin_close_environment(
         &self,
@@ -1720,27 +2297,66 @@ pub trait EnvironmentStore: Send + Sync {
         &self,
         request: FinishCloseEnvironment,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError>;
-    async fn set_environment_ingress(
+
+    async fn mark_registered_connected(
+        &self,
+        request: MarkRegisteredConnected,
+    ) -> Result<EnvironmentRecord, EnvironmentRegistryError>;
+    async fn mark_registered_disconnected(
+        &self,
+        request: MarkRegisteredDisconnected,
+    ) -> Result<EnvironmentRecord, EnvironmentRegistryError>;
+    /// Whether the stamp was written.
+    async fn stamp_registered_seen(
         &self,
-        request: SetEnvironmentIngress,
+        request: StampRegisteredSeen,
+    ) -> Result<bool, EnvironmentRegistryError>;
+    /// Apply [`sweep_registered_environment`] to every open registered row
+    /// under its key.
+    async fn sweep_registered_environments(
+        &self,
+        now_ms: i64,
+    ) -> Result<RegisteredSweep, EnvironmentRegistryError>;
+    /// After a gateway restart: every connected row becomes disconnected
+    /// with `connection_changed_at_ms = now_ms`, since the connections the
+    /// gateway held ended now, and persistent rows get their full reconnect
+    /// wait. `last_seen_at_ms` is kept. Returns the rows it changed.
+    async fn repair_registered_connections(
+        &self,
+        now_ms: i64,
+    ) -> Result<u64, EnvironmentRegistryError>;
+
+    /// Provisioned rows whose next attempt is due at `now_ms`, earliest
+    /// first.
+    async fn list_environment_work(
+        &self,
+        now_ms: i64,
+        limit: u32,
+    ) -> Result<Vec<EnvironmentRecord>, EnvironmentRegistryError>;
+    /// Open provisioned rows: the display sweep's candidates.
+    async fn list_open_provisioned_environments(
+        &self,
+    ) -> Result<Vec<EnvironmentRecord>, EnvironmentRegistryError>;
+    async fn record_target_observation(
+        &self,
+        request: RecordTargetObservation,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError>;
-    async fn record_environment_ingress(
+    async fn schedule_environment_attempt(
         &self,
-        request: RecordEnvironmentIngress,
+        request: ScheduleEnvironmentAttempt,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError>;
-    async fn set_environment_power(
+    async fn open_environment(
         &self,
-        request: SetEnvironmentPower,
+        request: OpenEnvironment,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError>;
-    async fn set_environment_idle_policy(
+    async fn fail_environment(
         &self,
-        request: SetEnvironmentIdlePolicy,
+        request: FailEnvironment,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError>;
-    /// Ready provisioned environments carrying an idle policy: the power
-    /// reaper's candidates.
-    async fn list_environments_with_idle_policy(
+    async fn end_provisioned_environment(
         &self,
-    ) -> Result<Vec<EnvironmentRecord>, EnvironmentRegistryError>;
+        request: EndProvisionedEnvironment,
+    ) -> Result<EnvironmentRecord, EnvironmentRegistryError>;
 }
 
 #[async_trait]
@@ -1773,14 +2389,18 @@ pub fn template_record(
 }
 
 pub mod endpoint;
-pub use endpoint::{EndpointError, EndpointScheme, EnvironmentEndpoint};
+pub use endpoint::{EndpointError, EndpointScheme, EnvironmentEndpoint, MAX_ENDPOINT_BYTES};
 mod memory;
-pub use memory::{InMemoryEnvironmentRegistryStore, apply_registered_observation};
+pub use memory::InMemoryEnvironmentRegistryStore;
 
 fn invalid<T>(message: impl Into<String>) -> Result<T, EnvironmentRegistryError> {
-    Err(EnvironmentRegistryError::InvalidInput {
+    Err(invalid_error(message))
+}
+
+fn invalid_error(message: impl Into<String>) -> EnvironmentRegistryError {
+    EnvironmentRegistryError::InvalidInput {
         message: message.into(),
-    })
+    }
 }
 
 fn validate_timestamps(
@@ -1795,13 +2415,6 @@ fn validate_timestamps(
     Ok(())
 }
 
-/// An adoption source is a provider-native reference under the protocol's
-/// opaque rule: 1 to 255 bytes without control characters.
-pub fn validate_adoption_source(value: &str) -> Result<(), EnvironmentRegistryError> {
-    validate_opaque_id("adoption_source_target", value)
-        .map_err(|error| invalid_error(error.to_string()))
-}
-
 fn validate_registration_display_name(value: &str) -> Result<(), EnvironmentRegistryError> {
     validate_nonempty_string("registration key display_name", value)?;
     if value.len() > REGISTRATION_KEY_DISPLAY_NAME_MAX_BYTES
@@ -1815,32 +2428,28 @@ fn validate_registration_display_name(value: &str) -> Result<(), EnvironmentRegi
     Ok(())
 }
 
+/// A registration secret hash is lowercase hex SHA-256.
+fn validate_secret_hash(value: &str) -> Result<(), EnvironmentRegistryError> {
+    if value.len() != 64
+        || !value
+            .bytes()
+            .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
+    {
+        return invalid("registration secret hash must be 64 lowercase hex characters");
+    }
+    Ok(())
+}
+
 /// A daemon public key is the raw 32-byte Ed25519 key as lowercase hex.
 pub fn validate_daemon_public_key(value: &str) -> Result<(), EnvironmentRegistryError> {
     parse_daemon_public_key(value).map(|_| ())
 }
 
-fn parse_daemon_public_key(
-    value: &str,
-) -> Result<environment_protocol::registration::DaemonPublicKey, EnvironmentRegistryError> {
-    environment_protocol::registration::DaemonPublicKey::parse(value)
+fn parse_daemon_public_key(value: &str) -> Result<DaemonPublicKey, EnvironmentRegistryError> {
+    DaemonPublicKey::parse(value)
         .map_err(|_| invalid_error("daemon public key must be 64 lowercase hex characters"))
 }
 
-fn invalid_error(message: impl Into<String>) -> EnvironmentRegistryError {
-    EnvironmentRegistryError::InvalidInput {
-        message: message.into(),
-    }
-}
-
-/// Stored records obey the descriptive metadata bounds. The reserved-prefix
-/// check applies to caller input at the API boundary, not here: Lightspeed
-/// itself annotates records under that prefix, and those entries sit on top
-/// of a caller's full allowance rather than eating into it.
-fn validate_metadata(value: &BTreeMap<String, String>) -> Result<(), EnvironmentRegistryError> {
-    validate_stored_metadata(value).map_err(|error| invalid_error(error.to_string()))
-}
-
 fn validate_nonempty_optional(
     name: &'static str,
     value: Option<&str>,
diff --git a/crates/environments/src/memory.rs b/crates/environments/src/memory.rs
index 4b9c28c5b..1c908a054 100644
--- a/crates/environments/src/memory.rs
+++ b/crates/environments/src/memory.rs
@@ -6,11 +6,16 @@ use uuid::Uuid;
 use super::*;
 
 type CredentialKey = (EnvironmentId, String);
-type BindingKey = (Uuid, EnvironmentProviderBindingId);
+type BindingKey = (Uuid, EnvironmentProviderId);
 
-struct StoredRegistrationKey {
+struct StoredSecret {
     secret_hash: String,
+    retired_at_ms: Option<i64>,
+}
+
+struct StoredRegistrationKey {
     record: EnvironmentRegistrationKeyRecord,
+    secrets: Vec<StoredSecret>,
 }
 
 #[derive(Default)]
@@ -19,11 +24,56 @@ struct RegistryState {
     provider_credentials: BTreeMap<EnvironmentProviderId, SecretValue>,
     bindings: BTreeMap<BindingKey, EnvironmentProviderBindingRecord>,
     environments: BTreeMap<EnvironmentId, EnvironmentRecord>,
-    requests: BTreeMap<EnvironmentProvisionRequestId, EnvironmentId>,
     credentials: BTreeMap<CredentialKey, EnvironmentCredentialRecord>,
     registration_keys: BTreeMap<EnvironmentRegistrationKeyId, StoredRegistrationKey>,
 }
 
+impl RegistryState {
+    fn by_request_id(
+        &self,
+        request_id: &EnvironmentProvisionRequestId,
+    ) -> Option<&EnvironmentRecord> {
+        self.environments
+            .values()
+            .find(|record| record.request_id.as_ref() == Some(request_id))
+    }
+
+    fn by_daemon_public_key(&self, daemon_public_key: &str) -> Option<&EnvironmentRecord> {
+        self.environments.values().find(|record| {
+            record
+                .registered()
+                .is_some_and(|source| source.daemon_public_key == daemon_public_key)
+        })
+    }
+
+    fn insert_new(
+        &mut self,
+        record: EnvironmentRecord,
+    ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
+        if self.environments.contains_key(&record.environment_id) {
+            return Err(EnvironmentRegistryError::AlreadyExists {
+                kind: "environment",
+                id: record.environment_id.to_string(),
+            });
+        }
+        self.environments
+            .insert(record.environment_id.clone(), record.clone());
+        Ok(record)
+    }
+
+    fn registration_key(
+        &self,
+        registration_key_id: &EnvironmentRegistrationKeyId,
+    ) -> Result<&EnvironmentRegistrationKeyRecord, EnvironmentRegistryError> {
+        self.registration_keys
+            .get(registration_key_id)
+            .map(|stored| &stored.record)
+            .ok_or_else(|| not_found("environment_registration_key", registration_key_id))
+    }
+}
+
+/// An in-memory registry for one universe, following the same rules as the
+/// PostgreSQL store through the shared `apply` functions.
 pub struct InMemoryEnvironmentRegistryStore {
     universe_id: Uuid,
     state: RwLock<RegistryState>,
@@ -70,6 +120,36 @@ impl InMemoryEnvironmentRegistryStore {
                 message: "environment registry write lock poisoned".to_owned(),
             })
     }
+
+    /// Apply one write to one environment: on a copy, validated, stored
+    /// only when valid. A refused change leaves the stored record untouched.
+    fn change(
+        &self,
+        environment_id: &EnvironmentId,
+        change: impl FnOnce(&mut EnvironmentRecord) -> Result<bool, EnvironmentRegistryError>,
+    ) -> Result<(EnvironmentRecord, bool), EnvironmentRegistryError> {
+        let mut state = self.write_state()?;
+        change_environment(&mut state, environment_id, change)
+    }
+}
+
+fn change_environment(
+    state: &mut RegistryState,
+    environment_id: &EnvironmentId,
+    change: impl FnOnce(&mut EnvironmentRecord) -> Result<bool, EnvironmentRegistryError>,
+) -> Result<(EnvironmentRecord, bool), EnvironmentRegistryError> {
+    let stored = state
+        .environments
+        .get_mut(environment_id)
+        .ok_or_else(|| not_found("environment", environment_id))?;
+    let mut candidate = stored.clone();
+    let changed = change(&mut candidate)?;
+    if !changed {
+        return Ok((stored.clone(), false));
+    }
+    candidate.validate()?;
+    *stored = candidate.clone();
+    Ok((candidate, true))
 }
 
 #[async_trait]
@@ -82,10 +162,16 @@ impl EnvironmentProviderStore for InMemoryEnvironmentRegistryStore {
         let credential = request.credential.clone();
         let existing = state.providers.get(&request.provider_id).cloned();
         let record = request.into_record(existing.as_ref())?;
-        if let Some(credential) = credential {
-            state
-                .provider_credentials
-                .insert(record.provider_id.clone(), credential);
+        match credential {
+            ProviderCredentialChange::Keep => {}
+            ProviderCredentialChange::Set(credential) => {
+                state
+                    .provider_credentials
+                    .insert(record.provider_id.clone(), credential);
+            }
+            ProviderCredentialChange::Clear => {
+                state.provider_credentials.remove(&record.provider_id);
+            }
         }
         state
             .providers
@@ -93,47 +179,30 @@ impl EnvironmentProviderStore for InMemoryEnvironmentRegistryStore {
         Ok(record)
     }
 
-    async fn read_provider_credential(
+    async fn read_provider(
         &self,
         provider_id: &EnvironmentProviderId,
-    ) -> Result<SecretValue, EnvironmentRegistryError> {
+    ) -> Result<EnvironmentProviderRecord, EnvironmentRegistryError> {
         self.read_state()?
-            .provider_credentials
+            .providers
             .get(provider_id)
             .cloned()
             .ok_or_else(|| not_found("environment_provider", provider_id))
     }
 
-    async fn record_provider_controller(
-        &self,
-        request: RecordProviderController,
-    ) -> Result<EnvironmentProviderRecord, EnvironmentRegistryError> {
-        let mut state = self.write_state()?;
-        let record = state
-            .providers
-            .get_mut(&request.provider_id)
-            .ok_or_else(|| not_found("environment_provider", &request.provider_id))?;
-        if record.controller_endpoint == request.controller_endpoint {
-            record.controller_features = Some(request.features);
-            record.data_route_base = Some(request.data_route_base);
-        }
-        Ok(record.clone())
-    }
-
-    async fn read_provider(
+    async fn read_provider_credential(
         &self,
         provider_id: &EnvironmentProviderId,
-    ) -> Result<EnvironmentProviderRecord, EnvironmentRegistryError> {
-        self.read_state()?
-            .providers
-            .get(provider_id)
-            .cloned()
-            .ok_or_else(|| not_found("environment_provider", provider_id))
+    ) -> Result<Option<SecretValue>, EnvironmentRegistryError> {
+        let state = self.read_state()?;
+        if !state.providers.contains_key(provider_id) {
+            return Err(not_found("environment_provider", provider_id));
+        }
+        Ok(state.provider_credentials.get(provider_id).cloned())
     }
 
     async fn list_providers(
         &self,
-        _request: ListEnvironmentProviders,
     ) -> Result<Vec<EnvironmentProviderRecord>, EnvironmentRegistryError> {
         Ok(self.read_state()?.providers.values().cloned().collect())
     }
@@ -150,6 +219,11 @@ impl EnvironmentProviderStore for InMemoryEnvironmentRegistryStore {
         {
             return invalid("environment provider is referenced by a universe binding");
         }
+        if state.environments.values().any(|record| {
+            record.state != EnvironmentState::Closed && record.provider_id() == Some(provider_id)
+        }) {
+            return invalid("environment provider is referenced by a non-closed environment");
+        }
         let record = state
             .providers
             .remove(provider_id)
@@ -165,48 +239,12 @@ impl EnvironmentProviderBindingStore for InMemoryEnvironmentRegistryStore {
         &self,
         request: PutEnvironmentProviderBinding,
     ) -> Result<EnvironmentProviderBindingRecord, EnvironmentRegistryError> {
-        validate_nonnegative_i64(request.updated_at_ms, "updated_at_ms")?;
         let mut state = self.write_state()?;
         if !state.providers.contains_key(&request.provider_id) {
             return Err(not_found("environment_provider", &request.provider_id));
         }
-        if state.bindings.values().any(|binding| {
-            binding.universe_id == request.universe_id
-                && binding.provider_id == request.provider_id
-                && binding.binding_id != request.binding_id
-        }) {
-            return Err(EnvironmentRegistryError::AlreadyExists {
-                kind: "environment_provider_binding",
-                id: format!("{}/{}", request.universe_id, request.provider_id),
-            });
-        }
-        let key = (request.universe_id, request.binding_id.clone());
-        let existing = state.bindings.get(&key);
-        if existing.is_some_and(|record| record.provider_id != request.provider_id) {
-            return invalid("provider_id is immutable for an existing binding");
-        }
-        let actual = existing.map(|record| record.revision);
-        if request.expected_revision != actual {
-            return Err(EnvironmentRegistryError::RevisionConflict {
-                kind: "environment_provider_binding",
-                id: request.binding_id.to_string(),
-                expected: request.expected_revision,
-                actual,
-            });
-        }
-        let record = EnvironmentProviderBindingRecord {
-            universe_id: request.universe_id,
-            binding_id: request.binding_id,
-            provider_id: request.provider_id,
-            status: request.status,
-            revision: actual.unwrap_or(0) + 1,
-            metadata: request.metadata,
-            created_at_ms: existing
-                .map(|record| record.created_at_ms)
-                .unwrap_or(request.updated_at_ms),
-            updated_at_ms: request.updated_at_ms,
-        };
-        record.validate()?;
+        let key = (request.universe_id, request.provider_id.clone());
+        let record = request.into_record(state.bindings.get(&key))?;
         state.bindings.insert(key, record.clone());
         Ok(record)
     }
@@ -214,13 +252,13 @@ impl EnvironmentProviderBindingStore for InMemoryEnvironmentRegistryStore {
     async fn read_provider_binding(
         &self,
         universe_id: Uuid,
-        binding_id: &EnvironmentProviderBindingId,
+        provider_id: &EnvironmentProviderId,
     ) -> Result<EnvironmentProviderBindingRecord, EnvironmentRegistryError> {
         self.read_state()?
             .bindings
-            .get(&(universe_id, binding_id.clone()))
+            .get(&(universe_id, provider_id.clone()))
             .cloned()
-            .ok_or_else(|| not_found("environment_provider_binding", binding_id))
+            .ok_or_else(|| not_found("environment_provider_binding", provider_id))
     }
 
     async fn list_provider_bindings(
@@ -239,19 +277,21 @@ impl EnvironmentProviderBindingStore for InMemoryEnvironmentRegistryStore {
     async fn delete_provider_binding(
         &self,
         universe_id: Uuid,
-        binding_id: &EnvironmentProviderBindingId,
+        provider_id: &EnvironmentProviderId,
     ) -> Result<EnvironmentProviderBindingRecord, EnvironmentRegistryError> {
         let mut state = self.write_state()?;
-        if state.environments.values().any(|environment| {
-            environment.status != EnvironmentStatus::Closed
-                && environment.binding_id() == Some(binding_id)
-        }) {
+        if universe_id == self.universe_id
+            && state.environments.values().any(|record| {
+                record.state != EnvironmentState::Closed
+                    && record.provider_id() == Some(provider_id)
+            })
+        {
             return invalid("provider binding is referenced by a non-closed environment");
         }
         state
             .bindings
-            .remove(&(universe_id, binding_id.clone()))
-            .ok_or_else(|| not_found("environment_provider_binding", binding_id))
+            .remove(&(universe_id, provider_id.clone()))
+            .ok_or_else(|| not_found("environment_provider_binding", provider_id))
     }
 }
 
@@ -263,72 +303,25 @@ impl EnvironmentStore for InMemoryEnvironmentRegistryStore {
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
         validate_nonnegative_i64(request.created_at_ms, "created_at_ms")?;
         let mut state = self.write_state()?;
-        if let Some(environment_id) = state.requests.get(&request.request_id) {
-            return state
-                .environments
-                .get(environment_id)
-                .cloned()
-                .ok_or_else(|| not_found("environment", environment_id));
-        }
-        let binding = state
-            .bindings
-            .get(&(self.universe_id, request.binding_id.clone()))
-            .cloned()
-            .ok_or_else(|| not_found("environment_provider_binding", &request.binding_id))?;
-        if binding.status != EnvironmentProviderBindingStatus::Enabled {
-            return invalid("environment provider binding is disabled");
-        }
-        if state.environments.contains_key(&request.environment_id) {
-            return Err(EnvironmentRegistryError::AlreadyExists {
-                kind: "environment",
-                id: request.environment_id.to_string(),
-            });
-        }
-        let record = request.record(binding.provider_id)?;
-        state
-            .requests
-            .insert(request.request_id, request.environment_id.clone());
-        state
-            .environments
-            .insert(request.environment_id, record.clone());
-        Ok(record)
-    }
-
-    async fn adopt_environment(
-        &self,
-        request: AdoptEnvironment,
-    ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
-        validate_nonnegative_i64(request.created_at_ms, "created_at_ms")?;
-        let mut state = self.write_state()?;
-        if let Some(environment_id) = state.requests.get(&request.request_id) {
-            return state
-                .environments
-                .get(environment_id)
-                .cloned()
-                .ok_or_else(|| not_found("environment", environment_id));
+        if let Some(existing) = state.by_request_id(&request.request_id) {
+            return if request.matches(existing) {
+                Ok(existing.clone())
+            } else {
+                Err(EnvironmentRegistryError::AlreadyExists {
+                    kind: "environment_request",
+                    id: request.request_id.to_string(),
+                })
+            };
         }
         let binding = state
             .bindings
-            .get(&(self.universe_id, request.binding_id.clone()))
-            .cloned()
-            .ok_or_else(|| not_found("environment_provider_binding", &request.binding_id))?;
-        if binding.status != EnvironmentProviderBindingStatus::Enabled {
+            .get(&(self.universe_id, request.provider_id.clone()))
+            .ok_or_else(|| not_found("environment_provider_binding", &request.provider_id))?;
+        if !binding.enabled {
             return invalid("environment provider binding is disabled");
         }
-        if state.environments.contains_key(&request.environment_id) {
-            return Err(EnvironmentRegistryError::AlreadyExists {
-                kind: "environment",
-                id: request.environment_id.to_string(),
-            });
-        }
-        let record = request.record(binding.provider_id)?;
-        state
-            .requests
-            .insert(request.request_id, request.environment_id.clone());
-        state
-            .environments
-            .insert(request.environment_id, record.clone());
-        Ok(record)
+        let record = request.record()?;
+        state.insert_new(record)
     }
 
     async fn create_external_environment(
@@ -337,27 +330,18 @@ impl EnvironmentStore for InMemoryEnvironmentRegistryStore {
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
         validate_nonnegative_i64(request.created_at_ms, "created_at_ms")?;
         let mut state = self.write_state()?;
-        if let Some(environment_id) = state.requests.get(&request.request_id) {
-            return state
-                .environments
-                .get(environment_id)
-                .cloned()
-                .ok_or_else(|| not_found("environment", environment_id));
-        }
-        if state.environments.contains_key(&request.environment_id) {
-            return Err(EnvironmentRegistryError::AlreadyExists {
-                kind: "environment",
-                id: request.environment_id.to_string(),
-            });
+        if let Some(existing) = state.by_request_id(&request.request_id) {
+            return if request.matches(existing) {
+                Ok(existing.clone())
+            } else {
+                Err(EnvironmentRegistryError::AlreadyExists {
+                    kind: "environment_request",
+                    id: request.request_id.to_string(),
+                })
+            };
         }
         let record = request.record()?;
-        state
-            .requests
-            .insert(request.request_id, request.environment_id.clone());
-        state
-            .environments
-            .insert(request.environment_id, record.clone());
-        Ok(record)
+        state.insert_new(record)
     }
 
     async fn create_registered_environment(
@@ -365,40 +349,34 @@ impl EnvironmentStore for InMemoryEnvironmentRegistryStore {
         request: CreateRegisteredEnvironment,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
         validate_nonnegative_i64(request.created_at_ms, "created_at_ms")?;
-        let daemon_id = request.daemon_id()?;
-        let request_id = EnvironmentProvisionRequestId::for_daemon(&daemon_id);
+        validate_daemon_public_key(&request.daemon_public_key)?;
+        validate_secret_hash(&request.secret_hash)?;
         let mut state = self.write_state()?;
-        if let Some(environment_id) = state.requests.get(&request_id) {
-            return state
-                .environments
-                .get(environment_id)
-                .cloned()
-                .ok_or_else(|| not_found("environment", environment_id));
-        }
-        if state.environments.values().any(|record| {
-            matches!(&record.source, EnvironmentSource::Registered { daemon_public_key, .. }
-                if daemon_public_key == &request.daemon_public_key)
-        }) {
-            return Err(EnvironmentRegistryError::AlreadyExists {
-                kind: "daemon_identity",
-                id: daemon_id.to_string(),
-            });
+        if let Some(existing) = state.by_daemon_public_key(&request.daemon_public_key) {
+            return Ok(existing.clone());
         }
         let key = state
+            .registration_key(&request.registration_key_id)?
+            .clone();
+        key.check_admits(request.created_at_ms)?;
+        let live = state
             .registration_keys
             .get(&request.registration_key_id)
-            .map(|stored| stored.record.clone())
-            .ok_or_else(|| {
-                not_found("environment_registration_key", &request.registration_key_id)
-            })?;
-        key.check_admits(request.created_at_ms)?;
+            .is_some_and(|stored| {
+                stored.secrets.iter().any(|secret| {
+                    secret.retired_at_ms.is_none() && secret.secret_hash == request.secret_hash
+                })
+            });
+        if !live {
+            return Err(request.secret_retired());
+        }
         if let Some(limit) = key.max_active_environments {
             let active = state
                 .environments
                 .values()
                 .filter(|record| {
                     record.registration_key_id() == Some(&key.registration_key_id)
-                        && record.status != EnvironmentStatus::Closed
+                        && record.state != EnvironmentState::Closed
                 })
                 .count();
             if active >= limit as usize {
@@ -408,20 +386,19 @@ impl EnvironmentStore for InMemoryEnvironmentRegistryStore {
                 });
             }
         }
-        if state.environments.contains_key(&request.environment_id) {
-            return Err(EnvironmentRegistryError::AlreadyExists {
-                kind: "environment",
-                id: request.environment_id.to_string(),
-            });
-        }
         let record = request.record(&key)?;
-        state
-            .requests
-            .insert(request_id, request.environment_id.clone());
-        state
+        state.insert_new(record)
+    }
+
+    async fn read_environment(
+        &self,
+        environment_id: &EnvironmentId,
+    ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
+        self.read_state()?
             .environments
-            .insert(request.environment_id, record.clone());
-        Ok(record)
+            .get(environment_id)
+            .cloned()
+            .ok_or_else(|| not_found("environment", environment_id))
     }
 
     async fn read_environment_by_daemon_public_key(
@@ -430,124 +407,171 @@ impl EnvironmentStore for InMemoryEnvironmentRegistryStore {
     ) -> Result<Option<EnvironmentRecord>, EnvironmentRegistryError> {
         Ok(self
             .read_state()?
+            .by_daemon_public_key(daemon_public_key)
+            .cloned())
+    }
+
+    async fn list_environments(
+        &self,
+        request: ListEnvironments,
+    ) -> Result<EnvironmentPage, EnvironmentRegistryError> {
+        request.validate()?;
+        let state = self.read_state()?;
+        let mut matching = state
             .environments
             .values()
-            .find(|record| {
-                matches!(&record.source, EnvironmentSource::Registered { daemon_public_key: key, .. }
-                    if key == daemon_public_key)
+            .filter(|record| {
+                request
+                    .after
+                    .as_ref()
+                    .is_none_or(|after| &record.environment_id > after)
             })
-            .cloned())
+            .filter(|record| request.matches(record));
+        let environments: Vec<EnvironmentRecord> = matching
+            .by_ref()
+            .take(request.limit as usize)
+            .cloned()
+            .collect();
+        let next_after = if matching.next().is_some() {
+            environments
+                .last()
+                .map(|record| record.environment_id.clone())
+        } else {
+            None
+        };
+        Ok(EnvironmentPage {
+            environments,
+            next_after,
+        })
     }
 
-    async fn observe_registered_environment(
+    async fn update_environment(
         &self,
-        request: ObserveRegisteredEnvironment,
+        request: UpdateEnvironment,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
-        validate_nonnegative_i64(request.observed_at_ms, "observed_at_ms")?;
-        let mut state = self.write_state()?;
-        update_environment(&mut state, &request.environment_id, |record| {
-            apply_registered_observation(
-                record,
-                request.observation,
-                request.observed_at_ms,
-                request.metadata,
-            )
-        })
+        self.change(&request.environment_id, |record| request.apply(record))
+            .map(|(record, _)| record)
     }
 
-    async fn list_open_registered_environments(
+    async fn begin_close_environment(
         &self,
-    ) -> Result<Vec<EnvironmentRecord>, EnvironmentRegistryError> {
-        Ok(self
-            .read_state()?
-            .environments
-            .values()
-            .filter(|record| {
-                record.is_registered()
-                    && !matches!(
-                        record.status,
-                        EnvironmentStatus::Closing | EnvironmentStatus::Closed
-                    )
-            })
-            .cloned()
-            .collect())
+        request: BeginCloseEnvironment,
+    ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
+        self.change(&request.environment_id, |record| request.apply(record))
+            .map(|(record, _)| record)
     }
 
-    async fn read_environment(
+    async fn finish_close_environment(
         &self,
-        environment_id: &EnvironmentId,
+        request: FinishCloseEnvironment,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
-        self.read_state()?
-            .environments
-            .get(environment_id)
-            .cloned()
-            .ok_or_else(|| not_found("environment", environment_id))
+        self.change(&request.environment_id, |record| request.apply(record))
+            .map(|(record, _)| record)
     }
 
-    async fn read_environment_by_request_id(
+    async fn mark_registered_connected(
         &self,
-        request_id: &EnvironmentProvisionRequestId,
+        request: MarkRegisteredConnected,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
-        let state = self.read_state()?;
-        let environment_id = state
-            .requests
-            .get(request_id)
-            .ok_or_else(|| not_found("environment_request", request_id))?;
-        state
-            .environments
-            .get(environment_id)
-            .cloned()
-            .ok_or_else(|| not_found("environment", environment_id))
+        self.change(&request.environment_id, |record| request.apply(record))
+            .map(|(record, _)| record)
     }
 
-    async fn list_environments(
+    async fn mark_registered_disconnected(
         &self,
-        request: ListEnvironments,
-    ) -> Result<Vec<EnvironmentRecord>, EnvironmentRegistryError> {
-        Ok(self
-            .read_state()?
+        request: MarkRegisteredDisconnected,
+    ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
+        self.change(&request.environment_id, |record| request.apply(record))
+            .map(|(record, _)| record)
+    }
+
+    async fn stamp_registered_seen(
+        &self,
+        request: StampRegisteredSeen,
+    ) -> Result<bool, EnvironmentRegistryError> {
+        self.change(&request.environment_id, |record| request.apply(record))
+            .map(|(_, written)| written)
+    }
+
+    async fn sweep_registered_environments(
+        &self,
+        now_ms: i64,
+    ) -> Result<RegisteredSweep, EnvironmentRegistryError> {
+        let mut state = self.write_state()?;
+        let candidates: Vec<(EnvironmentId, EnvironmentRegistrationKeyRecord)> = state
             .environments
             .values()
-            .filter(|record| {
-                request
-                    .provider_id
-                    .as_ref()
-                    .is_none_or(|id| record.provider_id() == Some(id))
-            })
-            .filter(|record| {
-                request
-                    .binding_id
-                    .as_ref()
-                    .is_none_or(|id| record.binding_id() == Some(id))
-            })
-            .filter(|record| request.status.is_none_or(|status| status == record.status))
-            .filter(|record| {
-                request
-                    .registration_key_id
-                    .as_ref()
-                    .is_none_or(|id| record.registration_key_id() == Some(id))
-            })
-            .filter(|record| {
-                harness::storage::metadata_matches(&record.metadata, &request.metadata)
+            .filter(|record| record.state == EnvironmentState::Open)
+            .filter_map(|record| {
+                let key = state.registration_keys.get(record.registration_key_id()?)?;
+                Some((record.environment_id.clone(), key.record.clone()))
             })
-            .cloned()
-            .collect())
+            .collect();
+        let mut sweep = RegisteredSweep::default();
+        for (environment_id, key) in candidates {
+            let mut outcome = (false, None);
+            change_environment(&mut state, &environment_id, |record| {
+                outcome = sweep_registered_environment(record, &key, now_ms);
+                Ok(outcome.0 || outcome.1.is_some())
+            })?;
+            if outcome.0 {
+                sweep.disconnected.push(environment_id.clone());
+            }
+            if let Some(reason) = outcome.1 {
+                sweep.closed.push((environment_id, reason));
+            }
+        }
+        Ok(sweep)
+    }
+
+    async fn repair_registered_connections(
+        &self,
+        now_ms: i64,
+    ) -> Result<u64, EnvironmentRegistryError> {
+        validate_nonnegative_i64(now_ms, "now_ms")?;
+        let mut state = self.write_state()?;
+        let mut repaired = 0;
+        for record in state.environments.values_mut() {
+            let Some(source) = record.registered_mut() else {
+                continue;
+            };
+            if source.connected {
+                source.connected = false;
+                source.connection_changed_at_ms = now_ms;
+                record.touch(now_ms);
+                repaired += 1;
+            }
+        }
+        Ok(repaired)
     }
 
-    async fn list_environments_needing_reconcile(
+    async fn list_environment_work(
         &self,
-        scope: ReconcileScope,
+        now_ms: i64,
+        limit: u32,
     ) -> Result<Vec<EnvironmentRecord>, EnvironmentRegistryError> {
-        Ok(self
-            .read_state()?
+        let state = self.read_state()?;
+        let mut due: Vec<(i64, &EnvironmentRecord)> = state
             .environments
             .values()
-            .filter(|record| record.needs_reconcile(scope))
-            .cloned()
+            .filter_map(|record| {
+                let next = record.provisioned()?.next_attempt_at_ms?;
+                (next <= now_ms).then_some((next, record))
+            })
+            .collect();
+        due.sort_by(|(left_at, left), (right_at, right)| {
+            left_at
+                .cmp(right_at)
+                .then_with(|| left.environment_id.cmp(&right.environment_id))
+        });
+        Ok(due
+            .into_iter()
+            .take(limit as usize)
+            .map(|(_, record)| record.clone())
             .collect())
     }
 
-    async fn list_environments_with_idle_policy(
+    async fn list_open_provisioned_environments(
         &self,
     ) -> Result<Vec<EnvironmentRecord>, EnvironmentRegistryError> {
         Ok(self
@@ -555,182 +579,74 @@ impl EnvironmentStore for InMemoryEnvironmentRegistryStore {
             .environments
             .values()
             .filter(|record| {
-                record.status == EnvironmentStatus::Ready && record.idle_policy.is_some()
+                record.state == EnvironmentState::Open && record.provisioned().is_some()
             })
             .cloned()
             .collect())
     }
 
-    async fn observe_provisioned_environment(
-        &self,
-        request: ObserveProvisionedEnvironment,
-    ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
-        let mut state = self.write_state()?;
-        update_environment(&mut state, &request.environment_id, |record| {
-            request.apply(record)
-        })
-    }
-
-    async fn fail_environment_lifecycle(
+    async fn record_target_observation(
         &self,
-        request: FailEnvironmentLifecycle,
+        request: RecordTargetObservation,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
         let mut state = self.write_state()?;
-        update_environment(&mut state, &request.environment_id, |record| {
-            request.apply(record)
-        })
-    }
-
-    async fn record_environment_lifecycle_error(
-        &self,
-        request: RecordEnvironmentLifecycleError,
-    ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
-        let mut state = self.write_state()?;
-        update_environment(&mut state, &request.environment_id, |record| {
+        if let Some(target_id) = &request.provider_target_id
+            && let Some(provider_id) = state
+                .environments
+                .get(&request.environment_id)
+                .and_then(EnvironmentRecord::provider_id)
+            && state.environments.values().any(|other| {
+                other.environment_id != request.environment_id
+                    && other.state != EnvironmentState::Closed
+                    && other.provider_id() == Some(provider_id)
+                    && other
+                        .provisioned()
+                        .and_then(|source| source.provider_target_id.as_ref())
+                        == Some(target_id)
+            })
+        {
+            return Err(EnvironmentRegistryError::AlreadyExists {
+                kind: "provider_target",
+                id: target_id.to_string(),
+            });
+        }
+        change_environment(&mut state, &request.environment_id, |record| {
             request.apply(record)
         })
+        .map(|(record, _)| record)
     }
 
-    async fn begin_close_environment(
-        &self,
-        request: BeginCloseEnvironment,
-    ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
-        let mut state = self.write_state()?;
-        update_environment(&mut state, &request.environment_id, |record| {
-            if record.status != EnvironmentStatus::Closed {
-                record.status = EnvironmentStatus::Closing;
-                record.updated_at_ms = record.updated_at_ms.max(request.updated_at_ms);
-            }
-            Ok(())
-        })
-    }
-
-    async fn finish_close_environment(
+    async fn schedule_environment_attempt(
         &self,
-        request: FinishCloseEnvironment,
+        request: ScheduleEnvironmentAttempt,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
-        let mut state = self.write_state()?;
-        update_environment(&mut state, &request.environment_id, |record| {
-            record.status = EnvironmentStatus::Closed;
-            record.public_ingress_enabled = false;
-            record.public_endpoint = None;
-            record.incarnation.updated_at_ms =
-                record.incarnation.updated_at_ms.max(request.observed_at_ms);
-            record.updated_at_ms = record.updated_at_ms.max(request.observed_at_ms);
-            Ok(())
-        })
-    }
-
-    async fn set_environment_ingress(
-        &self,
-        request: SetEnvironmentIngress,
-    ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
-        validate_nonnegative_i64(request.updated_at_ms, "updated_at_ms")?;
-        let mut state = self.write_state()?;
-        update_environment(&mut state, &request.environment_id, |record| {
-            if !matches!(record.source, EnvironmentSource::Provisioned { .. }) {
-                return invalid("provider-managed ingress requires a provisioned environment");
-            }
-            if record.status.is_closing_or_closed() && request.enabled {
-                return invalid("cannot enable ingress for a closing environment");
-            }
-            record.public_ingress_enabled = request.enabled;
-            record.updated_at_ms = record.updated_at_ms.max(request.updated_at_ms);
-            Ok(())
-        })
+        self.change(&request.environment_id, |record| request.apply(record))
+            .map(|(record, _)| record)
     }
 
-    async fn record_environment_ingress(
+    async fn open_environment(
         &self,
-        request: RecordEnvironmentIngress,
+        request: OpenEnvironment,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
-        let mut state = self.write_state()?;
-        update_environment(&mut state, &request.environment_id, |record| {
-            request.apply(record)
-        })
+        self.change(&request.environment_id, |record| request.apply(record))
+            .map(|(record, _)| record)
     }
 
-    async fn set_environment_power(
+    async fn fail_environment(
         &self,
-        request: SetEnvironmentPower,
+        request: FailEnvironment,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
-        validate_nonnegative_i64(request.updated_at_ms, "updated_at_ms")?;
-        let mut state = self.write_state()?;
-        update_environment(&mut state, &request.environment_id, |record| {
-            check_power_mutable(record)?;
-            record.desired_power = request.desired_power;
-            record.updated_at_ms = record.updated_at_ms.max(request.updated_at_ms);
-            Ok(())
-        })
+        self.change(&request.environment_id, |record| request.apply(record))
+            .map(|(record, _)| record)
     }
 
-    async fn set_environment_idle_policy(
+    async fn end_provisioned_environment(
         &self,
-        request: SetEnvironmentIdlePolicy,
+        request: EndProvisionedEnvironment,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
-        validate_nonnegative_i64(request.updated_at_ms, "updated_at_ms")?;
-        if let Some(policy) = &request.idle_policy {
-            policy.validate()?;
-        }
-        let mut state = self.write_state()?;
-        update_environment(&mut state, &request.environment_id, |record| {
-            check_power_mutable(record)?;
-            record.idle_policy = request.idle_policy;
-            record.updated_at_ms = record.updated_at_ms.max(request.updated_at_ms);
-            Ok(())
-        })
-    }
-}
-
-/// Change one environment through `change` on a copy, validate the result,
-/// and store it only when it is valid: a refused change leaves the stored
-/// record untouched.
-fn update_environment(
-    state: &mut RegistryState,
-    environment_id: &EnvironmentId,
-    change: impl FnOnce(&mut EnvironmentRecord) -> Result<(), EnvironmentRegistryError>,
-) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
-    let stored = state
-        .environments
-        .get_mut(environment_id)
-        .ok_or_else(|| not_found("environment", environment_id))?;
-    let mut candidate = stored.clone();
-    change(&mut candidate)?;
-    candidate.validate()?;
-    *stored = candidate.clone();
-    Ok(candidate)
-}
-
-/// Apply a gateway connection observation to a registered environment.
-/// Closing and closed environments keep their state: a late heartbeat must
-/// not resurrect them.
-pub fn apply_registered_observation(
-    record: &mut EnvironmentRecord,
-    observation: RegisteredConnectionObservation,
-    observed_at_ms: i64,
-    metadata: std::collections::BTreeMap<String, String>,
-) -> Result<(), EnvironmentRegistryError> {
-    if !record.is_registered() {
-        return invalid("connection observations apply only to registered environments");
-    }
-    if record.status.is_closing_or_closed() {
-        return Ok(());
-    }
-    record.metadata.extend(metadata);
-    match observation {
-        RegisteredConnectionObservation::Connected => {
-            record.status = EnvironmentStatus::Ready;
-            record.last_seen_at_ms = Some(observed_at_ms);
-        }
-        RegisteredConnectionObservation::Heartbeat => {
-            record.last_seen_at_ms = Some(observed_at_ms);
-        }
-        RegisteredConnectionObservation::Disconnected => {
-            record.status = EnvironmentStatus::Offline;
-        }
+        self.change(&request.environment_id, |record| request.apply(record))
+            .map(|(record, _)| record)
     }
-    record.updated_at_ms = record.updated_at_ms.max(observed_at_ms);
-    Ok(())
 }
 
 #[async_trait]
@@ -740,14 +656,12 @@ impl EnvironmentRegistrationKeyStore for InMemoryEnvironmentRegistryStore {
         request: CreateEnvironmentRegistrationKey,
     ) -> Result<EnvironmentRegistrationKeyRecord, EnvironmentRegistryError> {
         request.record.validate()?;
+        validate_secret_hash(&request.secret_hash)?;
         let mut state = self.write_state()?;
         if state
             .registration_keys
             .contains_key(&request.record.registration_key_id)
-            || state
-                .registration_keys
-                .values()
-                .any(|stored| stored.secret_hash == request.secret_hash)
+            || secret_known(&state, &request.secret_hash)
         {
             return Err(EnvironmentRegistryError::AlreadyExists {
                 kind: "environment_registration_key",
@@ -757,8 +671,11 @@ impl EnvironmentRegistrationKeyStore for InMemoryEnvironmentRegistryStore {
         state.registration_keys.insert(
             request.record.registration_key_id.clone(),
             StoredRegistrationKey {
-                secret_hash: request.secret_hash,
                 record: request.record.clone(),
+                secrets: vec![StoredSecret {
+                    secret_hash: request.secret_hash,
+                    retired_at_ms: None,
+                }],
             },
         );
         Ok(request.record)
@@ -769,10 +686,8 @@ impl EnvironmentRegistrationKeyStore for InMemoryEnvironmentRegistryStore {
         registration_key_id: &EnvironmentRegistrationKeyId,
     ) -> Result<EnvironmentRegistrationKeyRecord, EnvironmentRegistryError> {
         self.read_state()?
-            .registration_keys
-            .get(registration_key_id)
-            .map(|stored| stored.record.clone())
-            .ok_or_else(|| not_found("environment_registration_key", registration_key_id))
+            .registration_key(registration_key_id)
+            .cloned()
     }
 
     async fn list_registration_keys(
@@ -786,6 +701,51 @@ impl EnvironmentRegistrationKeyStore for InMemoryEnvironmentRegistryStore {
             .collect())
     }
 
+    async fn update_registration_key(
+        &self,
+        request: UpdateEnvironmentRegistrationKey,
+    ) -> Result<EnvironmentRegistrationKeyRecord, EnvironmentRegistryError> {
+        let mut state = self.write_state()?;
+        let stored = state
+            .registration_keys
+            .get_mut(&request.registration_key_id)
+            .ok_or_else(|| {
+                not_found("environment_registration_key", &request.registration_key_id)
+            })?;
+        request.apply(&mut stored.record)?;
+        Ok(stored.record.clone())
+    }
+
+    async fn rotate_registration_key(
+        &self,
+        request: RotateEnvironmentRegistrationKey,
+    ) -> Result<EnvironmentRegistrationKeyRecord, EnvironmentRegistryError> {
+        let mut state = self.write_state()?;
+        if secret_known(&state, &request.secret_hash) {
+            return Err(EnvironmentRegistryError::AlreadyExists {
+                kind: "environment_registration_key_secret",
+                id: request.key_prefix.clone(),
+            });
+        }
+        let stored = state
+            .registration_keys
+            .get_mut(&request.registration_key_id)
+            .ok_or_else(|| {
+                not_found("environment_registration_key", &request.registration_key_id)
+            })?;
+        request.apply(&mut stored.record)?;
+        for secret in &mut stored.secrets {
+            if secret.retired_at_ms.is_none() {
+                secret.retired_at_ms = Some(request.rotated_at_ms);
+            }
+        }
+        stored.secrets.push(StoredSecret {
+            secret_hash: request.secret_hash,
+            retired_at_ms: None,
+        });
+        Ok(stored.record.clone())
+    }
+
     async fn revoke_registration_key(
         &self,
         request: RevokeEnvironmentRegistrationKey,
@@ -799,8 +759,9 @@ impl EnvironmentRegistrationKeyStore for InMemoryEnvironmentRegistryStore {
                 not_found("environment_registration_key", &request.registration_key_id)
             })?;
         if stored.record.revoked_at_ms.is_none() {
-            stored.record.revoked_at_ms =
-                Some(request.revoked_at_ms.max(stored.record.created_at_ms));
+            let revoked_at_ms = request.revoked_at_ms.max(stored.record.created_at_ms);
+            stored.record.revoked_at_ms = Some(revoked_at_ms);
+            stored.record.updated_at_ms = stored.record.updated_at_ms.max(revoked_at_ms);
         }
         Ok(stored.record.clone())
     }
@@ -813,7 +774,11 @@ impl EnvironmentRegistrationKeyStore for InMemoryEnvironmentRegistryStore {
             .read_state()?
             .registration_keys
             .values()
-            .find(|stored| stored.secret_hash == secret_hash)
+            .find(|stored| {
+                stored.secrets.iter().any(|secret| {
+                    secret.retired_at_ms.is_none() && secret.secret_hash == secret_hash
+                })
+            })
             .map(|stored| stored.record.clone()))
     }
 
@@ -822,12 +787,7 @@ impl EnvironmentRegistrationKeyStore for InMemoryEnvironmentRegistryStore {
         registration_key_id: &EnvironmentRegistrationKeyId,
     ) -> Result<RegistrationKeyUsage, EnvironmentRegistryError> {
         let state = self.read_state()?;
-        if !state.registration_keys.contains_key(registration_key_id) {
-            return Err(not_found(
-                "environment_registration_key",
-                registration_key_id,
-            ));
-        }
+        state.registration_key(registration_key_id)?;
         let mut usage = RegistrationKeyUsage::default();
         for record in state
             .environments
@@ -835,7 +795,7 @@ impl EnvironmentRegistrationKeyStore for InMemoryEnvironmentRegistryStore {
             .filter(|record| record.registration_key_id() == Some(registration_key_id))
         {
             usage.registered += 1;
-            if record.status != EnvironmentStatus::Closed {
+            if record.state != EnvironmentState::Closed {
                 usage.active += 1;
             }
             usage.last_registered_at_ms = Some(
@@ -848,21 +808,14 @@ impl EnvironmentRegistrationKeyStore for InMemoryEnvironmentRegistryStore {
     }
 }
 
-/// Power intent and idle policy exist only for provisioned environments that
-/// are not on their way out.
-pub(crate) fn check_power_mutable(
-    record: &EnvironmentRecord,
-) -> Result<(), EnvironmentRegistryError> {
-    if !matches!(record.source, EnvironmentSource::Provisioned { .. }) {
-        return invalid("only provisioned environments have power control");
-    }
-    if matches!(
-        record.status,
-        EnvironmentStatus::Closing | EnvironmentStatus::Closed | EnvironmentStatus::Failed
-    ) {
-        return invalid("cannot change power of a closing, closed, or failed environment");
-    }
-    Ok(())
+/// Secret hashes are unique across every key, retired ones included.
+fn secret_known(state: &RegistryState, secret_hash: &str) -> bool {
+    state.registration_keys.values().any(|stored| {
+        stored
+            .secrets
+            .iter()
+            .any(|secret| secret.secret_hash == secret_hash)
+    })
 }
 
 #[async_trait]
diff --git a/crates/environments/src/tests.rs b/crates/environments/src/tests.rs
index d89568621..2b89129a5 100644
--- a/crates/environments/src/tests.rs
+++ b/crates/environments/src/tests.rs
@@ -1,10 +1,15 @@
 use std::collections::BTreeMap;
 
-use environment_protocol::{ids::ProviderTargetId, metadata::MAX_METADATA_ENTRIES};
+use environment_protocol::{
+    ids::ProviderTargetId,
+    metadata::{DescriptiveText, MAX_METADATA_ENTRIES},
+};
 use uuid::Uuid;
 
 use super::*;
 
+const PROVIDER: &str = "incus-local";
+
 fn endpoint(value: &str) -> EnvironmentEndpoint {
     EnvironmentEndpoint::parse(value).expect("endpoint")
 }
@@ -15,347 +20,571 @@ fn target(value: &str) -> ProviderTargetId {
 
 fn provider() -> PutEnvironmentProvider {
     PutEnvironmentProvider {
-        provider_id: EnvironmentProviderId::new("incus-local"),
+        provider_id: EnvironmentProviderId::new(PROVIDER),
         display_name: Some("Local Incus".to_owned()),
         controller_endpoint: endpoint("ws://127.0.0.1:19090/control"),
-        metadata: BTreeMap::new(),
-        credential: Some(SecretValue::new("provider-secret")),
+        data_route_base: None,
+        credential: ProviderCredentialChange::Set(SecretValue::new("provider-secret")),
         updated_at_ms: 1_000,
     }
 }
 
-fn observe(
-    environment_id: &EnvironmentId,
-    target_id: Option<&str>,
-    status: EnvironmentStatus,
-    at: i64,
-) -> ObserveProvisionedEnvironment {
-    ObserveProvisionedEnvironment {
-        environment_id: environment_id.clone(),
-        provider_target_id: target_id.map(target),
-        status,
-        power_states: vec![PowerState::Running, PowerState::Paused],
-        daemon_build: None,
-        observed_at_ms: at,
-    }
-}
-
-fn binding(universe_id: Uuid, expected_revision: Option<u64>) -> PutEnvironmentProviderBinding {
+fn binding(universe_id: Uuid, enabled: bool, at: i64) -> PutEnvironmentProviderBinding {
     PutEnvironmentProviderBinding {
         universe_id,
-        binding_id: EnvironmentProviderBindingId::new("primary"),
-        provider_id: EnvironmentProviderId::new("incus-local"),
-        status: EnvironmentProviderBindingStatus::Enabled,
-        metadata: BTreeMap::new(),
-        expected_revision,
-        updated_at_ms: 1_000 + expected_revision.unwrap_or(0) as i64,
+        provider_id: EnvironmentProviderId::new(PROVIDER),
+        enabled,
+        updated_at_ms: at,
     }
 }
 
-fn create(request: &str, environment: &str, incarnation: &str, at: i64) -> CreateEnvironment {
+fn create(request: &str, environment: &str, at: i64) -> CreateEnvironment {
     CreateEnvironment {
         request_id: EnvironmentProvisionRequestId::new(request),
         environment_id: EnvironmentId::new(environment),
-        incarnation_id: EnvironmentIncarnationId::new(incarnation),
-        binding_id: EnvironmentProviderBindingId::new("primary"),
+        provider_id: EnvironmentProviderId::new(PROVIDER),
         template_id: EnvironmentTemplateId::new("rust-v1"),
+        idle: None,
         display_name: None,
         metadata: BTreeMap::new(),
+        created_at_ms: at,
+    }
+}
 
-        idle_policy: None,
+fn external(request: &str, environment: &str, at: i64) -> CreateExternalEnvironment {
+    CreateExternalEnvironment {
+        request_id: EnvironmentProvisionRequestId::new(request),
+        environment_id: EnvironmentId::new(environment),
+        endpoint: endpoint("ws://envd.example:9000"),
+        display_name: None,
+        metadata: BTreeMap::new(),
         created_at_ms: at,
     }
 }
 
+fn build(version: &str) -> DaemonBuild {
+    DaemonBuild {
+        version: Some(version.to_owned()),
+        git_sha: Some("aaaa".to_owned()),
+        protocol_version: 4,
+    }
+}
+
+fn observed(phase: TargetPhase, power: Option<PowerState>, at: i64) -> ObservedTarget {
+    ObservedTarget {
+        phase,
+        power,
+        message: None,
+        observed_at_ms: at,
+    }
+}
+
+fn observation(
+    environment_id: &EnvironmentId,
+    target_id: Option<&str>,
+    target: ObservedTarget,
+) -> RecordTargetObservation {
+    RecordTargetObservation {
+        environment_id: environment_id.clone(),
+        provider_target_id: target_id.map(self::target),
+        observed_at_ms: target.observed_at_ms,
+        observed: target,
+        public_endpoint: None,
+    }
+}
+
 async fn store() -> (Uuid, InMemoryEnvironmentRegistryStore) {
     let universe_id = Uuid::new_v4();
     let store = InMemoryEnvironmentRegistryStore::for_universe(universe_id);
     store.put_provider(provider()).await.expect("provider");
     store
-        .put_provider_binding(binding(universe_id, None))
+        .put_provider_binding(binding(universe_id, true, 1_000))
         .await
         .expect("binding");
     (universe_id, store)
 }
 
-#[tokio::test(flavor = "current_thread")]
-async fn binding_put_is_revisioned_and_unique_per_provider() {
-    let (universe_id, store) = store().await;
-    let first = store
-        .read_provider_binding(universe_id, &EnvironmentProviderBindingId::new("primary"))
+async fn open_provisioned(
+    store: &InMemoryEnvironmentRegistryStore,
+    environment: &str,
+) -> EnvironmentRecord {
+    let created = store
+        .create_environment(create(&format!("req-{environment}"), environment, 2_000))
+        .await
+        .expect("create");
+    store
+        .record_target_observation(observation(
+            &created.environment_id,
+            Some(&format!("target-{environment}")),
+            observed(TargetPhase::Active, Some(PowerState::Running), 2_100),
+        ))
+        .await
+        .expect("observe");
+    store
+        .open_environment(OpenEnvironment {
+            environment_id: created.environment_id,
+            daemon_build: build("0.5.0"),
+            at_ms: 2_200,
+        })
         .await
-        .expect("read");
-    assert_eq!(first.revision, 1);
+        .expect("open")
+}
+
+// --- providers and bindings --------------------------------------------------
 
-    let conflict = store
-        .put_provider_binding(binding(universe_id, None))
+#[tokio::test(flavor = "current_thread")]
+async fn provider_credentials_are_optional_and_follow_the_change() {
+    let store = InMemoryEnvironmentRegistryStore::new();
+    let provider_id = EnvironmentProviderId::new(PROVIDER);
+    let mut bare = provider();
+    bare.credential = ProviderCredentialChange::Keep;
+    let created = store
+        .put_provider(bare.clone())
         .await
-        .expect_err("stale write");
+        .expect("no credential");
+    assert!(!created.has_credential);
+    assert_eq!(
+        store
+            .read_provider_credential(&provider_id)
+            .await
+            .expect("read"),
+        None
+    );
+
+    let mut unprintable = provider();
+    unprintable.credential = ProviderCredentialChange::Set(SecretValue::new("two words"));
     assert!(matches!(
-        conflict,
-        EnvironmentRegistryError::RevisionConflict {
-            actual: Some(1),
-            ..
-        }
+        store.put_provider(unprintable).await,
+        Err(EnvironmentRegistryError::InvalidInput { .. })
     ));
 
-    let second = store
-        .put_provider_binding(binding(universe_id, Some(1)))
-        .await
-        .expect("replace");
-    assert_eq!(second.revision, 2);
+    let set = store.put_provider(provider()).await.expect("set");
+    assert!(set.has_credential);
+    assert_eq!(set.created_at_ms, 1_000);
+    bare.updated_at_ms = 2_000;
+    let kept = store.put_provider(bare).await.expect("keep");
+    assert!(kept.has_credential);
+    assert_eq!(
+        store
+            .read_provider_credential(&provider_id)
+            .await
+            .expect("read")
+            .expect("stored")
+            .expose(),
+        "provider-secret"
+    );
 
-    let mut duplicate = binding(universe_id, None);
-    duplicate.binding_id = EnvironmentProviderBindingId::new("secondary");
+    let mut clear = provider();
+    clear.credential = ProviderCredentialChange::Clear;
+    clear.updated_at_ms = 3_000;
+    let cleared = store.put_provider(clear).await.expect("clear");
+    assert!(!cleared.has_credential);
+    assert_eq!(
+        store
+            .read_provider_credential(&provider_id)
+            .await
+            .expect("read"),
+        None
+    );
     assert!(matches!(
-        store.put_provider_binding(duplicate).await,
-        Err(EnvironmentRegistryError::AlreadyExists { .. })
+        store
+            .read_provider_credential(&EnvironmentProviderId::new("missing"))
+            .await,
+        Err(EnvironmentRegistryError::NotFound { .. })
     ));
+    let debug = format!("{:?}", provider());
+    assert!(!debug.contains("provider-secret"));
+}
+
+#[test]
+fn data_route_base_is_configured_or_derived_and_never_downgrades() {
+    let derived = provider().into_record(None).expect("derived");
+    assert_eq!(
+        derived.effective_data_route_base().expect("base").as_str(),
+        "ws://127.0.0.1:19090/routes"
+    );
+
+    let mut configured = provider();
+    configured.data_route_base = Some(DataRouteBase::new("ws://relay.example:7000/data").unwrap());
+    let configured = configured.into_record(None).expect("configured");
+    assert_eq!(
+        configured
+            .effective_data_route_base()
+            .expect("base")
+            .as_str(),
+        "ws://relay.example:7000/data"
+    );
+
+    let mut downgrade = provider();
+    downgrade.controller_endpoint = endpoint("wss://incus.example.com/control");
+    downgrade.data_route_base = Some(DataRouteBase::new("ws://incus.example.com/routes").unwrap());
+    assert!(matches!(
+        downgrade.into_record(None),
+        Err(EnvironmentRegistryError::InvalidInput { .. })
+    ));
+
+    let mut unix = provider();
+    unix.controller_endpoint = endpoint("unix:///run/incus-provider.sock");
+    assert!(matches!(
+        unix.clone().into_record(None),
+        Err(EnvironmentRegistryError::InvalidInput { .. })
+    ));
+    unix.data_route_base = Some(DataRouteBase::new("ws://127.0.0.1:19091/routes").unwrap());
+    unix.into_record(None).expect("unix with a configured base");
 }
 
 #[tokio::test(flavor = "current_thread")]
-async fn provider_delete_requires_all_bindings_to_be_removed() {
+async fn bindings_are_one_per_provider_and_guard_deletes() {
     let (universe_id, store) = store().await;
-    let provider_id = EnvironmentProviderId::new("incus-local");
+    let provider_id = EnvironmentProviderId::new(PROVIDER);
+    let replaced = store
+        .put_provider_binding(binding(universe_id, false, 1_500))
+        .await
+        .expect("replace");
+    assert!(!replaced.enabled);
+    assert_eq!(replaced.created_at_ms, 1_000);
+    assert_eq!(
+        store
+            .list_provider_bindings(universe_id)
+            .await
+            .unwrap()
+            .len(),
+        1
+    );
+    assert!(matches!(
+        store
+            .put_provider_binding(PutEnvironmentProviderBinding {
+                provider_id: EnvironmentProviderId::new("missing"),
+                ..binding(universe_id, true, 1_600)
+            })
+            .await,
+        Err(EnvironmentRegistryError::NotFound { .. })
+    ));
+
+    // A disabled binding refuses creates; a missing one is not found.
+    assert!(matches!(
+        store
+            .create_environment(create("r-1", "env-1", 2_000))
+            .await,
+        Err(EnvironmentRegistryError::InvalidInput { .. })
+    ));
+    store
+        .put_provider_binding(binding(universe_id, true, 1_700))
+        .await
+        .expect("enable");
+    let environment = store
+        .create_environment(create("r-1", "env-1", 2_000))
+        .await
+        .expect("create");
+
+    // Live environments guard the binding and the provider.
+    assert!(matches!(
+        store
+            .delete_provider_binding(universe_id, &provider_id)
+            .await,
+        Err(EnvironmentRegistryError::InvalidInput { .. })
+    ));
     assert!(matches!(
         store.delete_provider(&provider_id).await,
         Err(EnvironmentRegistryError::InvalidInput { .. })
     ));
     store
-        .delete_provider_binding(universe_id, &EnvironmentProviderBindingId::new("primary"))
+        .begin_close_environment(BeginCloseEnvironment {
+            environment_id: environment.environment_id.clone(),
+            reason: EnvironmentCloseReason::Requested,
+            at_ms: 3_000,
+        })
+        .await
+        .expect("begin close");
+    store
+        .finish_close_environment(FinishCloseEnvironment {
+            environment_id: environment.environment_id,
+            at_ms: 3_100,
+        })
         .await
-        .expect("delete binding");
-    let deleted = store
-        .delete_provider(&provider_id)
+        .expect("close");
+    store
+        .delete_provider_binding(universe_id, &provider_id)
         .await
-        .expect("delete provider");
-    assert_eq!(deleted.provider_id, provider_id);
+        .expect("delete binding");
     assert!(matches!(
-        store.read_provider(&provider_id).await,
+        store
+            .create_environment(create("r-2", "env-2", 4_000))
+            .await,
         Err(EnvironmentRegistryError::NotFound { .. })
     ));
+    store
+        .delete_provider(&provider_id)
+        .await
+        .expect("delete provider");
 }
 
+// --- creates -----------------------------------------------------------------
+
 #[tokio::test(flavor = "current_thread")]
-async fn stable_request_id_returns_the_original_environment() {
+async fn request_ids_are_idempotent_only_for_identical_inputs() {
     let (_, store) = store().await;
     let first = store
-        .create_environment(create("request-1", "environment-1", "incarnation-1", 2_000))
+        .create_environment(create("request-1", "environment-1", 2_000))
         .await
         .expect("first");
+    assert_eq!(first.state, EnvironmentState::Provisioning);
+    let source = first.provisioned().expect("provisioned");
+    assert_eq!(source.next_attempt_at_ms, Some(2_000));
+    assert_eq!(source.attempts, 0);
+
+    // A retry with a fresh environment id and time converges.
     let retry = store
-        .create_environment(create(
-            "request-1",
-            "different-environment",
-            "different-incarnation",
-            3_000,
-        ))
+        .create_environment(create("request-1", "other-environment", 3_000))
         .await
         .expect("retry");
-    assert_eq!(retry.environment_id, first.environment_id);
-    assert_eq!(
-        retry.incarnation.incarnation_id,
-        first.incarnation.incarnation_id
-    );
+    assert_eq!(retry, first);
+
+    let mut changed = create("request-1", "other-environment", 3_000);
+    changed.idle = Some(IdlePolicy {
+        pause_after_ms: Some(60_000),
+        ..IdlePolicy::default()
+    });
+    assert!(matches!(
+        store.create_environment(changed).await,
+        Err(EnvironmentRegistryError::AlreadyExists { .. })
+    ));
+    // Another kind cannot claim the same request id.
+    assert!(matches!(
+        store
+            .create_external_environment(external("request-1", "ext", 3_000))
+            .await,
+        Err(EnvironmentRegistryError::AlreadyExists { .. })
+    ));
+    assert!(matches!(
+        store
+            .create_environment(create("request-2", "environment-1", 3_000))
+            .await,
+        Err(EnvironmentRegistryError::AlreadyExists { .. })
+    ));
+
+    let external_row = store
+        .create_external_environment(external("ext-1", "ext-env", 4_000))
+        .await
+        .expect("external");
+    assert_eq!(external_row.state, EnvironmentState::Open);
     assert_eq!(
         store
-            .list_environments(ListEnvironments::default())
+            .create_external_environment(external("ext-1", "ext-env-2", 5_000))
             .await
-            .expect("list")
-            .len(),
-        1
+            .expect("external retry"),
+        external_row
     );
 }
 
 #[tokio::test(flavor = "current_thread")]
-async fn adoption_creates_a_provisioned_environment_without_a_template() {
+async fn invalid_idle_overrides_are_refused() {
     let (_, store) = store().await;
-    let adopted = store
-        .adopt_environment(AdoptEnvironment {
-            request_id: EnvironmentProvisionRequestId::new("adopt-request-1"),
-            environment_id: EnvironmentId::new("environment-adopted"),
-            incarnation_id: EnvironmentIncarnationId::new("incarnation-adopted"),
-            binding_id: EnvironmentProviderBindingId::new("primary"),
-            source_target: "legacy/hand-built-vm".to_owned(),
-            display_name: Some("Hand-built VM".to_owned()),
-            metadata: BTreeMap::new(),
-            created_at_ms: 2_000,
-        })
-        .await
-        .expect("adopt");
-
-    assert_eq!(adopted.status, EnvironmentStatus::Provisioning);
+    let mut request = create("request-1", "environment-1", 2_000);
+    request.idle = Some(IdlePolicy {
+        pause_after_ms: Some(30),
+        stop_after_ms: Some(10),
+        ..IdlePolicy::default()
+    });
     assert!(matches!(
-        adopted.source,
-        EnvironmentSource::Provisioned { .. }
+        store.create_environment(request).await,
+        Err(EnvironmentRegistryError::InvalidInput { .. })
     ));
-    assert_eq!(adopted.incarnation.template_id, None);
-    assert_eq!(
-        adopted.incarnation.adoption_source_target.as_deref(),
-        Some("legacy/hand-built-vm")
-    );
-
-    let retry = store
-        .adopt_environment(AdoptEnvironment {
-            request_id: EnvironmentProvisionRequestId::new("adopt-request-1"),
-            environment_id: EnvironmentId::new("ignored-on-retry"),
-            incarnation_id: EnvironmentIncarnationId::new("ignored-on-retry"),
-            binding_id: EnvironmentProviderBindingId::new("primary"),
-            source_target: "legacy/another-vm".to_owned(),
-            display_name: None,
-            metadata: BTreeMap::new(),
-            created_at_ms: 3_000,
-        })
-        .await
-        .expect("idempotent retry");
-    assert_eq!(retry.environment_id, adopted.environment_id);
 }
 
 #[tokio::test(flavor = "current_thread")]
-async fn lightspeed_does_not_enforce_provider_quota() {
-    let (_, store) = store().await;
-    let first = store
-        .create_environment(create("request-1", "environment-1", "incarnation-1", 2_000))
-        .await
-        .expect("first");
-    store
-        .fail_environment_lifecycle(FailEnvironmentLifecycle {
-            environment_id: first.environment_id.clone(),
-            message: "provider failed".to_owned(),
-            daemon_build: None,
-            observed_at_ms: 3_000,
+async fn external_environment_persists_its_endpoint() {
+    let store = InMemoryEnvironmentRegistryStore::new();
+    let environment = store
+        .create_external_environment(CreateExternalEnvironment {
+            endpoint: endpoint("unix:///run/lightspeed/envd.sock"),
+            ..external("external-request", "external-environment", 1_000)
         })
         .await
-        .expect("fail");
-    store
-        .create_environment(create("request-2", "environment-2", "incarnation-2", 4_000))
-        .await
-        .expect("second intent");
+        .expect("create external environment");
+    let EnvironmentSource::External { endpoint } = &environment.source else {
+        panic!("external source")
+    };
+    assert_eq!(endpoint.as_str(), "unix:///run/lightspeed/envd.sock");
+    assert_eq!(
+        environment.display_status(),
+        EnvironmentDisplayStatus::Ready
+    );
+    assert_eq!(environment.use_gate(1_000), EnvironmentUse::Use);
 }
 
+// --- provisioned lifecycle ---------------------------------------------------
+
 #[tokio::test(flavor = "current_thread")]
-async fn provider_observation_populates_only_the_current_incarnation() {
+async fn provisioning_opens_after_the_handshake_and_records_the_build() {
     let (_, store) = store().await;
-    let environment = store
-        .create_environment(create("request-1", "environment-1", "incarnation-1", 2_000))
+    let created = store
+        .create_environment(create("request-1", "environment-1", 2_000))
         .await
         .expect("create");
-    let target_id = target("target-1");
-    let observed = store
-        .observe_provisioned_environment(observe(
-            &environment.environment_id,
-            Some("target-1"),
-            EnvironmentStatus::Ready,
-            3_000,
-        ))
+    let scheduled = store
+        .schedule_environment_attempt(ScheduleEnvironmentAttempt {
+            environment_id: created.environment_id.clone(),
+            expected_state: EnvironmentState::Provisioning,
+            next_attempt_at_ms: 4_000,
+            attempts: 1,
+            state_message: Some(format!("connect failed\u{7}{}", "x".repeat(2_000))),
+            at_ms: 2_000,
+        })
         .await
-        .expect("observe");
-    assert_eq!(observed.status, EnvironmentStatus::Ready);
-    assert_eq!(observed.incarnation.provider_target_id, Some(target_id));
+        .expect("schedule");
+    let message = scheduled.state_message.as_deref().expect("message");
+    assert!(message.len() <= STATE_MESSAGE_MAX_BYTES);
+    assert!(!message.contains('\u{7}'));
     assert_eq!(
-        observed.incarnation.power_states,
-        vec![PowerState::Running, PowerState::Paused]
+        scheduled.provisioned().unwrap().next_attempt_at_ms,
+        Some(4_000)
     );
+
+    let opened = open_provisioned(&store, "environment-2").await;
+    assert_eq!(opened.state, EnvironmentState::Open);
+    assert_eq!(opened.state_message, None);
+    assert_eq!(opened.state_changed_at_ms, 2_200);
+    assert_eq!(opened.daemon_build, Some(build("0.5.0")));
+    let source = opened.provisioned().unwrap();
+    assert_eq!(source.next_attempt_at_ms, None);
     assert_eq!(
-        observed.incarnation.template_id,
-        Some(EnvironmentTemplateId::new("rust-v1"))
+        source.provider_target_id,
+        Some(target("target-environment-2"))
     );
+
+    // Opening twice, or scheduling an open row, is skipped.
+    let again = store
+        .open_environment(OpenEnvironment {
+            environment_id: opened.environment_id.clone(),
+            daemon_build: build("9.9.9"),
+            at_ms: 3_000,
+        })
+        .await
+        .expect("skipped");
+    assert_eq!(again, opened);
+    let unscheduled = store
+        .schedule_environment_attempt(ScheduleEnvironmentAttempt {
+            environment_id: opened.environment_id.clone(),
+            expected_state: EnvironmentState::Provisioning,
+            next_attempt_at_ms: 5_000,
+            attempts: 2,
+            state_message: None,
+            at_ms: 3_000,
+        })
+        .await
+        .expect("skipped");
+    assert_eq!(unscheduled, opened);
 }
 
 #[tokio::test(flavor = "current_thread")]
-async fn public_ingress_intent_and_realized_endpoint_are_recorded_apart() {
+async fn work_lists_due_rows_earliest_first() {
     let (_, store) = store().await;
-    let environment = store
-        .create_environment(create("request-1", "environment-1", "incarnation-1", 2_000))
-        .await
-        .expect("create");
+    for (request, environment, at) in [("r-a", "env-a", 3_000), ("r-b", "env-b", 1_500)] {
+        store
+            .create_environment(create(request, environment, at))
+            .await
+            .expect("create");
+    }
     store
-        .observe_provisioned_environment(observe(
-            &environment.environment_id,
-            Some("target-1"),
-            EnvironmentStatus::Ready,
-            2_500,
-        ))
-        .await
-        .expect("observe");
-    let enabled = store
-        .set_environment_ingress(SetEnvironmentIngress {
-            environment_id: environment.environment_id.clone(),
-            enabled: true,
-            updated_at_ms: 3_000,
+        .schedule_environment_attempt(ScheduleEnvironmentAttempt {
+            environment_id: EnvironmentId::new("env-a"),
+            expected_state: EnvironmentState::Provisioning,
+            next_attempt_at_ms: 2_500,
+            attempts: 1,
+            state_message: None,
+            at_ms: 3_000,
         })
         .await
-        .expect("enable ingress");
-    assert!(enabled.public_ingress_enabled);
-    assert_eq!(enabled.public_endpoint, None);
-    // The intent is pending until the provider reports an endpoint.
-    assert!(enabled.ingress_diverges());
+        .expect("schedule");
+    let open = open_provisioned(&store, "env-open").await;
+
+    let due = store.list_environment_work(2_600, 10).await.expect("work");
+    let ids: Vec<&str> = due
+        .iter()
+        .map(|record| record.environment_id.as_str())
+        .collect();
+    assert_eq!(ids, ["env-b", "env-a"]);
     assert_eq!(
+        store.list_environment_work(2_600, 1).await.unwrap().len(),
+        1
+    );
+    assert!(
         store
-            .list_environments_needing_reconcile(ReconcileScope::Converging)
+            .list_environment_work(1_000, 10)
             .await
             .unwrap()
-            .len(),
-        1
+            .is_empty()
     );
-    let realized = store
-        .record_environment_ingress(RecordEnvironmentIngress {
-            environment_id: environment.environment_id.clone(),
-            public_endpoint: Some("https://opaque.env.example".to_owned()),
-            observed_at_ms: 3_500,
+
+    let open_rows = store.list_open_provisioned_environments().await.unwrap();
+    assert_eq!(open_rows.len(), 1);
+    assert_eq!(open_rows[0].environment_id, open.environment_id);
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn failing_applies_to_provisioning_and_open_rows_only() {
+    let (_, store) = store().await;
+    let created = store
+        .create_environment(create("request-1", "environment-1", 2_000))
+        .await
+        .expect("create");
+    let failed = store
+        .fail_environment(FailEnvironment {
+            environment_id: created.environment_id.clone(),
+            message: "protocol mismatch: local 4, remote 3".to_owned(),
+            daemon_build: Some(DaemonBuild {
+                version: None,
+                git_sha: None,
+                protocol_version: 3,
+            }),
+            at_ms: 3_000,
         })
         .await
-        .expect("record realized ingress");
+        .expect("fail");
+    assert_eq!(failed.state, EnvironmentState::Failed);
+    assert_eq!(failed.provisioned().unwrap().next_attempt_at_ms, None);
+    assert_eq!(failed.daemon_build.as_ref().unwrap().protocol_version, 3);
     assert_eq!(
-        realized.public_endpoint.as_deref(),
-        Some("https://opaque.env.example")
+        failed.use_gate(3_000),
+        EnvironmentUse::Gone {
+            reason: EnvironmentGoneReason::Failed,
+            message: Some("protocol mismatch: local 4, remote 3".to_owned()),
+        }
     );
-    assert!(!realized.ingress_diverges());
-    let disabled = store
-        .set_environment_ingress(SetEnvironmentIngress {
-            environment_id: environment.environment_id.clone(),
-            enabled: false,
-            updated_at_ms: 4_000,
+    // A failed row cannot fail again; it can close.
+    let again = store
+        .fail_environment(FailEnvironment {
+            environment_id: created.environment_id.clone(),
+            message: "other".to_owned(),
+            daemon_build: None,
+            at_ms: 3_500,
         })
         .await
-        .expect("disable ingress");
-    assert!(!disabled.public_ingress_enabled);
-    // The endpoint stays recorded until the provider removed it.
-    assert!(disabled.public_endpoint.is_some());
-    assert!(disabled.ingress_diverges());
-    let removed = store
-        .record_environment_ingress(RecordEnvironmentIngress {
-            environment_id: environment.environment_id,
-            public_endpoint: None,
-            observed_at_ms: 4_500,
+        .expect("skipped");
+    assert_eq!(again, failed);
+    let closing = store
+        .begin_close_environment(BeginCloseEnvironment {
+            environment_id: created.environment_id.clone(),
+            reason: EnvironmentCloseReason::Requested,
+            at_ms: 4_000,
         })
         .await
-        .expect("record removed ingress");
-    assert_eq!(removed.public_endpoint, None);
-    assert!(!removed.ingress_diverges());
-}
+        .expect("close failed row");
+    assert_eq!(closing.state, EnvironmentState::Closing);
+    assert_eq!(closing.state_message, None);
 
-#[tokio::test(flavor = "current_thread")]
-async fn external_environment_cannot_enable_provider_managed_ingress() {
-    let store = InMemoryEnvironmentRegistryStore::new();
-    let environment = store
-        .create_external_environment(CreateExternalEnvironment {
-            request_id: EnvironmentProvisionRequestId::new("external-request"),
-            environment_id: EnvironmentId::new("external-environment"),
-            incarnation_id: EnvironmentIncarnationId::new("external-incarnation"),
-            endpoint: endpoint("ws://envd.example"),
-            display_name: None,
-            metadata: BTreeMap::new(),
-            created_at_ms: 1_000,
-        })
+    let external_row = store
+        .create_external_environment(external("ext", "ext-env", 2_000))
         .await
         .expect("external");
     assert!(matches!(
         store
-            .set_environment_ingress(SetEnvironmentIngress {
-                environment_id: environment.environment_id,
-                enabled: true,
-                updated_at_ms: 2_000,
+            .fail_environment(FailEnvironment {
+                environment_id: external_row.environment_id,
+                message: "x".to_owned(),
+                daemon_build: None,
+                at_ms: 3_000,
             })
             .await,
         Err(EnvironmentRegistryError::InvalidInput { .. })
@@ -363,303 +592,632 @@ async fn external_environment_cannot_enable_provider_managed_ingress() {
 }
 
 #[tokio::test(flavor = "current_thread")]
-async fn external_environment_persists_its_endpoint() {
-    let store = InMemoryEnvironmentRegistryStore::new();
-    let environment = store
-        .create_external_environment(CreateExternalEnvironment {
-            request_id: EnvironmentProvisionRequestId::new("external-request"),
-            environment_id: EnvironmentId::new("external-environment"),
-            incarnation_id: EnvironmentIncarnationId::new("external-incarnation"),
-            endpoint: endpoint("unix:///run/lightspeed/envd.sock"),
-            display_name: None,
-            metadata: BTreeMap::new(),
-            created_at_ms: 1_000,
+async fn a_close_wins_over_work_that_was_in_flight() {
+    let (_, store) = store().await;
+    let created = store
+        .create_environment(create("request-1", "environment-1", 2_000))
+        .await
+        .expect("create");
+    let closing = store
+        .begin_close_environment(BeginCloseEnvironment {
+            environment_id: created.environment_id.clone(),
+            reason: EnvironmentCloseReason::Requested,
+            at_ms: 2_500,
         })
         .await
-        .expect("create external environment");
-    let EnvironmentSource::External { endpoint } = environment.source else {
-        panic!("external source")
-    };
-    assert_eq!(endpoint.as_str(), "unix:///run/lightspeed/envd.sock");
+        .expect("begin close");
+    assert_eq!(closing.state, EnvironmentState::Closing);
+    assert_eq!(
+        closing.close_reason,
+        Some(EnvironmentCloseReason::Requested)
+    );
+    assert_eq!(
+        closing.provisioned().unwrap().next_attempt_at_ms,
+        Some(2_500)
+    );
+
+    // The create that was in flight answers: the target id is recorded so
+    // the close can address it, but the row stays closing.
+    let observed = store
+        .record_target_observation(observation(
+            &created.environment_id,
+            Some("ls-3f2a"),
+            observed(TargetPhase::Active, Some(PowerState::Running), 3_000),
+        ))
+        .await
+        .expect("observe");
+    assert_eq!(observed.state, EnvironmentState::Closing);
+    assert_eq!(
+        observed.provisioned().unwrap().provider_target_id,
+        Some(target("ls-3f2a"))
+    );
+    for skipped in [
+        store
+            .open_environment(OpenEnvironment {
+                environment_id: created.environment_id.clone(),
+                daemon_build: build("0.5.0"),
+                at_ms: 3_100,
+            })
+            .await
+            .expect("open skipped"),
+        store
+            .fail_environment(FailEnvironment {
+                environment_id: created.environment_id.clone(),
+                message: "late".to_owned(),
+                daemon_build: None,
+                at_ms: 3_200,
+            })
+            .await
+            .expect("fail skipped"),
+        store
+            .begin_close_environment(BeginCloseEnvironment {
+                environment_id: created.environment_id.clone(),
+                reason: EnvironmentCloseReason::KeyRevoked,
+                at_ms: 3_300,
+            })
+            .await
+            .expect("close skipped"),
+    ] {
+        assert_eq!(skipped.state, EnvironmentState::Closing);
+        assert_eq!(
+            skipped.close_reason,
+            Some(EnvironmentCloseReason::Requested)
+        );
+    }
+
+    // The provision step that read the row while provisioning reschedules
+    // it: skipped, so the close keeps its own schedule and message.
+    let rescheduled = store
+        .schedule_environment_attempt(ScheduleEnvironmentAttempt {
+            environment_id: created.environment_id.clone(),
+            expected_state: EnvironmentState::Provisioning,
+            next_attempt_at_ms: 300_000,
+            attempts: 3,
+            state_message: Some("waiting for the provider".to_owned()),
+            at_ms: 3_400,
+        })
+        .await
+        .expect("schedule skipped");
+    assert_eq!(rescheduled.state, EnvironmentState::Closing);
+    assert_eq!(rescheduled.state_message, None);
+    let source = rescheduled.provisioned().unwrap();
+    assert_eq!(source.next_attempt_at_ms, Some(2_500));
+    assert_eq!(source.attempts, 0);
+    // The close step's own reschedule still applies.
+    let close_retry = store
+        .schedule_environment_attempt(ScheduleEnvironmentAttempt {
+            environment_id: created.environment_id.clone(),
+            expected_state: EnvironmentState::Closing,
+            next_attempt_at_ms: 3_600,
+            attempts: 1,
+            state_message: None,
+            at_ms: 3_500,
+        })
+        .await
+        .expect("schedule close retry");
+    assert_eq!(
+        close_retry.provisioned().unwrap().next_attempt_at_ms,
+        Some(3_600)
+    );
+
+    let closed = store
+        .finish_close_environment(FinishCloseEnvironment {
+            environment_id: created.environment_id.clone(),
+            at_ms: 4_000,
+        })
+        .await
+        .expect("finish");
+    assert_eq!(closed.state, EnvironmentState::Closed);
+    assert_eq!(closed.closed_at_ms, Some(4_000));
+    assert_eq!(closed.close_reason, Some(EnvironmentCloseReason::Requested));
+    assert_eq!(closed.provisioned().unwrap().next_attempt_at_ms, None);
+    let finished_again = store
+        .finish_close_environment(FinishCloseEnvironment {
+            environment_id: created.environment_id,
+            at_ms: 5_000,
+        })
+        .await
+        .expect("skipped");
+    assert_eq!(finished_again, closed);
 }
 
 #[tokio::test(flavor = "current_thread")]
-async fn disabled_binding_blocks_create_and_live_references_block_delete() {
-    let (universe_id, store) = store().await;
-    let environment = store
-        .create_environment(create("request-1", "environment-1", "incarnation-1", 2_000))
+async fn observations_keep_the_target_id_and_never_go_back_in_time() {
+    let (_, store) = store().await;
+    let created = store
+        .create_environment(create("request-1", "environment-1", 2_000))
         .await
         .expect("create");
-    let mut disabled = binding(universe_id, Some(1));
-    disabled.status = EnvironmentProviderBindingStatus::Disabled;
-    store.put_provider_binding(disabled).await.expect("disable");
+    let pending = store
+        .record_target_observation(observation(
+            &created.environment_id,
+            None,
+            observed(TargetPhase::Provisioning, None, 2_500),
+        ))
+        .await
+        .expect("no id yet");
+    assert_eq!(pending.provisioned().unwrap().provider_target_id, None);
+
+    // Natural provider ids are opaque: slashes and colons are fine.
+    let natural = "arn:aws:ec2:eu-west-1:123456789012:instance/i-0abc";
+    store
+        .record_target_observation(observation(
+            &created.environment_id,
+            Some(natural),
+            observed(TargetPhase::Active, Some(PowerState::Running), 3_000),
+        ))
+        .await
+        .expect("id assigned");
+    let stale = store
+        .record_target_observation(RecordTargetObservation {
+            public_endpoint: Some("https://stale.example".to_owned()),
+            ..observation(
+                &created.environment_id,
+                None,
+                observed(TargetPhase::Provisioning, None, 2_800),
+            )
+        })
+        .await
+        .expect("stale");
+    let source = stale.provisioned().unwrap();
+    assert_eq!(source.provider_target_id, Some(target(natural)));
+    assert_eq!(source.observed.as_ref().unwrap().phase, TargetPhase::Active);
+    assert_eq!(source.public_endpoint, None);
+    assert_eq!(stale.state, EnvironmentState::Provisioning);
+
     assert!(matches!(
         store
-            .create_environment(create("request-2", "environment-2", "incarnation-2", 3_000))
+            .record_target_observation(observation(
+                &created.environment_id,
+                Some("another-target"),
+                observed(TargetPhase::Active, None, 4_000),
+            ))
             .await,
         Err(EnvironmentRegistryError::InvalidInput { .. })
     ));
+    // Power without the active phase is not a valid observation.
     assert!(matches!(
         store
-            .delete_provider_binding(universe_id, &EnvironmentProviderBindingId::new("primary"))
+            .record_target_observation(observation(
+                &created.environment_id,
+                None,
+                observed(TargetPhase::Unknown, Some(PowerState::Paused), 4_000),
+            ))
             .await,
         Err(EnvironmentRegistryError::InvalidInput { .. })
     ));
-    store
-        .finish_close_environment(FinishCloseEnvironment {
-            environment_id: environment.environment_id,
-            observed_at_ms: 4_000,
-        })
-        .await
-        .expect("close");
-    store
-        .delete_provider_binding(universe_id, &EnvironmentProviderBindingId::new("primary"))
+    // Another live row of the provider cannot claim the same target.
+    let other = store
+        .create_environment(create("request-2", "environment-2", 2_000))
         .await
-        .expect("delete");
+        .expect("other");
+    assert!(matches!(
+        store
+            .record_target_observation(observation(
+                &other.environment_id,
+                Some(natural),
+                observed(TargetPhase::Active, None, 4_000),
+            ))
+            .await,
+        Err(EnvironmentRegistryError::AlreadyExists { .. })
+    ));
 }
 
 #[tokio::test(flavor = "current_thread")]
-async fn environment_metadata_filters_require_every_pair() {
-    let (_universe, store) = store().await;
-    // Metadata filters by containment: every listed pair must match.
-    let mut tagged = create("tagged", "env-tagged", "inc-tagged", 3);
-    tagged.metadata = BTreeMap::from([
-        ("source".to_owned(), "harbor".to_owned()),
-        ("job".to_owned(), "nightly".to_owned()),
-    ]);
-    store
-        .create_environment(tagged)
-        .await
-        .expect("create tagged");
-    let by_metadata = store
-        .list_environments(ListEnvironments {
-            metadata: BTreeMap::from([("job".to_owned(), "nightly".to_owned())]),
-            ..ListEnvironments::default()
+async fn the_provider_ending_a_target_closes_open_and_failed_rows() {
+    let (_, store) = store().await;
+    let open = open_provisioned(&store, "env-open").await;
+    let ended = store
+        .end_provisioned_environment(EndProvisionedEnvironment {
+            environment_id: open.environment_id.clone(),
+            at_ms: 5_000,
         })
         .await
-        .expect("list by metadata");
-    assert_eq!(by_metadata.len(), 1);
-    assert_eq!(by_metadata[0].environment_id.as_str(), "env-tagged");
-    let mismatched = store
-        .list_environments(ListEnvironments {
-            metadata: BTreeMap::from([
-                ("job".to_owned(), "nightly".to_owned()),
-                ("trial".to_owned(), "1".to_owned()),
-            ]),
-            ..ListEnvironments::default()
+        .expect("end");
+    assert_eq!(ended.state, EnvironmentState::Closed);
+    assert_eq!(
+        ended.close_reason,
+        Some(EnvironmentCloseReason::ProviderEnded)
+    );
+    assert_eq!(ended.closed_at_ms, Some(5_000));
+
+    let provisioning = store
+        .create_environment(create("r-p", "env-p", 2_000))
+        .await
+        .expect("create");
+    let skipped = store
+        .end_provisioned_environment(EndProvisionedEnvironment {
+            environment_id: provisioning.environment_id.clone(),
+            at_ms: 5_000,
         })
         .await
-        .expect("list by mismatched metadata");
-    assert!(mismatched.is_empty());
-}
-
-#[test]
-fn idle_policy_validates_monotone_stages_and_picks_the_supported_due_action() {
-    let policy = EnvironmentIdlePolicy {
-        pause_after_ms: Some(10),
-        suspend_after_ms: Some(20),
-        stop_after_ms: Some(30),
-        close_after_ms: Some(40),
-    };
-    policy.validate().expect("valid");
-    assert!(EnvironmentIdlePolicy::default().validate().is_err());
-    assert!(
-        EnvironmentIdlePolicy {
-            pause_after_ms: Some(0),
-            ..EnvironmentIdlePolicy::default()
-        }
-        .validate()
-        .is_err()
-    );
-    assert!(
-        EnvironmentIdlePolicy {
-            pause_after_ms: Some(30),
-            stop_after_ms: Some(10),
-            ..EnvironmentIdlePolicy::default()
-        }
-        .validate()
-        .is_err()
-    );
-    let incus = [PowerState::Running, PowerState::Paused, PowerState::Stopped];
-    assert_eq!(policy.due_action(5, &incus), None);
-    assert_eq!(policy.due_action(10, &incus), Some(IdleAction::Pause));
-    // Suspend is due but unsupported by this provider: pause stays the
-    // most escalated applicable stage.
-    assert_eq!(policy.due_action(25, &incus), Some(IdleAction::Pause));
-    assert_eq!(policy.due_action(30, &incus), Some(IdleAction::Stop));
-    assert_eq!(policy.due_action(40, &incus), Some(IdleAction::Close));
-    // Close never needs provider support.
-    assert_eq!(policy.due_action(40, &[]), Some(IdleAction::Close));
-    assert_eq!(policy.due_action(30, &[]), None);
+        .expect("skipped");
+    assert_eq!(skipped, provisioning);
 }
 
 #[tokio::test(flavor = "current_thread")]
-async fn power_intent_and_idle_policy_are_provisioned_only_and_drive_reconcile_lists() {
+async fn a_closed_environment_keeps_no_public_endpoint() {
     let (_, store) = store().await;
-    let environment = store
-        .create_environment(create("request-1", "environment-1", "incarnation-1", 2_000))
-        .await
-        .expect("create");
-    assert_eq!(environment.desired_power, PowerState::Running);
-    assert!(environment.idle_policy.is_none());
-
-    store
-        .observe_provisioned_environment(observe(
-            &environment.environment_id,
-            Some("target-1"),
-            EnvironmentStatus::Ready,
-            3_000,
+    let with_endpoint =
+        |environment_id: &EnvironmentId, target: ObservedTarget| RecordTargetObservation {
+            public_endpoint: Some("https://env.example.test".to_owned()),
+            ..observation(environment_id, None, target)
+        };
+
+    // The provider ending the target clears the endpoint.
+    let open = open_provisioned(&store, "env-ended").await;
+    let exposed = store
+        .record_target_observation(with_endpoint(
+            &open.environment_id,
+            observed(TargetPhase::Active, Some(PowerState::Running), 4_000),
         ))
         .await
         .expect("observe");
-    // Ready and converged: nothing to reconcile, but a steady pass still
-    // observes the target.
-    assert!(
-        store
-            .list_environments_needing_reconcile(ReconcileScope::Converging)
-            .await
-            .unwrap()
-            .is_empty()
-    );
     assert_eq!(
-        store
-            .list_environments_needing_reconcile(ReconcileScope::WithSteady)
-            .await
-            .unwrap()
-            .len(),
-        1
+        exposed.provisioned().unwrap().public_endpoint.as_deref(),
+        Some("https://env.example.test")
     );
-    let paused = store
-        .set_environment_power(SetEnvironmentPower {
-            environment_id: environment.environment_id.clone(),
-            desired_power: PowerState::Paused,
-            updated_at_ms: 4_000,
+    let ended = store
+        .end_provisioned_environment(EndProvisionedEnvironment {
+            environment_id: open.environment_id.clone(),
+            at_ms: 5_000,
         })
         .await
-        .expect("set power");
-    assert_eq!(paused.desired_power, PowerState::Paused);
-    assert!(paused.power_diverges());
-    let pending = store
-        .list_environments_needing_reconcile(ReconcileScope::Converging)
-        .await
-        .unwrap();
-    assert_eq!(pending.len(), 1);
-
-    // Observed paused: converged again.
-    store
-        .observe_provisioned_environment(observe(
-            &environment.environment_id,
-            Some("target-1"),
-            EnvironmentStatus::Paused,
-            5_000,
+        .expect("end");
+    assert_eq!(ended.provisioned().unwrap().public_endpoint, None);
+    // A late observation does not bring it back.
+    let late = store
+        .record_target_observation(with_endpoint(
+            &open.environment_id,
+            observed(TargetPhase::Closed, None, 6_000),
         ))
         .await
-        .expect("observe paused");
-    assert!(
-        store
-            .list_environments_needing_reconcile(ReconcileScope::Converging)
-            .await
-            .unwrap()
-            .is_empty()
-    );
+        .expect("late observation");
+    assert_eq!(late.state, EnvironmentState::Closed);
+    assert_eq!(late.provisioned().unwrap().public_endpoint, None);
 
-    // Idle policy only lists ready environments.
-    let policy = EnvironmentIdlePolicy {
-        pause_after_ms: Some(60_000),
-        ..EnvironmentIdlePolicy::default()
-    };
+    // So does finishing a requested close; closing keeps it until then.
+    let created = store
+        .create_environment(create("r-close", "env-close", 2_000))
+        .await
+        .expect("create");
     store
-        .set_environment_idle_policy(SetEnvironmentIdlePolicy {
-            environment_id: environment.environment_id.clone(),
-            idle_policy: Some(policy.clone()),
-            updated_at_ms: 6_000,
+        .record_target_observation(RecordTargetObservation {
+            provider_target_id: Some(target("ls-close")),
+            ..with_endpoint(
+                &created.environment_id,
+                observed(TargetPhase::Active, Some(PowerState::Running), 3_000),
+            )
         })
         .await
-        .expect("policy");
-    assert!(
-        store
-            .list_environments_with_idle_policy()
-            .await
-            .unwrap()
-            .is_empty()
+        .expect("observe");
+    let closing = store
+        .begin_close_environment(BeginCloseEnvironment {
+            environment_id: created.environment_id.clone(),
+            reason: EnvironmentCloseReason::Requested,
+            at_ms: 3_500,
+        })
+        .await
+        .expect("begin close");
+    assert!(closing.provisioned().unwrap().public_endpoint.is_some());
+    let closed = store
+        .finish_close_environment(FinishCloseEnvironment {
+            environment_id: created.environment_id,
+            at_ms: 4_000,
+        })
+        .await
+        .expect("finish");
+    assert_eq!(closed.provisioned().unwrap().public_endpoint, None);
+}
+
+// --- display status and the use gate ----------------------------------------
+
+#[test]
+fn display_status_refines_open_rows_by_observation() {
+    let mut record = create("r", "e", 1_000).record().expect("record");
+    assert_eq!(
+        record.display_status(),
+        EnvironmentDisplayStatus::Provisioning
+    );
+    record.state = EnvironmentState::Open;
+    if let EnvironmentSource::Provisioned(source) = &mut record.source {
+        source.next_attempt_at_ms = None;
+    }
+    assert_eq!(record.display_status(), EnvironmentDisplayStatus::Ready);
+    for (phase, power, status) in [
+        (TargetPhase::Active, None, EnvironmentDisplayStatus::Ready),
+        (
+            TargetPhase::Active,
+            Some(PowerState::Running),
+            EnvironmentDisplayStatus::Ready,
+        ),
+        (
+            TargetPhase::Active,
+            Some(PowerState::Paused),
+            EnvironmentDisplayStatus::Paused,
+        ),
+        (
+            TargetPhase::Active,
+            Some(PowerState::Suspended),
+            EnvironmentDisplayStatus::Suspended,
+        ),
+        (
+            TargetPhase::Active,
+            Some(PowerState::Stopped),
+            EnvironmentDisplayStatus::Stopped,
+        ),
+        (
+            TargetPhase::Provisioning,
+            None,
+            EnvironmentDisplayStatus::Provisioning,
+        ),
+        (
+            TargetPhase::Closing,
+            None,
+            EnvironmentDisplayStatus::Closing,
+        ),
+        (
+            TargetPhase::Unknown,
+            None,
+            EnvironmentDisplayStatus::Unknown,
+        ),
+        (TargetPhase::Failed, None, EnvironmentDisplayStatus::Unknown),
+        (TargetPhase::Closed, None, EnvironmentDisplayStatus::Unknown),
+    ] {
+        if let EnvironmentSource::Provisioned(source) = &mut record.source {
+            source.observed = Some(observed(phase, power, 1_500));
+        }
+        record.validate().expect("valid");
+        assert_eq!(record.display_status(), status, "{phase:?} {power:?}");
+        // An observation never blocks use: the dial decides.
+        assert_eq!(record.use_gate(2_000), EnvironmentUse::Use);
+    }
+    for (state, status) in [
+        (EnvironmentState::Closing, EnvironmentDisplayStatus::Closing),
+        (EnvironmentState::Closed, EnvironmentDisplayStatus::Closed),
+        (EnvironmentState::Failed, EnvironmentDisplayStatus::Failed),
+    ] {
+        record.state = state;
+        assert_eq!(record.display_status(), status);
+    }
+}
+
+#[test]
+fn the_use_gate_covers_every_state() {
+    let provisioning = create("r", "e", 1_000).record().expect("record");
+    assert_eq!(
+        provisioning.use_gate(1_000),
+        EnvironmentUse::Wait {
+            reason: EnvironmentWaitReason::Provisioning,
+            retry_after_ms: WAIT_RETRY_AFTER_MS,
+            until_ms: None,
+        }
+    );
+    for (state, reason, message) in [
+        (
+            EnvironmentState::Closing,
+            EnvironmentGoneReason::Closing,
+            None,
+        ),
+        (
+            EnvironmentState::Closed,
+            EnvironmentGoneReason::Closed,
+            None,
+        ),
+        (
+            EnvironmentState::Failed,
+            EnvironmentGoneReason::Failed,
+            Some("broken".to_owned()),
+        ),
+    ] {
+        let record = EnvironmentRecord {
+            state,
+            state_message: message.clone(),
+            ..provisioning.clone()
+        };
+        assert_eq!(
+            record.use_gate(1_000),
+            EnvironmentUse::Gone { reason, message }
+        );
+    }
+}
+
+fn registered_record(mode: RegisteredIdentityMode, connected: bool) -> EnvironmentRecord {
+    let key = mint_registration_key(
+        EnvironmentRegistrationKeyId::new("rk"),
+        registration_policy(mode),
+        1_000,
+    )
+    .expect("mint")
+    .record;
+    let mut record = register("rk", "env", &daemon_key(0x51), 1_000)
+        .record(&key)
+        .expect("record");
+    if let EnvironmentSource::Registered(source) = &mut record.source {
+        source.connected = connected;
+        source.connection_changed_at_ms = 10_000;
+    }
+    record
+}
+
+#[test]
+fn a_disconnected_registered_daemon_is_waited_for_by_identity_mode() {
+    let connected = registered_record(RegisteredIdentityMode::Persistent, true);
+    assert_eq!(connected.use_gate(10_000), EnvironmentUse::Use);
+    assert_eq!(connected.display_status(), EnvironmentDisplayStatus::Ready);
+
+    let persistent = registered_record(RegisteredIdentityMode::Persistent, false);
+    assert_eq!(persistent.display_status(), EnvironmentDisplayStatus::Away);
+    let until = 10_000 + REGISTERED_RECONNECT_WAIT_MS;
+    assert_eq!(
+        persistent.use_gate(until - 1),
+        EnvironmentUse::Wait {
+            reason: EnvironmentWaitReason::Disconnected,
+            retry_after_ms: WAIT_RETRY_AFTER_MS,
+            until_ms: Some(until),
+        }
+    );
+    assert_eq!(
+        persistent.use_gate(until + 12_500),
+        EnvironmentUse::Gone {
+            reason: EnvironmentGoneReason::Away,
+            message: Some("daemon away for 2m12s".to_owned()),
+        }
     );
-    store
-        .observe_provisioned_environment(observe(
-            &environment.environment_id,
-            Some("target-1"),
-            EnvironmentStatus::Ready,
-            7_000,
-        ))
-        .await
-        .expect("observe ready");
-    let candidates = store.list_environments_with_idle_policy().await.unwrap();
-    assert_eq!(candidates.len(), 1);
-    assert_eq!(candidates[0].idle_policy, Some(policy));
 
-    // External environments have no power control.
-    let external = store
-        .create_external_environment(CreateExternalEnvironment {
-            request_id: EnvironmentProvisionRequestId::new("external-1"),
-            environment_id: EnvironmentId::new("external-env"),
-            incarnation_id: EnvironmentIncarnationId::new("external-inc"),
-            endpoint: endpoint("ws://envd.test:9000"),
-            display_name: None,
-            metadata: BTreeMap::new(),
-            created_at_ms: 8_000,
-        })
-        .await
-        .expect("external");
+    let ephemeral = registered_record(RegisteredIdentityMode::Ephemeral, false);
     assert!(matches!(
-        store
-            .set_environment_power(SetEnvironmentPower {
-                environment_id: external.environment_id.clone(),
-                desired_power: PowerState::Paused,
-                updated_at_ms: 9_000,
-            })
-            .await,
-        Err(EnvironmentRegistryError::InvalidInput { .. })
+        ephemeral.use_gate(10_001),
+        EnvironmentUse::Gone {
+            reason: EnvironmentGoneReason::Away,
+            ..
+        }
     ));
+}
 
-    // Closing environments cannot change power.
-    store
-        .begin_close_environment(BeginCloseEnvironment {
-            environment_id: environment.environment_id.clone(),
-            updated_at_ms: 10_000,
-        })
-        .await
-        .expect("close");
-    assert!(matches!(
-        store
-            .set_environment_power(SetEnvironmentPower {
-                environment_id: environment.environment_id.clone(),
-                desired_power: PowerState::Running,
-                updated_at_ms: 11_000,
-            })
-            .await,
-        Err(EnvironmentRegistryError::InvalidInput { .. })
-    ));
+#[test]
+fn away_spans_read_as_compact_durations() {
+    for (ms, expected) in [
+        (-5, "0s"),
+        (999, "0s"),
+        (45_000, "45s"),
+        (120_000, "2m"),
+        (192_000, "3m12s"),
+        (3_600_000, "1h"),
+        (3_900_000, "1h5m"),
+    ] {
+        assert_eq!(compact_duration(ms), expected);
+    }
+}
+
+#[test]
+fn route_refusals_map_to_wait_or_gone() {
+    let failed = DataRouteRefusal::Failed {
+        message: DescriptiveText::new("disk full").unwrap(),
+    };
+    for (refusal, expected) in [
+        (
+            DataRouteRefusal::Waking {},
+            EnvironmentUse::Wait {
+                reason: EnvironmentWaitReason::Waking,
+                retry_after_ms: 5_000,
+                until_ms: None,
+            },
+        ),
+        (
+            DataRouteRefusal::Booting {},
+            EnvironmentUse::Wait {
+                reason: EnvironmentWaitReason::Booting,
+                retry_after_ms: 5_000,
+                until_ms: None,
+            },
+        ),
+        (
+            DataRouteRefusal::Provisioning {},
+            EnvironmentUse::Wait {
+                reason: EnvironmentWaitReason::Provisioning,
+                retry_after_ms: 5_000,
+                until_ms: None,
+            },
+        ),
+        (
+            DataRouteRefusal::Disconnected {},
+            EnvironmentUse::Wait {
+                reason: EnvironmentWaitReason::Disconnected,
+                retry_after_ms: 5_000,
+                until_ms: None,
+            },
+        ),
+        (
+            DataRouteRefusal::Away {},
+            EnvironmentUse::Gone {
+                reason: EnvironmentGoneReason::Away,
+                message: None,
+            },
+        ),
+        (
+            DataRouteRefusal::Gone {},
+            EnvironmentUse::Gone {
+                reason: EnvironmentGoneReason::Closed,
+                message: None,
+            },
+        ),
+        (
+            failed,
+            EnvironmentUse::Gone {
+                reason: EnvironmentGoneReason::Failed,
+                message: Some("disk full".to_owned()),
+            },
+        ),
+    ] {
+        assert_eq!(
+            EnvironmentUse::from_route_refusal(&refusal, Some(5_000)),
+            expected
+        );
+    }
+    assert_eq!(
+        EnvironmentUse::from_route_refusal(&DataRouteRefusal::Waking {}, None),
+        EnvironmentUse::Wait {
+            reason: EnvironmentWaitReason::Waking,
+            retry_after_ms: WAIT_RETRY_AFTER_MS,
+            until_ms: None,
+        }
+    );
+
+    // A registered row that reads connected but has no control handle.
+    let ephemeral = registered_record(RegisteredIdentityMode::Ephemeral, true);
+    assert_eq!(
+        ephemeral.bound_route_refusal(&DataRouteRefusal::Disconnected {}, None),
+        EnvironmentUse::Gone {
+            reason: EnvironmentGoneReason::Away,
+            message: Some("daemon is not connected".to_owned()),
+        }
+    );
+    let persistent = registered_record(RegisteredIdentityMode::Persistent, true);
+    assert_eq!(
+        persistent.bound_route_refusal(&DataRouteRefusal::Disconnected {}, Some(1_000)),
+        EnvironmentUse::Wait {
+            reason: EnvironmentWaitReason::Disconnected,
+            retry_after_ms: 1_000,
+            until_ms: None,
+        }
+    );
+    assert_eq!(
+        ephemeral.bound_route_refusal(&DataRouteRefusal::Booting {}, None),
+        EnvironmentUse::from_route_refusal(&DataRouteRefusal::Booting {}, None)
+    );
 }
 
+// --- registration keys -------------------------------------------------------
+
 fn registration_policy(mode: RegisteredIdentityMode) -> RegistrationKeyPolicy {
     RegistrationKeyPolicy {
-        display_name: "harbor campaign".to_owned(),
+        display_name: "fleet".to_owned(),
         identity_mode: mode,
         max_active_environments: None,
         ephemeral_disconnect_grace_ms: None,
+        offline_close_after_ms: None,
         expires_at_ms: None,
     }
 }
 
+/// The secret hash [`minted_key`] stores for key `id`, so [`register`] can
+/// present it.
+fn key_secret_hash(id: &str) -> String {
+    registration_key_hash(&format!("{REGISTRATION_KEY_SECRET_PREFIX}test-{id}"))
+}
+
 async fn minted_key(
     store: &InMemoryEnvironmentRegistryStore,
     id: &str,
     policy: RegistrationKeyPolicy,
 ) -> MintedRegistrationKey {
-    let minted =
+    let mut minted =
         mint_registration_key(EnvironmentRegistrationKeyId::new(id), policy, 1_000).expect("mint");
+    minted.secret.secret_hash = key_secret_hash(id);
     store
         .create_registration_key(CreateEnvironmentRegistrationKey {
-            secret_hash: minted.secret_hash.clone(),
+            secret_hash: minted.secret.secret_hash.clone(),
             record: minted.record.clone(),
         })
         .await
@@ -679,30 +1237,32 @@ fn register(
 ) -> CreateRegisteredEnvironment {
     CreateRegisteredEnvironment {
         registration_key_id: EnvironmentRegistrationKeyId::new(key),
+        secret_hash: key_secret_hash(key),
         environment_id: EnvironmentId::new(environment),
-        incarnation_id: EnvironmentIncarnationId::new(format!("{environment}-inc")),
         daemon_public_key: public_key.to_owned(),
         display_name: Some("worker".to_owned()),
         metadata: BTreeMap::new(),
+        daemon_build: build("0.1.0"),
         created_at_ms: at,
     }
 }
 
 #[test]
-fn daemon_id_and_request_id_derive_from_the_public_key() {
+fn daemon_ids_derive_from_the_public_key() {
     let public_key = [7u8; 32];
     let daemon_id = EnvironmentDaemonId::from_public_key(&public_key);
     assert!(daemon_id.as_str().starts_with(DAEMON_ID_PREFIX));
     assert_eq!(daemon_id.as_str().len(), DAEMON_ID_PREFIX.len() + 64);
     assert_eq!(daemon_id, EnvironmentDaemonId::from_public_key(&public_key));
     assert_ne!(daemon_id, EnvironmentDaemonId::from_public_key(&[8u8; 32]));
-    let request_id = EnvironmentProvisionRequestId::for_daemon(&daemon_id);
-    assert_eq!(
-        request_id.as_str(),
-        format!("{DAEMON_PROVISION_REQUEST_PREFIX}{}", daemon_id.as_str())
-    );
     assert!(validate_daemon_public_key(&daemon_key(0xab)).is_ok());
     assert!(validate_daemon_public_key("ABCD").is_err());
+
+    let record = registered_record(RegisteredIdentityMode::Persistent, true);
+    assert_eq!(
+        record.registered().unwrap().daemon_id(),
+        EnvironmentDaemonId::from_public_key(&[0x51u8; 32])
+    );
 }
 
 #[test]
@@ -713,14 +1273,16 @@ fn minted_registration_keys_return_the_secret_once_and_redact_debug() {
         5,
     )
     .expect("mint");
-    let secret = minted.secret.expose().to_owned();
+    let secret = minted.secret.secret.expose().to_owned();
     assert!(secret.starts_with(REGISTRATION_KEY_SECRET_PREFIX));
-    assert_eq!(minted.secret_hash, registration_key_hash(&secret));
+    assert_eq!(minted.secret.secret_hash, registration_key_hash(&secret));
+    assert_eq!(minted.record.key_prefix, minted.secret.key_prefix);
     assert_eq!(
         minted.record.key_prefix.len(),
         REGISTRATION_KEY_DISPLAY_PREFIX_LEN
     );
     assert!(secret.starts_with(&minted.record.key_prefix));
+    assert_eq!(minted.record.updated_at_ms, 5);
     let debug = format!("{minted:?}");
     assert!(!debug.contains(&secret[REGISTRATION_KEY_DISPLAY_PREFIX_LEN..]));
     assert!(
@@ -736,24 +1298,220 @@ fn minted_registration_keys_return_the_secret_once_and_redact_debug() {
     );
 }
 
+#[test]
+fn offline_close_applies_only_to_persistent_keys() {
+    let policy = |mode, offline| RegistrationKeyPolicy {
+        offline_close_after_ms: offline,
+        ..registration_policy(mode)
+    };
+    let id = || EnvironmentRegistrationKeyId::new("rk");
+    mint_registration_key(
+        id(),
+        policy(RegisteredIdentityMode::Persistent, Some(60_000)),
+        1,
+    )
+    .expect("persistent");
+    for refused in [
+        policy(RegisteredIdentityMode::Ephemeral, Some(60_000)),
+        policy(RegisteredIdentityMode::Persistent, Some(0)),
+    ] {
+        assert!(matches!(
+            mint_registration_key(id(), refused, 1),
+            Err(EnvironmentRegistryError::InvalidInput { .. })
+        ));
+    }
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn key_settings_replace_the_editable_policy() {
+    let (_, store) = store().await;
+    minted_key(
+        &store,
+        "rk",
+        RegistrationKeyPolicy {
+            max_active_environments: Some(3),
+            ..registration_policy(RegisteredIdentityMode::Persistent)
+        },
+    )
+    .await;
+    let settings = RegistrationKeySettings {
+        display_name: "renamed fleet".to_owned(),
+        max_active_environments: None,
+        ephemeral_disconnect_grace_ms: None,
+        offline_close_after_ms: Some(3_600_000),
+        expires_at_ms: Some(99_000),
+    };
+    let updated = store
+        .update_registration_key(UpdateEnvironmentRegistrationKey {
+            registration_key_id: EnvironmentRegistrationKeyId::new("rk"),
+            settings: settings.clone(),
+            updated_at_ms: 2_000,
+        })
+        .await
+        .expect("update");
+    assert_eq!(updated.display_name, "renamed fleet");
+    assert_eq!(updated.max_active_environments, None);
+    assert_eq!(updated.offline_close_after_ms, Some(3_600_000));
+    assert_eq!(updated.identity_mode, RegisteredIdentityMode::Persistent);
+    assert_eq!(updated.updated_at_ms, 2_000);
+
+    let refused = store
+        .update_registration_key(UpdateEnvironmentRegistrationKey {
+            registration_key_id: EnvironmentRegistrationKeyId::new("rk"),
+            settings: RegistrationKeySettings {
+                display_name: String::new(),
+                ..settings
+            },
+            updated_at_ms: 3_000,
+        })
+        .await;
+    assert!(matches!(
+        refused,
+        Err(EnvironmentRegistryError::InvalidInput { .. })
+    ));
+    assert_eq!(
+        store
+            .read_registration_key(&EnvironmentRegistrationKeyId::new("rk"))
+            .await
+            .unwrap(),
+        updated
+    );
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn rotation_retires_the_live_secret_and_keeps_the_group() {
+    let (_, store) = store().await;
+    let minted = minted_key(
+        &store,
+        "rk",
+        registration_policy(RegisteredIdentityMode::Persistent),
+    )
+    .await;
+    let admitted = store
+        .create_registered_environment(register("rk", "env-1", &daemon_key(0x61), 1_500))
+        .await
+        .expect("admit");
+
+    let fresh = mint_registration_secret();
+    let rotated = store
+        .rotate_registration_key(RotateEnvironmentRegistrationKey {
+            registration_key_id: EnvironmentRegistrationKeyId::new("rk"),
+            secret_hash: fresh.secret_hash.clone(),
+            key_prefix: fresh.key_prefix.clone(),
+            rotated_at_ms: 2_000,
+        })
+        .await
+        .expect("rotate");
+    assert_eq!(rotated.key_prefix, fresh.key_prefix);
+    assert_eq!(rotated.updated_at_ms, 2_000);
+    assert!(
+        store
+            .resolve_registration_key(&minted.secret.secret_hash)
+            .await
+            .unwrap()
+            .is_none()
+    );
+    assert_eq!(
+        store
+            .resolve_registration_key(&fresh.secret_hash)
+            .await
+            .unwrap()
+            .map(|key| key.registration_key_id),
+        Some(EnvironmentRegistrationKeyId::new("rk"))
+    );
+    // The admitted daemon still belongs to the key's group.
+    let usage = store
+        .registration_key_usage(&EnvironmentRegistrationKeyId::new("rk"))
+        .await
+        .unwrap();
+    assert_eq!(usage.active, 1);
+    assert_eq!(
+        store
+            .read_environment(&admitted.environment_id)
+            .await
+            .unwrap()
+            .registration_key_id(),
+        Some(&EnvironmentRegistrationKeyId::new("rk"))
+    );
+    // An admission that resolved the key before the rotation committed
+    // presents the retired secret and is refused; the live one admits.
+    assert!(matches!(
+        store
+            .create_registered_environment(register("rk", "env-2", &daemon_key(0x62), 2_100))
+            .await,
+        Err(EnvironmentRegistryError::RegistrationKeyUnavailable {
+            reason: "rotated",
+            ..
+        })
+    ));
+    let admitted_fresh = store
+        .create_registered_environment(CreateRegisteredEnvironment {
+            secret_hash: fresh.secret_hash.clone(),
+            ..register("rk", "env-2", &daemon_key(0x62), 2_100)
+        })
+        .await
+        .expect("admit with the live secret");
+    assert_eq!(admitted_fresh.state, EnvironmentState::Open);
+
+    // A retired secret cannot come back.
+    assert!(matches!(
+        store
+            .rotate_registration_key(RotateEnvironmentRegistrationKey {
+                registration_key_id: EnvironmentRegistrationKeyId::new("rk"),
+                secret_hash: minted.secret.secret_hash.clone(),
+                key_prefix: minted.secret.key_prefix.clone(),
+                rotated_at_ms: 3_000,
+            })
+            .await,
+        Err(EnvironmentRegistryError::AlreadyExists { .. })
+    ));
+
+    store
+        .revoke_registration_key(RevokeEnvironmentRegistrationKey {
+            registration_key_id: EnvironmentRegistrationKeyId::new("rk"),
+            revoked_at_ms: 4_000,
+        })
+        .await
+        .expect("revoke");
+    let another = mint_registration_secret();
+    assert!(matches!(
+        store
+            .rotate_registration_key(RotateEnvironmentRegistrationKey {
+                registration_key_id: EnvironmentRegistrationKeyId::new("rk"),
+                secret_hash: another.secret_hash,
+                key_prefix: another.key_prefix,
+                rotated_at_ms: 5_000,
+            })
+            .await,
+        Err(EnvironmentRegistryError::RegistrationKeyUnavailable {
+            reason: "revoked",
+            ..
+        })
+    ));
+}
+
+// --- registered environments -------------------------------------------------
+
 #[tokio::test(flavor = "current_thread")]
 async fn registered_admission_is_keyed_by_daemon_identity() {
-    let (_universe_id, store) = store().await;
+    let (_, store) = store().await;
     let minted = minted_key(
         &store,
         "rk-eph",
         registration_policy(RegisteredIdentityMode::Ephemeral),
     )
     .await;
-    let resolved = store
-        .resolve_registration_key(&minted.secret_hash)
-        .await
-        .expect("resolve")
-        .expect("known");
-    assert_eq!(resolved.registration_key_id.as_str(), "rk-eph");
+    assert_eq!(
+        store
+            .resolve_registration_key(&minted.secret.secret_hash)
+            .await
+            .expect("resolve")
+            .map(|key| key.registration_key_id),
+        Some(EnvironmentRegistrationKeyId::new("rk-eph"))
+    );
     assert!(
         store
-            .resolve_registration_key("0000")
+            .resolve_registration_key(&"0".repeat(64))
             .await
             .expect("resolve")
             .is_none()
@@ -764,25 +1522,21 @@ async fn registered_admission_is_keyed_by_daemon_identity() {
         .create_registered_environment(register("rk-eph", "env-a", &public_key, 2_000))
         .await
         .expect("register");
-    assert_eq!(created.status, EnvironmentStatus::Ready);
-    assert_eq!(created.last_seen_at_ms, Some(2_000));
-    assert_eq!(
-        created.source.identity_mode(),
-        Some(RegisteredIdentityMode::Ephemeral)
-    );
-    assert_eq!(
-        created.request_id,
-        EnvironmentProvisionRequestId::for_daemon(&EnvironmentDaemonId::from_public_key(
-            &[0x11u8; 32]
-        ))
-    );
+    assert_eq!(created.state, EnvironmentState::Open);
+    assert_eq!(created.request_id, None);
+    assert_eq!(created.daemon_build, Some(build("0.1.0")));
+    let source = created.registered().expect("registered");
+    assert!(source.connected);
+    assert_eq!(source.identity_mode, RegisteredIdentityMode::Ephemeral);
+    assert_eq!(source.connection_changed_at_ms, 2_000);
+    assert_eq!(source.last_seen_at_ms, 2_000);
 
     // A retried first registration converges on the same environment.
     let retried = store
         .create_registered_environment(register("rk-eph", "env-b", &public_key, 2_500))
         .await
         .expect("retry");
-    assert_eq!(retried.environment_id, created.environment_id);
+    assert_eq!(retried, created);
     assert_eq!(
         store
             .read_environment_by_daemon_public_key(&public_key)
@@ -792,105 +1546,236 @@ async fn registered_admission_is_keyed_by_daemon_identity() {
         Some(created.environment_id.clone())
     );
 
-    let offline = store
-        .observe_registered_environment(ObserveRegisteredEnvironment {
+    let closed = store
+        .begin_close_environment(BeginCloseEnvironment {
             environment_id: created.environment_id.clone(),
-            observation: RegisteredConnectionObservation::Disconnected,
-            observed_at_ms: 3_000,
-            metadata: BTreeMap::new(),
+            reason: EnvironmentCloseReason::Departed,
+            at_ms: 3_000,
+        })
+        .await
+        .expect("close");
+    assert_eq!(closed.state, EnvironmentState::Closed);
+    assert_eq!(closed.close_reason, Some(EnvironmentCloseReason::Departed));
+    assert_eq!(closed.closed_at_ms, Some(3_000));
+
+    // The identity is spent: a reconnect is refused, a fresh admission
+    // returns the closed row.
+    assert!(matches!(
+        store
+            .mark_registered_connected(MarkRegisteredConnected {
+                environment_id: created.environment_id.clone(),
+                daemon_build: build("0.2.0"),
+                at_ms: 4_000,
+            })
+            .await,
+        Err(EnvironmentRegistryError::InvalidInput { .. })
+    ));
+    let spent = store
+        .create_registered_environment(register("rk-eph", "env-c", &public_key, 5_000))
+        .await
+        .expect("spent");
+    assert_eq!(spent.environment_id, created.environment_id);
+    assert_eq!(spent.state, EnvironmentState::Closed);
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn connection_writes_happen_on_transitions_and_coarse_stamps() {
+    let (_, store) = store().await;
+    minted_key(
+        &store,
+        "rk",
+        registration_policy(RegisteredIdentityMode::Persistent),
+    )
+    .await;
+    let created = store
+        .create_registered_environment(register("rk", "env", &daemon_key(0x71), 10_000))
+        .await
+        .expect("register");
+    let id = created.environment_id.clone();
+    let stamp = |at_ms| StampRegisteredSeen {
+        environment_id: id.clone(),
+        at_ms,
+    };
+    assert!(
+        !store
+            .stamp_registered_seen(stamp(10_000 + REGISTERED_LIVENESS_STAMP_MS - 1))
+            .await
+            .unwrap()
+    );
+    assert!(
+        store
+            .stamp_registered_seen(stamp(10_000 + REGISTERED_LIVENESS_STAMP_MS))
+            .await
+            .unwrap()
+    );
+
+    let away = store
+        .mark_registered_disconnected(MarkRegisteredDisconnected {
+            environment_id: id.clone(),
+            at_ms: 400_000,
         })
         .await
         .expect("disconnect");
-    assert_eq!(offline.status, EnvironmentStatus::Offline);
-    assert_eq!(offline.last_seen_at_ms, Some(2_000));
-    assert!(offline.registered_daemon_absent(3_000, 60_000));
+    let source = away.registered().unwrap();
+    assert!(!source.connected);
+    assert_eq!(source.connection_changed_at_ms, 400_000);
+    assert_eq!(
+        source.last_seen_at_ms,
+        10_000 + REGISTERED_LIVENESS_STAMP_MS
+    );
+    // A superseded connection's late disconnect writes nothing, and a
+    // disconnected row takes no stamps.
+    let again = store
+        .mark_registered_disconnected(MarkRegisteredDisconnected {
+            environment_id: id.clone(),
+            at_ms: 500_000,
+        })
+        .await
+        .expect("skipped");
+    assert_eq!(again, away);
+    assert!(
+        !store
+            .stamp_registered_seen(stamp(10_000_000))
+            .await
+            .unwrap()
+    );
 
-    // A reconnecting daemon may be a newer build: the admission re-records
-    // its build facts on the row.
     let back = store
-        .observe_registered_environment(ObserveRegisteredEnvironment {
-            environment_id: created.environment_id.clone(),
-            observation: RegisteredConnectionObservation::Connected,
-            observed_at_ms: 4_000,
-            metadata: DaemonBuild {
-                version: Some("0.2.0".to_owned()),
-                git_sha: Some("bbbb".to_owned()),
-                protocol_version: 3,
-            }
-            .metadata(),
+        .mark_registered_connected(MarkRegisteredConnected {
+            environment_id: id.clone(),
+            daemon_build: build("0.2.0"),
+            at_ms: 600_000,
         })
         .await
         .expect("reconnect");
-    assert_eq!(back.status, EnvironmentStatus::Ready);
-    assert_eq!(back.last_seen_at_ms, Some(4_000));
-    assert_eq!(
-        back.metadata
-            .get(ENVD_VERSION_METADATA_KEY)
-            .map(String::as_str),
-        Some("0.2.0")
-    );
+    let source = back.registered().unwrap();
+    assert!(source.connected);
+    assert_eq!(source.connection_changed_at_ms, 600_000);
+    assert_eq!(source.last_seen_at_ms, 600_000);
+    assert_eq!(back.daemon_build, Some(build("0.2.0")));
+
     assert_eq!(
-        back.metadata
-            .get(ENVD_GIT_SHA_METADATA_KEY)
-            .map(String::as_str),
-        Some("bbbb")
+        store.repair_registered_connections(700_000).await.unwrap(),
+        1
     );
+    let repaired = store.read_environment(&id).await.unwrap();
+    let source = repaired.registered().unwrap();
+    assert!(!source.connected);
+    assert_eq!(source.connection_changed_at_ms, 700_000);
+    assert_eq!(source.last_seen_at_ms, 600_000);
     assert_eq!(
-        back.metadata
-            .get(ENVD_PROTOCOL_VERSION_METADATA_KEY)
-            .map(String::as_str),
-        Some("3")
+        store.repair_registered_connections(800_000).await.unwrap(),
+        0
     );
-    assert!(!back.registered_daemon_absent(4_500, 60_000));
-    assert!(back.registered_daemon_absent(100_000, 60_000));
+}
 
+#[tokio::test(flavor = "current_thread")]
+async fn the_registered_sweep_disconnects_stale_rows_and_closes_by_key_policy() {
+    let (_, store) = store().await;
+    minted_key(
+        &store,
+        "rk-eph",
+        RegistrationKeyPolicy {
+            ephemeral_disconnect_grace_ms: Some(60_000),
+            ..registration_policy(RegisteredIdentityMode::Ephemeral)
+        },
+    )
+    .await;
+    minted_key(
+        &store,
+        "rk-off",
+        RegistrationKeyPolicy {
+            offline_close_after_ms: Some(600_000),
+            ..registration_policy(RegisteredIdentityMode::Persistent)
+        },
+    )
+    .await;
+    minted_key(
+        &store,
+        "rk-keep",
+        registration_policy(RegisteredIdentityMode::Persistent),
+    )
+    .await;
+    let start = 1_000_000;
+    for (key, environment, seed) in [
+        ("rk-eph", "eph-stale", 0x81),
+        ("rk-eph", "eph-away", 0x82),
+        ("rk-off", "off-away", 0x83),
+        ("rk-keep", "keep-away", 0x84),
+        ("rk-keep", "keep-live", 0x85),
+    ] {
+        store
+            .create_registered_environment(register(key, environment, &daemon_key(seed), start))
+            .await
+            .expect("register");
+    }
+    for environment in ["eph-away", "off-away", "keep-away"] {
+        store
+            .mark_registered_disconnected(MarkRegisteredDisconnected {
+                environment_id: EnvironmentId::new(environment),
+                at_ms: start,
+            })
+            .await
+            .expect("disconnect");
+    }
+    // keep-live keeps stamping; eph-stale's gateway died silently.
+    let now = start + REGISTERED_STALE_AFTER_MS + 1;
     store
-        .begin_close_environment(BeginCloseEnvironment {
-            environment_id: created.environment_id.clone(),
-            updated_at_ms: 5_000,
-        })
-        .await
-        .expect("begin close");
-    let closed = store
-        .finish_close_environment(FinishCloseEnvironment {
-            environment_id: created.environment_id.clone(),
-            observed_at_ms: 5_100,
+        .stamp_registered_seen(StampRegisteredSeen {
+            environment_id: EnvironmentId::new("keep-live"),
+            at_ms: now - 1_000,
         })
         .await
-        .expect("close");
-    assert_eq!(closed.status, EnvironmentStatus::Closed);
-    // A late heartbeat cannot resurrect a closed environment.
-    let still_closed = store
-        .observe_registered_environment(ObserveRegisteredEnvironment {
-            environment_id: created.environment_id.clone(),
-            observation: RegisteredConnectionObservation::Connected,
-            observed_at_ms: 5_200,
-            metadata: BTreeMap::from([(ENVD_GIT_SHA_METADATA_KEY.to_owned(), "cccc".to_owned())]),
-        })
+        .expect("stamp");
+
+    let sweep = store
+        .sweep_registered_environments(now)
         .await
-        .expect("late heartbeat");
-    assert_eq!(still_closed.status, EnvironmentStatus::Closed);
+        .expect("sweep");
+    assert_eq!(sweep.disconnected, [EnvironmentId::new("eph-stale")]);
     assert_eq!(
-        still_closed
-            .metadata
-            .get(ENVD_GIT_SHA_METADATA_KEY)
-            .map(String::as_str),
-        Some("bbbb")
+        sweep.closed,
+        [
+            (
+                EnvironmentId::new("eph-away"),
+                EnvironmentCloseReason::EphemeralGrace
+            ),
+            (
+                EnvironmentId::new("eph-stale"),
+                EnvironmentCloseReason::EphemeralGrace
+            ),
+            (
+                EnvironmentId::new("off-away"),
+                EnvironmentCloseReason::OfflineTimeout
+            ),
+        ]
     );
-
-    // The identity is spent: the same key with a fresh environment id is
-    // refused, and a different registration key cannot move it either.
-    let spent = store
-        .create_registered_environment(register("rk-eph", "env-c", &public_key, 6_000))
+    let stale = store
+        .read_environment(&EnvironmentId::new("eph-stale"))
         .await
-        .expect("dedup");
-    assert_eq!(spent.environment_id, created.environment_id);
-    assert_eq!(spent.status, EnvironmentStatus::Closed);
+        .unwrap();
+    assert_eq!(stale.state, EnvironmentState::Closed);
+    assert_eq!(stale.registered().unwrap().connection_changed_at_ms, start);
+    for open in ["keep-away", "keep-live"] {
+        assert_eq!(
+            store
+                .read_environment(&EnvironmentId::new(open))
+                .await
+                .unwrap()
+                .state,
+            EnvironmentState::Open
+        );
+    }
+    let quiet = store
+        .sweep_registered_environments(now)
+        .await
+        .expect("sweep");
+    assert_eq!(quiet, RegisteredSweep::default());
 }
 
 #[tokio::test(flavor = "current_thread")]
 async fn registration_key_policy_gates_admission_without_touching_reconnects() {
-    let (_universe_id, store) = store().await;
+    let (_, store) = store().await;
     minted_key(
         &store,
         "rk-cap",
@@ -922,14 +1807,8 @@ async fn registration_key_policy_gates_admission_without_touching_reconnects() {
     store
         .begin_close_environment(BeginCloseEnvironment {
             environment_id: first.environment_id.clone(),
-            updated_at_ms: 3_000,
-        })
-        .await
-        .expect("begin close");
-    store
-        .finish_close_environment(FinishCloseEnvironment {
-            environment_id: first.environment_id.clone(),
-            observed_at_ms: 3_100,
+            reason: EnvironmentCloseReason::Requested,
+            at_ms: 3_000,
         })
         .await
         .expect("close");
@@ -966,28 +1845,32 @@ async fn registration_key_policy_gates_admission_without_touching_reconnects() {
         .await
         .expect("revoke again");
     assert_eq!(again.revoked_at_ms, Some(4_000));
-    let refused = store
-        .create_registered_environment(register("rk-cap", "env-3", &daemon_key(0x23), 5_000))
-        .await
-        .expect_err("revoked");
     assert!(matches!(
-        refused,
-        EnvironmentRegistryError::RegistrationKeyUnavailable {
+        store
+            .create_registered_environment(register("rk-cap", "env-3", &daemon_key(0x23), 5_000))
+            .await,
+        Err(EnvironmentRegistryError::RegistrationKeyUnavailable {
             reason: "revoked",
             ..
-        }
+        })
     ));
     // Known daemons never consult the key.
+    store
+        .mark_registered_disconnected(MarkRegisteredDisconnected {
+            environment_id: EnvironmentId::new("env-2"),
+            at_ms: 5_400,
+        })
+        .await
+        .expect("disconnect");
     let reconnect = store
-        .observe_registered_environment(ObserveRegisteredEnvironment {
+        .mark_registered_connected(MarkRegisteredConnected {
             environment_id: EnvironmentId::new("env-2"),
-            observation: RegisteredConnectionObservation::Connected,
-            observed_at_ms: 5_500,
-            metadata: BTreeMap::new(),
+            daemon_build: build("0.1.1"),
+            at_ms: 5_500,
         })
         .await
         .expect("reconnect after revoke");
-    assert_eq!(reconnect.status, EnvironmentStatus::Ready);
+    assert!(reconnect.registered().unwrap().connected);
 
     minted_key(
         &store,
@@ -998,91 +1881,37 @@ async fn registration_key_policy_gates_admission_without_touching_reconnects() {
         },
     )
     .await;
-    let expired = store
-        .create_registered_environment(register("rk-exp", "env-4", &daemon_key(0x24), 2_000))
-        .await
-        .expect_err("expired");
     assert!(matches!(
-        expired,
-        EnvironmentRegistryError::RegistrationKeyUnavailable {
+        store
+            .create_registered_environment(register("rk-exp", "env-4", &daemon_key(0x24), 2_000))
+            .await,
+        Err(EnvironmentRegistryError::RegistrationKeyUnavailable {
             reason: "expired",
             ..
-        }
-    ));
-    let keys = store.list_registration_keys().await.expect("list");
-    assert_eq!(keys.len(), 2);
-}
-
-#[tokio::test(flavor = "current_thread")]
-async fn registered_environments_list_by_key() {
-    let (_universe_id, store) = store().await;
-    minted_key(
-        &store,
-        "rk-a",
-        registration_policy(RegisteredIdentityMode::Persistent),
-    )
-    .await;
-    minted_key(
-        &store,
-        "rk-b",
-        registration_policy(RegisteredIdentityMode::Persistent),
-    )
-    .await;
-    let a = store
-        .create_registered_environment(register("rk-a", "env-a", &daemon_key(0x31), 2_000))
-        .await
-        .expect("a");
-    store
-        .create_registered_environment(register("rk-b", "env-b", &daemon_key(0x32), 2_000))
-        .await
-        .expect("b");
-
-    let by_key = store
-        .list_environments(ListEnvironments {
-            metadata: Default::default(),
-            registration_key_id: Some(EnvironmentRegistrationKeyId::new("rk-a")),
-            ..ListEnvironments::default()
         })
-        .await
-        .expect("list");
-    assert_eq!(by_key.len(), 1);
-    assert_eq!(by_key[0].environment_id, a.environment_id);
+    ));
+    assert_eq!(store.list_registration_keys().await.unwrap().len(), 2);
 }
 
-/// The gateway stamps reserved entries on top of whatever a daemon sent, so
-/// a daemon using its whole allowance must still be admitted; the allowance
-/// itself stays enforced on the caller's keys.
 #[tokio::test(flavor = "current_thread")]
-async fn reserved_metadata_sits_on_top_of_the_caller_allowance() {
-    let (_universe_id, store) = store().await;
+async fn metadata_is_caller_only_and_bounded() {
+    let (_, store) = store().await;
     minted_key(
         &store,
-        "rk-meta",
+        "rk",
         registration_policy(RegisteredIdentityMode::Persistent),
     )
     .await;
-    let reserved = DaemonBuild {
-        version: Some("0.1.0".to_owned()),
-        git_sha: Some("a".repeat(40)),
-        protocol_version: 2,
-    }
-    .metadata();
-
-    let mut full = register("rk-meta", "env-meta", &daemon_key(0x31), 1_000);
+    let mut full = register("rk", "env-full", &daemon_key(0x31), 1_000);
     full.metadata = (0..MAX_METADATA_ENTRIES as usize)
         .map(|index| (format!("caller.key{index}"), "v".to_owned()))
         .collect();
-    full.metadata.extend(reserved.clone());
-    let created = store
+    store
         .create_registered_environment(full)
         .await
-        .expect("full caller allowance plus reserved entries");
-    assert_eq!(
-        created.metadata.len(),
-        MAX_METADATA_ENTRIES as usize + reserved.len()
-    );
+        .expect("full caller allowance");
 
-    let mut over = register("rk-meta", "env-over", &daemon_key(0x32), 1_000);
+    let mut over = register("rk", "env-over", &daemon_key(0x32), 1_000);
     over.metadata = (0..=MAX_METADATA_ENTRIES as usize)
         .map(|index| (format!("caller.key{index}"), "v".to_owned()))
         .collect();
@@ -1090,279 +1919,231 @@ async fn reserved_metadata_sits_on_top_of_the_caller_allowance() {
         store.create_registered_environment(over).await,
         Err(EnvironmentRegistryError::InvalidInput { .. })
     ));
+    let mut reserved = register("rk", "env-reserved", &daemon_key(0x33), 1_000);
+    reserved.metadata = BTreeMap::from([("lightspeed.envd.version".to_owned(), "1".to_owned())]);
+    assert!(matches!(
+        store.create_registered_environment(reserved).await,
+        Err(EnvironmentRegistryError::InvalidInput { .. })
+    ));
 }
 
+// --- updates and listing -----------------------------------------------------
+
 #[tokio::test(flavor = "current_thread")]
-async fn provider_credentials_are_required_once_and_kept_across_puts() {
+async fn updates_replace_name_and_metadata_until_closed() {
     let store = InMemoryEnvironmentRegistryStore::new();
-    let provider_id = EnvironmentProviderId::new("incus-local");
-    let mut without = provider();
-    without.credential = None;
-    assert!(matches!(
-        store.put_provider(without.clone()).await,
-        Err(EnvironmentRegistryError::InvalidInput { .. })
-    ));
-    let mut unprintable = provider();
-    unprintable.credential = Some(SecretValue::new("two words"));
+    let created = store
+        .create_external_environment(external("ext", "ext-env", 1_000))
+        .await
+        .expect("external");
+    let update = |name: Option<&str>, at| UpdateEnvironment {
+        environment_id: created.environment_id.clone(),
+        display_name: name.map(str::to_owned),
+        metadata: BTreeMap::from([("team".to_owned(), "infra".to_owned())]),
+        updated_at_ms: at,
+    };
+    let updated = store
+        .update_environment(update(Some("builder"), 2_000))
+        .await
+        .expect("update");
+    assert_eq!(updated.display_name.as_deref(), Some("builder"));
+    assert_eq!(
+        updated.metadata.get("team").map(String::as_str),
+        Some("infra")
+    );
+    assert_eq!(updated.updated_at_ms, 2_000);
+
+    // A refused change leaves the stored record untouched.
     assert!(matches!(
-        store.put_provider(unprintable).await,
+        store.update_environment(update(Some(""), 2_500)).await,
         Err(EnvironmentRegistryError::InvalidInput { .. })
     ));
-
-    store.put_provider(provider()).await.expect("create");
-    without.updated_at_ms = 2_000;
-    let replaced = store.put_provider(without).await.expect("replace");
-    assert_eq!(replaced.created_at_ms, 1_000);
     assert_eq!(
         store
-            .read_provider_credential(&provider_id)
+            .read_environment(&created.environment_id)
             .await
-            .expect("credential")
-            .expose(),
-        "provider-secret"
+            .unwrap(),
+        updated
     );
-    let debug = format!("{:?}", provider());
-    assert!(!debug.contains("provider-secret"));
-}
 
-#[tokio::test(flavor = "current_thread")]
-async fn controller_facts_follow_the_registered_endpoint() {
-    let store = InMemoryEnvironmentRegistryStore::new();
-    let provider_id = EnvironmentProviderId::new("incus-local");
-    let created = store.put_provider(provider()).await.expect("create");
-    assert_eq!(created.controller_features, None);
-    assert_eq!(created.data_route_base, None);
-
-    let base = DataRouteBase::new("ws://127.0.0.1:19090/data").expect("base");
-    let features = ControllerFeatures {
-        adopt_target: true,
-        ingress: false,
-    };
-    let recorded = store
-        .record_provider_controller(RecordProviderController {
-            provider_id: provider_id.clone(),
-            controller_endpoint: created.controller_endpoint.clone(),
-            features,
-            data_route_base: base.clone(),
-        })
-        .await
-        .expect("record");
-    assert_eq!(recorded.controller_features, Some(features));
-    assert_eq!(recorded.data_route_base, Some(base.clone()));
-
-    // A put that keeps the endpoint keeps the facts.
-    let mut same = provider();
-    same.credential = None;
-    same.display_name = Some("Renamed".to_owned());
-    let kept = store.put_provider(same).await.expect("rename");
-    assert_eq!(kept.data_route_base, Some(base.clone()));
-
-    // A new endpoint clears them, and an initialize that raced the change
-    // cannot write facts of the old endpoint back.
-    let mut moved = provider();
-    moved.credential = None;
-    moved.controller_endpoint = endpoint("wss://incus.example.com/control");
-    let moved = store.put_provider(moved).await.expect("move");
-    assert_eq!(moved.controller_features, None);
-    assert_eq!(moved.data_route_base, None);
-    let stale = store
-        .record_provider_controller(RecordProviderController {
-            provider_id,
-            controller_endpoint: created.controller_endpoint,
-            features,
-            data_route_base: base,
+    store
+        .begin_close_environment(BeginCloseEnvironment {
+            environment_id: created.environment_id.clone(),
+            reason: EnvironmentCloseReason::Requested,
+            at_ms: 3_000,
         })
         .await
-        .expect("stale record");
-    assert_eq!(stale.data_route_base, None);
+        .expect("close");
+    assert!(matches!(
+        store.update_environment(update(None, 4_000)).await,
+        Err(EnvironmentRegistryError::InvalidInput { .. })
+    ));
 }
 
 #[tokio::test(flavor = "current_thread")]
-async fn a_racing_observation_never_overwrites_a_close() {
+async fn listing_pages_by_id_and_hides_closed_rows_by_default() {
     let (_, store) = store().await;
-    let environment = store
-        .create_environment(create("request-1", "environment-1", "incarnation-1", 2_000))
-        .await
-        .expect("create");
+    for index in 0..5 {
+        let mut request = create(&format!("r-{index}"), &format!("env-{index}"), 2_000);
+        if index % 2 == 0 {
+            request.metadata = BTreeMap::from([("job".to_owned(), "nightly".to_owned())]);
+        }
+        store.create_environment(request).await.expect("create");
+    }
     store
         .begin_close_environment(BeginCloseEnvironment {
-            environment_id: environment.environment_id.clone(),
-            updated_at_ms: 2_500,
+            environment_id: EnvironmentId::new("env-1"),
+            reason: EnvironmentCloseReason::Requested,
+            at_ms: 3_000,
         })
         .await
-        .expect("begin close");
-
-    // The create that was in flight when the close arrived answers: the
-    // target id is still recorded so the close can address it, but the
-    // status stays closing.
-    let observed = store
-        .observe_provisioned_environment(observe(
-            &environment.environment_id,
-            Some("ls-3f2a"),
-            EnvironmentStatus::Ready,
-            3_000,
-        ))
-        .await
-        .expect("observe");
-    assert_eq!(observed.status, EnvironmentStatus::Closing);
-    assert_eq!(
-        observed.incarnation.provider_target_id,
-        Some(target("ls-3f2a"))
-    );
-
-    let failed = store
-        .fail_environment_lifecycle(FailEnvironmentLifecycle {
-            environment_id: environment.environment_id.clone(),
-            message: "power change failed".to_owned(),
-            daemon_build: None,
-            observed_at_ms: 3_500,
+        .expect("close");
+    store
+        .finish_close_environment(FinishCloseEnvironment {
+            environment_id: EnvironmentId::new("env-1"),
+            at_ms: 3_100,
         })
         .await
-        .expect("fail");
-    assert_eq!(failed.status, EnvironmentStatus::Closing);
-    assert_eq!(failed.lifecycle_error, None);
-}
+        .expect("closed");
 
-#[tokio::test(flavor = "current_thread")]
-async fn observations_without_a_target_id_keep_the_recorded_one() {
-    let (_, store) = store().await;
-    let environment = store
-        .create_environment(create("request-1", "environment-1", "incarnation-1", 2_000))
-        .await
-        .expect("create");
-    let pending = store
-        .observe_provisioned_environment(observe(
-            &environment.environment_id,
-            None,
-            EnvironmentStatus::Provisioning,
-            2_500,
-        ))
-        .await
-        .expect("no id yet");
-    assert_eq!(pending.incarnation.provider_target_id, None);
-    // Natural provider ids are opaque: slashes and colons are fine.
-    let natural = "arn:aws:ec2:eu-west-1:123456789012:instance/i-0abc";
-    store
-        .observe_provisioned_environment(observe(
-            &environment.environment_id,
-            Some(natural),
-            EnvironmentStatus::Booting,
-            3_000,
-        ))
+    let ids = |page: &EnvironmentPage| -> Vec<String> {
+        page.environments
+            .iter()
+            .map(|record| record.environment_id.to_string())
+            .collect()
+    };
+    let first = store
+        .list_environments(ListEnvironments {
+            limit: 2,
+            ..ListEnvironments::default()
+        })
         .await
-        .expect("id assigned");
-    let kept = store
-        .observe_provisioned_environment(observe(
-            &environment.environment_id,
-            None,
-            EnvironmentStatus::Booting,
-            3_500,
-        ))
+        .expect("page 1");
+    assert_eq!(ids(&first), ["env-0", "env-2"]);
+    assert_eq!(first.next_after, Some(EnvironmentId::new("env-2")));
+    let second = store
+        .list_environments(ListEnvironments {
+            limit: 2,
+            after: first.next_after.clone(),
+            ..ListEnvironments::default()
+        })
         .await
-        .expect("id kept");
-    assert_eq!(kept.incarnation.provider_target_id, Some(target(natural)));
-    assert!(matches!(
-        store
-            .observe_provisioned_environment(observe(
-                &environment.environment_id,
-                Some("another-target"),
-                EnvironmentStatus::Ready,
-                4_000,
-            ))
-            .await,
-        Err(EnvironmentRegistryError::InvalidInput { .. })
-    ));
-}
+        .expect("page 2");
+    assert_eq!(ids(&second), ["env-3", "env-4"]);
+    assert_eq!(second.next_after, None);
 
-#[tokio::test(flavor = "current_thread")]
-async fn lifecycle_errors_accumulate_until_a_steady_observation() {
-    let (_, store) = store().await;
-    let environment = store
-        .create_environment(create("request-1", "environment-1", "incarnation-1", 2_000))
-        .await
-        .expect("create");
-    let first = store
-        .record_environment_lifecycle_error(RecordEnvironmentLifecycleError {
-            environment_id: environment.environment_id.clone(),
-            message: "controller unavailable".to_owned(),
-            observed_at_ms: 3_000,
+    let with_closed = store
+        .list_environments(ListEnvironments {
+            include_closed: true,
+            ..ListEnvironments::default()
         })
         .await
-        .expect("first error");
-    assert_eq!(first.status, EnvironmentStatus::Provisioning);
-    let second = store
-        .record_environment_lifecycle_error(RecordEnvironmentLifecycleError {
-            environment_id: environment.environment_id.clone(),
-            message: format!("connect failed\u{7}{}", "x".repeat(2_000)),
-            observed_at_ms: 4_000,
+        .expect("all");
+    assert_eq!(with_closed.environments.len(), 5);
+    let only_closed = store
+        .list_environments(ListEnvironments {
+            state: Some(EnvironmentState::Closed),
+            ..ListEnvironments::default()
         })
         .await
-        .expect("second error");
-    let error = second.lifecycle_error.expect("recorded");
-    assert_eq!(error.first_at_ms, 3_000);
-    assert_eq!(error.last_at_ms, 4_000);
-    assert!(error.message.len() <= 1024);
-    assert!(!error.message.contains('\u{7}'));
+        .expect("closed");
+    assert_eq!(ids(&only_closed), ["env-1"]);
 
-    let ready = store
-        .observe_provisioned_environment(ObserveProvisionedEnvironment {
-            daemon_build: Some(DaemonBuild {
-                version: Some("0.5.0".to_owned()),
-                git_sha: None,
-                protocol_version: 3,
-            }),
-            ..observe(
-                &environment.environment_id,
-                Some("target-1"),
-                EnvironmentStatus::Ready,
-                5_000,
-            )
+    let tagged = store
+        .list_environments(ListEnvironments {
+            metadata: BTreeMap::from([("job".to_owned(), "nightly".to_owned())]),
+            ..ListEnvironments::default()
+        })
+        .await
+        .expect("metadata");
+    assert_eq!(ids(&tagged), ["env-0", "env-2", "env-4"]);
+    let mismatched = store
+        .list_environments(ListEnvironments {
+            metadata: BTreeMap::from([
+                ("job".to_owned(), "nightly".to_owned()),
+                ("trial".to_owned(), "1".to_owned()),
+            ]),
+            ..ListEnvironments::default()
         })
         .await
-        .expect("ready");
-    assert_eq!(ready.lifecycle_error, None);
+        .expect("mismatched");
+    assert!(mismatched.environments.is_empty());
+
+    for limit in [0, LIST_ENVIRONMENTS_MAX_LIMIT + 1] {
+        assert!(matches!(
+            store
+                .list_environments(ListEnvironments {
+                    limit,
+                    ..ListEnvironments::default()
+                })
+                .await,
+            Err(EnvironmentRegistryError::InvalidInput { .. })
+        ));
+    }
     assert_eq!(
-        ready
-            .metadata
-            .get(ENVD_PROTOCOL_VERSION_METADATA_KEY)
-            .map(String::as_str),
-        Some("3")
+        ListEnvironments::default().limit,
+        LIST_ENVIRONMENTS_DEFAULT_LIMIT
     );
 }
 
-/// A change whose result fails validation must leave the stored record as
-/// it was, so a bad value can never become durable.
 #[tokio::test(flavor = "current_thread")]
-async fn refused_changes_leave_the_stored_record_untouched() {
-    let (_universe_id, store) = store().await;
-    minted_key(
-        &store,
-        "rk-poison",
-        registration_policy(RegisteredIdentityMode::Persistent),
-    )
-    .await;
-    let created = store
-        .create_registered_environment(register("rk-poison", "env-p", &daemon_key(0x41), 1_000))
+async fn registered_environments_list_by_key() {
+    let (_, store) = store().await;
+    for key in ["rk-a", "rk-b"] {
+        minted_key(
+            &store,
+            key,
+            registration_policy(RegisteredIdentityMode::Persistent),
+        )
+        .await;
+    }
+    let a = store
+        .create_registered_environment(register("rk-a", "env-a", &daemon_key(0x31), 2_000))
         .await
-        .expect("register");
-    let refused = store
-        .observe_registered_environment(ObserveRegisteredEnvironment {
-            environment_id: created.environment_id.clone(),
-            observation: RegisteredConnectionObservation::Connected,
-            observed_at_ms: 2_000,
-            metadata: BTreeMap::from([(
-                ENVD_VERSION_METADATA_KEY.to_owned(),
-                "bad\u{0}version".to_owned(),
-            )]),
+        .expect("a");
+    store
+        .create_registered_environment(register("rk-b", "env-b", &daemon_key(0x32), 2_000))
+        .await
+        .expect("b");
+    let by_key = store
+        .list_environments(ListEnvironments {
+            registration_key_id: Some(EnvironmentRegistrationKeyId::new("rk-a")),
+            ..ListEnvironments::default()
         })
-        .await;
-    assert!(matches!(
-        refused,
-        Err(EnvironmentRegistryError::InvalidInput { .. })
-    ));
-    let stored = store
-        .read_environment(&created.environment_id)
         .await
-        .expect("still readable");
-    assert_eq!(stored, created);
+        .expect("list");
+    assert_eq!(by_key.environments.len(), 1);
+    assert_eq!(by_key.environments[0].environment_id, a.environment_id);
+}
+
+#[test]
+fn states_and_close_reasons_round_trip_their_stored_names() {
+    for state in [
+        EnvironmentState::Provisioning,
+        EnvironmentState::Open,
+        EnvironmentState::Closing,
+        EnvironmentState::Closed,
+        EnvironmentState::Failed,
+    ] {
+        assert_eq!(EnvironmentState::parse(state.as_str()), Some(state));
+        assert_eq!(
+            serde_json::to_value(state).unwrap(),
+            serde_json::json!(state.as_str())
+        );
+    }
+    for reason in [
+        EnvironmentCloseReason::Requested,
+        EnvironmentCloseReason::KeyRevoked,
+        EnvironmentCloseReason::EphemeralGrace,
+        EnvironmentCloseReason::Departed,
+        EnvironmentCloseReason::OfflineTimeout,
+        EnvironmentCloseReason::ProviderEnded,
+    ] {
+        assert_eq!(EnvironmentCloseReason::parse(reason.as_str()), Some(reason));
+        assert_eq!(
+            serde_json::to_value(reason).unwrap(),
+            serde_json::json!(reason.as_str())
+        );
+    }
+    assert_eq!(EnvironmentState::parse("ready"), None);
 }
diff --git a/crates/store-pg/migrations/005_environments.sql b/crates/store-pg/migrations/005_environments.sql
index fec0c6683..4d1aa3e1c 100644
--- a/crates/store-pg/migrations/005_environments.sql
+++ b/crates/store-pg/migrations/005_environments.sql
@@ -1,18 +1,59 @@
--- Environment compute: deployment providers, universe bindings, and
--- durable logical environments with incarnation-scoped physical facts.
+-- Environment compute: deployment providers, universe bindings, registration
+-- keys and their secrets, and universe environments of three kinds.
+--
+-- Design notes:
+-- - A provider is reached at one validated controller endpoint URL (ws://,
+--   wss:// or unix://). Its bearer credential is optional; when present it is
+--   sealed with AES-256-GCM by the store adapter, exactly like auth_secrets.
+--   data_route_base is optional operator configuration; without it the data
+--   routes derive from the controller endpoint.
+-- - A binding is a universe's use of one provider, keyed by the provider.
+-- - A registration key is an admission policy and the group of the
+--   environments it admitted. It stores no counters: registration and active
+--   counts derive from environment rows carrying registration_key_id. Only
+--   SHA-256 hashes of its server-generated secrets are stored, in a child
+--   table, so a rotation keeps the group.
+-- - One environments row covers three kinds. Lightspeed owns a five-state
+--   lifecycle; the observed_* columns and public_endpoint are what the
+--   provider last reported, for display only. A registered row's identity
+--   mode is read from its key.
+-- - The daemon public key is the identity. One public key maps to at most
+--   one environment in the whole deployment, ever: the unique index covers
+--   closed rows too, so a closed environment's daemon cannot register again
+--   without a fresh local identity.
 
 CREATE TABLE IF NOT EXISTS environment_providers (
     provider_id text PRIMARY KEY,
     display_name text,
-    controller_connection_json jsonb NOT NULL,
-    metadata_json jsonb NOT NULL DEFAULT '{}',
+    controller_endpoint text NOT NULL,
+    data_route_base text,
+    credential_key_id text,
+    credential_nonce bytea,
+    credential_ciphertext bytea,
     created_at_ms bigint NOT NULL,
     updated_at_ms bigint NOT NULL,
     CONSTRAINT environment_providers_provider_id_format
         CHECK (provider_id ~ '^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$'),
-    CONSTRAINT environment_providers_json_objects CHECK (
-        jsonb_typeof(controller_connection_json) = 'object'
-        AND jsonb_typeof(metadata_json) = 'object'
+    CONSTRAINT environment_providers_display_name_not_empty
+        CHECK (display_name IS NULL OR display_name <> ''),
+    CONSTRAINT environment_providers_controller_endpoint_format CHECK (
+        controller_endpoint ~ '^(wss?|unix)://[^[:space:][:cntrl:]]+$'
+        AND octet_length(controller_endpoint) <= 2048
+    ),
+    CONSTRAINT environment_providers_data_route_base_format CHECK (
+        data_route_base IS NULL
+        OR (
+            data_route_base ~ '^wss?://[^[:space:][:cntrl:]]+$'
+            AND octet_length(data_route_base) <= 2048
+        )
+    ),
+    CONSTRAINT environment_providers_credential_all_or_none CHECK (
+        (credential_key_id IS NULL AND credential_nonce IS NULL AND credential_ciphertext IS NULL)
+        OR (
+            credential_key_id IS NOT NULL AND credential_key_id <> ''
+            AND credential_nonce IS NOT NULL AND octet_length(credential_nonce) = 12
+            AND credential_ciphertext IS NOT NULL
+        )
     ),
     CONSTRAINT environment_providers_times_valid CHECK (
         created_at_ms >= 0 AND updated_at_ms >= created_at_ms
@@ -21,252 +62,267 @@ CREATE TABLE IF NOT EXISTS environment_providers (
 
 CREATE TABLE IF NOT EXISTS environment_provider_bindings (
     universe_id uuid NOT NULL REFERENCES universes (universe_id) ON DELETE CASCADE,
-    binding_id text NOT NULL,
     provider_id text NOT NULL REFERENCES environment_providers (provider_id) ON DELETE RESTRICT,
-    status text NOT NULL,
-    revision bigint NOT NULL,
-    metadata_json jsonb NOT NULL DEFAULT '{}',
+    enabled boolean NOT NULL,
     created_at_ms bigint NOT NULL,
     updated_at_ms bigint NOT NULL,
-    PRIMARY KEY (universe_id, binding_id),
-    UNIQUE (universe_id, provider_id),
-    CONSTRAINT environment_provider_bindings_binding_id_format
-        CHECK (binding_id ~ '^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$'),
-    CONSTRAINT environment_provider_bindings_status_known
-        CHECK (status IN ('enabled', 'disabled')),
-    CONSTRAINT environment_provider_bindings_revision_positive CHECK (revision > 0),
-    CONSTRAINT environment_provider_bindings_metadata_object
-        CHECK (jsonb_typeof(metadata_json) = 'object'),
+    PRIMARY KEY (universe_id, provider_id),
     CONSTRAINT environment_provider_bindings_times_valid CHECK (
         created_at_ms >= 0 AND updated_at_ms >= created_at_ms
     )
 );
 
--- Key-based outbound environment registration: reusable, universe-scoped
--- registration keys and the registered environment source they admit.
---
--- Design notes:
--- - A registration key is an admission policy and the group of the
---   environments it admitted. It stores no counters: registration and active
---   counts derive from environment rows carrying registration_key_id.
--- - Only the SHA-256 hash of the server-generated secret is stored, exactly
---   like api_keys. key_prefix is the display handle.
--- - identity_mode is key policy copied onto every environment the key
---   admits; the daemon neither knows nor chooses it.
--- - The daemon public key is the identity. One public key maps to at most
---   one environment in the whole deployment, ever: the unique index covers
---   closed rows too, so a closed environment's daemon cannot register again
---   without a fresh local identity.
--- - last_seen_at_ms is the gateway's heartbeat stamp on the control
---   connection; the lifecycle reconciler derives ephemeral cleanup and stale
---   Ready repair from it.
-
 CREATE TABLE IF NOT EXISTS environment_registration_keys (
     universe_id uuid NOT NULL REFERENCES universes (universe_id) ON DELETE CASCADE,
     registration_key_id text NOT NULL,
     display_name text NOT NULL,
-    key_prefix text NOT NULL,
-    secret_hash text NOT NULL,
     identity_mode text NOT NULL,
     max_active_environments integer,
     ephemeral_disconnect_grace_ms bigint,
+    offline_close_after_ms bigint,
     expires_at_ms bigint,
-    created_at_ms bigint NOT NULL,
     revoked_at_ms bigint,
+    created_at_ms bigint NOT NULL,
+    updated_at_ms bigint NOT NULL,
     PRIMARY KEY (universe_id, registration_key_id),
     CONSTRAINT environment_registration_keys_id_format
         CHECK (registration_key_id ~ '^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$'),
     CONSTRAINT environment_registration_keys_display_name_bounded
         CHECK (display_name <> '' AND length(display_name) <= 128),
-    CONSTRAINT environment_registration_keys_key_prefix_not_empty
-        CHECK (key_prefix <> ''),
-    CONSTRAINT environment_registration_keys_secret_hash_format
-        CHECK (secret_hash ~ '^[0-9a-f]{64}$'),
     CONSTRAINT environment_registration_keys_identity_mode_known
         CHECK (identity_mode IN ('persistent', 'ephemeral')),
     CONSTRAINT environment_registration_keys_limits_positive CHECK (
         (max_active_environments IS NULL OR max_active_environments > 0)
         AND (ephemeral_disconnect_grace_ms IS NULL OR ephemeral_disconnect_grace_ms > 0)
+        AND (offline_close_after_ms IS NULL OR offline_close_after_ms > 0)
     ),
+    CONSTRAINT environment_registration_keys_offline_close_persistent
+        CHECK (offline_close_after_ms IS NULL OR identity_mode = 'persistent'),
     CONSTRAINT environment_registration_keys_times_valid CHECK (
-        created_at_ms >= 0
+        created_at_ms >= 0 AND updated_at_ms >= created_at_ms
         AND (expires_at_ms IS NULL OR expires_at_ms >= 0)
         AND (revoked_at_ms IS NULL OR revoked_at_ms >= created_at_ms)
     )
 );
 
-CREATE UNIQUE INDEX IF NOT EXISTS environment_registration_keys_secret_hash_idx
-    ON environment_registration_keys (secret_hash);
+-- Secrets of a key: rotation retires one and adds another, so the key's
+-- group, allowlists and identity mode survive. secret_hash is SHA-256 of the
+-- server-generated secret; it is unique deployment-wide, retired secrets
+-- included.
+CREATE TABLE IF NOT EXISTS environment_registration_key_secrets (
+    secret_hash text PRIMARY KEY,
+    universe_id uuid NOT NULL,
+    registration_key_id text NOT NULL,
+    key_prefix text NOT NULL,
+    created_at_ms bigint NOT NULL,
+    retired_at_ms bigint,
+    FOREIGN KEY (universe_id, registration_key_id)
+        REFERENCES environment_registration_keys (universe_id, registration_key_id)
+        ON DELETE CASCADE,
+    CONSTRAINT environment_registration_key_secrets_hash_format
+        CHECK (secret_hash ~ '^[0-9a-f]{64}$'),
+    CONSTRAINT environment_registration_key_secrets_prefix_not_empty
+        CHECK (key_prefix <> ''),
+    CONSTRAINT environment_registration_key_secrets_times_valid CHECK (
+        created_at_ms >= 0 AND (retired_at_ms IS NULL OR retired_at_ms >= created_at_ms)
+    )
+);
 
-CREATE UNIQUE INDEX IF NOT EXISTS environment_registration_keys_key_prefix_idx
-    ON environment_registration_keys (key_prefix);
+CREATE UNIQUE INDEX IF NOT EXISTS environment_registration_key_secrets_live_idx
+    ON environment_registration_key_secrets (universe_id, registration_key_id)
+    WHERE retired_at_ms IS NULL;
 
 CREATE TABLE IF NOT EXISTS environments (
     universe_id uuid NOT NULL REFERENCES universes (universe_id) ON DELETE CASCADE,
     environment_id text NOT NULL,
-    request_id text NOT NULL,
     source_kind text NOT NULL,
+    state text NOT NULL,
+    state_message text,
+    close_reason text,
+    state_changed_at_ms bigint NOT NULL,
+    request_id text,
+    display_name text,
+    metadata_json jsonb NOT NULL DEFAULT '{}',
+    daemon_version text,
+    daemon_git_sha text,
+    daemon_protocol_version integer,
+    -- provisioned (no FK on provider_id: closed rows outlive providers)
     provider_id text,
-    binding_id text,
-    daemon_connection_json jsonb,
+    template_id text,
+    create_idle_json jsonb,
+    provider_target_id text,
+    next_attempt_at_ms bigint,
+    attempts integer NOT NULL DEFAULT 0,
+    observed_phase text,
+    observed_power text,
+    observed_message text,
+    observed_at_ms bigint,
+    public_endpoint text,
+    -- external
+    daemon_endpoint text,
+    -- registered
     registration_key_id text,
-    daemon_id text,
     daemon_public_key text,
-    identity_mode text,
+    connected boolean,
+    connection_changed_at_ms bigint,
     last_seen_at_ms bigint,
-    display_name text,
-    status text NOT NULL,
-    -- Lightspeed-owned power intent and optional staged idle policy. Observed
-    -- power remains in status; activity is read from the daemon on demand.
-    desired_power text NOT NULL DEFAULT 'running',
-    idle_policy_json jsonb,
-    current_incarnation_id text NOT NULL,
-    public_ingress_enabled boolean NOT NULL DEFAULT false,
-    public_endpoint text,
-    metadata_json jsonb NOT NULL DEFAULT '{}',
     created_at_ms bigint NOT NULL,
     updated_at_ms bigint NOT NULL,
+    closed_at_ms bigint,
     PRIMARY KEY (universe_id, environment_id),
-    UNIQUE (universe_id, request_id),
+    -- Deferrable so a universe delete can check at commit, after its
+    -- cascade has removed the environments too.
     CONSTRAINT environments_registration_key_fk
         FOREIGN KEY (universe_id, registration_key_id)
         REFERENCES environment_registration_keys (universe_id, registration_key_id)
-        ON DELETE RESTRICT,
+        ON DELETE NO ACTION DEFERRABLE INITIALLY IMMEDIATE,
     CONSTRAINT environments_ids_format CHECK (
         environment_id ~ '^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$'
-        AND request_id ~ '^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$'
-        AND current_incarnation_id ~ '^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$'
+        AND (request_id IS NULL OR request_id ~ '^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$')
+        AND (template_id IS NULL OR template_id ~ '^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$')
+        AND (
+            provider_target_id IS NULL
+            OR (
+                octet_length(provider_target_id) BETWEEN 1 AND 255
+                AND provider_target_id !~ '[[:cntrl:]]'
+            )
+        )
     ),
     CONSTRAINT environments_source_known
         CHECK (source_kind IN ('provisioned', 'external', 'registered')),
+    CONSTRAINT environments_state_known
+        CHECK (state IN ('provisioning', 'open', 'closing', 'closed', 'failed')),
+    CONSTRAINT environments_state_per_kind
+        CHECK (source_kind = 'provisioned' OR state IN ('open', 'closed')),
+    CONSTRAINT environments_close_reason CHECK (
+        (close_reason IS NULL) = (state NOT IN ('closing', 'closed'))
+        AND (
+            close_reason IS NULL
+            OR close_reason IN (
+                'requested', 'key_revoked', 'ephemeral_grace',
+                'departed', 'offline_timeout', 'provider_ended'
+            )
+        )
+    ),
+    CONSTRAINT environments_closed_at
+        CHECK ((closed_at_ms IS NULL) = (state <> 'closed')),
+    CONSTRAINT environments_state_message_bounded CHECK (
+        state_message IS NULL OR octet_length(state_message) BETWEEN 1 AND 1024
+    ),
+    CONSTRAINT environments_work_schedule CHECK (
+        (next_attempt_at_ms IS NOT NULL)
+            = (source_kind = 'provisioned' AND state IN ('provisioning', 'closing'))
+        AND attempts >= 0
+    ),
+    CONSTRAINT environments_daemon_build CHECK (
+        (daemon_protocol_version IS NOT NULL OR (daemon_version IS NULL AND daemon_git_sha IS NULL))
+        AND (daemon_version IS NULL OR daemon_version <> '')
+        AND (daemon_git_sha IS NULL OR daemon_git_sha <> '')
+    ),
     CONSTRAINT environments_source_fields CHECK (
         (
             source_kind = 'provisioned'
-            AND provider_id IS NOT NULL AND binding_id IS NOT NULL
-            AND daemon_connection_json IS NULL
-            AND registration_key_id IS NULL AND daemon_id IS NULL
-            AND daemon_public_key IS NULL AND identity_mode IS NULL
-            AND last_seen_at_ms IS NULL
+            AND request_id IS NOT NULL AND provider_id IS NOT NULL AND template_id IS NOT NULL
+            AND daemon_endpoint IS NULL
+            AND registration_key_id IS NULL AND daemon_public_key IS NULL
+            AND connected IS NULL AND connection_changed_at_ms IS NULL AND last_seen_at_ms IS NULL
         )
         OR (
             source_kind = 'external'
-            AND provider_id IS NULL AND binding_id IS NULL
-            AND jsonb_typeof(daemon_connection_json) = 'object'
-            AND registration_key_id IS NULL AND daemon_id IS NULL
-            AND daemon_public_key IS NULL AND identity_mode IS NULL
-            AND last_seen_at_ms IS NULL
+            AND request_id IS NOT NULL
+            AND provider_id IS NULL AND template_id IS NULL AND create_idle_json IS NULL
+            AND provider_target_id IS NULL
+            AND observed_phase IS NULL AND public_endpoint IS NULL
+            AND daemon_endpoint IS NOT NULL
+            AND daemon_endpoint ~ '^(wss?|unix)://[^[:space:][:cntrl:]]+$'
+            AND octet_length(daemon_endpoint) <= 2048
+            AND registration_key_id IS NULL AND daemon_public_key IS NULL
+            AND connected IS NULL AND connection_changed_at_ms IS NULL AND last_seen_at_ms IS NULL
         )
         OR (
             source_kind = 'registered'
-            AND provider_id IS NULL AND binding_id IS NULL
-            AND daemon_connection_json IS NULL
+            AND request_id IS NULL
+            AND provider_id IS NULL AND template_id IS NULL AND create_idle_json IS NULL
+            AND provider_target_id IS NULL
+            AND observed_phase IS NULL AND public_endpoint IS NULL
+            AND daemon_endpoint IS NULL
             AND registration_key_id IS NOT NULL
-            AND daemon_id ~ '^daemon_[0-9a-f]{64}$'
-            AND daemon_public_key ~ '^[0-9a-f]{64}$'
-            AND identity_mode IN ('persistent', 'ephemeral')
-            AND (last_seen_at_ms IS NULL OR last_seen_at_ms >= 0)
+            AND daemon_public_key IS NOT NULL AND daemon_public_key ~ '^[0-9a-f]{64}$'
+            AND connected IS NOT NULL
+            AND connection_changed_at_ms IS NOT NULL AND connection_changed_at_ms >= 0
+            AND last_seen_at_ms IS NOT NULL AND last_seen_at_ms >= 0
         )
     ),
-    CONSTRAINT environments_status_known CHECK (status IN (
-        'provisioning', 'booting', 'ready', 'paused', 'suspended', 'offline',
-        'closing', 'closed', 'failed', 'unknown'
-    )),
-    CONSTRAINT environments_desired_power_known
-        CHECK (desired_power IN ('running', 'paused', 'suspended', 'stopped')),
-    CONSTRAINT environments_idle_policy_object
-        CHECK (idle_policy_json IS NULL OR jsonb_typeof(idle_policy_json) = 'object'),
-    CONSTRAINT environments_power_provisioned_only CHECK (
-        source_kind = 'provisioned'
-        OR (desired_power = 'running' AND idle_policy_json IS NULL)
+    CONSTRAINT environments_observation CHECK (
+        (observed_phase IS NULL) = (observed_at_ms IS NULL)
+        AND (
+            observed_phase IS NULL
+            OR observed_phase IN ('provisioning', 'active', 'closing', 'closed', 'failed', 'unknown')
+        )
+        AND (
+            observed_power IS NULL
+            OR (
+                observed_phase IS NOT NULL AND observed_phase = 'active'
+                AND observed_power IN ('running', 'paused', 'suspended', 'stopped')
+            )
+        )
+        AND (
+            observed_message IS NULL
+            OR (observed_phase IS NOT NULL AND octet_length(observed_message) BETWEEN 1 AND 1024)
+        )
+        AND (
+            public_endpoint IS NULL
+            OR (public_endpoint <> '' AND octet_length(public_endpoint) <= 2048 AND state <> 'closed')
+        )
     ),
-    CONSTRAINT environments_metadata_object
-        CHECK (jsonb_typeof(metadata_json) = 'object'),
-    CONSTRAINT environments_public_ingress_fields CHECK (
-        (public_ingress_enabled AND source_kind = 'provisioned' AND public_endpoint IS NOT NULL AND public_endpoint <> '')
-        OR (NOT public_ingress_enabled AND public_endpoint IS NULL)
+    CONSTRAINT environments_json_objects CHECK (
+        jsonb_typeof(metadata_json) = 'object'
+        AND (create_idle_json IS NULL OR jsonb_typeof(create_idle_json) = 'object')
     ),
     CONSTRAINT environments_times_valid CHECK (
         created_at_ms >= 0 AND updated_at_ms >= created_at_ms
+        AND state_changed_at_ms >= created_at_ms
+        AND (closed_at_ms IS NULL OR closed_at_ms >= created_at_ms)
     )
 );
 
-CREATE INDEX IF NOT EXISTS environments_binding_status_idx
-    ON environments (universe_id, binding_id, status, environment_id);
+CREATE UNIQUE INDEX IF NOT EXISTS environments_request_id_idx
+    ON environments (universe_id, request_id)
+    WHERE request_id IS NOT NULL;
 
-CREATE INDEX IF NOT EXISTS environments_idle_policy_idx
-    ON environments (universe_id)
-    WHERE idle_policy_json IS NOT NULL AND status = 'ready';
+CREATE INDEX IF NOT EXISTS environments_provider_state_idx
+    ON environments (universe_id, provider_id, state)
+    WHERE provider_id IS NOT NULL;
 
--- Deployment-wide: one daemon identity, one environment, ever.
+CREATE INDEX IF NOT EXISTS environments_registration_key_state_idx
+    ON environments (universe_id, registration_key_id, state)
+    WHERE registration_key_id IS NOT NULL;
+
+-- The reconciler's work queue (provisioning and closing provisioned rows).
+CREATE INDEX IF NOT EXISTS environments_work_idx
+    ON environments (next_attempt_at_ms)
+    WHERE next_attempt_at_ms IS NOT NULL;
+
+-- Deployment-wide: one daemon identity, one environment, ever (closed rows included).
 CREATE UNIQUE INDEX IF NOT EXISTS environments_daemon_public_key_idx
     ON environments (daemon_public_key)
     WHERE daemon_public_key IS NOT NULL;
 
-CREATE INDEX IF NOT EXISTS environments_registration_key_idx
-    ON environments (universe_id, registration_key_id, status)
-    WHERE registration_key_id IS NOT NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS environments_provider_target_idx
+    ON environments (provider_id, provider_target_id)
+    WHERE provider_target_id IS NOT NULL AND state <> 'closed';
 
-CREATE INDEX IF NOT EXISTS environments_metadata_idx
-    ON environments USING gin (metadata_json jsonb_path_ops);
+CREATE INDEX IF NOT EXISTS environments_registered_open_idx
+    ON environments (universe_id, connected, connection_changed_at_ms)
+    WHERE source_kind = 'registered' AND state = 'open';
 
-CREATE TABLE IF NOT EXISTS environment_incarnations (
-    universe_id uuid NOT NULL,
-    environment_id text NOT NULL,
-    incarnation_id text NOT NULL,
-    provision_request_id text,
-    provider_target_id text,
-    template_id text,
-    adoption_source_target text,
-    power_states_json jsonb NOT NULL DEFAULT '[]',
-    created_at_ms bigint NOT NULL,
-    updated_at_ms bigint NOT NULL,
-    PRIMARY KEY (universe_id, environment_id, incarnation_id),
-    FOREIGN KEY (universe_id, environment_id)
-        REFERENCES environments (universe_id, environment_id) ON DELETE CASCADE,
-    UNIQUE (universe_id, provision_request_id),
-    CONSTRAINT environment_incarnations_ids_format CHECK (
-        incarnation_id ~ '^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$'
-        AND (
-            provision_request_id IS NULL
-            OR provision_request_id ~ '^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$'
-        )
-        AND (
-            template_id IS NULL
-            OR template_id ~ '^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$'
-        )
-        AND (
-            adoption_source_target IS NULL
-            OR (
-                length(adoption_source_target) BETWEEN 1 AND 255
-                AND adoption_source_target !~ '[[:cntrl:]]'
-            )
-        )
-    ),
-    CONSTRAINT environment_incarnations_source_fields CHECK (
-        (
-            provision_request_id IS NOT NULL
-            AND ((template_id IS NOT NULL) <> (adoption_source_target IS NOT NULL))
-        )
-        OR (
-            provision_request_id IS NULL
-            AND provider_target_id IS NULL
-            AND template_id IS NULL
-            AND adoption_source_target IS NULL
-        )
-    ),
-    CONSTRAINT environment_incarnations_power_states_array
-        CHECK (jsonb_typeof(power_states_json) = 'array'),
-    CONSTRAINT environment_incarnations_times_valid CHECK (
-        created_at_ms >= 0 AND updated_at_ms >= created_at_ms
-    )
-);
+-- The display sweep's scan set.
+CREATE INDEX IF NOT EXISTS environments_provisioned_open_idx
+    ON environments (universe_id)
+    WHERE source_kind = 'provisioned' AND state = 'open';
 
--- Incarnations point back to environments; add the other side after both exist.
-ALTER TABLE environments
-    ADD CONSTRAINT environments_current_incarnation_fk
-    FOREIGN KEY (universe_id, environment_id, current_incarnation_id)
-    REFERENCES environment_incarnations (universe_id, environment_id, incarnation_id)
-    DEFERRABLE INITIALLY DEFERRED;
+CREATE INDEX IF NOT EXISTS environments_metadata_idx
+    ON environments USING gin (metadata_json jsonb_path_ops);
 
 CREATE TABLE IF NOT EXISTS environment_credentials (
     universe_id uuid NOT NULL,
@@ -281,12 +337,17 @@ CREATE TABLE IF NOT EXISTS environment_credentials (
     PRIMARY KEY (universe_id, environment_id, env_name),
     FOREIGN KEY (universe_id, environment_id)
         REFERENCES environments (universe_id, environment_id) ON DELETE CASCADE,
+    -- Deferrable so a universe delete can check at commit, after its
+    -- cascade has removed the bindings too.
     FOREIGN KEY (universe_id, grant_id)
-        REFERENCES auth_grants (universe_id, grant_id) ON DELETE RESTRICT,
+        REFERENCES auth_grants (universe_id, grant_id)
+        ON DELETE NO ACTION DEFERRABLE INITIALLY IMMEDIATE,
     FOREIGN KEY (universe_id, auth_provider_id)
-        REFERENCES auth_providers (universe_id, provider_id) ON DELETE RESTRICT,
+        REFERENCES auth_providers (universe_id, provider_id)
+        ON DELETE NO ACTION DEFERRABLE INITIALLY IMMEDIATE,
     FOREIGN KEY (universe_id, secret_id)
-        REFERENCES auth_secrets (universe_id, secret_id) ON DELETE RESTRICT,
+        REFERENCES auth_secrets (universe_id, secret_id)
+        ON DELETE NO ACTION DEFERRABLE INITIALLY IMMEDIATE,
     CONSTRAINT environment_credentials_env_name_format
         CHECK (env_name ~ '^[A-Za-z_][A-Za-z0-9_]{0,127}$'),
     CONSTRAINT environment_credentials_source_kind_known
@@ -302,35 +363,24 @@ CREATE TABLE IF NOT EXISTS environment_credentials (
 );
 
 COMMENT ON TABLE environment_providers IS
-    'Operator-registered provider identity and controller connection; protocol and presence are observed transiently.';
-COMMENT ON COLUMN environment_providers.metadata_json IS
-    'Non-authoritative operator metadata; never provider capability, health, or allocation policy.';
+    'Operator-registered provider identity, controller endpoint, optional data route base and optional sealed credential.';
+COMMENT ON COLUMN environment_providers.data_route_base IS
+    'Operator-configured ws:// or wss:// base of the provider data routes; null derives it from the controller endpoint.';
+COMMENT ON COLUMN environment_providers.credential_ciphertext IS
+    'AES-256-GCM sealed bearer credential for the controller and data routes, AAD = provider id; all three credential columns are null without a credential.';
 COMMENT ON TABLE environment_provider_bindings IS
-    'Revisioned universe routing and admission binding to one provider; it is not a provider policy document.';
-COMMENT ON COLUMN environment_provider_bindings.metadata_json IS
-    'Non-authoritative binding labels; never provider template, quota, capacity, or ingress policy.';
-COMMENT ON TABLE environments IS
-    'Universe-owned logical environments. External environments store a Lightspeed-reachable envd endpoint; provisioned environments retain provider routing linkage.';
-COMMENT ON TABLE environment_incarnations IS
-    'Lightspeed-authorized environment generations with stable provider retry and target linkage; not provider inventory or live gateway state.';
-COMMENT ON COLUMN environment_incarnations.provider_target_id IS
-    'Opaque provider-scoped target handle returned by createTarget; interpreted with the environment provider identity.';
-COMMENT ON COLUMN environment_incarnations.adoption_source_target IS
-    'Provider-native source reference for an explicit operator-managed adoption; retained for idempotent lifecycle retries.';
-COMMENT ON COLUMN environments.public_endpoint IS
-    'Provider-realized public HTTPS endpoint; port, private target, proxy configuration, TLS, health, and policy remain provider-owned.';
-COMMENT ON COLUMN environments.desired_power IS
-    'Lightspeed-owned power intent (running|paused|suspended|stopped); converged by the lifecycle reconciler, observed state is status.';
-COMMENT ON COLUMN environments.idle_policy_json IS
-    'Optional staged idle policy {pauseAfterMs,suspendAfterMs,stopAfterMs,closeAfterMs}; applied by the power reaper from the daemon idle report.';
-COMMENT ON COLUMN environment_incarnations.power_states_json IS
-    'Provider-reported power states this target supports, observed with the target id.';
-COMMENT ON TABLE environment_credentials IS
-    'Universe-owned credential bindings for an environment.';
-
+    'A universe''s use of one provider; enabled admits creates, template listing and data routes.';
 COMMENT ON TABLE environment_registration_keys IS
     'Reusable universe-scoped admission policies for outbound envd registration; each key is also the group of the environments it admitted.';
+COMMENT ON TABLE environment_registration_key_secrets IS
+    'SHA-256 hashes of a registration key''s secrets; exactly one is live, rotation retires it and adds another.';
+COMMENT ON TABLE environments IS
+    'Universe-owned environments of three kinds (provisioned, external, registered) with the five-state lifecycle Lightspeed owns.';
+COMMENT ON COLUMN environments.create_idle_json IS
+    'Create-time idle policy passed to target/create on every retry; never interpreted by Lightspeed.';
 COMMENT ON COLUMN environments.daemon_public_key IS
     'Lowercase hex Ed25519 public key of the registered daemon; the identity, unique across the deployment including closed rows.';
 COMMENT ON COLUMN environments.last_seen_at_ms IS
-    'Gateway heartbeat stamp on the registered control connection; stale under ready means the gateway stopped without recording the disconnect.';
+    'Coarse registered liveness: written at connect, at disconnect, and at most every 5 minutes while connected.';
+COMMENT ON TABLE environment_credentials IS
+    'Universe-owned credential bindings for an environment.';
diff --git a/crates/store-pg/migrations/012_environment_endpoints.sql b/crates/store-pg/migrations/012_environment_endpoints.sql
deleted file mode 100644
index 1b39a1663..000000000
--- a/crates/store-pg/migrations/012_environment_endpoints.sql
+++ /dev/null
@@ -1,138 +0,0 @@
--- Environment protocol v3 storage.
---
--- Design notes:
--- - Providers and external environments are reached at one validated
---   endpoint URL (ws://, wss:// or unix://) whose scheme selects the dialer;
---   the transport JSON documents are gone.
--- - The provider credential is the bearer token Lightspeed presents on the
---   controller and data routes. It is sealed with AES-256-GCM by the store
---   adapter, exactly like auth_secrets, and never stored in plaintext.
--- - controller_adopt_target, controller_ingress and data_route_base are what
---   the controller advertised at its last successful initialize: all three
---   or none.
--- - lifecycle_error records why an environment failed, or the latest error
---   its lifecycle is retrying past, instead of a caller metadata entry.
--- - Provider target ids follow the protocol's opaque rule.
--- - public_ingress_enabled is the ingress intent and public_endpoint what
---   the provider last reported realized; the reconciler converges the
---   endpoint toward the intent, so either may lead the other for a while.
---
--- Rows written in the earlier shape are not converted: purge providers and
--- external environments before migrating a database that has them.
-
-ALTER TABLE environment_providers
-    DROP CONSTRAINT environment_providers_json_objects;
-
-ALTER TABLE environment_providers
-    DROP COLUMN controller_connection_json,
-    ADD COLUMN controller_endpoint text NOT NULL,
-    ADD COLUMN credential_key_id text NOT NULL,
-    ADD COLUMN credential_nonce bytea NOT NULL,
-    ADD COLUMN credential_ciphertext bytea NOT NULL,
-    ADD COLUMN controller_adopt_target boolean,
-    ADD COLUMN controller_ingress boolean,
-    ADD COLUMN data_route_base text,
-    ADD CONSTRAINT environment_providers_metadata_object
-        CHECK (jsonb_typeof(metadata_json) = 'object'),
-    ADD CONSTRAINT environment_providers_controller_endpoint_format CHECK (
-        controller_endpoint ~ '^(wss?|unix)://[^[:space:][:cntrl:]]+$'
-        AND octet_length(controller_endpoint) <= 2048
-    ),
-    ADD CONSTRAINT environment_providers_credential_sealed CHECK (
-        credential_key_id <> '' AND octet_length(credential_nonce) = 12
-    ),
-    ADD CONSTRAINT environment_providers_controller_facts CHECK (
-        (controller_adopt_target IS NULL) = (controller_ingress IS NULL)
-        AND (controller_ingress IS NULL) = (data_route_base IS NULL)
-    ),
-    ADD CONSTRAINT environment_providers_data_route_base_format CHECK (
-        data_route_base IS NULL
-        OR (data_route_base ~ '^wss?://' AND octet_length(data_route_base) <= 2048)
-    );
-
-ALTER TABLE environments
-    DROP CONSTRAINT environments_source_fields,
-    DROP CONSTRAINT environments_public_ingress_fields;
-
-ALTER TABLE environments
-    DROP COLUMN daemon_connection_json,
-    ADD COLUMN daemon_endpoint text,
-    ADD COLUMN lifecycle_error text,
-    ADD COLUMN lifecycle_error_first_at_ms bigint,
-    ADD COLUMN lifecycle_error_last_at_ms bigint,
-    ADD CONSTRAINT environments_source_fields CHECK (
-        (
-            source_kind = 'provisioned'
-            AND provider_id IS NOT NULL AND binding_id IS NOT NULL
-            AND daemon_endpoint IS NULL
-            AND registration_key_id IS NULL AND daemon_id IS NULL
-            AND daemon_public_key IS NULL AND identity_mode IS NULL
-            AND last_seen_at_ms IS NULL
-        )
-        OR (
-            source_kind = 'external'
-            AND provider_id IS NULL AND binding_id IS NULL
-            AND daemon_endpoint ~ '^(wss?|unix)://[^[:space:][:cntrl:]]+$'
-            AND octet_length(daemon_endpoint) <= 2048
-            AND registration_key_id IS NULL AND daemon_id IS NULL
-            AND daemon_public_key IS NULL AND identity_mode IS NULL
-            AND last_seen_at_ms IS NULL
-        )
-        OR (
-            source_kind = 'registered'
-            AND provider_id IS NULL AND binding_id IS NULL
-            AND daemon_endpoint IS NULL
-            AND registration_key_id IS NOT NULL
-            AND daemon_id ~ '^daemon_[0-9a-f]{64}$'
-            AND daemon_public_key ~ '^[0-9a-f]{64}$'
-            AND identity_mode IN ('persistent', 'ephemeral')
-            AND (last_seen_at_ms IS NULL OR last_seen_at_ms >= 0)
-        )
-    ),
-    ADD CONSTRAINT environments_public_ingress_fields CHECK (
-        (NOT public_ingress_enabled AND public_endpoint IS NULL)
-        OR (
-            source_kind = 'provisioned'
-            AND (public_endpoint IS NULL OR public_endpoint <> '')
-        )
-    ),
-    ADD CONSTRAINT environments_lifecycle_error_fields CHECK (
-        (
-            lifecycle_error IS NULL
-            AND lifecycle_error_first_at_ms IS NULL
-            AND lifecycle_error_last_at_ms IS NULL
-        )
-        OR (
-            octet_length(lifecycle_error) BETWEEN 1 AND 1024
-            AND lifecycle_error_first_at_ms >= 0
-            AND lifecycle_error_last_at_ms >= lifecycle_error_first_at_ms
-        )
-    );
-
-ALTER TABLE environment_incarnations
-    ADD CONSTRAINT environment_incarnations_provider_target_id_opaque CHECK (
-        provider_target_id IS NULL
-        OR (
-            octet_length(provider_target_id) BETWEEN 1 AND 255
-            AND provider_target_id !~ '[[:cntrl:]]'
-        )
-    );
-
-COMMENT ON TABLE environment_providers IS
-    'Operator-registered provider identity, controller endpoint and sealed credential, plus the controller facts observed at its last initialize.';
-COMMENT ON COLUMN environment_providers.controller_endpoint IS
-    'Validated ws://, wss:// or unix:// URL of the provider controller; the scheme selects the dialer.';
-COMMENT ON COLUMN environment_providers.credential_ciphertext IS
-    'AES-256-GCM sealed bearer credential for the controller and data routes; AAD binds it to the provider id.';
-COMMENT ON COLUMN environment_providers.data_route_base IS
-    'Data route base (routes.data) the controller advertised at its last successful initialize; target data routes are built from it.';
-COMMENT ON TABLE environments IS
-    'Universe-owned logical environments. External environments store a Lightspeed-reachable envd endpoint URL; provisioned environments retain provider routing linkage.';
-COMMENT ON COLUMN environments.public_ingress_enabled IS
-    'Lightspeed-owned public ingress intent; the lifecycle reconciler converges the provider target toward it.';
-COMMENT ON COLUMN environments.public_endpoint IS
-    'Public endpoint the provider last reported realized; may lag public_ingress_enabled while the reconciler converges.';
-COMMENT ON COLUMN environments.lifecycle_error IS
-    'Why the environment failed, or the latest lifecycle error being retried; first/last instants bound the current run of errors.';
-COMMENT ON COLUMN environment_incarnations.provider_target_id IS
-    'Opaque provider-scoped target handle (1-255 bytes, no control characters); interpreted with the environment provider identity.';
diff --git a/crates/store-pg/src/deployment.rs b/crates/store-pg/src/deployment.rs
index b0f8b1662..a50e7bc35 100644
--- a/crates/store-pg/src/deployment.rs
+++ b/crates/store-pg/src/deployment.rs
@@ -150,11 +150,20 @@ pub async fn list_universe_object_keys(
 
 /// Delete the universe row; every universe-scoped table cascades from it,
 /// including its keys. `false` when the universe did not exist.
+///
+/// Deferrable foreign keys between universe-scoped tables (environments to
+/// registration keys, environment credentials to auth objects) are checked
+/// at commit, so the cascade order between their tables does not matter.
 pub async fn delete_universe(pool: &PgPool, universe_id: Uuid) -> Result<bool, PgStoreError> {
+    let mut tx = pool.begin().await?;
+    sqlx::query("SET CONSTRAINTS ALL DEFERRED")
+        .execute(&mut *tx)
+        .await?;
     let result = sqlx::query("DELETE FROM universes WHERE universe_id = $1")
         .bind(universe_id)
-        .execute(pool)
+        .execute(&mut *tx)
         .await?;
+    tx.commit().await?;
     Ok(result.rows_affected() > 0)
 }
 
diff --git a/crates/store-pg/src/environment.rs b/crates/store-pg/src/environment.rs
index 8f60050a8..bbe9a21df 100644
--- a/crates/store-pg/src/environment.rs
+++ b/crates/store-pg/src/environment.rs
@@ -1,84 +1,72 @@
+//! Environment providers, universe bindings and environments.
+//!
+//! Every environment write locks its row and applies the domain request's
+//! pure `apply` in one transaction, so this store and the in-memory one
+//! share each transition's skip rule: a write whose expected state no longer
+//! holds leaves the row as it is. The writes that run often or in bulk (the
+//! liveness stamp, the deployment sweeps) are single
+//! conditional statements with the same rules.
+
 // Formatted SQL uses internal schema fragments; request values use bind parameters.
+use std::collections::{BTreeMap, HashMap};
+
 use async_trait::async_trait;
 use auth::{AuthGrantId, AuthProviderId, SecretId, SecretValue};
 use environment_protocol::{ids::ProviderTargetId, routes::DataRouteBase};
 use environments::{
-    AdoptEnvironment, BeginCloseEnvironment, ControllerFeatures, CreateEnvironment,
-    CreateExternalEnvironment, CreateRegisteredEnvironment, EnvironmentCredentialRecord,
-    EnvironmentCredentialSource, EnvironmentCredentialStore, EnvironmentDaemonId,
-    EnvironmentEndpoint, EnvironmentId, EnvironmentIncarnationId, EnvironmentIncarnationRecord,
-    EnvironmentLifecycleError, EnvironmentProviderBindingId, EnvironmentProviderBindingRecord,
-    EnvironmentProviderBindingStatus, EnvironmentProviderBindingStore, EnvironmentProviderId,
-    EnvironmentProviderRecord, EnvironmentProviderStore, EnvironmentProvisionRequestId,
-    EnvironmentRecord, EnvironmentRegistrationKeyId, EnvironmentRegistryError, EnvironmentSource,
-    EnvironmentStatus, EnvironmentStore, EnvironmentTemplateId, FailEnvironmentLifecycle,
-    FinishCloseEnvironment, ListEnvironmentCredentials, ListEnvironmentProviders, ListEnvironments,
-    ObserveProvisionedEnvironment, ObserveRegisteredEnvironment, PowerState,
-    PutEnvironmentCredential, PutEnvironmentProvider, PutEnvironmentProviderBinding,
-    ReconcileScope, RecordEnvironmentIngress, RecordEnvironmentLifecycleError,
-    RecordProviderController, RegisteredConnectionObservation, RegisteredIdentityMode,
-    SetEnvironmentIdlePolicy, SetEnvironmentIngress, SetEnvironmentPower,
-    apply_registered_observation,
+    BeginCloseEnvironment, CreateEnvironment, CreateExternalEnvironment,
+    CreateRegisteredEnvironment, DEFAULT_EPHEMERAL_DISCONNECT_GRACE_MS, DaemonBuild,
+    EndProvisionedEnvironment, EnvironmentCloseReason, EnvironmentCredentialRecord,
+    EnvironmentCredentialSource, EnvironmentCredentialStore, EnvironmentEndpoint, EnvironmentId,
+    EnvironmentPage, EnvironmentProviderBindingRecord, EnvironmentProviderBindingStore,
+    EnvironmentProviderId, EnvironmentProviderRecord, EnvironmentProviderStore,
+    EnvironmentProvisionRequestId, EnvironmentRecord, EnvironmentRegistrationKeyId,
+    EnvironmentRegistrationKeyRecord, EnvironmentRegistrationKeyStore, EnvironmentRegistryError,
+    EnvironmentSource, EnvironmentState, EnvironmentStore, EnvironmentTemplateId, FailEnvironment,
+    FinishCloseEnvironment, ListEnvironmentCredentials, ListEnvironments, MarkRegisteredConnected,
+    MarkRegisteredDisconnected, ObservedTarget, OpenEnvironment, PowerState,
+    ProviderCredentialChange, ProvisionedSource, PutEnvironmentCredential, PutEnvironmentProvider,
+    PutEnvironmentProviderBinding, REGISTERED_LIVENESS_STAMP_MS, REGISTERED_STALE_AFTER_MS,
+    RecordTargetObservation, RegisteredIdentityMode, RegisteredSource, RegisteredSweep,
+    ScheduleEnvironmentAttempt, StampRegisteredSeen, TargetPhase, UpdateEnvironment,
+    sweep_registered_environment, validate_daemon_public_key,
 };
-use sqlx::{Postgres, Row, Transaction};
+use sqlx::{PgPool, Postgres, Row, Transaction, postgres::PgRow};
 use uuid::Uuid;
 
 use crate::{
-    PgStore,
+    PgStore, PgStoreError,
     auth::{LOCAL_KEY_ID, open_secret, seal_secret},
 };
 
 const PROVIDER_COLUMNS: &str = r#"
-    provider_id, display_name, controller_endpoint, metadata_json,
-    controller_adopt_target, controller_ingress, data_route_base,
-    created_at_ms, updated_at_ms
+    provider_id, display_name, controller_endpoint, data_route_base,
+    credential_key_id IS NOT NULL AS has_credential, created_at_ms, updated_at_ms
 "#;
 
-const BINDING_COLUMNS: &str = r#"
-    universe_id, binding_id, provider_id, status, revision, metadata_json,
-    created_at_ms, updated_at_ms
-"#;
+const BINDING_COLUMNS: &str = "universe_id, provider_id, enabled, created_at_ms, updated_at_ms";
 
+/// Columns of `environments e` plus the identity mode of a registered row's
+/// key `k` (see [`ENVIRONMENT_FROM`]).
 const ENVIRONMENT_COLUMNS: &str = r#"
-    e.environment_id, e.request_id, e.source_kind, e.provider_id, e.binding_id, e.daemon_endpoint,
-    e.registration_key_id, e.daemon_id, e.daemon_public_key, e.identity_mode, e.last_seen_at_ms,
-    e.display_name, e.status, e.desired_power, e.idle_policy_json,
-    e.public_ingress_enabled, e.public_endpoint, e.metadata_json,
-    e.lifecycle_error, e.lifecycle_error_first_at_ms, e.lifecycle_error_last_at_ms,
-    e.created_at_ms, e.updated_at_ms,
-    i.incarnation_id, i.provision_request_id, i.provider_target_id,
-    i.template_id, i.adoption_source_target, i.power_states_json,
-    i.created_at_ms AS incarnation_created_at_ms,
-    i.updated_at_ms AS incarnation_updated_at_ms
+    e.environment_id, e.source_kind, e.state, e.state_message, e.close_reason,
+    e.state_changed_at_ms, e.request_id, e.display_name, e.metadata_json,
+    e.daemon_version, e.daemon_git_sha, e.daemon_protocol_version,
+    e.provider_id, e.template_id, e.create_idle_json, e.provider_target_id,
+    e.next_attempt_at_ms, e.attempts,
+    e.observed_phase, e.observed_power, e.observed_message, e.observed_at_ms,
+    e.public_endpoint, e.daemon_endpoint,
+    e.registration_key_id, e.daemon_public_key, e.connected,
+    e.connection_changed_at_ms, e.last_seen_at_ms,
+    e.created_at_ms, e.updated_at_ms, e.closed_at_ms,
+    k.identity_mode
 "#;
 
-/// SQL predicate: the observed steady power state differs from the desired
-/// one, so the lifecycle reconciler has power work to do.
-/// `EnvironmentRecord::needs_reconcile` over `environments e` without the
-/// steady clause: convergence pending (status, power or ingress).
-pub(crate) const CONVERGING_SQL: &str = r#"(
-    e.status IN ('provisioning','booting','closing','unknown')
-    OR (e.source_kind = 'provisioned' AND (
-        (e.status = 'ready' AND e.desired_power <> 'running')
-        OR (e.status = 'paused' AND e.desired_power <> 'paused')
-        OR (e.status = 'suspended' AND e.desired_power <> 'suspended')
-        OR (e.status = 'offline' AND e.desired_power <> 'stopped')
-        OR (e.status = 'ready' AND e.public_ingress_enabled <> (e.public_endpoint IS NOT NULL))
-    ))
-)"#;
-
-/// Steady provisioned environments, over `environments e`; with the
-/// incarnation join the recorded target is required too.
-pub(crate) const STEADY_SQL: &str = r#"(
-    e.source_kind = 'provisioned' AND e.status IN ('ready','offline','paused','suspended')
-)"#;
-
-const ENVIRONMENT_JOIN: &str = r#"
+/// Registered rows read their identity mode from the key that admitted them.
+const ENVIRONMENT_FROM: &str = r#"
     FROM environments e
-    JOIN environment_incarnations i
-      ON i.universe_id = e.universe_id
-     AND i.environment_id = e.environment_id
-     AND i.incarnation_id = e.current_incarnation_id
+    LEFT JOIN environment_registration_keys k
+      ON k.universe_id = e.universe_id AND k.registration_key_id = e.registration_key_id
 "#;
 
 const CREDENTIAL_COLUMNS: &str = r#"
@@ -100,8 +88,7 @@ impl EnvironmentProviderStore for PgStore {
         let query = format!(
             "SELECT {PROVIDER_COLUMNS} FROM environment_providers WHERE provider_id = $1 FOR UPDATE"
         );
-        // A row that no longer decodes is replaced as if it were absent, so
-        // an operator can repair it with a put that carries a credential.
+        // A row that no longer decodes is replaced as if it were absent.
         let existing = sqlx::query(sqlx::AssertSqlSafe(query))
             .bind(request.provider_id.as_str())
             .fetch_optional(&mut *tx)
@@ -110,80 +97,52 @@ impl EnvironmentProviderStore for PgStore {
             .and_then(|row| decoded_or_logged(provider_from_row(&row), "environment provider"));
         let credential = request.credential.clone();
         let record = request.into_record(existing.as_ref())?;
-        let features = record.controller_features;
-        let row = match credential {
-            Some(credential) => {
+        let (keep, key_id, nonce, ciphertext) = match credential {
+            ProviderCredentialChange::Keep => (true, None, None, None),
+            ProviderCredentialChange::Set(credential) => {
                 let (key_id, nonce, ciphertext) =
                     self.seal_provider_credential(&record.provider_id, &credential)?;
-                let query = format!(
-                    r#"
-                    INSERT INTO environment_providers (
-                        provider_id, display_name, controller_endpoint, metadata_json,
-                        controller_adopt_target, controller_ingress, data_route_base,
-                        credential_key_id, credential_nonce, credential_ciphertext,
-                        created_at_ms, updated_at_ms
-                    ) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12)
-                    ON CONFLICT (provider_id) DO UPDATE SET
-                        display_name = EXCLUDED.display_name,
-                        controller_endpoint = EXCLUDED.controller_endpoint,
-                        metadata_json = EXCLUDED.metadata_json,
-                        controller_adopt_target = EXCLUDED.controller_adopt_target,
-                        controller_ingress = EXCLUDED.controller_ingress,
-                        data_route_base = EXCLUDED.data_route_base,
-                        credential_key_id = EXCLUDED.credential_key_id,
-                        credential_nonce = EXCLUDED.credential_nonce,
-                        credential_ciphertext = EXCLUDED.credential_ciphertext,
-                        created_at_ms = EXCLUDED.created_at_ms,
-                        updated_at_ms = EXCLUDED.updated_at_ms
-                    RETURNING {PROVIDER_COLUMNS}
-                "#
-                );
-                sqlx::query(sqlx::AssertSqlSafe(query))
-                    .bind(record.provider_id.as_str())
-                    .bind(record.display_name.as_deref())
-                    .bind(record.controller_endpoint.as_str())
-                    .bind(json_value("encode provider metadata", &record.metadata)?)
-                    .bind(features.map(|features| features.adopt_target))
-                    .bind(features.map(|features| features.ingress))
-                    .bind(record.data_route_base.as_ref().map(DataRouteBase::as_str))
-                    .bind(key_id)
-                    .bind(nonce)
-                    .bind(ciphertext)
-                    .bind(record.created_at_ms)
-                    .bind(record.updated_at_ms)
-                    .fetch_one(&mut *tx)
-                    .await
-                    .map_err(|error| sql_error("put environment provider", error))?
-            }
-            None => {
-                let query = format!(
-                    r#"
-                    UPDATE environment_providers SET
-                        display_name = $2, controller_endpoint = $3, metadata_json = $4,
-                        controller_adopt_target = $5, controller_ingress = $6,
-                        data_route_base = $7, created_at_ms = $8, updated_at_ms = $9
-                    WHERE provider_id = $1
-                    RETURNING {PROVIDER_COLUMNS}
-                "#
-                );
-                sqlx::query(sqlx::AssertSqlSafe(query))
-                    .bind(record.provider_id.as_str())
-                    .bind(record.display_name.as_deref())
-                    .bind(record.controller_endpoint.as_str())
-                    .bind(json_value("encode provider metadata", &record.metadata)?)
-                    .bind(features.map(|features| features.adopt_target))
-                    .bind(features.map(|features| features.ingress))
-                    .bind(record.data_route_base.as_ref().map(DataRouteBase::as_str))
-                    .bind(record.created_at_ms)
-                    .bind(record.updated_at_ms)
-                    .fetch_optional(&mut *tx)
-                    .await
-                    .map_err(|error| sql_error("update environment provider", error))?
-                    .ok_or_else(|| {
-                        invalid_error("a new environment provider requires a credential")
-                    })?
+                (false, Some(key_id), Some(nonce), Some(ciphertext))
             }
+            ProviderCredentialChange::Clear => (false, None, None, None),
         };
+        let query = format!(
+            r#"
+            INSERT INTO environment_providers (
+                provider_id, display_name, controller_endpoint, data_route_base,
+                credential_key_id, credential_nonce, credential_ciphertext,
+                created_at_ms, updated_at_ms
+            ) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)
+            ON CONFLICT (provider_id) DO UPDATE SET
+                display_name = EXCLUDED.display_name,
+                controller_endpoint = EXCLUDED.controller_endpoint,
+                data_route_base = EXCLUDED.data_route_base,
+                credential_key_id = CASE WHEN $10::boolean
+                    THEN environment_providers.credential_key_id ELSE EXCLUDED.credential_key_id END,
+                credential_nonce = CASE WHEN $10::boolean
+                    THEN environment_providers.credential_nonce ELSE EXCLUDED.credential_nonce END,
+                credential_ciphertext = CASE WHEN $10::boolean
+                    THEN environment_providers.credential_ciphertext
+                    ELSE EXCLUDED.credential_ciphertext END,
+                created_at_ms = EXCLUDED.created_at_ms,
+                updated_at_ms = EXCLUDED.updated_at_ms
+            RETURNING {PROVIDER_COLUMNS}
+            "#
+        );
+        let row = sqlx::query(sqlx::AssertSqlSafe(query))
+            .bind(record.provider_id.as_str())
+            .bind(record.display_name.as_deref())
+            .bind(record.controller_endpoint.as_str())
+            .bind(record.data_route_base.as_ref().map(DataRouteBase::as_str))
+            .bind(key_id)
+            .bind(nonce)
+            .bind(ciphertext)
+            .bind(record.created_at_ms)
+            .bind(record.updated_at_ms)
+            .bind(keep)
+            .fetch_one(&mut *tx)
+            .await
+            .map_err(|error| sql_error("put environment provider", error))?;
         tx.commit()
             .await
             .map_err(|error| sql_error("commit environment provider put", error))?;
@@ -208,7 +167,7 @@ impl EnvironmentProviderStore for PgStore {
     async fn read_provider_credential(
         &self,
         provider_id: &EnvironmentProviderId,
-    ) -> Result<SecretValue, EnvironmentRegistryError> {
+    ) -> Result<Option<SecretValue>, EnvironmentRegistryError> {
         let row = sqlx::query(
             "SELECT credential_key_id, credential_nonce, credential_ciphertext FROM environment_providers WHERE provider_id = $1",
         )
@@ -217,20 +176,25 @@ impl EnvironmentProviderStore for PgStore {
         .await
         .map_err(|error| sql_error("read environment provider credential", error))?
         .ok_or_else(|| not_found("environment_provider", provider_id))?;
-        let key_id: String = row
+        let key_id: Option<String> = row
             .try_get("credential_key_id")
             .map_err(|error| sql_error("decode provider credential key id", error))?;
+        let nonce: Option<Vec<u8>> = row
+            .try_get("credential_nonce")
+            .map_err(|error| sql_error("decode provider credential nonce", error))?;
+        let ciphertext: Option<Vec<u8>> = row
+            .try_get("credential_ciphertext")
+            .map_err(|error| sql_error("decode provider credential", error))?;
+        let (key_id, nonce, ciphertext) = match (key_id, nonce, ciphertext) {
+            (None, None, None) => return Ok(None),
+            (Some(key_id), Some(nonce), Some(ciphertext)) => (key_id, nonce, ciphertext),
+            _ => return Err(store_message("provider credential columns are incomplete")),
+        };
         if key_id != LOCAL_KEY_ID {
             return Err(store_message(format!(
                 "unsupported provider credential key id '{key_id}'"
             )));
         }
-        let nonce: Vec<u8> = row
-            .try_get("credential_nonce")
-            .map_err(|error| sql_error("decode provider credential nonce", error))?;
-        let ciphertext: Vec<u8> = row
-            .try_get("credential_ciphertext")
-            .map_err(|error| sql_error("decode provider credential", error))?;
         let (cipher, _) = self
             .secrets_cipher()
             .map_err(|error| store_message(error.to_string()))?;
@@ -240,34 +204,12 @@ impl EnvironmentProviderStore for PgStore {
             &nonce,
             &ciphertext,
         )
+        .map(Some)
         .map_err(|error| store_message(format!("open provider credential: {error}")))
     }
 
-    async fn record_provider_controller(
-        &self,
-        request: RecordProviderController,
-    ) -> Result<EnvironmentProviderRecord, EnvironmentRegistryError> {
-        sqlx::query(
-            r#"
-            UPDATE environment_providers SET
-                controller_adopt_target = $3, controller_ingress = $4, data_route_base = $5
-            WHERE provider_id = $1 AND controller_endpoint = $2
-            "#,
-        )
-        .bind(request.provider_id.as_str())
-        .bind(request.controller_endpoint.as_str())
-        .bind(request.features.adopt_target)
-        .bind(request.features.ingress)
-        .bind(request.data_route_base.as_str())
-        .execute(&self.pool)
-        .await
-        .map_err(|error| sql_error("record environment provider controller", error))?;
-        self.read_provider(&request.provider_id).await
-    }
-
     async fn list_providers(
         &self,
-        _request: ListEnvironmentProviders,
     ) -> Result<Vec<EnvironmentProviderRecord>, EnvironmentRegistryError> {
         let query =
             format!("SELECT {PROVIDER_COLUMNS} FROM environment_providers ORDER BY provider_id");
@@ -286,25 +228,51 @@ impl EnvironmentProviderStore for PgStore {
         &self,
         provider_id: &EnvironmentProviderId,
     ) -> Result<EnvironmentProviderRecord, EnvironmentRegistryError> {
+        let mut tx = self
+            .pool
+            .begin()
+            .await
+            .map_err(|error| sql_error("begin environment provider delete", error))?;
+        let query = format!(
+            "SELECT {PROVIDER_COLUMNS} FROM environment_providers WHERE provider_id = $1 FOR UPDATE"
+        );
+        sqlx::query(sqlx::AssertSqlSafe(query))
+            .bind(provider_id.as_str())
+            .fetch_optional(&mut *tx)
+            .await
+            .map_err(|error| sql_error("lock environment provider", error))?
+            .ok_or_else(|| not_found("environment_provider", provider_id))?;
         let bindings: i64 = sqlx::query_scalar(
             "SELECT count(*) FROM environment_provider_bindings WHERE provider_id = $1",
         )
         .bind(provider_id.as_str())
-        .fetch_one(&self.pool)
+        .fetch_one(&mut *tx)
         .await
         .map_err(|error| sql_error("count environment provider bindings", error))?;
         if bindings != 0 {
             return invalid("environment provider is referenced by a universe binding");
         }
+        let active: i64 = sqlx::query_scalar(
+            "SELECT count(*) FROM environments WHERE provider_id = $1 AND state <> 'closed'",
+        )
+        .bind(provider_id.as_str())
+        .fetch_one(&mut *tx)
+        .await
+        .map_err(|error| sql_error("count environment provider environments", error))?;
+        if active != 0 {
+            return invalid("environment provider is referenced by a non-closed environment");
+        }
         let query = format!(
             "DELETE FROM environment_providers WHERE provider_id = $1 RETURNING {PROVIDER_COLUMNS}"
         );
         let row = sqlx::query(sqlx::AssertSqlSafe(query))
             .bind(provider_id.as_str())
-            .fetch_optional(&self.pool)
+            .fetch_one(&mut *tx)
             .await
-            .map_err(map_provider_delete_error)?
-            .ok_or_else(|| not_found("environment_provider", provider_id))?;
+            .map_err(map_provider_delete_error)?;
+        tx.commit()
+            .await
+            .map_err(|error| sql_error("commit environment provider delete", error))?;
         provider_from_row(&row)
     }
 }
@@ -337,68 +305,53 @@ impl EnvironmentProviderBindingStore for PgStore {
         &self,
         request: PutEnvironmentProviderBinding,
     ) -> Result<EnvironmentProviderBindingRecord, EnvironmentRegistryError> {
-        if request.updated_at_ms < 0 {
-            return invalid("updated_at_ms must be nonnegative");
-        }
         let mut tx = self
             .pool
             .begin()
             .await
-            .map_err(|error| sql_error("begin binding put", error))?;
-        let existing = sqlx::query(
-            "SELECT revision, provider_id FROM environment_provider_bindings WHERE universe_id = $1 AND binding_id = $2 FOR UPDATE"
-        ).bind(request.universe_id).bind(request.binding_id.as_str()).fetch_optional(&mut *tx).await
-            .map_err(|error| sql_error("read provider binding revision", error))?;
-        let actual: Option<i64> = existing
-            .as_ref()
-            .map(|row| row.try_get("revision"))
-            .transpose()
-            .map_err(|error| sql_error("decode provider binding revision", error))?;
-        if let Some(row) = &existing {
-            let provider_id: String = row
-                .try_get("provider_id")
-                .map_err(|error| sql_error("decode provider binding provider", error))?;
-            if provider_id != request.provider_id.as_str() {
-                return invalid("provider_id is immutable for an existing binding");
-            }
-        }
-        let actual_u64 = actual.map(|value| value as u64);
-        if actual_u64 != request.expected_revision {
-            return Err(EnvironmentRegistryError::RevisionConflict {
-                kind: "environment_provider_binding",
-                id: request.binding_id.to_string(),
-                expected: request.expected_revision,
-                actual: actual_u64,
-            });
+            .map_err(|error| sql_error("begin provider binding put", error))?;
+        let provider: Option<String> = sqlx::query_scalar(
+            "SELECT provider_id FROM environment_providers WHERE provider_id = $1 FOR SHARE",
+        )
+        .bind(request.provider_id.as_str())
+        .fetch_optional(&mut *tx)
+        .await
+        .map_err(|error| sql_error("lock binding provider", error))?;
+        if provider.is_none() {
+            return Err(not_found("environment_provider", &request.provider_id));
         }
-        let revision = actual.unwrap_or(0) + 1;
+        let query = format!(
+            "SELECT {BINDING_COLUMNS} FROM environment_provider_bindings WHERE universe_id = $1 AND provider_id = $2 FOR UPDATE"
+        );
+        let existing = sqlx::query(sqlx::AssertSqlSafe(query))
+            .bind(request.universe_id)
+            .bind(request.provider_id.as_str())
+            .fetch_optional(&mut *tx)
+            .await
+            .map_err(|error| sql_error("lock provider binding", error))?
+            .and_then(|row| decoded_or_logged(binding_from_row(&row), "provider binding"));
+        let record = request.into_record(existing.as_ref())?;
         let query = format!(
             r#"
             INSERT INTO environment_provider_bindings (
-                universe_id, binding_id, provider_id, status, revision,
-                metadata_json, created_at_ms, updated_at_ms
-            ) VALUES ($1,$2,$3,$4,$5,$6,$7,$7)
-            ON CONFLICT (universe_id, binding_id) DO UPDATE SET
-                status = EXCLUDED.status,
-                metadata_json = EXCLUDED.metadata_json,
-                revision = EXCLUDED.revision, updated_at_ms = EXCLUDED.updated_at_ms
+                universe_id, provider_id, enabled, created_at_ms, updated_at_ms
+            ) VALUES ($1,$2,$3,$4,$5)
+            ON CONFLICT (universe_id, provider_id) DO UPDATE SET
+                enabled = EXCLUDED.enabled,
+                created_at_ms = EXCLUDED.created_at_ms,
+                updated_at_ms = EXCLUDED.updated_at_ms
             RETURNING {BINDING_COLUMNS}
-        "#
+            "#
         );
         let row = sqlx::query(sqlx::AssertSqlSafe(query))
-            .bind(request.universe_id)
-            .bind(request.binding_id.as_str())
-            .bind(request.provider_id.as_str())
-            .bind(binding_status_to_str(request.status))
-            .bind(revision)
-            .bind(json_value(
-                "encode provider binding metadata",
-                &request.metadata,
-            )?)
-            .bind(request.updated_at_ms)
+            .bind(record.universe_id)
+            .bind(record.provider_id.as_str())
+            .bind(record.enabled)
+            .bind(record.created_at_ms)
+            .bind(record.updated_at_ms)
             .fetch_one(&mut *tx)
             .await
-            .map_err(|error| map_binding_write_error("put provider binding", error))?;
+            .map_err(|error| map_binding_write_error(error, record.universe_id))?;
         tx.commit()
             .await
             .map_err(|error| sql_error("commit provider binding", error))?;
@@ -408,18 +361,18 @@ impl EnvironmentProviderBindingStore for PgStore {
     async fn read_provider_binding(
         &self,
         universe_id: Uuid,
-        binding_id: &EnvironmentProviderBindingId,
+        provider_id: &EnvironmentProviderId,
     ) -> Result<EnvironmentProviderBindingRecord, EnvironmentRegistryError> {
         let query = format!(
-            "SELECT {BINDING_COLUMNS} FROM environment_provider_bindings WHERE universe_id = $1 AND binding_id = $2"
+            "SELECT {BINDING_COLUMNS} FROM environment_provider_bindings WHERE universe_id = $1 AND provider_id = $2"
         );
         let row = sqlx::query(sqlx::AssertSqlSafe(query))
             .bind(universe_id)
-            .bind(binding_id.as_str())
+            .bind(provider_id.as_str())
             .fetch_optional(&self.pool)
             .await
             .map_err(|error| sql_error("read provider binding", error))?
-            .ok_or_else(|| not_found("environment_provider_binding", binding_id))?;
+            .ok_or_else(|| not_found("environment_provider_binding", provider_id))?;
         binding_from_row(&row)
     }
 
@@ -428,7 +381,7 @@ impl EnvironmentProviderBindingStore for PgStore {
         universe_id: Uuid,
     ) -> Result<Vec<EnvironmentProviderBindingRecord>, EnvironmentRegistryError> {
         let query = format!(
-            "SELECT {BINDING_COLUMNS} FROM environment_provider_bindings WHERE universe_id = $1 ORDER BY binding_id"
+            "SELECT {BINDING_COLUMNS} FROM environment_provider_bindings WHERE universe_id = $1 ORDER BY provider_id"
         );
         let rows = sqlx::query(sqlx::AssertSqlSafe(query))
             .bind(universe_id)
@@ -445,334 +398,242 @@ impl EnvironmentProviderBindingStore for PgStore {
     async fn delete_provider_binding(
         &self,
         universe_id: Uuid,
-        binding_id: &EnvironmentProviderBindingId,
+        provider_id: &EnvironmentProviderId,
     ) -> Result<EnvironmentProviderBindingRecord, EnvironmentRegistryError> {
+        let mut tx = self
+            .pool
+            .begin()
+            .await
+            .map_err(|error| sql_error("begin provider binding delete", error))?;
+        let query = format!(
+            "SELECT {BINDING_COLUMNS} FROM environment_provider_bindings WHERE universe_id = $1 AND provider_id = $2 FOR UPDATE"
+        );
+        sqlx::query(sqlx::AssertSqlSafe(query))
+            .bind(universe_id)
+            .bind(provider_id.as_str())
+            .fetch_optional(&mut *tx)
+            .await
+            .map_err(|error| sql_error("lock provider binding", error))?
+            .ok_or_else(|| not_found("environment_provider_binding", provider_id))?;
         let active: i64 = sqlx::query_scalar(
-            "SELECT count(*) FROM environments WHERE universe_id = $1 AND binding_id = $2 AND status <> 'closed'"
-        ).bind(universe_id).bind(binding_id.as_str()).fetch_one(&self.pool).await
-            .map_err(|error| sql_error("count binding environments", error))?;
+            "SELECT count(*) FROM environments WHERE universe_id = $1 AND provider_id = $2 AND state <> 'closed'",
+        )
+        .bind(universe_id)
+        .bind(provider_id.as_str())
+        .fetch_one(&mut *tx)
+        .await
+        .map_err(|error| sql_error("count binding environments", error))?;
         if active != 0 {
             return invalid("provider binding is referenced by a non-closed environment");
         }
         let query = format!(
-            "DELETE FROM environment_provider_bindings WHERE universe_id = $1 AND binding_id = $2 RETURNING {BINDING_COLUMNS}"
+            "DELETE FROM environment_provider_bindings WHERE universe_id = $1 AND provider_id = $2 RETURNING {BINDING_COLUMNS}"
         );
         let row = sqlx::query(sqlx::AssertSqlSafe(query))
             .bind(universe_id)
-            .bind(binding_id.as_str())
-            .fetch_optional(&self.pool)
+            .bind(provider_id.as_str())
+            .fetch_one(&mut *tx)
+            .await
+            .map_err(|error| sql_error("delete provider binding", error))?;
+        tx.commit()
             .await
-            .map_err(|error| sql_error("delete provider binding", error))?
-            .ok_or_else(|| not_found("environment_provider_binding", binding_id))?;
+            .map_err(|error| sql_error("commit provider binding delete", error))?;
         binding_from_row(&row)
     }
 }
 
-#[async_trait]
-impl EnvironmentStore for PgStore {
-    async fn create_environment(
+impl PgStore {
+    /// Apply one write to one environment: the row is locked, `change` runs
+    /// on a copy, and the copy is validated and written only when `change`
+    /// reports a change. Returns the current record and whether it changed.
+    async fn change_environment<F>(
         &self,
-        request: CreateEnvironment,
-    ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
-        self.ensure_universe()
-            .await
-            .map_err(|error| store_error("ensure universe", error))?;
-        if request.created_at_ms < 0 {
-            return invalid("environment timestamp must be nonnegative");
-        }
+        environment_id: &EnvironmentId,
+        action: &'static str,
+        change: F,
+    ) -> Result<(EnvironmentRecord, bool), EnvironmentRegistryError>
+    where
+        F: FnOnce(&mut EnvironmentRecord) -> Result<bool, EnvironmentRegistryError> + Send,
+    {
         let mut tx = self
             .pool
             .begin()
             .await
-            .map_err(|error| sql_error("begin environment create", error))?;
-        if let Some(existing_id) = sqlx::query_scalar::<_, String>(
-            "SELECT environment_id FROM environments WHERE universe_id = $1 AND request_id = $2",
-        )
-        .bind(self.config.universe_id)
-        .bind(request.request_id.as_str())
-        .fetch_optional(&mut *tx)
-        .await
-        .map_err(|error| sql_error("deduplicate environment create", error))?
-        {
-            tx.commit()
-                .await
-                .map_err(|error| sql_error("commit environment dedup", error))?;
-            let environment_id = EnvironmentId::try_new(existing_id)
-                .map_err(|error| store_message(format!("decode environment id: {error}")))?;
-            return self.read_environment(&environment_id).await;
+            .map_err(|error| sql_error(action, error))?;
+        let current = lock_environment(&mut tx, self.config.universe_id, environment_id).await?;
+        let mut candidate = current.clone();
+        if !change(&mut candidate)? {
+            return Ok((current, false));
         }
+        candidate.validate()?;
+        let columns = EnvironmentColumns::of(&candidate)?;
+        update_environment_row(&mut tx, self.config.universe_id, &candidate, columns)
+            .await
+            .map_err(|error| map_environment_write_error(action, error))?;
+        tx.commit()
+            .await
+            .map_err(|error| sql_error(action, error))?;
+        Ok((candidate, true))
+    }
+
+    async fn find_environment_by_request_id(
+        &self,
+        request_id: &EnvironmentProvisionRequestId,
+    ) -> Result<Option<EnvironmentRecord>, EnvironmentRegistryError> {
         let query = format!(
-            "SELECT {BINDING_COLUMNS} FROM environment_provider_bindings WHERE universe_id = $1 AND binding_id = $2 FOR UPDATE"
+            "SELECT {ENVIRONMENT_COLUMNS} {ENVIRONMENT_FROM} WHERE e.universe_id = $1 AND e.request_id = $2"
         );
-        let binding_row = sqlx::query(sqlx::AssertSqlSafe(query))
+        let row = sqlx::query(sqlx::AssertSqlSafe(query))
             .bind(self.config.universe_id)
-            .bind(request.binding_id.as_str())
-            .fetch_optional(&mut *tx)
+            .bind(request_id.as_str())
+            .fetch_optional(&self.pool)
             .await
-            .map_err(|error| sql_error("lock provider binding", error))?
-            .ok_or_else(|| not_found("environment_provider_binding", &request.binding_id))?;
-        let binding = binding_from_row(&binding_row)?;
-        if binding.status != EnvironmentProviderBindingStatus::Enabled {
-            return invalid("environment provider binding is disabled");
+            .map_err(|error| sql_error("read environment by request id", error))?;
+        row.as_ref().map(environment_from_row).transpose()
+    }
+
+    /// The stored row a retried create with `request_id` converges on:
+    /// itself when `matches` holds, otherwise `AlreadyExists`.
+    async fn converge_create(
+        &self,
+        request_id: &EnvironmentProvisionRequestId,
+        matches: impl FnOnce(&EnvironmentRecord) -> bool,
+    ) -> Result<Option<EnvironmentRecord>, EnvironmentRegistryError> {
+        match self.find_environment_by_request_id(request_id).await? {
+            None => Ok(None),
+            Some(existing) if matches(&existing) => Ok(Some(existing)),
+            Some(_) => Err(EnvironmentRegistryError::AlreadyExists {
+                kind: "environment_request",
+                id: request_id.to_string(),
+            }),
         }
-        request.record(binding.provider_id.clone())?;
-        sqlx::query(
-            r#"
-            INSERT INTO environments (
-                universe_id, environment_id, request_id, source_kind, provider_id, binding_id,
-                display_name, status, current_incarnation_id, metadata_json,
-                idle_policy_json, created_at_ms, updated_at_ms
-            ) VALUES ($1,$2,$3,'provisioned',$4,$5,$6,'provisioning',$7,$8,$9,$10,$10)
-        "#,
-        )
-        .bind(self.config.universe_id)
-        .bind(request.environment_id.as_str())
-        .bind(request.request_id.as_str())
-        .bind(binding.provider_id.as_str())
-        .bind(request.binding_id.as_str())
-        .bind(request.display_name.as_deref())
-        .bind(request.incarnation_id.as_str())
-        .bind(json_value(
-            "encode environment metadata",
-            &request.metadata,
-        )?)
-        .bind(
-            request
-                .idle_policy
-                .as_ref()
-                .map(|policy| json_value("encode idle policy", policy))
-                .transpose()?,
-        )
-        .bind(request.created_at_ms)
-        .execute(&mut *tx)
-        .await
-        .map_err(map_environment_insert_error)?;
-        sqlx::query(
-            r#"
-            INSERT INTO environment_incarnations (
-                universe_id, environment_id, incarnation_id, provision_request_id,
-                template_id, created_at_ms, updated_at_ms
-            ) VALUES ($1,$2,$3,$4,$5,$6,$6)
-        "#,
-        )
-        .bind(self.config.universe_id)
-        .bind(request.environment_id.as_str())
-        .bind(request.incarnation_id.as_str())
-        .bind(request.request_id.as_str())
-        .bind(request.template_id.as_str())
-        .bind(request.created_at_ms)
-        .execute(&mut *tx)
-        .await
-        .map_err(|error| sql_error("insert environment incarnation", error))?;
-        tx.commit()
+    }
+
+    /// Insert a provisioned or external row unless its request id is
+    /// already taken; a concurrent create with the same request id converges
+    /// like a retry.
+    async fn insert_requested_environment(
+        &self,
+        mut tx: Transaction<'_, Postgres>,
+        record: EnvironmentRecord,
+        matches: impl FnOnce(&EnvironmentRecord) -> bool,
+    ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
+        let columns = EnvironmentColumns::of(&record)?;
+        let inserted = insert_environment_row(&mut tx, self.config.universe_id, &record, columns)
             .await
-            .map_err(|error| sql_error("commit environment create", error))?;
-        self.read_environment(&request.environment_id).await
+            .map_err(|error| map_environment_write_error("insert environment", error))?;
+        if inserted {
+            tx.commit()
+                .await
+                .map_err(|error| sql_error("commit environment create", error))?;
+            return Ok(record);
+        }
+        drop(tx);
+        let request_id = record
+            .request_id
+            .as_ref()
+            .ok_or_else(|| store_message("environment insert conflicted without a request id"))?;
+        self.converge_create(request_id, matches)
+            .await?
+            .ok_or_else(|| store_message("conflicting environment request is gone"))
     }
+}
 
-    async fn adopt_environment(
+#[async_trait]
+impl EnvironmentStore for PgStore {
+    async fn create_environment(
         &self,
-        request: AdoptEnvironment,
+        request: CreateEnvironment,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
+        let record = request.record()?;
         self.ensure_universe()
             .await
             .map_err(|error| store_error("ensure universe", error))?;
-        if request.created_at_ms < 0 {
-            return invalid("environment timestamp must be nonnegative");
+        if let Some(existing) = self
+            .converge_create(&request.request_id, |existing| request.matches(existing))
+            .await?
+        {
+            return Ok(existing);
         }
         let mut tx = self
             .pool
             .begin()
             .await
-            .map_err(|error| sql_error("begin environment adoption", error))?;
-        if let Some(existing_id) = sqlx::query_scalar::<_, String>(
-            "SELECT environment_id FROM environments WHERE universe_id = $1 AND request_id = $2",
+            .map_err(|error| sql_error("begin environment create", error))?;
+        // Share-lock the binding so it cannot be deleted or disabled while
+        // the row that references it is inserted.
+        let enabled: Option<bool> = sqlx::query_scalar(
+            "SELECT enabled FROM environment_provider_bindings WHERE universe_id = $1 AND provider_id = $2 FOR SHARE",
         )
         .bind(self.config.universe_id)
-        .bind(request.request_id.as_str())
+        .bind(request.provider_id.as_str())
         .fetch_optional(&mut *tx)
         .await
-        .map_err(|error| sql_error("deduplicate environment adoption", error))?
-        {
-            tx.commit()
-                .await
-                .map_err(|error| sql_error("commit environment adoption dedup", error))?;
-            let environment_id = EnvironmentId::try_new(existing_id)
-                .map_err(|error| store_message(format!("decode environment id: {error}")))?;
-            return self.read_environment(&environment_id).await;
+        .map_err(|error| sql_error("lock provider binding", error))?;
+        match enabled {
+            None => {
+                return Err(not_found(
+                    "environment_provider_binding",
+                    &request.provider_id,
+                ));
+            }
+            Some(false) => return invalid("environment provider binding is disabled"),
+            Some(true) => {}
         }
-        let query = format!(
-            "SELECT {BINDING_COLUMNS} FROM environment_provider_bindings WHERE universe_id = $1 AND binding_id = $2 FOR UPDATE"
-        );
-        let binding_row = sqlx::query(sqlx::AssertSqlSafe(query))
-            .bind(self.config.universe_id)
-            .bind(request.binding_id.as_str())
-            .fetch_optional(&mut *tx)
+        self.insert_requested_environment(tx, record, |existing| request.matches(existing))
             .await
-            .map_err(|error| sql_error("lock provider binding for adoption", error))?
-            .ok_or_else(|| not_found("environment_provider_binding", &request.binding_id))?;
-        let binding = binding_from_row(&binding_row)?;
-        if binding.status != EnvironmentProviderBindingStatus::Enabled {
-            return invalid("environment provider binding is disabled");
-        }
-        request.record(binding.provider_id.clone())?;
-        sqlx::query(
-            r#"
-            INSERT INTO environments (
-                universe_id, environment_id, request_id, source_kind, provider_id, binding_id,
-                display_name, status, current_incarnation_id, metadata_json,
-                created_at_ms, updated_at_ms
-            ) VALUES ($1,$2,$3,'provisioned',$4,$5,$6,'provisioning',$7,$8,$9,$9)
-        "#,
-        )
-        .bind(self.config.universe_id)
-        .bind(request.environment_id.as_str())
-        .bind(request.request_id.as_str())
-        .bind(binding.provider_id.as_str())
-        .bind(request.binding_id.as_str())
-        .bind(request.display_name.as_deref())
-        .bind(request.incarnation_id.as_str())
-        .bind(json_value(
-            "encode environment metadata",
-            &request.metadata,
-        )?)
-        .bind(request.created_at_ms)
-        .execute(&mut *tx)
-        .await
-        .map_err(map_environment_insert_error)?;
-        sqlx::query(
-            r#"
-            INSERT INTO environment_incarnations (
-                universe_id, environment_id, incarnation_id, provision_request_id,
-                adoption_source_target, created_at_ms, updated_at_ms
-            ) VALUES ($1,$2,$3,$4,$5,$6,$6)
-        "#,
-        )
-        .bind(self.config.universe_id)
-        .bind(request.environment_id.as_str())
-        .bind(request.incarnation_id.as_str())
-        .bind(request.request_id.as_str())
-        .bind(&request.source_target)
-        .bind(request.created_at_ms)
-        .execute(&mut *tx)
-        .await
-        .map_err(|error| sql_error("insert adopted environment incarnation", error))?;
-        tx.commit()
-            .await
-            .map_err(|error| sql_error("commit environment adoption", error))?;
-        self.read_environment(&request.environment_id).await
     }
 
     async fn create_external_environment(
         &self,
         request: CreateExternalEnvironment,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
+        let record = request.record()?;
         self.ensure_universe()
             .await
             .map_err(|error| store_error("ensure universe", error))?;
-        if request.created_at_ms < 0 {
-            return invalid("environment timestamp must be nonnegative");
+        if let Some(existing) = self
+            .converge_create(&request.request_id, |existing| request.matches(existing))
+            .await?
+        {
+            return Ok(existing);
         }
-        request.record()?;
-        let mut tx = self
+        let tx = self
             .pool
             .begin()
             .await
             .map_err(|error| sql_error("begin external environment create", error))?;
-        if let Some(existing_id) = sqlx::query_scalar::<_, String>(
-            "SELECT environment_id FROM environments WHERE universe_id = $1 AND request_id = $2",
-        )
-        .bind(self.config.universe_id)
-        .bind(request.request_id.as_str())
-        .fetch_optional(&mut *tx)
-        .await
-        .map_err(|error| sql_error("deduplicate external environment create", error))?
-        {
-            tx.commit()
-                .await
-                .map_err(|error| sql_error("commit external environment dedup", error))?;
-            let environment_id = EnvironmentId::try_new(existing_id)
-                .map_err(|error| store_message(format!("decode environment id: {error}")))?;
-            return self.read_environment(&environment_id).await;
-        }
-        sqlx::query(
-            r#"
-            INSERT INTO environments (
-                universe_id, environment_id, request_id, source_kind, daemon_endpoint,
-                display_name, status, current_incarnation_id, metadata_json,
-                created_at_ms, updated_at_ms
-            ) VALUES ($1,$2,$3,'external',$4,$5,'ready',$6,$7,$8,$8)
-            "#,
-        )
-        .bind(self.config.universe_id)
-        .bind(request.environment_id.as_str())
-        .bind(request.request_id.as_str())
-        .bind(request.endpoint.as_str())
-        .bind(request.display_name.as_deref())
-        .bind(request.incarnation_id.as_str())
-        .bind(json_value(
-            "encode external environment metadata",
-            &request.metadata,
-        )?)
-        .bind(request.created_at_ms)
-        .execute(&mut *tx)
-        .await
-        .map_err(map_environment_insert_error)?;
-        sqlx::query(
-            r#"
-            INSERT INTO environment_incarnations (
-                universe_id, environment_id, incarnation_id, created_at_ms, updated_at_ms
-            ) VALUES ($1,$2,$3,$4,$4)
-            "#,
-        )
-        .bind(self.config.universe_id)
-        .bind(request.environment_id.as_str())
-        .bind(request.incarnation_id.as_str())
-        .bind(request.created_at_ms)
-        .execute(&mut *tx)
-        .await
-        .map_err(|error| sql_error("insert external environment incarnation", error))?;
-        tx.commit()
+        self.insert_requested_environment(tx, record, |existing| request.matches(existing))
             .await
-            .map_err(|error| sql_error("commit external environment create", error))?;
-        self.read_environment(&request.environment_id).await
     }
 
     async fn create_registered_environment(
         &self,
         request: CreateRegisteredEnvironment,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
+        if request.created_at_ms < 0 {
+            return invalid("created_at_ms must be nonnegative");
+        }
+        validate_daemon_public_key(&request.daemon_public_key)?;
         self.ensure_universe()
             .await
             .map_err(|error| store_error("ensure universe", error))?;
-        if request.created_at_ms < 0 {
-            return invalid("environment timestamp must be nonnegative");
+        // A known identity converges on its row, closed included: the
+        // identity is spent, and the caller refuses a closed one.
+        if let Some(existing) = self
+            .read_environment_by_daemon_public_key(&request.daemon_public_key)
+            .await?
+        {
+            return Ok(existing);
         }
-        let daemon_id = request.daemon_id()?;
-        let request_id = EnvironmentProvisionRequestId::for_daemon(&daemon_id);
         let mut tx = self
             .pool
             .begin()
             .await
             .map_err(|error| sql_error("begin registered environment create", error))?;
-        if let Some(existing_id) = sqlx::query_scalar::<_, String>(
-            "SELECT environment_id FROM environments WHERE universe_id = $1 AND request_id = $2",
-        )
-        .bind(self.config.universe_id)
-        .bind(request_id.as_str())
-        .fetch_optional(&mut *tx)
-        .await
-        .map_err(|error| sql_error("deduplicate registered environment create", error))?
-        {
-            tx.commit()
-                .await
-                .map_err(|error| sql_error("commit registered environment dedup", error))?;
-            let environment_id = EnvironmentId::try_new(existing_id)
-                .map_err(|error| store_message(format!("decode environment id: {error}")))?;
-            return self.read_environment(&environment_id).await;
-        }
         // Lock the key row: concurrent registrations against one key
-        // serialize here, so the count below is exact.
+        // serialize here, so the count below is exact. Rotation takes the
+        // same lock, so the secret check below sees every committed one.
         let key = crate::environment_registration::lock_registration_key(
             &mut tx,
             self.config.universe_id,
@@ -780,9 +641,27 @@ impl EnvironmentStore for PgStore {
         )
         .await?;
         key.check_admits(request.created_at_ms)?;
+        let live: bool = sqlx::query_scalar(
+            r#"
+            SELECT EXISTS (
+                SELECT 1 FROM environment_registration_key_secrets
+                WHERE universe_id = $1 AND registration_key_id = $2
+                  AND secret_hash = $3 AND retired_at_ms IS NULL
+            )
+            "#,
+        )
+        .bind(self.config.universe_id)
+        .bind(key.registration_key_id.as_str())
+        .bind(&request.secret_hash)
+        .fetch_one(&mut *tx)
+        .await
+        .map_err(|error| sql_error("check registration key secret", error))?;
+        if !live {
+            return Err(request.secret_retired());
+        }
         if let Some(limit) = key.max_active_environments {
             let active: i64 = sqlx::query_scalar(
-                "SELECT count(*) FROM environments WHERE universe_id = $1 AND registration_key_id = $2 AND status <> 'closed'",
+                "SELECT count(*) FROM environments WHERE universe_id = $1 AND registration_key_id = $2 AND state <> 'closed'",
             )
             .bind(self.config.universe_id)
             .bind(key.registration_key_id.as_str())
@@ -796,52 +675,52 @@ impl EnvironmentStore for PgStore {
                 });
             }
         }
-        request.record(&key)?;
-        sqlx::query(
-            r#"
-            INSERT INTO environments (
-                universe_id, environment_id, request_id, source_kind,
-                registration_key_id, daemon_id, daemon_public_key, identity_mode, last_seen_at_ms,
-                display_name, status, current_incarnation_id, metadata_json,
-                created_at_ms, updated_at_ms
-            ) VALUES ($1,$2,$3,'registered',$4,$5,$6,$7,$8,$9,'ready',$10,$11,$8,$8)
-            "#,
-        )
-        .bind(self.config.universe_id)
-        .bind(request.environment_id.as_str())
-        .bind(request_id.as_str())
-        .bind(key.registration_key_id.as_str())
-        .bind(daemon_id.as_str())
-        .bind(&request.daemon_public_key)
-        .bind(key.identity_mode.as_str())
-        .bind(request.created_at_ms)
-        .bind(request.display_name.as_deref())
-        .bind(request.incarnation_id.as_str())
-        .bind(json_value(
-            "encode registered environment metadata",
-            &request.metadata,
-        )?)
-        .execute(&mut *tx)
-        .await
-        .map_err(|error| map_registered_insert_error(error, &daemon_id))?;
-        sqlx::query(
-            r#"
-            INSERT INTO environment_incarnations (
-                universe_id, environment_id, incarnation_id, created_at_ms, updated_at_ms
-            ) VALUES ($1,$2,$3,$4,$4)
-            "#,
-        )
-        .bind(self.config.universe_id)
-        .bind(request.environment_id.as_str())
-        .bind(request.incarnation_id.as_str())
-        .bind(request.created_at_ms)
-        .execute(&mut *tx)
-        .await
-        .map_err(|error| sql_error("insert registered environment incarnation", error))?;
-        tx.commit()
+        let record = request.record(&key)?;
+        let columns = EnvironmentColumns::of(&record)?;
+        match insert_environment_row(&mut tx, self.config.universe_id, &record, columns).await {
+            Ok(_) => {
+                tx.commit()
+                    .await
+                    .map_err(|error| sql_error("commit registered environment create", error))?;
+                Ok(record)
+            }
+            Err(error) if constraint_of(&error) == Some("environments_daemon_public_key_idx") => {
+                drop(tx);
+                // A concurrent admission of the same identity in this
+                // universe won; elsewhere the identity belongs to another
+                // universe.
+                self.read_environment_by_daemon_public_key(&request.daemon_public_key)
+                    .await?
+                    .ok_or_else(|| EnvironmentRegistryError::AlreadyExists {
+                        kind: "daemon_identity",
+                        id: request
+                            .daemon_id()
+                            .map(|daemon_id| daemon_id.to_string())
+                            .unwrap_or_else(|_| request.daemon_public_key.clone()),
+                    })
+            }
+            Err(error) => Err(map_environment_write_error(
+                "insert registered environment",
+                error,
+            )),
+        }
+    }
+
+    async fn read_environment(
+        &self,
+        environment_id: &EnvironmentId,
+    ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
+        let query = format!(
+            "SELECT {ENVIRONMENT_COLUMNS} {ENVIRONMENT_FROM} WHERE e.universe_id = $1 AND e.environment_id = $2"
+        );
+        let row = sqlx::query(sqlx::AssertSqlSafe(query))
+            .bind(self.config.universe_id)
+            .bind(environment_id.as_str())
+            .fetch_optional(&self.pool)
             .await
-            .map_err(|error| sql_error("commit registered environment create", error))?;
-        self.read_environment(&request.environment_id).await
+            .map_err(|error| sql_error("read environment", error))?
+            .ok_or_else(|| not_found("environment", environment_id))?;
+        environment_from_row(&row)
     }
 
     async fn read_environment_by_daemon_public_key(
@@ -849,7 +728,7 @@ impl EnvironmentStore for PgStore {
         daemon_public_key: &str,
     ) -> Result<Option<EnvironmentRecord>, EnvironmentRegistryError> {
         let query = format!(
-            "SELECT {ENVIRONMENT_COLUMNS} {ENVIRONMENT_JOIN} WHERE e.universe_id = $1 AND e.daemon_public_key = $2"
+            "SELECT {ENVIRONMENT_COLUMNS} {ENVIRONMENT_FROM} WHERE e.universe_id = $1 AND e.daemon_public_key = $2"
         );
         let row = sqlx::query(sqlx::AssertSqlSafe(query))
             .bind(self.config.universe_id)
@@ -860,520 +739,487 @@ impl EnvironmentStore for PgStore {
         row.as_ref().map(environment_from_row).transpose()
     }
 
-    async fn observe_registered_environment(
+    async fn list_environments(
         &self,
-        request: ObserveRegisteredEnvironment,
-    ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
-        if request.observed_at_ms < 0 {
-            return invalid("observed_at_ms must be nonnegative");
+        request: ListEnvironments,
+    ) -> Result<EnvironmentPage, EnvironmentRegistryError> {
+        request.validate()?;
+        let mut query =
+            format!("SELECT {ENVIRONMENT_COLUMNS} {ENVIRONMENT_FROM} WHERE e.universe_id = $1");
+        let mut next = 2;
+        let mut parameter = |query: &mut String, predicate: &str| {
+            query.push_str(&format!(" AND {predicate}${next}"));
+            next += 1;
+        };
+        if request.provider_id.is_some() {
+            parameter(&mut query, "e.provider_id = ");
         }
-        let current = self.read_environment(&request.environment_id).await?;
-        // Validate the merged result before anything becomes durable: a
-        // build fact that breaks the record's bounds is refused here rather
-        // than poisoning the row for every later read.
-        let mut candidate = current.clone();
-        apply_registered_observation(
-            &mut candidate,
-            request.observation,
-            request.observed_at_ms,
-            request.metadata.clone(),
-        )?;
-        candidate.validate()?;
-        // One conditional statement rather than read-modify-write: a close
-        // that lands between a read and a write must never be overwritten
-        // by a late connect or disconnect observation.
-        let observation = match request.observation {
-            RegisteredConnectionObservation::Connected => "connected",
-            RegisteredConnectionObservation::Heartbeat => "heartbeat",
-            RegisteredConnectionObservation::Disconnected => "disconnected",
+        if request.registration_key_id.is_some() {
+            parameter(&mut query, "e.registration_key_id = ");
+        }
+        if request.state.is_some() {
+            parameter(&mut query, "e.state = ");
+        }
+        // Appended only when present so containment can use the GIN index.
+        if !request.metadata.is_empty() {
+            parameter(&mut query, "e.metadata_json @> ");
+        }
+        if request.after.is_some() {
+            parameter(&mut query, "e.environment_id > ");
+        }
+        if !request.include_closed && request.state != Some(EnvironmentState::Closed) {
+            query.push_str(" AND e.state <> 'closed'");
+        }
+        query.push_str(&format!(" ORDER BY e.environment_id LIMIT ${next}"));
+        let mut sql = sqlx::query(sqlx::AssertSqlSafe(query)).bind(self.config.universe_id);
+        if let Some(id) = &request.provider_id {
+            sql = sql.bind(id.as_str().to_owned());
+        }
+        if let Some(id) = &request.registration_key_id {
+            sql = sql.bind(id.as_str().to_owned());
+        }
+        if let Some(state) = request.state {
+            sql = sql.bind(state.as_str());
+        }
+        if !request.metadata.is_empty() {
+            sql = sql.bind(metadata_filter_json(&request.metadata));
+        }
+        if let Some(after) = &request.after {
+            sql = sql.bind(after.as_str().to_owned());
+        }
+        let limit = request.limit as usize;
+        // One row past the page tells whether another page follows.
+        let mut rows = sql
+            .bind(i64::from(request.limit) + 1)
+            .fetch_all(&self.pool)
+            .await
+            .map_err(|error| sql_error("list environments", error))?;
+        let next_after = if rows.len() > limit {
+            rows.truncate(limit);
+            rows.last()
+                .map(|row| parse_id(row, "environment_id", EnvironmentId::try_new))
+                .transpose()?
+        } else {
+            None
         };
-        sqlx::query(
-            r#"
-            UPDATE environments SET
-                status = CASE
-                    WHEN status IN ('closing', 'closed') THEN status
-                    WHEN $3 = 'connected' THEN 'ready'
-                    WHEN $3 = 'disconnected' THEN 'offline'
-                    ELSE status END,
-                last_seen_at_ms = CASE
-                    WHEN status IN ('closing', 'closed') THEN last_seen_at_ms
-                    WHEN $3 IN ('connected', 'heartbeat') THEN $4
-                    ELSE last_seen_at_ms END,
-                metadata_json = CASE
-                    WHEN status IN ('closing', 'closed') THEN metadata_json
-                    ELSE metadata_json || $5::jsonb END,
-                updated_at_ms = CASE
-                    WHEN status IN ('closing', 'closed') THEN updated_at_ms
-                    ELSE GREATEST(updated_at_ms, $4) END
-            WHERE universe_id = $1 AND environment_id = $2 AND source_kind = 'registered'
-            "#,
+        Ok(EnvironmentPage {
+            environments: decode_rows(&rows, environment_from_row, "environment"),
+            next_after,
+        })
+    }
+
+    async fn update_environment(
+        &self,
+        request: UpdateEnvironment,
+    ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
+        self.change_environment(&request.environment_id, "update environment", |record| {
+            request.apply(record)
+        })
+        .await
+        .map(|(record, _)| record)
+    }
+
+    async fn begin_close_environment(
+        &self,
+        request: BeginCloseEnvironment,
+    ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
+        self.change_environment(
+            &request.environment_id,
+            "begin environment close",
+            |record| request.apply(record),
         )
-        .bind(self.config.universe_id)
-        .bind(request.environment_id.as_str())
-        .bind(observation)
-        .bind(request.observed_at_ms)
-        .bind(json_value(
-            "encode daemon build metadata",
-            &request.metadata,
-        )?)
-        .execute(&self.pool)
         .await
-        .map_err(|error| sql_error("observe registered environment", error))?;
-        self.read_environment(&request.environment_id).await
+        .map(|(record, _)| record)
     }
 
-    async fn list_open_registered_environments(
+    async fn finish_close_environment(
         &self,
-    ) -> Result<Vec<EnvironmentRecord>, EnvironmentRegistryError> {
-        let query = format!(
-            "SELECT {ENVIRONMENT_COLUMNS} {ENVIRONMENT_JOIN} WHERE e.universe_id = $1 AND e.source_kind = 'registered' AND e.status NOT IN ('closing','closed') ORDER BY e.environment_id"
-        );
-        let rows = sqlx::query(sqlx::AssertSqlSafe(query))
-            .bind(self.config.universe_id)
-            .fetch_all(&self.pool)
-            .await
-            .map_err(|error| sql_error("list open registered environments", error))?;
-        Ok(decode_rows(&rows, environment_from_row, "environment"))
+        request: FinishCloseEnvironment,
+    ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
+        self.change_environment(
+            &request.environment_id,
+            "finish environment close",
+            |record| request.apply(record),
+        )
+        .await
+        .map(|(record, _)| record)
     }
 
-    async fn read_environment(
+    async fn mark_registered_connected(
         &self,
-        environment_id: &EnvironmentId,
+        request: MarkRegisteredConnected,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
-        read_environment_on(
-            &self.pool,
-            self.config.universe_id,
-            "e.environment_id = $2",
-            environment_id.as_str(),
-            "read environment",
+        self.change_environment(
+            &request.environment_id,
+            "mark registered environment connected",
+            |record| request.apply(record),
         )
         .await
+        .map(|(record, _)| record)
     }
 
-    async fn read_environment_by_request_id(
+    async fn mark_registered_disconnected(
         &self,
-        request_id: &EnvironmentProvisionRequestId,
+        request: MarkRegisteredDisconnected,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
-        read_environment_on(
-            &self.pool,
-            self.config.universe_id,
-            "e.request_id = $2",
-            request_id.as_str(),
-            "read environment request",
+        self.change_environment(
+            &request.environment_id,
+            "mark registered environment disconnected",
+            |record| request.apply(record),
         )
         .await
+        .map(|(record, _)| record)
     }
 
-    async fn list_environments(
+    async fn stamp_registered_seen(
         &self,
-        request: ListEnvironments,
-    ) -> Result<Vec<EnvironmentRecord>, EnvironmentRegistryError> {
-        let mut query =
-            format!("SELECT {ENVIRONMENT_COLUMNS} {ENVIRONMENT_JOIN} WHERE e.universe_id = $1");
-        let mut next = 2;
-        if request.provider_id.is_some() {
-            query.push_str(&format!(" AND e.provider_id = ${next}"));
-            next += 1;
-        }
-        if request.binding_id.is_some() {
-            query.push_str(&format!(" AND e.binding_id = ${next}"));
-            next += 1;
-        }
-        if request.status.is_some() {
-            query.push_str(&format!(" AND e.status = ${next}"));
-            next += 1;
-        }
-        if request.registration_key_id.is_some() {
-            query.push_str(&format!(" AND e.registration_key_id = ${next}"));
-            next += 1;
-        }
-        // Appended only when present so containment can use the GIN index.
-        if !request.metadata.is_empty() {
-            query.push_str(&format!(" AND e.metadata_json @> ${next}"));
-        }
-        query.push_str(" ORDER BY e.environment_id");
-        let mut sql = sqlx::query(sqlx::AssertSqlSafe(query)).bind(self.config.universe_id);
-        if let Some(id) = request.provider_id {
-            sql = sql.bind(id.to_string());
+        request: StampRegisteredSeen,
+    ) -> Result<bool, EnvironmentRegistryError> {
+        if request.at_ms < 0 {
+            return invalid("at_ms must be nonnegative");
         }
-        if let Some(id) = request.binding_id {
-            sql = sql.bind(id.to_string());
-        }
-        if let Some(status) = request.status {
-            sql = sql.bind(environment_status_to_str(status));
+        // One round trip: the stamp is conditional, and the row's kind
+        // tells a skipped stamp from a missing or non-registered row.
+        let row = sqlx::query(
+            r#"
+            WITH target AS (
+                SELECT source_kind FROM environments
+                WHERE universe_id = $1 AND environment_id = $2
+            ), stamped AS (
+                UPDATE environments SET
+                    last_seen_at_ms = $3,
+                    updated_at_ms = GREATEST(updated_at_ms, $3)
+                WHERE universe_id = $1 AND environment_id = $2
+                  AND source_kind = 'registered' AND state = 'open' AND connected
+                  AND last_seen_at_ms <= $4
+                RETURNING 1
+            )
+            SELECT (SELECT source_kind FROM target) AS source_kind,
+                   EXISTS (SELECT 1 FROM stamped) AS stamped
+            "#,
+        )
+        .bind(self.config.universe_id)
+        .bind(request.environment_id.as_str())
+        .bind(request.at_ms)
+        .bind(request.at_ms.saturating_sub(REGISTERED_LIVENESS_STAMP_MS))
+        .fetch_one(&self.pool)
+        .await
+        .map_err(|error| sql_error("stamp registered environment", error))?;
+        let source_kind: Option<String> = row
+            .try_get("source_kind")
+            .map_err(|error| sql_error("decode stamped source kind", error))?;
+        match source_kind.as_deref() {
+            None => Err(not_found("environment", &request.environment_id)),
+            Some("registered") => row
+                .try_get("stamped")
+                .map_err(|error| sql_error("decode stamp result", error)),
+            Some(_) => invalid("connection writes apply only to registered environments"),
         }
-        if let Some(id) = request.registration_key_id {
-            sql = sql.bind(id.to_string());
+    }
+
+    async fn sweep_registered_environments(
+        &self,
+        now_ms: i64,
+    ) -> Result<RegisteredSweep, EnvironmentRegistryError> {
+        // Only rows one of the three sweep rules can move; the rules
+        // themselves run in the domain, under the row lock. A connected row
+        // can close only after rule 1 marks it disconnected, so rule 1
+        // covers it.
+        let candidates: Vec<(String, String)> = sqlx::query_as(
+            r#"
+            SELECT e.environment_id, e.registration_key_id
+            FROM environments e
+            JOIN environment_registration_keys k
+              ON k.universe_id = e.universe_id AND k.registration_key_id = e.registration_key_id
+            WHERE e.universe_id = $1 AND e.source_kind = 'registered' AND e.state = 'open'
+              AND (
+                (e.connected AND e.last_seen_at_ms < $2 - $3)
+                OR (
+                    NOT e.connected AND k.identity_mode = 'ephemeral'
+                    AND e.connection_changed_at_ms < $2 - COALESCE(k.ephemeral_disconnect_grace_ms, $4)
+                )
+                OR (
+                    NOT e.connected AND k.identity_mode = 'persistent'
+                    AND k.offline_close_after_ms IS NOT NULL
+                    AND e.connection_changed_at_ms < $2 - k.offline_close_after_ms
+                )
+              )
+            ORDER BY e.environment_id
+            "#,
+        )
+        .bind(self.config.universe_id)
+        .bind(now_ms)
+        .bind(REGISTERED_STALE_AFTER_MS)
+        .bind(i64::try_from(DEFAULT_EPHEMERAL_DISCONNECT_GRACE_MS).unwrap_or(i64::MAX))
+        .fetch_all(&self.pool)
+        .await
+        .map_err(|error| sql_error("list registered sweep candidates", error))?;
+        let mut keys: HashMap<String, EnvironmentRegistrationKeyRecord> = HashMap::new();
+        let mut sweep = RegisteredSweep::default();
+        for (environment_id, registration_key_id) in candidates {
+            let key = match keys.get(&registration_key_id) {
+                Some(key) => key.clone(),
+                None => {
+                    let id = EnvironmentRegistrationKeyId::try_new(registration_key_id.clone())
+                        .map_err(|error| {
+                            store_message(format!("decode registration key id: {error}"))
+                        })?;
+                    let key = self.read_registration_key(&id).await?;
+                    keys.insert(registration_key_id, key.clone());
+                    key
+                }
+            };
+            let environment_id = EnvironmentId::try_new(environment_id)
+                .map_err(|error| store_message(format!("decode environment id: {error}")))?;
+            let mut outcome = (false, None);
+            let changed = self
+                .change_environment(&environment_id, "sweep registered environment", |record| {
+                    outcome = sweep_registered_environment(record, &key, now_ms);
+                    Ok(outcome.0 || outcome.1.is_some())
+                })
+                .await;
+            if let Err(error) = changed {
+                tracing::error!(%error, environment_id = %environment_id, "registered sweep skipped a row");
+                continue;
+            }
+            if outcome.0 {
+                sweep.disconnected.push(environment_id.clone());
+            }
+            if let Some(reason) = outcome.1 {
+                sweep.closed.push((environment_id, reason));
+            }
         }
-        if !request.metadata.is_empty() {
-            sql = sql.bind(metadata_filter_json(&request.metadata));
+        Ok(sweep)
+    }
+
+    async fn repair_registered_connections(
+        &self,
+        now_ms: i64,
+    ) -> Result<u64, EnvironmentRegistryError> {
+        if now_ms < 0 {
+            return invalid("now_ms must be nonnegative");
         }
-        let rows = sql
-            .fetch_all(&self.pool)
+        repair_connections(&self.pool, Some(self.config.universe_id), now_ms)
             .await
-            .map_err(|error| sql_error("list environments", error))?;
-        Ok(decode_rows(&rows, environment_from_row, "environment"))
+            .map_err(|error| sql_error("repair registered connections", error))
     }
 
-    async fn list_environments_needing_reconcile(
+    async fn list_environment_work(
         &self,
-        scope: ReconcileScope,
+        now_ms: i64,
+        limit: u32,
     ) -> Result<Vec<EnvironmentRecord>, EnvironmentRegistryError> {
-        let query = match scope {
-            ReconcileScope::Converging => format!(
-                "SELECT {ENVIRONMENT_COLUMNS} {ENVIRONMENT_JOIN} WHERE e.universe_id = $1 AND {CONVERGING_SQL} ORDER BY e.updated_at_ms, e.environment_id"
-            ),
-            ReconcileScope::WithSteady => format!(
-                "SELECT {ENVIRONMENT_COLUMNS} {ENVIRONMENT_JOIN} WHERE e.universe_id = $1 AND ({CONVERGING_SQL} OR ({STEADY_SQL} AND i.provider_target_id IS NOT NULL)) ORDER BY e.updated_at_ms, e.environment_id"
-            ),
-        };
+        let query = format!(
+            "SELECT {ENVIRONMENT_COLUMNS} {ENVIRONMENT_FROM} WHERE e.universe_id = $1 AND e.next_attempt_at_ms <= $2 ORDER BY e.next_attempt_at_ms, e.environment_id LIMIT $3"
+        );
         let rows = sqlx::query(sqlx::AssertSqlSafe(query))
             .bind(self.config.universe_id)
+            .bind(now_ms)
+            .bind(i64::from(limit))
             .fetch_all(&self.pool)
             .await
-            .map_err(|error| sql_error("list environments needing reconcile", error))?;
+            .map_err(|error| sql_error("list environment work", error))?;
         Ok(decode_rows(&rows, environment_from_row, "environment"))
     }
 
-    async fn list_environments_with_idle_policy(
+    async fn list_open_provisioned_environments(
         &self,
     ) -> Result<Vec<EnvironmentRecord>, EnvironmentRegistryError> {
         let query = format!(
-            "SELECT {ENVIRONMENT_COLUMNS} {ENVIRONMENT_JOIN} WHERE e.universe_id = $1 AND e.status = 'ready' AND e.idle_policy_json IS NOT NULL ORDER BY e.updated_at_ms, e.environment_id"
+            "SELECT {ENVIRONMENT_COLUMNS} {ENVIRONMENT_FROM} WHERE e.universe_id = $1 AND e.source_kind = 'provisioned' AND e.state = 'open' ORDER BY e.environment_id"
         );
         let rows = sqlx::query(sqlx::AssertSqlSafe(query))
             .bind(self.config.universe_id)
             .fetch_all(&self.pool)
             .await
-            .map_err(|error| sql_error("list environments with idle policy", error))?;
+            .map_err(|error| sql_error("list open provisioned environments", error))?;
         Ok(decode_rows(&rows, environment_from_row, "environment"))
     }
 
-    async fn observe_provisioned_environment(
+    async fn record_target_observation(
         &self,
-        request: ObserveProvisionedEnvironment,
+        request: RecordTargetObservation,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
-        let current = self.read_environment(&request.environment_id).await?;
-        let mut candidate = current.clone();
-        request.apply(&mut candidate)?;
-        candidate.validate()?;
-        if candidate == current {
-            return Ok(current);
-        }
-        let mut tx = self
-            .pool
-            .begin()
-            .await
-            .map_err(|error| sql_error("begin environment observation", error))?;
-        // The target id and power states are recorded whatever the status,
-        // so a close that raced the first create can still address the
-        // target; the predicates refuse stale and conflicting observations
-        // that raced this one.
-        sqlx::query(
-            r#"
-            UPDATE environment_incarnations SET
-                provider_target_id = COALESCE($4, provider_target_id),
-                power_states_json = $5,
-                updated_at_ms = $6
-            WHERE universe_id = $1 AND environment_id = $2 AND incarnation_id = $3
-              AND updated_at_ms <= $6
-              AND ($4::text IS NULL OR provider_target_id IS NULL OR provider_target_id = $4)
-            "#,
-        )
-        .bind(self.config.universe_id)
-        .bind(request.environment_id.as_str())
-        .bind(current.incarnation.incarnation_id.as_str())
-        .bind(
-            request
-                .provider_target_id
-                .as_ref()
-                .map(ProviderTargetId::as_str),
-        )
-        .bind(json_value("encode power states", &request.power_states)?)
-        .bind(request.observed_at_ms)
-        .execute(&mut *tx)
-        .await
-        .map_err(|error| sql_error("observe environment incarnation", error))?;
-        // A close accepted while this observation was in flight wins.
-        sqlx::query(
-            r#"
-            UPDATE environments SET
-                status = $3,
-                metadata_json = metadata_json || $4,
-                lifecycle_error = CASE WHEN $5 THEN NULL ELSE lifecycle_error END,
-                lifecycle_error_first_at_ms =
-                    CASE WHEN $5 THEN NULL ELSE lifecycle_error_first_at_ms END,
-                lifecycle_error_last_at_ms =
-                    CASE WHEN $5 THEN NULL ELSE lifecycle_error_last_at_ms END,
-                updated_at_ms = GREATEST(updated_at_ms, $6)
-            WHERE universe_id = $1 AND environment_id = $2
-              AND status NOT IN ('closing', 'closed')
-            "#,
+        self.change_environment(
+            &request.environment_id,
+            "record target observation",
+            |record| request.apply(record),
         )
-        .bind(self.config.universe_id)
-        .bind(request.environment_id.as_str())
-        .bind(environment_status_to_str(request.status))
-        .bind(json_value(
-            "encode daemon build metadata",
-            &request
-                .daemon_build
-                .as_ref()
-                .map(|build| build.metadata())
-                .unwrap_or_default(),
-        )?)
-        .bind(request.status.power_state().is_some())
-        .bind(request.observed_at_ms)
-        .execute(&mut *tx)
         .await
-        .map_err(|error| sql_error("observe environment", error))?;
-        tx.commit()
-            .await
-            .map_err(|error| sql_error("commit environment observation", error))?;
-        self.read_environment(&request.environment_id).await
+        .map(|(record, _)| record)
     }
 
-    async fn fail_environment_lifecycle(
+    async fn schedule_environment_attempt(
         &self,
-        request: FailEnvironmentLifecycle,
+        request: ScheduleEnvironmentAttempt,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
-        let current = self.read_environment(&request.environment_id).await?;
-        let mut candidate = current.clone();
-        request.apply(&mut candidate)?;
-        candidate.validate()?;
-        let Some(error) = candidate
-            .lifecycle_error
-            .as_ref()
-            .filter(|_| candidate != current)
-        else {
-            return Ok(current);
-        };
-        let mut tx = self
-            .pool
-            .begin()
-            .await
-            .map_err(|error| sql_error("begin environment failure", error))?;
-        let failed = sqlx::query(
-            r#"
-            UPDATE environments SET
-                status = 'failed',
-                lifecycle_error = $3,
-                lifecycle_error_first_at_ms = LEAST(COALESCE(lifecycle_error_first_at_ms, $4), $4),
-                lifecycle_error_last_at_ms = $4,
-                metadata_json = metadata_json || $5,
-                updated_at_ms = GREATEST(updated_at_ms, $4)
-            WHERE universe_id = $1 AND environment_id = $2
-              AND status NOT IN ('closing', 'closed')
-            "#,
+        self.change_environment(
+            &request.environment_id,
+            "schedule environment attempt",
+            |record| request.apply(record),
         )
-        .bind(self.config.universe_id)
-        .bind(request.environment_id.as_str())
-        .bind(&error.message)
-        .bind(request.observed_at_ms)
-        .bind(json_value(
-            "encode daemon build metadata",
-            &request
-                .daemon_build
-                .as_ref()
-                .map(|build| build.metadata())
-                .unwrap_or_default(),
-        )?)
-        .execute(&mut *tx)
         .await
-        .map_err(|error| sql_error("fail environment", error))?;
-        if failed.rows_affected() == 1 {
-            // Observations older than the failure are stale from now on.
-            sqlx::query(
-                "UPDATE environment_incarnations SET updated_at_ms = GREATEST(updated_at_ms, $4) WHERE universe_id = $1 AND environment_id = $2 AND incarnation_id = $3",
-            )
-            .bind(self.config.universe_id)
-            .bind(request.environment_id.as_str())
-            .bind(current.incarnation.incarnation_id.as_str())
-            .bind(request.observed_at_ms)
-            .execute(&mut *tx)
-            .await
-            .map_err(|error| sql_error("fail environment incarnation", error))?;
-        }
-        tx.commit()
-            .await
-            .map_err(|error| sql_error("commit environment failure", error))?;
-        self.read_environment(&request.environment_id).await
+        .map(|(record, _)| record)
     }
 
-    async fn record_environment_lifecycle_error(
+    async fn open_environment(
         &self,
-        request: RecordEnvironmentLifecycleError,
+        request: OpenEnvironment,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
-        let current = self.read_environment(&request.environment_id).await?;
-        let mut candidate = current.clone();
-        request.apply(&mut candidate)?;
-        candidate.validate()?;
-        let Some(error) = candidate
-            .lifecycle_error
-            .as_ref()
-            .filter(|_| candidate != current)
-        else {
-            return Ok(current);
-        };
-        sqlx::query(
-            r#"
-            UPDATE environments SET
-                lifecycle_error = $3,
-                lifecycle_error_first_at_ms = LEAST(COALESCE(lifecycle_error_first_at_ms, $4), $4),
-                lifecycle_error_last_at_ms = $4,
-                updated_at_ms = GREATEST(updated_at_ms, $4)
-            WHERE universe_id = $1 AND environment_id = $2 AND status <> 'closed'
-            "#,
-        )
-        .bind(self.config.universe_id)
-        .bind(request.environment_id.as_str())
-        .bind(&error.message)
-        .bind(request.observed_at_ms)
-        .execute(&self.pool)
+        self.change_environment(&request.environment_id, "open environment", |record| {
+            request.apply(record)
+        })
         .await
-        .map_err(|error| sql_error("record environment lifecycle error", error))?;
-        self.read_environment(&request.environment_id).await
+        .map(|(record, _)| record)
     }
 
-    async fn begin_close_environment(
+    async fn fail_environment(
         &self,
-        request: BeginCloseEnvironment,
+        request: FailEnvironment,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
-        sqlx::query("UPDATE environments SET status=CASE WHEN status='closed' THEN status ELSE 'closing' END, updated_at_ms=GREATEST(updated_at_ms,$3) WHERE universe_id=$1 AND environment_id=$2")
-            .bind(self.config.universe_id).bind(request.environment_id.as_str()).bind(request.updated_at_ms)
-            .execute(&self.pool).await.map_err(|error| sql_error("begin environment close", error))?;
-        self.read_environment(&request.environment_id).await
+        self.change_environment(&request.environment_id, "fail environment", |record| {
+            request.apply(record)
+        })
+        .await
+        .map(|(record, _)| record)
     }
 
-    async fn finish_close_environment(
+    async fn end_provisioned_environment(
         &self,
-        request: FinishCloseEnvironment,
+        request: EndProvisionedEnvironment,
     ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
-        let current = self.read_environment(&request.environment_id).await?;
-        let mut tx = self
-            .pool
-            .begin()
-            .await
-            .map_err(|error| sql_error("begin finish close", error))?;
-        sqlx::query("UPDATE environment_incarnations SET updated_at_ms=$4 WHERE universe_id=$1 AND environment_id=$2 AND incarnation_id=$3")
-            .bind(self.config.universe_id).bind(request.environment_id.as_str()).bind(current.incarnation.incarnation_id.as_str()).bind(request.observed_at_ms)
-            .execute(&mut *tx).await.map_err(|error| sql_error("close environment incarnation", error))?;
-        sqlx::query("UPDATE environments SET status='closed', public_ingress_enabled=false, public_endpoint=NULL, updated_at_ms=$3 WHERE universe_id=$1 AND environment_id=$2")
-            .bind(self.config.universe_id).bind(request.environment_id.as_str()).bind(request.observed_at_ms)
-            .execute(&mut *tx).await.map_err(|error| sql_error("finish environment close", error))?;
-        tx.commit()
-            .await
-            .map_err(|error| sql_error("commit environment close", error))?;
-        self.read_environment(&request.environment_id).await
+        self.change_environment(
+            &request.environment_id,
+            "end provisioned environment",
+            |record| request.apply(record),
+        )
+        .await
+        .map(|(record, _)| record)
     }
+}
 
-    async fn set_environment_ingress(
-        &self,
-        request: SetEnvironmentIngress,
-    ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
-        validate_ingress_request_time(request.updated_at_ms)?;
-        let environment = self.read_environment(&request.environment_id).await?;
-        if !matches!(environment.source, EnvironmentSource::Provisioned { .. }) {
-            return invalid_store("provider-managed ingress requires a provisioned environment");
-        }
-        if request.enabled && environment.status.is_closing_or_closed() {
-            return invalid_store("cannot enable ingress for a closing environment");
-        }
-        EnvironmentRecord {
-            public_ingress_enabled: request.enabled,
-            ..environment
-        }
-        .validate()?;
-        // Enabling never revives a close accepted in the meantime.
-        sqlx::query("UPDATE environments SET public_ingress_enabled=$3, updated_at_ms=GREATEST(updated_at_ms,$4) WHERE universe_id=$1 AND environment_id=$2 AND (NOT $3 OR status NOT IN ('closing','closed'))")
-            .bind(self.config.universe_id)
-            .bind(request.environment_id.as_str())
-            .bind(request.enabled)
-            .bind(request.updated_at_ms)
-            .execute(&self.pool).await.map_err(|error| sql_error("set environment ingress", error))?;
-        self.read_environment(&request.environment_id).await
-    }
+/// Connected registered rows become disconnected as of `now_ms`, in one
+/// universe or in all of them.
+async fn repair_connections(
+    pool: &PgPool,
+    universe_id: Option<Uuid>,
+    now_ms: i64,
+) -> Result<u64, sqlx::Error> {
+    let result = sqlx::query(
+        r#"
+        UPDATE environments SET
+            connected = false,
+            connection_changed_at_ms = $2,
+            updated_at_ms = GREATEST(updated_at_ms, $2)
+        WHERE ($1::uuid IS NULL OR universe_id = $1)
+          AND source_kind = 'registered' AND connected
+        "#,
+    )
+    .bind(universe_id)
+    .bind(now_ms)
+    .execute(pool)
+    .await?;
+    Ok(result.rows_affected())
+}
 
-    async fn record_environment_ingress(
-        &self,
-        request: RecordEnvironmentIngress,
-    ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
-        let current = self.read_environment(&request.environment_id).await?;
-        let mut candidate = current.clone();
-        request.apply(&mut candidate)?;
-        candidate.validate()?;
-        if candidate == current {
-            return Ok(current);
-        }
-        // A close accepted while this observation was in flight wins.
-        sqlx::query("UPDATE environments SET public_endpoint=$3, updated_at_ms=GREATEST(updated_at_ms,$4) WHERE universe_id=$1 AND environment_id=$2 AND status NOT IN ('closing','closed')")
-            .bind(self.config.universe_id)
-            .bind(request.environment_id.as_str())
-            .bind(request.public_endpoint)
-            .bind(request.observed_at_ms)
-            .execute(&self.pool).await.map_err(|error| sql_error("record environment ingress", error))?;
-        self.read_environment(&request.environment_id).await
-    }
+// ---------------------------------------------------------------------------
+// Deployment-level functions: the environment-gateway role's loops run
+// these across universes before they pick a universe-scoped store.
+// ---------------------------------------------------------------------------
 
-    async fn set_environment_power(
-        &self,
-        request: SetEnvironmentPower,
-    ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
-        validate_ingress_request_time(request.updated_at_ms)?;
-        let environment = self.read_environment(&request.environment_id).await?;
-        check_power_mutable(&environment)?;
-        EnvironmentRecord {
-            desired_power: request.desired_power,
-            ..environment
-        }
-        .validate()?;
-        sqlx::query("UPDATE environments SET desired_power=$3, updated_at_ms=GREATEST(updated_at_ms,$4) WHERE universe_id=$1 AND environment_id=$2")
-            .bind(self.config.universe_id)
-            .bind(request.environment_id.as_str())
-            .bind(request.desired_power.as_str())
-            .bind(request.updated_at_ms)
-            .execute(&self.pool).await.map_err(|error| sql_error("set environment power", error))?;
-        self.read_environment(&request.environment_id).await
-    }
+/// Universes holding provisioned rows whose next attempt is due at `now_ms`.
+pub async fn list_universes_with_environment_work(
+    pool: &PgPool,
+    now_ms: i64,
+) -> Result<Vec<Uuid>, PgStoreError> {
+    list_universes(
+        pool,
+        "SELECT DISTINCT universe_id FROM environments WHERE next_attempt_at_ms <= $1 ORDER BY universe_id",
+        Some(now_ms),
+    )
+    .await
+}
 
-    async fn set_environment_idle_policy(
-        &self,
-        request: SetEnvironmentIdlePolicy,
-    ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
-        validate_ingress_request_time(request.updated_at_ms)?;
-        if let Some(policy) = &request.idle_policy {
-            policy.validate()?;
-        }
-        let environment = self.read_environment(&request.environment_id).await?;
-        check_power_mutable(&environment)?;
-        EnvironmentRecord {
-            idle_policy: request.idle_policy.clone(),
-            ..environment
-        }
-        .validate()?;
-        sqlx::query("UPDATE environments SET idle_policy_json=$3, updated_at_ms=GREATEST(updated_at_ms,$4) WHERE universe_id=$1 AND environment_id=$2")
-            .bind(self.config.universe_id)
-            .bind(request.environment_id.as_str())
-            .bind(
-                request
-                    .idle_policy
-                    .as_ref()
-                    .map(|policy| json_value("encode idle policy", policy))
-                    .transpose()?,
-            )
-            .bind(request.updated_at_ms)
-            .execute(&self.pool).await.map_err(|error| sql_error("set environment idle policy", error))?;
-        self.read_environment(&request.environment_id).await
-    }
+/// Universes holding open provisioned rows: the display sweep's scan set.
+pub async fn list_universes_with_open_provisioned_environments(
+    pool: &PgPool,
+) -> Result<Vec<Uuid>, PgStoreError> {
+    list_universes(
+        pool,
+        "SELECT DISTINCT universe_id FROM environments WHERE source_kind = 'provisioned' AND state = 'open' ORDER BY universe_id",
+        None,
+    )
+    .await
+}
+
+/// Universes holding open registered rows (a registered row is only ever
+/// `open` or `closed`): the registered sweep's scan set.
+pub async fn list_universes_with_registered_environments(
+    pool: &PgPool,
+) -> Result<Vec<Uuid>, PgStoreError> {
+    list_universes(
+        pool,
+        "SELECT DISTINCT universe_id FROM environments WHERE source_kind = 'registered' AND state = 'open' ORDER BY universe_id",
+        None,
+    )
+    .await
 }
 
-fn check_power_mutable(record: &EnvironmentRecord) -> Result<(), EnvironmentRegistryError> {
-    if !matches!(record.source, EnvironmentSource::Provisioned { .. }) {
-        return invalid_store("only provisioned environments have power control");
+async fn list_universes(
+    pool: &PgPool,
+    query: &'static str,
+    now_ms: Option<i64>,
+) -> Result<Vec<Uuid>, PgStoreError> {
+    let mut sql = sqlx::query_as::<_, (Uuid,)>(query);
+    if let Some(now_ms) = now_ms {
+        sql = sql.bind(now_ms);
     }
-    if record.status.is_closing_or_closed() || record.status == EnvironmentStatus::Failed {
-        return invalid_store("cannot change power of a closing, closed, or failed environment");
+    let rows = sql.fetch_all(pool).await?;
+    Ok(rows.into_iter().map(|(universe_id,)| universe_id).collect())
+}
+
+/// At gateway startup, in every universe: connected registered rows become
+/// disconnected with `connection_changed_at_ms = now_ms`, since the
+/// connections the previous gateway held ended now, and persistent rows get
+/// their full reconnect wait while their daemons reconnect.
+/// `last_seen_at_ms` is kept. Assumes a single gateway replica.
+pub async fn repair_registered_connections(
+    pool: &PgPool,
+    now_ms: i64,
+) -> Result<u64, PgStoreError> {
+    Ok(repair_connections(pool, None, now_ms).await?)
+}
+
+/// Of `keys` (universe, environment id), those whose live routes must end:
+/// the row is gone or not `open`, or it is provisioned and its universe's
+/// binding of the provider is missing or disabled.
+pub async fn list_revoked_environment_routes(
+    pool: &PgPool,
+    keys: &[(Uuid, String)],
+) -> Result<Vec<(Uuid, String)>, PgStoreError> {
+    if keys.is_empty() {
+        return Ok(Vec::new());
     }
-    Ok(())
+    let (universes, environments): (Vec<Uuid>, Vec<String>) = keys.iter().cloned().unzip();
+    let rows: Vec<(Uuid, String)> = sqlx::query_as(
+        r#"
+        SELECT route.universe_id, route.environment_id
+        FROM unnest($1::uuid[], $2::text[]) AS route (universe_id, environment_id)
+        LEFT JOIN environments e
+          ON e.universe_id = route.universe_id AND e.environment_id = route.environment_id
+        LEFT JOIN environment_provider_bindings b
+          ON b.universe_id = e.universe_id AND b.provider_id = e.provider_id
+        WHERE e.environment_id IS NULL
+           OR e.state <> 'open'
+           OR (e.source_kind = 'provisioned' AND (b.provider_id IS NULL OR NOT b.enabled))
+        ORDER BY route.universe_id, route.environment_id
+        "#,
+    )
+    .bind(universes)
+    .bind(environments)
+    .fetch_all(pool)
+    .await?;
+    Ok(rows)
 }
 
 #[async_trait]
@@ -1455,55 +1301,272 @@ impl EnvironmentCredentialStore for PgStore {
     }
 }
 
-async fn read_environment_on(
-    pool: &sqlx::PgPool,
+// ---------------------------------------------------------------------------
+// Rows
+// ---------------------------------------------------------------------------
+
+async fn lock_environment(
+    tx: &mut Transaction<'_, Postgres>,
     universe_id: Uuid,
-    predicate: &'static str,
-    value: &str,
-    action: &str,
+    environment_id: &EnvironmentId,
 ) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
     let query = format!(
-        "SELECT {ENVIRONMENT_COLUMNS} {ENVIRONMENT_JOIN} WHERE e.universe_id = $1 AND {predicate}"
+        "SELECT {ENVIRONMENT_COLUMNS} {ENVIRONMENT_FROM} WHERE e.universe_id = $1 AND e.environment_id = $2 FOR UPDATE OF e"
     );
     let row = sqlx::query(sqlx::AssertSqlSafe(query))
         .bind(universe_id)
-        .bind(value)
-        .fetch_optional(pool)
+        .bind(environment_id.as_str())
+        .fetch_optional(&mut **tx)
         .await
-        .map_err(|error| sql_error(action, error))?
-        .ok_or_else(|| not_found("environment", &value))?;
+        .map_err(|error| sql_error("lock environment", error))?
+        .ok_or_else(|| not_found("environment", environment_id))?;
     environment_from_row(&row)
 }
 
-fn provider_from_row(
-    row: &sqlx::postgres::PgRow,
-) -> Result<EnvironmentProviderRecord, EnvironmentRegistryError> {
-    let provider_id = parse_id(row, "provider_id", EnvironmentProviderId::try_new)?;
-    let adopt_target: Option<bool> = row
-        .try_get("controller_adopt_target")
-        .map_err(|e| sql_error("decode provider controller adoptTarget", e))?;
-    let ingress: Option<bool> = row
-        .try_get("controller_ingress")
-        .map_err(|e| sql_error("decode provider controller ingress", e))?;
-    let controller_features = match (adopt_target, ingress) {
-        (Some(adopt_target), Some(ingress)) => Some(ControllerFeatures {
-            adopt_target,
-            ingress,
-        }),
-        (None, None) => None,
-        _ => return Err(store_message("provider controller features are incomplete")),
-    };
+/// Every stored column of an environment record, as bound to SQL.
+struct EnvironmentColumns {
+    source_kind: &'static str,
+    state: &'static str,
+    state_message: Option<String>,
+    close_reason: Option<&'static str>,
+    state_changed_at_ms: i64,
+    request_id: Option<String>,
+    display_name: Option<String>,
+    metadata_json: serde_json::Value,
+    daemon_version: Option<String>,
+    daemon_git_sha: Option<String>,
+    daemon_protocol_version: Option<i32>,
+    provider_id: Option<String>,
+    template_id: Option<String>,
+    create_idle_json: Option<serde_json::Value>,
+    provider_target_id: Option<String>,
+    next_attempt_at_ms: Option<i64>,
+    attempts: i32,
+    observed_phase: Option<&'static str>,
+    observed_power: Option<&'static str>,
+    observed_message: Option<String>,
+    observed_at_ms: Option<i64>,
+    public_endpoint: Option<String>,
+    daemon_endpoint: Option<String>,
+    registration_key_id: Option<String>,
+    daemon_public_key: Option<String>,
+    connected: Option<bool>,
+    connection_changed_at_ms: Option<i64>,
+    last_seen_at_ms: Option<i64>,
+    created_at_ms: i64,
+    updated_at_ms: i64,
+    closed_at_ms: Option<i64>,
+}
+
+impl EnvironmentColumns {
+    fn of(record: &EnvironmentRecord) -> Result<Self, EnvironmentRegistryError> {
+        let mut columns = Self {
+            source_kind: record.source.kind_str(),
+            state: record.state.as_str(),
+            state_message: record.state_message.clone(),
+            close_reason: record.close_reason.map(EnvironmentCloseReason::as_str),
+            state_changed_at_ms: record.state_changed_at_ms,
+            request_id: record.request_id.as_ref().map(|id| id.as_str().to_owned()),
+            display_name: record.display_name.clone(),
+            metadata_json: metadata_filter_json(&record.metadata),
+            daemon_version: None,
+            daemon_git_sha: None,
+            daemon_protocol_version: None,
+            provider_id: None,
+            template_id: None,
+            create_idle_json: None,
+            provider_target_id: None,
+            next_attempt_at_ms: None,
+            attempts: 0,
+            observed_phase: None,
+            observed_power: None,
+            observed_message: None,
+            observed_at_ms: None,
+            public_endpoint: None,
+            daemon_endpoint: None,
+            registration_key_id: None,
+            daemon_public_key: None,
+            connected: None,
+            connection_changed_at_ms: None,
+            last_seen_at_ms: None,
+            created_at_ms: record.created_at_ms,
+            updated_at_ms: record.updated_at_ms,
+            closed_at_ms: record.closed_at_ms,
+        };
+        if let Some(build) = &record.daemon_build {
+            columns.daemon_version = build.version.clone();
+            columns.daemon_git_sha = build.git_sha.clone();
+            columns.daemon_protocol_version = Some(
+                i32::try_from(build.protocol_version)
+                    .map_err(|_| invalid_error("daemon protocol version is out of range"))?,
+            );
+        }
+        match &record.source {
+            EnvironmentSource::Provisioned(source) => {
+                columns.provider_id = Some(source.provider_id.as_str().to_owned());
+                columns.template_id = Some(source.template_id.as_str().to_owned());
+                columns.create_idle_json = source
+                    .idle
+                    .as_ref()
+                    .map(|policy| json_value("encode create idle policy", policy))
+                    .transpose()?;
+                columns.provider_target_id = source
+                    .provider_target_id
+                    .as_ref()
+                    .map(|id| id.as_str().to_owned());
+                columns.next_attempt_at_ms = source.next_attempt_at_ms;
+                columns.attempts = i32::try_from(source.attempts).unwrap_or(i32::MAX);
+                if let Some(observed) = &source.observed {
+                    columns.observed_phase = Some(target_phase_str(observed.phase));
+                    columns.observed_power = observed.power.map(PowerState::as_str);
+                    columns.observed_message = observed.message.clone();
+                    columns.observed_at_ms = Some(observed.observed_at_ms);
+                }
+                columns.public_endpoint = source.public_endpoint.clone();
+            }
+            EnvironmentSource::External { endpoint } => {
+                columns.daemon_endpoint = Some(endpoint.as_str().to_owned());
+            }
+            EnvironmentSource::Registered(source) => {
+                columns.registration_key_id = Some(source.registration_key_id.as_str().to_owned());
+                columns.daemon_public_key = Some(source.daemon_public_key.clone());
+                columns.connected = Some(source.connected);
+                columns.connection_changed_at_ms = Some(source.connection_changed_at_ms);
+                columns.last_seen_at_ms = Some(source.last_seen_at_ms);
+            }
+        }
+        Ok(columns)
+    }
+}
+
+/// Insert a new row. Returns false, inserting nothing, when the request id
+/// is already taken in the universe.
+async fn insert_environment_row(
+    tx: &mut Transaction<'_, Postgres>,
+    universe_id: Uuid,
+    record: &EnvironmentRecord,
+    columns: EnvironmentColumns,
+) -> Result<bool, sqlx::Error> {
+    let result = sqlx::query(
+        r#"
+        INSERT INTO environments (
+            universe_id, environment_id, source_kind, state, state_message, close_reason,
+            state_changed_at_ms, request_id, display_name, metadata_json,
+            daemon_version, daemon_git_sha, daemon_protocol_version,
+            provider_id, template_id, create_idle_json, provider_target_id,
+            next_attempt_at_ms, attempts,
+            observed_phase, observed_power, observed_message, observed_at_ms,
+            public_endpoint, daemon_endpoint,
+            registration_key_id, daemon_public_key, connected,
+            connection_changed_at_ms, last_seen_at_ms,
+            created_at_ms, updated_at_ms, closed_at_ms
+        ) VALUES (
+            $1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,
+            $18,$19,$20,$21,$22,$23,$24,$25,$26,$27,$28,$29,$30,$31,$32,$33
+        )
+        ON CONFLICT (universe_id, request_id) WHERE request_id IS NOT NULL DO NOTHING
+        "#,
+    )
+    .bind(universe_id)
+    .bind(record.environment_id.as_str())
+    .bind(columns.source_kind)
+    .bind(columns.state)
+    .bind(columns.state_message)
+    .bind(columns.close_reason)
+    .bind(columns.state_changed_at_ms)
+    .bind(columns.request_id)
+    .bind(columns.display_name)
+    .bind(columns.metadata_json)
+    .bind(columns.daemon_version)
+    .bind(columns.daemon_git_sha)
+    .bind(columns.daemon_protocol_version)
+    .bind(columns.provider_id)
+    .bind(columns.template_id)
+    .bind(columns.create_idle_json)
+    .bind(columns.provider_target_id)
+    .bind(columns.next_attempt_at_ms)
+    .bind(columns.attempts)
+    .bind(columns.observed_phase)
+    .bind(columns.observed_power)
+    .bind(columns.observed_message)
+    .bind(columns.observed_at_ms)
+    .bind(columns.public_endpoint)
+    .bind(columns.daemon_endpoint)
+    .bind(columns.registration_key_id)
+    .bind(columns.daemon_public_key)
+    .bind(columns.connected)
+    .bind(columns.connection_changed_at_ms)
+    .bind(columns.last_seen_at_ms)
+    .bind(columns.created_at_ms)
+    .bind(columns.updated_at_ms)
+    .bind(columns.closed_at_ms)
+    .execute(&mut **tx)
+    .await?;
+    Ok(result.rows_affected() == 1)
+}
+
+/// Write the mutable columns of a locked row. The kind, its identity
+/// columns and its create inputs never change after the insert.
+async fn update_environment_row(
+    tx: &mut Transaction<'_, Postgres>,
+    universe_id: Uuid,
+    record: &EnvironmentRecord,
+    columns: EnvironmentColumns,
+) -> Result<(), sqlx::Error> {
+    sqlx::query(
+        r#"
+        UPDATE environments SET
+            state = $3, state_message = $4, close_reason = $5, state_changed_at_ms = $6,
+            display_name = $7, metadata_json = $8,
+            daemon_version = $9, daemon_git_sha = $10, daemon_protocol_version = $11,
+            provider_target_id = $12, next_attempt_at_ms = $13, attempts = $14,
+            observed_phase = $15, observed_power = $16, observed_message = $17,
+            observed_at_ms = $18, public_endpoint = $19,
+            connected = $20, connection_changed_at_ms = $21, last_seen_at_ms = $22,
+            updated_at_ms = $23, closed_at_ms = $24
+        WHERE universe_id = $1 AND environment_id = $2
+        "#,
+    )
+    .bind(universe_id)
+    .bind(record.environment_id.as_str())
+    .bind(columns.state)
+    .bind(columns.state_message)
+    .bind(columns.close_reason)
+    .bind(columns.state_changed_at_ms)
+    .bind(columns.display_name)
+    .bind(columns.metadata_json)
+    .bind(columns.daemon_version)
+    .bind(columns.daemon_git_sha)
+    .bind(columns.daemon_protocol_version)
+    .bind(columns.provider_target_id)
+    .bind(columns.next_attempt_at_ms)
+    .bind(columns.attempts)
+    .bind(columns.observed_phase)
+    .bind(columns.observed_power)
+    .bind(columns.observed_message)
+    .bind(columns.observed_at_ms)
+    .bind(columns.public_endpoint)
+    .bind(columns.connected)
+    .bind(columns.connection_changed_at_ms)
+    .bind(columns.last_seen_at_ms)
+    .bind(columns.updated_at_ms)
+    .bind(columns.closed_at_ms)
+    .execute(&mut **tx)
+    .await?;
+    Ok(())
+}
+
+fn provider_from_row(row: &PgRow) -> Result<EnvironmentProviderRecord, EnvironmentRegistryError> {
     let record = EnvironmentProviderRecord {
-        provider_id,
-        display_name: row
-            .try_get("display_name")
-            .map_err(|e| sql_error("decode provider display_name", e))?,
+        provider_id: parse_id(row, "provider_id", EnvironmentProviderId::try_new)?,
+        display_name: optional_string(row, "display_name")?,
         controller_endpoint: parse_id(row, "controller_endpoint", |value| {
             EnvironmentEndpoint::parse(&value)
         })?,
-        metadata: json_column(row, "metadata_json")?,
-        controller_features,
         data_route_base: optional_id(row, "data_route_base", DataRouteBase::new)?,
+        has_credential: row
+            .try_get("has_credential")
+            .map_err(|e| sql_error("decode provider credential presence", e))?,
         created_at_ms: scalar(row, "created_at_ms")?,
         updated_at_ms: scalar(row, "updated_at_ms")?,
     };
@@ -1512,17 +1575,16 @@ fn provider_from_row(
 }
 
 fn binding_from_row(
-    row: &sqlx::postgres::PgRow,
+    row: &PgRow,
 ) -> Result<EnvironmentProviderBindingRecord, EnvironmentRegistryError> {
     let record = EnvironmentProviderBindingRecord {
         universe_id: row
             .try_get("universe_id")
             .map_err(|e| sql_error("decode binding universe", e))?,
-        binding_id: parse_id(row, "binding_id", EnvironmentProviderBindingId::try_new)?,
         provider_id: parse_id(row, "provider_id", EnvironmentProviderId::try_new)?,
-        status: binding_status_from_str(&column(row, "status")?)?,
-        revision: i64_to_u64(scalar(row, "revision")?, "revision")?,
-        metadata: json_column(row, "metadata_json")?,
+        enabled: row
+            .try_get("enabled")
+            .map_err(|e| sql_error("decode binding enabled", e))?,
         created_at_ms: scalar(row, "created_at_ms")?,
         updated_at_ms: scalar(row, "updated_at_ms")?,
     };
@@ -1530,108 +1592,103 @@ fn binding_from_row(
     Ok(record)
 }
 
-fn environment_from_row(
-    row: &sqlx::postgres::PgRow,
-) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
+fn environment_from_row(row: &PgRow) -> Result<EnvironmentRecord, EnvironmentRegistryError> {
     let source_kind = column(row, "source_kind")?;
-    let provider_id: Option<String> = row
-        .try_get("provider_id")
-        .map_err(|e| sql_error("decode environment provider", e))?;
-    let binding_id: Option<String> = row
-        .try_get("binding_id")
-        .map_err(|e| sql_error("decode environment binding", e))?;
     let source = match source_kind.as_str() {
-        "provisioned" => EnvironmentSource::Provisioned {
-            provider_id: EnvironmentProviderId::try_new(
-                provider_id.ok_or_else(|| store_message("missing provider id"))?,
-            )
-            .map_err(|e| store_message(format!("decode provider id: {e}")))?,
-            binding_id: EnvironmentProviderBindingId::try_new(
-                binding_id.ok_or_else(|| store_message("missing binding id"))?,
+        "provisioned" => EnvironmentSource::Provisioned(ProvisionedSource {
+            provider_id: parse_id(row, "provider_id", EnvironmentProviderId::try_new)?,
+            template_id: parse_id(row, "template_id", EnvironmentTemplateId::try_new)?,
+            idle: optional_json_column(row, "create_idle_json")?,
+            provider_target_id: optional_id(row, "provider_target_id", ProviderTargetId::new)?,
+            observed: observed_from_row(row)?,
+            public_endpoint: optional_string(row, "public_endpoint")?,
+            next_attempt_at_ms: optional_i64(row, "next_attempt_at_ms")?,
+            attempts: u32::try_from(
+                row.try_get::<i32, _>("attempts")
+                    .map_err(|e| sql_error("decode attempts", e))?,
             )
-            .map_err(|e| store_message(format!("decode binding id: {e}")))?,
-        },
+            .map_err(|_| store_message("attempts is negative"))?,
+        }),
         "external" => EnvironmentSource::External {
             endpoint: parse_id(row, "daemon_endpoint", |value| {
                 EnvironmentEndpoint::parse(&value)
             })?,
         },
-        "registered" => EnvironmentSource::Registered {
+        "registered" => EnvironmentSource::Registered(RegisteredSource {
             registration_key_id: parse_id(
                 row,
                 "registration_key_id",
                 EnvironmentRegistrationKeyId::try_new,
             )?,
-            daemon_id: parse_id(row, "daemon_id", EnvironmentDaemonId::try_new)?,
             daemon_public_key: column(row, "daemon_public_key")?,
             identity_mode: identity_mode_from_str(&column(row, "identity_mode")?)?,
-        },
+            connected: row
+                .try_get::<Option<bool>, _>("connected")
+                .map_err(|e| sql_error("decode connected", e))?
+                .ok_or_else(|| store_message("registered environment without connected"))?,
+            connection_changed_at_ms: required_i64(row, "connection_changed_at_ms")?,
+            last_seen_at_ms: required_i64(row, "last_seen_at_ms")?,
+        }),
         other => {
             return Err(store_message(format!(
                 "unknown environment source: {other}"
             )));
         }
     };
-    let lifecycle_error = match (
-        row.try_get::<Option<String>, _>("lifecycle_error")
-            .map_err(|e| sql_error("decode lifecycle error", e))?,
-        row.try_get::<Option<i64>, _>("lifecycle_error_first_at_ms")
-            .map_err(|e| sql_error("decode lifecycle error start", e))?,
-        row.try_get::<Option<i64>, _>("lifecycle_error_last_at_ms")
-            .map_err(|e| sql_error("decode lifecycle error time", e))?,
-    ) {
-        (Some(message), Some(first_at_ms), Some(last_at_ms)) => Some(EnvironmentLifecycleError {
-            message,
-            first_at_ms,
-            last_at_ms,
-        }),
-        (None, None, None) => None,
-        _ => return Err(store_message("environment lifecycle error is incomplete")),
-    };
+    let daemon_build = row
+        .try_get::<Option<i32>, _>("daemon_protocol_version")
+        .map_err(|e| sql_error("decode daemon protocol version", e))?
+        .map(
+            |protocol_version| -> Result<DaemonBuild, EnvironmentRegistryError> {
+                Ok(DaemonBuild {
+                    version: optional_string(row, "daemon_version")?,
+                    git_sha: optional_string(row, "daemon_git_sha")?,
+                    protocol_version: u32::try_from(protocol_version)
+                        .map_err(|_| store_message("daemon protocol version is negative"))?,
+                })
+            },
+        )
+        .transpose()?;
+    let state = column(row, "state")?;
     let record = EnvironmentRecord {
         environment_id: parse_id(row, "environment_id", EnvironmentId::try_new)?,
-        request_id: parse_id(row, "request_id", EnvironmentProvisionRequestId::try_new)?,
+        request_id: optional_id(row, "request_id", EnvironmentProvisionRequestId::try_new)?,
         source,
-        display_name: row
-            .try_get("display_name")
-            .map_err(|e| sql_error("decode environment display", e))?,
-        status: environment_status_from_str(&column(row, "status")?)?,
-        desired_power: power_state_from_str(&column(row, "desired_power")?)?,
-        idle_policy: optional_json_column(row, "idle_policy_json")?,
-        incarnation: EnvironmentIncarnationRecord {
-            incarnation_id: parse_id(row, "incarnation_id", EnvironmentIncarnationId::try_new)?,
-            provision_request_id: optional_id(
-                row,
-                "provision_request_id",
-                EnvironmentProvisionRequestId::try_new,
-            )?,
-            provider_target_id: optional_id(row, "provider_target_id", ProviderTargetId::new)?,
-            template_id: optional_id(row, "template_id", EnvironmentTemplateId::try_new)?,
-            adoption_source_target: row
-                .try_get("adoption_source_target")
-                .map_err(|e| sql_error("decode adoption source target", e))?,
-            power_states: json_column(row, "power_states_json")?,
-            created_at_ms: scalar(row, "incarnation_created_at_ms")?,
-            updated_at_ms: scalar(row, "incarnation_updated_at_ms")?,
-        },
-        public_ingress_enabled: row
-            .try_get("public_ingress_enabled")
-            .map_err(|e| sql_error("decode public ingress enabled", e))?,
-        public_endpoint: row
-            .try_get("public_endpoint")
-            .map_err(|e| sql_error("decode public endpoint", e))?,
+        display_name: optional_string(row, "display_name")?,
         metadata: json_column(row, "metadata_json")?,
-        last_seen_at_ms: row
-            .try_get("last_seen_at_ms")
-            .map_err(|e| sql_error("decode last seen", e))?,
-        lifecycle_error,
+        state: EnvironmentState::parse(&state)
+            .ok_or_else(|| store_message(format!("unknown environment state: {state}")))?,
+        state_message: optional_string(row, "state_message")?,
+        close_reason: optional_string(row, "close_reason")?
+            .map(|reason| {
+                EnvironmentCloseReason::parse(&reason)
+                    .ok_or_else(|| store_message(format!("unknown close reason: {reason}")))
+            })
+            .transpose()?,
+        state_changed_at_ms: scalar(row, "state_changed_at_ms")?,
+        daemon_build,
         created_at_ms: scalar(row, "created_at_ms")?,
         updated_at_ms: scalar(row, "updated_at_ms")?,
+        closed_at_ms: optional_i64(row, "closed_at_ms")?,
     };
     record.validate()?;
     Ok(record)
 }
 
+fn observed_from_row(row: &PgRow) -> Result<Option<ObservedTarget>, EnvironmentRegistryError> {
+    let Some(phase) = optional_string(row, "observed_phase")? else {
+        return Ok(None);
+    };
+    Ok(Some(ObservedTarget {
+        phase: target_phase_from_str(&phase)?,
+        power: optional_string(row, "observed_power")?
+            .map(|power| power_state_from_str(&power))
+            .transpose()?,
+        message: optional_string(row, "observed_message")?,
+        observed_at_ms: required_i64(row, "observed_at_ms")?,
+    }))
+}
+
 pub(crate) fn identity_mode_from_str(
     value: &str,
 ) -> Result<RegisteredIdentityMode, EnvironmentRegistryError> {
@@ -1639,19 +1696,45 @@ pub(crate) fn identity_mode_from_str(
         .ok_or_else(|| store_message(format!("unknown identity mode: {value}")))
 }
 
+fn target_phase_str(phase: TargetPhase) -> &'static str {
+    match phase {
+        TargetPhase::Provisioning => "provisioning",
+        TargetPhase::Active => "active",
+        TargetPhase::Closing => "closing",
+        TargetPhase::Closed => "closed",
+        TargetPhase::Failed => "failed",
+        TargetPhase::Unknown => "unknown",
+    }
+}
+
+fn target_phase_from_str(value: &str) -> Result<TargetPhase, EnvironmentRegistryError> {
+    [
+        TargetPhase::Provisioning,
+        TargetPhase::Active,
+        TargetPhase::Closing,
+        TargetPhase::Closed,
+        TargetPhase::Failed,
+        TargetPhase::Unknown,
+    ]
+    .into_iter()
+    .find(|phase| target_phase_str(*phase) == value)
+    .ok_or_else(|| store_message(format!("unknown target phase: {value}")))
+}
+
+fn power_state_from_str(value: &str) -> Result<PowerState, EnvironmentRegistryError> {
+    PowerState::ALL
+        .into_iter()
+        .find(|state| state.as_str() == value)
+        .ok_or_else(|| store_message(format!("unknown environment power state: {value}")))
+}
+
 fn credential_from_row(
-    row: &sqlx::postgres::PgRow,
+    row: &PgRow,
 ) -> Result<EnvironmentCredentialRecord, EnvironmentRegistryError> {
     let kind = column(row, "source_kind")?;
-    let grant: Option<String> = row
-        .try_get("grant_id")
-        .map_err(|e| sql_error("decode grant id", e))?;
-    let provider: Option<String> = row
-        .try_get("auth_provider_id")
-        .map_err(|e| sql_error("decode auth provider id", e))?;
-    let secret: Option<String> = row
-        .try_get("secret_id")
-        .map_err(|e| sql_error("decode secret id", e))?;
+    let grant = optional_string(row, "grant_id")?;
+    let provider = optional_string(row, "auth_provider_id")?;
+    let secret = optional_string(row, "secret_id")?;
     let source = match kind.as_str() {
         "auth_grant" => EnvironmentCredentialSource::AuthGrant {
             grant_id: AuthGrantId::try_new(grant.ok_or_else(|| store_message("missing grant id"))?)
@@ -1699,30 +1782,12 @@ fn credential_source_columns(
     }
 }
 
-fn binding_status_to_str(value: EnvironmentProviderBindingStatus) -> &'static str {
-    match value {
-        EnvironmentProviderBindingStatus::Enabled => "enabled",
-        EnvironmentProviderBindingStatus::Disabled => "disabled",
-    }
-}
-fn binding_status_from_str(
-    value: &str,
-) -> Result<EnvironmentProviderBindingStatus, EnvironmentRegistryError> {
-    match value {
-        "enabled" => Ok(EnvironmentProviderBindingStatus::Enabled),
-        "disabled" => Ok(EnvironmentProviderBindingStatus::Disabled),
-        other => Err(store_message(format!("unknown binding status: {other}"))),
-    }
-}
-fn power_state_from_str(value: &str) -> Result<PowerState, EnvironmentRegistryError> {
-    PowerState::ALL
-        .into_iter()
-        .find(|state| state.as_str() == value)
-        .ok_or_else(|| store_message(format!("unknown environment power state: {value}")))
-}
+// ---------------------------------------------------------------------------
+// Decoding and error helpers
+// ---------------------------------------------------------------------------
 
 fn optional_json_column<T: serde::de::DeserializeOwned>(
-    row: &sqlx::postgres::PgRow,
+    row: &PgRow,
     name: &str,
 ) -> Result<Option<T>, EnvironmentRegistryError> {
     let value: Option<serde_json::Value> = row
@@ -1735,52 +1800,8 @@ fn optional_json_column<T: serde::de::DeserializeOwned>(
         .transpose()
 }
 
-fn environment_status_to_str(value: EnvironmentStatus) -> &'static str {
-    match value {
-        EnvironmentStatus::Provisioning => "provisioning",
-        EnvironmentStatus::Booting => "booting",
-        EnvironmentStatus::Ready => "ready",
-        EnvironmentStatus::Paused => "paused",
-        EnvironmentStatus::Suspended => "suspended",
-        EnvironmentStatus::Offline => "offline",
-        EnvironmentStatus::Closing => "closing",
-        EnvironmentStatus::Closed => "closed",
-        EnvironmentStatus::Failed => "failed",
-        EnvironmentStatus::Unknown => "unknown",
-    }
-}
-fn environment_status_from_str(value: &str) -> Result<EnvironmentStatus, EnvironmentRegistryError> {
-    match value {
-        "provisioning" => Ok(EnvironmentStatus::Provisioning),
-        "booting" => Ok(EnvironmentStatus::Booting),
-        "ready" => Ok(EnvironmentStatus::Ready),
-        "paused" => Ok(EnvironmentStatus::Paused),
-        "suspended" => Ok(EnvironmentStatus::Suspended),
-        "offline" => Ok(EnvironmentStatus::Offline),
-        "closing" => Ok(EnvironmentStatus::Closing),
-        "closed" => Ok(EnvironmentStatus::Closed),
-        "failed" => Ok(EnvironmentStatus::Failed),
-        "unknown" => Ok(EnvironmentStatus::Unknown),
-        other => Err(store_message(format!(
-            "unknown environment status: {other}"
-        ))),
-    }
-}
-
-fn validate_ingress_request_time(value: i64) -> Result<(), EnvironmentRegistryError> {
-    if value < 0 {
-        invalid("updated_at_ms must be nonnegative")
-    } else {
-        Ok(())
-    }
-}
-
-fn invalid_store<T>(message: impl Into<String>) -> Result<T, EnvironmentRegistryError> {
-    invalid(message)
-}
-
 fn parse_id<T, E>(
-    row: &sqlx::postgres::PgRow,
+    row: &PgRow,
     name: &str,
     parse: impl FnOnce(String) -> Result<T, E>,
 ) -> Result<T, EnvironmentRegistryError>
@@ -1789,38 +1810,54 @@ where
 {
     parse(column(row, name)?).map_err(|e| store_message(format!("decode {name}: {e}")))
 }
+
 fn optional_id<T, E>(
-    row: &sqlx::postgres::PgRow,
+    row: &PgRow,
     name: &str,
     parse: impl FnOnce(String) -> Result<T, E>,
 ) -> Result<Option<T>, EnvironmentRegistryError>
 where
     E: std::fmt::Display,
 {
-    let value: Option<String> = row
-        .try_get(name)
-        .map_err(|e| sql_error("decode optional id", e))?;
-    value
+    optional_string(row, name)?
         .map(parse)
         .transpose()
         .map_err(|e| store_message(format!("decode {name}: {e}")))
 }
-fn column(row: &sqlx::postgres::PgRow, name: &str) -> Result<String, EnvironmentRegistryError> {
+
+fn optional_string(row: &PgRow, name: &str) -> Result<Option<String>, EnvironmentRegistryError> {
+    row.try_get(name)
+        .map_err(|e| sql_error(&format!("decode {name}"), e))
+}
+
+fn optional_i64(row: &PgRow, name: &str) -> Result<Option<i64>, EnvironmentRegistryError> {
+    row.try_get(name)
+        .map_err(|e| sql_error(&format!("decode {name}"), e))
+}
+
+fn required_i64(row: &PgRow, name: &str) -> Result<i64, EnvironmentRegistryError> {
+    optional_i64(row, name)?.ok_or_else(|| store_message(format!("missing {name}")))
+}
+
+fn column(row: &PgRow, name: &str) -> Result<String, EnvironmentRegistryError> {
     row.try_get(name)
-        .map_err(|e| sql_error("decode environment column", e))
+        .map_err(|e| sql_error(&format!("decode {name}"), e))
 }
-fn scalar(row: &sqlx::postgres::PgRow, name: &str) -> Result<i64, EnvironmentRegistryError> {
+
+fn scalar(row: &PgRow, name: &str) -> Result<i64, EnvironmentRegistryError> {
     row.try_get(name)
-        .map_err(|e| sql_error("decode integer column", e))
+        .map_err(|e| sql_error(&format!("decode {name}"), e))
 }
+
 fn json_value<T: serde::Serialize>(
     action: &str,
     value: &T,
 ) -> Result<serde_json::Value, EnvironmentRegistryError> {
     serde_json::to_value(value).map_err(|e| store_message(format!("{action}: {e}")))
 }
+
 fn json_column<T: serde::de::DeserializeOwned>(
-    row: &sqlx::postgres::PgRow,
+    row: &PgRow,
     name: &str,
 ) -> Result<T, EnvironmentRegistryError> {
     let value: serde_json::Value = row
@@ -1828,71 +1865,67 @@ fn json_column<T: serde::de::DeserializeOwned>(
         .map_err(|e| sql_error("decode json column", e))?;
     serde_json::from_value(value).map_err(|e| store_message(format!("decode {name}: {e}")))
 }
-fn i64_to_u64(value: i64, name: &str) -> Result<u64, EnvironmentRegistryError> {
-    value
-        .try_into()
-        .map_err(|_| store_message(format!("{name} is negative")))
-}
+
 pub(crate) fn not_found(kind: &'static str, id: &impl ToString) -> EnvironmentRegistryError {
     EnvironmentRegistryError::NotFound {
         kind,
         id: id.to_string(),
     }
 }
+
 pub(crate) fn invalid<T>(message: impl Into<String>) -> Result<T, EnvironmentRegistryError> {
     Err(invalid_error(message))
 }
+
 fn invalid_error(message: impl Into<String>) -> EnvironmentRegistryError {
     EnvironmentRegistryError::InvalidInput {
         message: message.into(),
     }
 }
-fn store_error(action: &str, error: crate::PgStoreError) -> EnvironmentRegistryError {
+
+fn store_error(action: &str, error: PgStoreError) -> EnvironmentRegistryError {
     store_message(format!("{action}: {error}"))
 }
+
 pub(crate) fn sql_error(action: &str, error: sqlx::Error) -> EnvironmentRegistryError {
     store_message(format!("{action}: {error}"))
 }
+
 pub(crate) fn store_message(message: impl Into<String>) -> EnvironmentRegistryError {
     EnvironmentRegistryError::Store {
         message: message.into(),
     }
 }
-fn map_environment_insert_error(error: sqlx::Error) -> EnvironmentRegistryError {
-    if let Some(db) = error.as_database_error()
-        && db.constraint() == Some("environments_pkey")
-    {
-        return EnvironmentRegistryError::AlreadyExists {
+
+pub(crate) fn constraint_of(error: &sqlx::Error) -> Option<&str> {
+    error.as_database_error().and_then(|db| db.constraint())
+}
+
+fn map_environment_write_error(action: &str, error: sqlx::Error) -> EnvironmentRegistryError {
+    match constraint_of(&error) {
+        Some("environments_pkey") => EnvironmentRegistryError::AlreadyExists {
             kind: "environment",
             id: "duplicate environment id".to_owned(),
-        };
-    }
-    sql_error("insert environment", error)
-}
-fn map_registered_insert_error(
-    error: sqlx::Error,
-    daemon_id: &EnvironmentDaemonId,
-) -> EnvironmentRegistryError {
-    if let Some(db) = error.as_database_error()
-        && db.constraint() == Some("environments_daemon_public_key_idx")
-    {
-        return EnvironmentRegistryError::AlreadyExists {
-            kind: "daemon_identity",
-            id: daemon_id.to_string(),
-        };
+        },
+        Some("environments_provider_target_idx") => EnvironmentRegistryError::AlreadyExists {
+            kind: "provider_target",
+            id: "target recorded for another open environment".to_owned(),
+        },
+        Some("environments_registration_key_fk") => {
+            invalid_error("environment registration key does not exist")
+        }
+        _ => sql_error(action, error),
     }
-    map_environment_insert_error(error)
 }
-fn map_binding_write_error(action: &str, error: sqlx::Error) -> EnvironmentRegistryError {
-    if let Some(db) = error.as_database_error()
-        && db.constraint() == Some("environment_provider_bindings_universe_id_provider_id_key")
+
+fn map_binding_write_error(error: sqlx::Error, universe_id: Uuid) -> EnvironmentRegistryError {
+    if error
+        .as_database_error()
+        .is_some_and(|database| database.code().as_deref() == Some("23503"))
     {
-        return EnvironmentRegistryError::AlreadyExists {
-            kind: "environment_provider_binding",
-            id: "universe/provider".to_owned(),
-        };
+        return not_found("universe", &universe_id);
     }
-    sql_error(action, error)
+    sql_error("put provider binding", error)
 }
 
 fn map_provider_delete_error(error: sqlx::Error) -> EnvironmentRegistryError {
@@ -1905,15 +1938,12 @@ fn map_provider_delete_error(error: sqlx::Error) -> EnvironmentRegistryError {
     sql_error("delete environment provider", error)
 }
 
-#[allow(dead_code)]
-async fn _transaction_marker(_: &mut Transaction<'_, Postgres>) {}
-
 /// Decode every row that still decodes. A row that does not is left out
 /// and logged, so one bad row never hides the rest of a listing or stalls
 /// a reconciler pass over them.
 pub(crate) fn decode_rows<T>(
-    rows: &[sqlx::postgres::PgRow],
-    decode: impl Fn(&sqlx::postgres::PgRow) -> Result<T, EnvironmentRegistryError>,
+    rows: &[PgRow],
+    decode: impl Fn(&PgRow) -> Result<T, EnvironmentRegistryError>,
     kind: &'static str,
 ) -> Vec<T> {
     rows.iter()
@@ -1930,11 +1960,10 @@ fn decoded_or_logged<T>(
         .ok()
 }
 
-/// A string map as the jsonb object the `@>` containment filter compares
-/// against; building the value directly cannot fail.
-fn metadata_filter_json(
-    metadata: &std::collections::BTreeMap<String, String>,
-) -> serde_json::Value {
+/// A string map as a jsonb object: the stored caller metadata and the `@>`
+/// containment filter compared against it. Building the value directly
+/// cannot fail.
+fn metadata_filter_json(metadata: &BTreeMap<String, String>) -> serde_json::Value {
     serde_json::Value::Object(
         metadata
             .iter()
diff --git a/crates/store-pg/src/environment_registration.rs b/crates/store-pg/src/environment_registration.rs
index eb0d568c7..8ab5aba87 100644
--- a/crates/store-pg/src/environment_registration.rs
+++ b/crates/store-pg/src/environment_registration.rs
@@ -1,14 +1,16 @@
-//! Registration keys for outbound `envd` registration, plus the two
-//! deployment-wide lookups the environment gateway needs before it knows a
-//! universe: a presented secret selects the universe of its key, and a
-//! known daemon public key selects the universe of its environment.
+//! Registration keys for outbound `envd` registration and their secrets,
+//! plus the two deployment-wide lookups the environment gateway needs
+//! before it knows a universe: a presented secret selects the universe of
+//! its key, and a known daemon public key selects the universe of its
+//! environment.
 
 // Formatted SQL uses internal schema fragments; request values use bind parameters.
 use async_trait::async_trait;
 use environments::{
     CreateEnvironmentRegistrationKey, EnvironmentRegistrationKeyId,
     EnvironmentRegistrationKeyRecord, EnvironmentRegistrationKeyStore, EnvironmentRegistryError,
-    RegistrationKeyUsage, RevokeEnvironmentRegistrationKey,
+    RegistrationKeyUsage, RevokeEnvironmentRegistrationKey, RotateEnvironmentRegistrationKey,
+    UpdateEnvironmentRegistrationKey,
 };
 use sqlx::{PgPool, Postgres, Row, Transaction, postgres::PgRow};
 use uuid::Uuid;
@@ -16,14 +18,23 @@ use uuid::Uuid;
 use crate::{
     PgStore, PgStoreError,
     environment::{
-        decode_rows, identity_mode_from_str, invalid, not_found, sql_error, store_message,
+        constraint_of, decode_rows, identity_mode_from_str, invalid, not_found, sql_error,
+        store_message,
     },
 };
 
+/// Columns of `environment_registration_keys k`. The display prefix is the
+/// live secret's (the latest one when a key has none live).
 const KEY_COLUMNS: &str = r#"
-    registration_key_id, display_name, key_prefix, identity_mode,
-    max_active_environments, ephemeral_disconnect_grace_ms, expires_at_ms,
-    created_at_ms, revoked_at_ms
+    k.registration_key_id, k.display_name, k.identity_mode,
+    k.max_active_environments, k.ephemeral_disconnect_grace_ms, k.offline_close_after_ms,
+    k.expires_at_ms, k.created_at_ms, k.updated_at_ms, k.revoked_at_ms,
+    (
+        SELECT s.key_prefix FROM environment_registration_key_secrets s
+        WHERE s.universe_id = k.universe_id AND s.registration_key_id = k.registration_key_id
+        ORDER BY s.retired_at_ms IS NOT NULL, s.created_at_ms DESC
+        LIMIT 1
+    ) AS key_prefix
 "#;
 
 #[async_trait]
@@ -33,44 +44,58 @@ impl EnvironmentRegistrationKeyStore for PgStore {
         request: CreateEnvironmentRegistrationKey,
     ) -> Result<EnvironmentRegistrationKeyRecord, EnvironmentRegistryError> {
         request.record.validate()?;
+        validate_secret_hash(&request.secret_hash)?;
         self.ensure_universe()
             .await
             .map_err(|error| store_message(format!("ensure universe: {error}")))?;
         let record = request.record;
-        let query = format!(
+        let mut tx = self
+            .pool
+            .begin()
+            .await
+            .map_err(|error| sql_error("begin registration key create", error))?;
+        sqlx::query(
             r#"
             INSERT INTO environment_registration_keys (
-                universe_id, registration_key_id, display_name, key_prefix, secret_hash,
-                identity_mode, max_active_environments, ephemeral_disconnect_grace_ms,
-                expires_at_ms, created_at_ms, revoked_at_ms
+                universe_id, registration_key_id, display_name, identity_mode,
+                max_active_environments, ephemeral_disconnect_grace_ms, offline_close_after_ms,
+                expires_at_ms, revoked_at_ms, created_at_ms, updated_at_ms
             ) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11)
-            RETURNING {KEY_COLUMNS}
-            "#
-        );
-        let row = sqlx::query(sqlx::AssertSqlSafe(query))
-            .bind(self.config.universe_id)
-            .bind(record.registration_key_id.as_str())
-            .bind(&record.display_name)
-            .bind(&record.key_prefix)
-            .bind(&request.secret_hash)
-            .bind(record.identity_mode.as_str())
-            .bind(
-                record
-                    .max_active_environments
-                    .map(|value| i32::try_from(value).unwrap_or(i32::MAX)),
-            )
-            .bind(
-                record
-                    .ephemeral_disconnect_grace_ms
-                    .map(|value| i64::try_from(value).unwrap_or(i64::MAX)),
-            )
-            .bind(record.expires_at_ms)
-            .bind(record.created_at_ms)
-            .bind(record.revoked_at_ms)
-            .fetch_one(&self.pool)
+            "#,
+        )
+        .bind(self.config.universe_id)
+        .bind(record.registration_key_id.as_str())
+        .bind(&record.display_name)
+        .bind(record.identity_mode.as_str())
+        .bind(max_active_column(record.max_active_environments))
+        .bind(duration_column(record.ephemeral_disconnect_grace_ms))
+        .bind(duration_column(record.offline_close_after_ms))
+        .bind(record.expires_at_ms)
+        .bind(record.revoked_at_ms)
+        .bind(record.created_at_ms)
+        .bind(record.updated_at_ms)
+        .execute(&mut *tx)
+        .await
+        .map_err(|error| map_key_write_error(error, &record.registration_key_id))?;
+        insert_secret(
+            &mut tx,
+            self.config.universe_id,
+            &record.registration_key_id,
+            &request.secret_hash,
+            &record.key_prefix,
+            record.created_at_ms,
+        )
+        .await?;
+        let record = lock_registration_key(
+            &mut tx,
+            self.config.universe_id,
+            &record.registration_key_id,
+        )
+        .await?;
+        tx.commit()
             .await
-            .map_err(|error| map_key_insert_error(error, &record.registration_key_id))?;
-        key_from_row(&row)
+            .map_err(|error| sql_error("commit registration key create", error))?;
+        Ok(record)
     }
 
     async fn read_registration_key(
@@ -78,7 +103,7 @@ impl EnvironmentRegistrationKeyStore for PgStore {
         registration_key_id: &EnvironmentRegistrationKeyId,
     ) -> Result<EnvironmentRegistrationKeyRecord, EnvironmentRegistryError> {
         let query = format!(
-            "SELECT {KEY_COLUMNS} FROM environment_registration_keys WHERE universe_id = $1 AND registration_key_id = $2"
+            "SELECT {KEY_COLUMNS} FROM environment_registration_keys k WHERE k.universe_id = $1 AND k.registration_key_id = $2"
         );
         let row = sqlx::query(sqlx::AssertSqlSafe(query))
             .bind(self.config.universe_id)
@@ -94,7 +119,7 @@ impl EnvironmentRegistrationKeyStore for PgStore {
         &self,
     ) -> Result<Vec<EnvironmentRegistrationKeyRecord>, EnvironmentRegistryError> {
         let query = format!(
-            "SELECT {KEY_COLUMNS} FROM environment_registration_keys WHERE universe_id = $1 ORDER BY created_at_ms, registration_key_id"
+            "SELECT {KEY_COLUMNS} FROM environment_registration_keys k WHERE k.universe_id = $1 ORDER BY k.created_at_ms, k.registration_key_id"
         );
         let rows = sqlx::query(sqlx::AssertSqlSafe(query))
             .bind(self.config.universe_id)
@@ -108,6 +133,102 @@ impl EnvironmentRegistrationKeyStore for PgStore {
         ))
     }
 
+    async fn update_registration_key(
+        &self,
+        request: UpdateEnvironmentRegistrationKey,
+    ) -> Result<EnvironmentRegistrationKeyRecord, EnvironmentRegistryError> {
+        let mut tx = self
+            .pool
+            .begin()
+            .await
+            .map_err(|error| sql_error("begin registration key update", error))?;
+        let mut record = lock_registration_key(
+            &mut tx,
+            self.config.universe_id,
+            &request.registration_key_id,
+        )
+        .await?;
+        request.apply(&mut record)?;
+        sqlx::query(
+            r#"
+            UPDATE environment_registration_keys SET
+                display_name = $3, max_active_environments = $4,
+                ephemeral_disconnect_grace_ms = $5, offline_close_after_ms = $6,
+                expires_at_ms = $7, updated_at_ms = $8
+            WHERE universe_id = $1 AND registration_key_id = $2
+            "#,
+        )
+        .bind(self.config.universe_id)
+        .bind(record.registration_key_id.as_str())
+        .bind(&record.display_name)
+        .bind(max_active_column(record.max_active_environments))
+        .bind(duration_column(record.ephemeral_disconnect_grace_ms))
+        .bind(duration_column(record.offline_close_after_ms))
+        .bind(record.expires_at_ms)
+        .bind(record.updated_at_ms)
+        .execute(&mut *tx)
+        .await
+        .map_err(|error| sql_error("update registration key", error))?;
+        tx.commit()
+            .await
+            .map_err(|error| sql_error("commit registration key update", error))?;
+        Ok(record)
+    }
+
+    async fn rotate_registration_key(
+        &self,
+        request: RotateEnvironmentRegistrationKey,
+    ) -> Result<EnvironmentRegistrationKeyRecord, EnvironmentRegistryError> {
+        let mut tx = self
+            .pool
+            .begin()
+            .await
+            .map_err(|error| sql_error("begin registration key rotation", error))?;
+        let mut record = lock_registration_key(
+            &mut tx,
+            self.config.universe_id,
+            &request.registration_key_id,
+        )
+        .await?;
+        request.apply(&mut record)?;
+        // Retire before inserting: a key has at most one live secret.
+        sqlx::query(
+            r#"
+            UPDATE environment_registration_key_secrets
+            SET retired_at_ms = GREATEST(created_at_ms, $3)
+            WHERE universe_id = $1 AND registration_key_id = $2 AND retired_at_ms IS NULL
+            "#,
+        )
+        .bind(self.config.universe_id)
+        .bind(record.registration_key_id.as_str())
+        .bind(request.rotated_at_ms)
+        .execute(&mut *tx)
+        .await
+        .map_err(|error| sql_error("retire registration key secret", error))?;
+        insert_secret(
+            &mut tx,
+            self.config.universe_id,
+            &record.registration_key_id,
+            &request.secret_hash,
+            &request.key_prefix,
+            request.rotated_at_ms,
+        )
+        .await?;
+        sqlx::query(
+            "UPDATE environment_registration_keys SET updated_at_ms = $3 WHERE universe_id = $1 AND registration_key_id = $2",
+        )
+        .bind(self.config.universe_id)
+        .bind(record.registration_key_id.as_str())
+        .bind(record.updated_at_ms)
+        .execute(&mut *tx)
+        .await
+        .map_err(|error| sql_error("touch rotated registration key", error))?;
+        tx.commit()
+            .await
+            .map_err(|error| sql_error("commit registration key rotation", error))?;
+        Ok(record)
+    }
+
     async fn revoke_registration_key(
         &self,
         request: RevokeEnvironmentRegistrationKey,
@@ -115,25 +236,30 @@ impl EnvironmentRegistrationKeyStore for PgStore {
         if request.revoked_at_ms < 0 {
             return invalid("revoked_at_ms must be nonnegative");
         }
-        let query = format!(
+        let revoked = sqlx::query(
             r#"
-            UPDATE environment_registration_keys
-            SET revoked_at_ms = COALESCE(revoked_at_ms, GREATEST($3, created_at_ms))
+            UPDATE environment_registration_keys SET
+                revoked_at_ms = COALESCE(revoked_at_ms, GREATEST($3, created_at_ms)),
+                updated_at_ms = CASE WHEN revoked_at_ms IS NULL
+                    THEN GREATEST(updated_at_ms, $3, created_at_ms)
+                    ELSE updated_at_ms END
             WHERE universe_id = $1 AND registration_key_id = $2
-            RETURNING {KEY_COLUMNS}
-            "#
-        );
-        let row = sqlx::query(sqlx::AssertSqlSafe(query))
-            .bind(self.config.universe_id)
-            .bind(request.registration_key_id.as_str())
-            .bind(request.revoked_at_ms)
-            .fetch_optional(&self.pool)
+            "#,
+        )
+        .bind(self.config.universe_id)
+        .bind(request.registration_key_id.as_str())
+        .bind(request.revoked_at_ms)
+        .execute(&self.pool)
+        .await
+        .map_err(|error| sql_error("revoke registration key", error))?;
+        if revoked.rows_affected() == 0 {
+            return Err(not_found(
+                "environment_registration_key",
+                &request.registration_key_id,
+            ));
+        }
+        self.read_registration_key(&request.registration_key_id)
             .await
-            .map_err(|error| sql_error("revoke registration key", error))?
-            .ok_or_else(|| {
-                not_found("environment_registration_key", &request.registration_key_id)
-            })?;
-        key_from_row(&row)
     }
 
     async fn resolve_registration_key(
@@ -141,7 +267,14 @@ impl EnvironmentRegistrationKeyStore for PgStore {
         secret_hash: &str,
     ) -> Result<Option<EnvironmentRegistrationKeyRecord>, EnvironmentRegistryError> {
         let query = format!(
-            "SELECT {KEY_COLUMNS} FROM environment_registration_keys WHERE universe_id = $1 AND secret_hash = $2"
+            r#"
+            SELECT {KEY_COLUMNS}
+            FROM environment_registration_key_secrets live
+            JOIN environment_registration_keys k
+              ON k.universe_id = live.universe_id
+             AND k.registration_key_id = live.registration_key_id
+            WHERE live.universe_id = $1 AND live.secret_hash = $2 AND live.retired_at_ms IS NULL
+            "#
         );
         let row = sqlx::query(sqlx::AssertSqlSafe(query))
             .bind(self.config.universe_id)
@@ -160,7 +293,7 @@ impl EnvironmentRegistrationKeyStore for PgStore {
         let row = sqlx::query(
             r#"
             SELECT count(*) AS registered,
-                   count(*) FILTER (WHERE status <> 'closed') AS active,
+                   count(*) FILTER (WHERE state <> 'closed') AS active,
                    max(created_at_ms) AS last_registered_at_ms
             FROM environments
             WHERE universe_id = $1 AND registration_key_id = $2
@@ -187,14 +320,14 @@ impl EnvironmentRegistrationKeyStore for PgStore {
     }
 }
 
-/// Lock one key row for the duration of an admission transaction.
+/// Lock one key row for the duration of a transaction.
 pub(crate) async fn lock_registration_key(
     tx: &mut Transaction<'_, Postgres>,
     universe_id: Uuid,
     registration_key_id: &EnvironmentRegistrationKeyId,
 ) -> Result<EnvironmentRegistrationKeyRecord, EnvironmentRegistryError> {
     let query = format!(
-        "SELECT {KEY_COLUMNS} FROM environment_registration_keys WHERE universe_id = $1 AND registration_key_id = $2 FOR UPDATE"
+        "SELECT {KEY_COLUMNS} FROM environment_registration_keys k WHERE k.universe_id = $1 AND k.registration_key_id = $2 FOR UPDATE"
     );
     let row = sqlx::query(sqlx::AssertSqlSafe(query))
         .bind(universe_id)
@@ -206,15 +339,48 @@ pub(crate) async fn lock_registration_key(
     key_from_row(&row)
 }
 
-/// The universe whose registration key hashes to `secret_hash`. Key rows are
-/// universe-scoped; this is the one lookup that intentionally searches
-/// across universes, because the key is what selects the universe.
+async fn insert_secret(
+    tx: &mut Transaction<'_, Postgres>,
+    universe_id: Uuid,
+    registration_key_id: &EnvironmentRegistrationKeyId,
+    secret_hash: &str,
+    key_prefix: &str,
+    created_at_ms: i64,
+) -> Result<(), EnvironmentRegistryError> {
+    sqlx::query(
+        r#"
+        INSERT INTO environment_registration_key_secrets (
+            secret_hash, universe_id, registration_key_id, key_prefix, created_at_ms
+        ) VALUES ($1,$2,$3,$4,$5)
+        "#,
+    )
+    .bind(secret_hash)
+    .bind(universe_id)
+    .bind(registration_key_id.as_str())
+    .bind(key_prefix)
+    .bind(created_at_ms)
+    .execute(&mut **tx)
+    .await
+    .map_err(|error| map_key_write_error(error, registration_key_id))?;
+    Ok(())
+}
+
+/// The universe whose live registration secret hashes to `secret_hash`.
+/// Key rows are universe-scoped; this is the one lookup that intentionally
+/// searches across universes, because the key is what selects the universe.
+/// A retired secret selects nothing.
 pub async fn find_registration_key_universe(
     pool: &PgPool,
     secret_hash: &str,
 ) -> Result<Option<Uuid>, PgStoreError> {
     let row: Option<(Uuid,)> = sqlx::query_as(
-        "SELECT universe_id FROM environment_registration_keys WHERE secret_hash = $1",
+        r#"
+        SELECT k.universe_id
+        FROM environment_registration_key_secrets s
+        JOIN environment_registration_keys k
+          ON k.universe_id = s.universe_id AND k.registration_key_id = s.registration_key_id
+        WHERE s.secret_hash = $1 AND s.retired_at_ms IS NULL
+        "#,
     )
     .bind(secret_hash)
     .fetch_optional(pool)
@@ -244,9 +410,6 @@ fn key_from_row(row: &PgRow) -> Result<EnvironmentRegistrationKeyRecord, Environ
     let max_active: Option<i32> = row
         .try_get("max_active_environments")
         .map_err(|error| sql_error("decode max active", error))?;
-    let grace: Option<i64> = row
-        .try_get("ephemeral_disconnect_grace_ms")
-        .map_err(|error| sql_error("decode disconnect grace", error))?;
     let record = EnvironmentRegistrationKeyRecord {
         registration_key_id: EnvironmentRegistrationKeyId::try_new(
             row.try_get::<String, _>("registration_key_id")
@@ -257,21 +420,24 @@ fn key_from_row(row: &PgRow) -> Result<EnvironmentRegistrationKeyRecord, Environ
             .try_get("display_name")
             .map_err(|error| sql_error("decode display name", error))?,
         key_prefix: row
-            .try_get("key_prefix")
-            .map_err(|error| sql_error("decode key prefix", error))?,
+            .try_get::<Option<String>, _>("key_prefix")
+            .map_err(|error| sql_error("decode key prefix", error))?
+            .ok_or_else(|| store_message("registration key has no secret"))?,
         identity_mode: identity_mode_from_str(&identity_mode)?,
         max_active_environments: max_active
             .map(|value| u32::try_from(value).map_err(|_| store_message("max active out of range")))
             .transpose()?,
-        ephemeral_disconnect_grace_ms: grace
-            .map(|value| u64::try_from(value).map_err(|_| store_message("grace out of range")))
-            .transpose()?,
+        ephemeral_disconnect_grace_ms: duration_from_row(row, "ephemeral_disconnect_grace_ms")?,
+        offline_close_after_ms: duration_from_row(row, "offline_close_after_ms")?,
         expires_at_ms: row
             .try_get("expires_at_ms")
             .map_err(|error| sql_error("decode expires", error))?,
         created_at_ms: row
             .try_get("created_at_ms")
             .map_err(|error| sql_error("decode created", error))?,
+        updated_at_ms: row
+            .try_get("updated_at_ms")
+            .map_err(|error| sql_error("decode updated", error))?,
         revoked_at_ms: row
             .try_get("revoked_at_ms")
             .map_err(|error| sql_error("decode revoked", error))?,
@@ -280,18 +446,50 @@ fn key_from_row(row: &PgRow) -> Result<EnvironmentRegistrationKeyRecord, Environ
     Ok(record)
 }
 
-fn map_key_insert_error(
+fn duration_from_row(row: &PgRow, name: &str) -> Result<Option<u64>, EnvironmentRegistryError> {
+    row.try_get::<Option<i64>, _>(name)
+        .map_err(|error| sql_error(&format!("decode {name}"), error))?
+        .map(|value| {
+            u64::try_from(value).map_err(|_| store_message(format!("{name} out of range")))
+        })
+        .transpose()
+}
+
+fn max_active_column(value: Option<u32>) -> Option<i32> {
+    value.map(|value| i32::try_from(value).unwrap_or(i32::MAX))
+}
+
+fn duration_column(value: Option<u64>) -> Option<i64> {
+    value.map(|value| i64::try_from(value).unwrap_or(i64::MAX))
+}
+
+/// A registration secret hash is lowercase hex SHA-256.
+fn validate_secret_hash(value: &str) -> Result<(), EnvironmentRegistryError> {
+    if value.len() != 64
+        || !value
+            .bytes()
+            .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
+    {
+        return invalid("registration secret hash must be 64 lowercase hex characters");
+    }
+    Ok(())
+}
+
+fn map_key_write_error(
     error: sqlx::Error,
     registration_key_id: &EnvironmentRegistrationKeyId,
 ) -> EnvironmentRegistryError {
-    if error
-        .as_database_error()
-        .is_some_and(|db| db.code().as_deref() == Some("23505"))
-    {
-        return EnvironmentRegistryError::AlreadyExists {
+    match constraint_of(&error) {
+        Some("environment_registration_keys_pkey") => EnvironmentRegistryError::AlreadyExists {
             kind: "environment_registration_key",
             id: registration_key_id.to_string(),
-        };
+        },
+        Some("environment_registration_key_secrets_pkey") => {
+            EnvironmentRegistryError::AlreadyExists {
+                kind: "environment_registration_key_secret",
+                id: registration_key_id.to_string(),
+            }
+        }
+        _ => sql_error("write registration key", error),
     }
-    sql_error("insert registration key", error)
 }
diff --git a/crates/store-pg/src/lib.rs b/crates/store-pg/src/lib.rs
index b944ffbc5..c666ec378 100644
--- a/crates/store-pg/src/lib.rs
+++ b/crates/store-pg/src/lib.rs
@@ -368,6 +368,11 @@ pub use deployment::{
     list_universe_object_keys, list_universe_session_ids, list_universe_stats, put_universe_slug,
     read_universe_stats,
 };
+pub use environment::{
+    list_revoked_environment_routes, list_universes_with_environment_work,
+    list_universes_with_open_provisioned_environments, list_universes_with_registered_environments,
+    repair_registered_connections,
+};
 pub use environment_registration::{
     find_registered_environment_universe, find_registration_key_universe,
 };
@@ -385,43 +390,6 @@ pub async fn list_universes(pool: &PgPool) -> Result<Vec<(Uuid, Option<String>)>
     Ok(rows)
 }
 
-/// Universes with lifecycle intents requiring provider reconciliation.
-pub async fn list_universes_with_pending_environments(
-    pool: &PgPool,
-    scope: environments::ReconcileScope,
-) -> Result<Vec<Uuid>, PgStoreError> {
-    // Pending provider work, registered-environment heartbeat repair and,
-    // for a steady pass, every steady provisioned environment.
-    let converging = environment::CONVERGING_SQL;
-    let steady = match scope {
-        environments::ReconcileScope::Converging => String::new(),
-        environments::ReconcileScope::WithSteady => format!(" OR {}", environment::STEADY_SQL),
-    };
-    let query = format!(
-        "SELECT DISTINCT e.universe_id FROM environments e \
-         WHERE {converging} \
-            OR (e.source_kind = 'registered' AND e.status NOT IN ('closing','closed')){steady} \
-         ORDER BY e.universe_id"
-    );
-    let rows: Vec<(Uuid,)> = sqlx::query_as(sqlx::AssertSqlSafe(query))
-        .fetch_all(pool)
-        .await?;
-    Ok(rows.into_iter().map(|(universe_id,)| universe_id).collect())
-}
-
-/// Universes holding a ready provisioned environment with an idle policy:
-/// the power reaper's scan set.
-pub async fn list_universes_with_idle_policies(pool: &PgPool) -> Result<Vec<Uuid>, PgStoreError> {
-    let rows: Vec<(Uuid,)> = sqlx::query_as(
-        "SELECT DISTINCT e.universe_id FROM environments e \
-         WHERE e.status = 'ready' AND e.idle_policy_json IS NOT NULL \
-         ORDER BY e.universe_id",
-    )
-    .fetch_all(pool)
-    .await?;
-    Ok(rows.into_iter().map(|(universe_id,)| universe_id).collect())
-}
-
 /// Deployment-level check whether a universe exists. Runs above the
 /// per-universe `PgStore` boundary: multi-universe deployments consult it
 /// before lazily constructing a universe's store.
diff --git a/crates/store-pg/src/migrations.rs b/crates/store-pg/src/migrations.rs
index 63eafdc32..52f3a1550 100644
--- a/crates/store-pg/src/migrations.rs
+++ b/crates/store-pg/src/migrations.rs
@@ -34,9 +34,9 @@ const LIGHTSPEED_TABLES: &[&str] = &[
     "channel_accounts",
     "channel_pairings",
     "environment_credentials",
-    "environment_incarnations",
     "environment_provider_bindings",
     "environment_providers",
+    "environment_registration_key_secrets",
     "environment_registration_keys",
     "environments",
     "mcp_servers",
@@ -113,14 +113,9 @@ pub const MIGRATIONS: &[EmbeddedMigration] = &[
         name: "session_deletion",
         sql: include_str!("../migrations/011_session_deletion.sql"),
     },
-    EmbeddedMigration {
-        version: 12,
-        name: "environment_endpoints",
-        sql: include_str!("../migrations/012_environment_endpoints.sql"),
-    },
 ];
 
-pub const REQUIRED_SCHEMA_REVISION: i64 = 12;
+pub const REQUIRED_SCHEMA_REVISION: i64 = 11;
 
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub struct SchemaStatus {
diff --git a/crates/store-pg/tests/migrations_live.rs b/crates/store-pg/tests/migrations_live.rs
index e382666b2..8db959364 100644
--- a/crates/store-pg/tests/migrations_live.rs
+++ b/crates/store-pg/tests/migrations_live.rs
@@ -109,8 +109,16 @@ async fn exercise_migrator(pool: &sqlx::PgPool) -> Result<(), String> {
         return Err(format!("unexpected migrated status: {status:?}"));
     }
 
+    // The environment baseline is folded into one migration; the ledger
+    // ends at revision 11.
+    if REQUIRED_SCHEMA_REVISION != 11 {
+        return Err(format!(
+            "unexpected required schema revision {REQUIRED_SCHEMA_REVISION}"
+        ));
+    }
+
     // The public schema can have these same names. Every newly migrated schema
-    // must still receive its own foreign keys, including the deferred cycle.
+    // must still receive its own foreign keys.
     let foreign_keys: Vec<(String, bool, bool, bool)> = sqlx::query_as(
         "SELECT constraint_row.conname::text, constraint_row.condeferrable,
                 constraint_row.condeferred,
@@ -120,7 +128,6 @@ async fn exercise_migrator(pool: &sqlx::PgPool) -> Result<(), String> {
          JOIN pg_class AS target ON target.oid = constraint_row.confrelid
          WHERE source.relnamespace = current_schema()::regnamespace
            AND constraint_row.conname IN (
-               'environments_current_incarnation_fk',
                'environments_registration_key_fk',
                'mcp_servers_auth_grant_fk'
            )
@@ -131,15 +138,12 @@ async fn exercise_migrator(pool: &sqlx::PgPool) -> Result<(), String> {
     .map_err(|error| error.to_string())?;
     if foreign_keys
         != vec![
-            (
-                "environments_current_incarnation_fk".to_owned(),
-                true,
-                true,
-                true,
-            ),
+            // Deferrable but checked immediately, so only a universe delete
+            // (which defers its constraints) can remove keys and
+            // environments in either cascade order.
             (
                 "environments_registration_key_fk".to_owned(),
-                false,
+                true,
                 false,
                 true,
             ),
@@ -151,6 +155,99 @@ async fn exercise_migrator(pool: &sqlx::PgPool) -> Result<(), String> {
         ));
     }
 
+    // The environment baseline's named constraints and indexes.
+    let mut expected_constraints = vec![
+        "environment_providers_controller_endpoint_format",
+        "environment_providers_credential_all_or_none",
+        "environment_providers_data_route_base_format",
+        "environment_providers_display_name_not_empty",
+        "environment_providers_provider_id_format",
+        "environment_providers_times_valid",
+        "environment_provider_bindings_times_valid",
+        "environment_registration_keys_display_name_bounded",
+        "environment_registration_keys_id_format",
+        "environment_registration_keys_identity_mode_known",
+        "environment_registration_keys_limits_positive",
+        "environment_registration_keys_offline_close_persistent",
+        "environment_registration_keys_times_valid",
+        "environment_registration_key_secrets_hash_format",
+        "environment_registration_key_secrets_prefix_not_empty",
+        "environment_registration_key_secrets_times_valid",
+        "environments_close_reason",
+        "environments_closed_at",
+        "environments_daemon_build",
+        "environments_ids_format",
+        "environments_json_objects",
+        "environments_observation",
+        "environments_registration_key_fk",
+        "environments_source_fields",
+        "environments_source_known",
+        "environments_state_known",
+        "environments_state_message_bounded",
+        "environments_state_per_kind",
+        "environments_times_valid",
+        "environments_work_schedule",
+    ];
+    expected_constraints.sort_unstable();
+    let constraints: Vec<String> = sqlx::query_scalar(
+        "SELECT constraint_row.conname::text
+         FROM pg_constraint AS constraint_row
+         JOIN pg_class AS source ON source.oid = constraint_row.conrelid
+         WHERE source.relnamespace = current_schema()::regnamespace
+           AND source.relname IN (
+               'environment_providers', 'environment_provider_bindings',
+               'environment_registration_keys', 'environment_registration_key_secrets',
+               'environments'
+           )
+           AND constraint_row.contype IN ('c', 'f')
+           AND constraint_row.conname = ANY($1::text[])
+         ORDER BY constraint_row.conname",
+    )
+    .bind(&expected_constraints)
+    .fetch_all(pool)
+    .await
+    .map_err(|error| error.to_string())?;
+    let mut constraints: Vec<&str> = constraints.iter().map(String::as_str).collect();
+    constraints.sort_unstable();
+    if constraints != expected_constraints {
+        return Err(format!(
+            "environment baseline constraints differ: {constraints:?}"
+        ));
+    }
+    let mut expected_indexes = vec![
+        "environment_registration_key_secrets_live_idx",
+        "environments_daemon_public_key_idx",
+        "environments_metadata_idx",
+        "environments_provider_state_idx",
+        "environments_provider_target_idx",
+        "environments_provisioned_open_idx",
+        "environments_registered_open_idx",
+        "environments_registration_key_state_idx",
+        "environments_request_id_idx",
+        "environments_work_idx",
+    ];
+    expected_indexes.sort_unstable();
+    let mut indexes: Vec<String> = sqlx::query_scalar(
+        "SELECT indexname::text FROM pg_indexes
+         WHERE schemaname = current_schema() AND indexname = ANY($1::text[])",
+    )
+    .bind(&expected_indexes)
+    .fetch_all(pool)
+    .await
+    .map_err(|error| error.to_string())?;
+    indexes.sort_unstable();
+    if indexes != expected_indexes {
+        return Err(format!("environment baseline indexes differ: {indexes:?}"));
+    }
+    let incarnations: Option<String> =
+        sqlx::query_scalar("SELECT to_regclass('environment_incarnations')::text")
+            .fetch_one(pool)
+            .await
+            .map_err(|error| error.to_string())?;
+    if incarnations.is_some() {
+        return Err("the environment baseline must not create incarnations".to_owned());
+    }
+
     let rows: Vec<(i64, String, String)> =
         sqlx::query_as("SELECT version, name, checksum FROM schema_migrations ORDER BY version")
             .fetch_all(pool)
diff --git a/crates/store-pg/tests/store_pg_live.rs b/crates/store-pg/tests/store_pg_live.rs
index 654475bf0..0bd14559f 100644
--- a/crates/store-pg/tests/store_pg_live.rs
+++ b/crates/store-pg/tests/store_pg_live.rs
@@ -9,12 +9,12 @@ use auth::{
 };
 use environment_protocol::{ids::ProviderTargetId, routes::DataRouteBase};
 use environments::{
-    BeginCloseEnvironment, ControllerFeatures, CreateEnvironment, EnvironmentEndpoint,
-    EnvironmentId, EnvironmentIncarnationId, EnvironmentProviderBindingId,
-    EnvironmentProviderBindingStatus, EnvironmentProviderBindingStore, EnvironmentProviderId,
-    EnvironmentProviderStore, EnvironmentProvisionRequestId, EnvironmentStatus, EnvironmentStore,
-    EnvironmentTemplateId, ListEnvironmentProviders, ListEnvironments,
-    ObserveProvisionedEnvironment, PutEnvironmentProvider, PutEnvironmentProviderBinding,
+    BeginCloseEnvironment, CreateEnvironment, CreateExternalEnvironment, DaemonBuild,
+    EnvironmentCloseReason, EnvironmentEndpoint, EnvironmentId, EnvironmentProviderBindingStore,
+    EnvironmentProviderId, EnvironmentProviderStore, EnvironmentProvisionRequestId,
+    EnvironmentRegistryError, EnvironmentState, EnvironmentStore, EnvironmentTemplateId,
+    FinishCloseEnvironment, ListEnvironments, ProviderCredentialChange, PutEnvironmentProvider,
+    PutEnvironmentProviderBinding,
 };
 use harness::{
     BlobRef, CORE_AGENT_LIFECYCLE_CLOSED_EVENT_KIND,
@@ -1993,253 +1993,6 @@ async fn pg_live_mcp_crud_and_universe_isolation() {
     ));
 }
 
-#[tokio::test(flavor = "current_thread")]
-#[ignore = "requires ./dev.sh infra or compatible Postgres + MinIO env"]
-async fn pg_live_universe_environments_are_independent_of_sessions() {
-    let store = live_store("environments", 1024).await;
-    for table in ["environment_jobs", "environment_job_groups"] {
-        let relation: Option<String> = sqlx::query_scalar("SELECT to_regclass($1)::text")
-            .bind(format!("public.{table}"))
-            .fetch_one(store.pool())
-            .await
-            .expect("inspect removed environment job table");
-        assert!(
-            relation.is_none(),
-            "legacy job table must be removed: {table}"
-        );
-    }
-    let provider_id = EnvironmentProviderId::new("bridge-local");
-    let target_id = ProviderTargetId::new("local-host").expect("target id");
-    let environment_id = EnvironmentId::new("instance-local");
-    let session_id = SessionId::new("session-env");
-
-    let provider = store
-        .put_provider(PutEnvironmentProvider {
-            provider_id: provider_id.clone(),
-            display_name: Some("Local bridge".to_owned()),
-            controller_endpoint: EnvironmentEndpoint::parse("ws://127.0.0.1:9000/controller")
-                .expect("endpoint"),
-            metadata: Default::default(),
-            credential: Some(SecretValue::new("bridge-credential")),
-            updated_at_ms: 10,
-        })
-        .await
-        .expect("register provider");
-    // Providers are global rows shared by every test universe on this
-    // database, so assert membership rather than equality.
-    assert!(
-        store
-            .list_providers(ListEnvironmentProviders::default())
-            .await
-            .expect("list providers")
-            .contains(&provider),
-        "registered provider must be listed"
-    );
-
-    store
-        .put_provider_binding(PutEnvironmentProviderBinding {
-            universe_id: store.config().universe_id,
-            binding_id: EnvironmentProviderBindingId::new("primary"),
-            provider_id: provider_id.clone(),
-            status: EnvironmentProviderBindingStatus::Enabled,
-            metadata: Default::default(),
-            expected_revision: None,
-            updated_at_ms: 25,
-        })
-        .await
-        .expect("provider binding");
-    store
-        .create_environment(CreateEnvironment {
-            request_id: EnvironmentProvisionRequestId::new("request-local"),
-            environment_id: environment_id.clone(),
-            incarnation_id: EnvironmentIncarnationId::new("incarnation-local"),
-            binding_id: EnvironmentProviderBindingId::new("primary"),
-            template_id: EnvironmentTemplateId::new("rust-v1"),
-            display_name: Some("Local host".to_owned()),
-            metadata: Default::default(),
-
-            idle_policy: Some(environments::EnvironmentIdlePolicy {
-                pause_after_ms: Some(60_000),
-                suspend_after_ms: None,
-                stop_after_ms: Some(3_600_000),
-                close_after_ms: None,
-            }),
-            created_at_ms: 29,
-        })
-        .await
-        .expect("create environment");
-    let instance = store
-        .observe_provisioned_environment(ObserveProvisionedEnvironment {
-            environment_id: environment_id.clone(),
-            provider_target_id: Some(target_id.clone()),
-            daemon_build: None,
-            status: EnvironmentStatus::Offline,
-            power_states: vec![
-                environments::PowerState::Running,
-                environments::PowerState::Paused,
-                environments::PowerState::Stopped,
-            ],
-            observed_at_ms: 30,
-        })
-        .await
-        .expect("upsert target");
-    // Power intent, observed power states, and idle policy round-trip
-    // and feed the reconcile/reaper queries.
-    assert_eq!(instance.desired_power, environments::PowerState::Running);
-    assert_eq!(
-        instance.incarnation.power_states,
-        vec![
-            environments::PowerState::Running,
-            environments::PowerState::Paused,
-            environments::PowerState::Stopped,
-        ]
-    );
-    assert_eq!(
-        instance
-            .idle_policy
-            .as_ref()
-            .and_then(|policy| policy.pause_after_ms),
-        Some(60_000)
-    );
-    // Offline while desired running: the reconciler must pick it up.
-    assert!(
-        store
-            .list_environments_needing_reconcile(environments::ReconcileScope::Converging)
-            .await
-            .expect("needing reconcile")
-            .iter()
-            .any(|record| record.environment_id == environment_id)
-    );
-    // Not ready: the reaper must not.
-    assert!(
-        store
-            .list_environments_with_idle_policy()
-            .await
-            .expect("idle policy candidates")
-            .is_empty()
-    );
-    let stopped_intent = store
-        .set_environment_power(environments::SetEnvironmentPower {
-            environment_id: environment_id.clone(),
-            desired_power: environments::PowerState::Stopped,
-            updated_at_ms: 31,
-        })
-        .await
-        .expect("set power");
-    assert_eq!(
-        stopped_intent.desired_power,
-        environments::PowerState::Stopped
-    );
-    assert!(
-        !store
-            .list_environments_needing_reconcile(environments::ReconcileScope::Converging)
-            .await
-            .expect("needing reconcile")
-            .iter()
-            .any(|record| record.environment_id == environment_id)
-    );
-    // A steady pass observes it anyway.
-    assert!(
-        store
-            .list_environments_needing_reconcile(environments::ReconcileScope::WithSteady)
-            .await
-            .expect("needing reconcile")
-            .iter()
-            .any(|record| record.environment_id == environment_id)
-    );
-    let ready = store
-        .observe_provisioned_environment(ObserveProvisionedEnvironment {
-            environment_id: environment_id.clone(),
-            provider_target_id: Some(target_id.clone()),
-            daemon_build: None,
-            status: EnvironmentStatus::Ready,
-            power_states: vec![environments::PowerState::Running],
-            observed_at_ms: 32,
-        })
-        .await
-        .expect("observe ready");
-    assert_eq!(
-        store
-            .list_environments_with_idle_policy()
-            .await
-            .expect("idle policy candidates"),
-        vec![ready.clone()]
-    );
-    let cleared = store
-        .set_environment_idle_policy(environments::SetEnvironmentIdlePolicy {
-            environment_id: environment_id.clone(),
-            idle_policy: None,
-            updated_at_ms: 33,
-        })
-        .await
-        .expect("clear policy");
-    assert!(cleared.idle_policy.is_none());
-    store
-        .set_environment_power(environments::SetEnvironmentPower {
-            environment_id: environment_id.clone(),
-            desired_power: environments::PowerState::Running,
-            updated_at_ms: 34,
-        })
-        .await
-        .expect("restore power");
-    let instance = store
-        .observe_provisioned_environment(ObserveProvisionedEnvironment {
-            environment_id: environment_id.clone(),
-            provider_target_id: Some(target_id.clone()),
-            daemon_build: None,
-            status: EnvironmentStatus::Offline,
-            power_states: vec![environments::PowerState::Running],
-            observed_at_ms: 35,
-        })
-        .await
-        .expect("observe offline again");
-    assert_eq!(
-        store
-            .list_environments(ListEnvironments {
-                metadata: Default::default(),
-                provider_id: Some(provider_id.clone()),
-                binding_id: Some(EnvironmentProviderBindingId::new("primary")),
-                status: Some(EnvironmentStatus::Offline),
-                ..ListEnvironments::default()
-            })
-            .await
-            .expect("list instances"),
-        vec![instance.clone()]
-    );
-
-    store
-        .create_session(CreateSession {
-            metadata: Default::default(),
-            session_id: session_id.clone(),
-            display_name: None,
-            origin: None,
-            delete_after_close_ms: None,
-            created_at_ms: 35,
-        })
-        .await
-        .expect("create session");
-
-    let closing = store
-        .begin_close_environment(BeginCloseEnvironment {
-            environment_id: environment_id.clone(),
-            updated_at_ms: 50,
-        })
-        .await
-        .expect("close environment while a session exists");
-    assert_eq!(closing.status, EnvironmentStatus::Closing);
-
-    // Leave nothing behind for a running dev reconciler to chase: the
-    // provider endpoint is fictional and its closing environments would be
-    // retried forever.
-    store_pg::delete_universe(store.pool(), store.config().universe_id)
-        .await
-        .expect("delete test universe");
-    store
-        .delete_provider(&provider_id)
-        .await
-        .expect("delete test provider");
-}
-
 #[tokio::test(flavor = "current_thread")]
 #[ignore = "requires ./dev.sh infra or compatible Postgres + MinIO env"]
 async fn pg_live_auth_secrets_are_encrypted_and_universe_scoped() {
@@ -2797,368 +2550,242 @@ fn create_oauth_client_record(client_id: &OAuthClientId) -> CreateOAuthClientRec
 }
 
 #[tokio::test(flavor = "current_thread")]
-#[ignore = "requires ./dev.sh infra or compatible Postgres + MinIO env"]
-async fn pg_live_environment_lifecycle_guards_and_provider_facts() {
+#[ignore = "requires ./dev.sh infra or compatible Postgres env"]
+async fn pg_live_environment_credentials_round_trip() {
     use environments::{
-        FailEnvironmentLifecycle, RecordEnvironmentLifecycleError, RecordProviderController,
+        EnvironmentCredentialSource, EnvironmentCredentialStore, ListEnvironmentCredentials,
+        PutEnvironmentCredential,
     };
 
-    let store = live_store("environment-guards", 1024).await;
-    let suffix = Uuid::new_v4().simple().to_string();
-    let provider_id = EnvironmentProviderId::new(format!("guard-provider-{suffix}"));
-    let endpoint = EnvironmentEndpoint::parse("ws://127.0.0.1:9100/control").expect("endpoint");
-
-    // The credential is required for a new provider, sealed at rest, and
-    // kept by a later put that omits it.
-    let refused = store
-        .put_provider(PutEnvironmentProvider {
-            provider_id: provider_id.clone(),
-            display_name: None,
-            controller_endpoint: endpoint.clone(),
-            metadata: Default::default(),
-            credential: None,
-            updated_at_ms: 1,
-        })
-        .await;
-    assert!(matches!(
-        refused,
-        Err(environments::EnvironmentRegistryError::InvalidInput { .. })
-    ));
+    let store = live_store("environment-credentials", 1024).await;
+    let provider_id = bound_test_provider(&store, "cred-provider").await;
+    let environment_id = EnvironmentId::new("cred-env");
     store
-        .put_provider(PutEnvironmentProvider {
-            provider_id: provider_id.clone(),
-            display_name: None,
-            controller_endpoint: endpoint.clone(),
-            metadata: Default::default(),
-            credential: Some(SecretValue::new("guard-bearer-secret")),
-            updated_at_ms: 1,
-        })
+        .create_environment(create_environment(
+            &provider_id,
+            "cred-request",
+            "cred-env",
+            3,
+        ))
         .await
-        .expect("register provider");
-    let ciphertext: Vec<u8> = sqlx::query_scalar(
-        "SELECT credential_ciphertext FROM environment_providers WHERE provider_id = $1",
-    )
-    .bind(provider_id.as_str())
-    .fetch_one(store.pool())
-    .await
-    .expect("read sealed credential");
-    assert!(
-        !ciphertext
-            .windows(b"guard-bearer-secret".len())
-            .any(|window| window == b"guard-bearer-secret")
-    );
-    let base = DataRouteBase::new("ws://127.0.0.1:9100/data").expect("base");
-    let recorded = store
-        .record_provider_controller(RecordProviderController {
-            provider_id: provider_id.clone(),
-            controller_endpoint: endpoint.clone(),
-            features: ControllerFeatures {
-                adopt_target: false,
-                ingress: true,
+        .expect("create environment");
+
+    // Subscription credentials are ordinary static_bearer grants carrying
+    // metadata, so exercise two stored-secret grants.
+    for (grant_id, kind, provider) in [
+        ("authgrant_codex", AuthProviderKind::StaticBearer, "openai"),
+        (
+            "authgrant_claude",
+            AuthProviderKind::StaticBearer,
+            "anthropic",
+        ),
+    ] {
+        store
+            .create_grant(CreateAuthGrantRecord {
+                grant_id: AuthGrantId::new(grant_id),
+                provider_id: provider.to_owned(),
+                provider_kind: kind,
+                exposure: auth::AuthGrantExposure::Brokered,
+                created_by: api::Attribution::Local,
+                display_name: None,
+                subject_hint: None,
+                scopes: Vec::new(),
+                audience: None,
+                access_token_secret: Some(SecretId::new(format!("{grant_id}_access"))),
+                refresh_token_secret: None,
+                oauth_client: None,
+                expires_at_ms: None,
+                status: AuthGrantStatus::Active,
+                metadata: serde_json::json!({ "subscription": "codex" }),
+                created_at_ms: 4,
+            })
+            .await
+            .expect("create subscription grant");
+    }
+
+    let bound = store
+        .bind_credential(PutEnvironmentCredential {
+            environment_id: environment_id.clone(),
+            env_name: "CODEX_AUTH_JSON".to_owned(),
+            source: EnvironmentCredentialSource::AuthGrant {
+                grant_id: AuthGrantId::new("authgrant_codex"),
             },
-            data_route_base: base.clone(),
-        })
-        .await
-        .expect("record controller");
-    assert_eq!(recorded.data_route_base, Some(base));
-    let renamed = store
-        .put_provider(PutEnvironmentProvider {
-            provider_id: provider_id.clone(),
-            display_name: Some("Guard".to_owned()),
-            controller_endpoint: endpoint.clone(),
-            metadata: Default::default(),
-            credential: None,
-            updated_at_ms: 2,
+            created_at_ms: 5,
         })
         .await
-        .expect("rename provider");
-    assert_eq!(renamed.controller_features, recorded.controller_features);
+        .expect("bind codex credential");
     assert_eq!(
-        store
-            .read_provider_credential(&provider_id)
-            .await
-            .expect("credential")
-            .expose(),
-        "guard-bearer-secret"
+        bound.source,
+        EnvironmentCredentialSource::AuthGrant {
+            grant_id: AuthGrantId::new("authgrant_codex"),
+        }
     );
-
     store
-        .put_provider_binding(PutEnvironmentProviderBinding {
-            universe_id: store.config().universe_id,
-            binding_id: EnvironmentProviderBindingId::new("primary"),
-            provider_id: provider_id.clone(),
-            status: EnvironmentProviderBindingStatus::Enabled,
-            metadata: Default::default(),
-            expected_revision: None,
-            updated_at_ms: 3,
+        .bind_credential(PutEnvironmentCredential {
+            environment_id: environment_id.clone(),
+            env_name: "CLAUDE_CODE_OAUTH_TOKEN".to_owned(),
+            source: EnvironmentCredentialSource::AuthGrant {
+                grant_id: AuthGrantId::new("authgrant_claude"),
+            },
+            created_at_ms: 6,
         })
         .await
-        .expect("provider binding");
-    let create = |request: &str, environment: &str| CreateEnvironment {
-        request_id: EnvironmentProvisionRequestId::new(request),
-        environment_id: EnvironmentId::new(environment),
-        incarnation_id: EnvironmentIncarnationId::new(format!("{environment}-inc")),
-        binding_id: EnvironmentProviderBindingId::new("primary"),
-        template_id: EnvironmentTemplateId::new("rust-v1"),
-        display_name: None,
-        metadata: Default::default(),
-        idle_policy: None,
-        created_at_ms: 10,
-    };
+        .expect("bind plain credential");
 
-    // A close accepted while a create was in flight wins over its answer,
-    // and the target id is still recorded so the close can address it.
-    let closing = store
-        .create_environment(create("guard-request", "guard-env"))
+    // Rebinding the same name replaces the source.
+    let replaced = store
+        .bind_credential(PutEnvironmentCredential {
+            environment_id: environment_id.clone(),
+            env_name: "CODEX_AUTH_JSON".to_owned(),
+            source: EnvironmentCredentialSource::AuthGrant {
+                grant_id: AuthGrantId::new("authgrant_claude"),
+            },
+            created_at_ms: 7,
+        })
         .await
-        .expect("create");
-    store
-        .begin_close_environment(BeginCloseEnvironment {
-            environment_id: closing.environment_id.clone(),
-            updated_at_ms: 11,
-        })
-        .await
-        .expect("begin close");
-    let natural = ProviderTargetId::new("default/pod-abc").expect("opaque target id");
-    let observed = store
-        .observe_provisioned_environment(ObserveProvisionedEnvironment {
-            environment_id: closing.environment_id.clone(),
-            provider_target_id: Some(natural.clone()),
-            status: EnvironmentStatus::Ready,
-            power_states: vec![environments::PowerState::Running],
-            daemon_build: None,
-            observed_at_ms: 12,
-        })
-        .await
-        .expect("observe");
-    assert_eq!(observed.status, EnvironmentStatus::Closing);
-    assert_eq!(observed.incarnation.provider_target_id, Some(natural));
-    let failed = store
-        .fail_environment_lifecycle(FailEnvironmentLifecycle {
-            environment_id: closing.environment_id.clone(),
-            message: "late failure".to_owned(),
-            daemon_build: None,
-            observed_at_ms: 13,
-        })
-        .await
-        .expect("fail");
-    assert_eq!(failed.status, EnvironmentStatus::Closing);
-
-    // Lifecycle errors keep the start of their run and leave the status.
-    let erroring = store
-        .create_environment(create("guard-request-2", "guard-env-2"))
-        .await
-        .expect("create second");
-    for at in [20, 30] {
-        store
-            .record_environment_lifecycle_error(RecordEnvironmentLifecycleError {
-                environment_id: erroring.environment_id.clone(),
-                message: format!("controller unavailable at {at}"),
-                observed_at_ms: at,
-            })
-            .await
-            .expect("record error");
-    }
-    let still = store
-        .read_environment(&erroring.environment_id)
-        .await
-        .expect("read");
-    assert_eq!(still.status, EnvironmentStatus::Provisioning);
-    let error = still.lifecycle_error.expect("lifecycle error");
-    assert_eq!((error.first_at_ms, error.last_at_ms), (20, 30));
+        .expect("rebind to another grant");
+    assert_eq!(
+        replaced.source,
+        EnvironmentCredentialSource::AuthGrant {
+            grant_id: AuthGrantId::new("authgrant_claude"),
+        }
+    );
 
-    // A row that no longer decodes is skipped by listings instead of
-    // failing them.
-    let poisoned = store
-        .create_environment(create("guard-request-3", "guard-env-3"))
-        .await
-        .expect("create third");
-    let oversized: serde_json::Map<String, serde_json::Value> = (0..40)
-        .map(|index| (format!("key{index}"), serde_json::json!("v")))
-        .collect();
-    sqlx::query(
-        "UPDATE environments SET metadata_json = $3 WHERE universe_id = $1 AND environment_id = $2",
-    )
-    .bind(store.config().universe_id)
-    .bind(poisoned.environment_id.as_str())
-    .bind(serde_json::Value::Object(oversized))
-    .execute(store.pool())
-    .await
-    .expect("poison row");
     let listed = store
-        .list_environments(ListEnvironments::default())
+        .list_credentials(ListEnvironmentCredentials {
+            environment_id: environment_id.clone(),
+        })
         .await
-        .expect("list despite a bad row");
-    assert!(
+        .expect("list credentials");
+    assert_eq!(
         listed
             .iter()
-            .all(|record| record.environment_id != poisoned.environment_id)
+            .map(|c| c.env_name.as_str())
+            .collect::<Vec<_>>(),
+        vec!["CLAUDE_CODE_OAUTH_TOKEN", "CODEX_AUTH_JSON"]
     );
-    assert!(
-        listed
-            .iter()
-            .any(|record| record.environment_id == erroring.environment_id)
+
+    store
+        .unbind_credential(&environment_id, "CODEX_AUTH_JSON")
+        .await
+        .expect("unbind");
+    assert_eq!(
+        store
+            .list_credentials(ListEnvironmentCredentials { environment_id })
+            .await
+            .expect("list after unbind")
+            .len(),
+        1
     );
 }
 
 #[tokio::test(flavor = "current_thread")]
 #[ignore = "requires ./dev.sh infra or compatible Postgres env"]
-async fn pg_live_environment_credentials_round_trip() {
+async fn pg_live_universe_delete_removes_registered_environments_and_credential_bindings() {
     use environments::{
-        EnvironmentCredentialSource, EnvironmentCredentialStore, ListEnvironmentCredentials,
-        PutEnvironmentCredential,
+        CreateEnvironmentRegistrationKey, CreateRegisteredEnvironment, EnvironmentCredentialSource,
+        EnvironmentCredentialStore, EnvironmentRegistrationKeyId, EnvironmentRegistrationKeyStore,
+        PutEnvironmentCredential, RegisteredIdentityMode, RegistrationKeyPolicy,
+        mint_registration_key,
     };
 
-    let store = live_store("environment-credentials", 1024).await;
-    let provider_id = EnvironmentProviderId::new("cred-provider");
-    let environment_id = EnvironmentId::new("cred-env");
-    store
-        .put_provider(PutEnvironmentProvider {
-            provider_id: provider_id.clone(),
-            display_name: None,
-            controller_endpoint: EnvironmentEndpoint::parse("ws://127.0.0.1:9000/controller")
-                .expect("endpoint"),
-            metadata: Default::default(),
-            credential: Some(SecretValue::new("cred-provider-credential")),
-            updated_at_ms: 1,
-        })
-        .await
-        .expect("register provider");
+    let store = live_store("environment-universe-delete", 1024).await;
+    let universe_id = store.config().universe_id;
+    let minted = mint_registration_key(
+        EnvironmentRegistrationKeyId::new("fleet"),
+        RegistrationKeyPolicy {
+            display_name: "Fleet".to_owned(),
+            identity_mode: RegisteredIdentityMode::Persistent,
+            max_active_environments: None,
+            ephemeral_disconnect_grace_ms: None,
+            offline_close_after_ms: None,
+            expires_at_ms: None,
+        },
+        1,
+    )
+    .expect("mint key");
     store
-        .put_provider_binding(PutEnvironmentProviderBinding {
-            universe_id: store.config().universe_id,
-            binding_id: EnvironmentProviderBindingId::new("primary"),
-            provider_id,
-            status: EnvironmentProviderBindingStatus::Enabled,
-            metadata: Default::default(),
-            expected_revision: None,
-            updated_at_ms: 2,
+        .create_registration_key(CreateEnvironmentRegistrationKey {
+            secret_hash: minted.secret.secret_hash.clone(),
+            record: minted.record.clone(),
         })
         .await
-        .expect("provider binding");
+        .expect("create key");
+    let environment_id = EnvironmentId::new("pod-0");
     store
-        .create_environment(CreateEnvironment {
-            request_id: EnvironmentProvisionRequestId::new("cred-request"),
+        .create_registered_environment(CreateRegisteredEnvironment {
+            registration_key_id: minted.record.registration_key_id.clone(),
+            secret_hash: minted.secret.secret_hash.clone(),
             environment_id: environment_id.clone(),
-            incarnation_id: EnvironmentIncarnationId::new("cred-incarnation"),
-            binding_id: EnvironmentProviderBindingId::new("primary"),
-            template_id: EnvironmentTemplateId::new("rust-v1"),
+            daemon_public_key: test_daemon_public_key(),
             display_name: None,
             metadata: Default::default(),
-
-            idle_policy: None,
-            created_at_ms: 3,
-        })
-        .await
-        .expect("create environment");
-
-    // Subscription credentials are ordinary static_bearer grants carrying
-    // metadata, so exercise two stored-secret grants.
-    for (grant_id, kind, provider) in [
-        ("authgrant_codex", AuthProviderKind::StaticBearer, "openai"),
-        (
-            "authgrant_claude",
-            AuthProviderKind::StaticBearer,
-            "anthropic",
-        ),
-    ] {
-        store
-            .create_grant(CreateAuthGrantRecord {
-                grant_id: AuthGrantId::new(grant_id),
-                provider_id: provider.to_owned(),
-                provider_kind: kind,
-                exposure: auth::AuthGrantExposure::Brokered,
-                created_by: api::Attribution::Local,
-                display_name: None,
-                subject_hint: None,
-                scopes: Vec::new(),
-                audience: None,
-                access_token_secret: Some(SecretId::new(format!("{grant_id}_access"))),
-                refresh_token_secret: None,
-                oauth_client: None,
-                expires_at_ms: None,
-                status: AuthGrantStatus::Active,
-                metadata: serde_json::json!({ "subscription": "codex" }),
-                created_at_ms: 4,
-            })
-            .await
-            .expect("create subscription grant");
-    }
-
-    let bound = store
-        .bind_credential(PutEnvironmentCredential {
-            environment_id: environment_id.clone(),
-            env_name: "CODEX_AUTH_JSON".to_owned(),
-            source: EnvironmentCredentialSource::AuthGrant {
-                grant_id: AuthGrantId::new("authgrant_codex"),
-            },
-            created_at_ms: 5,
+            daemon_build: test_build("1.0.0"),
+            created_at_ms: 2,
         })
         .await
-        .expect("bind codex credential");
-    assert_eq!(
-        bound.source,
-        EnvironmentCredentialSource::AuthGrant {
-            grant_id: AuthGrantId::new("authgrant_codex"),
-        }
-    );
+        .expect("admit registered environment");
+    let secret_id = SecretId::new("authsec_pod_token");
     store
-        .bind_credential(PutEnvironmentCredential {
-            environment_id: environment_id.clone(),
-            env_name: "CLAUDE_CODE_OAUTH_TOKEN".to_owned(),
-            source: EnvironmentCredentialSource::AuthGrant {
-                grant_id: AuthGrantId::new("authgrant_claude"),
-            },
-            created_at_ms: 6,
+        .put_secret(PutSecretRecord {
+            secret_id: secret_id.clone(),
+            secret_kind: SECRET_KIND_STATIC_BEARER.to_owned(),
+            value: SecretValue::new("token"),
+            created_at_ms: 3,
         })
         .await
-        .expect("bind plain credential");
-
-    // Rebinding the same name replaces the source.
-    let replaced = store
+        .expect("put secret");
+    store
         .bind_credential(PutEnvironmentCredential {
             environment_id: environment_id.clone(),
-            env_name: "CODEX_AUTH_JSON".to_owned(),
-            source: EnvironmentCredentialSource::AuthGrant {
-                grant_id: AuthGrantId::new("authgrant_claude"),
+            env_name: "POD_TOKEN".to_owned(),
+            source: EnvironmentCredentialSource::DirectSecret {
+                secret_id: secret_id.clone(),
             },
-            created_at_ms: 7,
+            created_at_ms: 4,
         })
         .await
-        .expect("rebind to another grant");
-    assert_eq!(
-        replaced.source,
-        EnvironmentCredentialSource::AuthGrant {
-            grant_id: AuthGrantId::new("authgrant_claude"),
-        }
-    );
+        .expect("bind credential");
 
-    let listed = store
-        .list_credentials(ListEnvironmentCredentials {
-            environment_id: environment_id.clone(),
-        })
-        .await
-        .expect("list credentials");
+    // Outside a universe delete the references still hold.
+    assert!(matches!(
+        store.delete_secret(&secret_id).await,
+        Err(AuthRegistryError::Store { .. })
+    ));
     assert_eq!(
-        listed
-            .iter()
-            .map(|c| c.env_name.as_str())
-            .collect::<Vec<_>>(),
-        vec!["CLAUDE_CODE_OAUTH_TOKEN", "CODEX_AUTH_JSON"]
+        violated_constraint(
+            sqlx::query(
+                "DELETE FROM environment_registration_keys WHERE universe_id = $1 AND registration_key_id = 'fleet'",
+            )
+            .bind(universe_id)
+            .execute(store.pool())
+            .await
+        )
+        .as_deref(),
+        Some("environments_registration_key_fk")
     );
 
-    store
-        .unbind_credential(&environment_id, "CODEX_AUTH_JSON")
-        .await
-        .expect("unbind");
-    assert_eq!(
-        store
-            .list_credentials(ListEnvironmentCredentials { environment_id })
+    assert!(
+        store_pg::delete_universe(store.pool(), universe_id)
             .await
-            .expect("list after unbind")
-            .len(),
-        1
+            .expect("delete universe with registered environment and credential binding")
     );
+    for table in [
+        "environments",
+        "environment_registration_keys",
+        "environment_registration_key_secrets",
+        "environment_credentials",
+        "auth_secrets",
+    ] {
+        let remaining: i64 = sqlx::query_scalar(sqlx::AssertSqlSafe(format!(
+            "SELECT count(*) FROM {table} WHERE universe_id = $1"
+        )))
+        .bind(universe_id)
+        .fetch_one(store.pool())
+        .await
+        .expect("count remaining rows");
+        assert_eq!(remaining, 0, "{table} cascades with the universe");
+    }
 }
 
 #[tokio::test(flavor = "current_thread")]
@@ -3815,3 +3442,1680 @@ async fn pg_live_concurrent_puts_leave_one_readable_object() {
     );
     assert_eq!(cold.read_bytes(&expected).await.expect("cold read"), bytes);
 }
+
+// ---------------------------------------------------------------------------
+// Environments
+// ---------------------------------------------------------------------------
+
+/// Register a provider with a unique id (providers are deployment-wide) and
+/// bind it, enabled, to the store's universe.
+async fn bound_test_provider(store: &PgStore, name: &str) -> EnvironmentProviderId {
+    let provider_id = EnvironmentProviderId::new(format!("{name}-{}", Uuid::new_v4().simple()));
+    store
+        .put_provider(PutEnvironmentProvider {
+            provider_id: provider_id.clone(),
+            display_name: None,
+            controller_endpoint: EnvironmentEndpoint::parse("ws://127.0.0.1:9100/control")
+                .expect("endpoint"),
+            data_route_base: None,
+            credential: ProviderCredentialChange::Keep,
+            updated_at_ms: 1,
+        })
+        .await
+        .expect("register provider");
+    store
+        .put_provider_binding(PutEnvironmentProviderBinding {
+            universe_id: store.config().universe_id,
+            provider_id: provider_id.clone(),
+            enabled: true,
+            updated_at_ms: 2,
+        })
+        .await
+        .expect("bind provider");
+    provider_id
+}
+
+fn create_environment(
+    provider_id: &EnvironmentProviderId,
+    request_id: &str,
+    environment_id: &str,
+    created_at_ms: i64,
+) -> CreateEnvironment {
+    CreateEnvironment {
+        request_id: EnvironmentProvisionRequestId::new(request_id),
+        environment_id: EnvironmentId::new(environment_id),
+        provider_id: provider_id.clone(),
+        template_id: EnvironmentTemplateId::new("rust-v1"),
+        idle: None,
+        display_name: None,
+        metadata: Default::default(),
+        created_at_ms,
+    }
+}
+
+fn test_build(version: &str) -> DaemonBuild {
+    DaemonBuild {
+        version: Some(version.to_owned()),
+        git_sha: None,
+        protocol_version: environment_protocol::ENVD_PROTOCOL_VERSION,
+    }
+}
+
+/// A fresh lowercase-hex daemon public key; unique deployment-wide.
+fn test_daemon_public_key() -> String {
+    format!("{}{}", Uuid::new_v4().simple(), Uuid::new_v4().simple())
+}
+
+/// The constraint a refused statement violated.
+fn violated_constraint<T>(result: Result<T, sqlx::Error>) -> Option<String> {
+    result.err().and_then(|error| {
+        error
+            .as_database_error()
+            .and_then(|database| database.constraint().map(str::to_owned))
+    })
+}
+
+#[tokio::test(flavor = "current_thread")]
+#[ignore = "requires ./dev.sh infra or compatible Postgres + MinIO env"]
+async fn pg_live_environment_provider_credentials_are_optional_and_sealed() {
+    let store = live_store("environment-providers", 1024).await;
+    let universe_id = store.config().universe_id;
+    let provider_id = EnvironmentProviderId::new(format!("provider-{}", Uuid::new_v4().simple()));
+    let endpoint = EnvironmentEndpoint::parse("ws://127.0.0.1:9100/control").expect("endpoint");
+    let put = |display_name: Option<&str>,
+               data_route_base: Option<DataRouteBase>,
+               credential: ProviderCredentialChange,
+               updated_at_ms: i64| PutEnvironmentProvider {
+        provider_id: provider_id.clone(),
+        display_name: display_name.map(str::to_owned),
+        controller_endpoint: endpoint.clone(),
+        data_route_base,
+        credential,
+        updated_at_ms,
+    };
+
+    // A new provider needs no credential, and its data route base derives
+    // from the controller endpoint.
+    let bare = store
+        .put_provider(put(None, None, ProviderCredentialChange::Keep, 1))
+        .await
+        .expect("register provider without a credential");
+    assert!(!bare.has_credential);
+    assert!(
+        store
+            .read_provider_credential(&provider_id)
+            .await
+            .expect("read absent credential")
+            .is_none()
+    );
+    assert_eq!(
+        bare.effective_data_route_base()
+            .expect("derived data route base")
+            .as_str(),
+        "ws://127.0.0.1:9100/routes"
+    );
+
+    // A set credential is sealed at rest.
+    let base = DataRouteBase::new("ws://127.0.0.1:9100/data").expect("base");
+    let sealed = store
+        .put_provider(put(
+            Some("Guard"),
+            Some(base.clone()),
+            ProviderCredentialChange::Set(SecretValue::new("guard-bearer-secret")),
+            2,
+        ))
+        .await
+        .expect("set credential");
+    assert!(sealed.has_credential);
+    assert_eq!(sealed.data_route_base, Some(base.clone()));
+    assert_eq!((sealed.created_at_ms, sealed.updated_at_ms), (1, 2));
+    let ciphertext: Vec<u8> = sqlx::query_scalar(
+        "SELECT credential_ciphertext FROM environment_providers WHERE provider_id = $1",
+    )
+    .bind(provider_id.as_str())
+    .fetch_one(store.pool())
+    .await
+    .expect("read sealed credential");
+    assert!(
+        !ciphertext
+            .windows(b"guard-bearer-secret".len())
+            .any(|window| window == b"guard-bearer-secret")
+    );
+
+    // Keep leaves the stored credential; Clear removes all three columns.
+    let renamed = store
+        .put_provider(put(
+            Some("Renamed"),
+            Some(base),
+            ProviderCredentialChange::Keep,
+            3,
+        ))
+        .await
+        .expect("rename provider");
+    assert!(renamed.has_credential);
+    assert_eq!(
+        store
+            .read_provider_credential(&provider_id)
+            .await
+            .expect("read credential")
+            .expect("credential kept")
+            .expose(),
+        "guard-bearer-secret"
+    );
+    let cleared = store
+        .put_provider(put(None, None, ProviderCredentialChange::Clear, 4))
+        .await
+        .expect("clear credential");
+    assert!(!cleared.has_credential);
+    assert!(cleared.data_route_base.is_none());
+    let columns: (Option<String>, Option<Vec<u8>>, Option<Vec<u8>>) = sqlx::query_as(
+        "SELECT credential_key_id, credential_nonce, credential_ciphertext FROM environment_providers WHERE provider_id = $1",
+    )
+    .bind(provider_id.as_str())
+    .fetch_one(store.pool())
+    .await
+    .expect("read credential columns");
+    assert_eq!(columns, (None, None, None));
+    assert!(
+        store
+            .list_providers()
+            .await
+            .expect("list providers")
+            .contains(&cleared)
+    );
+
+    // Bindings are keyed by provider; a missing provider is NotFound.
+    let binding = store
+        .put_provider_binding(PutEnvironmentProviderBinding {
+            universe_id,
+            provider_id: provider_id.clone(),
+            enabled: true,
+            updated_at_ms: 5,
+        })
+        .await
+        .expect("bind provider");
+    assert!(binding.enabled);
+    let disabled = store
+        .put_provider_binding(PutEnvironmentProviderBinding {
+            universe_id,
+            provider_id: provider_id.clone(),
+            enabled: false,
+            updated_at_ms: 6,
+        })
+        .await
+        .expect("disable binding");
+    assert!(!disabled.enabled);
+    assert_eq!((disabled.created_at_ms, disabled.updated_at_ms), (5, 6));
+    assert_eq!(
+        store
+            .read_provider_binding(universe_id, &provider_id)
+            .await
+            .expect("read binding"),
+        disabled
+    );
+    assert_eq!(
+        store
+            .list_provider_bindings(universe_id)
+            .await
+            .expect("list bindings"),
+        vec![disabled]
+    );
+    assert!(matches!(
+        store
+            .put_provider_binding(PutEnvironmentProviderBinding {
+                universe_id,
+                provider_id: EnvironmentProviderId::new(format!(
+                    "missing-{}",
+                    Uuid::new_v4().simple()
+                )),
+                enabled: true,
+                updated_at_ms: 6,
+            })
+            .await,
+        Err(EnvironmentRegistryError::NotFound {
+            kind: "environment_provider",
+            ..
+        })
+    ));
+
+    // Creates need an enabled binding; deletes are guarded.
+    assert!(matches!(
+        store
+            .create_environment(create_environment(
+                &provider_id,
+                "provider-request",
+                "provider-env",
+                10,
+            ))
+            .await,
+        Err(EnvironmentRegistryError::InvalidInput { .. })
+    ));
+    store
+        .put_provider_binding(PutEnvironmentProviderBinding {
+            universe_id,
+            provider_id: provider_id.clone(),
+            enabled: true,
+            updated_at_ms: 7,
+        })
+        .await
+        .expect("enable binding");
+    let environment = store
+        .create_environment(create_environment(
+            &provider_id,
+            "provider-request",
+            "provider-env",
+            10,
+        ))
+        .await
+        .expect("create environment");
+    assert!(matches!(
+        store.delete_provider(&provider_id).await,
+        Err(EnvironmentRegistryError::InvalidInput { .. })
+    ));
+    assert!(matches!(
+        store
+            .delete_provider_binding(universe_id, &provider_id)
+            .await,
+        Err(EnvironmentRegistryError::InvalidInput { .. })
+    ));
+    store
+        .begin_close_environment(BeginCloseEnvironment {
+            environment_id: environment.environment_id.clone(),
+            reason: EnvironmentCloseReason::Requested,
+            at_ms: 11,
+        })
+        .await
+        .expect("begin close");
+    let closed = store
+        .finish_close_environment(FinishCloseEnvironment {
+            environment_id: environment.environment_id.clone(),
+            at_ms: 12,
+        })
+        .await
+        .expect("finish close");
+    assert_eq!(closed.state, EnvironmentState::Closed);
+    store
+        .delete_provider_binding(universe_id, &provider_id)
+        .await
+        .expect("delete binding once its environments are closed");
+    store
+        .delete_provider(&provider_id)
+        .await
+        .expect("closed environments do not hold a provider");
+
+    // The all-or-none credential CHECK names its NULL case explicitly.
+    let orphan_id = format!("check-{}", Uuid::new_v4().simple());
+    let refused = sqlx::query(
+        "INSERT INTO environment_providers (provider_id, controller_endpoint, credential_nonce, credential_ciphertext, created_at_ms, updated_at_ms) VALUES ($1, 'ws://127.0.0.1:1/control', $2, $3, 1, 1)",
+    )
+    .bind(&orphan_id)
+    .bind(vec![0_u8; 12])
+    .bind(vec![1_u8; 16])
+    .execute(store.pool())
+    .await;
+    assert_eq!(
+        violated_constraint(refused).as_deref(),
+        Some("environment_providers_credential_all_or_none")
+    );
+}
+
+#[tokio::test(flavor = "current_thread")]
+#[ignore = "requires ./dev.sh infra or compatible Postgres + MinIO env"]
+async fn pg_live_provisioned_environment_lifecycle_follows_the_domain_rules() {
+    use environments::{
+        EndProvisionedEnvironment, EnvironmentDisplayStatus, FailEnvironment, IdlePolicy,
+        ObservedTarget, OpenEnvironment, PowerState, RecordTargetObservation,
+        ScheduleEnvironmentAttempt, TargetPhase, UpdateEnvironment,
+    };
+
+    let store = live_store("environment-lifecycle", 1024).await;
+    let provider_id = bound_test_provider(&store, "lifecycle").await;
+    let idle = IdlePolicy {
+        pause_after_ms: Some(60_000),
+        ..IdlePolicy::default()
+    };
+    let request = CreateEnvironment {
+        idle: Some(idle.clone()),
+        display_name: Some("Sandbox".to_owned()),
+        ..create_environment(&provider_id, "lifecycle-a", "lifecycle-a", 100)
+    };
+
+    // Creates are idempotent per request id with identical inputs.
+    let created = store
+        .create_environment(request.clone())
+        .await
+        .expect("create");
+    assert_eq!(created.state, EnvironmentState::Provisioning);
+    let source = created.provisioned().expect("provisioned").clone();
+    assert_eq!(source.idle, Some(idle));
+    assert_eq!((source.next_attempt_at_ms, source.attempts), (Some(100), 0));
+    assert_eq!(
+        store
+            .create_environment(CreateEnvironment {
+                created_at_ms: 200,
+                ..request.clone()
+            })
+            .await
+            .expect("retry create"),
+        created
+    );
+    assert!(matches!(
+        store
+            .create_environment(CreateEnvironment {
+                template_id: EnvironmentTemplateId::new("other-template"),
+                ..request.clone()
+            })
+            .await,
+        Err(EnvironmentRegistryError::AlreadyExists {
+            kind: "environment_request",
+            ..
+        })
+    ));
+    assert_eq!(
+        store
+            .read_environment(&created.environment_id)
+            .await
+            .expect("read back"),
+        created
+    );
+    assert!(matches!(
+        store
+            .create_environment(create_environment(
+                &EnvironmentProviderId::new(format!("unbound-{}", Uuid::new_v4().simple())),
+                "lifecycle-unbound",
+                "lifecycle-unbound",
+                100,
+            ))
+            .await,
+        Err(EnvironmentRegistryError::NotFound {
+            kind: "environment_provider_binding",
+            ..
+        })
+    ));
+
+    // The work queue holds due provisioning rows only.
+    let due = |rows: Vec<environments::EnvironmentRecord>| {
+        rows.iter()
+            .any(|record| record.environment_id == created.environment_id)
+    };
+    assert!(!due(store
+        .list_environment_work(99, 10)
+        .await
+        .expect("work")));
+    assert!(due(store
+        .list_environment_work(100, 10)
+        .await
+        .expect("work")));
+    let scheduled = store
+        .schedule_environment_attempt(ScheduleEnvironmentAttempt {
+            environment_id: created.environment_id.clone(),
+            expected_state: EnvironmentState::Provisioning,
+            next_attempt_at_ms: 2_100,
+            attempts: 1,
+            state_message: Some("waiting for the provider: booting".to_owned()),
+            at_ms: 101,
+        })
+        .await
+        .expect("schedule");
+    let source = scheduled.provisioned().expect("provisioned");
+    assert_eq!(
+        (source.next_attempt_at_ms, source.attempts),
+        (Some(2_100), 1)
+    );
+    assert_eq!(
+        scheduled.state_message.as_deref(),
+        Some("waiting for the provider: booting")
+    );
+    assert!(!due(store
+        .list_environment_work(2_099, 10)
+        .await
+        .expect("work")));
+
+    // Observations record the target id and keep the freshest report.
+    let target = ProviderTargetId::new("pod-a").expect("target id");
+    let observe = |target_id: Option<ProviderTargetId>, phase, power, at| RecordTargetObservation {
+        environment_id: created.environment_id.clone(),
+        provider_target_id: target_id,
+        observed: ObservedTarget {
+            phase,
+            power,
+            message: None,
+            observed_at_ms: 0,
+        },
+        public_endpoint: Some("https://a.example.test".to_owned()),
+        observed_at_ms: at,
+    };
+    let observed = store
+        .record_target_observation(observe(
+            Some(target.clone()),
+            TargetPhase::Active,
+            Some(PowerState::Running),
+            102,
+        ))
+        .await
+        .expect("observe");
+    let source = observed.provisioned().expect("provisioned");
+    assert_eq!(source.provider_target_id, Some(target.clone()));
+    assert_eq!(
+        source
+            .observed
+            .as_ref()
+            .map(|observed| observed.observed_at_ms),
+        Some(102)
+    );
+    assert_eq!(
+        source.public_endpoint.as_deref(),
+        Some("https://a.example.test")
+    );
+    let stale = store
+        .record_target_observation(observe(None, TargetPhase::Provisioning, None, 90))
+        .await
+        .expect("stale observation");
+    assert_eq!(stale, observed);
+    assert!(matches!(
+        store
+            .record_target_observation(observe(
+                Some(ProviderTargetId::new("pod-other").expect("target id")),
+                TargetPhase::Active,
+                None,
+                103,
+            ))
+            .await,
+        Err(EnvironmentRegistryError::InvalidInput { .. })
+    ));
+    let second = store
+        .create_environment(create_environment(
+            &provider_id,
+            "lifecycle-b",
+            "lifecycle-b",
+            100,
+        ))
+        .await
+        .expect("create second");
+    assert!(matches!(
+        store
+            .record_target_observation(RecordTargetObservation {
+                environment_id: second.environment_id.clone(),
+                ..observe(Some(target.clone()), TargetPhase::Active, None, 103)
+            })
+            .await,
+        Err(EnvironmentRegistryError::AlreadyExists {
+            kind: "provider_target",
+            ..
+        })
+    ));
+
+    // Open clears the schedule and records the build; a second open skips.
+    let opened = store
+        .open_environment(OpenEnvironment {
+            environment_id: created.environment_id.clone(),
+            daemon_build: test_build("1.2.3"),
+            at_ms: 104,
+        })
+        .await
+        .expect("open");
+    assert_eq!(opened.state, EnvironmentState::Open);
+    assert_eq!(opened.state_message, None);
+    assert_eq!(opened.daemon_build, Some(test_build("1.2.3")));
+    let source = opened.provisioned().expect("provisioned");
+    assert_eq!((source.next_attempt_at_ms, source.attempts), (None, 0));
+    assert_eq!(opened.display_status(), EnvironmentDisplayStatus::Ready);
+    assert!(
+        store
+            .list_open_provisioned_environments()
+            .await
+            .expect("open provisioned")
+            .contains(&opened)
+    );
+    assert_eq!(
+        store
+            .open_environment(OpenEnvironment {
+                environment_id: created.environment_id.clone(),
+                daemon_build: test_build("9.9.9"),
+                at_ms: 105,
+            })
+            .await
+            .expect("open again"),
+        opened
+    );
+
+    // Fail keeps the build; the provider ending the target closes it.
+    let failed = store
+        .fail_environment(FailEnvironment {
+            environment_id: created.environment_id.clone(),
+            message: "broken".to_owned(),
+            daemon_build: None,
+            at_ms: 106,
+        })
+        .await
+        .expect("fail");
+    assert_eq!(failed.state, EnvironmentState::Failed);
+    assert_eq!(failed.state_message.as_deref(), Some("broken"));
+    assert_eq!(failed.daemon_build, Some(test_build("1.2.3")));
+    let ended = store
+        .end_provisioned_environment(EndProvisionedEnvironment {
+            environment_id: created.environment_id.clone(),
+            at_ms: 107,
+        })
+        .await
+        .expect("end");
+    assert_eq!(ended.state, EnvironmentState::Closed);
+    assert_eq!(
+        ended.close_reason,
+        Some(EnvironmentCloseReason::ProviderEnded)
+    );
+    assert_eq!(
+        (ended.closed_at_ms, ended.state_message.as_deref()),
+        (Some(107), None)
+    );
+    // A closed row keeps no public endpoint, even after a late observation.
+    assert_eq!(
+        ended.provisioned().expect("provisioned").public_endpoint,
+        None
+    );
+    let late = store
+        .record_target_observation(observe(None, TargetPhase::Closed, None, 108))
+        .await
+        .expect("late observation");
+    assert_eq!(
+        late.provisioned().expect("provisioned").public_endpoint,
+        None
+    );
+    assert!(matches!(
+        store
+            .update_environment(UpdateEnvironment {
+                environment_id: created.environment_id.clone(),
+                display_name: None,
+                metadata: Default::default(),
+                updated_at_ms: 108,
+            })
+            .await,
+        Err(EnvironmentRegistryError::InvalidInput { .. })
+    ));
+
+    // A close accepted while a create was in flight wins over its answer.
+    let closing = store
+        .begin_close_environment(BeginCloseEnvironment {
+            environment_id: second.environment_id.clone(),
+            reason: EnvironmentCloseReason::Requested,
+            at_ms: 110,
+        })
+        .await
+        .expect("begin close");
+    assert_eq!(closing.state, EnvironmentState::Closing);
+    assert_eq!(
+        closing
+            .provisioned()
+            .and_then(|source| source.next_attempt_at_ms),
+        Some(110)
+    );
+    assert_eq!(
+        store
+            .open_environment(OpenEnvironment {
+                environment_id: second.environment_id.clone(),
+                daemon_build: test_build("1.2.3"),
+                at_ms: 111,
+            })
+            .await
+            .expect("late open"),
+        closing
+    );
+    assert_eq!(
+        store
+            .fail_environment(FailEnvironment {
+                environment_id: second.environment_id.clone(),
+                message: "late failure".to_owned(),
+                daemon_build: None,
+                at_ms: 111,
+            })
+            .await
+            .expect("late failure"),
+        closing
+    );
+    let finished = store
+        .finish_close_environment(FinishCloseEnvironment {
+            environment_id: second.environment_id.clone(),
+            at_ms: 112,
+        })
+        .await
+        .expect("finish close");
+    assert_eq!(
+        finished.close_reason,
+        Some(EnvironmentCloseReason::Requested)
+    );
+    assert_eq!(finished.closed_at_ms, Some(112));
+
+    // A lagging clock is clamped to the row's own times.
+    let late = store
+        .create_environment(create_environment(
+            &provider_id,
+            "lifecycle-c",
+            "lifecycle-c",
+            500,
+        ))
+        .await
+        .expect("create third");
+    let clamped = store
+        .begin_close_environment(BeginCloseEnvironment {
+            environment_id: late.environment_id.clone(),
+            reason: EnvironmentCloseReason::Requested,
+            at_ms: 10,
+        })
+        .await
+        .expect("close with a lagging clock");
+    assert_eq!(clamped.state_changed_at_ms, 500);
+    assert_eq!(
+        clamped
+            .provisioned()
+            .and_then(|source| source.next_attempt_at_ms),
+        Some(500)
+    );
+
+    // Updates replace the display name and caller metadata.
+    let renamed = store
+        .create_environment(create_environment(
+            &provider_id,
+            "lifecycle-d",
+            "lifecycle-d",
+            600,
+        ))
+        .await
+        .expect("create fourth");
+    let updated = store
+        .update_environment(UpdateEnvironment {
+            environment_id: renamed.environment_id.clone(),
+            display_name: Some("Renamed".to_owned()),
+            metadata: [("team".to_owned(), "infra".to_owned())].into(),
+            updated_at_ms: 601,
+        })
+        .await
+        .expect("update");
+    assert_eq!(updated.display_name.as_deref(), Some("Renamed"));
+    assert_eq!(
+        updated.metadata.get("team").map(String::as_str),
+        Some("infra")
+    );
+    assert!(matches!(
+        store
+            .update_environment(UpdateEnvironment {
+                environment_id: renamed.environment_id.clone(),
+                display_name: None,
+                metadata: [("lightspeed.reserved".to_owned(), "x".to_owned())].into(),
+                updated_at_ms: 602,
+            })
+            .await,
+        Err(EnvironmentRegistryError::InvalidInput { .. })
+    ));
+
+    // External environments are open at once and close in one step.
+    let external = CreateExternalEnvironment {
+        request_id: EnvironmentProvisionRequestId::new("lifecycle-external"),
+        environment_id: EnvironmentId::new("lifecycle-external"),
+        endpoint: EnvironmentEndpoint::parse("ws://127.0.0.1:9200/envd").expect("endpoint"),
+        display_name: None,
+        metadata: Default::default(),
+        created_at_ms: 700,
+    };
+    let opened_external = store
+        .create_external_environment(external.clone())
+        .await
+        .expect("create external");
+    assert_eq!(opened_external.state, EnvironmentState::Open);
+    assert_eq!(
+        store
+            .create_external_environment(external.clone())
+            .await
+            .expect("retry external"),
+        opened_external
+    );
+    assert!(matches!(
+        store
+            .fail_environment(FailEnvironment {
+                environment_id: external.environment_id.clone(),
+                message: "external".to_owned(),
+                daemon_build: None,
+                at_ms: 701,
+            })
+            .await,
+        Err(EnvironmentRegistryError::InvalidInput { .. })
+    ));
+    let closed_external = store
+        .begin_close_environment(BeginCloseEnvironment {
+            environment_id: external.environment_id.clone(),
+            reason: EnvironmentCloseReason::Requested,
+            at_ms: 702,
+        })
+        .await
+        .expect("close external");
+    assert_eq!(closed_external.state, EnvironmentState::Closed);
+    assert_eq!(closed_external.closed_at_ms, Some(702));
+
+    // Leave nothing for a running dev reconciler to chase.
+    store_pg::delete_universe(store.pool(), store.config().universe_id)
+        .await
+        .expect("delete test universe");
+    store
+        .delete_provider(&provider_id)
+        .await
+        .expect("delete test provider");
+}
+
+#[tokio::test(flavor = "current_thread")]
+#[ignore = "requires ./dev.sh infra or compatible Postgres + MinIO env"]
+async fn pg_live_environment_listing_pages_filters_and_skips_bad_rows() {
+    let store = live_store("environment-listing", 1024).await;
+    let provider_id = bound_test_provider(&store, "listing").await;
+    for index in 1..=5 {
+        let team = if index % 2 == 1 { "a" } else { "b" };
+        store
+            .create_environment(CreateEnvironment {
+                metadata: [("team".to_owned(), team.to_owned())].into(),
+                ..create_environment(
+                    &provider_id,
+                    &format!("list-request-{index}"),
+                    &format!("list-{index}"),
+                    10,
+                )
+            })
+            .await
+            .expect("create listed environment");
+    }
+    store
+        .begin_close_environment(BeginCloseEnvironment {
+            environment_id: EnvironmentId::new("list-2"),
+            reason: EnvironmentCloseReason::Requested,
+            at_ms: 11,
+        })
+        .await
+        .expect("begin close");
+    store
+        .finish_close_environment(FinishCloseEnvironment {
+            environment_id: EnvironmentId::new("list-2"),
+            at_ms: 12,
+        })
+        .await
+        .expect("finish close");
+    let ids = |page: &environments::EnvironmentPage| {
+        page.environments
+            .iter()
+            .map(|record| record.environment_id.as_str().to_owned())
+            .collect::<Vec<_>>()
+    };
+
+    // Closed rows are hidden by default; pages continue after an id.
+    let first = store
+        .list_environments(ListEnvironments {
+            limit: 2,
+            ..ListEnvironments::default()
+        })
+        .await
+        .expect("first page");
+    assert_eq!(ids(&first), ["list-1", "list-3"]);
+    assert_eq!(first.next_after, Some(EnvironmentId::new("list-3")));
+    let second = store
+        .list_environments(ListEnvironments {
+            limit: 2,
+            after: first.next_after.clone(),
+            ..ListEnvironments::default()
+        })
+        .await
+        .expect("second page");
+    assert_eq!(ids(&second), ["list-4", "list-5"]);
+    assert_eq!(second.next_after, None);
+    let all = store
+        .list_environments(ListEnvironments {
+            include_closed: true,
+            ..ListEnvironments::default()
+        })
+        .await
+        .expect("include closed");
+    assert_eq!(all.environments.len(), 5);
+    let closed = store
+        .list_environments(ListEnvironments {
+            state: Some(EnvironmentState::Closed),
+            ..ListEnvironments::default()
+        })
+        .await
+        .expect("closed only");
+    assert_eq!(ids(&closed), ["list-2"]);
+    let team_a = store
+        .list_environments(ListEnvironments {
+            metadata: [("team".to_owned(), "a".to_owned())].into(),
+            ..ListEnvironments::default()
+        })
+        .await
+        .expect("by metadata");
+    assert_eq!(ids(&team_a), ["list-1", "list-3", "list-5"]);
+    let by_provider = store
+        .list_environments(ListEnvironments {
+            provider_id: Some(provider_id.clone()),
+            ..ListEnvironments::default()
+        })
+        .await
+        .expect("by provider");
+    assert_eq!(ids(&by_provider), ["list-1", "list-3", "list-4", "list-5"]);
+    let other_provider = store
+        .list_environments(ListEnvironments {
+            provider_id: Some(EnvironmentProviderId::new("listing-other")),
+            ..ListEnvironments::default()
+        })
+        .await
+        .expect("by another provider");
+    assert!(other_provider.environments.is_empty());
+    for limit in [0, 501] {
+        assert!(matches!(
+            store
+                .list_environments(ListEnvironments {
+                    limit,
+                    ..ListEnvironments::default()
+                })
+                .await,
+            Err(EnvironmentRegistryError::InvalidInput { .. })
+        ));
+    }
+
+    // A row that no longer decodes is skipped by listings instead of
+    // failing them.
+    let oversized: serde_json::Map<String, serde_json::Value> = (0..40)
+        .map(|index| (format!("key{index}"), serde_json::json!("v")))
+        .collect();
+    sqlx::query(
+        "UPDATE environments SET metadata_json = $3 WHERE universe_id = $1 AND environment_id = $2",
+    )
+    .bind(store.config().universe_id)
+    .bind("list-4")
+    .bind(serde_json::Value::Object(oversized))
+    .execute(store.pool())
+    .await
+    .expect("poison row");
+    let listed = store
+        .list_environments(ListEnvironments::default())
+        .await
+        .expect("list despite a bad row");
+    assert_eq!(ids(&listed), ["list-1", "list-3", "list-5"]);
+
+    store_pg::delete_universe(store.pool(), store.config().universe_id)
+        .await
+        .expect("delete test universe");
+    store
+        .delete_provider(&provider_id)
+        .await
+        .expect("delete test provider");
+}
+
+#[tokio::test(flavor = "current_thread")]
+#[ignore = "requires ./dev.sh infra or compatible Postgres + MinIO env"]
+async fn pg_live_environment_checks_refuse_null_positive_disjuncts() {
+    use environments::{
+        CreateEnvironmentRegistrationKey, EnvironmentRegistrationKeyId,
+        EnvironmentRegistrationKeyStore, RegisteredIdentityMode, RegistrationKeyPolicy,
+        mint_registration_key,
+    };
+
+    let store = live_store("environment-checks", 1024).await;
+    let universe_id = store.config().universe_id;
+    let minted = mint_registration_key(
+        EnvironmentRegistrationKeyId::new("checks"),
+        RegistrationKeyPolicy {
+            display_name: "Checks".to_owned(),
+            identity_mode: RegisteredIdentityMode::Persistent,
+            max_active_environments: None,
+            ephemeral_disconnect_grace_ms: None,
+            offline_close_after_ms: None,
+            expires_at_ms: None,
+        },
+        1,
+    )
+    .expect("mint key");
+    store
+        .create_registration_key(CreateEnvironmentRegistrationKey {
+            secret_hash: minted.secret.secret_hash.clone(),
+            record: minted.record.clone(),
+        })
+        .await
+        .expect("create key");
+
+    let external = sqlx::query(
+        "INSERT INTO environments (universe_id, environment_id, source_kind, state, state_changed_at_ms, request_id, created_at_ms, updated_at_ms) VALUES ($1, 'check-external', 'external', 'open', 1, 'check-external', 1, 1)",
+    )
+    .bind(universe_id)
+    .execute(store.pool())
+    .await;
+    assert_eq!(
+        violated_constraint(external).as_deref(),
+        Some("environments_source_fields")
+    );
+
+    let public_key = test_daemon_public_key();
+    for (missing, daemon_public_key, connection_changed_at_ms, last_seen_at_ms) in [
+        ("daemon_public_key", None, Some(1_i64), Some(1_i64)),
+        (
+            "connection_changed_at_ms",
+            Some(public_key.as_str()),
+            None,
+            Some(1),
+        ),
+        ("last_seen_at_ms", Some(public_key.as_str()), Some(1), None),
+    ] {
+        let registered = sqlx::query(
+            "INSERT INTO environments (universe_id, environment_id, source_kind, state, state_changed_at_ms, registration_key_id, daemon_public_key, connected, connection_changed_at_ms, last_seen_at_ms, created_at_ms, updated_at_ms) VALUES ($1, $2, 'registered', 'open', 1, 'checks', $3, true, $4, $5, 1, 1)",
+        )
+        .bind(universe_id)
+        .bind(format!("check-registered-{missing}").replace('_', "-"))
+        .bind(daemon_public_key)
+        .bind(connection_changed_at_ms)
+        .bind(last_seen_at_ms)
+        .execute(store.pool())
+        .await;
+        assert_eq!(
+            violated_constraint(registered).as_deref(),
+            Some("environments_source_fields"),
+            "a registered row without {missing} must be refused"
+        );
+    }
+
+    let observed = sqlx::query(
+        "INSERT INTO environments (universe_id, environment_id, source_kind, state, state_changed_at_ms, request_id, provider_id, template_id, next_attempt_at_ms, observed_power, created_at_ms, updated_at_ms) VALUES ($1, 'check-observed', 'provisioned', 'provisioning', 1, 'check-observed', 'check-provider', 'rust-v1', 1, 'running', 1, 1)",
+    )
+    .bind(universe_id)
+    .execute(store.pool())
+    .await;
+    assert_eq!(
+        violated_constraint(observed).as_deref(),
+        Some("environments_observation")
+    );
+}
+
+#[tokio::test(flavor = "current_thread")]
+#[ignore = "requires ./dev.sh infra or compatible Postgres + MinIO env"]
+async fn pg_live_registered_environments_track_connections_and_sweep() {
+    use environments::{
+        CreateEnvironmentRegistrationKey, CreateRegisteredEnvironment,
+        EnvironmentRegistrationKeyId, EnvironmentRegistrationKeyStore, EnvironmentUse,
+        EnvironmentWaitReason, MarkRegisteredConnected, MarkRegisteredDisconnected,
+        REGISTERED_RECONNECT_WAIT_MS, RegisteredIdentityMode, RegistrationKeyPolicy,
+        StampRegisteredSeen, mint_registration_key,
+    };
+
+    let store = live_store("environment-registered", 1024).await;
+    let universe_id = store.config().universe_id;
+    let create_key = |id: &str, identity_mode, grace, offline_close| {
+        mint_registration_key(
+            EnvironmentRegistrationKeyId::new(id),
+            RegistrationKeyPolicy {
+                display_name: id.to_owned(),
+                identity_mode,
+                max_active_environments: Some(2),
+                ephemeral_disconnect_grace_ms: grace,
+                offline_close_after_ms: offline_close,
+                expires_at_ms: None,
+            },
+            1,
+        )
+        .expect("mint key")
+    };
+    let mut secrets = std::collections::BTreeMap::new();
+    for minted in [
+        create_key(
+            "fleet",
+            RegisteredIdentityMode::Persistent,
+            None,
+            Some(3_600_000),
+        ),
+        create_key(
+            "sandboxes",
+            RegisteredIdentityMode::Ephemeral,
+            Some(60_000),
+            None,
+        ),
+    ] {
+        store
+            .create_registration_key(CreateEnvironmentRegistrationKey {
+                secret_hash: minted.secret.secret_hash.clone(),
+                record: minted.record.clone(),
+            })
+            .await
+            .expect("create key");
+        secrets.insert(
+            minted.record.registration_key_id.to_string(),
+            minted.secret.secret_hash,
+        );
+    }
+    let admit =
+        |key: &str, environment_id: &str, public_key: &str, at: i64| CreateRegisteredEnvironment {
+            registration_key_id: EnvironmentRegistrationKeyId::new(key),
+            secret_hash: secrets[key].clone(),
+            environment_id: EnvironmentId::new(environment_id),
+            daemon_public_key: public_key.to_owned(),
+            display_name: Some(environment_id.to_owned()),
+            metadata: Default::default(),
+            daemon_build: test_build("1.0.0"),
+            created_at_ms: at,
+        };
+
+    // Admission inserts an open, connected row; a known identity converges.
+    let key_0 = test_daemon_public_key();
+    let pod_0 = store
+        .create_registered_environment(admit("fleet", "pod-0", &key_0, 100))
+        .await
+        .expect("admit pod-0");
+    assert_eq!(pod_0.state, EnvironmentState::Open);
+    assert_eq!(pod_0.request_id, None);
+    let source = pod_0.registered().expect("registered").clone();
+    assert!(source.connected);
+    assert_eq!(source.identity_mode, RegisteredIdentityMode::Persistent);
+    assert_eq!(
+        (source.connection_changed_at_ms, source.last_seen_at_ms),
+        (100, 100)
+    );
+    assert_eq!(
+        store
+            .create_registered_environment(admit("fleet", "pod-0-retry", &key_0, 200))
+            .await
+            .expect("retry admission"),
+        pod_0
+    );
+    assert_eq!(
+        store
+            .read_environment_by_daemon_public_key(&key_0)
+            .await
+            .expect("read by daemon key"),
+        Some(pod_0.clone())
+    );
+    assert_eq!(
+        store_pg::find_registered_environment_universe(store.pool(), &key_0)
+            .await
+            .expect("find universe by daemon key"),
+        Some(universe_id)
+    );
+    store
+        .create_registered_environment(admit("fleet", "pod-1", &test_daemon_public_key(), 150))
+        .await
+        .expect("admit pod-1");
+    assert!(matches!(
+        store
+            .create_registered_environment(admit("fleet", "pod-2", &test_daemon_public_key(), 160,))
+            .await,
+        Err(EnvironmentRegistryError::RegistrationCapacityExhausted { limit: 2, .. })
+    ));
+    let listed_universes = store_pg::list_universes_with_registered_environments(store.pool())
+        .await
+        .expect("universes with registered environments");
+    assert!(listed_universes.contains(&universe_id));
+
+    // The liveness stamp is coarse and conditional.
+    let stamp = |at_ms| StampRegisteredSeen {
+        environment_id: EnvironmentId::new("pod-0"),
+        at_ms,
+    };
+    assert!(
+        !store
+            .stamp_registered_seen(stamp(300_099))
+            .await
+            .expect("early stamp")
+    );
+    assert!(
+        store
+            .stamp_registered_seen(stamp(300_100))
+            .await
+            .expect("due stamp")
+    );
+    assert_eq!(
+        store
+            .read_environment(&EnvironmentId::new("pod-0"))
+            .await
+            .expect("read stamped")
+            .registered()
+            .map(|source| source.last_seen_at_ms),
+        Some(300_100)
+    );
+    assert!(matches!(
+        store
+            .stamp_registered_seen(StampRegisteredSeen {
+                environment_id: EnvironmentId::new("missing"),
+                at_ms: 1,
+            })
+            .await,
+        Err(EnvironmentRegistryError::NotFound { .. })
+    ));
+
+    // Disconnects and reconnects are written on the transition only.
+    let disconnected = store
+        .mark_registered_disconnected(MarkRegisteredDisconnected {
+            environment_id: EnvironmentId::new("pod-0"),
+            at_ms: 400_000,
+        })
+        .await
+        .expect("disconnect");
+    let source = disconnected.registered().expect("registered");
+    assert!(!source.connected);
+    assert_eq!(source.connection_changed_at_ms, 400_000);
+    assert_eq!(
+        store
+            .mark_registered_disconnected(MarkRegisteredDisconnected {
+                environment_id: EnvironmentId::new("pod-0"),
+                at_ms: 400_500,
+            })
+            .await
+            .expect("disconnect again"),
+        disconnected
+    );
+    assert_eq!(
+        disconnected.use_gate(400_001),
+        EnvironmentUse::Wait {
+            reason: EnvironmentWaitReason::Disconnected,
+            retry_after_ms: environments::WAIT_RETRY_AFTER_MS,
+            until_ms: Some(400_000 + REGISTERED_RECONNECT_WAIT_MS),
+        }
+    );
+    assert!(
+        !store
+            .stamp_registered_seen(stamp(900_000))
+            .await
+            .expect("stamp while away")
+    );
+    let reconnected = store
+        .mark_registered_connected(MarkRegisteredConnected {
+            environment_id: EnvironmentId::new("pod-0"),
+            daemon_build: test_build("1.1.0"),
+            at_ms: 410_000,
+        })
+        .await
+        .expect("reconnect");
+    let source = reconnected.registered().expect("registered");
+    assert!(source.connected);
+    assert_eq!(
+        (source.connection_changed_at_ms, source.last_seen_at_ms),
+        (410_000, 410_000)
+    );
+    assert_eq!(reconnected.daemon_build, Some(test_build("1.1.0")));
+
+    // A gateway restart disconnects every connected row as of now.
+    assert_eq!(
+        store
+            .repair_registered_connections(500_000)
+            .await
+            .expect("repair"),
+        2
+    );
+    let repaired = store
+        .read_environment(&EnvironmentId::new("pod-0"))
+        .await
+        .expect("read repaired");
+    let source = repaired.registered().expect("registered");
+    assert!(!source.connected);
+    assert_eq!(
+        (source.connection_changed_at_ms, source.last_seen_at_ms),
+        (500_000, 410_000)
+    );
+
+    // Sweep rule 2: an ephemeral daemon away past its grace closes.
+    store
+        .create_registered_environment(admit(
+            "sandboxes",
+            "sbx-0",
+            &test_daemon_public_key(),
+            1_000_000,
+        ))
+        .await
+        .expect("admit sbx-0");
+    store
+        .create_registered_environment(admit(
+            "sandboxes",
+            "sbx-1",
+            &test_daemon_public_key(),
+            1_000_000,
+        ))
+        .await
+        .expect("admit sbx-1");
+    store
+        .mark_registered_disconnected(MarkRegisteredDisconnected {
+            environment_id: EnvironmentId::new("sbx-0"),
+            at_ms: 1_000_000,
+        })
+        .await
+        .expect("disconnect sbx-0");
+    let sweep = store
+        .sweep_registered_environments(1_060_001)
+        .await
+        .expect("first sweep");
+    assert!(sweep.disconnected.is_empty());
+    assert_eq!(
+        sweep.closed,
+        vec![(
+            EnvironmentId::new("sbx-0"),
+            EnvironmentCloseReason::EphemeralGrace
+        )]
+    );
+
+    // Rule 1 flips a stale connected row, which rule 2 then closes; rule 3
+    // closes persistent rows away past the key's offline close-after.
+    let sweep = store
+        .sweep_registered_environments(4_200_000)
+        .await
+        .expect("second sweep");
+    assert_eq!(sweep.disconnected, vec![EnvironmentId::new("sbx-1")]);
+    assert_eq!(
+        sweep.closed,
+        vec![
+            (
+                EnvironmentId::new("pod-0"),
+                EnvironmentCloseReason::OfflineTimeout
+            ),
+            (
+                EnvironmentId::new("pod-1"),
+                EnvironmentCloseReason::OfflineTimeout
+            ),
+            (
+                EnvironmentId::new("sbx-1"),
+                EnvironmentCloseReason::EphemeralGrace
+            ),
+        ]
+    );
+    let closed = store
+        .read_environment(&EnvironmentId::new("pod-0"))
+        .await
+        .expect("read swept");
+    assert_eq!(closed.state, EnvironmentState::Closed);
+    assert_eq!(closed.closed_at_ms, Some(4_200_000));
+    assert!(
+        store
+            .sweep_registered_environments(4_200_000)
+            .await
+            .expect("idle sweep")
+            .closed
+            .is_empty()
+    );
+
+    // A closed identity is spent.
+    assert!(matches!(
+        store
+            .mark_registered_connected(MarkRegisteredConnected {
+                environment_id: EnvironmentId::new("pod-0"),
+                daemon_build: test_build("1.1.0"),
+                at_ms: 4_300_000,
+            })
+            .await,
+        Err(EnvironmentRegistryError::InvalidInput { .. })
+    ));
+    assert_eq!(
+        store
+            .create_registered_environment(admit("fleet", "pod-0-again", &key_0, 4_300_000))
+            .await
+            .expect("spent identity converges"),
+        closed
+    );
+    let usage = store
+        .registration_key_usage(&EnvironmentRegistrationKeyId::new("fleet"))
+        .await
+        .expect("usage");
+    assert_eq!((usage.registered, usage.active), (2, 0));
+}
+
+#[tokio::test(flavor = "current_thread")]
+#[ignore = "requires ./dev.sh infra or compatible Postgres + MinIO env"]
+async fn pg_live_registration_keys_rotate_update_and_resolve_live_secrets() {
+    use environments::{
+        CreateEnvironmentRegistrationKey, CreateRegisteredEnvironment,
+        EnvironmentRegistrationKeyId, EnvironmentRegistrationKeyStore, RegisteredIdentityMode,
+        RegistrationKeyPolicy, RegistrationKeySettings, RevokeEnvironmentRegistrationKey,
+        RotateEnvironmentRegistrationKey, UpdateEnvironmentRegistrationKey, mint_registration_key,
+        mint_registration_secret,
+    };
+
+    let store = live_store("environment-keys", 1024).await;
+    let universe_id = store.config().universe_id;
+    let key_id = EnvironmentRegistrationKeyId::new("rotating");
+    let policy = |identity_mode| RegistrationKeyPolicy {
+        display_name: "Rotating".to_owned(),
+        identity_mode,
+        max_active_environments: None,
+        ephemeral_disconnect_grace_ms: None,
+        offline_close_after_ms: None,
+        expires_at_ms: None,
+    };
+    let minted = mint_registration_key(
+        key_id.clone(),
+        policy(RegisteredIdentityMode::Persistent),
+        1,
+    )
+    .expect("mint key");
+    let created = store
+        .create_registration_key(CreateEnvironmentRegistrationKey {
+            secret_hash: minted.secret.secret_hash.clone(),
+            record: minted.record.clone(),
+        })
+        .await
+        .expect("create key");
+    assert_eq!(created, minted.record);
+    assert_eq!(
+        store
+            .resolve_registration_key(&minted.secret.secret_hash)
+            .await
+            .expect("resolve"),
+        Some(created.clone())
+    );
+    assert_eq!(
+        store_pg::find_registration_key_universe(store.pool(), &minted.secret.secret_hash)
+            .await
+            .expect("find universe"),
+        Some(universe_id)
+    );
+    assert!(matches!(
+        store
+            .create_registration_key(CreateEnvironmentRegistrationKey {
+                secret_hash: mint_registration_secret().secret_hash,
+                record: minted.record.clone(),
+            })
+            .await,
+        Err(EnvironmentRegistryError::AlreadyExists {
+            kind: "environment_registration_key",
+            ..
+        })
+    ));
+
+    // Rotation retires the live secret and keeps the key.
+    let rotated_secret = mint_registration_secret();
+    let rotated = store
+        .rotate_registration_key(RotateEnvironmentRegistrationKey {
+            registration_key_id: key_id.clone(),
+            secret_hash: rotated_secret.secret_hash.clone(),
+            key_prefix: rotated_secret.key_prefix.clone(),
+            rotated_at_ms: 10,
+        })
+        .await
+        .expect("rotate");
+    assert_eq!(rotated.key_prefix, rotated_secret.key_prefix);
+    assert_eq!((rotated.created_at_ms, rotated.updated_at_ms), (1, 10));
+    assert_eq!(
+        store
+            .read_registration_key(&key_id)
+            .await
+            .expect("read rotated"),
+        rotated
+    );
+    assert_eq!(
+        store
+            .resolve_registration_key(&minted.secret.secret_hash)
+            .await
+            .expect("resolve retired"),
+        None
+    );
+    assert_eq!(
+        store
+            .resolve_registration_key(&rotated_secret.secret_hash)
+            .await
+            .expect("resolve live"),
+        Some(rotated.clone())
+    );
+    assert_eq!(
+        store_pg::find_registration_key_universe(store.pool(), &minted.secret.secret_hash)
+            .await
+            .expect("find by retired secret"),
+        None
+    );
+    // An admission that resolved the key before the rotation committed
+    // presents the retired secret: refused inside the key-locked
+    // transaction. The live secret admits.
+    let admit = |secret_hash: &str| CreateRegisteredEnvironment {
+        registration_key_id: key_id.clone(),
+        secret_hash: secret_hash.to_owned(),
+        environment_id: EnvironmentId::new("rotating-pod"),
+        daemon_public_key: test_daemon_public_key(),
+        display_name: None,
+        metadata: Default::default(),
+        daemon_build: test_build("1.0.0"),
+        created_at_ms: 12,
+    };
+    assert!(matches!(
+        store
+            .create_registered_environment(admit(&minted.secret.secret_hash))
+            .await,
+        Err(EnvironmentRegistryError::RegistrationKeyUnavailable {
+            reason: "rotated",
+            ..
+        })
+    ));
+    assert_eq!(
+        store
+            .create_registered_environment(admit(&rotated_secret.secret_hash))
+            .await
+            .expect("admit with the live secret")
+            .state,
+        EnvironmentState::Open
+    );
+    assert!(matches!(
+        store
+            .rotate_registration_key(RotateEnvironmentRegistrationKey {
+                registration_key_id: key_id.clone(),
+                secret_hash: minted.secret.secret_hash.clone(),
+                key_prefix: minted.secret.key_prefix.clone(),
+                rotated_at_ms: 11,
+            })
+            .await,
+        Err(EnvironmentRegistryError::AlreadyExists {
+            kind: "environment_registration_key_secret",
+            ..
+        })
+    ));
+
+    // Updates replace the editable policy; the identity mode bounds it.
+    let updated = store
+        .update_registration_key(UpdateEnvironmentRegistrationKey {
+            registration_key_id: key_id.clone(),
+            settings: RegistrationKeySettings {
+                display_name: "Renamed".to_owned(),
+                max_active_environments: Some(5),
+                ephemeral_disconnect_grace_ms: None,
+                offline_close_after_ms: Some(60_000),
+                expires_at_ms: Some(1_000_000),
+            },
+            updated_at_ms: 20,
+        })
+        .await
+        .expect("update");
+    assert_eq!(updated.display_name, "Renamed");
+    assert_eq!(updated.offline_close_after_ms, Some(60_000));
+    assert_eq!(updated.updated_at_ms, 20);
+    assert_eq!(
+        store
+            .read_registration_key(&key_id)
+            .await
+            .expect("read updated"),
+        updated
+    );
+    let ephemeral_id = EnvironmentRegistrationKeyId::new("ephemeral");
+    let ephemeral = mint_registration_key(
+        ephemeral_id.clone(),
+        policy(RegisteredIdentityMode::Ephemeral),
+        1,
+    )
+    .expect("mint ephemeral key");
+    store
+        .create_registration_key(CreateEnvironmentRegistrationKey {
+            secret_hash: ephemeral.secret.secret_hash.clone(),
+            record: ephemeral.record.clone(),
+        })
+        .await
+        .expect("create ephemeral key");
+    assert!(matches!(
+        store
+            .update_registration_key(UpdateEnvironmentRegistrationKey {
+                registration_key_id: ephemeral_id,
+                settings: RegistrationKeySettings {
+                    display_name: "Ephemeral".to_owned(),
+                    max_active_environments: None,
+                    ephemeral_disconnect_grace_ms: None,
+                    offline_close_after_ms: Some(60_000),
+                    expires_at_ms: None,
+                },
+                updated_at_ms: 21,
+            })
+            .await,
+        Err(EnvironmentRegistryError::InvalidInput { .. })
+    ));
+    assert_eq!(
+        store
+            .list_registration_keys()
+            .await
+            .expect("list keys")
+            .len(),
+        2
+    );
+
+    // Revocation is idempotent and stops rotation; resolve still answers so
+    // the caller can refuse with the reason.
+    let revoked = store
+        .revoke_registration_key(RevokeEnvironmentRegistrationKey {
+            registration_key_id: key_id.clone(),
+            revoked_at_ms: 30,
+        })
+        .await
+        .expect("revoke");
+    assert_eq!(revoked.revoked_at_ms, Some(30));
+    assert_eq!(
+        store
+            .revoke_registration_key(RevokeEnvironmentRegistrationKey {
+                registration_key_id: key_id.clone(),
+                revoked_at_ms: 40,
+            })
+            .await
+            .expect("revoke again")
+            .revoked_at_ms,
+        Some(30)
+    );
+    assert!(matches!(
+        store
+            .rotate_registration_key(RotateEnvironmentRegistrationKey {
+                registration_key_id: key_id.clone(),
+                secret_hash: mint_registration_secret().secret_hash,
+                key_prefix: "lsrk_revoked".to_owned(),
+                rotated_at_ms: 50,
+            })
+            .await,
+        Err(EnvironmentRegistryError::RegistrationKeyUnavailable {
+            reason: "revoked",
+            ..
+        })
+    ));
+    assert!(
+        store
+            .resolve_registration_key(&rotated_secret.secret_hash)
+            .await
+            .expect("resolve revoked key")
+            .is_some_and(|key| key.revoked_at_ms == Some(30))
+    );
+}
+
+#[tokio::test(flavor = "current_thread")]
+#[ignore = "requires ./dev.sh infra or compatible Postgres + MinIO env"]
+async fn pg_live_environment_deployment_queries_find_work_and_revoked_routes() {
+    use environments::{ObservedTarget, OpenEnvironment, RecordTargetObservation, TargetPhase};
+
+    let store = live_store("environment-deployment-queries", 1024).await;
+    let universe_id = store.config().universe_id;
+    let provider_id = bound_test_provider(&store, "deployment-queries").await;
+    let opened = store
+        .create_environment(create_environment(
+            &provider_id,
+            "deployment-opened",
+            "deployment-opened",
+            100,
+        ))
+        .await
+        .expect("create opened environment");
+    let closing = store
+        .create_environment(create_environment(
+            &provider_id,
+            "deployment-closing",
+            "deployment-closing",
+            100,
+        ))
+        .await
+        .expect("create closing environment");
+    store
+        .begin_close_environment(BeginCloseEnvironment {
+            environment_id: closing.environment_id.clone(),
+            reason: EnvironmentCloseReason::Requested,
+            at_ms: 100,
+        })
+        .await
+        .expect("begin close");
+    assert!(
+        store_pg::list_universes_with_environment_work(store.pool(), 10_000_000)
+            .await
+            .expect("universes with work")
+            .contains(&universe_id)
+    );
+
+    // Revoked routes: gone or not open rows, and rows whose binding is
+    // disabled.
+    store
+        .record_target_observation(RecordTargetObservation {
+            environment_id: opened.environment_id.clone(),
+            provider_target_id: Some(
+                ProviderTargetId::new("deployment-target").expect("target id"),
+            ),
+            observed: ObservedTarget {
+                phase: TargetPhase::Active,
+                power: None,
+                message: None,
+                observed_at_ms: 0,
+            },
+            public_endpoint: None,
+            observed_at_ms: 101,
+        })
+        .await
+        .expect("observe opened");
+    store
+        .open_environment(OpenEnvironment {
+            environment_id: opened.environment_id.clone(),
+            daemon_build: test_build("1.0.0"),
+            at_ms: 102,
+        })
+        .await
+        .expect("open opened");
+    assert!(
+        store_pg::list_universes_with_open_provisioned_environments(store.pool())
+            .await
+            .expect("universes with open provisioned environments")
+            .contains(&universe_id)
+    );
+    let routes = vec![
+        (universe_id, opened.environment_id.as_str().to_owned()),
+        (universe_id, closing.environment_id.as_str().to_owned()),
+        (universe_id, "deployment-missing".to_owned()),
+    ];
+    assert_eq!(
+        store_pg::list_revoked_environment_routes(store.pool(), &routes)
+            .await
+            .expect("revoked routes"),
+        vec![
+            (universe_id, closing.environment_id.as_str().to_owned()),
+            (universe_id, "deployment-missing".to_owned()),
+        ]
+    );
+    store
+        .put_provider_binding(PutEnvironmentProviderBinding {
+            universe_id,
+            provider_id: provider_id.clone(),
+            enabled: false,
+            updated_at_ms: 103,
+        })
+        .await
+        .expect("disable binding");
+    assert!(
+        store_pg::list_revoked_environment_routes(store.pool(), &routes)
+            .await
+            .expect("revoked routes after disable")
+            .contains(&(universe_id, opened.environment_id.as_str().to_owned()))
+    );
+
+    store_pg::delete_universe(store.pool(), universe_id)
+        .await
+        .expect("delete test universe");
+    store
+        .delete_provider(&provider_id)
+        .await
+        .expect("delete test provider");
+}
diff --git a/crates/temporal-runtime/src/environments/fake_controller.rs b/crates/temporal-runtime/src/environments/fake_controller.rs
index 4879a081d..6dbe4b763 100644
--- a/crates/temporal-runtime/src/environments/fake_controller.rs
+++ b/crates/temporal-runtime/src/environments/fake_controller.rs
@@ -1,22 +1,29 @@
 //! An in-memory provider controller for tests.
 //!
 //! It serves the controller plane on `/control` and a minimal data plane on
-//! `/routes/{universeId}/{bindingId}/{environmentId}/{incarnationId}/{targetId}`
-//! over a loopback WebSocket listener, and checks the provider credential
-//! as a bearer token on both, exactly as a real provider must. Nothing
-//! registers it: a test starts one and registers its controller URL and
-//! credential like any provider's.
+//! `/routes/{universeId}/{environmentId}/{targetId}` over a loopback
+//! WebSocket listener, so Lightspeed's derived data route base
+//! (`{controller origin}/routes`) reaches it. When started with a
+//! credential it checks it as a bearer token on both, exactly as a real
+//! provider must; without one it checks nothing. Nothing registers it: a
+//! test starts one and registers its controller URL (and credential, if
+//! any) like any provider's.
 //!
 //! Targets come up at once: `target/create` answers an `active`, `running`
-//! target whose daemon is ready, and power changes and closes complete
-//! before they answer. The data route answers `initialize` only, as an envd
-//! with no capability families, which is enough for the runtime's
-//! data-plane handshake at the Ready transition.
+//! target, and power changes and closes complete before they answer. A data
+//! route dial wakes a powered-down target and refuses `waking` once, and a
+//! new target may refuse `booting` for a configured number of dials; after
+//! that the route answers `initialize` only, as an envd with no capability
+//! families, which is enough for the runtime's open handshake. Tests change
+//! targets out of band the way a provider's own idle policy or TTL would.
 
 use std::{
     collections::BTreeMap,
     hash::{DefaultHasher, Hash, Hasher},
-    sync::Arc,
+    sync::{
+        Arc,
+        atomic::{AtomicBool, Ordering},
+    },
 };
 
 use axum::{
@@ -34,13 +41,12 @@ use environment_protocol::{
     control::{
         handshake::{
             ControllerCapabilities, ControllerInitializeParams, ControllerInitializeResponse,
-            ControllerRoutes,
         },
         ingress::{EnsureIngressParams, RemoveIngressParams},
         target::{
-            AdoptTargetParams, CloseTargetParams, CreateTargetParams, GetTargetParams,
-            IngressObservation, PowerState, SetTargetPowerParams, TargetObservation, TargetOwner,
-            TargetPhase, TargetRef, TargetResponse, TargetState,
+            CloseTargetParams, CreateTargetParams, GetTargetParams, IngressObservation, PowerState,
+            SetTargetPowerParams, TargetObservation, TargetOwner, TargetPhase, TargetRef,
+            TargetResponse,
         },
         template::{EnvironmentTemplate, ListTemplatesResponse, TemplateResources},
     },
@@ -51,19 +57,16 @@ use environment_protocol::{
     },
     error::{Capability, PreconditionReason, ProtocolError, ProtocolErrorKind},
     handshake::{ImplementationInfo, Plane},
-    ids::{
-        BindingId, DaemonInstanceId, EnvironmentId, IncarnationId, ProviderTargetId, TemplateId,
-        UniverseId,
-    },
+    ids::{DaemonInstanceId, EnvironmentId, ProviderTargetId, TemplateId, UniverseId},
     jsonrpc::{self, Request, Response as RpcResponse},
     limits::{MAX_MESSAGE_BYTES, MIN_CONCURRENT_REQUESTS},
     manifest::{
-        ControllerInitialize, IngressEnsure, IngressRemove, RequestMethod, TargetAdopt,
-        TargetClose, TargetCreate, TargetGet, TargetSetPower, TemplateList,
+        ControllerInitialize, IngressEnsure, IngressRemove, RequestMethod, TargetClose,
+        TargetCreate, TargetGet, TargetSetPower, TemplateList,
     },
     metadata::{DescriptiveText, DisplayName, Metadata},
     paths::EnvironmentPath,
-    routes::{DataRouteBase, PublicUrl},
+    routes::{DataRouteRefusal, PublicUrl},
 };
 use futures_util::{SinkExt, StreamExt};
 use serde::{Serialize, de::DeserializeOwned};
@@ -76,8 +79,8 @@ pub const FAKE_TEMPLATE_ID: &str = "rust-v1";
 /// Public endpoint the fake controller reports for enabled ingress.
 pub const FAKE_INGRESS_ENDPOINT: &str = "https://fake.env.test";
 
-/// Power states the fake controller supports. Suspended is included so the
-/// suspend path has coverage.
+/// Power states the fake controller supports when it offers power control.
+/// Suspended is included so the suspend path has coverage.
 pub const FAKE_POWER_STATES: [PowerState; 4] = [
     PowerState::Running,
     PowerState::Paused,
@@ -85,13 +88,21 @@ pub const FAKE_POWER_STATES: [PowerState; 4] = [
     PowerState::Stopped,
 ];
 
-/// What the fake controller advertises.
+/// `Retry-After` of the fake data route's 503 refusals, in seconds.
+pub const FAKE_RETRY_AFTER_SECS: u64 = 1;
+
+/// What the fake controller advertises and how its data routes behave.
 #[derive(Clone, Debug)]
 pub struct FakeControllerOptions {
-    /// `capabilities.adoptTarget`.
-    pub adopt_target: bool,
+    /// `capabilities.power`.
+    pub power: bool,
     /// `capabilities.ingress`.
     pub ingress: bool,
+    /// Require a bearer credential on the controller and its data routes.
+    pub credential: bool,
+    /// Data route dials of a new target that are refused `booting` before
+    /// its envd answers.
+    pub booting_dials: u32,
     /// The protocol version the fake envd behind every data route speaks.
     pub daemon_protocol_version: u32,
 }
@@ -99,8 +110,10 @@ pub struct FakeControllerOptions {
 impl Default for FakeControllerOptions {
     fn default() -> Self {
         Self {
-            adopt_target: true,
+            power: true,
             ingress: true,
+            credential: true,
+            booting_dials: 0,
             daemon_protocol_version: ENVD_PROTOCOL_VERSION,
         }
     }
@@ -109,7 +122,8 @@ impl Default for FakeControllerOptions {
 /// A running fake controller. Dropping it stops the listener.
 pub struct FakeController {
     controller_url: String,
-    credential: String,
+    credential: Option<String>,
+    app: Arc<App>,
     task: JoinHandle<()>,
 }
 
@@ -122,38 +136,39 @@ impl FakeController {
     pub async fn start_with(options: FakeControllerOptions) -> std::io::Result<Self> {
         let listener = TcpListener::bind("127.0.0.1:0").await?;
         let address = listener.local_addr()?;
-        let credential = format!("fake-credential-{}", uuid::Uuid::new_v4().simple());
-        let data = DataRouteBase::new(format!("ws://{address}/routes"))
-            .map_err(|error| std::io::Error::other(error.to_string()))?;
+        let credential = options
+            .credential
+            .then(|| format!("fake-credential-{}", uuid::Uuid::new_v4().simple()));
         let initialize = ControllerInitializeResponse {
             protocol_version: CONTROLLER_PROTOCOL_VERSION,
             plane: Plane::Controller,
             server_info: implementation("lightspeed-fake-controller"),
             capabilities: ControllerCapabilities {
-                adopt_target: options.adopt_target,
+                power: options.power,
                 ingress: options.ingress,
             },
-            routes: ControllerRoutes { data },
         };
         let app = Arc::new(App {
             credential: credential.clone(),
             options,
             initialize,
+            reachable: AtomicBool::new(true),
             targets: Mutex::new(Targets::default()),
         });
         let router = Router::new()
             .route("/control", get(control_upgrade))
             .route(
-                "/routes/{universe}/{binding}/{environment}/{incarnation}/{target}",
+                "/routes/{universe}/{environment}/{target}",
                 get(data_upgrade),
             )
-            .with_state(app);
+            .with_state(app.clone());
         let task = tokio::spawn(async move {
             let _ = axum::serve(listener, router).await;
         });
         Ok(Self {
             controller_url: format!("ws://{address}/control"),
             credential,
+            app,
             task,
         })
     }
@@ -163,9 +178,48 @@ impl FakeController {
         &self.controller_url
     }
 
-    /// The provider credential the controller and its data routes accept.
-    pub fn credential(&self) -> &str {
-        &self.credential
+    /// The provider credential the controller and its data routes accept;
+    /// `None` when they check none.
+    pub fn credential(&self) -> Option<&str> {
+        self.credential.as_deref()
+    }
+
+    /// While `false`, the controller and every data route answer 503
+    /// without upgrading, as a provider that is down would.
+    pub fn set_reachable(&self, reachable: bool) {
+        self.app.reachable.store(reachable, Ordering::SeqCst);
+    }
+
+    /// Move the environment's target to `power` out of band, as the
+    /// provider's own idle policy would. False when it holds no target.
+    pub async fn set_power_out_of_band(&self, environment_id: &str, power: PowerState) -> bool {
+        let mut targets = self.app.targets.lock().await;
+        match targets.find_mut(environment_id) {
+            Some(target) => {
+                target.power = power;
+                true
+            }
+            None => false,
+        }
+    }
+
+    /// Remove the environment's target out of band, as a provider TTL
+    /// would. False when it holds no target.
+    pub async fn end_target(&self, environment_id: &str) -> bool {
+        let mut targets = self.app.targets.lock().await;
+        let Some(target_id) = targets
+            .find_mut(environment_id)
+            .map(|target| target.target_id.clone())
+        else {
+            return false;
+        };
+        targets.remove(&target_id);
+        true
+    }
+
+    /// How many targets the controller holds.
+    pub async fn target_count(&self) -> usize {
+        self.app.targets.lock().await.by_id.len()
     }
 }
 
@@ -176,9 +230,10 @@ impl Drop for FakeController {
 }
 
 struct App {
-    credential: String,
+    credential: Option<String>,
     options: FakeControllerOptions,
     initialize: ControllerInitializeResponse,
+    reachable: AtomicBool,
     targets: Mutex<Targets>,
 }
 
@@ -194,7 +249,7 @@ struct FakeTarget {
     owner: TargetOwner,
     power: PowerState,
     ingress: bool,
-    metadata: Metadata,
+    booting_dials: u32,
 }
 
 impl FakeTarget {
@@ -202,18 +257,12 @@ impl FakeTarget {
         TargetObservation {
             target_id: Some(self.target_id.clone()),
             owner: self.owner.clone(),
-            display_name: DisplayName::new(self.owner.environment_id.as_str()).ok(),
-            state: TargetState {
-                phase: TargetPhase::Active,
-                power: Some(self.power),
-                daemon_ready: self.power == PowerState::Running,
-                message: None,
-            },
-            supported_power_states: FAKE_POWER_STATES.to_vec(),
+            phase: TargetPhase::Active,
+            power: Some(self.power),
+            message: None,
             ingress: self.ingress.then(|| IngressObservation {
                 endpoint: PublicUrl::new(FAKE_INGRESS_ENDPOINT).expect("valid fake endpoint"),
             }),
-            metadata: self.metadata.clone(),
         }
     }
 }
@@ -225,11 +274,14 @@ fn implementation(name: &str) -> ImplementationInfo {
 }
 
 fn authorized(app: &App, headers: &HeaderMap) -> bool {
+    let Some(credential) = &app.credential else {
+        return true;
+    };
     headers
         .get(header::AUTHORIZATION)
         .and_then(|value| value.to_str().ok())
         .and_then(|value| value.strip_prefix("Bearer "))
-        .is_some_and(|token| constant_time_eq(token.as_bytes(), app.credential.as_bytes()))
+        .is_some_and(|token| constant_time_eq(token.as_bytes(), credential.as_bytes()))
 }
 
 fn constant_time_eq(left: &[u8], right: &[u8]) -> bool {
@@ -243,12 +295,45 @@ fn constant_time_eq(left: &[u8], right: &[u8]) -> bool {
             == 0
 }
 
-fn unauthorized() -> Response {
-    (
-        StatusCode::UNAUTHORIZED,
-        [(header::WWW_AUTHENTICATE, "Bearer")],
+/// The answer before any upgrade: 503 while unreachable, 401 without the
+/// credential.
+fn gate(app: &App, headers: &HeaderMap) -> Option<Response> {
+    if !app.reachable.load(Ordering::SeqCst) {
+        return Some(StatusCode::SERVICE_UNAVAILABLE.into_response());
+    }
+    if !authorized(app, headers) {
+        return Some(
+            (
+                StatusCode::UNAUTHORIZED,
+                [(header::WWW_AUTHENTICATE, "Bearer")],
+            )
+                .into_response(),
+        );
+    }
+    None
+}
+
+/// A typed data route refusal: its status, a JSON body and, for a 503,
+/// `Retry-After`.
+fn refuse(refusal: DataRouteRefusal) -> Response {
+    let status = StatusCode::from_u16(refusal.status()).expect("refusal statuses are valid");
+    let body = serde_json::to_string(&refusal).expect("refusals encode");
+    let mut response = (
+        status,
+        [(header::CONTENT_TYPE, "application/json".to_owned())],
+        body,
     )
-        .into_response()
+        .into_response();
+    if refusal.is_retryable() {
+        response.headers_mut().insert(
+            header::RETRY_AFTER,
+            FAKE_RETRY_AFTER_SECS
+                .to_string()
+                .parse()
+                .expect("valid header"),
+        );
+    }
+    response
 }
 
 fn with_limits(upgrade: WebSocketUpgrade) -> WebSocketUpgrade {
@@ -262,8 +347,8 @@ async fn control_upgrade(
     headers: HeaderMap,
     upgrade: WebSocketUpgrade,
 ) -> Response {
-    if !authorized(&app, &headers) {
-        return unauthorized();
+    if let Some(refused) = gate(&app, &headers) {
+        return refused;
     }
     with_limits(upgrade)
         .on_upgrade(move |socket| serve(socket, Plane::Controller, app))
@@ -272,41 +357,41 @@ async fn control_upgrade(
 
 async fn data_upgrade(
     State(app): State<Arc<App>>,
-    Path((universe, binding, environment, incarnation, target_id)): Path<(
-        String,
-        String,
-        String,
-        String,
-        String,
-    )>,
+    Path((universe, environment, target_id)): Path<(String, String, String)>,
     headers: HeaderMap,
     upgrade: WebSocketUpgrade,
 ) -> Response {
-    if !authorized(&app, &headers) {
-        return unauthorized();
+    if let Some(refused) = gate(&app, &headers) {
+        return refused;
     }
-    let (Ok(universe_id), Ok(binding_id), Ok(environment_id), Ok(incarnation_id), Ok(target_id)) = (
+    let (Ok(universe_id), Ok(environment_id), Ok(target_id)) = (
         UniverseId::new(universe),
-        BindingId::new(binding),
         EnvironmentId::new(environment),
-        IncarnationId::new(incarnation),
         ProviderTargetId::new(target_id),
     ) else {
-        return StatusCode::NOT_FOUND.into_response();
+        return refuse(DataRouteRefusal::Gone {});
     };
     let owner = TargetOwner {
         universe_id,
-        binding_id,
         environment_id,
-        incarnation_id,
     };
-    match app.targets.lock().await.by_id.get(&target_id) {
-        Some(target) if target.owner != owner => return StatusCode::NOT_FOUND.into_response(),
-        Some(target) if target.power != PowerState::Running => {
-            return StatusCode::SERVICE_UNAVAILABLE.into_response();
+    {
+        let mut targets = app.targets.lock().await;
+        let Some(target) = targets.by_id.get_mut(&target_id) else {
+            return refuse(DataRouteRefusal::Gone {});
+        };
+        if target.owner != owner {
+            return refuse(DataRouteRefusal::Gone {});
+        }
+        // The dial is the wake signal.
+        if target.power != PowerState::Running {
+            target.power = PowerState::Running;
+            return refuse(DataRouteRefusal::Waking {});
+        }
+        if target.booting_dials > 0 {
+            target.booting_dials -= 1;
+            return refuse(DataRouteRefusal::Booting {});
         }
-        Some(_) => {}
-        None => return StatusCode::NOT_FOUND.into_response(),
     }
     with_limits(upgrade)
         .on_upgrade(move |socket| serve(socket, Plane::Data, app))
@@ -492,7 +577,7 @@ async fn controller_call(app: &App, request: &Request) -> Result<Value, Protocol
     let method = request.method.as_str();
     if method == TemplateList::NAME {
         params::<TemplateList>(request)?;
-        return encode(&list_templates());
+        return encode(&list_templates(&app.options));
     }
     if (method == IngressEnsure::NAME || method == IngressRemove::NAME) && !app.options.ingress {
         return Err(ProtocolError::capability_unavailable(
@@ -500,16 +585,17 @@ async fn controller_call(app: &App, request: &Request) -> Result<Value, Protocol
             "the fake controller was started without ingress",
         ));
     }
-    if method == TargetAdopt::NAME && !app.options.adopt_target {
+    if method == TargetSetPower::NAME && !app.options.power {
         return Err(ProtocolError::capability_unavailable(
-            Capability::AdoptTarget,
-            "the fake controller was started without adoption",
+            Capability::Power,
+            "the fake controller was started without power control",
         ));
     }
     let mut targets = app.targets.lock().await;
     let observation = match method {
-        TargetCreate::NAME => targets.create(params::<TargetCreate>(request)?)?,
-        TargetAdopt::NAME => targets.adopt(params::<TargetAdopt>(request)?)?,
+        TargetCreate::NAME => {
+            targets.create(params::<TargetCreate>(request)?, app.options.booting_dials)?
+        }
         TargetGet::NAME => {
             let GetTargetParams { target } = params::<TargetGet>(request)?;
             targets.resolve(&target)?.observation()
@@ -531,13 +617,19 @@ async fn controller_call(app: &App, request: &Request) -> Result<Value, Protocol
     })
 }
 
-fn list_templates() -> ListTemplatesResponse {
+fn list_templates(options: &FakeControllerOptions) -> ListTemplatesResponse {
     ListTemplatesResponse {
         templates: vec![EnvironmentTemplate {
             template_id: TemplateId::new(FAKE_TEMPLATE_ID).expect("valid template id"),
             display_name: DisplayName::new("Rust development").expect("valid display name"),
             description: DescriptiveText::new("Deterministic fake provider template").ok(),
-            public_ingress: true,
+            power_states: if options.power {
+                FAKE_POWER_STATES.to_vec()
+            } else {
+                Vec::new()
+            },
+            public_ingress: options.ingress,
+            idle: None,
             deprecated: false,
             resources: Some(TemplateResources {
                 vcpus: Some(2),
@@ -576,25 +668,27 @@ impl Targets {
         Ok(found)
     }
 
-    fn insert(&mut self, owner: TargetOwner, metadata: Metadata) -> TargetObservation {
-        let mut identity = DefaultHasher::new();
-        owner.hash(&mut identity);
-        let target_id = ProviderTargetId::new(format!("fake-{:016x}", identity.finish()))
-            .expect("valid fake target id");
-        let target = FakeTarget {
-            target_id: target_id.clone(),
-            owner: owner.clone(),
-            power: PowerState::Running,
-            ingress: false,
-            metadata,
-        };
-        let observation = target.observation();
-        self.by_owner.insert(owner, target_id.clone());
-        self.by_id.insert(target_id, target);
-        observation
+    fn find_mut(&mut self, environment_id: &str) -> Option<&mut FakeTarget> {
+        self.by_id
+            .values_mut()
+            .find(|target| target.owner.environment_id.as_str() == environment_id)
     }
 
-    fn create(&mut self, params: CreateTargetParams) -> Result<TargetObservation, ProtocolError> {
+    fn remove(&mut self, target_id: &ProviderTargetId) {
+        if let Some(target) = self.by_id.remove(target_id) {
+            self.by_owner.remove(&target.owner);
+        }
+    }
+
+    fn create(
+        &mut self,
+        params: CreateTargetParams,
+        booting_dials: u32,
+    ) -> Result<TargetObservation, ProtocolError> {
+        if let Some(idle) = &params.idle {
+            idle.validate()
+                .map_err(|error| ProtocolError::invalid_field("idle", error.to_string()))?;
+        }
         if let Some(target_id) = self.by_owner.get(&params.owner) {
             return Ok(self.by_id[target_id].observation());
         }
@@ -604,37 +698,21 @@ impl Targets {
                 params.template_id
             )));
         }
-        let metadata = Metadata::new(BTreeMap::from([(
-            "imageFingerprint".to_owned(),
-            format!("fake:{}", params.template_id),
-        )]))
-        .expect("valid fake metadata");
-        Ok(self.insert(params.owner, metadata))
-    }
-
-    fn adopt(&mut self, params: AdoptTargetParams) -> Result<TargetObservation, ProtocolError> {
-        let fingerprint = format!("fake:adopted:{}", params.source_target);
-        if let Some(target_id) = self.by_owner.get(&params.owner) {
-            let target = &self.by_id[target_id];
-            return if target.metadata.get("imageFingerprint") == Some(fingerprint.as_str()) {
-                Ok(target.observation())
-            } else {
-                Err(owner_mismatch())
-            };
-        }
-        if self
-            .by_id
-            .values()
-            .any(|target| target.metadata.get("imageFingerprint") == Some(fingerprint.as_str()))
-        {
-            return Err(owner_mismatch());
-        }
-        let metadata = Metadata::new(BTreeMap::from([(
-            "imageFingerprint".to_owned(),
-            fingerprint,
-        )]))
-        .map_err(|error| ProtocolError::invalid_params(error.to_string()))?;
-        Ok(self.insert(params.owner, metadata))
+        let mut identity = DefaultHasher::new();
+        params.owner.hash(&mut identity);
+        let target_id = ProviderTargetId::new(format!("fake-{:016x}", identity.finish()))
+            .expect("valid fake target id");
+        let target = FakeTarget {
+            target_id: target_id.clone(),
+            owner: params.owner.clone(),
+            power: PowerState::Running,
+            ingress: false,
+            booting_dials,
+        };
+        let observation = target.observation();
+        self.by_owner.insert(params.owner, target_id.clone());
+        self.by_id.insert(target_id, target);
+        Ok(observation)
     }
 
     fn set_power(
@@ -657,27 +735,19 @@ impl Targets {
         let closed = |target_id| TargetObservation {
             target_id,
             owner: params.target.owner.clone(),
-            display_name: None,
-            state: TargetState {
-                phase: TargetPhase::Closed,
-                power: None,
-                daemon_ready: false,
-                message: None,
-            },
-            supported_power_states: Vec::new(),
+            phase: TargetPhase::Closed,
+            power: None,
+            message: None,
             ingress: None,
-            metadata: Metadata::default(),
         };
         let target_id = match self.resolve(&params.target) {
             Ok(target) => target.target_id.clone(),
             Err(error) if error.kind() == ProtocolErrorKind::NotFound => {
-                return Ok(closed(None));
+                return Ok(closed(params.target.target_id.clone()));
             }
             Err(error) => return Err(error),
         };
-        if let Some(target) = self.by_id.remove(&target_id) {
-            self.by_owner.remove(&target.owner);
-        }
+        self.remove(&target_id);
         Ok(closed(Some(target_id)))
     }
 
@@ -698,9 +768,13 @@ mod tests {
     use super::*;
     use crate::environments::gateway::runtime_client_info;
     use environment_client::{
-        ConnectOptions,
-        conformance::controller::{ControllerConformance, run},
+        ConnectOptions, ControllerClient, DataClient,
+        conformance::{
+            controller::{ControllerConformance, run},
+            data_route::expect_refusal,
+        },
     };
+    use environment_protocol::routes::{DataRouteBase, provider_data_route};
     use std::{
         sync::atomic::{AtomicU64, Ordering},
         time::Duration,
@@ -713,24 +787,32 @@ mod tests {
             let n = next.fetch_add(1, Ordering::SeqCst);
             TargetOwner {
                 universe_id: UniverseId::new(universe.clone()).unwrap(),
-                binding_id: BindingId::new("conformance").unwrap(),
                 environment_id: EnvironmentId::new(format!("environment_{n}")).unwrap(),
-                incarnation_id: IncarnationId::new(format!("incarnation_{n}")).unwrap(),
             }
         })
     }
 
-    async fn conformance(options: FakeControllerOptions) {
-        let controller = FakeController::start_with(options).await.unwrap();
+    fn options(controller: &FakeController) -> ConnectOptions {
+        let options = ConnectOptions::new(runtime_client_info());
+        match controller.credential() {
+            Some(credential) => options.with_bearer_token(credential),
+            None => options,
+        }
+    }
+
+    async fn conformance(options_for: FakeControllerOptions) {
+        let controller = FakeController::start_with(options_for).await.unwrap();
         let mut suite = ControllerConformance::new(
             controller.controller_url(),
-            ConnectOptions::new(runtime_client_info()).with_bearer_token(controller.credential()),
+            options(&controller),
             TemplateId::new(FAKE_TEMPLATE_ID).unwrap(),
             owner_factory(),
         );
         suite.prompt_bound = Duration::from_secs(5);
         suite.settle_timeout = Duration::from_secs(10);
         suite.poll_interval = Duration::from_millis(50);
+        suite.data_route_base =
+            Some(DataRouteBase::derived_from_controller(controller.controller_url()).unwrap());
         run(&suite)
             .await
             .into_result()
@@ -743,12 +825,108 @@ mod tests {
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn the_fake_controller_without_optional_features_conforms() {
+    async fn the_fake_controller_without_optional_capabilities_conforms() {
         conformance(FakeControllerOptions {
-            adopt_target: false,
+            power: false,
             ingress: false,
             ..FakeControllerOptions::default()
         })
         .await;
     }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn the_fake_controller_without_a_credential_conforms() {
+        conformance(FakeControllerOptions {
+            credential: false,
+            ..FakeControllerOptions::default()
+        })
+        .await;
+    }
+
+    /// A target created through the controller, and its data route under
+    /// the base Lightspeed derives from the controller URL.
+    async fn created(controller: &FakeController) -> (TargetOwner, String) {
+        let (client, _) =
+            ControllerClient::connect_initialized(controller.controller_url(), options(controller))
+                .await
+                .expect("controller handshake");
+        let owner = owner_factory()();
+        let target_id = client
+            .create_target(&CreateTargetParams {
+                owner: owner.clone(),
+                template_id: TemplateId::new(FAKE_TEMPLATE_ID).unwrap(),
+                display_name: None,
+                idle: None,
+            })
+            .await
+            .expect("create")
+            .target
+            .target_id
+            .expect("target id");
+        let _ = client.close().await;
+        let base = DataRouteBase::derived_from_controller(controller.controller_url()).unwrap();
+        let route = provider_data_route(&base, &owner, &target_id);
+        (owner, route)
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn a_dial_wakes_a_powered_down_target_and_refuses_waking_once() {
+        let controller = FakeController::start().await.unwrap();
+        let (owner, route) = created(&controller).await;
+        assert!(
+            controller
+                .set_power_out_of_band(owner.environment_id.as_str(), PowerState::Paused)
+                .await
+        );
+        let refusal = expect_refusal(&route, options(&controller))
+            .await
+            .expect("a conforming refusal");
+        assert_eq!(refusal, DataRouteRefusal::Waking {});
+        let (client, _) = DataClient::connect_initialized(&route, options(&controller))
+            .await
+            .expect("the woken target upgrades");
+        let _ = client.close().await;
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn a_new_target_refuses_booting_for_its_configured_dials() {
+        let controller = FakeController::start_with(FakeControllerOptions {
+            booting_dials: 1,
+            ..FakeControllerOptions::default()
+        })
+        .await
+        .unwrap();
+        let (_, route) = created(&controller).await;
+        assert_eq!(
+            expect_refusal(&route, options(&controller)).await.unwrap(),
+            DataRouteRefusal::Booting {}
+        );
+        let (client, _) = DataClient::connect_initialized(&route, options(&controller))
+            .await
+            .expect("envd answers after its booting dials");
+        let _ = client.close().await;
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn an_ended_target_refuses_gone_and_an_unreachable_controller_refuses_all() {
+        let controller = FakeController::start().await.unwrap();
+        let (owner, route) = created(&controller).await;
+        assert!(controller.end_target(owner.environment_id.as_str()).await);
+        assert_eq!(controller.target_count().await, 0);
+        assert_eq!(
+            expect_refusal(&route, options(&controller)).await.unwrap(),
+            DataRouteRefusal::Gone {}
+        );
+        controller.set_reachable(false);
+        let error = ControllerClient::connect_initialized(
+            controller.controller_url(),
+            options(&controller),
+        )
+        .await
+        .expect_err("an unreachable controller refuses the upgrade");
+        assert!(matches!(
+            error,
+            environment_client::ClientError::UpgradeRejected { status: 503, .. }
+        ));
+    }
 }
diff --git a/crates/temporal-runtime/src/environments/gateway.rs b/crates/temporal-runtime/src/environments/gateway.rs
index bae09af3f..cbb8984dc 100644
--- a/crates/temporal-runtime/src/environments/gateway.rs
+++ b/crates/temporal-runtime/src/environments/gateway.rs
@@ -5,8 +5,8 @@ use environment_protocol::{data::handshake::InitializeResponse, handshake::Imple
 use uuid::Uuid;
 
 /// Path prefix of the worker routes the environment gateway serves:
-/// `{prefix}/{universe}/{environment}/{incarnation}`. Runtime-internal: only
-/// Lightspeed's own workers dial it, with the deployment token.
+/// `{prefix}/{universe}/{environment}`. Runtime-internal: only Lightspeed's
+/// own workers dial it, with the deployment token.
 pub const ROUTE_PATH_PREFIX: &str = "/environment-gateway/routes";
 
 /// Connect bound (TCP, TLS and upgrade) of a worker route. The gateway
@@ -17,11 +17,18 @@ pub const ROUTE_PATH_PREFIX: &str = "/environment-gateway/routes";
 pub const WORKER_ROUTE_CONNECT_TIMEOUT: Duration =
     Duration::from_secs(crate::gateway::registration::STREAM_OPEN_TIMEOUT.as_secs() + 5);
 
+/// Runtime-internal header of a worker route dial that must not wake a
+/// powered-down target: environment source discovery. The gateway asks the
+/// provider for a provisioned target's current power first and refuses the
+/// dial (bodiless 412) unless the target is active and running; the
+/// recorded observation cannot decide, since providers power targets down
+/// on their own clock. Other sources have no power to keep.
+pub const NO_WAKE_HEADER: &str = "lightspeed-no-wake";
+
 #[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord)]
 pub struct RouteKey {
     pub universe_id: Uuid,
     pub environment_id: String,
-    pub incarnation_id: String,
 }
 
 #[derive(Clone)]
@@ -68,19 +75,18 @@ impl EnvironmentGatewayClientConfig {
         RouteKey {
             universe_id,
             environment_id: environment.environment_id.to_string(),
-            incarnation_id: environment.incarnation.incarnation_id.to_string(),
         }
     }
 
-    /// The worker route of one environment incarnation: a data-plane
-    /// endpoint whatever the environment's source.
+    /// The worker route of one environment: a data-plane endpoint whatever
+    /// the environment's source. Instead of upgrading, the gateway may
+    /// answer a typed `DataRouteRefusal`.
     pub fn endpoint(&self, key: &RouteKey) -> String {
         format!(
-            "{}{ROUTE_PATH_PREFIX}/{}/{}/{}",
+            "{}{ROUTE_PATH_PREFIX}/{}/{}",
             websocket_base(&self.base_url),
             key.universe_id,
             environment_protocol::routes::encode_path_segment(&key.environment_id),
-            environment_protocol::routes::encode_path_segment(&key.incarnation_id),
         )
     }
 
@@ -105,6 +111,13 @@ impl EnvironmentGatewayClientConfig {
         options
     }
 
+    /// [`connect_options`](Self::connect_options) for a dial that must not
+    /// wake its target ([`NO_WAKE_HEADER`]).
+    pub fn no_wake_connect_options(&self, user_agent: impl Into<String>) -> ConnectOptions {
+        self.connect_options(user_agent)
+            .with_header(NO_WAKE_HEADER, "1")
+    }
+
     /// Dial the worker route of `key` and complete the data-plane
     /// handshake.
     pub async fn connect(
@@ -169,7 +182,6 @@ mod tests {
         RouteKey {
             universe_id: Uuid::nil(),
             environment_id: "environment-a".to_owned(),
-            incarnation_id: "incarnation-a".to_owned(),
         }
     }
 
@@ -178,7 +190,7 @@ mod tests {
         let config = EnvironmentGatewayClientConfig::new("https://gateway.test/", "secret");
         assert_eq!(
             config.endpoint(&key()),
-            "wss://gateway.test/environment-gateway/routes/00000000-0000-0000-0000-000000000000/environment-a/incarnation-a"
+            "wss://gateway.test/environment-gateway/routes/00000000-0000-0000-0000-000000000000/environment-a"
         );
         let local = EnvironmentGatewayClientConfig::new("http://127.0.0.1:18080", "secret");
         assert!(
diff --git a/crates/temporal-runtime/src/environments/lifecycle.rs b/crates/temporal-runtime/src/environments/lifecycle.rs
index 34ef4fd4b..b7a2e678a 100644
--- a/crates/temporal-runtime/src/environments/lifecycle.rs
+++ b/crates/temporal-runtime/src/environments/lifecycle.rs
@@ -1,266 +1,176 @@
+//! Environment lifecycle: the API handlers and the reconciler.
+//!
+//! Lightspeed keeps durable retries for the two things it alone decides:
+//! create until accepted (and opened by one data-plane handshake), and
+//! close until gone. Everything a provider does while a target runs —
+//! power, idle, wake, ingress — is the provider's; the slow display sweep
+//! only records what it reports, and acts only when it reports the target
+//! failed or gone. Power and ingress API calls are synchronous
+//! pass-throughs that store nothing but the returned observation.
+
 use super::provider_controllers::{
-    ControllerDisposition, ControllerError, ControllerFeature, ProviderController, ProviderPass,
+    ControllerDisposition, ControllerError, ControllerFeature, PASS_THROUGH_TIMEOUT,
+    ProviderController, ProviderControllerConnector, call_disposition, connect_provider_controller,
     provider_connect_options,
 };
 use super::providers::{
-    environment_view, map_environments_error, parse_environment_provider_binding_id,
-    registry_idle_policy, registry_lifecycle_status, registry_power_state,
+    environment_view, map_environments_error, parse_environment_provider_id, registry_idle_policy,
+    registry_power_state, registry_state,
 };
+use super::signals::EnvironmentSignals;
 use super::*;
 
 use ::environments::{
     BeginCloseEnvironment, CreateEnvironment, CreateExternalEnvironment, DaemonBuild,
-    EnvironmentEndpoint, EnvironmentId, EnvironmentIncarnationId, EnvironmentLifecycleError,
-    EnvironmentProviderId, EnvironmentProvisionRequestId, EnvironmentRecord,
-    EnvironmentRegistryError, EnvironmentSource, EnvironmentStatus, EnvironmentStore,
-    EnvironmentTemplateId, FailEnvironmentLifecycle, FinishCloseEnvironment, ListEnvironments,
-    ObserveProvisionedEnvironment, PowerState, ReconcileScope, RecordEnvironmentIngress,
-    RecordEnvironmentLifecycleError, SetEnvironmentIdlePolicy, SetEnvironmentIngress,
-    SetEnvironmentPower,
+    EndProvisionedEnvironment, EnvironmentCloseReason, EnvironmentEndpoint, EnvironmentId,
+    EnvironmentProviderId, EnvironmentProviderStore, EnvironmentProvisionRequestId,
+    EnvironmentRecord, EnvironmentRegistryError, EnvironmentState, EnvironmentStore,
+    EnvironmentTemplateId, FailEnvironment, FinishCloseEnvironment, ListEnvironments,
+    ObservedTarget, OpenEnvironment, RecordTargetObservation, ScheduleEnvironmentAttempt,
+    UpdateEnvironment, WAIT_RETRY_AFTER_MS,
 };
-use auth::SecretValue;
 use environment_client::{ClientError, DataClient};
 use environment_protocol::{
     control::{
         ingress::{EnsureIngressParams, RemoveIngressParams},
         target::{
-            AdoptTargetParams, CloseTargetParams, CreateTargetParams, GetTargetParams,
-            SetTargetPowerParams, TargetObservation, TargetOwner, TargetPhase, TargetRef,
-            TargetState,
+            CloseTargetParams, CreateTargetParams, GetTargetParams, SetTargetPowerParams,
+            TargetObservation, TargetOwner, TargetPhase, TargetRef,
         },
     },
-    error::PreconditionReason,
-    ids::{BindingId, IncarnationId, ProviderNativeRef, TemplateId, UniverseId},
-    routes::provider_data_route,
+    ids::{TemplateId, UniverseId},
+    manifest::{IngressEnsure, IngressRemove, TargetSetPower},
+    metadata::DisplayName,
+    routes::{DataRouteRefusal, provider_data_route},
 };
+use futures_util::{StreamExt, stream};
+use std::{collections::BTreeMap, time::Duration};
 
-/// How long a provisioning, booting or unknown environment may go without
-/// converging (transient errors such as an unreachable provider, or
-/// observations that make no progress, such as a guest whose envd never
-/// answers) before it is failed with the last error.
+/// How long a provisioning environment may take, from entering
+/// `provisioning` to its open handshake, before it is failed.
 pub(crate) const PROVISIONING_DEADLINE_MS: i64 = 30 * 60 * 1000;
 
-/// How often a reconcile pass also observes steady provisioned
-/// environments with `target/get`, so a target deleted or changed out of
-/// band is noticed and ingress converges.
-pub(crate) const STEADY_OBSERVATION_INTERVAL: std::time::Duration =
-    std::time::Duration::from_secs(120);
-
-/// A repeated transient error is written again only after this long, so a
-/// provider that stays down does not rewrite every row on every pass.
-const LIFECYCLE_ERROR_REFRESH_MS: i64 = 30 * 1000;
-
-/// What one target observation means for its environment.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub(crate) enum TargetVerdict {
-    /// Record this status.
-    Status(EnvironmentStatus),
-    /// Running, and the provider's own probe reached envd: Ready once the
-    /// runtime's data-plane handshake succeeds.
-    DaemonReady,
-    /// Broken or gone for good.
-    Failed(String),
-    /// The provider cannot tell; retried like a transient error.
-    Unknown(String),
-}
+/// Re-check interval while the provider reports work in progress.
+pub(crate) const POLL_MS: i64 = 2_000;
 
-/// Map a target's two-axis state to the environment lifecycle. A target
-/// that closes while its environment is not closing was closed out of band.
-pub(crate) fn target_verdict(state: &TargetState) -> TargetVerdict {
-    let message = state.message.as_ref().map(|message| message.as_str());
-    match state.phase {
-        TargetPhase::Provisioning => TargetVerdict::Status(EnvironmentStatus::Provisioning),
-        TargetPhase::Active => match state.power {
-            Some(PowerState::Running) if state.daemon_ready => TargetVerdict::DaemonReady,
-            Some(PowerState::Running) => TargetVerdict::Status(EnvironmentStatus::Booting),
-            Some(PowerState::Paused) => TargetVerdict::Status(EnvironmentStatus::Paused),
-            Some(PowerState::Suspended) => TargetVerdict::Status(EnvironmentStatus::Suspended),
-            Some(PowerState::Stopped) => TargetVerdict::Status(EnvironmentStatus::Offline),
-            None => TargetVerdict::Unknown(
-                "the provider reported an active target without a power state".to_owned(),
-            ),
-        },
-        TargetPhase::Closing => {
-            TargetVerdict::Failed("the provider is closing the environment's target".to_owned())
-        }
-        TargetPhase::Closed => {
-            TargetVerdict::Failed("the provider closed the environment's target".to_owned())
-        }
-        TargetPhase::Failed => TargetVerdict::Failed(
-            message
-                .unwrap_or("the provider reported the target failed")
-                .to_owned(),
-        ),
-        TargetPhase::Unknown => TargetVerdict::Unknown(
-            message
-                .unwrap_or("the provider cannot tell the target's state")
-                .to_owned(),
-        ),
-    }
-}
+/// First backoff after a failed attempt; doubled per attempt.
+const BACKOFF_BASE_MS: i64 = 2_000;
 
-/// The lifecycle note for an observation that leaves a converging
-/// environment where it was: recorded like a transient error, so the
-/// provisioning deadline runs while nothing progresses.
-pub(crate) fn waiting_note(status: EnvironmentStatus, state: &TargetState) -> String {
-    let waiting = match status {
-        EnvironmentStatus::Booting => "waiting for envd to answer on the target",
-        _ => "waiting for the provider to provision the target",
-    };
-    match &state.message {
-        Some(message) => format!("{waiting}: {}", message.as_str()),
-        None => waiting.to_owned(),
-    }
-}
+/// Longest backoff between attempts.
+const BACKOFF_MAX_MS: i64 = 5 * 60 * 1000;
 
-/// True once transient errors or stalled observations have persisted past
-/// the provisioning deadline.
-pub(crate) fn provisioning_deadline_passed(
-    error: Option<&EnvironmentLifecycleError>,
-    now_ms: i64,
-) -> bool {
-    error.is_some_and(|error| now_ms.saturating_sub(error.first_at_ms) >= PROVISIONING_DEADLINE_MS)
-}
+/// Rows of one provider in flight at once, over one shared controller
+/// connection.
+pub(crate) const PROVIDER_CONCURRENCY: usize = 8;
 
-/// True when `message` at `now_ms` is worth a write over `recorded`.
-fn lifecycle_error_is_news(
-    recorded: Option<&EnvironmentLifecycleError>,
-    message: &str,
-    now_ms: i64,
-) -> bool {
-    let cleaned = EnvironmentLifecycleError::record(None, message, now_ms).message;
-    recorded.is_none_or(|recorded| {
-        recorded.message != cleaned
-            || now_ms.saturating_sub(recorded.last_at_ms) >= LIFECYCLE_ERROR_REFRESH_MS
-    })
-}
+/// Rows one work pass takes from a universe.
+pub(crate) const WORK_BATCH: u32 = 256;
 
-/// The outcome of the data-plane handshake at the Ready transition.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub(crate) enum DaemonProbe {
-    Ready(DaemonBuild),
-    /// envd speaks another protocol version and can never serve this
-    /// runtime.
-    Mismatch {
-        local: u32,
-        remote: u32,
-    },
-    /// envd did not complete the handshake; retried.
-    Unreachable(String),
+/// How often the reconciler wakes without a nudge.
+pub(crate) const WORK_TICK: Duration = Duration::from_secs(1);
+
+/// How often the display sweep observes open provisioned environments.
+pub(crate) const DISPLAY_SWEEP_INTERVAL: Duration = Duration::from_secs(5 * 60);
+
+/// The delay before attempt `attempts + 1` after `attempts` consecutive
+/// failures: 2 s doubling, at most 5 min.
+pub(crate) fn backoff_delay_ms(attempts: u32) -> i64 {
+    let shift = attempts.saturating_sub(1).min(8);
+    (BACKOFF_BASE_MS << shift).min(BACKOFF_MAX_MS)
 }
 
-/// Run `initialize` against a target's data route, with the provider
-/// credential, and close the connection again.
-pub(crate) async fn probe_daemon(endpoint: &str, credential: &SecretValue) -> DaemonProbe {
-    match DataClient::connect_initialized(endpoint, provider_connect_options(credential)).await {
-        Ok((client, initialized)) => {
-            let _ = client.close().await;
-            DaemonProbe::Ready(DaemonBuild::from_implementation(
-                &initialized.server_info,
-                initialized.protocol_version,
-            ))
-        }
-        Err(ClientError::VersionMismatch { local, remote, .. }) => {
-            DaemonProbe::Mismatch { local, remote }
-        }
-        Err(error) => DaemonProbe::Unreachable(format!(
-            "envd did not complete the data-plane handshake: {error}"
-        )),
-    }
+/// True once a provisioning row has been provisioning for the deadline.
+pub(crate) fn provisioning_deadline_passed(record: &EnvironmentRecord, now_ms: i64) -> bool {
+    record.state == EnvironmentState::Provisioning
+        && now_ms.saturating_sub(record.state_changed_at_ms) >= PROVISIONING_DEADLINE_MS
 }
 
-/// The controller-plane owner of an environment's current incarnation.
+/// The controller-plane owner of a provisioned environment.
 pub(crate) fn target_owner(
     universe_id: uuid::Uuid,
     environment: &EnvironmentRecord,
-) -> Result<TargetOwner, ControllerError> {
-    let binding_id = environment
-        .binding_id()
-        .ok_or_else(|| invalid_registry("only provisioned environments have a provider target"))?;
-    let invalid = |error: environment_protocol::ids::IdError| {
-        invalid_registry(format!(
-            "environment ids do not fit the controller protocol: {error}"
-        ))
-    };
+) -> Result<TargetOwner, EnvironmentRegistryError> {
+    let invalid =
+        |error: environment_protocol::ids::IdError| EnvironmentRegistryError::InvalidInput {
+            message: format!("environment ids do not fit the controller protocol: {error}"),
+        };
     Ok(TargetOwner {
         universe_id: UniverseId::new(universe_id.to_string()).map_err(invalid)?,
-        binding_id: BindingId::new(binding_id.as_str()).map_err(invalid)?,
         environment_id: environment_protocol::ids::EnvironmentId::new(
             environment.environment_id.as_str(),
         )
         .map_err(invalid)?,
-        incarnation_id: IncarnationId::new(environment.incarnation.incarnation_id.as_str())
-            .map_err(invalid)?,
     })
 }
 
+/// The wire name of a target phase, for state messages.
+fn phase_name(phase: TargetPhase) -> &'static str {
+    match phase {
+        TargetPhase::Provisioning => "provisioning",
+        TargetPhase::Active => "active",
+        TargetPhase::Closing => "closing",
+        TargetPhase::Closed => "closed",
+        TargetPhase::Failed => "failed",
+        TargetPhase::Unknown => "unknown",
+    }
+}
+
+/// What a provider observation records: power only on an active target.
+fn observed_target(observation: &TargetObservation, now_ms: i64) -> ObservedTarget {
+    ObservedTarget {
+        phase: observation.phase,
+        power: observation
+            .power
+            .filter(|_| observation.phase == TargetPhase::Active),
+        message: observation
+            .message
+            .as_ref()
+            .map(|message| message.as_str().to_owned()),
+        observed_at_ms: now_ms,
+    }
+}
+
+fn observation_request(
+    environment: &EnvironmentRecord,
+    observation: &TargetObservation,
+    now_ms: i64,
+) -> RecordTargetObservation {
+    RecordTargetObservation {
+        environment_id: environment.environment_id.clone(),
+        provider_target_id: observation.target_id.clone(),
+        observed: observed_target(observation, now_ms),
+        public_endpoint: observation
+            .ingress
+            .as_ref()
+            .map(|ingress| ingress.endpoint.as_str().to_owned()),
+        observed_at_ms: now_ms,
+    }
+}
+
 /// Wall-clock milliseconds for reconciler writes.
-fn clock_ms() -> i64 {
+pub(crate) fn clock_ms() -> i64 {
     std::time::SystemTime::now()
         .duration_since(std::time::UNIX_EPOCH)
         .map(|elapsed| i64::try_from(elapsed.as_millis()).unwrap_or(i64::MAX))
         .unwrap_or(0)
 }
 
-fn invalid_registry(message: impl Into<String>) -> ControllerError {
-    ControllerError::Registry(EnvironmentRegistryError::InvalidInput {
-        message: message.into(),
-    })
-}
-
 impl EnvironmentService {
-    /// `environments/ingress/put`: record the public ingress intent. The
-    /// reconciler converges the provider toward it while the environment is
-    /// ready and records the realized endpoint. Enabling is refused up front
-    /// when the provider does not offer ingress.
-    pub(crate) async fn put_environment_ingress_record(
-        &self,
-        params: EnvironmentIngressPutParams,
-    ) -> Result<EnvironmentIngressPutResponse, AgentApiError> {
-        let environment_id = parse_registry_environment_id(params.environment_id)?;
-        let environment = EnvironmentStore::read_environment(self.store.as_ref(), &environment_id)
-            .await
-            .map_err(map_environments_error)?;
-        if matches!(
-            environment.status,
-            EnvironmentStatus::Closing | EnvironmentStatus::Closed | EnvironmentStatus::Failed
-        ) {
-            return Err(AgentApiError::rejected(
-                "public ingress requires an environment that is not closing, closed or failed",
-            ));
-        }
-        let EnvironmentSource::Provisioned { provider_id, .. } = &environment.source else {
-            return Err(AgentApiError::rejected(
-                "provider-managed ingress is unavailable for external environments",
-            ));
-        };
-        if params.enabled {
-            self.require_controller_feature(provider_id, ControllerFeature::Ingress)
-                .await?;
+    fn reconciler(&self) -> Reconciler<'_> {
+        Reconciler {
+            universe_id: self.store.config().universe_id,
+            environments: self.store.as_ref(),
+            providers: self.store.as_ref(),
+            connector: self.provider_controller_connector.as_ref(),
+            signals: &self.signals,
         }
-        let environment = EnvironmentStore::set_environment_ingress(
-            self.store.as_ref(),
-            SetEnvironmentIngress {
-                environment_id,
-                enabled: params.enabled,
-                updated_at_ms: now_ms()?,
-            },
-        )
-        .await
-        .map_err(map_environments_error)?;
-        Ok(EnvironmentIngressPutResponse {
-            environment: environment_view(&environment),
-        })
     }
 
     pub(crate) async fn create_external_environment_record(
         &self,
         params: EnvironmentExternalCreateParams,
     ) -> Result<EnvironmentExternalCreateResponse, AgentApiError> {
-        let request_id =
-            EnvironmentProvisionRequestId::try_new(params.request_id).map_err(|error| {
-                AgentApiError::invalid_request(format!("invalid environment request id: {error}"))
-            })?;
+        let request_id = parse_request_id(params.request_id)?;
         let endpoint = EnvironmentEndpoint::parse(&params.endpoint).map_err(|error| {
             AgentApiError::invalid_request(format!("invalid environment endpoint: {error}"))
         })?;
@@ -269,7 +179,6 @@ impl EnvironmentService {
             CreateExternalEnvironment {
                 request_id,
                 environment_id: allocate_environment_id(),
-                incarnation_id: allocate_incarnation_id(),
                 endpoint,
                 display_name: params.display_name,
                 metadata: validated_caller_metadata(params.metadata)?,
@@ -283,132 +192,198 @@ impl EnvironmentService {
         })
     }
 
+    /// `environments/create`: accept the creation and nudge the
+    /// reconciler; provider I/O belongs to the reconciler.
     pub(crate) async fn create_environment_record(
         &self,
         params: EnvironmentCreateParams,
     ) -> Result<EnvironmentCreateResponse, AgentApiError> {
-        let environment = self.accept_environment_create(params).await?;
-        Ok(EnvironmentCreateResponse {
-            environment: environment_view(&environment),
-        })
-    }
-
-    /// Accept environment creation; provider I/O belongs to the reconciler.
-    pub(crate) async fn accept_environment_create(
-        &self,
-        params: EnvironmentCreateParams,
-    ) -> Result<EnvironmentRecord, AgentApiError> {
-        let request_id =
-            EnvironmentProvisionRequestId::try_new(params.request_id).map_err(|error| {
-                AgentApiError::invalid_request(format!("invalid environment request id: {error}"))
-            })?;
-        let binding_id = parse_environment_provider_binding_id(params.binding_id)?;
+        let request_id = parse_request_id(params.request_id)?;
+        let provider_id = parse_environment_provider_id(params.provider_id)?;
         let template_id = EnvironmentTemplateId::try_new(params.template_id).map_err(|error| {
             AgentApiError::invalid_request(format!("invalid environment template id: {error}"))
         })?;
-        let idle_policy = params.idle_policy.as_ref().map(registry_idle_policy);
-        if let Some(policy) = &idle_policy {
-            policy.validate().map_err(map_environments_error)?;
-        }
-        EnvironmentStore::create_environment(
+        let idle = params.idle.as_ref().map(registry_idle_policy).transpose()?;
+        let environment = EnvironmentStore::create_environment(
             self.store.as_ref(),
             CreateEnvironment {
                 request_id,
                 environment_id: allocate_environment_id(),
-                incarnation_id: allocate_incarnation_id(),
-                binding_id,
+                provider_id,
                 template_id,
+                idle,
                 display_name: params.display_name,
                 metadata: validated_caller_metadata(params.metadata)?,
-                idle_policy,
                 created_at_ms: now_ms()?,
             },
         )
         .await
-        .map_err(map_environments_error)
+        .map_err(map_environments_error)?;
+        if environment.state == EnvironmentState::Provisioning {
+            self.signals.nudge_work();
+        }
+        Ok(EnvironmentCreateResponse {
+            environment: environment_view(&environment),
+        })
     }
 
-    /// `environments/power/put`: record power intent. Provider support is
-    /// checked against the states observed on the current incarnation; the
-    /// reconciler converges asynchronously.
+    /// `environments/power/put`: a synchronous `target/setPower`
+    /// pass-through. Only the returned observation is stored.
     pub(crate) async fn put_environment_power_record(
         &self,
         params: EnvironmentPowerPutParams,
     ) -> Result<EnvironmentPowerPutResponse, AgentApiError> {
         let environment_id = parse_registry_environment_id(params.environment_id)?;
-        let desired_power = registry_power_state(params.power);
-        let environment = EnvironmentStore::read_environment(self.store.as_ref(), &environment_id)
-            .await
-            .map_err(map_environments_error)?;
-        if !matches!(environment.source, EnvironmentSource::Provisioned { .. }) {
-            return Err(AgentApiError::rejected(
-                "external environments have no power control",
-            ));
-        }
-        if desired_power != PowerState::Running
-            && !environment
-                .incarnation
-                .power_states
-                .contains(&desired_power)
-        {
-            return Err(AgentApiError::rejected(
-                if environment.incarnation.power_states.is_empty() {
-                    format!(
-                        "environment power state {desired_power} is unavailable: the provider has not reported power support for this environment yet"
-                    )
-                } else {
-                    format!(
-                        "environment power state {desired_power} is not supported by the provider (supported: {})",
-                        environment
-                            .incarnation
-                            .power_states
-                            .iter()
-                            .map(|state| state.as_str())
-                            .collect::<Vec<_>>()
-                            .join(", ")
-                    )
+        let power = registry_power_state(params.power);
+        let environment = self
+            .open_provisioned(&environment_id, "power control")
+            .await?;
+        let environment = self
+            .pass_through(
+                &environment,
+                ControllerFeature::Power,
+                |controller, target| {
+                    Box::pin(async move {
+                        controller
+                            .client
+                            .call_with_timeout::<TargetSetPower>(
+                                &SetTargetPowerParams { target, power },
+                                PASS_THROUGH_TIMEOUT,
+                            )
+                            .await
+                    })
                 },
-            ));
-        }
-        let environment = EnvironmentStore::set_environment_power(
-            self.store.as_ref(),
-            SetEnvironmentPower {
-                environment_id,
-                desired_power,
-                updated_at_ms: now_ms()?,
-            },
-        )
-        .await
-        .map_err(map_environments_error)?;
+            )
+            .await?;
         Ok(EnvironmentPowerPutResponse {
             environment: environment_view(&environment),
         })
     }
 
-    /// `environments/idle-policy/put`: replace or clear the staged idle
-    /// policy of a provisioned environment.
-    pub(crate) async fn put_environment_idle_policy_record(
+    /// `environments/ingress/put`: a synchronous `ingress/ensure` or
+    /// `ingress/remove` pass-through; the reported endpoint is cached.
+    pub(crate) async fn put_environment_ingress_record(
         &self,
-        params: EnvironmentIdlePolicyPutParams,
-    ) -> Result<EnvironmentIdlePolicyPutResponse, AgentApiError> {
+        params: EnvironmentIngressPutParams,
+    ) -> Result<EnvironmentIngressPutResponse, AgentApiError> {
         let environment_id = parse_registry_environment_id(params.environment_id)?;
-        let idle_policy = params.idle_policy.as_ref().map(registry_idle_policy);
-        if let Some(policy) = &idle_policy {
-            policy.validate().map_err(map_environments_error)?;
+        let enabled = params.enabled;
+        let environment = self
+            .open_provisioned(&environment_id, "provider-managed ingress")
+            .await?;
+        let environment = self
+            .pass_through(
+                &environment,
+                ControllerFeature::Ingress,
+                |controller, target| {
+                    Box::pin(async move {
+                        if enabled {
+                            controller
+                                .client
+                                .call_with_timeout::<IngressEnsure>(
+                                    &EnsureIngressParams { target },
+                                    PASS_THROUGH_TIMEOUT,
+                                )
+                                .await
+                        } else {
+                            controller
+                                .client
+                                .call_with_timeout::<IngressRemove>(
+                                    &RemoveIngressParams { target },
+                                    PASS_THROUGH_TIMEOUT,
+                                )
+                                .await
+                        }
+                    })
+                },
+            )
+            .await?;
+        Ok(EnvironmentIngressPutResponse {
+            environment: environment_view(&environment),
+        })
+    }
+
+    /// The environment a pass-through acts on: provisioned and open.
+    async fn open_provisioned(
+        &self,
+        environment_id: &EnvironmentId,
+        what: &str,
+    ) -> Result<EnvironmentRecord, AgentApiError> {
+        let environment = EnvironmentStore::read_environment(self.store.as_ref(), environment_id)
+            .await
+            .map_err(map_environments_error)?;
+        if environment.provisioned().is_none() {
+            return Err(AgentApiError::rejected(format!(
+                "{what} is available only for provisioned environments"
+            )));
+        }
+        if environment.state != EnvironmentState::Open {
+            return Err(AgentApiError::rejected(format!(
+                "environment {environment_id} is {}; {what} needs an open environment",
+                environment.state
+            )));
+        }
+        Ok(environment)
+    }
+
+    /// Run one synchronous controller call against an open provisioned
+    /// environment's target and record the observation it answers.
+    async fn pass_through<F>(
+        &self,
+        environment: &EnvironmentRecord,
+        feature: ControllerFeature,
+        call: F,
+    ) -> Result<EnvironmentRecord, AgentApiError>
+    where
+        F: for<'a> FnOnce(
+            &'a ProviderController,
+            TargetRef,
+        ) -> futures_util::future::BoxFuture<
+            'a,
+            Result<environment_protocol::control::target::TargetResponse, ClientError>,
+        >,
+    {
+        let source = environment
+            .provisioned()
+            .ok_or_else(|| AgentApiError::internal("pass-through on a non-provisioned row"))?;
+        let provider_id = source.provider_id.clone();
+        let target_id = source.provider_target_id.clone().ok_or_else(|| {
+            AgentApiError::rejected(format!(
+                "environment {} has no provider target",
+                environment.environment_id
+            ))
+        })?;
+        let owner = target_owner(self.store.config().universe_id, environment)
+            .map_err(map_environments_error)?;
+        let controller = self
+            .connect_provider_controller(&provider_id)
+            .await
+            .map_err(ControllerError::into_api_error)?;
+        let answered = match controller.require(feature) {
+            Ok(()) => call(
+                &controller,
+                TargetRef {
+                    owner: owner.clone(),
+                    target_id: Some(target_id),
+                },
+            )
+            .await
+            .map_err(|error| controller.call_error(error)),
+            Err(error) => Err(error),
+        };
+        controller.close().await;
+        let observation = answered.map_err(ControllerError::into_api_error)?.target;
+        if observation.owner != owner {
+            return Err(AgentApiError::internal(format!(
+                "provider {provider_id} answered with another owner's target"
+            )));
         }
-        let environment = EnvironmentStore::set_environment_idle_policy(
+        EnvironmentStore::record_target_observation(
             self.store.as_ref(),
-            SetEnvironmentIdlePolicy {
-                environment_id,
-                idle_policy,
-                updated_at_ms: now_ms()?,
-            },
+            observation_request(environment, &observation, now_ms()?),
         )
         .await
-        .map_err(map_environments_error)?;
-        Ok(EnvironmentIdlePolicyPutResponse {
-            environment: environment_view(&environment),
-        })
+        .map_err(map_environments_error)
     }
 
     pub(crate) async fn read_environment_record(
@@ -424,353 +399,374 @@ impl EnvironmentService {
         })
     }
 
+    /// `environments/update`: replace the display name and caller metadata.
+    pub(crate) async fn update_environment_record(
+        &self,
+        params: EnvironmentUpdateParams,
+    ) -> Result<EnvironmentUpdateResponse, AgentApiError> {
+        let environment_id = parse_registry_environment_id(params.environment_id)?;
+        let environment = EnvironmentStore::update_environment(
+            self.store.as_ref(),
+            UpdateEnvironment {
+                environment_id,
+                display_name: params.display_name,
+                metadata: validated_caller_metadata(params.metadata)?,
+                updated_at_ms: now_ms()?,
+            },
+        )
+        .await
+        .map_err(map_environments_error)?;
+        Ok(EnvironmentUpdateResponse {
+            environment: environment_view(&environment),
+        })
+    }
+
     pub(crate) async fn list_environment_records(
         &self,
         params: EnvironmentListParams,
     ) -> Result<EnvironmentListResponse, AgentApiError> {
-        let environments = EnvironmentStore::list_environments(
+        let page = EnvironmentStore::list_environments(
             self.store.as_ref(),
             ListEnvironments {
-                metadata: params.metadata,
                 provider_id: params
                     .provider_id
-                    .map(super::providers::parse_environment_provider_id)
-                    .transpose()?,
-                binding_id: params
-                    .binding_id
-                    .map(parse_environment_provider_binding_id)
+                    .map(parse_environment_provider_id)
                     .transpose()?,
-                status: params.status.map(registry_lifecycle_status),
                 registration_key_id: params
                     .registration_key_id
                     .map(parse_registration_key_id)
                     .transpose()?,
+                state: params.state.map(registry_state),
+                include_closed: params.include_closed,
+                metadata: params.metadata,
+                limit: params
+                    .limit
+                    .unwrap_or(::environments::LIST_ENVIRONMENTS_DEFAULT_LIMIT),
+                after: params
+                    .after
+                    .map(parse_registry_environment_id)
+                    .transpose()?,
             },
         )
         .await
         .map_err(map_environments_error)?;
         Ok(EnvironmentListResponse {
-            environments: environments.iter().map(environment_view).collect(),
+            environments: page.environments.iter().map(environment_view).collect(),
+            next_after: page.next_after.map(|id| id.to_string()),
         })
     }
 
+    /// `environments/close`: a provisioned environment moves to `closing`
+    /// and the reconciler is nudged; external and registered ones close at
+    /// once and their live routes end.
     pub(crate) async fn close_environment_record(
         &self,
         params: EnvironmentCloseParams,
     ) -> Result<EnvironmentCloseResponse, AgentApiError> {
         let environment_id = parse_registry_environment_id(params.environment_id)?;
+        let environment = self
+            .begin_close(&environment_id, EnvironmentCloseReason::Requested)
+            .await?;
+        Ok(EnvironmentCloseResponse {
+            environment: environment_view(&environment),
+        })
+    }
+
+    /// Begin closing one environment with `reason`, then signal: the
+    /// reconciler for a provisioned row, live routes for every row.
+    pub(crate) async fn begin_close(
+        &self,
+        environment_id: &EnvironmentId,
+        reason: EnvironmentCloseReason,
+    ) -> Result<EnvironmentRecord, AgentApiError> {
         let environment = EnvironmentStore::begin_close_environment(
             self.store.as_ref(),
             BeginCloseEnvironment {
-                environment_id,
-                updated_at_ms: now_ms()?,
+                environment_id: environment_id.clone(),
+                reason,
+                at_ms: now_ms()?,
             },
         )
         .await
         .map_err(map_environments_error)?;
-        Ok(EnvironmentCloseResponse {
-            environment: environment_view(&environment),
-        })
+        if environment.state == EnvironmentState::Closing {
+            self.signals.nudge_work();
+        }
+        self.signals
+            .revoke(self.store.config().universe_id, environment_id.as_str());
+        Ok(environment)
+    }
+
+    /// Start a work pass, as its own task, for every provider of this
+    /// universe with due provisioning or closing rows and no pass in
+    /// flight; returns how many it started. The caller never waits on a
+    /// provider, so a slow or hung controller delays only its own rows.
+    pub(crate) async fn start_environment_work(
+        &self,
+        now_ms: i64,
+        work: &ProviderWork,
+    ) -> Result<usize, AgentApiError> {
+        let universe_id = self.store.config().universe_id;
+        let rows = self
+            .store
+            .list_environment_work(now_ms, WORK_BATCH)
+            .await
+            .map_err(map_environments_error)?;
+        let mut started = 0;
+        for (provider_id, rows) in by_provider(rows) {
+            let Some(claim) = work.claim(universe_id, &provider_id) else {
+                continue;
+            };
+            let service = self.clone();
+            tokio::spawn(async move {
+                let outcome = service
+                    .reconciler()
+                    .work_provider(provider_id, rows, now_ms)
+                    .await;
+                claim.finish(outcome.into_result());
+            });
+            started += 1;
+        }
+        Ok(started)
+    }
+
+    /// One display sweep over this universe's open provisioned rows.
+    pub(crate) async fn run_display_sweep(&self, now_ms: i64) -> Result<usize, AgentApiError> {
+        self.reconciler().run_display_sweep(now_ms).await
     }
 
-    /// Public entry point for one reconciliation pass; used by acceptance
-    /// tests that drive the reconciler deterministically instead of running
-    /// the background loop.
-    /// The pass includes steady environments.
+    /// One work pass that treats every scheduled row as due, then the
+    /// display sweep of this universe; acceptance tests drive the
+    /// reconciler with it instead of the background loop.
     pub async fn reconcile_environments_once(&self) -> Result<usize, AgentApiError> {
-        let mut pass = ProviderPass::default();
-        let result = self
-            .reconcile_environment_lifecycle_pass(&mut pass, ReconcileScope::WithSteady)
-            .await;
-        pass.close().await;
-        result
+        let reconciler = self.reconciler();
+        let worked = reconciler.run_work(i64::MAX, clock_ms()).await;
+        let swept = reconciler.run_display_sweep(clock_ms()).await;
+        Ok(worked? + swept?)
+    }
+}
+
+/// The reconciler of one universe, over its stores.
+pub(crate) struct Reconciler<'a> {
+    pub(crate) universe_id: uuid::Uuid,
+    pub(crate) environments: &'a dyn EnvironmentStore,
+    pub(crate) providers: &'a dyn EnvironmentProviderStore,
+    pub(crate) connector: &'a dyn ProviderControllerConnector,
+    pub(crate) signals: &'a EnvironmentSignals,
+}
+
+/// What one pass over a group of rows did.
+#[derive(Default)]
+struct PassOutcome {
+    changed: usize,
+    first_error: Option<AgentApiError>,
+}
+
+impl PassOutcome {
+    fn absorb(&mut self, environment_id: &EnvironmentId, result: Result<bool, AgentApiError>) {
+        match result {
+            Ok(changed) => self.changed += usize::from(changed),
+            Err(error) => {
+                tracing::debug!(
+                    target: "temporal_runtime",
+                    %environment_id,
+                    %error,
+                    "environment reconcile step failed"
+                );
+                self.first_error.get_or_insert(AgentApiError {
+                    message: format!("environment {environment_id}: {}", error.message),
+                    ..error
+                });
+            }
+        }
+    }
+
+    fn merge(&mut self, other: PassOutcome) {
+        self.changed += other.changed;
+        if self.first_error.is_none() {
+            self.first_error = other.first_error;
+        }
+    }
+
+    fn into_result(self) -> Result<usize, AgentApiError> {
+        match self.first_error {
+            Some(error) => Err(error),
+            None => Ok(self.changed),
+        }
+    }
+}
+
+/// Group rows by provider; rows without one are not provisioned.
+fn by_provider(
+    rows: Vec<EnvironmentRecord>,
+) -> BTreeMap<EnvironmentProviderId, Vec<EnvironmentRecord>> {
+    let mut groups: BTreeMap<EnvironmentProviderId, Vec<EnvironmentRecord>> = BTreeMap::new();
+    for row in rows {
+        if let Some(provider_id) = row.provider_id().cloned() {
+            groups.entry(provider_id).or_default().push(row);
+        }
+    }
+    groups
+}
+
+/// How a step's registry failure is treated: the row's own records that
+/// cannot be written (a contract breach the provider caused) back off like
+/// a transient error; a missing row is done; a store failure is the pass's.
+fn step_registry_error(error: &EnvironmentRegistryError) -> Option<String> {
+    match error {
+        EnvironmentRegistryError::InvalidInput { message } => Some(message.clone()),
+        EnvironmentRegistryError::AlreadyExists { kind, id } => {
+            Some(format!("the provider's answer conflicts with {kind} {id}"))
+        }
+        _ => None,
     }
+}
 
-    /// Reconcile this universe once, sharing `pass`'s controller
-    /// connections and unhealthy-provider skips with the rest of the
-    /// deployment pass. The registered sweep and the provisioned pass run
-    /// independently: an error in one never stops the other, and one
-    /// environment's error never stops the rest.
-    pub(crate) async fn reconcile_environment_lifecycle_pass(
+impl Reconciler<'_> {
+    /// Work on the rows due at `list_at_ms`; `now_ms` stamps writes and
+    /// decides deadlines and backoff. Providers run in parallel, each with
+    /// at most [`PROVIDER_CONCURRENCY`] rows in flight over one controller
+    /// connection.
+    pub(crate) async fn run_work(
         &self,
-        pass: &mut ProviderPass,
-        scope: ReconcileScope,
+        list_at_ms: i64,
+        now_ms: i64,
     ) -> Result<usize, AgentApiError> {
-        let registered = self.reconcile_registered_once().await;
-        let provisioned = self.reconcile_provisioned_once(pass, scope).await;
-        match (registered, provisioned) {
-            (Ok(registered), Ok(provisioned)) => Ok(registered + provisioned),
-            (Err(error), Ok(_)) => Err(AgentApiError {
-                message: format!("registered environments: {}", error.message),
-                ..error
-            }),
-            (Ok(_), Err(error)) => Err(error),
-            (Err(registered), Err(provisioned)) => Err(AgentApiError {
-                message: format!(
-                    "registered environments: {}; {}",
-                    registered.message, provisioned.message
-                ),
-                ..provisioned
-            }),
+        let rows = self
+            .environments
+            .list_environment_work(list_at_ms, WORK_BATCH)
+            .await
+            .map_err(map_environments_error)?;
+        let groups = by_provider(rows);
+        let outcomes = futures_util::future::join_all(
+            groups
+                .into_iter()
+                .map(|(provider_id, rows)| self.work_provider(provider_id, rows, now_ms)),
+        )
+        .await;
+        let mut outcome = PassOutcome::default();
+        for provider in outcomes {
+            outcome.merge(provider);
         }
+        outcome.into_result()
     }
 
-    /// One pass over every environment `scope` selects. Calls are
-    /// idempotent per owner, so a crash after controller I/O is recovered
-    /// by a later pass making the same calls again.
-    async fn reconcile_provisioned_once(
+    async fn work_provider(
         &self,
-        pass: &mut ProviderPass,
-        scope: ReconcileScope,
-    ) -> Result<usize, AgentApiError> {
-        let environments =
-            EnvironmentStore::list_environments_needing_reconcile(self.store.as_ref(), scope)
-                .await
-                .map_err(map_environments_error)?;
-        let mut changed = 0;
-        let mut first_error: Option<AgentApiError> = None;
-        for environment in environments {
-            match self.reconcile_environment(pass, &environment).await {
-                Ok(did_change) => changed += usize::from(did_change),
+        provider_id: EnvironmentProviderId,
+        rows: Vec<EnvironmentRecord>,
+        now_ms: i64,
+    ) -> PassOutcome {
+        let mut outcome = PassOutcome::default();
+        let controller =
+            match connect_provider_controller(self.providers, self.connector, &provider_id).await {
+                Ok(controller) => Some(controller),
                 Err(error) => {
-                    tracing::debug!(
-                        target: "temporal_runtime",
-                        environment_id = %environment.environment_id,
-                        %error,
-                        "environment reconcile step failed"
+                    let unregistered = matches!(
+                        error,
+                        ControllerError::Registry(EnvironmentRegistryError::NotFound { .. })
                     );
-                    first_error.get_or_insert(AgentApiError {
-                        message: format!(
-                            "environment {}: {}",
-                            environment.environment_id, error.message
-                        ),
-                        ..error
-                    });
+                    let message = error.to_string();
+                    for row in &rows {
+                        let result = self
+                            .without_controller(row, unregistered, &message, now_ms)
+                            .await;
+                        outcome.absorb(&row.environment_id, result);
+                    }
+                    None
                 }
-            }
-        }
-        match first_error {
-            Some(error) => Err(error),
-            None => Ok(changed),
+            };
+        let Some(controller) = controller else {
+            return outcome;
+        };
+        let controller = &controller;
+        let results = stream::iter(rows)
+            .map(|row| async move {
+                let result = self.step(controller, &row, now_ms).await;
+                (row.environment_id, result)
+            })
+            .buffer_unordered(PROVIDER_CONCURRENCY)
+            .collect::<Vec<_>>()
+            .await;
+        controller.close().await;
+        for (environment_id, result) in results {
+            outcome.absorb(&environment_id, result);
         }
+        outcome
     }
 
-    async fn reconcile_environment(
+    /// A due row whose provider controller could not be reached. A closing
+    /// row of a provider that is no longer registered is closed: nothing
+    /// can reach its target any more.
+    async fn without_controller(
         &self,
-        pass: &mut ProviderPass,
-        environment: &EnvironmentRecord,
+        row: &EnvironmentRecord,
+        unregistered: bool,
+        message: &str,
+        now_ms: i64,
     ) -> Result<bool, AgentApiError> {
-        let EnvironmentSource::Provisioned { provider_id, .. } = &environment.source else {
-            // External and registered environments hold no provider target.
-            if environment.status == EnvironmentStatus::Closing {
-                self.finish_close(environment)
-                    .await
-                    .map_err(map_environments_error)?;
-                return Ok(true);
-            }
-            return Ok(false);
-        };
-        let step = match environment.status {
-            EnvironmentStatus::Closing => self.close_target(pass, environment, provider_id).await,
-            EnvironmentStatus::Provisioning
-            | EnvironmentStatus::Booting
-            | EnvironmentStatus::Unknown => {
-                self.observe_target(pass, environment, provider_id).await
+        let result = match row.state {
+            EnvironmentState::Closing if unregistered => {
+                tracing::warn!(
+                    target: "temporal_runtime",
+                    environment_id = %row.environment_id,
+                    "closing an environment whose provider is no longer registered"
+                );
+                self.finish_close(row, now_ms).await
             }
-            _ if environment.power_diverges() => {
-                self.converge_power(pass, environment, provider_id).await
+            EnvironmentState::Provisioning if provisioning_deadline_passed(row, now_ms) => {
+                self.deadline(row, now_ms).await
             }
-            // Steady targets (and ready ones whose ingress diverges) are
-            // observed with `target/get`: a vanished target fails the
-            // environment, and ingress converges from the observation.
-            _ if environment.is_steady_provisioned() => {
-                self.observe_target(pass, environment, provider_id).await
+            EnvironmentState::Provisioning if unregistered => {
+                self.fail(row, message, None, now_ms).await
             }
-            _ => return Ok(false),
+            _ => self.backoff(row, message, now_ms).await,
         };
-        match step {
-            Ok(changed) => Ok(changed),
-            Err(error) => {
-                pass.observe_failure(&error).await;
-                self.controller_failure(environment, error).await
-            }
-        }
+        result.map_err(map_environments_error)
     }
 
-    /// Decide what a failed controller interaction does to the environment.
-    async fn controller_failure(
+    async fn step(
         &self,
-        environment: &EnvironmentRecord,
-        error: ControllerError,
+        controller: &ProviderController,
+        row: &EnvironmentRecord,
+        now_ms: i64,
     ) -> Result<bool, AgentApiError> {
-        if let ControllerError::Registry(error) = error {
-            return Err(map_environments_error(error));
-        }
-        let converging = matches!(
-            environment.status,
-            EnvironmentStatus::Closing
-                | EnvironmentStatus::Provisioning
-                | EnvironmentStatus::Booting
-                | EnvironmentStatus::Unknown
-        );
-        if !converging && error.disposition() != ControllerDisposition::Gone {
-            // A steady environment whose power change failed keeps serving
-            // in its current state. The error is reported with the pass
-            // instead of recorded, so it cannot start a provisioning
-            // deadline that a later wake would inherit.
-            return Err(error.into_api_error());
+        let attempt = match row.state {
+            EnvironmentState::Provisioning => self.provision_step(controller, row, now_ms).await,
+            EnvironmentState::Closing => self.close_step(controller, row, now_ms).await,
+            _ => Ok(false),
+        };
+        match attempt {
+            Ok(changed) => Ok(changed),
+            Err(EnvironmentRegistryError::NotFound { .. }) => Ok(false),
+            Err(error) => match step_registry_error(&error) {
+                Some(message) => self
+                    .backoff(row, &message, now_ms)
+                    .await
+                    .map_err(map_environments_error),
+                None => Err(map_environments_error(error)),
+            },
         }
-        self.decide_controller_failure(environment, error)
-            .await
-            .map_err(map_environments_error)
     }
 
-    async fn decide_controller_failure(
+    /// One step of a provisioning row: create while no target id is
+    /// recorded, observe once one is, and open after one data-plane
+    /// handshake with the target's envd.
+    async fn provision_step(
         &self,
-        environment: &EnvironmentRecord,
-        error: ControllerError,
+        controller: &ProviderController,
+        row: &EnvironmentRecord,
+        now_ms: i64,
     ) -> Result<bool, EnvironmentRegistryError> {
-        let error = match error {
-            ControllerError::Registry(error) => return Err(error),
-            error => error,
+        if provisioning_deadline_passed(row, now_ms) {
+            return self.deadline(row, now_ms).await;
+        }
+        let Some(source) = row.provisioned() else {
+            return Ok(false);
         };
-        let message = error.to_string();
-        let disposition = error.disposition();
-        match environment.status {
-            EnvironmentStatus::Closing if disposition == ControllerDisposition::Gone => {
-                self.finish_close(environment).await?;
-                Ok(true)
-            }
-            EnvironmentStatus::Closing => self.record_lifecycle_error(environment, &message).await,
-            EnvironmentStatus::Provisioning
-            | EnvironmentStatus::Booting
-            | EnvironmentStatus::Unknown => match disposition {
-                ControllerDisposition::Transient => {
-                    self.transient_failure(environment, &message).await
-                }
-                ControllerDisposition::Refused => self.fail(environment, &message, None).await,
-                ControllerDisposition::Gone => {
-                    let message = if environment.incarnation.provider_target_id.is_some() {
-                        format!("provider target disappeared: {message}")
-                    } else {
-                        message
-                    };
-                    self.fail(environment, &message, None).await
-                }
-            },
-            // Only a vanished target reaches here for a steady environment.
-            _ => {
-                self.fail(
-                    environment,
-                    &format!("provider target disappeared: {message}"),
-                    None,
-                )
-                .await
-            }
-        }
-    }
-
-    /// Keep the status and record the error; fail once errors persisted
-    /// past the provisioning deadline.
-    async fn transient_failure(
-        &self,
-        environment: &EnvironmentRecord,
-        message: &str,
-    ) -> Result<bool, EnvironmentRegistryError> {
-        let now = clock_ms();
-        if provisioning_deadline_passed(environment.lifecycle_error.as_ref(), now) {
-            return self
-                .fail(
-                    environment,
-                    &format!(
-                        "provisioning did not finish within {} minutes; last error: {message}",
-                        PROVISIONING_DEADLINE_MS / 60_000
-                    ),
-                    None,
-                )
-                .await;
-        }
-        self.record_lifecycle_error(environment, message).await
-    }
-
-    async fn record_lifecycle_error(
-        &self,
-        environment: &EnvironmentRecord,
-        message: &str,
-    ) -> Result<bool, EnvironmentRegistryError> {
-        let now = clock_ms();
-        if !lifecycle_error_is_news(environment.lifecycle_error.as_ref(), message, now) {
-            return Ok(false);
-        }
-        EnvironmentStore::record_environment_lifecycle_error(
-            self.store.as_ref(),
-            RecordEnvironmentLifecycleError {
-                environment_id: environment.environment_id.clone(),
-                message: message.to_owned(),
-                observed_at_ms: now,
-            },
-        )
-        .await?;
-        Ok(true)
-    }
-
-    async fn fail(
-        &self,
-        environment: &EnvironmentRecord,
-        message: &str,
-        daemon_build: Option<DaemonBuild>,
-    ) -> Result<bool, EnvironmentRegistryError> {
-        EnvironmentStore::fail_environment_lifecycle(
-            self.store.as_ref(),
-            FailEnvironmentLifecycle {
-                environment_id: environment.environment_id.clone(),
-                message: message.to_owned(),
-                daemon_build,
-                observed_at_ms: clock_ms(),
-            },
-        )
-        .await?;
-        Ok(true)
-    }
-
-    async fn finish_close(
-        &self,
-        environment: &EnvironmentRecord,
-    ) -> Result<(), EnvironmentRegistryError> {
-        EnvironmentStore::finish_close_environment(
-            self.store.as_ref(),
-            FinishCloseEnvironment {
-                environment_id: environment.environment_id.clone(),
-                observed_at_ms: clock_ms(),
-            },
-        )
-        .await?;
-        Ok(())
-    }
-
-    /// Converging and steady environments: create (or adopt) while no
-    /// target id is recorded, observe with `target/get` once one is.
-    /// Creation is never re-sent for a known target.
-    async fn observe_target(
-        &self,
-        pass: &mut ProviderPass,
-        environment: &EnvironmentRecord,
-        provider_id: &EnvironmentProviderId,
-    ) -> Result<bool, ControllerError> {
-        let controller = pass
-            .controller(
-                self.store.as_ref(),
-                self.provider_controller_connector.as_ref(),
-                provider_id,
-            )
-            .await?;
-        let owner = target_owner(self.store.config().universe_id, environment)?;
-        let response = match (
-            &environment.incarnation.provider_target_id,
-            &environment.incarnation.template_id,
-            &environment.incarnation.adoption_source_target,
-        ) {
-            (Some(target_id), _, _) => {
+        let owner = target_owner(self.universe_id, row)?;
+        let answer = match &source.provider_target_id {
+            Some(target_id) => {
                 controller
                     .client
                     .get_target(&GetTargetParams {
@@ -781,485 +777,582 @@ impl EnvironmentService {
                     })
                     .await
             }
-            (None, Some(template_id), None) => {
-                let template_id = TemplateId::new(template_id.as_str()).map_err(|error| {
-                    invalid_registry(format!("template id does not fit the protocol: {error}"))
-                })?;
+            None => {
+                let template_id =
+                    TemplateId::new(source.template_id.as_str()).map_err(|error| {
+                        EnvironmentRegistryError::InvalidInput {
+                            message: format!("template id does not fit the protocol: {error}"),
+                        }
+                    })?;
                 controller
                     .client
                     .create_target(&CreateTargetParams {
                         owner: owner.clone(),
                         template_id,
+                        display_name: row
+                            .display_name
+                            .as_deref()
+                            .and_then(|name| DisplayName::new(name).ok()),
+                        idle: source.idle.clone(),
                     })
                     .await
             }
-            (None, None, Some(source_target)) => {
-                controller.require(ControllerFeature::AdoptTarget)?;
-                let source_target =
-                    ProviderNativeRef::new(source_target.as_str()).map_err(|error| {
-                        invalid_registry(format!("adoption source is not valid: {error}"))
-                    })?;
-                controller
-                    .client
-                    .adopt_target(&AdoptTargetParams {
-                        owner: owner.clone(),
-                        source_target,
-                    })
-                    .await
-            }
-            _ => {
-                return Err(invalid_registry(
-                    "provisioned incarnation has neither a template nor an adoption source",
-                ));
-            }
-        };
-        let observation = response
-            .map_err(|error| controller.call_error(error))?
-            .target;
-        self.apply_observation(&controller, environment, &owner, observation)
-            .await
-    }
-
-    /// Steady environments whose power diverges from the intent: one
-    /// idempotent `target/setPower` per pass. A target that is not active
-    /// is observed instead.
-    async fn converge_power(
-        &self,
-        pass: &mut ProviderPass,
-        environment: &EnvironmentRecord,
-        provider_id: &EnvironmentProviderId,
-    ) -> Result<bool, ControllerError> {
-        let Some(target_id) = environment.incarnation.provider_target_id.clone() else {
-            return self.observe_target(pass, environment, provider_id).await;
         };
-        let controller = pass
-            .controller(
-                self.store.as_ref(),
-                self.provider_controller_connector.as_ref(),
-                provider_id,
-            )
-            .await?;
-        let owner = target_owner(self.store.config().universe_id, environment)?;
-        let target = TargetRef {
-            owner: owner.clone(),
-            target_id: Some(target_id),
-        };
-        let observation = match controller
-            .client
-            .set_target_power(&SetTargetPowerParams {
-                target: target.clone(),
-                power: environment.desired_power,
-            })
-            .await
-        {
+        let observation = match answer {
             Ok(response) => response.target,
             Err(error) => {
                 let error = controller.call_error(error);
-                if error.precondition() != Some(PreconditionReason::TargetNotActive) {
-                    return Err(error);
-                }
-                controller
-                    .client
-                    .get_target(&GetTargetParams { target })
-                    .await
-                    .map_err(|error| controller.call_error(error))?
-                    .target
-            }
-        };
-        self.apply_observation(&controller, environment, &owner, observation)
-            .await
-    }
-
-    /// Close by owner, with the target id when one is recorded: the provider
-    /// destroys whatever the owner holds, ingress included, and answers
-    /// `closed` once nothing is left. A closing target is closed again on
-    /// later passes (close is idempotent).
-    async fn close_target(
-        &self,
-        pass: &mut ProviderPass,
-        environment: &EnvironmentRecord,
-        provider_id: &EnvironmentProviderId,
-    ) -> Result<bool, ControllerError> {
-        let controller = match pass
-            .controller(
-                self.store.as_ref(),
-                self.provider_controller_connector.as_ref(),
-                provider_id,
-            )
-            .await
-        {
-            Err(ControllerError::Registry(EnvironmentRegistryError::NotFound { .. })) => {
-                // The provider record is gone, so nothing can reach its
-                // targets any more.
-                tracing::warn!(
-                    target: "temporal_runtime",
-                    environment_id = %environment.environment_id,
-                    %provider_id,
-                    "closing an environment whose provider is no longer registered"
-                );
-                self.finish_close(environment).await?;
-                return Ok(true);
+                return match error.disposition() {
+                    ControllerDisposition::Transient => {
+                        self.backoff(row, &error.to_string(), now_ms).await
+                    }
+                    ControllerDisposition::Refused => {
+                        self.fail(row, &error.to_string(), None, now_ms).await
+                    }
+                    ControllerDisposition::Gone => {
+                        let message = if source.provider_target_id.is_some() {
+                            format!("the provider target disappeared: {error}")
+                        } else {
+                            error.to_string()
+                        };
+                        self.fail(row, &message, None, now_ms).await
+                    }
+                };
             }
-            other => other?,
         };
-        let owner = target_owner(self.store.config().universe_id, environment)?;
-        let observation = controller
-            .client
-            .close_target(&CloseTargetParams {
-                target: TargetRef {
-                    owner,
-                    target_id: environment.incarnation.provider_target_id.clone(),
-                },
-            })
-            .await
-            .map_err(|error| controller.call_error(error))?
-            .target;
-        if observation.state.phase == TargetPhase::Closed {
-            self.finish_close(environment).await?;
-            return Ok(true);
+        if observation.owner != owner {
+            return self
+                .backoff(
+                    row,
+                    &format!(
+                        "provider {} answered with another owner's target",
+                        controller.provider_id
+                    ),
+                    now_ms,
+                )
+                .await;
         }
-        let (_, changed) = self
-            .record_observation(environment, &observation, environment.status, None)
+        let recorded = self
+            .environments
+            .record_target_observation(observation_request(row, &observation, now_ms))
             .await?;
-        Ok(changed)
+        // A close that landed while this step was in flight owns the row's
+        // schedule now; its own step picks the target up next.
+        if recorded.state != EnvironmentState::Provisioning {
+            return Ok(true);
+        }
+        let message = observation.message.as_ref().map(|message| message.as_str());
+        match observation.phase {
+            TargetPhase::Provisioning => {
+                let note = match message {
+                    Some(message) => format!("waiting for the provider: {message}"),
+                    None => "waiting for the provider".to_owned(),
+                };
+                self.schedule(&recorded, now_ms + POLL_MS, 0, Some(note), now_ms)
+                    .await
+            }
+            TargetPhase::Active => {
+                self.open_handshake(controller, &recorded, &owner, now_ms)
+                    .await
+            }
+            TargetPhase::Failed => {
+                self.fail(
+                    &recorded,
+                    message.unwrap_or("the provider reported the target failed"),
+                    None,
+                    now_ms,
+                )
+                .await
+            }
+            TargetPhase::Closing | TargetPhase::Closed => {
+                self.fail(
+                    &recorded,
+                    "the provider ended the target before it opened",
+                    None,
+                    now_ms,
+                )
+                .await
+            }
+            TargetPhase::Unknown => {
+                self.backoff(
+                    &recorded,
+                    message.unwrap_or("the provider cannot tell the target's state"),
+                    now_ms,
+                )
+                .await
+            }
+        }
     }
 
-    /// Record an observation and act on it: the Ready transition runs the
-    /// data-plane handshake first, and ingress converges against the
-    /// recorded intent on running targets.
-    async fn apply_observation(
+    /// The only readiness proof: `initialize` over the target's data route.
+    /// A typed refusal that may clear is waited out at its `Retry-After`.
+    async fn open_handshake(
         &self,
         controller: &ProviderController,
-        environment: &EnvironmentRecord,
+        row: &EnvironmentRecord,
         owner: &TargetOwner,
-        observation: TargetObservation,
-    ) -> Result<bool, ControllerError> {
-        if observation.owner != *owner {
-            return Err(controller.call_error(ClientError::Decode(
-                "the provider answered with another owner's target".to_owned(),
-            )));
-        }
-        match target_verdict(&observation.state) {
-            // A ready environment became ready through the runtime's own
-            // data-plane handshake; the provider's liveness probe alone does
-            // not demote it.
-            TargetVerdict::Status(EnvironmentStatus::Booting)
-                if environment.status == EnvironmentStatus::Ready =>
-            {
-                let (recorded, changed) = self
-                    .record_observation(environment, &observation, EnvironmentStatus::Ready, None)
-                    .await?;
-                let converged = self
-                    .converge_ingress(controller, &recorded, owner, &observation)
-                    .await;
-                Ok(changed || converged)
-            }
-            TargetVerdict::Status(status) => {
-                let (recorded, changed) = self
-                    .record_observation(environment, &observation, status, None)
-                    .await?;
-                let stalled = environment.status == status
-                    && matches!(
-                        status,
-                        EnvironmentStatus::Provisioning | EnvironmentStatus::Booting
-                    );
-                if !stalled {
-                    return Ok(changed);
-                }
-                let noted = self
-                    .transient_failure(&recorded, &waiting_note(status, &observation.state))
-                    .await?;
-                Ok(changed || noted)
-            }
-            TargetVerdict::Failed(message) => {
-                self.record_observation(environment, &observation, environment.status, None)
-                    .await?;
-                Ok(self.fail(environment, &message, None).await?)
-            }
-            TargetVerdict::Unknown(message) => {
-                let (recorded, _) = self
-                    .record_observation(environment, &observation, EnvironmentStatus::Unknown, None)
+        now_ms: i64,
+    ) -> Result<bool, EnvironmentRegistryError> {
+        let Some(target_id) = row
+            .provisioned()
+            .and_then(|source| source.provider_target_id.clone())
+        else {
+            return self
+                .backoff(
+                    row,
+                    "the provider reported an active target without a targetId",
+                    now_ms,
+                )
+                .await;
+        };
+        let route = provider_data_route(&controller.data_route_base, owner, &target_id);
+        match DataClient::connect_initialized(
+            &route,
+            provider_connect_options(controller.credential.as_ref()),
+        )
+        .await
+        {
+            Ok((client, initialized)) => {
+                let _ = client.close().await;
+                let written = self
+                    .environments
+                    .open_environment(OpenEnvironment {
+                        environment_id: row.environment_id.clone(),
+                        daemon_build: DaemonBuild::from_implementation(
+                            &initialized.server_info,
+                            initialized.protocol_version,
+                        ),
+                        at_ms: now_ms,
+                    })
                     .await?;
-                self.transient_failure(&recorded, &message).await?;
-                Ok(true)
+                Ok(written.state == EnvironmentState::Open)
             }
-            TargetVerdict::DaemonReady if environment.status == EnvironmentStatus::Ready => {
-                let (recorded, changed) = self
-                    .record_observation(environment, &observation, EnvironmentStatus::Ready, None)
-                    .await?;
-                let converged = self
-                    .converge_ingress(controller, &recorded, owner, &observation)
-                    .await;
-                Ok(changed || converged)
+            Err(ClientError::VersionMismatch { local, remote, .. }) => {
+                self.fail(
+                    row,
+                    &format!(
+                        "the environment's envd speaks protocol version {remote}; this runtime requires {local}"
+                    ),
+                    Some(DaemonBuild {
+                        version: None,
+                        git_sha: None,
+                        protocol_version: remote,
+                    }),
+                    now_ms,
+                )
+                .await
             }
-            TargetVerdict::DaemonReady => {
-                let Some(target_id) = &observation.target_id else {
-                    let (recorded, _) = self
-                        .record_observation(
-                            environment,
-                            &observation,
-                            EnvironmentStatus::Booting,
-                            None,
-                        )
-                        .await?;
-                    self.transient_failure(
-                        &recorded,
-                        "the provider reported a running target without a targetId",
+            Err(error) => match error.data_route_refusal() {
+                Some(refusal) if refusal.is_retryable() => {
+                    let retry_after = i64::try_from(
+                        error.retry_after_ms().unwrap_or(WAIT_RETRY_AFTER_MS),
                     )
-                    .await?;
-                    return Ok(true);
-                };
-                let endpoint = provider_data_route(&controller.data_route_base, owner, target_id);
-                match probe_daemon(&endpoint, &controller.credential).await {
-                    DaemonProbe::Ready(build) => {
-                        let (recorded, _) = self
-                            .record_observation(
-                                environment,
-                                &observation,
-                                EnvironmentStatus::Ready,
-                                Some(build),
-                            )
-                            .await?;
-                        self.converge_ingress(controller, &recorded, owner, &observation)
-                            .await;
-                        Ok(true)
-                    }
-                    DaemonProbe::Mismatch { local, remote } => {
-                        self.record_observation(
-                            environment,
-                            &observation,
-                            environment.status,
-                            None,
-                        )
-                        .await?;
-                        self.fail(
-                            environment,
-                            &format!(
-                                "the environment's envd speaks protocol version {remote}; this runtime requires {local}"
-                            ),
-                            Some(DaemonBuild {
-                                version: None,
-                                git_sha: None,
-                                protocol_version: remote,
-                            }),
-                        )
+                    .unwrap_or(i64::MAX);
+                    self.schedule(
+                        row,
+                        now_ms.saturating_add(retry_after),
+                        0,
+                        Some(format!("waiting for envd: {refusal}")),
+                        now_ms,
+                    )
+                    .await
+                }
+                Some(DataRouteRefusal::Gone {}) => {
+                    self.fail(row, "the provider closed the target", None, now_ms)
                         .await
-                        .map_err(ControllerError::from)
-                    }
-                    DaemonProbe::Unreachable(message) => {
-                        let (recorded, _) = self
-                            .record_observation(
-                                environment,
-                                &observation,
-                                EnvironmentStatus::Booting,
-                                None,
-                            )
-                            .await?;
-                        self.transient_failure(&recorded, &message).await?;
-                        Ok(true)
-                    }
                 }
-            }
+                Some(DataRouteRefusal::Failed { message }) => {
+                    self.fail(row, message.as_str(), None, now_ms).await
+                }
+                _ => {
+                    self.backoff(
+                        row,
+                        &format!("envd did not complete the data-plane handshake: {error}"),
+                        now_ms,
+                    )
+                    .await
+                }
+            },
         }
     }
 
-    /// Persist an observation when it changes the record: status, target
-    /// id, power states or the daemon build. Returns the current record.
-    async fn record_observation(
+    /// One step of a closing row: `target/close` by owner, with the target
+    /// id when one is recorded, until the provider reports it gone. Closing
+    /// has no deadline: a provider still closing is polled, and any other
+    /// phase it answers (a target it cannot remove) backs off like an
+    /// error.
+    async fn close_step(
         &self,
-        environment: &EnvironmentRecord,
-        observation: &TargetObservation,
-        status: EnvironmentStatus,
-        daemon_build: Option<DaemonBuild>,
-    ) -> Result<(EnvironmentRecord, bool), ControllerError> {
-        let target_changed = observation.target_id.is_some()
-            && environment.incarnation.provider_target_id != observation.target_id;
-        let changed = environment.status != status
-            || target_changed
-            || environment.incarnation.power_states != observation.supported_power_states
-            || daemon_build.is_some();
-        if !changed {
-            return Ok((environment.clone(), false));
-        }
-        let recorded = EnvironmentStore::observe_provisioned_environment(
-            self.store.as_ref(),
-            ObserveProvisionedEnvironment {
-                environment_id: environment.environment_id.clone(),
-                provider_target_id: observation.target_id.clone(),
-                status,
-                power_states: observation.supported_power_states.clone(),
-                daemon_build,
-                observed_at_ms: clock_ms(),
+        controller: &ProviderController,
+        row: &EnvironmentRecord,
+        now_ms: i64,
+    ) -> Result<bool, EnvironmentRegistryError> {
+        let owner = target_owner(self.universe_id, row)?;
+        let target_id = row
+            .provisioned()
+            .and_then(|source| source.provider_target_id.clone());
+        match controller
+            .client
+            .close_target(&CloseTargetParams {
+                target: TargetRef { owner, target_id },
+            })
+            .await
+        {
+            Ok(response) => match response.target.phase {
+                TargetPhase::Closed => self.finish_close(row, now_ms).await,
+                TargetPhase::Closing => {
+                    self.schedule(
+                        row,
+                        now_ms + POLL_MS,
+                        0,
+                        Some("waiting for the provider to close the target".to_owned()),
+                        now_ms,
+                    )
+                    .await
+                }
+                phase => {
+                    let message = match response.target.message.as_ref() {
+                        Some(message) => format!(
+                            "the provider answered close with a {} target: {}",
+                            phase_name(phase),
+                            message.as_str()
+                        ),
+                        None => format!(
+                            "the provider answered close with a {} target",
+                            phase_name(phase)
+                        ),
+                    };
+                    self.backoff(row, &message, now_ms).await
+                }
             },
+            Err(error) if call_disposition(&error) == ControllerDisposition::Gone => {
+                self.finish_close(row, now_ms).await
+            }
+            Err(error) => {
+                let error = controller.call_error(error);
+                self.backoff(row, &error.to_string(), now_ms).await
+            }
+        }
+    }
+
+    /// Observe every open provisioned row with `target/get` and record what
+    /// the provider reports. A failed target fails its row; a closed or
+    /// missing one closes it (`provider_ended`). Power is never touched.
+    pub(crate) async fn run_display_sweep(&self, now_ms: i64) -> Result<usize, AgentApiError> {
+        let rows = self
+            .environments
+            .list_open_provisioned_environments()
+            .await
+            .map_err(map_environments_error)?;
+        let outcomes = futures_util::future::join_all(
+            by_provider(rows)
+                .into_iter()
+                .map(|(provider_id, rows)| self.sweep_provider(provider_id, rows, now_ms)),
         )
-        .await?;
-        Ok((recorded, true))
+        .await;
+        let mut outcome = PassOutcome::default();
+        for provider in outcomes {
+            outcome.merge(provider);
+        }
+        outcome.into_result()
     }
 
-    /// Converge a running target's ingress toward the recorded intent. The
-    /// recorded endpoint always mirrors what the provider last reported.
-    /// Ingress methods answer promptly and may continue in the background,
-    /// so an answer that has not converged yet is pending: the intent stays
-    /// and a later observation checks again. Only a typed refusal of
-    /// `ingress/ensure` drops the intent. Ingress failures never fail the
-    /// environment and are never recorded as lifecycle errors, so they
-    /// cannot start a provisioning deadline. Returns whether the record
-    /// changed.
-    async fn converge_ingress(
+    async fn sweep_provider(
         &self,
-        controller: &ProviderController,
-        environment: &EnvironmentRecord,
-        owner: &TargetOwner,
-        observation: &TargetObservation,
-    ) -> bool {
-        let realized = realized_ingress(observation);
-        let mut changed = self
-            .record_realized_ingress(
-                environment,
-                environment.public_endpoint.as_deref(),
-                &realized,
-            )
-            .await;
-        let mut recorded = realized;
-        if environment.public_ingress_enabled == recorded.is_some() {
-            return changed;
-        }
-        let enabling = environment.public_ingress_enabled;
-        if !controller.features.ingress {
-            if enabling {
-                tracing::warn!(
-                    target: "temporal_runtime",
-                    environment_id = %environment.environment_id,
-                    provider_id = %controller.provider_id,
-                    "the provider no longer offers public ingress; the ingress intent is dropped"
-                );
-                changed |= self.drop_ingress_intent(environment).await;
-            }
-            return changed;
-        }
-        let target = TargetRef {
-            owner: owner.clone(),
-            target_id: observation.target_id.clone(),
-        };
-        let answer = if enabling {
-            controller
-                .client
-                .ensure_ingress(&EnsureIngressParams { target })
-                .await
-        } else {
-            controller
-                .client
-                .remove_ingress(&RemoveIngressParams { target })
-                .await
-        };
-        match answer.map_err(|error| controller.call_error(error)) {
-            Ok(response) => {
-                let answered = realized_ingress(&response.target);
-                changed |= self
-                    .record_realized_ingress(environment, recorded.as_deref(), &answered)
-                    .await;
-                recorded = answered;
-                if environment.public_ingress_enabled != recorded.is_some() {
+        provider_id: EnvironmentProviderId,
+        rows: Vec<EnvironmentRecord>,
+        now_ms: i64,
+    ) -> PassOutcome {
+        let mut outcome = PassOutcome::default();
+        let controller =
+            match connect_provider_controller(self.providers, self.connector, &provider_id).await {
+                Ok(controller) => controller,
+                Err(error) => {
                     tracing::debug!(
                         target: "temporal_runtime",
-                        environment_id = %environment.environment_id,
-                        enabling,
-                        "public ingress change is still in progress at the provider"
+                        %provider_id,
+                        %error,
+                        "display sweep skipped an unreachable provider"
                     );
+                    return outcome;
                 }
-            }
-            Err(error) if enabling && error.disposition() == ControllerDisposition::Refused => {
-                tracing::warn!(
-                    target: "temporal_runtime",
-                    environment_id = %environment.environment_id,
-                    %error,
-                    "the provider refused public ingress; the ingress intent is dropped"
-                );
-                changed |= self.drop_ingress_intent(environment).await;
+            };
+        let controller = &controller;
+        let results = stream::iter(rows)
+            .map(|row| async move {
+                let result = self.observe_open(controller, &row, now_ms).await;
+                (row.environment_id, result)
+            })
+            .buffer_unordered(PROVIDER_CONCURRENCY)
+            .collect::<Vec<_>>()
+            .await;
+        controller.close().await;
+        for (environment_id, result) in results {
+            outcome.absorb(
+                &environment_id,
+                match result {
+                    Err(EnvironmentRegistryError::NotFound { .. }) => Ok(false),
+                    other => other.map_err(map_environments_error),
+                },
+            );
+        }
+        outcome
+    }
+
+    async fn observe_open(
+        &self,
+        controller: &ProviderController,
+        row: &EnvironmentRecord,
+        now_ms: i64,
+    ) -> Result<bool, EnvironmentRegistryError> {
+        let Some(target_id) = row
+            .provisioned()
+            .and_then(|source| source.provider_target_id.clone())
+        else {
+            return Ok(false);
+        };
+        let owner = target_owner(self.universe_id, row)?;
+        let observation = match controller
+            .client
+            .get_target(&GetTargetParams {
+                target: TargetRef {
+                    owner: owner.clone(),
+                    target_id: Some(target_id),
+                },
+            })
+            .await
+        {
+            Ok(response) => response.target,
+            Err(error) if call_disposition(&error) == ControllerDisposition::Gone => {
+                return self.end(row, now_ms).await;
             }
             Err(error) => {
-                tracing::warn!(
+                tracing::debug!(
                     target: "temporal_runtime",
-                    environment_id = %environment.environment_id,
+                    environment_id = %row.environment_id,
                     %error,
-                    "{}; retried at the next observation",
-                    if enabling {
-                        "enabling public ingress failed"
-                    } else {
-                        "removing public ingress failed"
-                    }
+                    "display sweep could not observe a target"
                 );
+                return Ok(false);
             }
+        };
+        if observation.owner != owner {
+            return Ok(false);
+        }
+        let recorded = self
+            .environments
+            .record_target_observation(observation_request(row, &observation, now_ms))
+            .await?;
+        match observation.phase {
+            TargetPhase::Failed => {
+                let message = observation
+                    .message
+                    .as_ref()
+                    .map(|message| message.as_str())
+                    .unwrap_or("the provider reported the target failed");
+                self.fail(&recorded, message, None, now_ms).await
+            }
+            TargetPhase::Closed => self.end(&recorded, now_ms).await,
+            _ => Ok(recorded != *row),
         }
-        changed
     }
 
-    /// Record `realized` as the environment's public endpoint when it
-    /// differs from `recorded`.
-    async fn record_realized_ingress(
+    async fn deadline(
         &self,
-        environment: &EnvironmentRecord,
-        recorded: Option<&str>,
-        realized: &Option<String>,
-    ) -> bool {
-        if recorded == realized.as_deref() {
-            return false;
-        }
-        let written = EnvironmentStore::record_environment_ingress(
-            self.store.as_ref(),
-            RecordEnvironmentIngress {
-                environment_id: environment.environment_id.clone(),
-                public_endpoint: realized.clone(),
-                observed_at_ms: clock_ms(),
-            },
+        row: &EnvironmentRecord,
+        now_ms: i64,
+    ) -> Result<bool, EnvironmentRegistryError> {
+        let message = format!(
+            "provisioning did not finish within {} minutes: {}",
+            PROVISIONING_DEADLINE_MS / 60_000,
+            row.state_message.as_deref().unwrap_or("no progress")
+        );
+        self.fail(row, &message, None, now_ms).await
+    }
+
+    async fn backoff(
+        &self,
+        row: &EnvironmentRecord,
+        message: &str,
+        now_ms: i64,
+    ) -> Result<bool, EnvironmentRegistryError> {
+        let attempts = row
+            .provisioned()
+            .map_or(0, |source| source.attempts)
+            .saturating_add(1);
+        self.schedule(
+            row,
+            now_ms.saturating_add(backoff_delay_ms(attempts)),
+            attempts,
+            Some(message.to_owned()),
+            now_ms,
         )
-        .await;
-        match written {
-            Ok(_) => true,
-            Err(error) => {
-                tracing::warn!(
-                    target: "temporal_runtime",
-                    environment_id = %environment.environment_id,
-                    %error,
-                    "recording the realized public ingress failed"
-                );
-                false
-            }
+        .await
+    }
+
+    async fn schedule(
+        &self,
+        row: &EnvironmentRecord,
+        next_attempt_at_ms: i64,
+        attempts: u32,
+        state_message: Option<String>,
+        now_ms: i64,
+    ) -> Result<bool, EnvironmentRegistryError> {
+        let written = self
+            .environments
+            .schedule_environment_attempt(ScheduleEnvironmentAttempt {
+                environment_id: row.environment_id.clone(),
+                expected_state: row.state,
+                next_attempt_at_ms,
+                attempts,
+                state_message,
+                at_ms: now_ms,
+            })
+            .await?;
+        Ok(written != *row)
+    }
+
+    async fn fail(
+        &self,
+        row: &EnvironmentRecord,
+        message: &str,
+        daemon_build: Option<DaemonBuild>,
+        now_ms: i64,
+    ) -> Result<bool, EnvironmentRegistryError> {
+        let written = self
+            .environments
+            .fail_environment(FailEnvironment {
+                environment_id: row.environment_id.clone(),
+                message: message.to_owned(),
+                daemon_build,
+                at_ms: now_ms,
+            })
+            .await?;
+        Ok(written.state == EnvironmentState::Failed)
+    }
+
+    async fn finish_close(
+        &self,
+        row: &EnvironmentRecord,
+        now_ms: i64,
+    ) -> Result<bool, EnvironmentRegistryError> {
+        let written = self
+            .environments
+            .finish_close_environment(FinishCloseEnvironment {
+                environment_id: row.environment_id.clone(),
+                at_ms: now_ms,
+            })
+            .await?;
+        self.signals
+            .revoke(self.universe_id, row.environment_id.as_str());
+        Ok(written.state == EnvironmentState::Closed)
+    }
+
+    async fn end(
+        &self,
+        row: &EnvironmentRecord,
+        now_ms: i64,
+    ) -> Result<bool, EnvironmentRegistryError> {
+        let written = self
+            .environments
+            .end_provisioned_environment(EndProvisionedEnvironment {
+                environment_id: row.environment_id.clone(),
+                at_ms: now_ms,
+            })
+            .await?;
+        self.signals
+            .revoke(self.universe_id, row.environment_id.as_str());
+        Ok(written.state == EnvironmentState::Closed)
+    }
+}
+
+/// The provider work passes in flight, one per universe and provider at a
+/// time, and the rate limit of their failure warnings.
+#[derive(Clone, Default)]
+pub(crate) struct ProviderWork {
+    inner: std::sync::Arc<std::sync::Mutex<ProviderWorkState>>,
+}
+
+#[derive(Default)]
+struct ProviderWorkState {
+    running: std::collections::HashSet<(uuid::Uuid, EnvironmentProviderId)>,
+    failures: std::collections::HashMap<
+        (uuid::Uuid, EnvironmentProviderId),
+        (String, std::time::Instant),
+    >,
+}
+
+impl ProviderWork {
+    /// Claim the provider's next pass in the universe; `None` while one is
+    /// in flight.
+    fn claim(
+        &self,
+        universe_id: uuid::Uuid,
+        provider_id: &EnvironmentProviderId,
+    ) -> Option<ProviderWorkClaim> {
+        let key = (universe_id, provider_id.clone());
+        let mut state = self.inner.lock().expect("provider work poisoned");
+        if !state.running.insert(key.clone()) {
+            return None;
         }
+        Some(ProviderWorkClaim {
+            work: self.clone(),
+            key,
+        })
     }
 
-    /// Clear an ingress intent the provider cannot realize.
-    async fn drop_ingress_intent(&self, environment: &EnvironmentRecord) -> bool {
-        let written = EnvironmentStore::set_environment_ingress(
-            self.store.as_ref(),
-            SetEnvironmentIngress {
-                environment_id: environment.environment_id.clone(),
-                enabled: false,
-                updated_at_ms: clock_ms(),
-            },
-        )
-        .await;
-        match written {
-            Ok(_) => true,
+    #[cfg(test)]
+    fn in_flight(&self) -> usize {
+        self.inner
+            .lock()
+            .expect("provider work poisoned")
+            .running
+            .len()
+    }
+}
+
+/// A claimed provider pass; released when dropped, so a pass that panics
+/// still frees its provider.
+struct ProviderWorkClaim {
+    work: ProviderWork,
+    key: (uuid::Uuid, EnvironmentProviderId),
+}
+
+impl ProviderWorkClaim {
+    /// Record the pass's outcome: a failure warns when it is new or its
+    /// last warning is older than [`ReconcileFailureLog::REPEAT_INTERVAL`].
+    fn finish(self, result: Result<usize, AgentApiError>) {
+        let (universe_id, provider_id) = (&self.key.0, &self.key.1);
+        let mut state = self.work.inner.lock().expect("provider work poisoned");
+        match result {
+            Ok(_) => {
+                state.failures.remove(&self.key);
+            }
             Err(error) => {
-                tracing::warn!(
-                    target: "temporal_runtime",
-                    environment_id = %environment.environment_id,
-                    %error,
-                    "dropping the public ingress intent failed"
-                );
-                false
+                let message = error.to_string();
+                let now = std::time::Instant::now();
+                let repeat = state.failures.get(&self.key).is_some_and(|(last, at)| {
+                    *last == message
+                        && now.duration_since(*at) < ReconcileFailureLog::REPEAT_INTERVAL
+                });
+                if repeat {
+                    tracing::debug!(target: "temporal_runtime", %universe_id, %provider_id, error = %message, "environment provider work pass still failing");
+                } else {
+                    tracing::warn!(target: "temporal_runtime", %universe_id, %provider_id, error = %message, "environment provider work pass failed (repeats suppressed for 60s)");
+                    state.failures.insert(self.key.clone(), (message, now));
+                }
             }
         }
+        drop(state);
     }
 }
 
-/// The public endpoint an observation reports realized.
-fn realized_ingress(observation: &TargetObservation) -> Option<String> {
-    observation
-        .ingress
-        .as_ref()
-        .map(|ingress| ingress.endpoint.as_str().to_owned())
+impl Drop for ProviderWorkClaim {
+    fn drop(&mut self) {
+        if let Ok(mut state) = self.work.inner.lock() {
+            state.running.remove(&self.key);
+        }
+    }
 }
 
 /// Rate-limits repeated reconcile-pass failures per universe so a provider
@@ -1308,12 +1401,14 @@ pub(crate) fn parse_registration_key_id(
     })
 }
 
-pub(crate) fn allocate_environment_id() -> EnvironmentId {
-    EnvironmentId::new(format!("environment_{}", uuid::Uuid::new_v4().simple()))
+fn parse_request_id(value: String) -> Result<EnvironmentProvisionRequestId, AgentApiError> {
+    EnvironmentProvisionRequestId::try_new(value).map_err(|error| {
+        AgentApiError::invalid_request(format!("invalid environment request id: {error}"))
+    })
 }
 
-pub(crate) fn allocate_incarnation_id() -> EnvironmentIncarnationId {
-    EnvironmentIncarnationId::new(format!("incarnation_{}", uuid::Uuid::new_v4().simple()))
+pub(crate) fn allocate_environment_id() -> EnvironmentId {
+    EnvironmentId::new(format!("environment_{}", uuid::Uuid::new_v4().simple()))
 }
 
 /// Caller-supplied environment metadata: the same bounds and reserved-prefix
@@ -1328,210 +1423,400 @@ fn validated_caller_metadata(
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::environments::fake_controller::{FakeController, FakeControllerOptions};
-    use environment_protocol::{
-        ENVD_PROTOCOL_VERSION, control::target::TargetRef as Ref, metadata::DescriptiveText,
-        routes::DataRouteBase,
+    use crate::environments::{
+        fake_controller::{FAKE_TEMPLATE_ID, FakeController, FakeControllerOptions},
+        provider_controllers::WebSocketProviderControllerConnector,
     };
+    use ::environments::{
+        EnvironmentProviderBindingStore, InMemoryEnvironmentRegistryStore, PowerState,
+        ProviderCredentialChange, PutEnvironmentProvider, PutEnvironmentProviderBinding,
+    };
+    use auth::SecretValue;
+    use environment_protocol::ENVD_PROTOCOL_VERSION;
 
-    fn state(
-        phase: TargetPhase,
-        power: Option<PowerState>,
-        daemon_ready: bool,
-        message: Option<&str>,
-    ) -> TargetState {
-        TargetState {
-            phase,
-            power,
-            daemon_ready,
-            message: message.and_then(DescriptiveText::lossy),
-        }
+    #[test]
+    fn backoff_doubles_from_two_seconds_up_to_five_minutes() {
+        assert_eq!(backoff_delay_ms(1), 2_000);
+        assert_eq!(backoff_delay_ms(2), 4_000);
+        assert_eq!(backoff_delay_ms(5), 32_000);
+        assert_eq!(backoff_delay_ms(8), 256_000);
+        assert_eq!(backoff_delay_ms(9), BACKOFF_MAX_MS);
+        assert_eq!(backoff_delay_ms(u32::MAX), BACKOFF_MAX_MS);
     }
 
     #[test]
-    fn target_states_map_to_lifecycle_verdicts() {
-        use TargetPhase::*;
+    fn one_pass_per_universe_and_provider_is_in_flight_and_a_dropped_claim_frees_it() {
+        let work = ProviderWork::default();
+        let universe = uuid::Uuid::from_u128(1);
+        let provider = EnvironmentProviderId::new("incus");
+        let other = EnvironmentProviderId::new("sandbox");
+        let claim = work.claim(universe, &provider).unwrap();
+        assert!(work.claim(universe, &provider).is_none());
+        let elsewhere = work.claim(uuid::Uuid::from_u128(2), &provider).unwrap();
+        let sibling = work.claim(universe, &other).unwrap();
+        assert_eq!(work.in_flight(), 3);
+        claim.finish(Ok(0));
+        drop(elsewhere);
+        drop(sibling);
+        assert_eq!(work.in_flight(), 0);
+        assert!(work.claim(universe, &provider).is_some());
+    }
+
+    struct Fixture {
+        store: InMemoryEnvironmentRegistryStore,
+        signals: EnvironmentSignals,
+        provider_id: EnvironmentProviderId,
+    }
+
+    impl Fixture {
+        async fn new(controller: &FakeController) -> Self {
+            Self::with_endpoint(controller.controller_url(), controller.credential()).await
+        }
+
+        async fn with_endpoint(endpoint: &str, credential: Option<&str>) -> Self {
+            let store = InMemoryEnvironmentRegistryStore::new();
+            let provider_id = EnvironmentProviderId::new("fake");
+            store
+                .put_provider(PutEnvironmentProvider {
+                    provider_id: provider_id.clone(),
+                    display_name: None,
+                    controller_endpoint: EnvironmentEndpoint::parse(endpoint).unwrap(),
+                    data_route_base: None,
+                    credential: match credential {
+                        Some(credential) => {
+                            ProviderCredentialChange::Set(SecretValue::new(credential))
+                        }
+                        None => ProviderCredentialChange::Keep,
+                    },
+                    updated_at_ms: 1,
+                })
+                .await
+                .unwrap();
+            store
+                .put_provider_binding(PutEnvironmentProviderBinding {
+                    universe_id: store.universe_id(),
+                    provider_id: provider_id.clone(),
+                    enabled: true,
+                    updated_at_ms: 1,
+                })
+                .await
+                .unwrap();
+            Self {
+                store,
+                signals: EnvironmentSignals::default(),
+                provider_id,
+            }
+        }
+
+        fn reconciler(&self) -> Reconciler<'_> {
+            Reconciler {
+                universe_id: self.store.universe_id(),
+                environments: &self.store,
+                providers: &self.store,
+                connector: &WebSocketProviderControllerConnector,
+                signals: &self.signals,
+            }
+        }
+
+        async fn create(&self, name: &str, created_at_ms: i64) -> EnvironmentId {
+            let environment_id = EnvironmentId::new(name);
+            self.store
+                .create_environment(CreateEnvironment {
+                    request_id: EnvironmentProvisionRequestId::new(format!("request-{name}")),
+                    environment_id: environment_id.clone(),
+                    provider_id: self.provider_id.clone(),
+                    template_id: EnvironmentTemplateId::new(FAKE_TEMPLATE_ID),
+                    idle: None,
+                    display_name: Some("Test environment".to_owned()),
+                    metadata: BTreeMap::new(),
+                    created_at_ms,
+                })
+                .await
+                .unwrap();
+            environment_id
+        }
+
+        async fn read(&self, environment_id: &EnvironmentId) -> EnvironmentRecord {
+            self.store.read_environment(environment_id).await.unwrap()
+        }
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn a_created_target_opens_after_one_handshake_that_records_the_build() {
+        let controller = FakeController::start().await.unwrap();
+        let fixture = Fixture::new(&controller).await;
+        let environment_id = fixture.create("environment_a", 1_000).await;
+        fixture
+            .reconciler()
+            .run_work(i64::MAX, 2_000)
+            .await
+            .unwrap();
+        let opened = fixture.read(&environment_id).await;
+        assert_eq!(opened.state, EnvironmentState::Open);
+        let source = opened.provisioned().unwrap();
+        assert!(source.provider_target_id.is_some());
+        assert_eq!(source.next_attempt_at_ms, None);
         assert_eq!(
-            target_verdict(&state(Provisioning, None, false, None)),
-            TargetVerdict::Status(EnvironmentStatus::Provisioning)
+            source.observed.as_ref().map(|observed| observed.phase),
+            Some(TargetPhase::Active)
         );
         assert_eq!(
-            target_verdict(&state(Active, Some(PowerState::Running), false, None)),
-            TargetVerdict::Status(EnvironmentStatus::Booting)
+            opened.daemon_build.map(|build| build.protocol_version),
+            Some(ENVD_PROTOCOL_VERSION)
         );
+        assert_eq!(controller.target_count().await, 1);
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn a_booting_refusal_is_waited_out_at_its_retry_after() {
+        let controller = FakeController::start_with(FakeControllerOptions {
+            booting_dials: 1,
+            ..FakeControllerOptions::default()
+        })
+        .await
+        .unwrap();
+        let fixture = Fixture::new(&controller).await;
+        let environment_id = fixture.create("environment_a", 1_000).await;
+        fixture
+            .reconciler()
+            .run_work(i64::MAX, 2_000)
+            .await
+            .unwrap();
+        let waiting = fixture.read(&environment_id).await;
+        assert_eq!(waiting.state, EnvironmentState::Provisioning);
         assert_eq!(
-            target_verdict(&state(Active, Some(PowerState::Running), true, None)),
-            TargetVerdict::DaemonReady
+            waiting.state_message.as_deref(),
+            Some("waiting for envd: booting")
         );
+        let source = waiting.provisioned().unwrap();
+        assert_eq!(source.attempts, 0, "a typed wait is not a failure");
+        assert_eq!(source.next_attempt_at_ms, Some(3_000));
+        // Not due before its Retry-After.
+        fixture.reconciler().run_work(2_500, 2_500).await.unwrap();
         assert_eq!(
-            target_verdict(&state(Active, Some(PowerState::Stopped), false, None)),
-            TargetVerdict::Status(EnvironmentStatus::Offline)
+            fixture.read(&environment_id).await.state,
+            EnvironmentState::Provisioning
         );
+        fixture.reconciler().run_work(3_000, 3_000).await.unwrap();
         assert_eq!(
-            target_verdict(&state(Failed, None, false, Some("disk full"))),
-            TargetVerdict::Failed("disk full".to_owned())
+            fixture.read(&environment_id).await.state,
+            EnvironmentState::Open
         );
-        assert!(matches!(
-            target_verdict(&state(Closed, None, false, None)),
-            TargetVerdict::Failed(_)
-        ));
-        assert!(matches!(
-            target_verdict(&state(Unknown, None, false, None)),
-            TargetVerdict::Unknown(_)
-        ));
-        assert!(matches!(
-            target_verdict(&state(Active, None, false, None)),
-            TargetVerdict::Unknown(_)
-        ));
     }
 
-    #[test]
-    fn the_provisioning_deadline_counts_from_the_first_error_or_stall() {
-        let error = EnvironmentLifecycleError::record(None, "provider unreachable", 1_000);
-        assert!(!provisioning_deadline_passed(None, i64::MAX));
-        assert!(!provisioning_deadline_passed(
-            Some(&error),
-            1_000 + PROVISIONING_DEADLINE_MS - 1
-        ));
-        let later = EnvironmentLifecycleError::record(Some(&error), "still unreachable", 50_000);
-        assert_eq!(later.first_at_ms, 1_000);
-        assert!(provisioning_deadline_passed(
-            Some(&later),
-            1_000 + PROVISIONING_DEADLINE_MS
-        ));
-    }
-
-    #[test]
-    fn stalled_observations_carry_the_provider_message_into_the_deadline() {
-        let booting = waiting_note(
-            EnvironmentStatus::Booting,
-            &state(
-                TargetPhase::Active,
-                Some(PowerState::Running),
-                false,
-                Some("guest agent not up"),
-            ),
+    #[tokio::test(flavor = "current_thread")]
+    async fn an_unreachable_provider_backs_off_per_row_until_the_deadline() {
+        let controller = FakeController::start().await.unwrap();
+        controller.set_reachable(false);
+        let fixture = Fixture::new(&controller).await;
+        let environment_id = fixture.create("environment_a", 1_000).await;
+        fixture
+            .reconciler()
+            .run_work(i64::MAX, 2_000)
+            .await
+            .unwrap();
+        let first = fixture.read(&environment_id).await;
+        let source = first.provisioned().unwrap();
+        assert_eq!(first.state, EnvironmentState::Provisioning);
+        assert_eq!(source.attempts, 1);
+        assert_eq!(source.next_attempt_at_ms, Some(4_000));
+        assert!(
+            first
+                .state_message
+                .as_deref()
+                .unwrap()
+                .contains("unreachable")
         );
+        fixture
+            .reconciler()
+            .run_work(i64::MAX, 4_000)
+            .await
+            .unwrap();
+        let second = fixture.read(&environment_id).await;
+        assert_eq!(second.provisioned().unwrap().attempts, 2);
         assert_eq!(
-            booting,
-            "waiting for envd to answer on the target: guest agent not up"
-        );
-        let provisioning = waiting_note(
-            EnvironmentStatus::Provisioning,
-            &state(TargetPhase::Provisioning, None, false, None),
+            second.provisioned().unwrap().next_attempt_at_ms,
+            Some(8_000)
         );
-        assert_eq!(
-            provisioning,
-            "waiting for the provider to provision the target"
+        // Past the deadline the row fails with the last error.
+        fixture
+            .reconciler()
+            .run_work(i64::MAX, 1_000 + PROVISIONING_DEADLINE_MS)
+            .await
+            .unwrap();
+        let failed = fixture.read(&environment_id).await;
+        assert_eq!(failed.state, EnvironmentState::Failed);
+        assert!(
+            failed
+                .state_message
+                .as_deref()
+                .unwrap()
+                .starts_with("provisioning did not finish within 30 minutes: ")
         );
-        // A stalled observation starts the deadline like a transient error:
-        // the run of notes keeps its first instant.
-        let first = EnvironmentLifecycleError::record(None, &booting, 1_000);
-        let repeated = EnvironmentLifecycleError::record(Some(&first), &booting, 900_000);
-        assert!(provisioning_deadline_passed(
-            Some(&repeated),
-            1_000 + PROVISIONING_DEADLINE_MS
-        ));
-    }
-
-    #[test]
-    fn repeated_errors_are_rewritten_only_when_new_or_stale() {
-        let recorded = EnvironmentLifecycleError::record(None, "provider unreachable", 1_000);
-        assert!(lifecycle_error_is_news(None, "provider unreachable", 1_000));
-        assert!(!lifecycle_error_is_news(
-            Some(&recorded),
-            "provider unreachable",
-            2_000
-        ));
-        assert!(lifecycle_error_is_news(
-            Some(&recorded),
-            "provider refused",
-            2_000
-        ));
-        assert!(lifecycle_error_is_news(
-            Some(&recorded),
-            "provider unreachable",
-            1_000 + LIFECYCLE_ERROR_REFRESH_MS
-        ));
+        // The provider back: a new row opens.
+        controller.set_reachable(true);
+        let next = fixture.create("environment_b", 2_000).await;
+        fixture
+            .reconciler()
+            .run_work(i64::MAX, 3_000)
+            .await
+            .unwrap();
+        assert_eq!(fixture.read(&next).await.state, EnvironmentState::Open);
     }
 
-    async fn created_target(controller: &FakeController) -> (TargetOwner, String, SecretValue) {
-        let credential = SecretValue::new(controller.credential());
-        let (client, initialized) = environment_client::ControllerClient::connect_initialized(
-            controller.controller_url(),
-            provider_connect_options(&credential),
-        )
+    #[tokio::test(flavor = "current_thread")]
+    async fn a_daemon_of_another_protocol_version_fails_naming_both() {
+        let controller = FakeController::start_with(FakeControllerOptions {
+            daemon_protocol_version: ENVD_PROTOCOL_VERSION + 1,
+            ..FakeControllerOptions::default()
+        })
         .await
-        .expect("controller handshake");
-        let owner = TargetOwner {
-            universe_id: UniverseId::new(uuid::Uuid::new_v4().to_string()).unwrap(),
-            binding_id: BindingId::new("primary").unwrap(),
-            environment_id: environment_protocol::ids::EnvironmentId::new("environment_1").unwrap(),
-            incarnation_id: IncarnationId::new("incarnation_1").unwrap(),
-        };
-        let observation = client
-            .create_target(&CreateTargetParams {
-                owner: owner.clone(),
-                template_id: TemplateId::new(
-                    crate::environments::fake_controller::FAKE_TEMPLATE_ID,
+        .unwrap();
+        let fixture = Fixture::new(&controller).await;
+        let environment_id = fixture.create("environment_a", 1_000).await;
+        fixture
+            .reconciler()
+            .run_work(i64::MAX, 2_000)
+            .await
+            .unwrap();
+        let failed = fixture.read(&environment_id).await;
+        assert_eq!(failed.state, EnvironmentState::Failed);
+        assert_eq!(
+            failed.state_message.as_deref(),
+            Some(
+                format!(
+                    "the environment's envd speaks protocol version {}; this runtime requires {ENVD_PROTOCOL_VERSION}",
+                    ENVD_PROTOCOL_VERSION + 1
                 )
-                .unwrap(),
+                .as_str()
+            )
+        );
+        assert_eq!(
+            failed.daemon_build.map(|build| build.protocol_version),
+            Some(ENVD_PROTOCOL_VERSION + 1)
+        );
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn an_unknown_template_is_a_refusal_that_fails_the_row() {
+        let controller = FakeController::start().await.unwrap();
+        let fixture = Fixture::new(&controller).await;
+        let environment_id = EnvironmentId::new("environment_a");
+        fixture
+            .store
+            .create_environment(CreateEnvironment {
+                request_id: EnvironmentProvisionRequestId::new("request"),
+                environment_id: environment_id.clone(),
+                provider_id: fixture.provider_id.clone(),
+                template_id: EnvironmentTemplateId::new("missing-template"),
+                idle: None,
+                display_name: None,
+                metadata: BTreeMap::new(),
+                created_at_ms: 1_000,
             })
             .await
-            .expect("create")
-            .target;
-        let target_id = observation.target_id.expect("target id");
-        let base: DataRouteBase = initialized.routes.data;
-        let endpoint = provider_data_route(&base, &owner, &target_id);
-        // Observation is a pure read of the same target.
-        let observed = client
-            .get_target(&GetTargetParams {
-                target: Ref {
-                    owner: owner.clone(),
-                    target_id: Some(target_id.clone()),
-                },
-            })
+            .unwrap();
+        fixture
+            .reconciler()
+            .run_work(i64::MAX, 2_000)
             .await
-            .expect("get")
-            .target;
-        assert_eq!(observed.target_id, Some(target_id));
-        let _ = client.close().await;
-        (owner, endpoint, credential)
+            .unwrap();
+        assert_eq!(
+            fixture.read(&environment_id).await.state,
+            EnvironmentState::Failed
+        );
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn the_ready_transition_handshake_records_the_daemon_build() {
+    async fn close_runs_until_the_target_is_gone_and_revokes_routes() {
         let controller = FakeController::start().await.unwrap();
-        let (_, endpoint, credential) = created_target(&controller).await;
-        match probe_daemon(&endpoint, &credential).await {
-            DaemonProbe::Ready(build) => {
-                assert_eq!(build.protocol_version, ENVD_PROTOCOL_VERSION);
-                assert!(build.version.is_some());
-            }
-            other => panic!("expected a ready daemon, got {other:?}"),
-        }
-        // Without the provider credential the data route is refused.
-        assert!(matches!(
-            probe_daemon(&endpoint, &SecretValue::new("wrong")).await,
-            DaemonProbe::Unreachable(_)
-        ));
+        let fixture = Fixture::new(&controller).await;
+        let environment_id = fixture.create("environment_a", 1_000).await;
+        fixture
+            .reconciler()
+            .run_work(i64::MAX, 2_000)
+            .await
+            .unwrap();
+        let mut route = fixture
+            .signals
+            .watch(fixture.store.universe_id(), environment_id.as_str());
+        fixture
+            .store
+            .begin_close_environment(BeginCloseEnvironment {
+                environment_id: environment_id.clone(),
+                reason: EnvironmentCloseReason::Requested,
+                at_ms: 3_000,
+            })
+            .await
+            .unwrap();
+        // While the provider is down the close backs off and stays closing.
+        controller.set_reachable(false);
+        fixture
+            .reconciler()
+            .run_work(i64::MAX, 3_000)
+            .await
+            .unwrap();
+        let closing = fixture.read(&environment_id).await;
+        assert_eq!(closing.state, EnvironmentState::Closing);
+        assert_eq!(closing.provisioned().unwrap().attempts, 1);
+        controller.set_reachable(true);
+        fixture
+            .reconciler()
+            .run_work(i64::MAX, 5_000)
+            .await
+            .unwrap();
+        let closed = fixture.read(&environment_id).await;
+        assert_eq!(closed.state, EnvironmentState::Closed);
+        assert_eq!(closed.close_reason, Some(EnvironmentCloseReason::Requested));
+        assert_eq!(controller.target_count().await, 0);
+        assert!(route.has_changed().unwrap());
+        route.mark_unchanged();
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn a_daemon_of_another_protocol_version_is_a_mismatch_naming_both() {
-        let controller = FakeController::start_with(FakeControllerOptions {
-            daemon_protocol_version: ENVD_PROTOCOL_VERSION + 1,
-            ..FakeControllerOptions::default()
-        })
-        .await
-        .unwrap();
-        let (_, endpoint, credential) = created_target(&controller).await;
+    async fn the_display_sweep_records_power_and_ends_a_target_the_provider_removed() {
+        let controller = FakeController::start().await.unwrap();
+        let fixture = Fixture::new(&controller).await;
+        let paused = fixture.create("environment_a", 1_000).await;
+        let ended = fixture.create("environment_b", 1_000).await;
+        fixture
+            .reconciler()
+            .run_work(i64::MAX, 2_000)
+            .await
+            .unwrap();
+        assert!(
+            controller
+                .set_power_out_of_band(paused.as_str(), PowerState::Paused)
+                .await
+        );
+        assert!(controller.end_target(ended.as_str()).await);
+        fixture
+            .reconciler()
+            .run_display_sweep(10_000)
+            .await
+            .unwrap();
+        let observed = fixture.read(&paused).await;
+        assert_eq!(observed.state, EnvironmentState::Open);
         assert_eq!(
-            probe_daemon(&endpoint, &credential).await,
-            DaemonProbe::Mismatch {
-                local: ENVD_PROTOCOL_VERSION,
-                remote: ENVD_PROTOCOL_VERSION + 1,
-            }
+            observed.display_status(),
+            ::environments::EnvironmentDisplayStatus::Paused
+        );
+        let gone = fixture.read(&ended).await;
+        assert_eq!(gone.state, EnvironmentState::Closed);
+        assert_eq!(
+            gone.close_reason,
+            Some(EnvironmentCloseReason::ProviderEnded)
+        );
+        // The sweep never powers anything: the paused target stays paused.
+        assert_eq!(controller.target_count().await, 1);
+        fixture
+            .reconciler()
+            .run_display_sweep(20_000)
+            .await
+            .unwrap();
+        assert_eq!(
+            fixture.read(&paused).await.display_status(),
+            ::environments::EnvironmentDisplayStatus::Paused
         );
     }
 }
diff --git a/crates/temporal-runtime/src/environments/mod.rs b/crates/temporal-runtime/src/environments/mod.rs
index 6d952e7a1..848588cb7 100644
--- a/crates/temporal-runtime/src/environments/mod.rs
+++ b/crates/temporal-runtime/src/environments/mod.rs
@@ -1,18 +1,18 @@
 //! Environment lifecycle management, connectivity, runtime resolution, and source discovery.
-use crate::environments::gateway::EnvironmentGatewayClientConfig;
 use api::*;
 use lifecycle::parse_registry_environment_id;
 use provider_controllers::ProviderControllerConnector;
 use providers::map_environments_error;
+use signals::EnvironmentSignals;
 use std::{collections::BTreeMap, sync::Arc};
 use store_pg::PgStore;
 pub(crate) mod credentials;
 pub mod fake_controller;
 pub(crate) mod lifecycle;
-pub(crate) mod power;
 pub(crate) mod provider_controllers;
 pub(crate) mod providers;
 pub(crate) mod registration;
+pub mod signals;
 
 pub mod gateway;
 pub(crate) mod prompts;
@@ -24,8 +24,8 @@ pub(crate) mod sources;
 #[derive(Clone)]
 pub(crate) struct EnvironmentService {
     pub(crate) store: Arc<PgStore>,
-    pub(crate) environment_gateway: EnvironmentGatewayClientConfig,
     pub(crate) provider_controller_connector: Arc<dyn ProviderControllerConnector>,
+    pub(crate) signals: Arc<EnvironmentSignals>,
 }
 fn now_ms() -> Result<i64, AgentApiError> {
     i64::try_from(
diff --git a/crates/temporal-runtime/src/environments/power.rs b/crates/temporal-runtime/src/environments/power.rs
deleted file mode 100644
index 7701ee00c..000000000
--- a/crates/temporal-runtime/src/environments/power.rs
+++ /dev/null
@@ -1,312 +0,0 @@
-//! Idle power policy: the power reaper.
-//!
-//! One pass reads the daemon idle report of every `ready` provisioned
-//! environment that carries an idle policy and, when a stage threshold has
-//! been crossed and nothing is executing, records the matching power intent
-//! (or a close). Activity is never persisted: the daemon owns the clock and
-//! reports a monotonic idle duration; Lightspeed only decides.
-
-use super::providers::map_environments_error;
-use super::*;
-
-use ::environments::{
-    BeginCloseEnvironment, EnvironmentProviderId, EnvironmentRecord, EnvironmentStore, IdleAction,
-    PowerState, SetEnvironmentPower,
-};
-use environment_client::{ClientError, DataClient};
-use environment_protocol::data::idle::{GetIdleParams, GetIdleResponse};
-use std::{collections::HashSet, time::Duration};
-
-/// `clientInfo.name` of the reaper's data-plane connections.
-const POWER_REAPER_CLIENT: &str = "lightspeed-power-reaper";
-
-/// Deadline of one `env/getIdle`, on top of the connect and `initialize`
-/// bounds.
-const IDLE_REPORT_TIMEOUT: Duration = Duration::from_secs(10);
-
-/// Outcome of one reaper pass for reporting/tests.
-#[derive(Clone, Debug, Default, PartialEq, Eq)]
-pub struct PowerReaperStats {
-    pub candidates: usize,
-    pub unreachable: usize,
-    pub busy: usize,
-    pub powered_down: usize,
-    pub closed: usize,
-}
-
-/// No process or job is running.
-fn is_quiescent(report: &GetIdleResponse) -> bool {
-    report.running_process_count == 0 && report.running_job_count == 0
-}
-
-/// Decide the idle action for one environment from the daemon's report.
-/// Pure so it can be tested without a daemon: nothing is due while work
-/// runs, while a power change is already pending, or before the first
-/// supported stage threshold.
-pub(crate) fn decide_idle_action(
-    environment: &EnvironmentRecord,
-    report: &GetIdleResponse,
-) -> Option<IdleAction> {
-    if !is_quiescent(report) {
-        return None;
-    }
-    if environment.desired_power != PowerState::Running {
-        return None;
-    }
-    let policy = environment.idle_policy.as_ref()?;
-    policy.due_action(report.idle_for_ms, &environment.incarnation.power_states)
-}
-
-/// Why an idle report could not be read.
-enum IdleReportFailure {
-    /// The daemon did not answer within its deadlines: its provider's
-    /// remaining environments are skipped for the rest of the pass.
-    TimedOut,
-    Unavailable,
-}
-
-impl EnvironmentService {
-    /// Public entry point for one reaper pass; used by acceptance tests that
-    /// drive the reaper deterministically instead of running the loop.
-    pub async fn reap_idle_environments_once(&self) -> Result<PowerReaperStats, AgentApiError> {
-        self.reconcile_idle_power_pass(&mut HashSet::new()).await
-    }
-
-    /// One reaper pass over this universe. `unhealthy` names providers
-    /// whose daemons timed out earlier in the deployment pass; their
-    /// environments are left for the next pass.
-    pub(crate) async fn reconcile_idle_power_pass(
-        &self,
-        unhealthy: &mut HashSet<EnvironmentProviderId>,
-    ) -> Result<PowerReaperStats, AgentApiError> {
-        let candidates = EnvironmentStore::list_environments_with_idle_policy(self.store.as_ref())
-            .await
-            .map_err(map_environments_error)?;
-        let mut stats = PowerReaperStats {
-            candidates: candidates.len(),
-            ..PowerReaperStats::default()
-        };
-        let universe_id = self.store.config().universe_id;
-        for environment in candidates {
-            let provider_id = environment.provider_id().cloned();
-            if provider_id
-                .as_ref()
-                .is_some_and(|provider_id| unhealthy.contains(provider_id))
-            {
-                stats.unreachable += 1;
-                continue;
-            }
-            let report = match self.read_idle_report(universe_id, &environment).await {
-                Ok(report) => report,
-                Err(failure) => {
-                    if let (IdleReportFailure::TimedOut, Some(provider_id)) = (failure, provider_id)
-                    {
-                        unhealthy.insert(provider_id);
-                    }
-                    stats.unreachable += 1;
-                    continue;
-                }
-            };
-            let Some(action) = decide_idle_action(&environment, &report) else {
-                if !is_quiescent(&report) {
-                    stats.busy += 1;
-                }
-                continue;
-            };
-            let now = now_ms()?;
-            match action.power_state() {
-                Some(desired_power) => {
-                    EnvironmentStore::set_environment_power(
-                        self.store.as_ref(),
-                        SetEnvironmentPower {
-                            environment_id: environment.environment_id.clone(),
-                            desired_power,
-                            updated_at_ms: now,
-                        },
-                    )
-                    .await
-                    .map_err(map_environments_error)?;
-                    stats.powered_down += 1;
-                    tracing::info!(
-                        target: "temporal_runtime",
-                        environment_id = %environment.environment_id,
-                        idle_for_ms = report.idle_for_ms,
-                        %desired_power,
-                        "idle policy powered environment down"
-                    );
-                }
-                None => {
-                    match EnvironmentStore::begin_close_environment(
-                        self.store.as_ref(),
-                        BeginCloseEnvironment {
-                            environment_id: environment.environment_id.clone(),
-                            updated_at_ms: now,
-                        },
-                    )
-                    .await
-                    {
-                        Ok(_) => stats.closed += 1,
-                        // Already closing/closed by someone else: converged.
-                        Err(::environments::EnvironmentRegistryError::InvalidInput { .. }) => {}
-                        Err(error) => return Err(map_environments_error(error)),
-                    }
-                    tracing::info!(
-                        target: "temporal_runtime",
-                        environment_id = %environment.environment_id,
-                        idle_for_ms = report.idle_for_ms,
-                        "idle policy closed environment"
-                    );
-                }
-            }
-        }
-        Ok(stats)
-    }
-
-    /// Ask the environment's daemon for its idle report through the ordinary
-    /// on-demand route, within the connect, `initialize` and report
-    /// deadlines, and close the connection again. The handshake and the
-    /// report are observations: reading them never resets the idle clock.
-    async fn read_idle_report(
-        &self,
-        universe_id: uuid::Uuid,
-        environment: &EnvironmentRecord,
-    ) -> Result<GetIdleResponse, IdleReportFailure> {
-        let endpoint = self
-            .environment_gateway
-            .endpoint_for(universe_id, environment);
-        let options = self
-            .environment_gateway
-            .connect_options(POWER_REAPER_CLIENT)
-            .with_request_timeout(IDLE_REPORT_TIMEOUT);
-        let failure = |error: &ClientError| match error {
-            ClientError::ConnectTimeout { .. } | ClientError::DeadlineExceeded { .. } => {
-                IdleReportFailure::TimedOut
-            }
-            _ => IdleReportFailure::Unavailable,
-        };
-        let (client, _) = DataClient::connect_initialized(&endpoint, options)
-            .await
-            .map_err(|error| failure(&error))?;
-        let report = client.get_idle(&GetIdleParams {}).await;
-        let _ = client.close().await;
-        report.map_err(|error| failure(&error))
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use std::collections::BTreeMap;
-
-    use ::environments::{
-        EnvironmentIdlePolicy, EnvironmentIncarnationId, EnvironmentIncarnationRecord,
-        EnvironmentProviderBindingId, EnvironmentProviderId, EnvironmentProvisionRequestId,
-        EnvironmentSource, EnvironmentStatus, EnvironmentTemplateId,
-    };
-
-    use super::*;
-
-    fn environment(
-        policy: EnvironmentIdlePolicy,
-        power_states: Vec<PowerState>,
-    ) -> EnvironmentRecord {
-        EnvironmentRecord {
-            environment_id: ::environments::EnvironmentId::new("environment-1"),
-            request_id: EnvironmentProvisionRequestId::new("request-1"),
-            source: EnvironmentSource::Provisioned {
-                provider_id: EnvironmentProviderId::new("incus"),
-                binding_id: EnvironmentProviderBindingId::new("primary"),
-            },
-            display_name: None,
-            status: EnvironmentStatus::Ready,
-            desired_power: PowerState::Running,
-            idle_policy: Some(policy),
-            incarnation: EnvironmentIncarnationRecord {
-                incarnation_id: EnvironmentIncarnationId::new("incarnation-1"),
-                provision_request_id: Some(EnvironmentProvisionRequestId::new("request-1")),
-                provider_target_id: Some(
-                    environment_protocol::ids::ProviderTargetId::new("target-1").unwrap(),
-                ),
-                template_id: Some(EnvironmentTemplateId::new("dev")),
-                adoption_source_target: None,
-                power_states,
-                created_at_ms: 1,
-                updated_at_ms: 1,
-            },
-            public_ingress_enabled: false,
-            public_endpoint: None,
-            metadata: BTreeMap::new(),
-            last_seen_at_ms: None,
-            lifecycle_error: None,
-            created_at_ms: 1,
-            updated_at_ms: 1,
-        }
-    }
-
-    fn report(idle_for_ms: u64, running_processes: u32, running_jobs: u32) -> GetIdleResponse {
-        GetIdleResponse {
-            idle_for_ms,
-            running_process_count: running_processes,
-            running_job_count: running_jobs,
-            leftover_process_group_count: 0,
-        }
-    }
-
-    #[test]
-    fn idle_decision_respects_work_pending_power_and_provider_support() {
-        let policy = EnvironmentIdlePolicy {
-            pause_after_ms: Some(1_000),
-            suspend_after_ms: Some(2_000),
-            stop_after_ms: Some(3_000),
-            close_after_ms: Some(4_000),
-        };
-        let incus = vec![PowerState::Running, PowerState::Paused, PowerState::Stopped];
-        let env = environment(policy.clone(), incus.clone());
-        assert_eq!(decide_idle_action(&env, &report(500, 0, 0)), None);
-        assert_eq!(
-            decide_idle_action(&env, &report(1_500, 0, 0)),
-            Some(IdleAction::Pause)
-        );
-        // Running work blocks every stage regardless of the clock.
-        assert_eq!(decide_idle_action(&env, &report(10_000, 1, 0)), None);
-        // Leftover process groups are services left behind, not running work.
-        let mut leftovers = report(1_500, 0, 0);
-        leftovers.leftover_process_group_count = 3;
-        assert_eq!(
-            decide_idle_action(&env, &leftovers),
-            Some(IdleAction::Pause)
-        );
-        assert_eq!(decide_idle_action(&env, &report(10_000, 0, 2)), None);
-        // Suspend is due but unsupported by Incus: pause remains.
-        assert_eq!(
-            decide_idle_action(&env, &report(2_500, 0, 0)),
-            Some(IdleAction::Pause)
-        );
-        assert_eq!(
-            decide_idle_action(&env, &report(3_500, 0, 0)),
-            Some(IdleAction::Stop)
-        );
-        assert_eq!(
-            decide_idle_action(&env, &report(4_500, 0, 0)),
-            Some(IdleAction::Close)
-        );
-        // A Firecracker-shaped provider gets suspend.
-        let firecracker = environment(policy.clone(), PowerState::ALL.to_vec());
-        assert_eq!(
-            decide_idle_action(&firecracker, &report(2_500, 0, 0)),
-            Some(IdleAction::Suspend)
-        );
-        // A pending power change is left to the reconciler.
-        let mut pending = environment(policy, incus);
-        pending.desired_power = PowerState::Paused;
-        assert_eq!(decide_idle_action(&pending, &report(10_000, 0, 0)), None);
-        // No power control at all: only close can ever apply.
-        let bare = environment(
-            EnvironmentIdlePolicy {
-                pause_after_ms: Some(1_000),
-                ..EnvironmentIdlePolicy::default()
-            },
-            Vec::new(),
-        );
-        assert_eq!(decide_idle_action(&bare, &report(10_000, 0, 0)), None);
-    }
-}
diff --git a/crates/temporal-runtime/src/environments/provider_controllers.rs b/crates/temporal-runtime/src/environments/provider_controllers.rs
index d9050e271..fa6be3d32 100644
--- a/crates/temporal-runtime/src/environments/provider_controllers.rs
+++ b/crates/temporal-runtime/src/environments/provider_controllers.rs
@@ -1,48 +1,49 @@
-//! Provider controllers: dialing a provider's controller with its
-//! credential, recording what its `initialize` advertises, and classifying
-//! what goes wrong.
+//! Provider controllers: dialing a provider's controller, with its bearer
+//! credential when one is stored, and classifying what goes wrong.
 //!
-//! Every connection runs the controller handshake through
-//! [`ControllerClient::connect_initialized`]. At each successful handshake
-//! the advertised `routes.data` passes the downgrade rule and, together with
-//! the optional features, is recorded on the provider record; the gateway's
-//! provider data proxy and the reconciler's data-plane handshake build
-//! every target's data route from that recorded base, never from the
-//! controller URL.
+//! Nothing a controller advertises is stored. Every connection runs the
+//! controller handshake through [`ControllerClient::connect_initialized`],
+//! and its live `capabilities` gate the optional calls on that connection.
+//! The data route base is configuration: the provider record's configured
+//! base, or the one derived from its controller endpoint
+//! ([`EnvironmentProviderRecord::effective_data_route_base`]).
 
 use super::*;
 
 use ::environments::{
-    ControllerFeatures, EndpointScheme, EnvironmentEndpoint, EnvironmentProviderId,
-    EnvironmentProviderStore, EnvironmentRegistryError, ListEnvironmentProviders,
-    RecordProviderController,
+    EnvironmentEndpoint, EnvironmentProviderId, EnvironmentProviderRecord,
+    EnvironmentProviderStore, EnvironmentRegistryError,
 };
 use async_trait::async_trait;
 use auth::SecretValue;
 use environment_client::{ClientError, ConnectOptions, ControllerClient};
 use environment_protocol::{
-    control::handshake::ControllerInitializeResponse,
-    error::{ErrorData, PreconditionReason, ProtocolErrorKind},
-    routes::{DataRouteBase, UrlError},
-};
-use std::{
-    collections::HashMap,
-    time::{Duration, Instant},
+    control::handshake::ControllerCapabilities, error::ProtocolErrorKind, routes::DataRouteBase,
 };
+use std::time::Duration;
 use thiserror::Error;
 
-/// Deadline of every controller call. Controllers answer target methods
-/// promptly and continue slow work in the background, so this bounds a
-/// hung controller, not a slow create.
-pub(crate) const CONTROLLER_REQUEST_TIMEOUT: Duration = Duration::from_secs(120);
+/// Deadline of every reconciler controller call. Controllers answer target
+/// methods promptly and continue slow work in the background, so this
+/// bounds a hung controller, not a slow create; it is short because a hung
+/// call holds one of the provider's in-flight rows until it expires.
+pub(crate) const CONTROLLER_REQUEST_TIMEOUT: Duration = Duration::from_secs(30);
+
+/// Deadline of the synchronous power and ingress calls an API request
+/// waits on.
+pub(crate) const PASS_THROUGH_TIMEOUT: Duration = Duration::from_secs(30);
 
 /// Options for one controller or provider data-route connection: the
-/// provider credential as the bearer token, the default connect and
-/// `initialize` bounds, and [`CONTROLLER_REQUEST_TIMEOUT`] on every call.
-pub(crate) fn provider_connect_options(credential: &SecretValue) -> ConnectOptions {
-    ConnectOptions::new(super::gateway::runtime_client_info())
-        .with_bearer_token(credential.expose())
-        .with_request_timeout(CONTROLLER_REQUEST_TIMEOUT)
+/// provider credential as the bearer token when one is stored (no
+/// `Authorization` header otherwise), the default connect and `initialize`
+/// bounds, and [`CONTROLLER_REQUEST_TIMEOUT`] on every call.
+pub(crate) fn provider_connect_options(credential: Option<&SecretValue>) -> ConnectOptions {
+    let options = ConnectOptions::new(super::gateway::runtime_client_info())
+        .with_request_timeout(CONTROLLER_REQUEST_TIMEOUT);
+    match credential {
+        Some(credential) => options.with_bearer_token(credential.expose()),
+        None => options,
+    }
 }
 
 /// Dials a provider controller and runs its handshake. Tests substitute an
@@ -74,67 +75,48 @@ impl ProviderControllerConnector for WebSocketProviderControllerConnector {
     }
 }
 
-/// The facts a controller's `initialize` advertises, checked: the data
-/// route base must not downgrade a `wss` controller to `ws`. A controller
-/// on a Unix socket is local, so any base passes.
-pub(crate) fn controller_facts(
-    endpoint: &EnvironmentEndpoint,
-    initialize: &ControllerInitializeResponse,
-) -> Result<(ControllerFeatures, DataRouteBase), UrlError> {
-    if endpoint.scheme() != EndpointScheme::Unix {
-        initialize
-            .routes
-            .data
-            .check_for_controller(endpoint.as_str())?;
-    }
-    Ok((
-        ControllerFeatures {
-            adopt_target: initialize.capabilities.adopt_target,
-            ingress: initialize.capabilities.ingress,
-        },
-        initialize.routes.data.clone(),
-    ))
-}
-
-/// An optional controller feature the runtime gates calls on.
+/// An optional controller capability the runtime gates calls on.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub(crate) enum ControllerFeature {
-    AdoptTarget,
+    Power,
     Ingress,
 }
 
 impl ControllerFeature {
     pub(crate) fn as_str(self) -> &'static str {
         match self {
-            Self::AdoptTarget => "target adoption",
+            Self::Power => "power control",
             Self::Ingress => "public ingress",
         }
     }
 
-    pub(crate) fn in_features(self, features: &ControllerFeatures) -> bool {
+    pub(crate) fn in_capabilities(self, capabilities: &ControllerCapabilities) -> bool {
         match self {
-            Self::AdoptTarget => features.adopt_target,
-            Self::Ingress => features.ingress,
+            Self::Power => capabilities.power,
+            Self::Ingress => capabilities.ingress,
         }
     }
 }
 
-/// One initialized controller connection and what its handshake advertised.
+/// One initialized controller connection, what its handshake advertised,
+/// and what its data routes need.
 #[derive(Clone)]
 pub(crate) struct ProviderController {
     pub(crate) provider_id: EnvironmentProviderId,
     pub(crate) client: ControllerClient,
-    pub(crate) features: ControllerFeatures,
+    /// The live `initialize` capabilities of this connection.
+    pub(crate) capabilities: ControllerCapabilities,
+    /// The effective data route base.
     pub(crate) data_route_base: DataRouteBase,
     /// The provider credential, presented on its data routes too.
-    pub(crate) credential: SecretValue,
+    pub(crate) credential: Option<SecretValue>,
 }
 
 impl ProviderController {
-    /// Refuse a call that needs an optional feature the controller did not
-    /// advertise, before anything is sent.
+    /// Refuse a call that needs an optional capability the controller did
+    /// not advertise, before anything is sent.
     pub(crate) fn require(&self, feature: ControllerFeature) -> Result<(), ControllerError> {
-        if feature.in_features(&self.features) {
+        if feature.in_capabilities(&self.capabilities) {
             Ok(())
         } else {
             Err(ControllerError::FeatureUnavailable {
@@ -157,86 +139,52 @@ impl ProviderController {
     }
 }
 
-/// Connect to a provider's controller with its stored credential, check the
-/// advertised facts and record them on the provider record when they
-/// changed.
+/// Connect to a provider's controller with its stored credential, if any.
 pub(crate) async fn connect_provider_controller(
     store: &dyn EnvironmentProviderStore,
     connector: &dyn ProviderControllerConnector,
     provider_id: &EnvironmentProviderId,
 ) -> Result<ProviderController, ControllerError> {
-    let provider = store.read_provider(provider_id).await?;
+    let provider: EnvironmentProviderRecord = store.read_provider(provider_id).await?;
+    let data_route_base = provider.effective_data_route_base()?;
     let credential = store.read_provider_credential(provider_id).await?;
     let client = connector
         .connect(
             &provider.controller_endpoint,
-            provider_connect_options(&credential),
+            provider_connect_options(credential.as_ref()),
         )
         .await
         .map_err(|source| ControllerError::Connect {
             provider_id: provider_id.to_string(),
             source,
         })?;
-    let (features, data_route_base) =
-        match controller_facts(&provider.controller_endpoint, client.initialize_response()) {
-            Ok(facts) => facts,
-            Err(source) => {
-                let _ = client.close().await;
-                return Err(ControllerError::Routes {
-                    provider_id: provider_id.to_string(),
-                    source,
-                });
-            }
-        };
-    if provider.controller_features != Some(features)
-        || provider.data_route_base.as_ref() != Some(&data_route_base)
-    {
-        let recorded = store
-            .record_provider_controller(RecordProviderController {
-                provider_id: provider_id.clone(),
-                controller_endpoint: provider.controller_endpoint.clone(),
-                features,
-                data_route_base: data_route_base.clone(),
-            })
-            .await;
-        if let Err(error) = recorded {
-            let _ = client.close().await;
-            return Err(error.into());
-        }
-    }
     Ok(ProviderController {
         provider_id: provider_id.clone(),
+        capabilities: client.initialize_response().capabilities.clone(),
         client,
-        features,
         data_route_base,
         credential,
     })
 }
 
-/// Check a controller endpoint at provider registration. A controller that
-/// answers definitively wrong (an HTTP refusal such as 404 for a URL that
-/// names no controller or 401 for a wrong credential, another plane, or a
-/// data route base that fails the downgrade rule) is refused, so a
-/// mis-registered provider never provisions anything. One that cannot be
-/// reached right now is accepted; its facts are recorded at the first
-/// successful handshake.
+/// Check a controller endpoint at provider registration, with the
+/// credential the provider will hold. A controller that answers
+/// definitively wrong (an HTTP refusal such as 404 for a URL that names no
+/// controller or 401 for a wrong or missing credential, or another plane)
+/// is refused, so a mis-registered provider never provisions anything. One
+/// that cannot be reached right now is accepted.
 pub(crate) async fn probe_controller(
     connector: &dyn ProviderControllerConnector,
     endpoint: &EnvironmentEndpoint,
-    credential: &SecretValue,
-) -> Result<Option<(ControllerFeatures, DataRouteBase)>, AgentApiError> {
+    credential: Option<&SecretValue>,
+) -> Result<(), AgentApiError> {
     match connector
         .connect(endpoint, provider_connect_options(credential))
         .await
     {
         Ok(client) => {
-            let facts = controller_facts(endpoint, client.initialize_response());
             let _ = client.close().await;
-            facts.map(Some).map_err(|error| {
-                AgentApiError::invalid_request(format!(
-                    "the provider controller advertised an unusable data route: {error}"
-                ))
-            })
+            Ok(())
         }
         Err(error) if refuses_registration(&error) => Err(AgentApiError::invalid_request(format!(
             "the provider controller at {endpoint} refused the handshake: {error}"
@@ -246,9 +194,9 @@ pub(crate) async fn probe_controller(
                 target: "temporal_runtime",
                 %endpoint,
                 %error,
-                "provider controller is not reachable at registration; its features are recorded at the first successful handshake"
+                "provider controller is not reachable at registration; it is registered anyway"
             );
-            Ok(None)
+            Ok(())
         }
     }
 }
@@ -257,7 +205,7 @@ pub(crate) async fn probe_controller(
 /// controller temporarily unavailable.
 fn refuses_registration(error: &ClientError) -> bool {
     match error {
-        ClientError::UpgradeRejected { status } => {
+        ClientError::UpgradeRejected { status, .. } => {
             (400..500).contains(status) && !matches!(status, 408 | 429)
         }
         ClientError::WrongPlane { .. } | ClientError::Configuration { .. } => true,
@@ -268,8 +216,8 @@ fn refuses_registration(error: &ClientError) -> bool {
 /// How the reconciler treats a failed controller interaction.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub(crate) enum ControllerDisposition {
-    /// May succeed later unchanged: keep the status, record the error and
-    /// retry next pass, until the provisioning deadline.
+    /// May succeed later unchanged: back off and retry, until the
+    /// provisioning deadline.
     Transient,
     /// The provider refused the request; repeating it cannot help.
     Refused,
@@ -289,15 +237,6 @@ pub(crate) enum ControllerError {
         source: ClientError,
     },
 
-    /// The controller advertised a data route base that fails the
-    /// downgrade rule; treated like a failed `initialize`.
-    #[error("provider controller {provider_id} advertised an unusable data route: {source}")]
-    Routes {
-        provider_id: String,
-        #[source]
-        source: UrlError,
-    },
-
     /// A call on an initialized connection failed.
     #[error("provider controller {provider_id}: {source}")]
     Call {
@@ -306,7 +245,7 @@ pub(crate) enum ControllerError {
         source: ClientError,
     },
 
-    /// The call needs an optional feature the controller did not
+    /// The call needs an optional capability the controller did not
     /// advertise; nothing was sent.
     #[error("provider {provider_id} does not offer {}", feature.as_str())]
     FeatureUnavailable {
@@ -314,14 +253,6 @@ pub(crate) enum ControllerError {
         feature: ControllerFeature,
     },
 
-    /// An earlier failure in this reconcile pass marked the provider
-    /// unhealthy; its remaining environments are not attempted.
-    #[error("provider controller {provider_id} is skipped for this pass: {message}")]
-    Skipped {
-        provider_id: String,
-        message: String,
-    },
-
     #[error(transparent)]
     Registry(#[from] EnvironmentRegistryError),
 }
@@ -335,50 +266,7 @@ impl ControllerError {
         match self {
             Self::Call { source, .. } => call_disposition(source),
             Self::FeatureUnavailable { .. } => ControllerDisposition::Refused,
-            Self::Connect { .. } | Self::Routes { .. } | Self::Skipped { .. } => {
-                ControllerDisposition::Transient
-            }
-            Self::Registry(_) => ControllerDisposition::Transient,
-        }
-    }
-
-    /// True when the controller connection itself failed (a dial, a
-    /// deadline, a dropped socket): the provider's remaining environments
-    /// are skipped for the rest of the pass, so one hung provider costs one
-    /// deadline per pass instead of one per environment.
-    pub(crate) fn is_connection_failure(&self) -> bool {
-        match self {
-            Self::Connect { .. } | Self::Routes { .. } | Self::Skipped { .. } => true,
-            Self::Call { source, .. } => !matches!(
-                source,
-                ClientError::Protocol(_) | ClientError::Decode(_) | ClientError::Encode(_)
-            ),
-            Self::FeatureUnavailable { .. } | Self::Registry(_) => false,
-        }
-    }
-
-    /// The precondition a refusal named, if any.
-    pub(crate) fn precondition(&self) -> Option<PreconditionReason> {
-        match self {
-            Self::Call {
-                source: ClientError::Protocol(error),
-                ..
-            } => match error.data {
-                ErrorData::FailedPrecondition { reason } => Some(reason),
-                _ => None,
-            },
-            _ => None,
-        }
-    }
-
-    pub(crate) fn provider_id(&self) -> Option<&str> {
-        match self {
-            Self::Connect { provider_id, .. }
-            | Self::Routes { provider_id, .. }
-            | Self::Call { provider_id, .. }
-            | Self::FeatureUnavailable { provider_id, .. }
-            | Self::Skipped { provider_id, .. } => Some(provider_id),
-            Self::Registry(_) => None,
+            Self::Connect { .. } | Self::Registry(_) => ControllerDisposition::Transient,
         }
     }
 
@@ -408,167 +296,6 @@ pub(crate) fn call_disposition(error: &ClientError) -> ControllerDisposition {
     }
 }
 
-/// The controllers one reconcile pass talks to: each provider is dialed at
-/// most once per pass, and a provider whose connection failed is skipped
-/// for the rest of the pass.
-#[derive(Default)]
-pub(crate) struct ProviderPass {
-    controllers: HashMap<EnvironmentProviderId, PassController>,
-}
-
-enum PassController {
-    Connected(ProviderController),
-    Unhealthy(String),
-}
-
-impl ProviderPass {
-    pub(crate) async fn controller(
-        &mut self,
-        store: &dyn EnvironmentProviderStore,
-        connector: &dyn ProviderControllerConnector,
-        provider_id: &EnvironmentProviderId,
-    ) -> Result<ProviderController, ControllerError> {
-        match self.controllers.get(provider_id) {
-            Some(PassController::Connected(controller)) => return Ok(controller.clone()),
-            Some(PassController::Unhealthy(message)) => {
-                return Err(ControllerError::Skipped {
-                    provider_id: provider_id.to_string(),
-                    message: message.clone(),
-                });
-            }
-            None => {}
-        }
-        match connect_provider_controller(store, connector, provider_id).await {
-            Ok(controller) => {
-                self.controllers.insert(
-                    provider_id.clone(),
-                    PassController::Connected(controller.clone()),
-                );
-                Ok(controller)
-            }
-            Err(error) => {
-                if error.is_connection_failure() {
-                    self.controllers.insert(
-                        provider_id.clone(),
-                        PassController::Unhealthy(error.to_string()),
-                    );
-                }
-                Err(error)
-            }
-        }
-    }
-
-    /// Record a failure of `error`'s provider: a connection failure skips
-    /// the provider for the rest of the pass.
-    pub(crate) async fn observe_failure(&mut self, error: &ControllerError) {
-        if !error.is_connection_failure() {
-            return;
-        }
-        let Some(provider_id) = error.provider_id() else {
-            return;
-        };
-        let Ok(provider_id) = EnvironmentProviderId::try_new(provider_id) else {
-            return;
-        };
-        if let Some(PassController::Connected(controller)) = self
-            .controllers
-            .insert(provider_id, PassController::Unhealthy(error.to_string()))
-        {
-            controller.close().await;
-        }
-    }
-
-    pub(crate) async fn close(self) {
-        for controller in self.controllers.into_values() {
-            if let PassController::Connected(controller) = controller {
-                controller.close().await;
-            }
-        }
-    }
-}
-
-/// Dials providers whose controller facts are not recorded yet (never
-/// reached, or their endpoint changed and the registration probe could not
-/// reach the new one), so the gateway's data proxy gets a data route base
-/// even when none of the provider's environments needs convergence. Failed
-/// attempts back off per provider.
-#[derive(Default)]
-pub(crate) struct ProviderFactsRefresh {
-    listed_at: Option<Instant>,
-    retry: HashMap<EnvironmentProviderId, (Instant, Duration)>,
-}
-
-impl ProviderFactsRefresh {
-    /// How often the provider list is read.
-    const LIST_INTERVAL: Duration = Duration::from_secs(5);
-    const FIRST_RETRY: Duration = Duration::from_secs(5);
-    const MAX_RETRY: Duration = Duration::from_secs(300);
-
-    /// One refresh step of a deployment pass; connections stay in `pass`.
-    pub(crate) async fn run(
-        &mut self,
-        pass: &mut ProviderPass,
-        store: &dyn EnvironmentProviderStore,
-        connector: &dyn ProviderControllerConnector,
-    ) {
-        let now = Instant::now();
-        if self
-            .listed_at
-            .is_some_and(|listed| now.duration_since(listed) < Self::LIST_INTERVAL)
-        {
-            return;
-        }
-        self.listed_at = Some(now);
-        let providers = match store
-            .list_providers(ListEnvironmentProviders::default())
-            .await
-        {
-            Ok(providers) => providers,
-            Err(error) => {
-                tracing::warn!(target: "temporal_runtime", %error, "listing providers for a controller handshake failed");
-                return;
-            }
-        };
-        let unrecorded: Vec<EnvironmentProviderId> = providers
-            .into_iter()
-            .filter(|provider| provider.data_route_base.is_none())
-            .map(|provider| provider.provider_id)
-            .collect();
-        self.retry
-            .retain(|provider_id, _| unrecorded.contains(provider_id));
-        for provider_id in unrecorded {
-            if self
-                .retry
-                .get(&provider_id)
-                .is_some_and(|(next, _)| now < *next)
-            {
-                continue;
-            }
-            match pass.controller(store, connector, &provider_id).await {
-                Ok(_) => {
-                    self.retry.remove(&provider_id);
-                }
-                Err(error) => {
-                    let backoff = self
-                        .retry
-                        .get(&provider_id)
-                        .map_or(Self::FIRST_RETRY, |(_, backoff)| {
-                            (*backoff * 2).min(Self::MAX_RETRY)
-                        });
-                    tracing::debug!(
-                        target: "temporal_runtime",
-                        %provider_id,
-                        %error,
-                        retry_in_s = backoff.as_secs(),
-                        "provider controller handshake failed; its data route base stays unrecorded"
-                    );
-                    self.retry.insert(provider_id, (now + backoff, backoff));
-                }
-            }
-        }
-    }
-}
-
 impl EnvironmentService {
     /// A controller connection for one API request; the caller closes it.
     pub(crate) async fn connect_provider_controller(
@@ -582,63 +309,16 @@ impl EnvironmentService {
         )
         .await
     }
-
-    /// Refuse an API request that needs an optional controller feature the
-    /// provider does not offer. Features recorded at the last handshake
-    /// decide; a provider not reached yet is dialed once to learn them.
-    pub(crate) async fn require_controller_feature(
-        &self,
-        provider_id: &EnvironmentProviderId,
-        feature: ControllerFeature,
-    ) -> Result<(), AgentApiError> {
-        let provider = self.read_environment_provider(provider_id).await?;
-        let features = match provider.controller_features {
-            Some(features) => features,
-            None => {
-                let controller = self
-                    .connect_provider_controller(provider_id)
-                    .await
-                    .map_err(ControllerError::into_api_error)?;
-                controller.close().await;
-                controller.features
-            }
-        };
-        if feature.in_features(&features) {
-            Ok(())
-        } else {
-            Err(AgentApiError::rejected(format!(
-                "provider {provider_id} does not offer {}",
-                feature.as_str()
-            )))
-        }
-    }
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
     use environment_protocol::{
-        CONTROLLER_PROTOCOL_VERSION,
-        control::handshake::{ControllerCapabilities, ControllerRoutes},
-        error::ProtocolError,
-        handshake::{ImplementationInfo, Plane},
+        error::{PreconditionReason, ProtocolError},
+        handshake::Plane,
     };
 
-    fn initialize(data: &str) -> ControllerInitializeResponse {
-        ControllerInitializeResponse {
-            protocol_version: CONTROLLER_PROTOCOL_VERSION,
-            plane: Plane::Controller,
-            server_info: ImplementationInfo::new("controller").unwrap(),
-            capabilities: ControllerCapabilities {
-                adopt_target: true,
-                ingress: false,
-            },
-            routes: ControllerRoutes {
-                data: DataRouteBase::new(data).unwrap(),
-            },
-        }
-    }
-
     fn call(source: ClientError) -> ControllerError {
         ControllerError::Call {
             provider_id: "provider".into(),
@@ -672,10 +352,14 @@ mod tests {
         for source in [
             ClientError::VersionMismatch {
                 plane: Plane::Controller,
-                local: 3,
-                remote: 4,
+                local: 4,
+                remote: 5,
+            },
+            ClientError::UpgradeRejected {
+                status: 404,
+                refusal: None,
+                retry_after_ms: None,
             },
-            ClientError::UpgradeRejected { status: 404 },
             ClientError::ConnectTimeout {
                 endpoint: "ws://provider".into(),
             },
@@ -685,7 +369,6 @@ mod tests {
                 source,
             };
             assert_eq!(error.disposition(), ControllerDisposition::Transient);
-            assert!(error.is_connection_failure());
         }
     }
 
@@ -696,28 +379,29 @@ mod tests {
             "deprecated",
         )));
         assert_eq!(refused.disposition(), ControllerDisposition::Refused);
-        assert_eq!(
-            refused.precondition(),
-            Some(PreconditionReason::TemplateDeprecated)
-        );
-        assert!(!refused.is_connection_failure());
         let gone = call(ClientError::Protocol(ProtocolError::not_found("no target")));
         assert_eq!(gone.disposition(), ControllerDisposition::Gone);
         let unadvertised = ControllerError::FeatureUnavailable {
             provider_id: "provider".into(),
-            feature: ControllerFeature::AdoptTarget,
+            feature: ControllerFeature::Power,
         };
         assert_eq!(unadvertised.disposition(), ControllerDisposition::Refused);
-        // A deadline or a dropped socket skips the provider for the pass.
-        assert!(call(ClientError::DeadlineExceeded { elapsed_ms: 1 }).is_connection_failure());
-        assert!(!call(ClientError::Decode("bad".into())).is_connection_failure());
+        assert_eq!(
+            unadvertised.into_api_error().kind,
+            api::AgentApiErrorKind::Rejected
+        );
     }
 
     #[test]
     fn registration_refuses_only_definitive_handshake_failures() {
+        let rejected = |status| ClientError::UpgradeRejected {
+            status,
+            refusal: None,
+            retry_after_ms: None,
+        };
         for refused in [
-            ClientError::UpgradeRejected { status: 404 },
-            ClientError::UpgradeRejected { status: 401 },
+            rejected(404),
+            rejected(401),
             ClientError::WrongPlane {
                 expected: Plane::Controller,
                 actual: Plane::Data,
@@ -726,47 +410,38 @@ mod tests {
             assert!(refuses_registration(&refused), "{refused}");
         }
         for accepted in [
-            ClientError::UpgradeRejected { status: 503 },
-            ClientError::UpgradeRejected { status: 429 },
+            rejected(503),
+            rejected(429),
             ClientError::Connect {
                 endpoint: "ws://provider".into(),
                 message: "refused".into(),
             },
             ClientError::VersionMismatch {
                 plane: Plane::Controller,
-                local: 3,
-                remote: 4,
+                local: 4,
+                remote: 5,
             },
         ] {
             assert!(!refuses_registration(&accepted), "{accepted}");
         }
     }
 
-    /// A connector whose every dial fails, counting the attempts.
-    #[derive(Default)]
-    struct UnreachableConnector {
-        attempts: std::sync::atomic::AtomicUsize,
-    }
-
-    #[async_trait]
-    impl ProviderControllerConnector for UnreachableConnector {
-        async fn connect(
-            &self,
-            endpoint: &EnvironmentEndpoint,
-            _options: ConnectOptions,
-        ) -> Result<ControllerClient, ClientError> {
-            self.attempts
-                .fetch_add(1, std::sync::atomic::Ordering::SeqCst);
-            Err(ClientError::Connect {
-                endpoint: endpoint.to_string(),
-                message: "refused".into(),
-            })
-        }
+    #[test]
+    fn the_bearer_is_sent_only_with_a_credential() {
+        assert!(provider_connect_options(None).bearer_token.is_none());
+        let credential = SecretValue::new("provider-credential");
+        assert_eq!(
+            provider_connect_options(Some(&credential))
+                .bearer_token
+                .as_ref()
+                .map(|token| token.expose()),
+            Some("provider-credential")
+        );
     }
 
     async fn provider_store(
         endpoint: &str,
-        credential: &str,
+        credential: Option<&str>,
     ) -> ::environments::InMemoryEnvironmentRegistryStore {
         let store = ::environments::InMemoryEnvironmentRegistryStore::new();
         store
@@ -774,8 +449,13 @@ mod tests {
                 provider_id: EnvironmentProviderId::new("provider"),
                 display_name: None,
                 controller_endpoint: EnvironmentEndpoint::parse(endpoint).unwrap(),
-                metadata: Default::default(),
-                credential: Some(SecretValue::new(credential)),
+                data_route_base: None,
+                credential: match credential {
+                    Some(credential) => {
+                        ::environments::ProviderCredentialChange::Set(SecretValue::new(credential))
+                    }
+                    None => ::environments::ProviderCredentialChange::Keep,
+                },
                 updated_at_ms: 1,
             })
             .await
@@ -784,68 +464,70 @@ mod tests {
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn the_refresh_records_facts_of_a_provider_never_reached() {
-        let controller = crate::environments::fake_controller::FakeController::start()
-            .await
-            .unwrap();
+    async fn a_connection_carries_live_capabilities_and_the_derived_data_route() {
+        let controller = crate::environments::fake_controller::FakeController::start_with(
+            crate::environments::fake_controller::FakeControllerOptions {
+                power: false,
+                ..Default::default()
+            },
+        )
+        .await
+        .unwrap();
         let store = provider_store(controller.controller_url(), controller.credential()).await;
-        let provider_id = EnvironmentProviderId::new("provider");
+        let connected = connect_provider_controller(
+            &store,
+            &WebSocketProviderControllerConnector,
+            &EnvironmentProviderId::new("provider"),
+        )
+        .await
+        .expect("connect");
+        assert!(!connected.capabilities.power && connected.capabilities.ingress);
+        assert!(matches!(
+            connected.require(ControllerFeature::Power),
+            Err(ControllerError::FeatureUnavailable { .. })
+        ));
         assert!(
-            store
-                .read_provider(&provider_id)
-                .await
-                .unwrap()
+            connected
                 .data_route_base
-                .is_none()
+                .as_str()
+                .ends_with(environment_protocol::routes::DEFAULT_DATA_ROUTE_PATH)
         );
-        let mut pass = ProviderPass::default();
-        ProviderFactsRefresh::default()
-            .run(&mut pass, &store, &WebSocketProviderControllerConnector)
-            .await;
-        pass.close().await;
-        let provider = store.read_provider(&provider_id).await.unwrap();
-        assert!(provider.data_route_base.is_some());
-        assert!(provider.controller_features.is_some());
+        connected.close().await;
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn an_unreachable_provider_is_retried_with_backoff() {
-        let store = provider_store("ws://127.0.0.1:9/control", "credential").await;
-        let connector = UnreachableConnector::default();
-        let mut refresh = ProviderFactsRefresh::default();
-        let mut pass = ProviderPass::default();
-        refresh.run(&mut pass, &store, &connector).await;
-        assert_eq!(
-            connector.attempts.load(std::sync::atomic::Ordering::SeqCst),
-            1
-        );
-        // The next listing still finds it unrecorded, but its retry is not
-        // due yet.
-        refresh.listed_at = None;
-        let mut pass = ProviderPass::default();
-        refresh.run(&mut pass, &store, &connector).await;
-        assert_eq!(
-            connector.attempts.load(std::sync::atomic::Ordering::SeqCst),
-            1
-        );
-        let (_, backoff) = refresh.retry[&EnvironmentProviderId::new("provider")];
-        assert_eq!(backoff, ProviderFactsRefresh::FIRST_RETRY);
-    }
-
-    #[test]
-    fn controller_facts_enforce_the_downgrade_rule() {
-        let secure = EnvironmentEndpoint::parse("wss://provider.test/control").unwrap();
-        assert!(matches!(
-            controller_facts(&secure, &initialize("ws://provider.test/routes")),
-            Err(UrlError::Downgrade(_))
-        ));
-        let (features, base) =
-            controller_facts(&secure, &initialize("wss://provider.test/routes")).unwrap();
-        assert!(features.adopt_target && !features.ingress);
-        assert_eq!(base.as_str(), "wss://provider.test/routes");
-        let plain = EnvironmentEndpoint::parse("ws://127.0.0.1:9/control").unwrap();
-        assert!(controller_facts(&plain, &initialize("ws://127.0.0.1:9/routes")).is_ok());
-        let local = EnvironmentEndpoint::parse("unix:///run/provider.sock").unwrap();
-        assert!(controller_facts(&local, &initialize("ws://localhost/routes")).is_ok());
+    async fn a_provider_without_a_credential_connects_without_a_bearer() {
+        let controller = crate::environments::fake_controller::FakeController::start_with(
+            crate::environments::fake_controller::FakeControllerOptions {
+                credential: false,
+                ..Default::default()
+            },
+        )
+        .await
+        .unwrap();
+        assert!(controller.credential().is_none());
+        let store = provider_store(controller.controller_url(), None).await;
+        let connected = connect_provider_controller(
+            &store,
+            &WebSocketProviderControllerConnector,
+            &EnvironmentProviderId::new("provider"),
+        )
+        .await
+        .expect("connect without a credential");
+        assert!(connected.credential.is_none());
+        connected.close().await;
+        // A controller that requires a credential refuses a provider that
+        // has none, and registration says so.
+        let guarded = crate::environments::fake_controller::FakeController::start()
+            .await
+            .unwrap();
+        let refused = probe_controller(
+            &WebSocketProviderControllerConnector,
+            &EnvironmentEndpoint::parse(guarded.controller_url()).unwrap(),
+            None,
+        )
+        .await
+        .expect_err("a missing credential is a definitive refusal");
+        assert_eq!(refused.kind, api::AgentApiErrorKind::InvalidRequest);
     }
 }
diff --git a/crates/temporal-runtime/src/environments/providers.rs b/crates/temporal-runtime/src/environments/providers.rs
index 0e891459e..1a868fc7c 100644
--- a/crates/temporal-runtime/src/environments/providers.rs
+++ b/crates/temporal-runtime/src/environments/providers.rs
@@ -2,16 +2,14 @@ use super::provider_controllers::ControllerError;
 use super::*;
 
 use ::environments::{
-    EnvironmentProviderBindingId, EnvironmentProviderBindingRecord,
-    EnvironmentProviderBindingStatus, EnvironmentProviderId, EnvironmentProviderRecord,
-    EnvironmentRecord, EnvironmentRegistryError, EnvironmentSource, EnvironmentStatus,
+    DaemonBuild, EnvironmentCloseReason, EnvironmentDisplayStatus,
+    EnvironmentProviderBindingRecord, EnvironmentProviderId, EnvironmentProviderRecord,
+    EnvironmentRecord, EnvironmentRegistryError, EnvironmentSource, EnvironmentState, IdlePolicy,
+    ObservedTarget, PowerState, TargetPhase,
 };
 use environment_protocol::{
-    control::{
-        target::BindingRef,
-        template::{EnvironmentTemplate, ListTemplatesParams},
-    },
-    ids::{BindingId, UniverseId},
+    control::template::{EnvironmentTemplate, ListTemplatesParams},
+    ids::UniverseId,
 };
 
 impl EnvironmentService {
@@ -37,11 +35,11 @@ impl EnvironmentService {
         &self,
         params: EnvironmentProviderBindingReadParams,
     ) -> Result<EnvironmentProviderBindingReadResponse, AgentApiError> {
-        let binding_id = parse_environment_provider_binding_id(params.binding_id)?;
+        let provider_id = parse_environment_provider_id(params.provider_id)?;
         let record = ::environments::EnvironmentProviderBindingStore::read_provider_binding(
             self.store.as_ref(),
             self.store.config().universe_id,
-            &binding_id,
+            &provider_id,
         )
         .await
         .map_err(map_environments_error)?;
@@ -50,60 +48,62 @@ impl EnvironmentService {
         })
     }
 
+    /// Templates are listed live from every enabled binding's provider;
+    /// nothing about them is stored.
     pub(crate) async fn list_environment_template_records(
         &self,
         params: EnvironmentTemplateListParams,
     ) -> Result<EnvironmentTemplateListResponse, AgentApiError> {
-        let binding_filter = params
-            .binding_id
-            .map(parse_environment_provider_binding_id)
-            .transpose()?;
-        let bindings = if let Some(binding_id) = binding_filter {
-            vec![
+        let universe_id = self.store.config().universe_id;
+        let bindings = match params
+            .provider_id
+            .map(parse_environment_provider_id)
+            .transpose()?
+        {
+            Some(provider_id) => vec![
                 ::environments::EnvironmentProviderBindingStore::read_provider_binding(
                     self.store.as_ref(),
-                    self.store.config().universe_id,
-                    &binding_id,
+                    universe_id,
+                    &provider_id,
                 )
                 .await
                 .map_err(map_environments_error)?,
-            ]
-        } else {
-            ::environments::EnvironmentProviderBindingStore::list_provider_bindings(
+            ],
+            None => ::environments::EnvironmentProviderBindingStore::list_provider_bindings(
                 self.store.as_ref(),
-                self.store.config().universe_id,
+                universe_id,
             )
             .await
-            .map_err(map_environments_error)?
+            .map_err(map_environments_error)?,
         };
+        let universe = UniverseId::new(universe_id.to_string()).map_err(|error| {
+            AgentApiError::internal(format!(
+                "universe id does not fit the controller protocol: {error}"
+            ))
+        })?;
         let mut templates = Vec::new();
-        for binding in bindings
-            .into_iter()
-            .filter(|binding| binding.status == EnvironmentProviderBindingStatus::Enabled)
-        {
+        for binding in bindings.into_iter().filter(|binding| binding.enabled) {
             let controller = self
                 .connect_provider_controller(&binding.provider_id)
                 .await
                 .map_err(ControllerError::into_api_error)?;
-            let response = match binding_ref(&binding) {
-                Ok(binding) => controller
-                    .client
-                    .list_templates(&ListTemplatesParams { binding })
-                    .await
-                    .map_err(|error| controller.call_error(error).into_api_error()),
-                Err(error) => Err(error),
-            };
+            let response = controller
+                .client
+                .list_templates(&ListTemplatesParams {
+                    universe_id: universe.clone(),
+                })
+                .await
+                .map_err(|error| controller.call_error(error).into_api_error());
             controller.close().await;
-            let response = response?;
             templates.extend(
-                response
+                response?
                     .templates
                     .iter()
-                    .map(|template| environment_template_view(&binding, template)),
+                    .map(|template| environment_template_view(&binding.provider_id, template)),
             );
         }
         templates.sort_by(|left, right| {
-            (&left.binding_id, &left.template_id).cmp(&(&right.binding_id, &right.template_id))
+            (&left.provider_id, &left.template_id).cmp(&(&right.provider_id, &right.template_id))
         });
         Ok(EnvironmentTemplateListResponse { templates })
     }
@@ -115,7 +115,7 @@ impl EnvironmentService {
         let expected = params.template_id;
         let response = self
             .list_environment_template_records(EnvironmentTemplateListParams {
-                binding_id: Some(params.binding_id),
+                provider_id: Some(params.provider_id),
             })
             .await?;
         let template = response
@@ -127,30 +127,6 @@ impl EnvironmentService {
             })?;
         Ok(EnvironmentTemplateReadResponse { template })
     }
-
-    pub(crate) async fn read_environment_provider(
-        &self,
-        provider_id: &EnvironmentProviderId,
-    ) -> Result<EnvironmentProviderRecord, AgentApiError> {
-        ::environments::EnvironmentProviderStore::read_provider(self.store.as_ref(), provider_id)
-            .await
-            .map_err(map_environments_error)
-    }
-}
-
-/// The controller-plane reference to a binding.
-pub(crate) fn binding_ref(
-    record: &EnvironmentProviderBindingRecord,
-) -> Result<BindingRef, AgentApiError> {
-    let invalid = |error: environment_protocol::ids::IdError| {
-        AgentApiError::internal(format!(
-            "binding ids do not fit the controller protocol: {error}"
-        ))
-    };
-    Ok(BindingRef {
-        universe_id: UniverseId::new(record.universe_id.to_string()).map_err(invalid)?,
-        binding_id: BindingId::new(record.binding_id.as_str()).map_err(invalid)?,
-    })
 }
 
 pub(crate) fn parse_environment_provider_id(
@@ -160,43 +136,24 @@ pub(crate) fn parse_environment_provider_id(
         .map_err(|error| AgentApiError::invalid_request(format!("invalid provider id: {error}")))
 }
 
-pub(crate) fn parse_environment_provider_binding_id(
-    value: String,
-) -> Result<EnvironmentProviderBindingId, AgentApiError> {
-    EnvironmentProviderBindingId::try_new(value).map_err(|error| {
-        AgentApiError::invalid_request(format!("invalid provider binding id: {error}"))
-    })
-}
-
 pub(crate) fn environment_provider_binding_view(
     record: &EnvironmentProviderBindingRecord,
 ) -> EnvironmentProviderBindingView {
     EnvironmentProviderBindingView {
-        binding_id: record.binding_id.to_string(),
         provider_id: record.provider_id.to_string(),
-        status: match record.status {
-            EnvironmentProviderBindingStatus::Enabled => {
-                EnvironmentProviderBindingStatusView::Enabled
-            }
-            EnvironmentProviderBindingStatus::Disabled => {
-                EnvironmentProviderBindingStatusView::Disabled
-            }
-        },
-        revision: record.revision,
-        metadata: record.metadata.clone(),
+        enabled: record.enabled,
         created_at_ms: record.created_at_ms,
         updated_at_ms: record.updated_at_ms,
     }
 }
 
 pub(crate) fn environment_template_view(
-    binding: &EnvironmentProviderBindingRecord,
+    provider_id: &EnvironmentProviderId,
     template: &EnvironmentTemplate,
 ) -> EnvironmentTemplateView {
     EnvironmentTemplateView {
         template_id: template.template_id.to_string(),
-        provider_id: binding.provider_id.to_string(),
-        binding_id: binding.binding_id.to_string(),
+        provider_id: provider_id.to_string(),
         display_name: template.display_name.to_string(),
         description: template
             .description
@@ -212,6 +169,13 @@ pub(crate) fn environment_template_view(
                 memory_bytes: resources.memory_bytes,
                 disk_bytes: resources.disk_bytes,
             }),
+        power_states: template
+            .power_states
+            .iter()
+            .copied()
+            .map(power_state_view)
+            .collect(),
+        idle: template.idle.as_ref().map(idle_policy_view),
         metadata: template.metadata.as_map().clone(),
     }
 }
@@ -219,73 +183,66 @@ pub(crate) fn environment_template_view(
 pub(crate) fn environment_view(record: &EnvironmentRecord) -> EnvironmentView {
     EnvironmentView {
         environment_id: record.environment_id.to_string(),
-        request_id: record.request_id.to_string(),
+        request_id: record.request_id.as_ref().map(ToString::to_string),
         source: match &record.source {
-            EnvironmentSource::Provisioned {
-                provider_id,
-                binding_id,
-            } => EnvironmentSourceView::Provisioned {
-                provider_id: provider_id.to_string(),
-                binding_id: binding_id.to_string(),
+            EnvironmentSource::Provisioned(source) => EnvironmentSourceView::Provisioned {
+                provider_id: source.provider_id.to_string(),
+                template_id: source.template_id.to_string(),
+                target_id: source
+                    .provider_target_id
+                    .as_ref()
+                    .map(|target_id| target_id.as_str().to_owned()),
+                idle: source.idle.as_ref().map(idle_policy_view),
+                observed: source.observed.as_ref().map(observed_target_view),
+                public_endpoint: source.public_endpoint.clone(),
             },
             EnvironmentSource::External { endpoint } => EnvironmentSourceView::External {
                 endpoint: endpoint.as_str().to_owned(),
             },
-            EnvironmentSource::Registered {
-                registration_key_id,
-                daemon_id,
-                identity_mode,
-                ..
-            } => EnvironmentSourceView::Registered {
-                registration_key_id: registration_key_id.to_string(),
-                daemon_id: daemon_id.to_string(),
-                identity_mode: identity_mode_view(*identity_mode),
+            EnvironmentSource::Registered(source) => EnvironmentSourceView::Registered {
+                registration_key_id: source.registration_key_id.to_string(),
+                daemon_id: source.daemon_id().to_string(),
+                identity_mode: identity_mode_view(source.identity_mode),
+                connected: source.connected,
+                connection_changed_at_ms: source.connection_changed_at_ms,
+                last_seen_at_ms: source.last_seen_at_ms,
             },
         },
         display_name: record.display_name.clone(),
-        status: lifecycle_status_view(record.status),
-        desired_power: power_state_view(record.desired_power),
-        idle_policy: record.idle_policy.as_ref().map(idle_policy_view),
-        incarnation: EnvironmentIncarnationView {
-            incarnation_id: record.incarnation.incarnation_id.to_string(),
-            provision_request_id: record
-                .incarnation
-                .provision_request_id
-                .as_ref()
-                .map(ToString::to_string),
-            provider_target_id: record
-                .incarnation
-                .provider_target_id
-                .as_ref()
-                .map(ToString::to_string),
-            template_id: record
-                .incarnation
-                .template_id
-                .as_ref()
-                .map(ToString::to_string),
-            power_states: record
-                .incarnation
-                .power_states
-                .iter()
-                .copied()
-                .map(power_state_view)
-                .collect(),
-            created_at_ms: record.incarnation.created_at_ms,
-            updated_at_ms: record.incarnation.updated_at_ms,
-        },
-        public_ingress_enabled: record.public_ingress_enabled,
-        public_endpoint: record.public_endpoint.clone(),
+        state: state_view(record.state),
+        status: status_view(record.display_status()),
+        state_message: record.state_message.clone(),
+        close_reason: record.close_reason.map(close_reason_view),
+        state_changed_at_ms: record.state_changed_at_ms,
+        daemon: record.daemon_build.as_ref().map(daemon_view),
         metadata: record.metadata.clone(),
-        last_seen_at_ms: record.last_seen_at_ms,
-        lifecycle_error: record.lifecycle_error.as_ref().map(|error| {
-            EnvironmentLifecycleErrorView {
-                message: error.message.clone(),
-                first_at_ms: error.first_at_ms,
-                last_at_ms: error.last_at_ms,
-            }
-        }),
         created_at_ms: record.created_at_ms,
         updated_at_ms: record.updated_at_ms,
+        closed_at_ms: record.closed_at_ms,
+    }
+}
+
+fn observed_target_view(observed: &ObservedTarget) -> EnvironmentObservedTargetView {
+    EnvironmentObservedTargetView {
+        phase: match observed.phase {
+            TargetPhase::Provisioning => EnvironmentTargetPhaseView::Provisioning,
+            TargetPhase::Active => EnvironmentTargetPhaseView::Active,
+            TargetPhase::Closing => EnvironmentTargetPhaseView::Closing,
+            TargetPhase::Closed => EnvironmentTargetPhaseView::Closed,
+            TargetPhase::Failed => EnvironmentTargetPhaseView::Failed,
+            TargetPhase::Unknown => EnvironmentTargetPhaseView::Unknown,
+        },
+        power: observed.power.map(power_state_view),
+        message: observed.message.clone(),
+        observed_at_ms: observed.observed_at_ms,
+    }
+}
+
+fn daemon_view(build: &DaemonBuild) -> EnvironmentDaemonView {
+    EnvironmentDaemonView {
+        version: build.version.clone(),
+        git_sha: build.git_sha.clone(),
+        protocol_version: build.protocol_version,
     }
 }
 
@@ -315,27 +272,25 @@ pub(crate) fn registry_identity_mode(
     }
 }
 
-pub(crate) fn power_state_view(value: ::environments::PowerState) -> EnvironmentPowerStateView {
+pub(crate) fn power_state_view(value: PowerState) -> EnvironmentPowerStateView {
     match value {
-        ::environments::PowerState::Running => EnvironmentPowerStateView::Running,
-        ::environments::PowerState::Paused => EnvironmentPowerStateView::Paused,
-        ::environments::PowerState::Suspended => EnvironmentPowerStateView::Suspended,
-        ::environments::PowerState::Stopped => EnvironmentPowerStateView::Stopped,
+        PowerState::Running => EnvironmentPowerStateView::Running,
+        PowerState::Paused => EnvironmentPowerStateView::Paused,
+        PowerState::Suspended => EnvironmentPowerStateView::Suspended,
+        PowerState::Stopped => EnvironmentPowerStateView::Stopped,
     }
 }
 
-pub(crate) fn registry_power_state(value: EnvironmentPowerStateView) -> ::environments::PowerState {
+pub(crate) fn registry_power_state(value: EnvironmentPowerStateView) -> PowerState {
     match value {
-        EnvironmentPowerStateView::Running => ::environments::PowerState::Running,
-        EnvironmentPowerStateView::Paused => ::environments::PowerState::Paused,
-        EnvironmentPowerStateView::Suspended => ::environments::PowerState::Suspended,
-        EnvironmentPowerStateView::Stopped => ::environments::PowerState::Stopped,
+        EnvironmentPowerStateView::Running => PowerState::Running,
+        EnvironmentPowerStateView::Paused => PowerState::Paused,
+        EnvironmentPowerStateView::Suspended => PowerState::Suspended,
+        EnvironmentPowerStateView::Stopped => PowerState::Stopped,
     }
 }
 
-pub(crate) fn idle_policy_view(
-    value: &::environments::EnvironmentIdlePolicy,
-) -> EnvironmentIdlePolicyView {
+pub(crate) fn idle_policy_view(value: &IdlePolicy) -> EnvironmentIdlePolicyView {
     EnvironmentIdlePolicyView {
         pause_after_ms: value.pause_after_ms,
         suspend_after_ms: value.suspend_after_ms,
@@ -344,46 +299,89 @@ pub(crate) fn idle_policy_view(
     }
 }
 
+/// The idle policy a create-time override names, validated: Lightspeed
+/// passes it to the provider unchanged and never interprets it.
 pub(crate) fn registry_idle_policy(
     value: &EnvironmentIdlePolicyView,
-) -> ::environments::EnvironmentIdlePolicy {
-    ::environments::EnvironmentIdlePolicy {
+) -> Result<IdlePolicy, AgentApiError> {
+    let policy = IdlePolicy {
         pause_after_ms: value.pause_after_ms,
         suspend_after_ms: value.suspend_after_ms,
         stop_after_ms: value.stop_after_ms,
         close_after_ms: value.close_after_ms,
+    };
+    policy
+        .validate()
+        .map_err(|error| AgentApiError::invalid_request(format!("invalid idle policy: {error}")))?;
+    Ok(policy)
+}
+
+pub(crate) fn state_view(value: EnvironmentState) -> EnvironmentStateView {
+    match value {
+        EnvironmentState::Provisioning => EnvironmentStateView::Provisioning,
+        EnvironmentState::Open => EnvironmentStateView::Open,
+        EnvironmentState::Closing => EnvironmentStateView::Closing,
+        EnvironmentState::Closed => EnvironmentStateView::Closed,
+        EnvironmentState::Failed => EnvironmentStateView::Failed,
+    }
+}
+
+pub(crate) fn registry_state(value: EnvironmentStateView) -> EnvironmentState {
+    match value {
+        EnvironmentStateView::Provisioning => EnvironmentState::Provisioning,
+        EnvironmentStateView::Open => EnvironmentState::Open,
+        EnvironmentStateView::Closing => EnvironmentState::Closing,
+        EnvironmentStateView::Closed => EnvironmentState::Closed,
+        EnvironmentStateView::Failed => EnvironmentState::Failed,
     }
 }
 
-fn lifecycle_status_view(value: EnvironmentStatus) -> EnvironmentLifecycleStatusView {
+pub(crate) fn status_view(value: EnvironmentDisplayStatus) -> EnvironmentStatusView {
     match value {
-        EnvironmentStatus::Provisioning => EnvironmentLifecycleStatusView::Provisioning,
-        EnvironmentStatus::Booting => EnvironmentLifecycleStatusView::Booting,
-        EnvironmentStatus::Ready => EnvironmentLifecycleStatusView::Ready,
-        EnvironmentStatus::Paused => EnvironmentLifecycleStatusView::Paused,
-        EnvironmentStatus::Suspended => EnvironmentLifecycleStatusView::Suspended,
-        EnvironmentStatus::Offline => EnvironmentLifecycleStatusView::Offline,
-        EnvironmentStatus::Closing => EnvironmentLifecycleStatusView::Closing,
-        EnvironmentStatus::Closed => EnvironmentLifecycleStatusView::Closed,
-        EnvironmentStatus::Failed => EnvironmentLifecycleStatusView::Failed,
-        EnvironmentStatus::Unknown => EnvironmentLifecycleStatusView::Unknown,
+        EnvironmentDisplayStatus::Provisioning => EnvironmentStatusView::Provisioning,
+        EnvironmentDisplayStatus::Ready => EnvironmentStatusView::Ready,
+        EnvironmentDisplayStatus::Paused => EnvironmentStatusView::Paused,
+        EnvironmentDisplayStatus::Suspended => EnvironmentStatusView::Suspended,
+        EnvironmentDisplayStatus::Stopped => EnvironmentStatusView::Stopped,
+        EnvironmentDisplayStatus::Unknown => EnvironmentStatusView::Unknown,
+        EnvironmentDisplayStatus::Away => EnvironmentStatusView::Away,
+        EnvironmentDisplayStatus::Closing => EnvironmentStatusView::Closing,
+        EnvironmentDisplayStatus::Closed => EnvironmentStatusView::Closed,
+        EnvironmentDisplayStatus::Failed => EnvironmentStatusView::Failed,
     }
 }
 
-pub(crate) fn registry_lifecycle_status(
-    value: EnvironmentLifecycleStatusView,
-) -> EnvironmentStatus {
+fn close_reason_view(value: EnvironmentCloseReason) -> EnvironmentCloseReasonView {
     match value {
-        EnvironmentLifecycleStatusView::Provisioning => EnvironmentStatus::Provisioning,
-        EnvironmentLifecycleStatusView::Booting => EnvironmentStatus::Booting,
-        EnvironmentLifecycleStatusView::Ready => EnvironmentStatus::Ready,
-        EnvironmentLifecycleStatusView::Paused => EnvironmentStatus::Paused,
-        EnvironmentLifecycleStatusView::Suspended => EnvironmentStatus::Suspended,
-        EnvironmentLifecycleStatusView::Offline => EnvironmentStatus::Offline,
-        EnvironmentLifecycleStatusView::Closing => EnvironmentStatus::Closing,
-        EnvironmentLifecycleStatusView::Closed => EnvironmentStatus::Closed,
-        EnvironmentLifecycleStatusView::Failed => EnvironmentStatus::Failed,
-        EnvironmentLifecycleStatusView::Unknown => EnvironmentStatus::Unknown,
+        EnvironmentCloseReason::Requested => EnvironmentCloseReasonView::Requested,
+        EnvironmentCloseReason::KeyRevoked => EnvironmentCloseReasonView::KeyRevoked,
+        EnvironmentCloseReason::EphemeralGrace => EnvironmentCloseReasonView::EphemeralGrace,
+        EnvironmentCloseReason::Departed => EnvironmentCloseReasonView::Departed,
+        EnvironmentCloseReason::OfflineTimeout => EnvironmentCloseReasonView::OfflineTimeout,
+        EnvironmentCloseReason::ProviderEnded => EnvironmentCloseReasonView::ProviderEnded,
+    }
+}
+
+/// The deployment view of a provider record. The effective data route base
+/// is absent only when it cannot be derived.
+pub(crate) fn environment_provider_view(
+    record: &EnvironmentProviderRecord,
+) -> DeploymentEnvironmentProviderView {
+    DeploymentEnvironmentProviderView {
+        provider_id: record.provider_id.to_string(),
+        display_name: record.display_name.clone(),
+        controller_endpoint: record.controller_endpoint.as_str().to_owned(),
+        data_route_base: record
+            .data_route_base
+            .as_ref()
+            .map(|base| base.as_str().to_owned()),
+        effective_data_route_base: record
+            .effective_data_route_base()
+            .ok()
+            .map(|base| base.as_str().to_owned()),
+        has_credential: record.has_credential,
+        created_at_ms: record.created_at_ms,
+        updated_at_ms: record.updated_at_ms,
     }
 }
 
@@ -395,14 +393,6 @@ pub(crate) fn map_environments_error(error: EnvironmentRegistryError) -> AgentAp
         EnvironmentRegistryError::NotFound { kind, id } => {
             AgentApiError::not_found(format!("environment registry {kind} not found: {id}"))
         }
-        EnvironmentRegistryError::RevisionConflict {
-            kind,
-            id,
-            expected,
-            actual,
-        } => AgentApiError::conflict(format!(
-            "environment registry revision conflict for {kind} {id}: expected {expected:?}, actual {actual:?}"
-        )),
         EnvironmentRegistryError::InvalidInput { message } => {
             AgentApiError::invalid_request(message)
         }
@@ -415,3 +405,145 @@ pub(crate) fn map_environments_error(error: EnvironmentRegistryError) -> AgentAp
         EnvironmentRegistryError::Store { message } => AgentApiError::internal(message),
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use std::collections::BTreeMap;
+
+    use ::environments::{
+        EndpointScheme, EnvironmentEndpoint, EnvironmentProviderBindingStore,
+        EnvironmentProviderStore, EnvironmentStore, InMemoryEnvironmentRegistryStore,
+        PutEnvironmentProvider, PutEnvironmentProviderBinding,
+    };
+    use environment_protocol::routes::DataRouteBase;
+
+    use super::*;
+
+    #[test]
+    fn the_provider_view_shows_the_effective_data_route_and_no_credential() {
+        let record = EnvironmentProviderRecord {
+            provider_id: EnvironmentProviderId::new("provider"),
+            display_name: None,
+            controller_endpoint: EnvironmentEndpoint::parse("wss://provider.test:8443/control")
+                .unwrap(),
+            data_route_base: None,
+            has_credential: false,
+            created_at_ms: 1,
+            updated_at_ms: 1,
+        };
+        let view = environment_provider_view(&record);
+        assert_eq!(view.data_route_base, None);
+        assert_eq!(
+            view.effective_data_route_base.as_deref(),
+            Some("wss://provider.test:8443/routes")
+        );
+        assert!(!view.has_credential);
+        let local = EnvironmentProviderRecord {
+            controller_endpoint: EnvironmentEndpoint::parse("unix:///run/provider.sock").unwrap(),
+            data_route_base: Some(DataRouteBase::new("ws://127.0.0.1:9/routes").unwrap()),
+            has_credential: true,
+            ..record
+        };
+        assert_eq!(local.controller_endpoint.scheme(), EndpointScheme::Unix);
+        let view = environment_provider_view(&local);
+        assert_eq!(
+            view.effective_data_route_base.as_deref(),
+            Some("ws://127.0.0.1:9/routes")
+        );
+        assert!(view.has_credential);
+    }
+
+    #[test]
+    fn idle_overrides_are_validated_before_they_reach_a_provider() {
+        let valid = EnvironmentIdlePolicyView {
+            pause_after_ms: Some(60_000),
+            stop_after_ms: Some(3_600_000),
+            ..EnvironmentIdlePolicyView::default()
+        };
+        assert_eq!(
+            idle_policy_view(&registry_idle_policy(&valid).unwrap()),
+            valid
+        );
+        let out_of_order = EnvironmentIdlePolicyView {
+            pause_after_ms: Some(10),
+            stop_after_ms: Some(5),
+            ..EnvironmentIdlePolicyView::default()
+        };
+        assert_eq!(
+            registry_idle_policy(&out_of_order).unwrap_err().kind,
+            api::AgentApiErrorKind::InvalidRequest
+        );
+        assert_eq!(
+            registry_idle_policy(&EnvironmentIdlePolicyView::default())
+                .unwrap_err()
+                .kind,
+            api::AgentApiErrorKind::InvalidRequest
+        );
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn a_provisioned_view_carries_state_status_and_the_create_inputs() {
+        let store = InMemoryEnvironmentRegistryStore::new();
+        let provider_id = EnvironmentProviderId::new("provider");
+        store
+            .put_provider(PutEnvironmentProvider {
+                provider_id: provider_id.clone(),
+                display_name: None,
+                controller_endpoint: EnvironmentEndpoint::parse("ws://provider.test/control")
+                    .unwrap(),
+                data_route_base: None,
+                credential: ::environments::ProviderCredentialChange::Keep,
+                updated_at_ms: 1,
+            })
+            .await
+            .unwrap();
+        store
+            .put_provider_binding(PutEnvironmentProviderBinding {
+                universe_id: store.universe_id(),
+                provider_id: provider_id.clone(),
+                enabled: true,
+                updated_at_ms: 1,
+            })
+            .await
+            .unwrap();
+        let idle = IdlePolicy {
+            pause_after_ms: Some(60_000),
+            ..IdlePolicy::default()
+        };
+        let record = store
+            .create_environment(::environments::CreateEnvironment {
+                request_id: ::environments::EnvironmentProvisionRequestId::new("request"),
+                environment_id: ::environments::EnvironmentId::new("environment"),
+                provider_id: provider_id.clone(),
+                template_id: ::environments::EnvironmentTemplateId::new("template"),
+                idle: Some(idle.clone()),
+                display_name: None,
+                metadata: BTreeMap::new(),
+                created_at_ms: 10,
+            })
+            .await
+            .unwrap();
+        let view = environment_view(&record);
+        assert_eq!(view.state, EnvironmentStateView::Provisioning);
+        assert_eq!(view.status, EnvironmentStatusView::Provisioning);
+        assert_eq!(view.request_id.as_deref(), Some("request"));
+        assert_eq!(view.close_reason, None);
+        match view.source {
+            EnvironmentSourceView::Provisioned {
+                provider_id,
+                template_id,
+                target_id,
+                idle: shown,
+                observed,
+                ..
+            } => {
+                assert_eq!(provider_id, "provider");
+                assert_eq!(template_id, "template");
+                assert_eq!(target_id, None);
+                assert_eq!(shown, Some(idle_policy_view(&idle)));
+                assert_eq!(observed, None);
+            }
+            other => panic!("expected a provisioned source, got {other:?}"),
+        }
+    }
+}
diff --git a/crates/temporal-runtime/src/environments/registration.rs b/crates/temporal-runtime/src/environments/registration.rs
index 82a12b9ee..783120343 100644
--- a/crates/temporal-runtime/src/environments/registration.rs
+++ b/crates/temporal-runtime/src/environments/registration.rs
@@ -1,77 +1,16 @@
 //! Registration keys: the universe-management surface of key-based outbound
-//! `envd` registration. Keys are minted here; admission itself happens on
-//! the environment gateway's connect route.
-
-use std::collections::BTreeMap;
+//! `envd` registration. Keys are minted, edited and rotated here; admission
+//! itself happens on the environment gateway's connect route, and the
+//! gateway's registered sweep applies the keys' disconnect policies.
 
 use ::environments::{
-    BeginCloseEnvironment, CreateEnvironmentRegistrationKey, EnvironmentRecord,
-    EnvironmentRegistrationKeyRecord, EnvironmentRegistrationKeyStatus,
-    EnvironmentRegistrationKeyStore, EnvironmentSource, EnvironmentStatus, EnvironmentStore,
-    ListEnvironments, ObserveRegisteredEnvironment, RegisteredConnectionObservation,
-    RegisteredIdentityMode, RegistrationKeyPolicy, RevokeEnvironmentRegistrationKey,
-    mint_registration_key,
+    CreateEnvironmentRegistrationKey, EnvironmentCloseReason, EnvironmentRegistrationKeyRecord,
+    EnvironmentRegistrationKeyStatus, EnvironmentRegistrationKeyStore, EnvironmentState,
+    EnvironmentStore, ListEnvironments, RegistrationKeyPolicy, RegistrationKeySettings,
+    RevokeEnvironmentRegistrationKey, RotateEnvironmentRegistrationKey,
+    UpdateEnvironmentRegistrationKey, mint_registration_key, mint_registration_secret,
 };
 
-/// A registered environment whose heartbeat stamp is older than this is
-/// treated as disconnected even if its row still says `Ready`: the gateway
-/// that held its control connection stopped without recording the
-/// disconnect. The registration channel's liveness rule: the same number
-/// of missed heartbeats after which either peer declares the connection
-/// dead.
-pub(crate) const REGISTERED_STALE_AFTER_MS: i64 =
-    environment_protocol::limits::HEARTBEAT_MISSED_INTERVALS as i64
-        * crate::gateway::registration::HEARTBEAT_INTERVAL.as_millis() as i64;
-
-/// What the reconciler does with one open registered environment.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub(crate) enum RegisteredSweepAction {
-    /// `Ready` with a stale stamp: record the disconnect the gateway lost.
-    MarkOffline,
-    /// Ephemeral and away past the key's grace: close it.
-    Close,
-}
-
-/// Pure decision for one open registered environment. Persistent
-/// environments only ever get repaired; ephemeral ones close once their
-/// daemon has been away longer than the key's disconnect grace.
-pub(crate) fn registered_sweep_action(
-    environment: &EnvironmentRecord,
-    key: &EnvironmentRegistrationKeyRecord,
-    now_ms: i64,
-) -> Option<RegisteredSweepAction> {
-    if !environment.registered_daemon_absent(now_ms, REGISTERED_STALE_AFTER_MS) {
-        return None;
-    }
-    let away_ms = environment
-        .last_seen_at_ms
-        .map_or(i64::MAX, |seen| now_ms.saturating_sub(seen));
-    if key.identity_mode == RegisteredIdentityMode::Ephemeral
-        && away_ms > i64::try_from(key.ephemeral_disconnect_grace_ms()).unwrap_or(i64::MAX)
-    {
-        return Some(RegisteredSweepAction::Close);
-    }
-    if environment.status == EnvironmentStatus::Ready {
-        return Some(RegisteredSweepAction::MarkOffline);
-    }
-    None
-}
-
-/// Whether a daemon's `registration/goodbye` ends its environment. An
-/// ephemeral environment closes at once: its daemon stopped on purpose,
-/// so waiting out the disconnect grace would only keep a finished sandbox
-/// `Offline` and counted against its key's limit. A persistent one stays
-/// `Offline` until its daemon returns or someone closes it.
-pub(crate) fn departure_closes(environment: &EnvironmentRecord) -> bool {
-    matches!(
-        environment.source,
-        EnvironmentSource::Registered {
-            identity_mode: RegisteredIdentityMode::Ephemeral,
-            ..
-        }
-    )
-}
-
 use super::*;
 use super::{
     lifecycle::parse_registration_key_id,
@@ -91,6 +30,7 @@ impl EnvironmentService {
                 identity_mode: registry_identity_mode(params.identity_mode),
                 max_active_environments: params.max_active_environments,
                 ephemeral_disconnect_grace_ms: params.ephemeral_disconnect_grace_ms,
+                offline_close_after_ms: params.offline_close_after_ms,
                 expires_at_ms: params.expires_at_ms,
             },
             now,
@@ -99,7 +39,7 @@ impl EnvironmentService {
         let record = EnvironmentRegistrationKeyStore::create_registration_key(
             self.store.as_ref(),
             CreateEnvironmentRegistrationKey {
-                secret_hash: minted.secret_hash,
+                secret_hash: minted.secret.secret_hash,
                 record: minted.record,
             },
         )
@@ -114,7 +54,7 @@ impl EnvironmentService {
         );
         Ok(EnvironmentRegistrationKeyCreateResponse {
             registration_key: self.registration_key_view(&record, now).await?,
-            secret: EnvironmentRegistrationSecretView(minted.secret.expose().to_owned()),
+            secret: EnvironmentRegistrationSecretView(minted.secret.secret.expose().to_owned()),
         })
     }
 
@@ -149,6 +89,69 @@ impl EnvironmentService {
         Ok(EnvironmentRegistrationKeyListResponse { registration_keys })
     }
 
+    /// `environments/registration-keys/update`: replace the editable policy.
+    /// The identity mode never changes.
+    pub(crate) async fn update_environment_registration_key_record(
+        &self,
+        params: EnvironmentRegistrationKeyUpdateParams,
+    ) -> Result<EnvironmentRegistrationKeyUpdateResponse, AgentApiError> {
+        let registration_key_id = parse_registration_key_id(params.registration_key_id)?;
+        let now = now_ms()?;
+        let record = EnvironmentRegistrationKeyStore::update_registration_key(
+            self.store.as_ref(),
+            UpdateEnvironmentRegistrationKey {
+                registration_key_id,
+                settings: RegistrationKeySettings {
+                    display_name: params.display_name,
+                    max_active_environments: params.max_active_environments,
+                    ephemeral_disconnect_grace_ms: params.ephemeral_disconnect_grace_ms,
+                    offline_close_after_ms: params.offline_close_after_ms,
+                    expires_at_ms: params.expires_at_ms,
+                },
+                updated_at_ms: now,
+            },
+        )
+        .await
+        .map_err(map_environments_error)?;
+        Ok(EnvironmentRegistrationKeyUpdateResponse {
+            registration_key: self.registration_key_view(&record, now).await?,
+        })
+    }
+
+    /// `environments/registration-keys/rotate`: retire the live secret at
+    /// once and mint a new one. The key's group, allowlists and admitted
+    /// daemons are unaffected.
+    pub(crate) async fn rotate_environment_registration_key_record(
+        &self,
+        params: EnvironmentRegistrationKeyRotateParams,
+    ) -> Result<EnvironmentRegistrationKeyRotateResponse, AgentApiError> {
+        let registration_key_id = parse_registration_key_id(params.registration_key_id)?;
+        let now = now_ms()?;
+        let minted = mint_registration_secret();
+        let record = EnvironmentRegistrationKeyStore::rotate_registration_key(
+            self.store.as_ref(),
+            RotateEnvironmentRegistrationKey {
+                registration_key_id,
+                secret_hash: minted.secret_hash,
+                key_prefix: minted.key_prefix,
+                rotated_at_ms: now,
+            },
+        )
+        .await
+        .map_err(map_environments_error)?;
+        tracing::info!(
+            target: "temporal_runtime",
+            registration_key_id = %record.registration_key_id,
+            "environment registration key rotated"
+        );
+        Ok(EnvironmentRegistrationKeyRotateResponse {
+            registration_key: self.registration_key_view(&record, now).await?,
+            secret: EnvironmentRegistrationSecretView(minted.secret.expose().to_owned()),
+        })
+    }
+
+    /// Revoke a key; with `closeEnvironments`, close every environment it
+    /// admitted (`key_revoked`) and end their live routes.
     pub(crate) async fn revoke_environment_registration_key_record(
         &self,
         params: EnvironmentRegistrationKeyRevokeParams,
@@ -166,33 +169,37 @@ impl EnvironmentService {
         .map_err(map_environments_error)?;
         let mut closed_environment_ids = Vec::new();
         if params.close_environments {
-            let environments = EnvironmentStore::list_environments(
-                self.store.as_ref(),
-                ListEnvironments {
-                    metadata: Default::default(),
-                    registration_key_id: Some(registration_key_id.clone()),
-                    ..ListEnvironments::default()
-                },
-            )
-            .await
-            .map_err(map_environments_error)?;
-            for environment in environments {
-                if matches!(
-                    environment.status,
-                    EnvironmentStatus::Closing | EnvironmentStatus::Closed
-                ) {
-                    continue;
-                }
-                EnvironmentStore::begin_close_environment(
+            let mut after = None;
+            loop {
+                let page = EnvironmentStore::list_environments(
                     self.store.as_ref(),
-                    BeginCloseEnvironment {
-                        environment_id: environment.environment_id.clone(),
-                        updated_at_ms: now,
+                    ListEnvironments {
+                        registration_key_id: Some(registration_key_id.clone()),
+                        limit: ::environments::LIST_ENVIRONMENTS_MAX_LIMIT,
+                        after,
+                        ..ListEnvironments::default()
                     },
                 )
                 .await
                 .map_err(map_environments_error)?;
-                closed_environment_ids.push(environment.environment_id.to_string());
+                for environment in &page.environments {
+                    if matches!(
+                        environment.state,
+                        EnvironmentState::Closing | EnvironmentState::Closed
+                    ) {
+                        continue;
+                    }
+                    self.begin_close(
+                        &environment.environment_id,
+                        EnvironmentCloseReason::KeyRevoked,
+                    )
+                    .await?;
+                    closed_environment_ids.push(environment.environment_id.to_string());
+                }
+                after = page.next_after;
+                if after.is_none() {
+                    break;
+                }
             }
         }
         tracing::info!(
@@ -207,104 +214,6 @@ impl EnvironmentService {
         })
     }
 
-    /// One pass over open registered environments: repair stale `Ready`
-    /// rows and close ephemeral environments past their disconnect grace.
-    /// One environment's failure is logged and never stops the pass.
-    /// Returns how many rows changed.
-    pub(crate) async fn reconcile_registered_once(&self) -> Result<usize, AgentApiError> {
-        let environments = EnvironmentStore::list_open_registered_environments(self.store.as_ref())
-            .await
-            .map_err(map_environments_error)?;
-        if environments.is_empty() {
-            return Ok(0);
-        }
-        let now = now_ms()?;
-        let mut keys: BTreeMap<String, EnvironmentRegistrationKeyRecord> = BTreeMap::new();
-        let mut changed = 0;
-        for environment in environments {
-            match self
-                .reconcile_registered_environment(&environment, &mut keys, now)
-                .await
-            {
-                Ok(true) => changed += 1,
-                Ok(false) => {}
-                Err(error) => tracing::warn!(
-                    target: "temporal_runtime",
-                    environment = %environment.environment_id,
-                    error = %error.message,
-                    "registered environment sweep failed; continuing with the next"
-                ),
-            }
-        }
-        Ok(changed)
-    }
-
-    /// Apply the sweep decision to one registered environment; true when
-    /// its row changed.
-    async fn reconcile_registered_environment(
-        &self,
-        environment: &EnvironmentRecord,
-        keys: &mut BTreeMap<String, EnvironmentRegistrationKeyRecord>,
-        now: i64,
-    ) -> Result<bool, AgentApiError> {
-        let Some(key_id) = environment.registration_key_id() else {
-            return Ok(false);
-        };
-        let key = match keys.get(key_id.as_str()) {
-            Some(key) => key.clone(),
-            None => {
-                let key = EnvironmentRegistrationKeyStore::read_registration_key(
-                    self.store.as_ref(),
-                    key_id,
-                )
-                .await
-                .map_err(map_environments_error)?;
-                keys.insert(key_id.to_string(), key.clone());
-                key
-            }
-        };
-        match registered_sweep_action(environment, &key, now) {
-            None => Ok(false),
-            Some(RegisteredSweepAction::MarkOffline) => {
-                tracing::info!(
-                    target: "temporal_runtime",
-                    environment = %environment.environment_id,
-                    "registered environment heartbeat is stale; marking offline"
-                );
-                EnvironmentStore::observe_registered_environment(
-                    self.store.as_ref(),
-                    ObserveRegisteredEnvironment {
-                        environment_id: environment.environment_id.clone(),
-                        observation: RegisteredConnectionObservation::Disconnected,
-                        observed_at_ms: now,
-                        metadata: BTreeMap::new(),
-                    },
-                )
-                .await
-                .map_err(map_environments_error)?;
-                Ok(true)
-            }
-            Some(RegisteredSweepAction::Close) => {
-                tracing::info!(
-                    target: "temporal_runtime",
-                    environment = %environment.environment_id,
-                    registration_key_id = %key.registration_key_id,
-                    "ephemeral registered environment exceeded its disconnect grace; closing"
-                );
-                EnvironmentStore::begin_close_environment(
-                    self.store.as_ref(),
-                    BeginCloseEnvironment {
-                        environment_id: environment.environment_id.clone(),
-                        updated_at_ms: now,
-                    },
-                )
-                .await
-                .map_err(map_environments_error)?;
-                Ok(true)
-            }
-        }
-    }
-
     async fn registration_key_view(
         &self,
         record: &EnvironmentRegistrationKeyRecord,
@@ -316,31 +225,41 @@ impl EnvironmentService {
         )
         .await
         .map_err(map_environments_error)?;
-        Ok(EnvironmentRegistrationKeyView {
-            registration_key_id: record.registration_key_id.to_string(),
-            display_name: record.display_name.clone(),
-            key_prefix: record.key_prefix.clone(),
-            identity_mode: identity_mode_view(record.identity_mode),
-            max_active_environments: record.max_active_environments,
-            ephemeral_disconnect_grace_ms: record.ephemeral_disconnect_grace_ms(),
-            expires_at_ms: record.expires_at_ms,
-            status: match record.status(now_ms) {
-                EnvironmentRegistrationKeyStatus::Active => {
-                    EnvironmentRegistrationKeyStatusView::Active
-                }
-                EnvironmentRegistrationKeyStatus::Revoked => {
-                    EnvironmentRegistrationKeyStatusView::Revoked
-                }
-                EnvironmentRegistrationKeyStatus::Expired => {
-                    EnvironmentRegistrationKeyStatusView::Expired
-                }
-            },
-            registered_environment_count: usage.registered,
-            active_environment_count: usage.active,
-            last_registered_at_ms: usage.last_registered_at_ms,
-            created_at_ms: record.created_at_ms,
-            revoked_at_ms: record.revoked_at_ms,
-        })
+        Ok(registration_key_view(record, usage, now_ms))
+    }
+}
+
+pub(crate) fn registration_key_view(
+    record: &EnvironmentRegistrationKeyRecord,
+    usage: ::environments::RegistrationKeyUsage,
+    now_ms: i64,
+) -> EnvironmentRegistrationKeyView {
+    EnvironmentRegistrationKeyView {
+        registration_key_id: record.registration_key_id.to_string(),
+        display_name: record.display_name.clone(),
+        key_prefix: record.key_prefix.clone(),
+        identity_mode: identity_mode_view(record.identity_mode),
+        max_active_environments: record.max_active_environments,
+        ephemeral_disconnect_grace_ms: record.ephemeral_disconnect_grace_ms(),
+        offline_close_after_ms: record.offline_close_after_ms,
+        expires_at_ms: record.expires_at_ms,
+        status: match record.status(now_ms) {
+            EnvironmentRegistrationKeyStatus::Active => {
+                EnvironmentRegistrationKeyStatusView::Active
+            }
+            EnvironmentRegistrationKeyStatus::Revoked => {
+                EnvironmentRegistrationKeyStatusView::Revoked
+            }
+            EnvironmentRegistrationKeyStatus::Expired => {
+                EnvironmentRegistrationKeyStatusView::Expired
+            }
+        },
+        registered_environment_count: usage.registered,
+        active_environment_count: usage.active,
+        last_registered_at_ms: usage.last_registered_at_ms,
+        created_at_ms: record.created_at_ms,
+        updated_at_ms: record.updated_at_ms,
+        revoked_at_ms: record.revoked_at_ms,
     }
 }
 
@@ -353,153 +272,47 @@ fn allocate_registration_key_id() -> ::environments::EnvironmentRegistrationKeyI
 
 #[cfg(test)]
 mod tests {
-    use std::collections::BTreeMap;
-
     use ::environments::{
-        EnvironmentDaemonId, EnvironmentId, EnvironmentIncarnationId, EnvironmentIncarnationRecord,
-        EnvironmentProvisionRequestId, EnvironmentRegistrationKeyId, PowerState,
+        EnvironmentRegistrationKeyId, RegisteredIdentityMode, RegistrationKeyUsage,
     };
 
     use super::*;
 
-    fn key(
-        mode: RegisteredIdentityMode,
-        grace_ms: Option<u64>,
-    ) -> EnvironmentRegistrationKeyRecord {
-        EnvironmentRegistrationKeyRecord {
-            registration_key_id: EnvironmentRegistrationKeyId::new("rk"),
-            display_name: "pool".to_owned(),
-            key_prefix: "lsrk_abcdefgh".to_owned(),
-            identity_mode: mode,
-            max_active_environments: None,
-            ephemeral_disconnect_grace_ms: grace_ms,
-            expires_at_ms: None,
-            created_at_ms: 0,
-            revoked_at_ms: None,
-        }
-    }
-
-    fn environment(status: EnvironmentStatus, last_seen_at_ms: Option<i64>) -> EnvironmentRecord {
-        environment_in_mode(status, last_seen_at_ms, RegisteredIdentityMode::Ephemeral)
-    }
-
-    fn environment_in_mode(
-        status: EnvironmentStatus,
-        last_seen_at_ms: Option<i64>,
-        identity_mode: RegisteredIdentityMode,
-    ) -> EnvironmentRecord {
-        let public_key = "ab".repeat(32);
-        let daemon_id = EnvironmentDaemonId::from_public_key(&[0xab; 32]);
-        EnvironmentRecord {
-            environment_id: EnvironmentId::new("env"),
-            request_id: EnvironmentProvisionRequestId::for_daemon(&daemon_id),
-            source: EnvironmentSource::Registered {
-                registration_key_id: EnvironmentRegistrationKeyId::new("rk"),
-                daemon_id,
-                daemon_public_key: public_key,
-                identity_mode,
+    #[test]
+    fn the_key_view_carries_the_editable_policy_and_its_update_time() {
+        let mut minted = mint_registration_key(
+            EnvironmentRegistrationKeyId::new("rk"),
+            RegistrationKeyPolicy {
+                display_name: "fleet".to_owned(),
+                identity_mode: RegisteredIdentityMode::Persistent,
+                max_active_environments: Some(3),
+                ephemeral_disconnect_grace_ms: None,
+                offline_close_after_ms: Some(86_400_000),
+                expires_at_ms: None,
             },
-            display_name: None,
-            status,
-            desired_power: PowerState::Running,
-            idle_policy: None,
-            incarnation: EnvironmentIncarnationRecord {
-                incarnation_id: EnvironmentIncarnationId::new("inc"),
-                provision_request_id: None,
-                provider_target_id: None,
-                template_id: None,
-                adoption_source_target: None,
-                power_states: Vec::new(),
-                created_at_ms: 0,
-                updated_at_ms: 0,
+            5,
+        )
+        .unwrap();
+        minted.record.updated_at_ms = 9;
+        let view = registration_key_view(
+            &minted.record,
+            RegistrationKeyUsage {
+                registered: 2,
+                active: 1,
+                last_registered_at_ms: Some(7),
             },
-            public_ingress_enabled: false,
-            public_endpoint: None,
-            metadata: BTreeMap::new(),
-            last_seen_at_ms,
-            lifecycle_error: None,
-            created_at_ms: 0,
-            updated_at_ms: 0,
-        }
-    }
-
-    #[test]
-    fn fresh_heartbeats_need_nothing() {
-        let ready = environment(EnvironmentStatus::Ready, Some(1_000));
-        assert_eq!(
-            registered_sweep_action(
-                &ready,
-                &key(RegisteredIdentityMode::Ephemeral, Some(1)),
-                1_500
-            ),
-            None
-        );
-    }
-
-    #[test]
-    fn stale_ready_rows_are_marked_offline_before_grace_and_closed_after() {
-        let stale = environment(EnvironmentStatus::Ready, Some(0));
-        let now = REGISTERED_STALE_AFTER_MS + 1;
-        assert_eq!(
-            registered_sweep_action(
-                &stale,
-                &key(RegisteredIdentityMode::Ephemeral, Some(1_000_000)),
-                now
-            ),
-            Some(RegisteredSweepAction::MarkOffline)
+            10,
         );
+        assert_eq!(view.offline_close_after_ms, Some(86_400_000));
+        assert_eq!(view.updated_at_ms, 9);
+        assert_eq!(view.status, EnvironmentRegistrationKeyStatusView::Active);
         assert_eq!(
-            registered_sweep_action(
-                &stale,
-                &key(RegisteredIdentityMode::Ephemeral, Some(1_000)),
-                now
+            (
+                view.registered_environment_count,
+                view.active_environment_count
             ),
-            Some(RegisteredSweepAction::Close)
-        );
-        assert_eq!(
-            registered_sweep_action(
-                &stale,
-                &key(RegisteredIdentityMode::Persistent, Some(1)),
-                now
-            ),
-            Some(RegisteredSweepAction::MarkOffline)
-        );
-    }
-
-    #[test]
-    fn offline_environments_close_only_when_ephemeral_and_past_grace() {
-        let offline = environment(EnvironmentStatus::Offline, Some(10_000));
-        let persistent = key(RegisteredIdentityMode::Persistent, Some(1));
-        assert_eq!(
-            registered_sweep_action(&offline, &persistent, 1_000_000),
-            None
-        );
-        let ephemeral = key(RegisteredIdentityMode::Ephemeral, Some(5_000));
-        assert_eq!(registered_sweep_action(&offline, &ephemeral, 14_000), None);
-        assert_eq!(
-            registered_sweep_action(&offline, &ephemeral, 15_001),
-            Some(RegisteredSweepAction::Close)
-        );
-        let default_grace = key(RegisteredIdentityMode::Ephemeral, None);
-        assert_eq!(
-            registered_sweep_action(
-                &offline,
-                &default_grace,
-                10_000 + ::environments::DEFAULT_EPHEMERAL_DISCONNECT_GRACE_MS as i64 + 1
-            ),
-            Some(RegisteredSweepAction::Close)
-        );
-    }
-
-    #[test]
-    fn only_ephemeral_environments_close_on_departure() {
-        let ephemeral = environment(EnvironmentStatus::Ready, Some(1_000));
-        assert!(departure_closes(&ephemeral));
-        let persistent = environment_in_mode(
-            EnvironmentStatus::Ready,
-            Some(1_000),
-            RegisteredIdentityMode::Persistent,
+            (2, 1)
         );
-        assert!(!departure_closes(&persistent));
+        assert_eq!(view.key_prefix, minted.secret.key_prefix);
     }
 }
diff --git a/crates/temporal-runtime/src/environments/resolver.rs b/crates/temporal-runtime/src/environments/resolver.rs
index 85d3b6a99..98d4f9454 100644
--- a/crates/temporal-runtime/src/environments/resolver.rs
+++ b/crates/temporal-runtime/src/environments/resolver.rs
@@ -1,13 +1,15 @@
-//! Internal environment lookup and liveness policy.
+//! Internal environment lookup and the single use gate.
 //!
 //! This is a shared runtime service, not a provider/plugin extension seam.
+//! Every consumer asks [`EnvironmentRecord::use_gate`] through it; nothing
+//! here writes to a row.
 
 use std::sync::Arc;
 
 use environment_client::{ClientError, DataClient};
 use environments::{
-    EnvironmentId, EnvironmentProviderStore, EnvironmentRecord, EnvironmentRegistryError,
-    EnvironmentSource, EnvironmentStatus, EnvironmentStore, PowerState, SetEnvironmentPower,
+    EnvironmentGoneReason, EnvironmentId, EnvironmentRecord, EnvironmentRegistryError,
+    EnvironmentState, EnvironmentStore, EnvironmentUse, EnvironmentWaitReason,
 };
 use store_pg::PgStore;
 use thiserror::Error;
@@ -15,7 +17,6 @@ use thiserror::Error;
 #[derive(Clone)]
 pub(crate) struct EnvironmentResolver {
     environments: Arc<dyn EnvironmentStore>,
-    providers: Arc<dyn EnvironmentProviderStore>,
     gateway: Option<crate::environments::gateway::EnvironmentGatewayClientConfig>,
     universe_id: uuid::Uuid,
 }
@@ -24,13 +25,10 @@ impl EnvironmentResolver {
     pub(crate) fn universe_id(&self) -> uuid::Uuid {
         self.universe_id
     }
-    pub(crate) fn new(
-        environments: Arc<dyn EnvironmentStore>,
-        providers: Arc<dyn EnvironmentProviderStore>,
-    ) -> Self {
+
+    pub(crate) fn new(environments: Arc<dyn EnvironmentStore>) -> Self {
         Self {
             environments,
-            providers,
             gateway: None,
             universe_id: uuid::Uuid::nil(),
         }
@@ -38,7 +36,7 @@ impl EnvironmentResolver {
 
     pub(crate) fn from_pg_store(store: Arc<PgStore>) -> Self {
         let universe_id = store.config().universe_id;
-        let mut resolver = Self::new(store.clone(), store);
+        let mut resolver = Self::new(store);
         resolver.universe_id = universe_id;
         resolver
     }
@@ -60,49 +58,59 @@ impl EnvironmentResolver {
         Ok(self.environments.read_environment(environment_id).await?)
     }
 
-    /// Validate selection using registry state only. Selecting or reselecting
-    /// an environment never changes power or proves data-plane reachability.
+    /// Selection: rejects closing, closed and failed environments; accepts
+    /// one that is not usable yet and a registered one whose daemon is away.
+    /// Selecting never changes power or proves reachability.
     pub(crate) async fn selectable(
         &self,
         environment_id: &EnvironmentId,
     ) -> Result<EnvironmentRecord, EnvironmentResolveError> {
         let environment = self.read(environment_id).await?;
-        match environment.status {
-            EnvironmentStatus::Failed => Err(EnvironmentResolveError::Failed {
-                environment_id: environment.environment_id.to_string(),
-                message: environment
-                    .lifecycle_error
-                    .as_ref()
-                    .map(|error| error.message.clone())
-                    .unwrap_or_else(|| "environment provisioning failed".to_owned()),
-            }),
-            EnvironmentStatus::Closing | EnvironmentStatus::Closed => {
+        match environment.state {
+            EnvironmentState::Failed => {
+                Err(failed(&environment, environment.state_message.clone()))
+            }
+            EnvironmentState::Closing | EnvironmentState::Closed => {
                 Err(EnvironmentResolveError::Closed {
                     environment_id: environment.environment_id.to_string(),
                 })
             }
-            _ => Ok(environment),
+            EnvironmentState::Provisioning | EnvironmentState::Open => Ok(environment),
         }
     }
 
-    /// Check readiness for actual use, requesting wake-up where supported and
-    /// running the data-plane handshake over the route. A daemon of another
-    /// protocol version is a typed blocker, never a Ready environment whose
-    /// calls all fail. Selection itself uses only registry validation.
+    /// The gate before a real connection: usable → the record; not yet →
+    /// `NotReady`; gone → `Closed`, `Failed` or `Away`. Never writes.
+    pub(crate) async fn resolve_for_connection(
+        &self,
+        environment_id: &EnvironmentId,
+        now_ms: i64,
+    ) -> Result<EnvironmentRecord, EnvironmentResolveError> {
+        let environment = self.read(environment_id).await?;
+        match environment.use_gate(now_ms) {
+            EnvironmentUse::Use => Ok(environment),
+            gate => Err(gate_error(&environment, gate)),
+        }
+    }
+
+    /// [`Self::resolve_for_connection`], then one handshake over the worker
+    /// route. The dial is the wake signal: a powered-down target answers a
+    /// typed refusal while it wakes, which maps through
+    /// [`EnvironmentRecord::bound_route_refusal`]. The handshake proves
+    /// nothing durable and its result is never written. A daemon of another
+    /// protocol version is a typed error, never a usable environment whose
+    /// calls all fail.
     pub(crate) async fn ready_for_use(
         &self,
         environment_id: &EnvironmentId,
         now_ms: i64,
     ) -> Result<EnvironmentRecord, EnvironmentResolveError> {
         let environment = self.resolve_for_connection(environment_id, now_ms).await?;
-        let unavailable = |status: String| EnvironmentResolveError::EnvironmentUnavailable {
-            environment_id: environment.environment_id.as_str().to_owned(),
-            status,
-        };
         let Some(gateway) = &self.gateway else {
-            return Err(unavailable(
-                "environment endpoint is not reachable".to_owned(),
-            ));
+            return Err(EnvironmentResolveError::Unreachable {
+                environment_id: environment.environment_id.to_string(),
+                status: "no environment gateway is configured".to_owned(),
+            });
         };
         let endpoint = gateway.endpoint_for(self.universe_id, &environment);
         match DataClient::connect_initialized(&endpoint, gateway.connect_options(READINESS_CLIENT))
@@ -114,75 +122,72 @@ impl EnvironmentResolver {
             }
             Err(ClientError::VersionMismatch { local, remote, .. }) => {
                 Err(EnvironmentResolveError::VersionMismatch {
-                    environment_id: environment.environment_id.as_str().to_owned(),
+                    environment_id: environment.environment_id.to_string(),
                     local,
                     remote,
                 })
             }
-            Err(error) => Err(unavailable(format!(
-                "environment endpoint is not reachable: {error}"
-            ))),
+            Err(error) => Err(
+                route_refusal_error(&environment, &error).unwrap_or_else(|| {
+                    EnvironmentResolveError::Unreachable {
+                        environment_id: environment.environment_id.to_string(),
+                        status: error.to_string(),
+                    }
+                }),
+            ),
         }
     }
+}
 
-    /// Validate lifecycle and policy immediately before opening a real
-    /// data-plane connection. Unlike [`Self::ready_for_use`], this does not open
-    /// a second connection merely to prove reachability.
-    pub(crate) async fn resolve_for_connection(
-        &self,
-        environment_id: &EnvironmentId,
-        now_ms: i64,
-    ) -> Result<EnvironmentRecord, EnvironmentResolveError> {
-        let environment = self.selectable(environment_id).await?;
-        if let Some(provider_id) = environment.provider_id() {
-            self.providers.read_provider(provider_id).await?;
-        }
-        match environment.status {
-            EnvironmentStatus::Provisioning | EnvironmentStatus::Booting => {
-                return Err(EnvironmentResolveError::NotReady {
-                    environment_id: environment.environment_id.as_str().to_owned(),
-                    status: environment.status,
-                });
-            }
-            EnvironmentStatus::Paused
-            | EnvironmentStatus::Suspended
-            | EnvironmentStatus::Offline
-                if wake_on_use_applies(&environment) =>
-            {
-                if environment.desired_power != PowerState::Running {
-                    self.environments
-                        .set_environment_power(SetEnvironmentPower {
-                            environment_id: environment.environment_id.clone(),
-                            desired_power: PowerState::Running,
-                            updated_at_ms: now_ms.max(0),
-                        })
-                        .await?;
-                }
-                return Err(EnvironmentResolveError::NotReady {
-                    environment_id: environment.environment_id.as_str().to_owned(),
-                    status: environment.status,
-                });
-            }
-            EnvironmentStatus::Ready if environment.desired_power != PowerState::Running => {
-                // Use cancels a pending power-down: the idle reaper has asked
-                // for a lower power state but the reconciler has not converged
-                // yet. Keeping the intent at `running` stops the reconciler
-                // from freezing the environment under the call about to
-                // start; the reaper re-evaluates from the daemon's next idle
-                // report. Sessions are not consulted — any use counts.
-                return self
-                    .environments
-                    .set_environment_power(SetEnvironmentPower {
-                        environment_id: environment.environment_id.clone(),
-                        desired_power: PowerState::Running,
-                        updated_at_ms: now_ms.max(0),
-                    })
-                    .await
-                    .map_err(EnvironmentResolveError::from);
+/// A worker-route dial error that carries a typed refusal, as a resolve
+/// error (through [`EnvironmentRecord::bound_route_refusal`]); `None` when
+/// it carries none.
+pub(crate) fn route_refusal_error(
+    record: &EnvironmentRecord,
+    error: &ClientError,
+) -> Option<EnvironmentResolveError> {
+    let refusal = error.data_route_refusal()?;
+    match record.bound_route_refusal(refusal, error.retry_after_ms()) {
+        EnvironmentUse::Use => None,
+        gate => Some(gate_error(record, gate)),
+    }
+}
+
+/// The resolve error a gate answer other than `Use` is.
+fn gate_error(record: &EnvironmentRecord, gate: EnvironmentUse) -> EnvironmentResolveError {
+    let environment_id = record.environment_id.to_string();
+    match gate {
+        EnvironmentUse::Use => EnvironmentResolveError::Unreachable {
+            environment_id,
+            status: "the environment is usable".to_owned(),
+        },
+        EnvironmentUse::Wait {
+            reason,
+            retry_after_ms,
+            until_ms,
+        } => EnvironmentResolveError::NotReady {
+            environment_id,
+            reason,
+            retry_after_ms,
+            until_ms,
+        },
+        EnvironmentUse::Gone { reason, message } => match reason {
+            EnvironmentGoneReason::Closing | EnvironmentGoneReason::Closed => {
+                EnvironmentResolveError::Closed { environment_id }
             }
-            _ => {}
-        }
-        Ok(environment)
+            EnvironmentGoneReason::Failed => failed(record, message),
+            EnvironmentGoneReason::Away => EnvironmentResolveError::Away {
+                environment_id,
+                message: message.unwrap_or_else(|| "the daemon is away".to_owned()),
+            },
+        },
+    }
+}
+
+fn failed(record: &EnvironmentRecord, message: Option<String>) -> EnvironmentResolveError {
+    EnvironmentResolveError::Failed {
+        environment_id: record.environment_id.to_string(),
+        message: message.unwrap_or_else(|| "the environment failed".to_owned()),
     }
 }
 
@@ -191,21 +196,17 @@ pub(crate) enum EnvironmentResolveError {
     #[error(transparent)]
     Store(#[from] EnvironmentRegistryError),
 
-    #[error("environment is unavailable: {environment_id} ({status})")]
-    EnvironmentUnavailable {
-        environment_id: String,
-        status: String,
-    },
-
-    /// The environment exists and is being provisioned or booted; it is not
-    /// yet reachable but selecting it is valid intent.
-    #[error("environment is not ready yet: {environment_id} ({status:?})")]
+    /// Not usable yet: re-check after `retry_after_ms`; `until_ms` bounds
+    /// the wait when the gate knows a bound.
+    #[error("environment is not ready yet: {environment_id} ({reason})")]
     NotReady {
         environment_id: String,
-        status: EnvironmentStatus,
+        reason: EnvironmentWaitReason,
+        retry_after_ms: u64,
+        until_ms: Option<i64>,
     },
 
-    #[error("environment failed to provision: {environment_id}: {message}")]
+    #[error("environment failed: {environment_id}: {message}")]
     Failed {
         environment_id: String,
         message: String,
@@ -214,6 +215,24 @@ pub(crate) enum EnvironmentResolveError {
     #[error("environment is closed: {environment_id}")]
     Closed { environment_id: String },
 
+    /// Terminal: the registered daemon is away past its bound (gate
+    /// `Gone{Away}`, a `disconnected` refusal for an ephemeral key, or the
+    /// gateway's `away` refusal).
+    #[error("environment {environment_id} is away: {message}")]
+    Away {
+        environment_id: String,
+        message: String,
+    },
+
+    /// Retryable: the dial failed without a typed refusal (connect error,
+    /// timeout, the gateway's bodiless 503 for a provider 5xx/429/timeout,
+    /// 502, 504, a gateway restart). `status` is a short display string.
+    #[error("environment is unreachable: {environment_id} ({status})")]
+    Unreachable {
+        environment_id: String,
+        status: String,
+    },
+
     /// The environment's envd speaks another data-plane protocol version;
     /// it cannot serve this runtime until it is replaced or upgraded.
     #[error(
@@ -229,54 +248,40 @@ pub(crate) enum EnvironmentResolveError {
 /// `clientInfo.name` of readiness handshakes.
 const READINESS_CLIENT: &str = "lightspeed-environment-readiness";
 
-/// A powered-down provisioned environment wakes on use when its provider
-/// reported that it can be moved back to `running`. External environments and
-/// providers without power control keep the reachability probe.
-pub(crate) fn wake_on_use_applies(environment: &EnvironmentRecord) -> bool {
-    matches!(environment.source, EnvironmentSource::Provisioned { .. })
-        && environment.status.is_powered_down()
-        && environment
-            .incarnation
-            .power_states
-            .contains(&PowerState::Running)
-}
-
 #[cfg(test)]
 mod tests {
     use std::collections::BTreeMap;
 
-    use auth::SecretValue;
-    use environment_protocol::ids::ProviderTargetId;
+    use environment_protocol::{
+        control::target::{PowerState, TargetPhase},
+        ids::ProviderTargetId,
+        metadata::DescriptiveText,
+        routes::DataRouteRefusal,
+    };
     use environments::{
-        CreateEnvironment, EnvironmentEndpoint, EnvironmentIncarnationId,
-        EnvironmentProviderBindingId, EnvironmentProviderBindingStatus,
-        EnvironmentProviderBindingStore, EnvironmentProviderId, EnvironmentProvisionRequestId,
-        EnvironmentStatus, EnvironmentTemplateId, ObserveProvisionedEnvironment,
-        PutEnvironmentProvider, PutEnvironmentProviderBinding,
+        BeginCloseEnvironment, CreateEnvironment, CreateEnvironmentRegistrationKey,
+        CreateRegisteredEnvironment, DaemonBuild, EnvironmentCloseReason, EnvironmentEndpoint,
+        EnvironmentProviderBindingStore, EnvironmentProviderId, EnvironmentProviderStore,
+        EnvironmentProvisionRequestId, EnvironmentRegistrationKeyId,
+        EnvironmentRegistrationKeyStore, EnvironmentSource, EnvironmentTemplateId, FailEnvironment,
+        MarkRegisteredDisconnected, ObservedTarget, OpenEnvironment, ProviderCredentialChange,
+        PutEnvironmentProvider, PutEnvironmentProviderBinding, REGISTERED_RECONNECT_WAIT_MS,
+        RecordTargetObservation, RegisteredIdentityMode, RegistrationKeyPolicy,
+        WAIT_RETRY_AFTER_MS, mint_registration_key,
     };
 
     use super::*;
 
-    fn target_id() -> Option<ProviderTargetId> {
-        Some(ProviderTargetId::new("target-1").unwrap())
-    }
-
-    fn observation(
-        environment_id: &EnvironmentId,
-        status: EnvironmentStatus,
-        power_states: Vec<PowerState>,
-        observed_at_ms: i64,
-    ) -> ObserveProvisionedEnvironment {
-        ObserveProvisionedEnvironment {
-            environment_id: environment_id.clone(),
-            provider_target_id: target_id(),
-            status,
-            power_states,
-            daemon_build: None,
-            observed_at_ms,
+    fn build() -> DaemonBuild {
+        DaemonBuild {
+            version: None,
+            git_sha: None,
+            protocol_version: environment_protocol::ENVD_PROTOCOL_VERSION,
         }
     }
 
+    /// A resolver over an in-memory store holding one provisioning
+    /// environment.
     async fn resolver() -> (EnvironmentResolver, EnvironmentId) {
         let store = Arc::new(environments::InMemoryEnvironmentRegistryStore::new());
         let provider_id = EnvironmentProviderId::new("allowed");
@@ -286,8 +291,8 @@ mod tests {
                 display_name: None,
                 controller_endpoint: EnvironmentEndpoint::parse("ws://controller.test/control")
                     .unwrap(),
-                metadata: BTreeMap::new(),
-                credential: Some(SecretValue::new("provider-credential")),
+                data_route_base: None,
+                credential: ProviderCredentialChange::Keep,
                 updated_at_ms: 10,
             })
             .await
@@ -295,11 +300,8 @@ mod tests {
         store
             .put_provider_binding(PutEnvironmentProviderBinding {
                 universe_id: store.universe_id(),
-                binding_id: EnvironmentProviderBindingId::new("primary"),
                 provider_id: provider_id.clone(),
-                status: EnvironmentProviderBindingStatus::Enabled,
-                expected_revision: None,
-                metadata: BTreeMap::new(),
+                enabled: true,
                 updated_at_ms: 10,
             })
             .await
@@ -309,29 +311,114 @@ mod tests {
             .create_environment(CreateEnvironment {
                 request_id: EnvironmentProvisionRequestId::new("request-1"),
                 environment_id: environment_id.clone(),
-                incarnation_id: EnvironmentIncarnationId::new("incarnation-1"),
-                binding_id: EnvironmentProviderBindingId::new("primary"),
+                provider_id,
                 template_id: EnvironmentTemplateId::new("test-template"),
+                idle: None,
                 display_name: None,
                 metadata: BTreeMap::new(),
-                idle_policy: None,
                 created_at_ms: 10,
             })
             .await
             .expect("create environment");
+        (EnvironmentResolver::new(store), environment_id)
+    }
+
+    async fn open(store: &Arc<dyn EnvironmentStore>, environment_id: &EnvironmentId, at_ms: i64) {
         store
-            .observe_provisioned_environment(observation(
-                &environment_id,
-                EnvironmentStatus::Offline,
-                Vec::new(),
-                10,
-            ))
+            .open_environment(OpenEnvironment {
+                environment_id: environment_id.clone(),
+                daemon_build: build(),
+                at_ms,
+            })
             .await
-            .expect("environment");
-        (
-            EnvironmentResolver::new(store.clone(), store),
-            environment_id,
+            .expect("open");
+    }
+
+    async fn observe(
+        store: &Arc<dyn EnvironmentStore>,
+        environment_id: &EnvironmentId,
+        power: PowerState,
+        at_ms: i64,
+    ) {
+        store
+            .record_target_observation(RecordTargetObservation {
+                environment_id: environment_id.clone(),
+                provider_target_id: Some(ProviderTargetId::new("target-1").unwrap()),
+                observed: ObservedTarget {
+                    phase: TargetPhase::Active,
+                    power: Some(power),
+                    message: None,
+                    observed_at_ms: at_ms,
+                },
+                public_endpoint: None,
+                observed_at_ms: at_ms,
+            })
+            .await
+            .expect("observe");
+    }
+
+    /// A registered environment of a key in `mode` whose daemon
+    /// disconnected at `disconnected_at_ms`.
+    async fn disconnected_registered(
+        mode: RegisteredIdentityMode,
+        disconnected_at_ms: i64,
+    ) -> (EnvironmentResolver, EnvironmentId) {
+        let store = Arc::new(environments::InMemoryEnvironmentRegistryStore::new());
+        let minted = mint_registration_key(
+            EnvironmentRegistrationKeyId::new("rk"),
+            RegistrationKeyPolicy {
+                display_name: "fleet".to_owned(),
+                identity_mode: mode,
+                max_active_environments: None,
+                ephemeral_disconnect_grace_ms: None,
+                offline_close_after_ms: None,
+                expires_at_ms: None,
+            },
+            1,
         )
+        .unwrap();
+        let secret_hash = minted.secret.secret_hash;
+        store
+            .create_registration_key(CreateEnvironmentRegistrationKey {
+                secret_hash: secret_hash.clone(),
+                record: minted.record,
+            })
+            .await
+            .unwrap();
+        let environment_id = EnvironmentId::new("registered-1");
+        store
+            .create_registered_environment(CreateRegisteredEnvironment {
+                registration_key_id: EnvironmentRegistrationKeyId::new("rk"),
+                secret_hash,
+                environment_id: environment_id.clone(),
+                daemon_public_key: "ab".repeat(32),
+                display_name: None,
+                metadata: BTreeMap::new(),
+                daemon_build: build(),
+                created_at_ms: 10,
+            })
+            .await
+            .unwrap();
+        store
+            .mark_registered_disconnected(MarkRegisteredDisconnected {
+                environment_id: environment_id.clone(),
+                at_ms: disconnected_at_ms,
+            })
+            .await
+            .unwrap();
+        (EnvironmentResolver::new(store), environment_id)
+    }
+
+    fn refused(
+        status: u16,
+        refusal: Option<DataRouteRefusal>,
+        retry_after_ms: Option<u64>,
+    ) -> ClientError {
+        ClientError::UpgradeRejected {
+            status,
+            refusal,
+            retry_after_ms,
+        }
     }
 
     /// Counters and switches of the fake gateway route below.
@@ -527,7 +614,8 @@ mod tests {
             )
             .unwrap()
         };
-        // Offline inspection never changes desired power and never opens a data route.
+        // Neither a provisioning nor a paused environment is dialed:
+        // discovery never wakes a machine and never writes the row.
         let before = store.read_environment(&environment_id).await.unwrap();
         let unavailable = entry(refresh(None).await.unwrap());
         assert_eq!(route.counts(), (0, 0, 0));
@@ -536,15 +624,11 @@ mod tests {
             before
         );
         assert!(refresh(Some(&unavailable)).await.unwrap().is_none());
-        store
-            .observe_provisioned_environment(observation(
-                &environment_id,
-                EnvironmentStatus::Ready,
-                vec![PowerState::Running, PowerState::Paused],
-                20,
-            ))
-            .await
-            .unwrap();
+        open(&store, &environment_id, 20).await;
+        observe(&store, &environment_id, PowerState::Paused, 21).await;
+        assert!(refresh(Some(&unavailable)).await.unwrap().is_none());
+        assert_eq!(route.counts(), (0, 0, 0));
+        observe(&store, &environment_id, PowerState::Running, 22).await;
         let available = entry(refresh(Some(&unavailable)).await.unwrap());
         let catalog = catalog_of(&available).await;
         assert_eq!(
@@ -768,19 +852,20 @@ mod tests {
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn offline_environment_without_gateway_is_unavailable_but_readable() {
+    async fn an_open_environment_without_a_gateway_resolves_but_is_unreachable() {
         let (resolver, environment_id) = resolver().await;
+        open(&resolver.environments, &environment_id, 20).await;
         assert!(resolver.read(&environment_id).await.is_ok());
         assert!(
             resolver
                 .resolve_for_connection(&environment_id, 111)
                 .await
                 .is_ok(),
-            "execution resolution should defer reachability to the real connection"
+            "execution resolution defers reachability to the real connection"
         );
         assert!(matches!(
             resolver.ready_for_use(&environment_id, 111).await,
-            Err(EnvironmentResolveError::EnvironmentUnavailable { .. })
+            Err(EnvironmentResolveError::Unreachable { .. })
         ));
     }
 
@@ -789,16 +874,7 @@ mod tests {
         use environment_protocol::{error::ProtocolError, jsonrpc};
         use futures_util::{SinkExt, StreamExt};
         let (resolver, environment_id) = resolver().await;
-        resolver
-            .environments
-            .observe_provisioned_environment(observation(
-                &environment_id,
-                EnvironmentStatus::Ready,
-                vec![PowerState::Running],
-                20,
-            ))
-            .await
-            .unwrap();
+        open(&resolver.environments, &environment_id, 20).await;
         let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
         let base_url = format!("http://{}", listener.local_addr().unwrap());
         let remote = environment_protocol::ENVD_PROTOCOL_VERSION + 1;
@@ -843,272 +919,255 @@ mod tests {
         task.abort();
     }
 
-    #[tokio::test(flavor = "current_thread")]
-    async fn selection_preserves_power_and_needs_no_gateway_in_any_nonterminal_state() {
-        let (resolver, environment_id) = resolver().await;
-        let store = resolver.environments.clone();
-        store
-            .set_environment_power(SetEnvironmentPower {
-                environment_id: environment_id.clone(),
-                desired_power: PowerState::Paused,
-                updated_at_ms: 20,
-            })
-            .await
-            .unwrap();
-        for status in [
-            EnvironmentStatus::Provisioning,
-            EnvironmentStatus::Booting,
-            EnvironmentStatus::Ready,
-            EnvironmentStatus::Paused,
-            EnvironmentStatus::Suspended,
-            EnvironmentStatus::Offline,
-            EnvironmentStatus::Unknown,
-        ] {
-            store
-                .observe_provisioned_environment(observation(
-                    &environment_id,
-                    status,
-                    vec![PowerState::Running, PowerState::Paused],
-                    30,
-                ))
-                .await
-                .unwrap();
-            let before = store.read_environment(&environment_id).await.unwrap();
-            for _ in 0..2 {
-                let selected = resolver
-                    .selectable(&environment_id)
-                    .await
-                    .expect("selection requires only valid registry state");
-                assert_eq!(selected, before);
-                assert_eq!(
-                    store.read_environment(&environment_id).await.unwrap(),
-                    before
+    /// Serve one HTTP refusal per connection instead of an upgrade.
+    async fn serve_refusal(
+        status: &'static str,
+        body: &'static str,
+        retry_after: Option<u64>,
+    ) -> String {
+        use tokio::io::{AsyncReadExt, AsyncWriteExt};
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let base_url = format!("http://{}", listener.local_addr().unwrap());
+        tokio::spawn(async move {
+            loop {
+                let Ok((mut socket, _)) = listener.accept().await else {
+                    return;
+                };
+                let mut request = Vec::new();
+                let mut buffer = [0_u8; 1024];
+                while !request.windows(4).any(|window| window == b"\r\n\r\n") {
+                    match socket.read(&mut buffer).await {
+                        Ok(0) | Err(_) => break,
+                        Ok(read) => request.extend_from_slice(&buffer[..read]),
+                    }
+                }
+                let retry = retry_after
+                    .map(|seconds| format!("Retry-After: {seconds}\r\n"))
+                    .unwrap_or_default();
+                let response = format!(
+                    "HTTP/1.1 {status}\r\nContent-Type: application/json\r\n{retry}Content-Length: {}\r\nConnection: close\r\n\r\n{body}",
+                    body.len()
                 );
+                let _ = socket.write_all(response.as_bytes()).await;
+                let _ = socket.shutdown().await;
             }
-        }
+        });
+        base_url
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn reselection_checks_terminal_status() {
+    async fn a_typed_route_refusal_maps_to_wait_or_gone_and_a_bodiless_one_is_unreachable() {
         let (resolver, environment_id) = resolver().await;
-        let store = resolver.environments.clone();
-        resolver.selectable(&environment_id).await.unwrap();
+        open(&resolver.environments, &environment_id, 20).await;
+        let with_route = |base_url: String| {
+            resolver.clone().with_gateway(
+                crate::environments::gateway::EnvironmentGatewayClientConfig::new(base_url, "test"),
+            )
+        };
+        let waking = with_route(
+            serve_refusal("503 Service Unavailable", r#"{"state":"waking"}"#, Some(3)).await,
+        );
         assert!(matches!(
-            resolver.selectable(&EnvironmentId::new("missing")).await,
-            Err(EnvironmentResolveError::Store(
-                EnvironmentRegistryError::NotFound { .. }
-            ))
-        ));
-        store
-            .fail_environment_lifecycle(environments::FailEnvironmentLifecycle {
-                environment_id: environment_id.clone(),
-                message: "no capacity".into(),
-                daemon_build: None,
-                observed_at_ms: 40,
+            waking.ready_for_use(&environment_id, 30).await,
+            Err(EnvironmentResolveError::NotReady {
+                reason: EnvironmentWaitReason::Waking,
+                retry_after_ms: 3_000,
+                until_ms: None,
+                ..
             })
-            .await
-            .unwrap();
-        assert!(matches!(
-            resolver.selectable(&environment_id).await,
-            Err(EnvironmentResolveError::Failed { .. })
         ));
-        store
-            .begin_close_environment(environments::BeginCloseEnvironment {
-                environment_id: environment_id.clone(),
-                updated_at_ms: 50,
-            })
-            .await
-            .unwrap();
+        let gone = with_route(serve_refusal("410 Gone", r#"{"state":"gone"}"#, None).await);
         assert!(matches!(
-            resolver.selectable(&environment_id).await,
+            gone.ready_for_use(&environment_id, 30).await,
             Err(EnvironmentResolveError::Closed { .. })
         ));
+        let failed = with_route(
+            serve_refusal(
+                "409 Conflict",
+                r#"{"state":"failed","message":"disk"}"#,
+                None,
+            )
+            .await,
+        );
+        assert!(matches!(
+            failed.ready_for_use(&environment_id, 30).await,
+            Err(EnvironmentResolveError::Failed { message, .. }) if message == "disk"
+        ));
+        let bodiless = with_route(serve_refusal("503 Service Unavailable", "", None).await);
+        assert!(matches!(
+            bodiless.ready_for_use(&environment_id, 30).await,
+            Err(EnvironmentResolveError::Unreachable { .. })
+        ));
+        // Nothing the readiness dial learns is written.
+        let record = resolver.read(&environment_id).await.unwrap();
+        assert_eq!(record.state, EnvironmentState::Open);
+        assert_eq!(record.updated_at_ms, 20);
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn use_cancels_a_pending_power_down() {
-        let (resolver, environment_id) = resolver().await;
-        let store = resolver.environments.clone();
-        store
-            .observe_provisioned_environment(observation(
-                &environment_id,
-                EnvironmentStatus::Ready,
-                vec![PowerState::Running, PowerState::Paused],
-                20,
-            ))
-            .await
-            .expect("observe");
-        // The reaper decided to pause; the reconciler has not acted yet.
-        store
-            .set_environment_power(SetEnvironmentPower {
-                environment_id: environment_id.clone(),
-                desired_power: PowerState::Paused,
-                updated_at_ms: 21,
+    async fn a_disconnected_refusal_follows_the_identity_mode() {
+        let disconnected = refused(503, Some(DataRouteRefusal::Disconnected {}), Some(2_000));
+        let (persistent, persistent_id) =
+            disconnected_registered(RegisteredIdentityMode::Persistent, 50).await;
+        // The row still reads connected in the window this refusal covers.
+        let mut record = persistent.read(&persistent_id).await.unwrap();
+        if let EnvironmentSource::Registered(source) = &mut record.source {
+            source.connected = true;
+        }
+        assert!(matches!(
+            route_refusal_error(&record, &disconnected),
+            Some(EnvironmentResolveError::NotReady {
+                reason: EnvironmentWaitReason::Disconnected,
+                until_ms: None,
+                ..
             })
-            .await
-            .expect("pause intent");
-
-        let resolved = resolver
-            .resolve_for_connection(&environment_id, 30)
-            .await
-            .expect("a ready environment resolves for use");
-        assert_eq!(resolved.status, EnvironmentStatus::Ready);
-        assert_eq!(resolved.desired_power, PowerState::Running);
-        let stored = store.read_environment(&environment_id).await.expect("read");
-        assert_eq!(stored.desired_power, PowerState::Running);
-        assert!(!stored.power_diverges());
-        assert_eq!(stored.updated_at_ms, 30);
+        ));
+        let (ephemeral, ephemeral_id) =
+            disconnected_registered(RegisteredIdentityMode::Ephemeral, 50).await;
+        let record = ephemeral.read(&ephemeral_id).await.unwrap();
+        assert!(matches!(
+            route_refusal_error(&record, &disconnected),
+            Some(EnvironmentResolveError::Away { .. })
+        ));
+        assert!(matches!(
+            route_refusal_error(
+                &record,
+                &refused(410, Some(DataRouteRefusal::Away {}), None)
+            ),
+            Some(EnvironmentResolveError::Away { .. })
+        ));
+        assert!(route_refusal_error(&record, &refused(502, None, None)).is_none());
+        let failed = DataRouteRefusal::Failed {
+            message: DescriptiveText::new("broken").unwrap(),
+        };
+        assert!(matches!(
+            route_refusal_error(&record, &refused(409, Some(failed), None)),
+            Some(EnvironmentResolveError::Failed { .. })
+        ));
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn powered_down_environment_with_power_control_wakes_on_use() {
-        let (resolver, environment_id) = resolver().await;
-        let store = resolver.environments.clone();
-        let observe = |status: EnvironmentStatus, at: i64| {
-            let store = store.clone();
-            let environment_id = environment_id.clone();
-            async move {
-                store
-                    .observe_provisioned_environment(observation(
-                        &environment_id,
-                        status,
-                        vec![PowerState::Running, PowerState::Paused],
-                        at,
-                    ))
-                    .await
-                    .expect("observe");
-            }
-        };
-        observe(EnvironmentStatus::Ready, 20).await;
-        store
-            .set_environment_power(SetEnvironmentPower {
-                environment_id: environment_id.clone(),
-                desired_power: PowerState::Paused,
-                updated_at_ms: 21,
-            })
+    async fn a_disconnected_persistent_daemon_is_waited_for_until_its_bound() {
+        let (resolver, environment_id) =
+            disconnected_registered(RegisteredIdentityMode::Persistent, 1_000).await;
+        let until = 1_000 + REGISTERED_RECONNECT_WAIT_MS;
+        match resolver
+            .resolve_for_connection(&environment_id, 2_000)
             .await
-            .expect("pause intent");
-        observe(EnvironmentStatus::Paused, 22).await;
-
-        // Using a paused environment requests a wake and reports it as
-        // not ready instead of probing an unreachable daemon.
-        assert!(matches!(
-            resolver.ready_for_use(&environment_id, 30).await,
+        {
             Err(EnvironmentResolveError::NotReady {
-                status: EnvironmentStatus::Paused,
+                reason: EnvironmentWaitReason::Disconnected,
+                retry_after_ms,
+                until_ms,
                 ..
-            })
-        ));
-        let woken = store.read_environment(&environment_id).await.expect("read");
-        assert_eq!(woken.desired_power, PowerState::Running);
-        assert!(woken.power_diverges());
-        // Activation admits it as intent.
-        let record = resolver
-            .selectable(&environment_id)
-            .await
-            .expect("activation admits a paused environment");
-        assert_eq!(record.status, EnvironmentStatus::Paused);
-
-        // Once the provider observed it running again the ordinary probe
-        // path applies (no gateway here → unavailable, not NotReady).
-        observe(EnvironmentStatus::Ready, 40).await;
+            }) => {
+                assert_eq!(retry_after_ms, WAIT_RETRY_AFTER_MS);
+                assert_eq!(until_ms, Some(until));
+            }
+            other => panic!("expected a bounded wait, got {other:?}"),
+        }
         assert!(matches!(
-            resolver.ready_for_use(&environment_id, 50).await,
-            Err(EnvironmentResolveError::EnvironmentUnavailable { .. })
+            resolver
+                .resolve_for_connection(&environment_id, until)
+                .await,
+            Err(EnvironmentResolveError::Away { .. })
         ));
-
-        // A stopped environment whose provider offers no power control keeps
-        // the old behaviour: no wake, plain unavailability.
-        store
-            .observe_provisioned_environment(observation(
-                &environment_id,
-                EnvironmentStatus::Offline,
-                Vec::new(),
-                60,
-            ))
-            .await
-            .expect("observe offline without power control");
+        // Selection still accepts it: the daemon may come back.
+        assert!(resolver.selectable(&environment_id).await.is_ok());
+        let (ephemeral, ephemeral_id) =
+            disconnected_registered(RegisteredIdentityMode::Ephemeral, 1_000).await;
         assert!(matches!(
-            resolver.ready_for_use(&environment_id, 70).await,
-            Err(EnvironmentResolveError::EnvironmentUnavailable { .. })
+            ephemeral.resolve_for_connection(&ephemeral_id, 1_001).await,
+            Err(EnvironmentResolveError::Away { .. })
         ));
-        assert_eq!(
-            store
-                .read_environment(&environment_id)
-                .await
-                .expect("read")
-                .desired_power,
-            PowerState::Running
-        );
     }
 
     #[tokio::test(flavor = "current_thread")]
-    async fn readiness_is_status_aware() {
+    async fn the_gate_waits_while_provisioning_and_selection_never_writes() {
         let (resolver, environment_id) = resolver().await;
         let store = resolver.environments.clone();
-        let observe = |status: EnvironmentStatus| {
-            let store = store.clone();
-            let environment_id = environment_id.clone();
-            async move {
-                store
-                    .observe_provisioned_environment(observation(
-                        &environment_id,
-                        status,
-                        Vec::new(),
-                        20,
-                    ))
-                    .await
-                    .expect("observe");
-            }
-        };
-
-        // A provisioning/booting environment is admitted as intent without a
-        // probe and reported as not ready.
-        observe(EnvironmentStatus::Provisioning).await;
         assert!(matches!(
             resolver.ready_for_use(&environment_id, 30).await,
             Err(EnvironmentResolveError::NotReady {
-                status: EnvironmentStatus::Provisioning,
+                reason: EnvironmentWaitReason::Provisioning,
+                retry_after_ms: WAIT_RETRY_AFTER_MS,
+                until_ms: None,
                 ..
             })
         ));
-        observe(EnvironmentStatus::Booting).await;
+        for step in 0..3 {
+            match step {
+                1 => open(&store, &environment_id, 20).await,
+                2 => observe(&store, &environment_id, PowerState::Suspended, 21).await,
+                _ => {}
+            }
+            let before = store.read_environment(&environment_id).await.unwrap();
+            for _ in 0..2 {
+                let selected = resolver
+                    .selectable(&environment_id)
+                    .await
+                    .expect("selection requires only valid registry state");
+                assert_eq!(selected, before);
+                resolver
+                    .resolve_for_connection(&environment_id, 30)
+                    .await
+                    .ok();
+                assert_eq!(
+                    store.read_environment(&environment_id).await.unwrap(),
+                    before
+                );
+            }
+        }
+        // A suspended environment is usable: the dial wakes it.
+        assert!(
+            resolver
+                .resolve_for_connection(&environment_id, 30)
+                .await
+                .is_ok()
+        );
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn failed_and_closed_environments_are_gone() {
+        let (resolver, environment_id) = resolver().await;
+        let store = resolver.environments.clone();
         assert!(matches!(
-            resolver.ready_for_use(&environment_id, 30).await,
-            Err(EnvironmentResolveError::NotReady {
-                status: EnvironmentStatus::Booting,
-                ..
-            })
+            resolver.selectable(&EnvironmentId::new("missing")).await,
+            Err(EnvironmentResolveError::Store(
+                EnvironmentRegistryError::NotFound { .. }
+            ))
         ));
-        let record = resolver
-            .selectable(&environment_id)
-            .await
-            .expect("activation admits a booting environment");
-        assert_eq!(record.status, EnvironmentStatus::Booting);
-
         store
-            .fail_environment_lifecycle(environments::FailEnvironmentLifecycle {
+            .fail_environment(FailEnvironment {
                 environment_id: environment_id.clone(),
-                message: "no capacity".to_owned(),
+                message: "no capacity".into(),
                 daemon_build: None,
-                observed_at_ms: 40,
+                at_ms: 40,
             })
             .await
-            .expect("fail");
+            .unwrap();
+        assert!(matches!(
+            resolver.selectable(&environment_id).await,
+            Err(EnvironmentResolveError::Failed { message, .. }) if message == "no capacity"
+        ));
         assert!(matches!(
             resolver.ready_for_use(&environment_id, 50).await,
             Err(EnvironmentResolveError::Failed { message, .. }) if message == "no capacity"
         ));
-
         store
-            .begin_close_environment(environments::BeginCloseEnvironment {
+            .begin_close_environment(BeginCloseEnvironment {
                 environment_id: environment_id.clone(),
-                updated_at_ms: 60,
+                reason: EnvironmentCloseReason::Requested,
+                at_ms: 50,
             })
             .await
-            .expect("close");
+            .unwrap();
+        assert!(matches!(
+            resolver.selectable(&environment_id).await,
+            Err(EnvironmentResolveError::Closed { .. })
+        ));
         assert!(matches!(
-            resolver.ready_for_use(&environment_id, 70).await,
+            resolver.resolve_for_connection(&environment_id, 60).await,
             Err(EnvironmentResolveError::Closed { .. })
         ));
     }
diff --git a/crates/temporal-runtime/src/environments/runtime.rs b/crates/temporal-runtime/src/environments/runtime.rs
index db785bbf1..7db09c04b 100644
--- a/crates/temporal-runtime/src/environments/runtime.rs
+++ b/crates/temporal-runtime/src/environments/runtime.rs
@@ -81,11 +81,12 @@ impl RuntimeEnvironment {
 /// context for this invocation.
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub enum ActiveEnvironmentBlocker {
-    /// The environment exists and is provisioning or booting; the call must
+    /// The environment exists but cannot serve calls yet (provisioning,
+    /// waking, booting, or a registered daemon reconnecting); the call must
     /// wait rather than fail.
     NotReady {
         environment_id: String,
-        status: environments::EnvironmentStatus,
+        reason: environments::EnvironmentWaitReason,
     },
     /// The environment cannot serve calls (failed, closed, unreachable, or
     /// not allowed); the call fails with this message.
@@ -141,9 +142,8 @@ mod tests {
 
     use environment_protocol::ids::ProviderTargetId;
     use environments::{
-        EnvironmentIncarnationId, EnvironmentIncarnationRecord, EnvironmentProviderBindingId,
-        EnvironmentProviderId, EnvironmentProvisionRequestId, EnvironmentSource, EnvironmentStatus,
-        EnvironmentTemplateId,
+        EnvironmentProviderId, EnvironmentProvisionRequestId, EnvironmentSource, EnvironmentState,
+        EnvironmentTemplateId, ProvisionedSource,
     };
     use harness::storage::InMemoryBlobStore;
     use tools::fs::{FsPath, FsToolContext, InMemoryFileSystem};
@@ -151,35 +151,29 @@ mod tests {
     use super::*;
 
     fn resource() -> EnvironmentRecord {
-        let target_id = ProviderTargetId::new("target-a").unwrap();
         EnvironmentRecord {
             environment_id: harness::EnvironmentId::new("environment-a"),
-            request_id: EnvironmentProvisionRequestId::new("request-a"),
-            source: EnvironmentSource::Provisioned {
+            request_id: Some(EnvironmentProvisionRequestId::new("request-a")),
+            source: EnvironmentSource::Provisioned(ProvisionedSource {
                 provider_id: EnvironmentProviderId::new("provider-a"),
-                binding_id: EnvironmentProviderBindingId::new("binding-a"),
-            },
+                template_id: EnvironmentTemplateId::new("template-a"),
+                idle: None,
+                provider_target_id: Some(ProviderTargetId::new("target-a").unwrap()),
+                observed: None,
+                public_endpoint: None,
+                next_attempt_at_ms: None,
+                attempts: 0,
+            }),
             display_name: None,
-            status: EnvironmentStatus::Offline,
-            desired_power: environments::PowerState::Running,
-            idle_policy: None,
-            incarnation: EnvironmentIncarnationRecord {
-                incarnation_id: EnvironmentIncarnationId::new("incarnation-a"),
-                provision_request_id: Some(EnvironmentProvisionRequestId::new("request-a")),
-                provider_target_id: Some(target_id.clone()),
-                template_id: Some(EnvironmentTemplateId::new("template-a")),
-                adoption_source_target: None,
-                power_states: Vec::new(),
-                created_at_ms: 1,
-                updated_at_ms: 1,
-            },
-            public_ingress_enabled: false,
-            public_endpoint: None,
             metadata: BTreeMap::from([("fsRoot".to_owned(), "/sandbox".to_owned())]),
-            last_seen_at_ms: None,
-            lifecycle_error: None,
+            state: EnvironmentState::Open,
+            state_message: None,
+            close_reason: None,
+            state_changed_at_ms: 1,
+            daemon_build: None,
             created_at_ms: 1,
             updated_at_ms: 1,
+            closed_at_ms: None,
         }
     }
 
diff --git a/crates/temporal-runtime/src/environments/signals.rs b/crates/temporal-runtime/src/environments/signals.rs
new file mode 100644
index 000000000..917cefc10
--- /dev/null
+++ b/crates/temporal-runtime/src/environments/signals.rs
@@ -0,0 +1,122 @@
+//! Process-local environment signals: the reconciler's work nudge and the
+//! revocation of live environment routes.
+//!
+//! One instance per process. A process without the environment-gateway
+//! role has no subscribers, so its signals reach nothing; the gateway's own
+//! sweeps catch up within one sweep interval.
+
+use std::{
+    collections::HashMap,
+    sync::{Mutex, PoisonError},
+};
+
+use tokio::sync::{Notify, watch};
+use uuid::Uuid;
+
+/// Process-local environment signals. One instance per process; processes
+/// without the environment-gateway role have no subscribers, and the
+/// gateway's sweeps catch up within one sweep interval.
+#[derive(Default)]
+pub struct EnvironmentSignals {
+    work: Notify,
+    routes: Mutex<HashMap<(Uuid, String), watch::Sender<u64>>>,
+}
+
+impl EnvironmentSignals {
+    /// Wake the reconciler now instead of at its next tick. A nudge with no
+    /// reconciler waiting is kept until one waits.
+    pub fn nudge_work(&self) {
+        self.work.notify_one();
+    }
+
+    /// Resolves at the next nudge.
+    pub async fn work_nudged(&self) {
+        self.work.notified().await;
+    }
+
+    /// Subscribe a live control connection or data route to the
+    /// environment's revocation: the receiver changes on every revoke.
+    pub fn watch(&self, universe_id: Uuid, environment_id: &str) -> watch::Receiver<u64> {
+        let mut routes = self.routes.lock().unwrap_or_else(PoisonError::into_inner);
+        routes
+            .entry((universe_id, environment_id.to_owned()))
+            .or_insert_with(|| watch::channel(0).0)
+            .subscribe()
+    }
+
+    /// End every live route of the environment; a control connection
+    /// re-reads its row and sends `registration/closed` if it is closed.
+    /// No-op without subscribers.
+    pub fn revoke(&self, universe_id: Uuid, environment_id: &str) {
+        let mut routes = self.routes.lock().unwrap_or_else(PoisonError::into_inner);
+        let key = (universe_id, environment_id.to_owned());
+        let Some(sender) = routes.get(&key) else {
+            return;
+        };
+        if sender.receiver_count() == 0 {
+            routes.remove(&key);
+            return;
+        }
+        sender.send_modify(|revision| *revision = revision.wrapping_add(1));
+    }
+
+    /// Keys with live subscribers; prunes senders without receivers.
+    pub fn watched(&self) -> Vec<(Uuid, String)> {
+        let mut routes = self.routes.lock().unwrap_or_else(PoisonError::into_inner);
+        routes.retain(|_, sender| sender.receiver_count() > 0);
+        routes.keys().cloned().collect()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::time::Duration;
+
+    use super::*;
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn a_nudge_before_the_wait_is_kept() {
+        let signals = EnvironmentSignals::default();
+        signals.nudge_work();
+        tokio::time::timeout(Duration::from_secs(1), signals.work_nudged())
+            .await
+            .expect("the stored nudge wakes the waiter");
+        assert!(
+            tokio::time::timeout(Duration::from_millis(20), signals.work_nudged())
+                .await
+                .is_err(),
+            "one nudge wakes one wait"
+        );
+    }
+
+    #[test]
+    fn revoke_reaches_every_subscriber_of_the_environment_only() {
+        let signals = EnvironmentSignals::default();
+        let universe = Uuid::new_v4();
+        let first = signals.watch(universe, "environment_a");
+        let second = signals.watch(universe, "environment_a");
+        let other = signals.watch(universe, "environment_b");
+        signals.revoke(universe, "environment_a");
+        assert!(first.has_changed().unwrap());
+        assert!(second.has_changed().unwrap());
+        assert!(!other.has_changed().unwrap());
+        // Unknown environments and other universes are no-ops.
+        signals.revoke(universe, "environment_missing");
+        signals.revoke(Uuid::new_v4(), "environment_b");
+        assert!(!other.has_changed().unwrap());
+    }
+
+    #[test]
+    fn watched_lists_live_subscriptions_and_prunes_dropped_ones() {
+        let signals = EnvironmentSignals::default();
+        let universe = Uuid::new_v4();
+        let kept = signals.watch(universe, "environment_a");
+        drop(signals.watch(universe, "environment_b"));
+        assert_eq!(
+            signals.watched(),
+            vec![(universe, "environment_a".to_owned())]
+        );
+        drop(kept);
+        assert!(signals.watched().is_empty());
+    }
+}
diff --git a/crates/temporal-runtime/src/environments/sources.rs b/crates/temporal-runtime/src/environments/sources.rs
index 9f66bdbaf..1fee51af7 100644
--- a/crates/temporal-runtime/src/environments/sources.rs
+++ b/crates/temporal-runtime/src/environments/sources.rs
@@ -54,7 +54,7 @@ pub(crate) struct SourceConnection {
     pub client: DataClient,
     pub initialized: InitializeResponse,
     pub cwd: EnvironmentPath,
-    // Includes universe and incarnation so cached observations cannot cross routes.
+    // Includes the universe so cached observations cannot cross routes.
     pub identity: String,
 }
 
@@ -190,23 +190,30 @@ async fn connect(
         let _timer = PhaseTimer::new("registry");
         resolver.read(id).await.map_err(|e| e.to_string())?
     };
-    if environment.status != environments::EnvironmentStatus::Ready
-        || environment.desired_power != environments::PowerState::Running
+    // A data route dial wakes a powered-down target, and discovery must
+    // never do that. A usable row whose last observation shows it powered
+    // down (or otherwise not ready) is skipped. The observation can be
+    // stale (providers power targets down on their own clock, and a dial
+    // wakes them without a write), so the dial also asks the gateway to
+    // check the provider first.
+    let now_ms = crate::environments::lifecycle::clock_ms();
+    if environment.use_gate(now_ms) != environments::EnvironmentUse::Use
+        || environment.display_status() != environments::EnvironmentDisplayStatus::Ready
     {
         return Err("environment is not accessible; discovery does not wake it".into());
     }
     let endpoint = gateway.endpoint_for(resolver.universe_id(), &environment);
-    let identity = serde_json::to_string(&(
-        resolver.universe_id(),
-        environment.environment_id.as_str(),
-        environment.incarnation.incarnation_id.as_str(),
-    ))
-    .map_err(|e| e.to_string())?;
+    let identity =
+        serde_json::to_string(&(resolver.universe_id(), environment.environment_id.as_str()))
+            .map_err(|e| e.to_string())?;
     let (client, initialized) = {
         let _timer = PhaseTimer::new("connect");
-        DataClient::connect_initialized(&endpoint, gateway.connect_options(SOURCE_DISCOVERY_CLIENT))
-            .await
-            .map_err(|e| e.to_string())?
+        DataClient::connect_initialized(
+            &endpoint,
+            gateway.no_wake_connect_options(SOURCE_DISCOVERY_CLIENT),
+        )
+        .await
+        .map_err(|e| e.to_string())?
     };
     if initialized.capabilities.filesystem.is_none() {
         let _ = client.close().await;
diff --git a/crates/temporal-runtime/src/gateway/deployment.rs b/crates/temporal-runtime/src/gateway/deployment.rs
index ef63f75b0..705706d18 100644
--- a/crates/temporal-runtime/src/gateway/deployment.rs
+++ b/crates/temporal-runtime/src/gateway/deployment.rs
@@ -18,28 +18,24 @@ use api::{
     AgentApiError, AgentApiOutcome, DeploymentApiKeyCreateParams, DeploymentApiKeyCreateResponse,
     DeploymentApiKeyListParams, DeploymentApiKeyListResponse, DeploymentApiKeyRevokeParams,
     DeploymentApiKeyRevokeResponse, DeploymentApiKeyRotateParams, DeploymentApiKeyView,
-    DeploymentApiService, DeploymentEnvironmentAdoptParams, DeploymentEnvironmentAdoptResponse,
-    DeploymentEnvironmentProviderDeleteParams, DeploymentEnvironmentProviderDeleteResponse,
-    DeploymentEnvironmentProviderFeaturesView, DeploymentEnvironmentProviderListParams,
+    DeploymentApiService, DeploymentEnvironmentProviderDeleteParams,
+    DeploymentEnvironmentProviderDeleteResponse, DeploymentEnvironmentProviderListParams,
     DeploymentEnvironmentProviderListResponse, DeploymentEnvironmentProviderPutParams,
     DeploymentEnvironmentProviderPutResponse, DeploymentEnvironmentProviderReadParams,
-    DeploymentEnvironmentProviderReadResponse, DeploymentEnvironmentProviderView,
-    DeploymentProviderBindingDeleteParams, DeploymentProviderBindingDeleteResponse,
-    DeploymentProviderBindingPutParams, DeploymentProviderBindingPutResponse,
-    DeploymentUniverseCreateParams, DeploymentUniverseCreateResponse,
-    DeploymentUniverseDeleteParams, DeploymentUniverseDeleteResponse, DeploymentUniverseListParams,
-    DeploymentUniverseListResponse, DeploymentUniverseReadParams, DeploymentUniverseReadResponse,
-    DeploymentUniverseView,
+    DeploymentEnvironmentProviderReadResponse, DeploymentProviderBindingDeleteParams,
+    DeploymentProviderBindingDeleteResponse, DeploymentProviderBindingPutParams,
+    DeploymentProviderBindingPutResponse, DeploymentUniverseCreateParams,
+    DeploymentUniverseCreateResponse, DeploymentUniverseDeleteParams,
+    DeploymentUniverseDeleteResponse, DeploymentUniverseListParams, DeploymentUniverseListResponse,
+    DeploymentUniverseReadParams, DeploymentUniverseReadResponse, DeploymentUniverseView,
 };
 use async_trait::async_trait;
 use auth::SecretValue;
+use environment_protocol::routes::DataRouteBase;
 use environments::{
-    AdoptEnvironment, EnvironmentEndpoint, EnvironmentId, EnvironmentIncarnationId,
-    EnvironmentProviderBindingId, EnvironmentProviderBindingStatus,
-    EnvironmentProviderBindingStore, EnvironmentProviderId, EnvironmentProviderRecord,
-    EnvironmentProviderStore, EnvironmentProvisionRequestId, EnvironmentRegistryError,
-    EnvironmentStore, ListEnvironmentProviders, PutEnvironmentProvider,
-    PutEnvironmentProviderBinding, RecordProviderController,
+    EnvironmentEndpoint, EnvironmentProviderBindingStore, EnvironmentProviderId,
+    EnvironmentProviderStore, EnvironmentRegistryError, ProviderCredentialChange,
+    PutEnvironmentProvider, PutEnvironmentProviderBinding,
 };
 use harness::SessionId;
 use object_store::ObjectStoreExt as _;
@@ -49,8 +45,9 @@ use temporalio_client::{Client, WorkflowTerminateOptions, errors::WorkflowIntera
 use uuid::Uuid;
 
 use crate::{
-    environments::provider_controllers::{
-        ControllerFeature, WebSocketProviderControllerConnector, probe_controller,
+    environments::{
+        provider_controllers::{WebSocketProviderControllerConnector, probe_controller},
+        providers::environment_provider_view,
     },
     universe::UniverseRuntime,
 };
@@ -273,63 +270,75 @@ impl DeploymentApiService for GatewayDeploymentApi {
                 .map_err(|error| {
                     AgentApiError::invalid_request(format!("invalid controller endpoint: {error}"))
                 })?;
-            let credential = params.credential.map(SecretValue::new);
-            if let Some(credential) = &credential {
-                environments::validate_provider_credential(credential)
-                    .map_err(super::service::environment_providers::map_environments_error)?;
-            }
-            // The handshake presents the credential the provider will hold:
-            // the new one, else the stored one.
-            let presented = match &credential {
-                Some(credential) => Some(credential.clone()),
-                None => match store.read_provider_credential(&provider_id).await {
-                    Ok(stored) => Some(stored),
-                    Err(EnvironmentRegistryError::NotFound { .. }) => None,
-                    Err(error) => {
-                        return Err(
-                            super::service::environment_providers::map_environments_error(error),
-                        );
-                    }
-                },
+            let data_route_base = params
+                .data_route_base
+                .map(DataRouteBase::new)
+                .transpose()
+                .map_err(|error| {
+                    AgentApiError::invalid_request(format!("invalid data route base: {error}"))
+                })?;
+            let credential = match (params.credential, params.clear_credential) {
+                (Some(_), true) => {
+                    return Err(AgentApiError::invalid_request(
+                        "credential and clearCredential are mutually exclusive",
+                    ));
+                }
+                (Some(credential), false) => {
+                    let credential = SecretValue::new(credential);
+                    environments::validate_provider_credential(&credential)
+                        .map_err(super::service::environment_providers::map_environments_error)?;
+                    ProviderCredentialChange::Set(credential)
+                }
+                (None, true) => ProviderCredentialChange::Clear,
+                (None, false) => ProviderCredentialChange::Keep,
+            };
+            let request = PutEnvironmentProvider {
+                provider_id: provider_id.clone(),
+                display_name: params.display_name,
+                controller_endpoint: controller_endpoint.clone(),
+                data_route_base,
+                credential,
+                updated_at_ms: i64::try_from(current_time_ms()?)
+                    .map_err(|_| AgentApiError::internal("current timestamp exceeds i64"))?,
             };
-            let facts = match &presented {
-                Some(credential) => {
-                    probe_controller(
-                        &WebSocketProviderControllerConnector,
-                        &controller_endpoint,
-                        credential,
-                    )
-                    .await?
+            // Refuse a configuration the store would refuse (a unix://
+            // controller without a data route base, a downgrading base)
+            // before dialing anything.
+            request
+                .clone()
+                .into_record(None)
+                .map_err(super::service::environment_providers::map_environments_error)?;
+            // The handshake presents the credential the provider will hold.
+            let presented = match &request.credential {
+                ProviderCredentialChange::Set(credential) => Some(credential.clone()),
+                ProviderCredentialChange::Clear => None,
+                ProviderCredentialChange::Keep => {
+                    match store.read_provider_credential(&provider_id).await {
+                        Ok(stored) => stored,
+                        Err(EnvironmentRegistryError::NotFound { .. }) => None,
+                        Err(error) => {
+                            return Err(
+                                super::service::environment_providers::map_environments_error(
+                                    error,
+                                ),
+                            );
+                        }
+                    }
                 }
-                None => None,
             };
+            probe_controller(
+                &WebSocketProviderControllerConnector,
+                &controller_endpoint,
+                presented.as_ref(),
+            )
+            .await?;
             let provider = store
-                .put_provider(PutEnvironmentProvider {
-                    provider_id: provider_id.clone(),
-                    display_name: params.display_name,
-                    controller_endpoint: controller_endpoint.clone(),
-                    metadata: params.metadata,
-                    credential,
-                    updated_at_ms: i64::try_from(current_time_ms()?)
-                        .map_err(|_| AgentApiError::internal("current timestamp exceeds i64"))?,
-                })
+                .put_provider(request)
                 .await
                 .map_err(super::service::environment_providers::map_environments_error)?;
-            let provider = match facts {
-                Some((features, data_route_base)) => store
-                    .record_provider_controller(RecordProviderController {
-                        provider_id,
-                        controller_endpoint,
-                        features,
-                        data_route_base,
-                    })
-                    .await
-                    .map_err(super::service::environment_providers::map_environments_error)?,
-                None => provider,
-            };
             Ok(AgentApiOutcome::new(
                 DeploymentEnvironmentProviderPutResponse {
-                    provider: environment_provider_view(provider),
+                    provider: environment_provider_view(&provider),
                 },
             ))
         })
@@ -343,15 +352,12 @@ impl DeploymentApiService for GatewayDeploymentApi {
         self.admitted(api::METHOD_DEPLOYMENT_ENVIRONMENT_PROVIDERS_LIST, async {
             let store = self.runtime.stores().store_for(Uuid::nil());
             let providers = store
-                .list_providers(ListEnvironmentProviders::default())
+                .list_providers()
                 .await
                 .map_err(super::service::environment_providers::map_environments_error)?;
             Ok(AgentApiOutcome::new(
                 DeploymentEnvironmentProviderListResponse {
-                    providers: providers
-                        .into_iter()
-                        .map(environment_provider_view)
-                        .collect(),
+                    providers: providers.iter().map(environment_provider_view).collect(),
                 },
             ))
         })
@@ -371,7 +377,7 @@ impl DeploymentApiService for GatewayDeploymentApi {
                 .map_err(super::service::environment_providers::map_environments_error)?;
             Ok(AgentApiOutcome::new(
                 DeploymentEnvironmentProviderReadResponse {
-                    provider: environment_provider_view(provider),
+                    provider: environment_provider_view(&provider),
                 },
             ))
         })
@@ -391,7 +397,7 @@ impl DeploymentApiService for GatewayDeploymentApi {
                 .map_err(super::service::environment_providers::map_environments_error)?;
             Ok(AgentApiOutcome::new(
                 DeploymentEnvironmentProviderDeleteResponse {
-                    provider: environment_provider_view(provider),
+                    provider: environment_provider_view(&provider),
                 },
             ))
         })
@@ -409,26 +415,8 @@ impl DeploymentApiService for GatewayDeploymentApi {
             let binding = store
                 .put_provider_binding(PutEnvironmentProviderBinding {
                     universe_id,
-                    binding_id: EnvironmentProviderBindingId::try_new(params.binding_id).map_err(
-                        |error| {
-                            AgentApiError::invalid_request(format!("invalid binding id: {error}"))
-                        },
-                    )?,
-                    provider_id: EnvironmentProviderId::try_new(params.provider_id).map_err(
-                        |error| {
-                            AgentApiError::invalid_request(format!("invalid provider id: {error}"))
-                        },
-                    )?,
-                    status: match params.status {
-                        api::EnvironmentProviderBindingStatusView::Enabled => {
-                            EnvironmentProviderBindingStatus::Enabled
-                        }
-                        api::EnvironmentProviderBindingStatusView::Disabled => {
-                            EnvironmentProviderBindingStatus::Disabled
-                        }
-                    },
-                    metadata: params.metadata,
-                    expected_revision: params.expected_revision,
+                    provider_id: parse_environment_provider_id(params.provider_id)?,
+                    enabled: params.enabled,
                     updated_at_ms: i64::try_from(current_time_ms()?)
                         .map_err(|_| AgentApiError::internal("current timestamp exceeds i64"))?,
                 })
@@ -450,13 +438,10 @@ impl DeploymentApiService for GatewayDeploymentApi {
         self.admitted(api::METHOD_DEPLOYMENT_PROVIDER_BINDINGS_DELETE, async {
             let universe_id = parse_universe_id(&params.universe_id)?;
             self.require_universe(universe_id).await?;
-            let binding_id =
-                EnvironmentProviderBindingId::try_new(params.binding_id).map_err(|error| {
-                    AgentApiError::invalid_request(format!("invalid binding id: {error}"))
-                })?;
+            let provider_id = parse_environment_provider_id(params.provider_id)?;
             let store = self.runtime.stores().store_for(universe_id);
             let binding = store
-                .delete_provider_binding(universe_id, &binding_id)
+                .delete_provider_binding(universe_id, &provider_id)
                 .await
                 .map_err(super::service::environment_providers::map_environments_error)?;
             Ok(AgentApiOutcome::new(
@@ -471,70 +456,6 @@ impl DeploymentApiService for GatewayDeploymentApi {
         .await
     }
 
-    async fn adopt_environment(
-        &self,
-        params: DeploymentEnvironmentAdoptParams,
-    ) -> Result<AgentApiOutcome<DeploymentEnvironmentAdoptResponse>, AgentApiError> {
-        self.admitted(api::METHOD_DEPLOYMENT_ENVIRONMENTS_ADOPT, async {
-        if !params.take_ownership {
-            return Err(AgentApiError::invalid_request(
-                "takeOwnership must be true because adoption transfers lifecycle ownership to Lightspeed",
-            ));
-        }
-        let universe_id = parse_universe_id(&params.universe_id)?;
-        self.require_universe(universe_id).await?;
-        let request_id =
-            EnvironmentProvisionRequestId::try_new(params.request_id).map_err(|error| {
-                AgentApiError::invalid_request(format!("invalid environment request id: {error}"))
-            })?;
-        let binding_id =
-            EnvironmentProviderBindingId::try_new(params.binding_id).map_err(|error| {
-                AgentApiError::invalid_request(format!("invalid binding id: {error}"))
-            })?;
-        validate_adoption_source(&params.source_target)?;
-        let store = self.runtime.stores().store_for(universe_id);
-        // Refuse up front when the binding's provider cannot adopt, instead
-        // of failing the environment after its record exists.
-        let binding = store
-            .read_provider_binding(universe_id, &binding_id)
-            .await
-            .map_err(super::service::environment_providers::map_environments_error)?;
-        self.runtime
-            .state_for(universe_id, false)
-            .await
-            .map_err(|error| AgentApiError::internal(error.to_string()))?
-            .api
-            .environment_service()
-            .require_controller_feature(&binding.provider_id, ControllerFeature::AdoptTarget)
-            .await?;
-        let environment = EnvironmentStore::adopt_environment(
-            store.as_ref(),
-            AdoptEnvironment {
-                request_id,
-                environment_id: EnvironmentId::new(format!(
-                    "environment_{}",
-                    Uuid::new_v4().simple()
-                )),
-                incarnation_id: EnvironmentIncarnationId::new(format!(
-                    "incarnation_{}",
-                    Uuid::new_v4().simple()
-                )),
-                binding_id,
-                source_target: params.source_target,
-                display_name: params.display_name,
-                metadata: params.metadata,
-                created_at_ms: i64::try_from(current_time_ms()?)
-                    .map_err(|_| AgentApiError::internal("current timestamp exceeds i64"))?,
-            },
-        )
-        .await
-        .map_err(super::service::environment_providers::map_environments_error)?;
-        Ok(AgentApiOutcome::new(DeploymentEnvironmentAdoptResponse {
-            environment: super::service::environment_providers::environment_view(&environment),
-        }))
-        }).await
-    }
-
     async fn put_universe_slug(
         &self,
         params: api::DeploymentUniverseSlugPutParams,
@@ -836,40 +757,11 @@ fn parse_universe_id(value: &str) -> Result<Uuid, AgentApiError> {
         .map_err(|error| AgentApiError::invalid_request(format!("invalid universe id: {error}")))
 }
 
-fn validate_adoption_source(value: &str) -> Result<(), AgentApiError> {
-    if value.is_empty() || value.len() > 255 || value.chars().any(char::is_control) {
-        return Err(AgentApiError::invalid_request(
-            "sourceTarget must be a non-empty provider-native reference of at most 255 bytes",
-        ));
-    }
-    Ok(())
-}
-
 fn parse_environment_provider_id(value: String) -> Result<EnvironmentProviderId, AgentApiError> {
     EnvironmentProviderId::try_new(value)
         .map_err(|error| AgentApiError::invalid_request(format!("invalid provider id: {error}")))
 }
 
-fn environment_provider_view(
-    record: EnvironmentProviderRecord,
-) -> DeploymentEnvironmentProviderView {
-    DeploymentEnvironmentProviderView {
-        provider_id: record.provider_id.to_string(),
-        display_name: record.display_name,
-        controller_endpoint: record.controller_endpoint.as_str().to_owned(),
-        metadata: record.metadata,
-        controller_features: record.controller_features.map(|features| {
-            DeploymentEnvironmentProviderFeaturesView {
-                adopt_target: features.adopt_target,
-                ingress: features.ingress,
-            }
-        }),
-        data_route_base: record.data_route_base.map(|base| base.as_str().to_owned()),
-        created_at_ms: record.created_at_ms,
-        updated_at_ms: record.updated_at_ms,
-    }
-}
-
 fn universe_view(stats: store_pg::UniverseStats) -> DeploymentUniverseView {
     DeploymentUniverseView {
         universe_id: stats.universe_id.to_string(),
diff --git a/crates/temporal-runtime/src/gateway/http.rs b/crates/temporal-runtime/src/gateway/http.rs
index aa6ff1b5f..75902b53f 100644
--- a/crates/temporal-runtime/src/gateway/http.rs
+++ b/crates/temporal-runtime/src/gateway/http.rs
@@ -18,16 +18,26 @@ use axum::{
     routing::{get, post},
 };
 use environment_protocol::{
-    control::target::TargetOwner,
-    ids::{BindingId, EnvironmentId, IncarnationId, ProviderTargetId, UniverseId},
-    limits::MAX_MESSAGE_BYTES,
-    routes::{CONNECT_PATH, CanonicalOrigin, DATA_PATH, canonical_origin, provider_data_route},
+    control::target::{GetTargetParams, PowerState, TargetOwner, TargetPhase, TargetRef},
+    ids::{EnvironmentId, UniverseId},
+    limits::{MAX_MESSAGE_BYTES, RETRY_AFTER_MAX_SECS},
+    metadata::DescriptiveText,
+    routes::{
+        CONNECT_PATH, CanonicalOrigin, DATA_PATH, DataRouteRefusal, canonical_origin,
+        parse_retry_after_ms, provider_data_route,
+    },
+};
+use environments::{
+    EndpointScheme, EnvironmentEndpoint, EnvironmentGoneReason, EnvironmentUse,
+    EnvironmentWaitReason, WAIT_RETRY_AFTER_MS,
 };
-use environments::{EndpointScheme, EnvironmentEndpoint};
 use futures_util::{SinkExt as _, StreamExt as _};
 use serde::Deserialize;
 use store_pg::PgApiKeyStore;
-use tokio::io::{AsyncRead, AsyncWrite};
+use tokio::{
+    io::{AsyncRead, AsyncWrite},
+    sync::watch,
+};
 use tokio_tungstenite::{
     WebSocketStream, client_async_with_config, connect_async_with_config,
     tungstenite::{
@@ -38,13 +48,16 @@ use tokio_tungstenite::{
 use uuid::Uuid;
 
 use crate::{
-    config::{DeploymentStores, GatewayAuthMode, gateway_auth_mode_from_env},
-    environments::gateway::{ROUTE_PATH_PREFIX, RouteKey, bearer_matches, close_message},
+    config::GatewayAuthMode,
+    environments::{
+        gateway::{NO_WAKE_HEADER, ROUTE_PATH_PREFIX, RouteKey, bearer_matches, close_message},
+        signals::EnvironmentSignals,
+    },
     universe::{UniverseError, UniverseRuntime},
 };
 
 use super::{
-    GatewayAgentApi, GatewayDeploymentApi, OAuthCallbackOutcome, connect_temporal,
+    GatewayAgentApi, GatewayDeploymentApi, OAuthCallbackOutcome,
     registration::{self, RegisteredConnections},
     request_context,
 };
@@ -54,19 +67,6 @@ pub const DEFAULT_MAX_REQUEST_BODY_BYTES: usize = 64 * 1024 * 1024;
 
 pub use super::authentication::{ACTOR_HEADER, UNIVERSE_HEADER};
 
-#[derive(Clone, Debug)]
-pub struct GatewayServerConfig {
-    pub bind: SocketAddr,
-    pub task_queue: String,
-    pub temporal_target: String,
-    pub namespace: String,
-    pub max_request_body_bytes: usize,
-    /// Externally reachable base URL: the OAuth callback
-    /// (`{base}/auth/callback`) and the origin registered daemons sign.
-    /// Defaults to `http://{bind}`, which only a loopback bind may rely on.
-    pub public_base_url: Option<String>,
-}
-
 /// Per-request universe resolution for the HTTP edge.
 ///
 /// The JSON-RPC API itself never carries a universe parameter: session-scoped
@@ -91,10 +91,13 @@ pub struct GatewayState {
     resolution: UniverseResolution,
     /// Live registered-daemon connections on this replica.
     registrations: Arc<RegisteredConnections>,
-    /// The origin daemons sign registrations for: the canonical origin of
-    /// the public base URL. Absent when that URL has no WebSocket origin;
+    /// The origins a daemon's registration signature may name: the
+    /// canonical origin of the public base URL and any configured
+    /// registration URLs. Empty when none of them has a WebSocket origin;
     /// the connect route then refuses every daemon.
-    registration_origin: Option<CanonicalOrigin>,
+    registration_origins: Vec<CanonicalOrigin>,
+    /// Revocation of live environment routes and control connections.
+    signals: Arc<EnvironmentSignals>,
 }
 
 /// Which route families one HTTP listener serves, derived from the
@@ -119,20 +122,35 @@ impl GatewayRoutes {
 impl GatewayState {
     /// Route every request to one existing service instance.
     pub fn for_api(api: Arc<GatewayAgentApi>) -> Self {
-        let registration_origin = registration_origin_of(api.public_base_url());
+        let registration_origins = registration_origin_of(api.public_base_url())
+            .into_iter()
+            .collect();
+        let signals = api.environment_signals().clone();
         Self {
             resolution: UniverseResolution::FixedApi { api },
             registrations: Arc::new(RegisteredConnections::new()),
-            registration_origin,
+            registration_origins,
+            signals,
         }
     }
 
+    /// Replace the origins registration signatures are verified against,
+    /// as [`registration_origins`] computed them at startup.
+    pub fn with_registration_origins(mut self, origins: Vec<CanonicalOrigin>) -> Self {
+        self.registration_origins = origins;
+        self
+    }
+
     pub(super) fn registrations(&self) -> &Arc<RegisteredConnections> {
         &self.registrations
     }
 
-    pub(super) fn registration_origin(&self) -> Option<&CanonicalOrigin> {
-        self.registration_origin.as_ref()
+    pub(super) fn registration_origins(&self) -> &[CanonicalOrigin] {
+        &self.registration_origins
+    }
+
+    pub(super) fn signals(&self) -> &Arc<EnvironmentSignals> {
+        &self.signals
     }
 
     /// The universe a register request belongs to: the environment's
@@ -198,7 +216,10 @@ impl GatewayState {
     ) -> Self {
         let api_keys = PgApiKeyStore::new(runtime.stores().pool().clone());
         let deployment = Arc::new(GatewayDeploymentApi::new(runtime.clone()));
-        let registration_origin = registration_origin_of(&public_base_url);
+        let registration_origins = registration_origin_of(&public_base_url)
+            .into_iter()
+            .collect();
+        let signals = runtime.environment_signals().clone();
         Self {
             resolution: UniverseResolution::Multi {
                 mode,
@@ -208,7 +229,8 @@ impl GatewayState {
                 deployment,
             },
             registrations: Arc::new(RegisteredConnections::new()),
-            registration_origin,
+            registration_origins,
+            signals,
         }
     }
 
@@ -350,7 +372,7 @@ impl GatewayState {
     async fn environment_provider_credential(
         &self,
         provider_id: &environments::EnvironmentProviderId,
-    ) -> Result<auth::SecretValue, environments::EnvironmentRegistryError> {
+    ) -> Result<Option<auth::SecretValue>, environments::EnvironmentRegistryError> {
         environments::EnvironmentProviderStore::read_provider_credential(
             self.deployment_store().as_ref(),
             provider_id,
@@ -375,27 +397,54 @@ fn registration_origin_of(public_base_url: &str) -> Option<CanonicalOrigin> {
     }
 }
 
-/// The origin registered daemons must sign for, checked once at startup by
+/// The origins registered daemons may sign for, computed once at startup by
 /// a process that serves the registration route: the canonical origin of
-/// `LIGHTSPEED_PUBLIC_BASE_URL`. Without that variable the default
-/// `http://{bind}` is the true origin only on a loopback bind, so any other
-/// bind refuses to start rather than reject every remote daemon.
-pub fn registration_origin(
+/// `LIGHTSPEED_PUBLIC_BASE_URL`, then the origin of each
+/// `LIGHTSPEED_ENVIRONMENT_REGISTRATION_URLS` entry (for example a
+/// cluster-internal Service name daemons dial instead). Without a public
+/// base URL the default `http://{bind}` is a true origin only on a loopback
+/// bind; any other bind needs at least one configured origin, or the
+/// process refuses to start rather than reject every remote daemon. A URL
+/// without a WebSocket origin is a startup error.
+pub fn registration_origins(
     public_base_url: Option<&str>,
+    registration_urls: &[String],
     bind: SocketAddr,
-) -> anyhow::Result<CanonicalOrigin> {
-    let Some(public_base_url) = public_base_url else {
-        if !bind.ip().is_loopback() {
-            anyhow::bail!(
-                "LIGHTSPEED_PUBLIC_BASE_URL is required to serve environment registration on {bind}: \
-                 daemons sign the gateway origin they dial, and only that URL names it"
-            );
+) -> anyhow::Result<Vec<CanonicalOrigin>> {
+    let mut origins = Vec::new();
+    match public_base_url {
+        Some(public_base_url) => {
+            origins.push(canonical_origin(public_base_url).map_err(|error| {
+                anyhow::anyhow!("LIGHTSPEED_PUBLIC_BASE_URL has no WebSocket origin: {error}")
+            })?)
         }
-        return Ok(canonical_origin(&format!("http://{bind}"))?);
-    };
-    canonical_origin(public_base_url).map_err(|error| {
-        anyhow::anyhow!("LIGHTSPEED_PUBLIC_BASE_URL has no WebSocket origin: {error}")
-    })
+        None if bind.ip().is_loopback() => {
+            origins.push(canonical_origin(&format!("http://{bind}"))?);
+        }
+        None => {}
+    }
+    for url in registration_urls
+        .iter()
+        .map(|url| url.trim())
+        .filter(|url| !url.is_empty())
+    {
+        let origin = canonical_origin(url).map_err(|error| {
+            anyhow::anyhow!(
+                "LIGHTSPEED_ENVIRONMENT_REGISTRATION_URLS entry {url:?} has no WebSocket origin: {error}"
+            )
+        })?;
+        if !origins.contains(&origin) {
+            origins.push(origin);
+        }
+    }
+    if origins.is_empty() {
+        anyhow::bail!(
+            "LIGHTSPEED_PUBLIC_BASE_URL or LIGHTSPEED_ENVIRONMENT_REGISTRATION_URLS is required to serve \
+             environment registration on {bind}: daemons sign the gateway origin they dial, and only \
+             those URLs name it"
+        );
+    }
+    Ok(origins)
 }
 
 fn map_universe_error(error: UniverseError) -> AgentApiError {
@@ -407,31 +456,6 @@ fn map_universe_error(error: UniverseError) -> AgentApiError {
     }
 }
 
-pub async fn serve_gateway(config: GatewayServerConfig) -> anyhow::Result<()> {
-    let mode = gateway_auth_mode_from_env()?;
-    let client = connect_temporal(&config.temporal_target, &config.namespace).await?;
-    let stores = DeploymentStores::from_env()
-        .await?
-        .with_blob_cache(crate::config::blob_cache_from_env()?);
-    registration_origin(config.public_base_url.as_deref(), config.bind)?;
-    let public_base_url = public_base_url_or_default(&config);
-    let runtime = Arc::new(UniverseRuntime::new(
-        client,
-        config.task_queue.clone(),
-        Some(public_base_url.clone()),
-        stores,
-    )?);
-    prewarm_single_universe(&mode, &runtime).await?;
-    let reconciler = tokio::spawn(runtime.clone().run_environment_reconciler());
-    let state = Arc::new(GatewayState::multi(mode, runtime, public_base_url));
-    let app = gateway_router(state, config.max_request_body_bytes, GatewayRoutes::ALL);
-    let listener = tokio::net::TcpListener::bind(config.bind).await?;
-    tracing::info!(target: "temporal_runtime", bind = %config.bind, "gateway listening");
-    axum::serve(listener, app).await?;
-    reconciler.abort();
-    Ok(())
-}
-
 /// In `single` mode, build the pinned universe's state at startup so
 /// misconfiguration fails the process instead of the first request. This also
 /// preserves the legacy behavior of creating the configured universe row.
@@ -445,13 +469,6 @@ pub async fn prewarm_single_universe(
     Ok(())
 }
 
-pub fn public_base_url_or_default(config: &GatewayServerConfig) -> String {
-    config
-        .public_base_url
-        .clone()
-        .unwrap_or_else(|| format!("http://{}", config.bind))
-}
-
 pub fn gateway_router(
     state: Arc<GatewayState>,
     max_request_body_bytes: usize,
@@ -471,7 +488,7 @@ pub fn gateway_router(
     if routes.environment {
         router = router
             .route(
-                &format!("{ROUTE_PATH_PREFIX}/{{universe}}/{{environment}}/{{incarnation}}"),
+                &format!("{ROUTE_PATH_PREFIX}/{{universe}}/{{environment}}"),
                 get(environment_route_upgrade),
             )
             .route(CONNECT_PATH, get(registration::connect_upgrade))
@@ -562,9 +579,14 @@ async fn bot_webhook_ingest(
     (status, Json(payload)).into_response()
 }
 
+/// `GET {ROUTE_PATH_PREFIX}/{universe}/{environment}`: a worker's data
+/// route. The row's use gate decides first; a usable environment is then
+/// dialed by its source. Every refusal the gate or a provider makes is a
+/// typed [`DataRouteRefusal`]; a bodiless status means the gateway itself
+/// could not reach or authorize the upstream.
 async fn environment_route_upgrade(
     State(state): State<Arc<GatewayState>>,
-    Path((universe, environment, incarnation)): Path<(String, String, String)>,
+    Path((universe, environment)): Path<(String, String)>,
     headers: HeaderMap,
     upgrade: WebSocketUpgrade,
 ) -> Response {
@@ -577,7 +599,6 @@ async fn environment_route_upgrade(
     let key = RouteKey {
         universe_id,
         environment_id: environment,
-        incarnation_id: incarnation,
     };
     let api = match state.api_for_daemon(universe_id).await {
         Ok(api) => api,
@@ -587,6 +608,9 @@ async fn environment_route_upgrade(
         Ok(id) => id,
         Err(_) => return StatusCode::BAD_REQUEST.into_response(),
     };
+    // Subscribe before reading the row: a revocation that lands after the
+    // read still ends the route.
+    let revoked = state.signals().watch(universe_id, &key.environment_id);
     let environment = match environments::EnvironmentStore::read_environment(
         api.store().as_ref(),
         &environment_id,
@@ -594,10 +618,16 @@ async fn environment_route_upgrade(
     .await
     {
         Ok(environment) => environment,
-        Err(_) => return StatusCode::NOT_FOUND.into_response(),
+        Err(environments::EnvironmentRegistryError::NotFound { .. }) => {
+            return refusal_response(&DataRouteRefusal::Gone {}, None);
+        }
+        Err(error) => {
+            tracing::warn!(target: "temporal_runtime", %error, environment = %key.environment_id, "environment route could not read its environment");
+            return StatusCode::SERVICE_UNAVAILABLE.into_response();
+        }
     };
-    if environment.incarnation.incarnation_id.as_str() != key.incarnation_id {
-        return StatusCode::CONFLICT.into_response();
+    if let Some(refused) = gate_refusal(&environment.use_gate(now_ms())) {
+        return refused;
     }
     let upgrade = upgrade
         .max_message_size(MAX_MESSAGE_BYTES as usize)
@@ -609,36 +639,24 @@ async fn environment_route_upgrade(
                     Ok(upstream) => upstream,
                     Err(failure) => return failure.respond(endpoint.as_str()),
                 };
-            let route = UpstreamRoute::External {
-                endpoint: endpoint.clone(),
-            };
             upgrade
-                .on_upgrade(move |socket| proxy_upstream(state, key, route, socket, upstream))
+                .on_upgrade(move |socket| proxy_upstream(revoked, socket, upstream))
                 .into_response()
         }
-        environments::EnvironmentSource::Provisioned {
-            provider_id,
-            binding_id,
-        } => {
-            let Some(target_id) = environment.incarnation.provider_target_id.clone() else {
-                return StatusCode::CONFLICT.into_response();
-            };
-            let route = UpstreamRoute::Provider {
-                provider_id: provider_id.clone(),
-                binding_id: binding_id.clone(),
-                target_id,
-            };
-            if authorize_upstream(&state, &key, &route).await.is_err() {
-                return StatusCode::CONFLICT.into_response();
-            }
-            let (endpoint, credential) = match provider_route(&state, &key, &route).await {
+        environments::EnvironmentSource::Provisioned(source) => {
+            let (endpoint, credential) = match provider_route(&state, &api, &key, source).await {
                 Ok(route) => route,
-                Err(refusal) => return refusal.respond(),
+                Err(refused) => return *refused,
             };
+            if headers.contains_key(NO_WAKE_HEADER)
+                && let Some(refused) = refuse_unless_running(&api, &key, source).await
+            {
+                return refused;
+            }
             let upstream = match dial_upstream(
                 &endpoint,
                 UpstreamTarget::Url,
-                Some(credential.expose()),
+                credential.as_ref().map(|credential| credential.expose()),
             )
             .await
             {
@@ -646,30 +664,26 @@ async fn environment_route_upgrade(
                 Err(failure) => return failure.respond(&endpoint),
             };
             upgrade
-                .on_upgrade(move |socket| proxy_upstream(state, key, route, socket, upstream))
+                .on_upgrade(move |socket| proxy_upstream(revoked, socket, upstream))
                 .into_response()
         }
-        environments::EnvironmentSource::Registered { .. } => {
-            if environment.status.is_closing_or_closed() {
-                return StatusCode::CONFLICT.into_response();
-            }
-            let (daemon_socket, control_connection_id) = match registration::open_registered_route(
+        environments::EnvironmentSource::Registered(_) => {
+            let (daemon_socket, control_ended) = match registration::open_registered_route(
                 &state, &key,
             )
             .await
             {
                 Ok(paired) => paired,
-                Err(status) => {
-                    tracing::warn!(target: "temporal_runtime", environment = %key.environment_id, %status, "registered environment data route unavailable");
-                    return status.into_response();
+                Err(refused) => {
+                    tracing::warn!(target: "temporal_runtime", environment = %key.environment_id, status = %refused.status(), "registered environment data route unavailable");
+                    return *refused;
                 }
             };
             upgrade
                 .on_upgrade(move |socket| {
                     registration::proxy_registered_route(
-                        state,
-                        key,
-                        control_connection_id,
+                        revoked,
+                        control_ended,
                         socket,
                         daemon_socket,
                     )
@@ -679,103 +693,194 @@ async fn environment_route_upgrade(
     }
 }
 
-/// How long the gateway waits for a provider route or external envd to
-/// accept the upstream WebSocket.
-const UPSTREAM_CONNECT_TIMEOUT: Duration = Duration::from_secs(10);
-/// A provider that has not yet advertised its data routes is asked again
-/// after this long.
-const PROVIDER_ROUTES_RETRY_AFTER_SECS: u64 = 5;
-
-/// The upstream a worker route is proxied to, and what keeps it
-/// authorized.
-enum UpstreamRoute {
-    External {
-        endpoint: EnvironmentEndpoint,
-    },
-    Provider {
-        provider_id: environments::EnvironmentProviderId,
-        binding_id: environments::EnvironmentProviderBindingId,
-        target_id: ProviderTargetId,
-    },
+/// The refusal a worker route answers for a gate that does not admit use,
+/// or `None` to dial. Waking and booting never come from the gate itself:
+/// only a provider answers them.
+fn gate_refusal(gate: &EnvironmentUse) -> Option<Response> {
+    let refusal = match gate {
+        EnvironmentUse::Use => return None,
+        EnvironmentUse::Wait {
+            reason,
+            retry_after_ms,
+            ..
+        } => {
+            let refusal = match reason {
+                EnvironmentWaitReason::Provisioning => DataRouteRefusal::Provisioning {},
+                EnvironmentWaitReason::Disconnected => DataRouteRefusal::Disconnected {},
+                EnvironmentWaitReason::Waking => DataRouteRefusal::Waking {},
+                EnvironmentWaitReason::Booting => DataRouteRefusal::Booting {},
+            };
+            return Some(refusal_response(&refusal, Some(*retry_after_ms)));
+        }
+        EnvironmentUse::Gone { reason, message } => match reason {
+            EnvironmentGoneReason::Closing | EnvironmentGoneReason::Closed => {
+                DataRouteRefusal::Gone {}
+            }
+            EnvironmentGoneReason::Away => DataRouteRefusal::Away {},
+            EnvironmentGoneReason::Failed => DataRouteRefusal::Failed {
+                message: message
+                    .as_deref()
+                    .and_then(DescriptiveText::lossy)
+                    .unwrap_or_else(|| {
+                        DescriptiveText::new("the environment failed")
+                            .expect("a fixed failure message is valid text")
+                    }),
+            },
+        },
+    };
+    Some(refusal_response(&refusal, None))
 }
 
-/// Why a provisioned target's data route cannot be dialed now.
-enum ProviderRouteRefusal {
-    /// The provider's controller has not advertised its data routes yet.
-    NotAdvertised,
-    Status(StatusCode),
+/// A typed data-route refusal: its status, a JSON body tagged by `state`,
+/// and for a retryable one `Retry-After` in whole seconds, rounded up and
+/// kept within 1 to [`RETRY_AFTER_MAX_SECS`] (default
+/// [`WAIT_RETRY_AFTER_MS`]).
+pub(super) fn refusal_response(
+    refusal: &DataRouteRefusal,
+    retry_after_ms: Option<u64>,
+) -> Response {
+    let status = StatusCode::from_u16(refusal.status()).unwrap_or(StatusCode::SERVICE_UNAVAILABLE);
+    let mut response = (status, Json(refusal)).into_response();
+    if refusal.is_retryable() {
+        response.headers_mut().insert(
+            header::RETRY_AFTER,
+            HeaderValue::from(retry_after_secs(retry_after_ms)),
+        );
+    }
+    response
 }
 
-impl ProviderRouteRefusal {
-    fn respond(self) -> Response {
-        match self {
-            Self::NotAdvertised => (
-                StatusCode::SERVICE_UNAVAILABLE,
-                [(
-                    header::RETRY_AFTER,
-                    HeaderValue::from(PROVIDER_ROUTES_RETRY_AFTER_SECS),
-                )],
-            )
-                .into_response(),
-            Self::Status(status) => status.into_response(),
-        }
-    }
+fn retry_after_secs(retry_after_ms: Option<u64>) -> u64 {
+    retry_after_ms
+        .unwrap_or(WAIT_RETRY_AFTER_MS)
+        .div_ceil(1_000)
+        .clamp(1, RETRY_AFTER_MAX_SECS)
 }
 
-/// The provider data route for a provisioned target and the credential it
-/// is dialed with. The route comes only from the base the controller
-/// advertised; a provider that has not advertised one yet is asked to
-/// retry, one without a credential is a configuration error.
+/// How long the gateway waits for a provider route or external envd to
+/// accept the upstream WebSocket; longer than a provider may hold a dial
+/// while it wakes the target (`MAX_DATA_ROUTE_HOLD_MS`).
+const UPSTREAM_CONNECT_TIMEOUT: Duration = Duration::from_secs(10);
+const _: () = assert!(
+    UPSTREAM_CONNECT_TIMEOUT.as_millis()
+        > environment_protocol::limits::MAX_DATA_ROUTE_HOLD_MS as u128
+);
+
+/// The provider data route of a provisioned environment and the credential
+/// it is dialed with (none when the provider has none). The universe's
+/// binding of the provider must exist and be enabled; a target the
+/// provider has not named yet is still provisioning.
 async fn provider_route(
     state: &GatewayState,
+    api: &GatewayAgentApi,
     key: &RouteKey,
-    route: &UpstreamRoute,
-) -> Result<(String, auth::SecretValue), ProviderRouteRefusal> {
-    let UpstreamRoute::Provider {
-        provider_id,
-        binding_id,
-        target_id,
-    } = route
-    else {
-        return Err(ProviderRouteRefusal::Status(StatusCode::BAD_GATEWAY));
-    };
+    source: &environments::ProvisionedSource,
+) -> Result<(String, Option<auth::SecretValue>), Box<Response>> {
+    let provider_id = &source.provider_id;
     let unavailable = |error: environments::EnvironmentRegistryError| match error {
         environments::EnvironmentRegistryError::Store { .. } => {
             tracing::warn!(target: "temporal_runtime", %error, provider = %provider_id, "provider record unavailable");
-            ProviderRouteRefusal::Status(StatusCode::SERVICE_UNAVAILABLE)
+            Box::new(StatusCode::SERVICE_UNAVAILABLE.into_response())
         }
         error => {
             tracing::error!(target: "temporal_runtime", %error, provider = %provider_id, "provider data route is misconfigured");
-            ProviderRouteRefusal::Status(StatusCode::BAD_GATEWAY)
+            Box::new(StatusCode::BAD_GATEWAY.into_response())
+        }
+    };
+    match environments::EnvironmentProviderBindingStore::read_provider_binding(
+        api.store().as_ref(),
+        key.universe_id,
+        provider_id,
+    )
+    .await
+    {
+        Ok(binding) if binding.enabled => {}
+        Ok(_) | Err(environments::EnvironmentRegistryError::NotFound { .. }) => {
+            return Err(Box::new(StatusCode::FORBIDDEN.into_response()));
         }
+        Err(error) => return Err(unavailable(error)),
+    }
+    let Some(target_id) = source.provider_target_id.as_ref() else {
+        return Err(Box::new(refusal_response(
+            &DataRouteRefusal::Provisioning {},
+            None,
+        )));
     };
     let provider = state
         .environment_provider(provider_id)
         .await
         .map_err(unavailable)?;
-    let Some(base) = provider.data_route_base.as_ref() else {
-        return Err(ProviderRouteRefusal::NotAdvertised);
-    };
+    let base = provider.effective_data_route_base().map_err(unavailable)?;
     let credential = state
         .environment_provider_credential(provider_id)
         .await
         .map_err(unavailable)?;
-    let owner = target_owner(key, binding_id).map_err(|error| {
+    let owner = target_owner(key).map_err(|error| {
         tracing::error!(target: "temporal_runtime", %error, environment = %key.environment_id, "route identity is not a valid target owner");
-        ProviderRouteRefusal::Status(StatusCode::BAD_REQUEST)
+        Box::new(StatusCode::BAD_REQUEST.into_response())
     })?;
-    Ok((provider_data_route(base, &owner, target_id), credential))
+    Ok((provider_data_route(&base, &owner, target_id), credential))
 }
 
-fn target_owner(
+/// Bound of the provider check a no-wake dial makes.
+const NO_WAKE_CHECK_TIMEOUT: Duration = Duration::from_secs(5);
+
+/// For a dial that must not wake its target ([`NO_WAKE_HEADER`]): `None`
+/// when the provider reports the target active and running right now (or
+/// active without power control), else the refusal. Nothing is dialed or
+/// written: a powered-down target is a bodiless 412, and a provider that
+/// cannot answer in time a bodiless 503.
+async fn refuse_unless_running(
+    api: &GatewayAgentApi,
     key: &RouteKey,
-    binding_id: &environments::EnvironmentProviderBindingId,
-) -> Result<TargetOwner, environment_protocol::ids::IdError> {
+    source: &environments::ProvisionedSource,
+) -> Option<Response> {
+    let (Some(target_id), Ok(owner)) = (source.provider_target_id.clone(), target_owner(key))
+    else {
+        return Some(StatusCode::SERVICE_UNAVAILABLE.into_response());
+    };
+    let service = api.environment_service();
+    let observed = tokio::time::timeout(NO_WAKE_CHECK_TIMEOUT, async {
+        let controller = service
+            .connect_provider_controller(&source.provider_id)
+            .await
+            .map_err(|error| error.to_string())?;
+        let answer = controller
+            .client
+            .get_target(&GetTargetParams {
+                target: TargetRef {
+                    owner,
+                    target_id: Some(target_id),
+                },
+            })
+            .await
+            .map_err(|error| error.to_string());
+        controller.close().await;
+        answer.map(|response| response.target)
+    })
+    .await;
+    match observed {
+        Ok(Ok(target))
+            if target.phase == TargetPhase::Active
+                && target
+                    .power
+                    .is_none_or(|power| power == PowerState::Running) =>
+        {
+            None
+        }
+        Ok(Ok(_)) => Some(StatusCode::PRECONDITION_FAILED.into_response()),
+        Ok(Err(error)) => {
+            tracing::debug!(target: "temporal_runtime", %error, environment = %key.environment_id, "a no-wake dial could not check its target's power");
+            Some(StatusCode::SERVICE_UNAVAILABLE.into_response())
+        }
+        Err(_) => Some(StatusCode::SERVICE_UNAVAILABLE.into_response()),
+    }
+}
+
+fn target_owner(key: &RouteKey) -> Result<TargetOwner, environment_protocol::ids::IdError> {
     Ok(TargetOwner {
         universe_id: UniverseId::new(key.universe_id.to_string())?,
-        binding_id: BindingId::new(binding_id.as_str())?,
         environment_id: EnvironmentId::new(key.environment_id.as_str())?,
-        incarnation_id: IncarnationId::new(key.incarnation_id.as_str())?,
     })
 }
 
@@ -801,17 +906,31 @@ enum Upstream {
 }
 
 /// Why an upstream dial failed, and what the worker is told.
+#[derive(Debug)]
 enum UpstreamFailure {
-    /// Unreachable, slow or answering 5xx/429: the worker may retry.
+    /// The upstream answered a typed refusal: forwarded unchanged.
+    Refusal {
+        refusal: DataRouteRefusal,
+        retry_after_ms: Option<u64>,
+    },
+    /// Unreachable, slow or answering 5xx/429 without a refusal body: the
+    /// worker may retry (bodiless 503).
     Unavailable(String),
     /// The upstream refused the upgrade for good (wrong credential, no such
-    /// route) or the URL is unusable.
+    /// route) or the URL is unusable (bodiless 502).
     Refused(String),
 }
 
 impl UpstreamFailure {
     fn respond(self, endpoint: &str) -> Response {
         match self {
+            Self::Refusal {
+                refusal,
+                retry_after_ms,
+            } => {
+                tracing::info!(target: "temporal_runtime", %refusal, %endpoint, "environment upstream refused the dial");
+                refusal_response(&refusal, retry_after_ms)
+            }
             Self::Unavailable(error) => {
                 tracing::warn!(target: "temporal_runtime", %error, %endpoint, "environment upstream unavailable");
                 StatusCode::SERVICE_UNAVAILABLE.into_response()
@@ -888,6 +1007,22 @@ fn upstream_failure(error: tokio_tungstenite::tungstenite::Error) -> UpstreamFai
     match error {
         Error::Http(response) => {
             let status = response.status();
+            let retry_after_ms = response
+                .headers()
+                .get(tokio_tungstenite::tungstenite::http::header::RETRY_AFTER)
+                .and_then(|value| value.to_str().ok())
+                .and_then(parse_retry_after_ms);
+            let refusal = DataRouteRefusal::from_refused_upgrade(
+                status.as_u16(),
+                response.body().as_deref(),
+                retry_after_ms,
+            );
+            if let Some(refusal) = refusal {
+                return UpstreamFailure::Refusal {
+                    refusal,
+                    retry_after_ms,
+                };
+            }
             let message = format!("upgrade refused with HTTP {status}");
             if status.is_server_error() || status.as_u16() == 429 {
                 UpstreamFailure::Unavailable(message)
@@ -900,93 +1035,30 @@ fn upstream_failure(error: tokio_tungstenite::tungstenite::Error) -> UpstreamFai
     }
 }
 
-async fn authorize_upstream(
-    state: &GatewayState,
-    key: &RouteKey,
-    route: &UpstreamRoute,
-) -> anyhow::Result<()> {
-    let api = state
-        .api_for_daemon(key.universe_id)
-        .await
-        .map_err(|error| anyhow::anyhow!(error.message))?;
-    let environment_id = environments::EnvironmentId::try_new(key.environment_id.clone())?;
-    let environment =
-        environments::EnvironmentStore::read_environment(api.store().as_ref(), &environment_id)
-            .await?;
-    if environment.incarnation.incarnation_id.as_str() != key.incarnation_id
-        || environment.status.is_closing_or_closed()
-    {
-        anyhow::bail!("environment route is stale or the environment is closing")
-    }
-    match (route, &environment.source) {
-        (
-            UpstreamRoute::External { endpoint },
-            environments::EnvironmentSource::External { endpoint: assigned },
-        ) if assigned == endpoint => Ok(()),
-        (
-            UpstreamRoute::Provider {
-                provider_id,
-                binding_id,
-                target_id,
-            },
-            environments::EnvironmentSource::Provisioned {
-                provider_id: assigned_provider,
-                binding_id: assigned_binding,
-            },
-        ) if assigned_provider == provider_id
-            && assigned_binding == binding_id
-            && environment.incarnation.provider_target_id.as_ref() == Some(target_id) =>
-        {
-            let binding = environments::EnvironmentProviderBindingStore::read_provider_binding(
-                api.store().as_ref(),
-                key.universe_id,
-                binding_id,
-            )
-            .await?;
-            if binding.status != environments::EnvironmentProviderBindingStatus::Enabled
-                || binding.provider_id != *provider_id
-            {
-                anyhow::bail!("provider binding is disabled or changed")
-            }
-            Ok(())
-        }
-        _ => anyhow::bail!("environment route no longer matches its environment"),
-    }
-}
-
-async fn proxy_upstream(
-    state: Arc<GatewayState>,
-    key: RouteKey,
-    route: UpstreamRoute,
-    worker: WebSocket,
-    upstream: Upstream,
-) {
+async fn proxy_upstream(revoked: watch::Receiver<u64>, worker: WebSocket, upstream: Upstream) {
     match upstream {
-        Upstream::Tcp(socket) => proxy_frames(state, key, route, worker, *socket).await,
-        Upstream::Unix(socket) => proxy_frames(state, key, route, worker, *socket).await,
+        Upstream::Tcp(socket) => proxy_frames(revoked, worker, *socket).await,
+        Upstream::Unix(socket) => proxy_frames(revoked, worker, *socket).await,
     }
 }
 
 /// Pipe one worker route and its upstream frame for frame, pings and pongs
-/// included, re-checking the route's authorization on an interval.
+/// included, until either side ends or the environment's routes are
+/// revoked (close code 1008).
 async fn proxy_frames<S>(
-    state: Arc<GatewayState>,
-    key: RouteKey,
-    route: UpstreamRoute,
+    mut revoked: watch::Receiver<u64>,
     mut worker: WebSocket,
     upstream: WebSocketStream<S>,
 ) where
     S: AsyncRead + AsyncWrite + Unpin,
 {
     let (mut upstream_writer, mut upstream_reader) = upstream.split();
-    let mut reauthorize = tokio::time::interval(Duration::from_secs(5));
     loop {
         tokio::select! {
-            _ = reauthorize.tick() => {
-                if authorize_upstream(&state, &key, &route).await.is_err() {
-                    let _ = worker.send(close_message("environment route authorization changed")).await;
-                    break;
-                }
+            // A dropped revocation sender fails closed like a revocation.
+            _ = revoked.changed() => {
+                let _ = worker.send(close_message("environment route revoked")).await;
+                break;
             }
             message = worker.recv() => {
                 let Some(Ok(message)) = message else { break };
@@ -1025,6 +1097,13 @@ async fn proxy_frames<S>(
     let _ = worker.send(Message::Close(None)).await;
 }
 
+fn now_ms() -> i64 {
+    std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|elapsed| i64::try_from(elapsed.as_millis()).unwrap_or(i64::MAX))
+        .unwrap_or(0)
+}
+
 /// Client ID Metadata Document (draft-ietf-oauth-client-id-metadata-document):
 /// authorization servers fetch this to resolve Lightspeed's CIMD client id.
 /// Deployment-scoped: it depends only on the public base URL, not a universe.
@@ -1237,6 +1316,7 @@ fn html_escape(value: &str) -> String {
 mod tests {
     use super::*;
     use api::AgentApiErrorKind;
+    use environment_protocol::ids::ProviderTargetId;
 
     #[test]
     fn json_rpc_responses_disable_caching() {
@@ -1283,17 +1363,12 @@ mod tests {
     }
 
     #[test]
-    fn provider_data_routes_come_from_the_advertised_base() {
+    fn provider_data_routes_name_the_universe_environment_and_target() {
         let key = RouteKey {
             universe_id: Uuid::parse_str("6f3a1a52-58c1-4f0e-9c2d-1a2b3c4d5e6f").unwrap(),
             environment_id: "environment_1".to_owned(),
-            incarnation_id: "incarnation_1".to_owned(),
         };
-        let owner = target_owner(
-            &key,
-            &environments::EnvironmentProviderBindingId::new("primary"),
-        )
-        .unwrap();
+        let owner = target_owner(&key).unwrap();
         let base =
             environment_protocol::routes::DataRouteBase::new("wss://provider.example/routes")
                 .unwrap();
@@ -1303,45 +1378,248 @@ mod tests {
                 &owner,
                 &ProviderTargetId::new("default/pod one").unwrap()
             ),
-            "wss://provider.example/routes/6f3a1a52-58c1-4f0e-9c2d-1a2b3c4d5e6f/primary/environment_1/incarnation_1/default%2Fpod%20one"
+            "wss://provider.example/routes/6f3a1a52-58c1-4f0e-9c2d-1a2b3c4d5e6f/environment_1/default%2Fpod%20one"
         );
     }
 
+    fn rejected(
+        status: u16,
+        body: Option<&str>,
+        retry_after: Option<&str>,
+    ) -> tokio_tungstenite::tungstenite::Error {
+        let mut response = tokio_tungstenite::tungstenite::http::Response::builder().status(status);
+        if let Some(retry_after) = retry_after {
+            response = response.header("retry-after", retry_after);
+        }
+        tokio_tungstenite::tungstenite::Error::Http(Box::new(
+            response
+                .body(body.map(|body| body.as_bytes().to_vec()))
+                .unwrap(),
+        ))
+    }
+
     #[test]
-    fn upstream_refusals_split_into_retryable_and_permanent() {
-        let refused = |status: u16| {
-            upstream_failure(tokio_tungstenite::tungstenite::Error::Http(Box::new(
-                tokio_tungstenite::tungstenite::http::Response::builder()
-                    .status(status)
-                    .body(None)
-                    .unwrap(),
-            )))
+    fn upstream_refusals_split_into_typed_retryable_and_permanent() {
+        assert!(matches!(
+            upstream_failure(rejected(401, None, None)),
+            UpstreamFailure::Refused(_)
+        ));
+        assert!(matches!(
+            upstream_failure(rejected(404, Some("not json"), None)),
+            UpstreamFailure::Refused(_)
+        ));
+        assert!(matches!(
+            upstream_failure(rejected(503, None, None)),
+            UpstreamFailure::Unavailable(_)
+        ));
+        assert!(matches!(
+            upstream_failure(rejected(429, None, None)),
+            UpstreamFailure::Unavailable(_)
+        ));
+        let UpstreamFailure::Refusal {
+            refusal,
+            retry_after_ms,
+        } = upstream_failure(rejected(503, Some(r#"{"state":"waking"}"#), Some("3")))
+        else {
+            panic!("a typed provider refusal is forwarded");
+        };
+        assert_eq!(refusal, DataRouteRefusal::Waking {});
+        assert_eq!(retry_after_ms, Some(3_000));
+        let UpstreamFailure::Refusal {
+            refusal,
+            retry_after_ms,
+        } = upstream_failure(rejected(
+            409,
+            Some(r#"{"state":"failed","message":"disk lost"}"#),
+            None,
+        ))
+        else {
+            panic!("a failed target is forwarded");
         };
-        assert!(matches!(refused(401), UpstreamFailure::Refused(_)));
-        assert!(matches!(refused(404), UpstreamFailure::Refused(_)));
-        assert!(matches!(refused(503), UpstreamFailure::Unavailable(_)));
-        assert!(matches!(refused(429), UpstreamFailure::Unavailable(_)));
+        assert_eq!(refusal.status(), 409);
+        assert_eq!(retry_after_ms, None);
+        let UpstreamFailure::Refusal { retry_after_ms, .. } =
+            upstream_failure(rejected(503, Some(r#"{"state":"booting"}"#), Some("3600")))
+        else {
+            panic!("a booting target is forwarded");
+        };
+        assert_eq!(retry_after_ms, Some(RETRY_AFTER_MAX_SECS * 1_000));
     }
 
     #[test]
-    fn the_registration_origin_comes_from_the_public_base_url() {
+    fn a_refusal_whose_body_was_not_read_is_forwarded_by_its_status() {
+        let forwarded = |status: u16, retry_after: Option<&str>| match upstream_failure(rejected(
+            status,
+            None,
+            retry_after,
+        )) {
+            UpstreamFailure::Refusal {
+                refusal,
+                retry_after_ms,
+            } => Some((refusal, retry_after_ms)),
+            _ => None,
+        };
+        assert_eq!(
+            forwarded(410, None),
+            Some((DataRouteRefusal::Gone {}, None))
+        );
+        assert!(matches!(
+            forwarded(409, None),
+            Some((DataRouteRefusal::Failed { .. }, None))
+        ));
+        assert_eq!(
+            forwarded(503, Some("2")),
+            Some((DataRouteRefusal::Booting {}, Some(2_000)))
+        );
+        // A 503 without `Retry-After` names no wait: a bodiless 503.
+        assert_eq!(forwarded(503, None), None);
+    }
+
+    fn body_of(response: Response) -> DataRouteRefusal {
+        let bytes =
+            futures::executor::block_on(axum::body::to_bytes(response.into_body(), usize::MAX))
+                .unwrap();
+        serde_json::from_slice(&bytes).unwrap()
+    }
+
+    #[test]
+    fn refusals_carry_their_status_body_and_retry_hint() {
+        let waking = refusal_response(&DataRouteRefusal::Waking {}, Some(2_500));
+        assert_eq!(waking.status(), StatusCode::SERVICE_UNAVAILABLE);
+        assert_eq!(
+            waking.headers().get(header::RETRY_AFTER),
+            Some(&HeaderValue::from(3_u64))
+        );
+        assert_eq!(
+            waking.headers().get(header::CONTENT_TYPE),
+            Some(&HeaderValue::from_static("application/json"))
+        );
+        assert_eq!(body_of(waking), DataRouteRefusal::Waking {});
+
+        let defaulted = refusal_response(&DataRouteRefusal::Disconnected {}, None);
+        assert_eq!(
+            defaulted.headers().get(header::RETRY_AFTER),
+            Some(&HeaderValue::from(WAIT_RETRY_AFTER_MS / 1_000))
+        );
+        assert_eq!(retry_after_secs(Some(0)), 1);
+        assert_eq!(
+            retry_after_secs(Some(10 * 60 * 1_000)),
+            RETRY_AFTER_MAX_SECS
+        );
+
+        let gone = refusal_response(&DataRouteRefusal::Gone {}, Some(5_000));
+        assert_eq!(gone.status(), StatusCode::GONE);
+        assert!(
+            gone.headers().get(header::RETRY_AFTER).is_none(),
+            "only retryable refusals carry Retry-After"
+        );
+    }
+
+    #[test]
+    fn the_use_gate_maps_to_route_refusals() {
+        assert!(gate_refusal(&EnvironmentUse::Use).is_none());
+        let wait = |reason| EnvironmentUse::Wait {
+            reason,
+            retry_after_ms: 2_000,
+            until_ms: None,
+        };
+        let gone = |reason, message: Option<&str>| EnvironmentUse::Gone {
+            reason,
+            message: message.map(str::to_owned),
+        };
+        for (gate, status, expected) in [
+            (
+                wait(EnvironmentWaitReason::Provisioning),
+                StatusCode::SERVICE_UNAVAILABLE,
+                DataRouteRefusal::Provisioning {},
+            ),
+            (
+                wait(EnvironmentWaitReason::Disconnected),
+                StatusCode::SERVICE_UNAVAILABLE,
+                DataRouteRefusal::Disconnected {},
+            ),
+            (
+                gone(EnvironmentGoneReason::Closing, None),
+                StatusCode::GONE,
+                DataRouteRefusal::Gone {},
+            ),
+            (
+                gone(EnvironmentGoneReason::Closed, None),
+                StatusCode::GONE,
+                DataRouteRefusal::Gone {},
+            ),
+            (
+                gone(EnvironmentGoneReason::Away, Some("daemon away since 1")),
+                StatusCode::GONE,
+                DataRouteRefusal::Away {},
+            ),
+            (
+                gone(EnvironmentGoneReason::Failed, Some("boot disk missing")),
+                StatusCode::CONFLICT,
+                DataRouteRefusal::Failed {
+                    message: DescriptiveText::new("boot disk missing").unwrap(),
+                },
+            ),
+        ] {
+            let response = gate_refusal(&gate).expect("the gate refuses");
+            assert_eq!(response.status(), status, "{gate:?}");
+            assert_eq!(body_of(response), expected, "{gate:?}");
+        }
+    }
+
+    #[test]
+    fn registration_origins_come_from_the_public_base_url_and_configured_urls() {
         let loopback: SocketAddr = "127.0.0.1:18080".parse().unwrap();
         let public: SocketAddr = "0.0.0.0:18080".parse().unwrap();
+        let origins = |base: Option<&str>, urls: &[&str], bind| {
+            registration_origins(
+                base,
+                &urls.iter().map(|url| (*url).to_owned()).collect::<Vec<_>>(),
+                bind,
+            )
+            .map(|origins| {
+                origins
+                    .iter()
+                    .map(|origin| origin.as_str().to_owned())
+                    .collect::<Vec<_>>()
+            })
+        };
         assert_eq!(
-            registration_origin(None, loopback).unwrap().as_str(),
-            "ws://127.0.0.1:18080"
+            origins(None, &[], loopback).unwrap(),
+            ["ws://127.0.0.1:18080"]
         );
         assert!(
-            registration_origin(None, public).is_err(),
-            "a non-loopback bind needs the public base URL"
+            origins(None, &[], public).is_err(),
+            "a non-loopback bind needs a configured origin"
+        );
+        assert_eq!(
+            origins(Some("https://Lightspeed.example/base/"), &[], public).unwrap(),
+            ["wss://lightspeed.example"]
+        );
+        assert!(origins(Some("lightspeed.example"), &[], public).is_err());
+        assert_eq!(
+            origins(
+                Some("https://lightspeed.example"),
+                &[
+                    " ws://lightspeed-gateway.lightspeed.svc:18080/environment-gateway/connect ",
+                    "",
+                    "https://lightspeed.example/other",
+                ],
+                public,
+            )
+            .unwrap(),
+            [
+                "wss://lightspeed.example",
+                "ws://lightspeed-gateway.lightspeed.svc:18080"
+            ],
+            "configured URLs are reduced to origins, trimmed and deduplicated"
         );
         assert_eq!(
-            registration_origin(Some("https://Lightspeed.example/base/"), public)
-                .unwrap()
-                .as_str(),
-            "wss://lightspeed.example"
+            origins(None, &["ws://gateway.internal:18080"], public).unwrap(),
+            ["ws://gateway.internal:18080"],
+            "a configured URL alone serves a non-loopback bind"
         );
-        assert!(registration_origin(Some("lightspeed.example"), public).is_err());
+        assert!(origins(None, &["gateway.internal"], public).is_err());
     }
 
     #[test]
diff --git a/crates/temporal-runtime/src/gateway/mod.rs b/crates/temporal-runtime/src/gateway/mod.rs
index 29d320d88..1927f489f 100644
--- a/crates/temporal-runtime/src/gateway/mod.rs
+++ b/crates/temporal-runtime/src/gateway/mod.rs
@@ -12,12 +12,11 @@ pub use crate::config::pg_store_from_env;
 pub use deployment::GatewayDeploymentApi;
 pub use http::{
     ACTOR_HEADER, DEFAULT_GATEWAY_BIND, DEFAULT_MAX_REQUEST_BODY_BYTES, GatewayRoutes,
-    GatewayServerConfig, GatewayState, UNIVERSE_HEADER, gateway_router, prewarm_single_universe,
-    public_base_url_or_default, serve_gateway,
+    GatewayState, UNIVERSE_HEADER, gateway_router, prewarm_single_universe,
 };
 pub use service::{
     DEFAULT_PUBLIC_BASE_URL, GatewayAgentApi, GatewayAgentApiBuilder, OAuthCallbackOutcome,
-    PowerReaperStats, ReconcileFailureLog,
+    ReconcileFailureLog,
 };
 pub use temporal_workflow::{
     AgentAdmission, AgentAdmissionFailure, AgentAdmissionFailureKind, AgentCompletedRunSummary,
diff --git a/crates/temporal-runtime/src/gateway/registration.rs b/crates/temporal-runtime/src/gateway/registration.rs
index 4516e8db9..26c992cee 100644
--- a/crates/temporal-runtime/src/gateway/registration.rs
+++ b/crates/temporal-runtime/src/gateway/registration.rs
@@ -13,12 +13,18 @@
 //! environment. The gateway never names a URL: the daemon derives the
 //! stream URL from its own connect URL.
 //!
-//! Connect, heartbeat, and disconnect are written as observations on the
-//! environment row; the lifecycle reconciler derives ephemeral cleanup and
-//! stale repair from them. The one lifecycle decision the gateway makes
-//! itself is a departure: an ephemeral environment whose daemon said
-//! `registration/goodbye` is closed at once instead of after the key's
-//! disconnect grace.
+//! Liveness is written on transitions: admission and reconnect mark the
+//! row connected, the end of the current connection marks it disconnected,
+//! and while connected a coarse `last_seen_at_ms` stamp is written at most
+//! every [`REGISTERED_LIVENESS_STAMP_MS`]. The registered sweep
+//! ([`run_registered_sweep`]) flips rows whose stamp went stale, closes
+//! ephemeral environments after their key's disconnect grace and
+//! persistent ones after its `offlineCloseAfterMs`, and ends the routes of
+//! environments closed elsewhere. The one close the session itself makes
+//! is a departure: an ephemeral environment whose daemon said
+//! `registration/goodbye` closes at once. A close in this process revokes
+//! the environment's routes through [`EnvironmentSignals`]; its control
+//! connection then re-reads its row and sends `registration/closed`.
 
 use std::{
     collections::{HashMap, VecDeque},
@@ -39,7 +45,7 @@ use environment_protocol::{
     ENVD_PROTOCOL_VERSION,
     bytes::SecretString,
     error::{BusyReason, NotFoundReason, PermissionReason, PreconditionReason, ProtocolError},
-    ids::{ControlConnectionId, DaemonId, EnvironmentId, IncarnationId},
+    ids::{ControlConnectionId, DaemonId, EnvironmentId},
     jsonrpc::{self, Id, Notification, Request},
     limits::{HEARTBEAT_MISSED_INTERVALS, MAX_MESSAGE_BYTES},
     manifest::{
@@ -52,43 +58,51 @@ use environment_protocol::{
         GoodbyeParams, OpenStreamParams, OpenStreamResponse, RegisterParams, RegisterResponse,
         RegistrationIdentityMode, RegistrationReceipt, StreamSpec, signed_registration_message,
     },
-    routes::CanonicalOrigin,
+    routes::{CanonicalOrigin, DataRouteRefusal},
 };
 use environments::{
-    BeginCloseEnvironment, CreateRegisteredEnvironment, DaemonBuild, EnvironmentRecord,
-    EnvironmentRegistrationKeyStore, EnvironmentRegistryError, EnvironmentSource, EnvironmentStore,
-    ObserveRegisteredEnvironment, RegisteredConnectionObservation, RegisteredIdentityMode,
-    registration_key_hash,
+    BeginCloseEnvironment, CreateRegisteredEnvironment, DaemonBuild, EnvironmentCloseReason,
+    EnvironmentRecord, EnvironmentRegistrationKeyStore, EnvironmentRegistryError, EnvironmentState,
+    EnvironmentStore, MarkRegisteredConnected, MarkRegisteredDisconnected,
+    REGISTERED_LIVENESS_STAMP_MS, RegisteredIdentityMode, RegisteredSweep, StampRegisteredSeen,
+    WAIT_RETRY_AFTER_MS, registration_key_hash,
 };
-use tokio::sync::{Semaphore, mpsc, oneshot};
+use tokio::sync::{Semaphore, mpsc, oneshot, watch};
 use uuid::Uuid;
 
-use super::http::GatewayState;
-use crate::environments::{
-    gateway::{RouteKey, close_message},
-    registration::departure_closes,
+use super::http::{GatewayState, refusal_response};
+use crate::{
+    environments::{
+        gateway::{RouteKey, close_message},
+        signals::EnvironmentSignals,
+    },
+    universe::UniverseRuntime,
 };
 
-/// Interval between gateway pings on a control connection; each pong
-/// refreshes the environment's heartbeat stamp. Sent to the daemon as
-/// `heartbeatIntervalMs`.
+/// Interval between gateway pings on a control connection. Sent to the
+/// daemon as `heartbeatIntervalMs`; pongs keep the connection alive, and
+/// at most one per [`REGISTERED_LIVENESS_STAMP_MS`] refreshes the row's
+/// liveness stamp.
 pub const HEARTBEAT_INTERVAL: Duration = Duration::from_secs(30);
 /// A control connection that sends no frame for this long is dead.
 const LIVENESS_TIMEOUT: Duration =
     Duration::from_secs(HEARTBEAT_INTERVAL.as_secs() * HEARTBEAT_MISSED_INTERVALS as u64);
-/// Time from the challenge to the register response; the gateway closes
+/// Time from the challenge to the register request; the gateway closes
 /// the socket when it passes and the daemon reconnects with backoff.
 const HANDSHAKE_TIMEOUT: Duration = Duration::from_secs(15);
 /// Time a daemon has to dial the stream route and answer one
 /// `registration/openStream`. The worker's upgrade waits on this pairing,
 /// so worker routes connect with a longer bound
 /// (`environments::gateway::WORKER_ROUTE_CONNECT_TIMEOUT`) and receive the
-/// gateway's typed 502/504 instead of their own connect timeout.
+/// gateway's 502/504 instead of their own connect timeout.
 pub(crate) const STREAM_OPEN_TIMEOUT: Duration = Duration::from_secs(15);
-/// Interval at which a control connection re-reads durable state.
-const REAUTHORIZE_INTERVAL: Duration = Duration::from_secs(5);
+/// Pause before a control connection re-subscribes to its environment's
+/// revocations after the subscription ended.
+const RESUBSCRIBE_DELAY: Duration = Duration::from_secs(1);
+/// Interval of the registered sweep ([`run_registered_sweep`]).
+pub const REGISTERED_SWEEP_INTERVAL: Duration = Duration::from_secs(30);
 /// Unauthenticated handshakes in flight at once. A permit is held from the
-/// upgrade until the handshake resolves, never for an admitted session.
+/// upgrade until the admission is written, never for an admitted session.
 const MAX_CONCURRENT_HANDSHAKES: usize = 256;
 /// Failed admissions per verified daemon identity per window.
 const MAX_FAILURES_PER_WINDOW: usize = 20;
@@ -107,6 +121,10 @@ const CONTROL_COMMAND_QUEUE: usize = 16;
 /// design: durable truth is the environment row.
 pub struct RegisteredConnections {
     controls: Mutex<HashMap<(Uuid, String), ControlHandle>>,
+    /// One lock per environment with a connection transition in progress
+    /// ([`RegisteredConnections::transition`]); pruned when the last holder
+    /// or waiter is done.
+    transitions: Mutex<HashMap<(Uuid, String), TransitionLock>>,
     pending: Mutex<HashMap<String, PendingStream>>,
     handshakes: Arc<Semaphore>,
     failures: Mutex<FailureLimiter>,
@@ -114,11 +132,13 @@ pub struct RegisteredConnections {
 
 struct ControlHandle {
     connection_id: ControlConnectionId,
-    incarnation_id: String,
     commands: mpsc::Sender<ControlCommand>,
     /// Fired when a newer connection of the same identity is installed.
     /// A oneshot, so backpressure on `commands` can never drop it.
     supersede: oneshot::Sender<()>,
+    /// Dropped with the handle: every data route paired under this
+    /// connection subscribes to it and ends when it closes.
+    ended: watch::Sender<()>,
 }
 
 enum ControlCommand {
@@ -150,16 +170,35 @@ impl RegisteredConnections {
     pub fn new() -> Self {
         Self {
             controls: Mutex::new(HashMap::new()),
+            transitions: Mutex::new(HashMap::new()),
             pending: Mutex::new(HashMap::new()),
             handshakes: Arc::new(Semaphore::new(MAX_CONCURRENT_HANDSHAKES)),
             failures: Mutex::new(FailureLimiter::default()),
         }
     }
 
-    /// The control connection currently serving an environment, if any.
-    pub fn current_connection_id(&self, key: &RouteKey) -> Option<String> {
-        self.current(key.universe_id, &key.environment_id)
-            .map(|id| id.as_str().to_owned())
+    /// Serialize this replica's connection writes of one environment: an
+    /// admission's install and its connected write, a session end's removal
+    /// and its disconnected write, and a liveness stamp's "still current"
+    /// check and its writes. A connection's disconnect therefore never lands
+    /// after a newer connection's connected write, and a handle an admission
+    /// hands back after a failed write is always removed again, with its
+    /// disconnect, by its own session end.
+    async fn transition(self: &Arc<Self>, universe_id: Uuid, environment_id: &str) -> Transition {
+        let key = (universe_id, environment_id.to_owned());
+        let lock = self
+            .transitions
+            .lock()
+            .expect("registered transitions poisoned")
+            .entry(key.clone())
+            .or_default()
+            .clone();
+        let guard = lock.lock_owned().await;
+        Transition {
+            registrations: self.clone(),
+            key,
+            guard: Some(guard),
+        }
     }
 
     fn current(&self, universe_id: Uuid, environment_id: &str) -> Option<ControlConnectionId> {
@@ -189,21 +228,37 @@ impl RegisteredConnections {
         universe_id: Uuid,
         environment_id: &str,
         connection_id: &ControlConnectionId,
+    ) -> bool {
+        self.uninstall(universe_id, environment_id, connection_id, None)
+    }
+
+    /// Replace the handle, if it is still the current one, with `previous`
+    /// (an admission that failed hands the environment back to the
+    /// connection it displaced) or with nothing; returns true when this
+    /// connection was current until now.
+    fn uninstall(
+        &self,
+        universe_id: Uuid,
+        environment_id: &str,
+        connection_id: &ControlConnectionId,
+        previous: Option<ControlHandle>,
     ) -> bool {
         let mut controls = self
             .controls
             .lock()
             .expect("registered connections poisoned");
         let key = (universe_id, environment_id.to_owned());
-        if controls
+        if !controls
             .get(&key)
             .is_some_and(|handle| &handle.connection_id == connection_id)
         {
-            controls.remove(&key);
-            true
-        } else {
-            false
+            return false;
         }
+        match previous {
+            Some(previous) => controls.insert(key, previous),
+            None => controls.remove(&key),
+        };
+        true
     }
 
     fn take_pending(&self, token: &str) -> Option<PendingStream> {
@@ -228,6 +283,31 @@ impl RegisteredConnections {
     }
 }
 
+type TransitionLock = Arc<tokio::sync::Mutex<()>>;
+
+/// A held connection transition of one environment; the lock entry is
+/// pruned on drop once nobody else holds or waits for it.
+struct Transition {
+    registrations: Arc<RegisteredConnections>,
+    key: (Uuid, String),
+    guard: Option<tokio::sync::OwnedMutexGuard<()>>,
+}
+
+impl Drop for Transition {
+    fn drop(&mut self) {
+        drop(self.guard.take());
+        let Ok(mut transitions) = self.registrations.transitions.lock() else {
+            return;
+        };
+        if transitions
+            .get(&self.key)
+            .is_some_and(|lock| Arc::strong_count(lock) == 1)
+        {
+            transitions.remove(&self.key);
+        }
+    }
+}
+
 /// Failed admissions per verified daemon identity. Keyed only on identities
 /// whose signature verified, so nobody can spend another daemon's
 /// allowance with claimed values; pruned on every insert and capped.
@@ -292,6 +372,29 @@ pub struct AdmittedEnvironment {
     pub admission: Admission,
 }
 
+/// How a verified register request will be admitted, decided before the
+/// gateway installs the connection and writes the row.
+#[derive(Debug)]
+pub enum AdmissionPlan {
+    /// A known daemon identity whose environment is open reconnects.
+    Reconnect {
+        environment: Box<EnvironmentRecord>,
+        daemon_build: DaemonBuild,
+    },
+    /// A new identity that a registration key admits.
+    Create(CreateRegisteredEnvironment),
+}
+
+impl AdmissionPlan {
+    /// The environment the connection will serve.
+    pub fn environment_id(&self) -> &environments::EnvironmentId {
+        match self {
+            Self::Reconnect { environment, .. } => &environment.environment_id,
+            Self::Create(request) => &request.environment_id,
+        }
+    }
+}
+
 /// Decode `registration/register` params. The protocol version is read
 /// first, so a daemon of another version learns it is stale even when the
 /// rest of its request has a shape this gateway does not know; then out of
@@ -319,7 +422,7 @@ pub fn decode_register(params: &serde_json::Value) -> Result<RegisterParams, Pro
 }
 
 /// Check a register request's signature over the challenge nonce bound to
-/// one of the gateway's expected origins. Pure: no store access.
+/// one of the gateway's accepted origins. Pure: no store access.
 pub fn verify_register_request(
     params: &RegisterParams,
     nonce: &ChallengeNonce,
@@ -339,68 +442,139 @@ pub fn verify_register_request(
         return Ok(());
     }
     Err(invalid(
-        "signature does not verify against the challenge and this gateway's origin",
+        "signature does not verify against the challenge and this gateway's origins",
     ))
 }
 
-/// Admit a verified register request inside its universe: reconnect a known
-/// daemon identity, or create an environment for a new one through its
-/// registration key. Every refusal is typed and leaves no rows behind.
-pub async fn admit_registration<S>(
+/// Decide how a verified register request is admitted inside its universe:
+/// a known daemon identity reconnects its open environment, a new one is
+/// admitted through its registration key. Reads only; every refusal is
+/// typed.
+pub async fn plan_admission<S>(
     store: &S,
     params: &RegisterParams,
     now_ms: i64,
-) -> Result<AdmittedEnvironment, ProtocolError>
+) -> Result<AdmissionPlan, ProtocolError>
 where
     S: EnvironmentStore + EnvironmentRegistrationKeyStore + ?Sized,
 {
     let daemon_public_key = params.daemon_public_key.to_hex();
+    let daemon_build =
+        DaemonBuild::from_implementation(&params.implementation, params.protocol_version);
     let known = store
         .read_environment_by_daemon_public_key(&daemon_public_key)
         .await
         .map_err(unavailable)?;
     if let Some(environment) = known {
-        if environment.status.is_closing_or_closed() {
+        if environment.state == EnvironmentState::Closed {
             return Err(environment_closed(&environment));
         }
-        return Ok(AdmittedEnvironment {
-            environment,
-            admission: Admission::Reconnected,
+        return Ok(AdmissionPlan::Reconnect {
+            environment: Box::new(environment),
+            daemon_build,
         });
     }
     let Some(secret) = params.registration_key.as_ref() else {
         return Err(unknown_daemon());
     };
+    let secret_hash = registration_key_hash(secret.expose());
     let key = store
-        .resolve_registration_key(&registration_key_hash(secret.expose()))
+        .resolve_registration_key(&secret_hash)
         .await
         .map_err(unavailable)?
         .ok_or_else(unknown_registration_key)?;
     key.check_admits(now_ms).map_err(map_registry_error)?;
-    let mut metadata = params.metadata.as_map().clone();
-    metadata.extend(
-        DaemonBuild::from_implementation(&params.implementation, params.protocol_version)
-            .metadata(),
-    );
-    let environment = store
-        .create_registered_environment(CreateRegisteredEnvironment {
-            registration_key_id: key.registration_key_id.clone(),
-            environment_id: super::service::allocate_environment_id_public(),
-            incarnation_id: super::service::allocate_incarnation_id_public(),
-            daemon_public_key,
-            display_name: params
-                .display_name
-                .as_ref()
-                .map(|name| name.as_str().to_owned()),
-            metadata,
-            created_at_ms: now_ms,
-        })
-        .await
-        .map_err(map_registry_error)?;
-    Ok(AdmittedEnvironment {
-        environment,
-        admission: Admission::Created,
-    })
+    Ok(AdmissionPlan::Create(CreateRegisteredEnvironment {
+        registration_key_id: key.registration_key_id.clone(),
+        secret_hash,
+        environment_id: super::service::allocate_environment_id_public(),
+        daemon_public_key,
+        display_name: params
+            .display_name
+            .as_ref()
+            .map(|name| name.as_str().to_owned()),
+        metadata: params.metadata.as_map().clone(),
+        daemon_build,
+        created_at_ms: now_ms,
+    }))
+}
+
+/// Write an admission: mark a reconnecting environment connected with the
+/// build that serves it now, or create the new environment open and
+/// connected (the store re-checks the key and its capacity in the same
+/// transaction). Nothing is left behind on a refusal.
+pub async fn commit_admission<S>(
+    store: &S,
+    plan: AdmissionPlan,
+    now_ms: i64,
+) -> Result<AdmittedEnvironment, ProtocolError>
+where
+    S: EnvironmentStore + ?Sized,
+{
+    match plan {
+        AdmissionPlan::Reconnect {
+            environment,
+            daemon_build,
+        } => {
+            let marked = store
+                .mark_registered_connected(MarkRegisteredConnected {
+                    environment_id: environment.environment_id.clone(),
+                    daemon_build,
+                    at_ms: now_ms,
+                })
+                .await;
+            match marked {
+                Ok(environment) => Ok(AdmittedEnvironment {
+                    environment,
+                    admission: Admission::Reconnected,
+                }),
+                // Closed since the plan read it: the identity is spent.
+                Err(EnvironmentRegistryError::InvalidInput { .. })
+                    if store
+                        .read_environment(&environment.environment_id)
+                        .await
+                        .is_ok_and(|current| current.state == EnvironmentState::Closed) =>
+                {
+                    Err(environment_closed(&environment))
+                }
+                Err(error) => Err(map_registry_error(error)),
+            }
+        }
+        AdmissionPlan::Create(request) => {
+            let environment = store
+                .create_registered_environment(request.clone())
+                .await
+                .map_err(map_registry_error)?;
+            if environment.environment_id != request.environment_id {
+                // Another connection of this identity was admitted first.
+                return Err(if environment.state == EnvironmentState::Closed {
+                    environment_closed(&environment)
+                } else {
+                    ProtocolError::unavailable(
+                        "this daemon identity was admitted by another connection; reconnect",
+                    )
+                });
+            }
+            Ok(AdmittedEnvironment {
+                environment,
+                admission: Admission::Created,
+            })
+        }
+    }
+}
+
+/// [`plan_admission`] then [`commit_admission`], for callers that hold no
+/// connection to install in between.
+pub async fn admit_registration<S>(
+    store: &S,
+    params: &RegisterParams,
+    now_ms: i64,
+) -> Result<AdmittedEnvironment, ProtocolError>
+where
+    S: EnvironmentStore + EnvironmentRegistrationKeyStore + ?Sized,
+{
+    let plan = plan_admission(store, params, now_ms).await?;
+    commit_admission(store, plan, now_ms).await
 }
 
 /// The receipt of an admitted environment, built only from a registered
@@ -410,12 +584,7 @@ fn registration_receipt(
     control_connection_id: &ControlConnectionId,
     admission: Admission,
 ) -> Result<RegistrationReceipt, ProtocolError> {
-    let EnvironmentSource::Registered {
-        daemon_id,
-        identity_mode,
-        ..
-    } = &environment.source
-    else {
+    let Some(source) = environment.registered() else {
         return Err(ProtocolError::internal(
             "the admitted environment is not a registered environment",
         ));
@@ -426,11 +595,9 @@ fn registration_receipt(
     Ok(RegistrationReceipt {
         environment_id: EnvironmentId::new(environment.environment_id.as_str())
             .map_err(internal)?,
-        incarnation_id: IncarnationId::new(environment.incarnation.incarnation_id.as_str())
-            .map_err(internal)?,
-        daemon_id: DaemonId::new(daemon_id.as_str()).map_err(internal)?,
+        daemon_id: DaemonId::new(source.daemon_id().as_str()).map_err(internal)?,
         control_connection_id: control_connection_id.clone(),
-        identity_mode: match identity_mode {
+        identity_mode: match source.identity_mode {
             RegisteredIdentityMode::Persistent => RegistrationIdentityMode::Persistent,
             RegisteredIdentityMode::Ephemeral => RegistrationIdentityMode::Ephemeral,
         },
@@ -467,6 +634,11 @@ fn map_registry_error(error: EnvironmentRegistryError) -> ProtocolError {
         EnvironmentRegistryError::RegistrationKeyUnavailable {
             reason: "expired", ..
         } => ProtocolError::expired("registration key is expired"),
+        // A rotation retired the presented secret while its admission was in
+        // flight: the same answer a later admission with it gets.
+        EnvironmentRegistryError::RegistrationKeyUnavailable {
+            reason: "rotated", ..
+        } => unknown_registration_key(),
         EnvironmentRegistryError::RegistrationKeyUnavailable { reason, .. } => {
             ProtocolError::permission_denied(
                 Some(PermissionReason::RegistrationKeyRevoked),
@@ -524,20 +696,20 @@ pub(super) async fn connect_upgrade(
     State(state): State<Arc<GatewayState>>,
     upgrade: WebSocketUpgrade,
 ) -> Response {
-    let Some(origin) = state.registration_origin().cloned() else {
+    if state.registration_origins().is_empty() {
         tracing::error!(
             target: "temporal_runtime",
-            "registration refused: the gateway has no valid public base URL to verify daemon signatures against"
+            "registration refused: the gateway has no valid origin to verify daemon signatures against"
         );
         return StatusCode::SERVICE_UNAVAILABLE.into_response();
-    };
+    }
     let Ok(permit) = state.registrations().handshakes.clone().try_acquire_owned() else {
         return StatusCode::SERVICE_UNAVAILABLE.into_response();
     };
     upgrade
         .max_message_size(CONTROL_MAX_MESSAGE_BYTES)
         .max_frame_size(CONTROL_MAX_MESSAGE_BYTES)
-        .on_upgrade(move |socket| control_connection(state, socket, permit, origin))
+        .on_upgrade(move |socket| control_connection(state, socket, permit))
         .into_response()
 }
 
@@ -578,25 +750,35 @@ pub(super) async fn data_upgrade(
 }
 
 /// Ask the daemon serving `key` to dial a data stream for one worker route
-/// and wait for it. Returns the paired socket and the control connection it
-/// was issued under, so the proxy can fence on it.
+/// and wait for it. Returns the paired socket and a receiver that closes
+/// when the control connection it was issued under ends. Without a live
+/// control connection the route is refused `disconnected`; a daemon that
+/// cannot open the stream is a bodiless 502, one that does not dial within
+/// [`STREAM_OPEN_TIMEOUT`] a 504.
 pub(super) async fn open_registered_route(
     state: &Arc<GatewayState>,
     key: &RouteKey,
-) -> Result<(WebSocket, String), StatusCode> {
+) -> Result<(WebSocket, watch::Receiver<()>), Box<Response>> {
+    let disconnected = || {
+        Box::new(refusal_response(
+            &DataRouteRefusal::Disconnected {},
+            Some(WAIT_RETRY_AFTER_MS),
+        ))
+    };
     let registrations = state.registrations();
-    let (commands, control_connection_id) = {
+    let (commands, control_connection_id, control_ended) = {
         let controls = registrations
             .controls
             .lock()
             .expect("registered connections poisoned");
         let Some(handle) = controls.get(&(key.universe_id, key.environment_id.clone())) else {
-            return Err(StatusCode::SERVICE_UNAVAILABLE);
+            return Err(disconnected());
         };
-        if handle.incarnation_id != key.incarnation_id {
-            return Err(StatusCode::CONFLICT);
-        }
-        (handle.commands.clone(), handle.connection_id.clone())
+        (
+            handle.commands.clone(),
+            handle.connection_id.clone(),
+            handle.ended.subscribe(),
+        )
     };
     let token = new_token();
     let (sender, socket) = oneshot::channel();
@@ -610,7 +792,7 @@ pub(super) async fn open_registered_route(
                 sender,
                 expires_at: Instant::now() + STREAM_OPEN_TIMEOUT,
                 key: key.clone(),
-                control_connection_id: control_connection_id.clone(),
+                control_connection_id,
             },
         );
     let opened = tokio::time::timeout(STREAM_OPEN_TIMEOUT, async {
@@ -621,7 +803,7 @@ pub(super) async fn open_registered_route(
                 answered,
             })
             .await
-            .map_err(|_| StatusCode::SERVICE_UNAVAILABLE)?;
+            .map_err(|_| disconnected())?;
         match answer.await {
             Ok(Ok(())) => {}
             Ok(Err(error)) => {
@@ -631,45 +813,49 @@ pub(super) async fn open_registered_route(
                     %error,
                     "registered daemon could not open a stream"
                 );
-                return Err(StatusCode::BAD_GATEWAY);
+                return Err(Box::new(StatusCode::BAD_GATEWAY.into_response()));
             }
             // The control connection ended before the daemon answered.
-            Err(_) => return Err(StatusCode::SERVICE_UNAVAILABLE),
+            Err(_) => return Err(disconnected()),
         }
-        socket.await.map_err(|_| StatusCode::BAD_GATEWAY)
+        socket
+            .await
+            .map_err(|_| Box::new(StatusCode::BAD_GATEWAY.into_response()))
     })
     .await;
     match opened {
-        Ok(Ok(socket)) => Ok((socket, control_connection_id.as_str().to_owned())),
-        Ok(Err(status)) => {
+        Ok(Ok(socket)) => Ok((socket, control_ended)),
+        Ok(Err(refused)) => {
             registrations.take_pending(&token);
-            Err(status)
+            Err(refused)
         }
         Err(_) => {
             registrations.take_pending(&token);
-            Err(StatusCode::GATEWAY_TIMEOUT)
+            Err(Box::new(StatusCode::GATEWAY_TIMEOUT.into_response()))
         }
     }
 }
 
-/// Pipe one worker route and one reverse-dialed daemon socket, re-checking
-/// durable state and the current control connection on an interval.
+/// Pipe one worker route and one reverse-dialed daemon socket until either
+/// side ends, the environment's routes are revoked, or the control
+/// connection the stream was issued under ends.
 pub(super) async fn proxy_registered_route(
-    state: Arc<GatewayState>,
-    key: RouteKey,
-    control_connection_id: String,
+    mut revoked: watch::Receiver<u64>,
+    mut control_ended: watch::Receiver<()>,
     mut worker: WebSocket,
     mut daemon: WebSocket,
 ) {
-    let mut reauthorize = tokio::time::interval(REAUTHORIZE_INTERVAL);
-    reauthorize.tick().await;
     loop {
         tokio::select! {
-            _ = reauthorize.tick() => {
-                if authorize_registered_route(&state, &key, &control_connection_id).await.is_err() {
-                    let _ = worker.send(close_message("registered route authorization changed")).await;
-                    break;
-                }
+            // A dropped revocation sender fails closed like a revocation.
+            _ = revoked.changed() => {
+                let _ = worker.send(close_message("environment route revoked")).await;
+                break;
+            }
+            // Nobody sends on it: it resolves when the handle is dropped.
+            _ = control_ended.changed() => {
+                let _ = worker.send(close_message("registered control connection ended")).await;
+                break;
             }
             message = worker.recv() => {
                 let Some(Ok(message)) = message else { break };
@@ -687,30 +873,6 @@ pub(super) async fn proxy_registered_route(
     let _ = worker.send(Message::Close(None)).await;
 }
 
-async fn authorize_registered_route(
-    state: &GatewayState,
-    key: &RouteKey,
-    control_connection_id: &str,
-) -> anyhow::Result<()> {
-    if state.registrations().current_connection_id(key).as_deref() != Some(control_connection_id) {
-        anyhow::bail!("control connection superseded");
-    }
-    let api = state
-        .api_for_daemon(key.universe_id)
-        .await
-        .map_err(|error| anyhow::anyhow!(error.message))?;
-    let environment_id = environments::EnvironmentId::try_new(key.environment_id.clone())?;
-    let environment =
-        EnvironmentStore::read_environment(api.store().as_ref(), &environment_id).await?;
-    if !environment.is_registered()
-        || environment.incarnation.incarnation_id.as_str() != key.incarnation_id
-        || environment.status.is_closing_or_closed()
-    {
-        anyhow::bail!("registered route no longer valid");
-    }
-    Ok(())
-}
-
 /// What the gateway does with one frame before admission.
 #[derive(Debug, PartialEq)]
 enum PreAdmission {
@@ -821,13 +983,29 @@ fn binary_frame_refusal() -> jsonrpc::Response {
     )
 }
 
-/// Everything the handshake established.
-struct Handshake {
+/// A register request whose signature verified, with its admission decided
+/// but not yet written.
+struct Verified {
     universe_id: Uuid,
     store: Arc<store_pg::PgStore>,
     register: RegisterParams,
     register_id: Id,
-    admitted: AdmittedEnvironment,
+    plan: AdmissionPlan,
+}
+
+/// An admission that was written, with the installed connection's
+/// channels.
+struct AdmittedConnection {
+    universe_id: Uuid,
+    store: Arc<store_pg::PgStore>,
+    register: RegisterParams,
+    register_id: Id,
+    environment: EnvironmentRecord,
+    receipt: RegistrationReceipt,
+    connection_id: ControlConnectionId,
+    commands: mpsc::Receiver<ControlCommand>,
+    superseded: oneshot::Receiver<()>,
+    revoked: watch::Receiver<u64>,
 }
 
 /// Why a handshake produced no admitted session.
@@ -842,20 +1020,34 @@ async fn control_connection(
     state: Arc<GatewayState>,
     mut socket: WebSocket,
     permit: tokio::sync::OwnedSemaphorePermit,
-    origin: CanonicalOrigin,
 ) {
-    let handshake =
-        tokio::time::timeout(HANDSHAKE_TIMEOUT, handshake(&state, &mut socket, &origin)).await;
+    // The handshake waits on the daemon and is bounded; the admission write
+    // that follows runs to completion, so a row is never left connected
+    // without the connection that wrote it.
+    let verified =
+        match tokio::time::timeout(HANDSHAKE_TIMEOUT, handshake(&state, &mut socket)).await {
+            Ok(verified) => verified,
+            Err(_) => {
+                // A daemon that is paused or starved retries with backoff.
+                tracing::info!(target: "temporal_runtime", "registration handshake timed out");
+                let _ = socket.send(Message::Close(None)).await;
+                return;
+            }
+        };
+    let admitted = match verified {
+        Ok(verified) => admit(&state, verified).await,
+        Err(refused) => Err(refused),
+    };
     // The permit bounds unauthenticated handshakes only: it is released as
-    // soon as the handshake resolved, whatever its outcome.
+    // soon as the admission resolved, whatever its outcome.
     drop(permit);
-    match handshake {
-        Ok(Ok(handshake)) => {
-            if let Err(error) = admitted_session(&state, socket, handshake).await {
+    match admitted {
+        Ok(admitted) => {
+            if let Err(error) = admitted_session(&state, socket, admitted).await {
                 tracing::debug!(target: "temporal_runtime", %error, "registration control session ended with error");
             }
         }
-        Ok(Err(Refused::Answer(id, error))) => {
+        Err(Refused::Answer(id, error)) => {
             tracing::info!(target: "temporal_runtime", kind = error.kind().as_str(), %error, "registration refused");
             let _ = send_text(
                 &mut socket,
@@ -864,23 +1056,15 @@ async fn control_connection(
             .await;
             let _ = socket.send(Message::Close(None)).await;
         }
-        Ok(Err(Refused::Silent)) => {
-            let _ = socket.send(Message::Close(None)).await;
-        }
-        Err(_) => {
-            // A daemon that is paused or starved retries with backoff.
-            tracing::info!(target: "temporal_runtime", "registration handshake timed out");
+        Err(Refused::Silent) => {
             let _ = socket.send(Message::Close(None)).await;
         }
     }
 }
 
-/// Challenge, read the register request, verify and admit it.
-async fn handshake(
-    state: &Arc<GatewayState>,
-    socket: &mut WebSocket,
-    origin: &CanonicalOrigin,
-) -> Result<Handshake, Refused> {
+/// Challenge, read the register request, verify it and decide its
+/// admission.
+async fn handshake(state: &Arc<GatewayState>, socket: &mut WebSocket) -> Result<Verified, Refused> {
     let nonce = new_nonce();
     let challenge = Notification::new(
         RegistrationChallenge::NAME,
@@ -915,7 +1099,7 @@ async fn handshake(
     let id = request.id.clone();
     let refuse = |error: ProtocolError| Refused::Answer(id.clone(), error);
     let register = decode_register(&request.params).map_err(refuse)?;
-    verify_register_request(&register, &nonce, std::slice::from_ref(origin)).map_err(refuse)?;
+    verify_register_request(&register, &nonce, state.registration_origins()).map_err(refuse)?;
 
     // From here the identity is verified: rate limits key on it alone.
     let registrations = state.registrations();
@@ -952,83 +1136,126 @@ async fn handshake(
         refuse(registration_unavailable())
     })?;
     let store = api.store().clone();
-    let admitted = admit_registration(store.as_ref(), &register, now_ms())
+    let plan = plan_admission(store.as_ref(), &register, now_ms())
         .await
         .map_err(refuse_counted)?;
-
-    // Record the connect, with the build that serves the environment now,
-    // before the daemon learns it is admitted: a row that cannot take the
-    // observation must not report a live daemon.
-    EnvironmentStore::observe_registered_environment(
-        store.as_ref(),
-        ObserveRegisteredEnvironment {
-            environment_id: admitted.environment.environment_id.clone(),
-            observation: RegisteredConnectionObservation::Connected,
-            observed_at_ms: now_ms(),
-            metadata: DaemonBuild::from_implementation(
-                &register.implementation,
-                register.protocol_version,
-            )
-            .metadata(),
-        },
-    )
-    .await
-    .map_err(|error| refuse(map_registry_error(error)))?;
-    Ok(Handshake {
+    Ok(Verified {
         universe_id,
         store,
         register,
         register_id: id,
-        admitted,
+        plan,
     })
 }
 
-/// The admitted control connection: answer the register request, then
-/// ping, pair streams and watch the environment until the session ends.
-/// Cleanup runs on every exit path.
-async fn admitted_session(
+/// Install the connection, then write the admission, both inside the
+/// environment's connection transition. The handle goes in first, so a row
+/// that reads connected without a handle exists only while a connection
+/// ends. The connection it displaces is superseded only once the write
+/// succeeded; a refused admission hands the environment back to it, and
+/// since that connection's own session end takes the same transition, a
+/// handle handed back after its session ended is removed again with its
+/// disconnect.
+async fn admit(
     state: &Arc<GatewayState>,
-    mut socket: WebSocket,
-    handshake: Handshake,
-) -> anyhow::Result<()> {
-    let Handshake {
+    verified: Verified,
+) -> Result<AdmittedConnection, Refused> {
+    let Verified {
         universe_id,
         store,
         register,
         register_id,
-        admitted,
-    } = handshake;
-    let environment = admitted.environment;
-    let environment_id = environment.environment_id.to_string();
+        plan,
+    } = verified;
+    let registrations = state.registrations();
+    let environment_id = plan.environment_id().to_string();
     let connection_id = ControlConnectionId::new(format!("connection_{}", Uuid::new_v4().simple()))
         .expect("generated control connection ids are valid");
-    let receipt = match registration_receipt(&environment, &connection_id, admitted.admission) {
-        Ok(receipt) => receipt,
-        Err(error) => {
-            let _ = send_text(
-                &mut socket,
-                jsonrpc::Response::failure(Some(register_id), error).to_text(),
-            )
-            .await;
-            let _ = socket.send(Message::Close(None)).await;
-            return Ok(());
-        }
-    };
-    let registrations = state.registrations();
     let (commands, command_rx) = mpsc::channel(CONTROL_COMMAND_QUEUE);
     let (supersede, superseded) = oneshot::channel();
-    if let Some(previous) = registrations.install(
+    let (ended, _) = watch::channel(());
+    // Subscribed before the write: a close that lands after it still
+    // reaches this connection.
+    let revoked = state.signals().watch(universe_id, &environment_id);
+    let _transition = registrations.transition(universe_id, &environment_id).await;
+    let previous = registrations.install(
         universe_id,
         environment_id.clone(),
         ControlHandle {
             connection_id: connection_id.clone(),
-            incarnation_id: environment.incarnation.incarnation_id.to_string(),
             commands,
             supersede,
+            ended,
         },
-    ) {
+    );
+    let refuse = |error: ProtocolError| {
+        if counts_as_failure(&error) {
+            registrations.record_failure(&register.daemon_public_key);
+        }
+        Refused::Answer(register_id.clone(), error)
+    };
+    let admitted = match commit_admission(store.as_ref(), plan, now_ms()).await {
+        Ok(admitted) => admitted,
+        Err(error) => {
+            registrations.uninstall(universe_id, &environment_id, &connection_id, previous);
+            return Err(refuse(error));
+        }
+    };
+    let receipt =
+        match registration_receipt(&admitted.environment, &connection_id, admitted.admission) {
+            Ok(receipt) => receipt,
+            Err(error) => {
+                // A handed-back connection is live and keeps the row
+                // connected; without one nobody holds it.
+                let handed_back = previous.is_some();
+                if registrations.uninstall(universe_id, &environment_id, &connection_id, previous)
+                    && !handed_back
+                {
+                    mark_disconnected(&store, &admitted.environment.environment_id).await;
+                }
+                return Err(refuse(error));
+            }
+        };
+    if let Some(previous) = previous {
+        // Dropping the displaced handle also ends its data routes.
         let _ = previous.supersede.send(());
     }
+    Ok(AdmittedConnection {
+        universe_id,
+        store,
+        register,
+        register_id,
+        environment: admitted.environment,
+        receipt,
+        connection_id,
+        commands: command_rx,
+        superseded,
+        revoked,
+    })
+}
+
+/// The admitted control connection: answer the register request, then
+/// ping, pair streams and watch for revocation until the session ends.
+/// Cleanup runs on every exit path.
+async fn admitted_session(
+    state: &Arc<GatewayState>,
+    mut socket: WebSocket,
+    admitted: AdmittedConnection,
+) -> anyhow::Result<()> {
+    let AdmittedConnection {
+        universe_id,
+        store,
+        register,
+        register_id,
+        environment,
+        receipt,
+        connection_id,
+        commands,
+        superseded,
+        revoked,
+    } = admitted;
+    let environment_id = environment.environment_id.to_string();
+    let registrations = state.registrations();
     tracing::info!(
         target: "temporal_runtime",
         %universe_id,
@@ -1045,17 +1272,27 @@ async fn admitted_session(
         universe_id,
         environment: &environment,
         connection_id: &connection_id,
+        daemon_build: DaemonBuild::from_implementation(
+            &register.implementation,
+            register.protocol_version,
+        ),
     };
-    let (end, heartbeat_write) = session
-        .serve(&mut socket, register_id, receipt, command_rx, superseded)
+    let end = session
+        .serve(
+            &mut socket,
+            register_id,
+            receipt,
+            commands,
+            superseded,
+            revoked,
+        )
         .await;
+    // Inside the transition: a liveness write that already passed its
+    // "still current" check lands first, a newer admission's connected
+    // write lands after this disconnect, and a later liveness write sees
+    // the removal.
+    let transition = registrations.transition(universe_id, &environment_id).await;
     let was_current = registrations.remove_if_current(universe_id, &environment_id, &connection_id);
-    // A heartbeat write that already passed its "still current" check
-    // must land before the disconnect, or a late `Connected` would report
-    // a live daemon on a row nobody holds. Later writes see the removal.
-    if let Some(write) = heartbeat_write {
-        settle_heartbeat_write(write).await;
-    }
     tracing::info!(
         target: "temporal_runtime",
         %universe_id,
@@ -1066,34 +1303,42 @@ async fn admitted_session(
         "registered environment control connection ended"
     );
     if was_current {
-        observe(
-            &store,
-            &environment.environment_id,
-            RegisteredConnectionObservation::Disconnected,
-        )
-        .await;
+        mark_disconnected(&store, &environment.environment_id).await;
         if end == SessionEnd::Goodbye && departure_closes(&environment) {
             close_departed(&store, &environment).await;
+            state.signals().revoke(universe_id, &environment_id);
         }
     }
+    drop(transition);
     let _ = socket.send(Message::Close(None)).await;
     Ok(())
 }
 
-/// Longest wait for an in-flight heartbeat write when a session ends; a
-/// write still running after it is aborted.
-const HEARTBEAT_SETTLE_TIMEOUT: Duration = Duration::from_secs(5);
+/// A deliberate goodbye ends an ephemeral daemon's sandbox for good, so its
+/// environment closes at once instead of after the key's disconnect grace.
+/// A persistent daemon's environment waits for it to return.
+fn departure_closes(environment: &EnvironmentRecord) -> bool {
+    environment
+        .registered()
+        .is_some_and(|source| source.identity_mode == RegisteredIdentityMode::Ephemeral)
+}
 
-async fn settle_heartbeat_write(mut write: tokio::task::JoinHandle<()>) {
-    if tokio::time::timeout(HEARTBEAT_SETTLE_TIMEOUT, &mut write)
-        .await
-        .is_err()
-    {
-        write.abort();
-        tracing::warn!(
-            target: "temporal_runtime",
-            "registered heartbeat write did not finish before the disconnect; aborted"
-        );
+async fn mark_disconnected(
+    store: &Arc<store_pg::PgStore>,
+    environment_id: &environments::EnvironmentId,
+) {
+    let result = EnvironmentStore::mark_registered_disconnected(
+        store.as_ref(),
+        MarkRegisteredDisconnected {
+            environment_id: environment_id.clone(),
+            at_ms: now_ms(),
+        },
+    )
+    .await;
+    // The registered sweep marks the row disconnected once its liveness
+    // stamp goes stale.
+    if let Err(error) = result {
+        tracing::warn!(target: "temporal_runtime", %error, environment = %environment_id, "recording a registered disconnect failed");
     }
 }
 
@@ -1102,7 +1347,8 @@ async fn close_departed(store: &Arc<store_pg::PgStore>, environment: &Environmen
         store.as_ref(),
         BeginCloseEnvironment {
             environment_id: environment.environment_id.clone(),
-            updated_at_ms: now_ms(),
+            reason: EnvironmentCloseReason::Departed,
+            at_ms: now_ms(),
         },
     )
     .await;
@@ -1110,9 +1356,9 @@ async fn close_departed(store: &Arc<store_pg::PgStore>, environment: &Environmen
         Ok(_) => tracing::info!(
             target: "temporal_runtime",
             environment = %environment.environment_id,
-            "ephemeral registered daemon departed; closing its environment"
+            "ephemeral registered daemon departed; closed its environment"
         ),
-        // The reconciler's grace sweep closes it later.
+        // The registered sweep closes it after the key's grace.
         Err(error) => tracing::warn!(
             target: "temporal_runtime",
             environment = %environment.environment_id,
@@ -1152,12 +1398,11 @@ struct ControlSession<'a> {
     universe_id: Uuid,
     environment: &'a EnvironmentRecord,
     connection_id: &'a ControlConnectionId,
+    daemon_build: DaemonBuild,
 }
 
 impl ControlSession<'_> {
-    /// Serve the admitted session until it ends. Also returns the heartbeat
-    /// write still in flight, which the caller settles before recording
-    /// the disconnect.
+    /// Serve the admitted session until it ends.
     async fn serve(
         &self,
         socket: &mut WebSocket,
@@ -1165,7 +1410,8 @@ impl ControlSession<'_> {
         receipt: RegistrationReceipt,
         commands: mpsc::Receiver<ControlCommand>,
         superseded: oneshot::Receiver<()>,
-    ) -> (SessionEnd, Option<tokio::task::JoinHandle<()>>) {
+        revoked: watch::Receiver<u64>,
+    ) -> SessionEnd {
         let response = jsonrpc::Response::success(
             register_id,
             &RegisterResponse {
@@ -1175,13 +1421,9 @@ impl ControlSession<'_> {
             },
         );
         if send_text(socket, response.to_text()).await.is_err() {
-            return (SessionEnd::SendFailed, None);
+            return SessionEnd::SendFailed;
         }
-        let mut heartbeat_write = None;
-        let end = self
-            .run(socket, commands, superseded, &mut heartbeat_write)
-            .await;
-        (end, heartbeat_write)
+        self.run(socket, commands, superseded, revoked).await
     }
 
     async fn run(
@@ -1189,17 +1431,26 @@ impl ControlSession<'_> {
         socket: &mut WebSocket,
         mut commands: mpsc::Receiver<ControlCommand>,
         mut superseded: oneshot::Receiver<()>,
-        heartbeat_write: &mut Option<tokio::task::JoinHandle<()>>,
+        revoked: watch::Receiver<u64>,
     ) -> SessionEnd {
         let mut heartbeat = tokio::time::interval(HEARTBEAT_INTERVAL);
         heartbeat.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Delay);
         heartbeat.tick().await;
-        let (mut environment_closed, _watcher) = self.watch_environment_closed();
+        let (mut environment_closed, _watcher) = self.watch_environment_closed(revoked);
         let mut watching = true;
         let mut deadline = tokio::time::Instant::now() + LIVENESS_TIMEOUT;
+        // The admission wrote the first stamp.
+        let mut last_stamp_ms = self
+            .environment
+            .registered()
+            .map_or_else(now_ms, |source| source.last_seen_at_ms);
         let mut next_request = 0_u64;
         let mut streams: HashMap<Id, oneshot::Sender<Result<(), ProtocolError>>> = HashMap::new();
         let mut commands_closed = false;
+        // One liveness write at a time. One still running when the session
+        // ends finishes on its own: it holds the environment's transition,
+        // so the disconnect waits for it.
+        let mut seen_write: Option<tokio::task::JoinHandle<()>> = None;
         loop {
             // Biased: a frame that already arrived is read before the
             // liveness deadline is checked, so a loop that fell behind
@@ -1253,8 +1504,12 @@ impl ControlSession<'_> {
                     deadline = tokio::time::Instant::now() + LIVENESS_TIMEOUT;
                     let answer = match message {
                         Message::Pong(_) => {
-                            if heartbeat_write.as_ref().is_none_or(|write| write.is_finished()) {
-                                *heartbeat_write = Some(self.record_heartbeat());
+                            let at_ms = now_ms();
+                            if at_ms.saturating_sub(last_stamp_ms) >= REGISTERED_LIVENESS_STAMP_MS
+                                && seen_write.as_ref().is_none_or(|write| write.is_finished())
+                            {
+                                last_stamp_ms = at_ms;
+                                seen_write = Some(self.record_seen(at_ms));
                             }
                             None
                         }
@@ -1293,28 +1548,36 @@ impl ControlSession<'_> {
         }
     }
 
-    /// Re-read the environment every [`REAUTHORIZE_INTERVAL`] off the
-    /// session loop, so a slow store never delays pings, pongs or stream
-    /// requests. The receiver fires once the environment is closing or
-    /// closed; the watcher stops when the returned guard drops.
-    fn watch_environment_closed(&self) -> (oneshot::Receiver<()>, AbortOnDrop) {
+    /// Wait off the session loop for the environment's routes to be
+    /// revoked, then re-read the row once, so a slow store never delays
+    /// pings, pongs or stream requests. The receiver fires once the
+    /// environment is closed; the watcher stops when the returned guard
+    /// drops.
+    fn watch_environment_closed(
+        &self,
+        mut revoked: watch::Receiver<u64>,
+    ) -> (oneshot::Receiver<()>, AbortOnDrop) {
+        let signals: Arc<EnvironmentSignals> = self.state.signals().clone();
         let store = self.store.clone();
+        let universe_id = self.universe_id;
         let environment_id = self.environment.environment_id.clone();
         let (closed, receiver) = oneshot::channel();
         let task = tokio::spawn(async move {
-            let mut interval = tokio::time::interval(REAUTHORIZE_INTERVAL);
-            interval.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Delay);
-            interval.tick().await;
             loop {
-                interval.tick().await;
+                if revoked.changed().await.is_err() {
+                    // The subscription ended without a revocation: take a
+                    // new one, then read the row in case a close was missed.
+                    tokio::time::sleep(RESUBSCRIBE_DELAY).await;
+                    revoked = signals.watch(universe_id, environment_id.as_str());
+                }
                 match EnvironmentStore::read_environment(store.as_ref(), &environment_id).await {
-                    Ok(current) if current.status.is_closing_or_closed() => {
+                    Ok(current) if current.state == EnvironmentState::Closed => {
                         let _ = closed.send(());
                         return;
                     }
                     Ok(_) => {}
                     Err(error) => {
-                        tracing::warn!(target: "temporal_runtime", %error, "registered control reauthorization failed");
+                        tracing::warn!(target: "temporal_runtime", %error, environment = %environment_id, "registered control connection could not re-read its environment");
                     }
                 }
             }
@@ -1341,26 +1604,60 @@ impl ControlSession<'_> {
             .await;
     }
 
-    /// A pong from the current control connection means the daemon is
-    /// connected: refresh the stamp and restore `Ready` if a lost write or
-    /// the stale sweep marked the row offline. Written off the session
-    /// loop so a slow store never delays pings or stream requests.
-    fn record_heartbeat(&self) -> tokio::task::JoinHandle<()> {
+    /// The coarse liveness stamp of the current control connection, written
+    /// off the session loop so a slow store never delays pings or stream
+    /// requests, inside the environment's connection transition. When the
+    /// row no longer reads connected (a stale sweep or a lost write marked
+    /// it disconnected while this connection was up), the connection is
+    /// recorded again instead.
+    fn record_seen(&self, at_ms: i64) -> tokio::task::JoinHandle<()> {
         let registrations = self.state.registrations().clone();
         let store = self.store.clone();
         let universe_id = self.universe_id;
         let environment_id = self.environment.environment_id.clone();
         let connection_id = self.connection_id.clone();
+        let daemon_build = self.daemon_build.clone();
         tokio::spawn(async move {
+            let _transition = registrations
+                .transition(universe_id, environment_id.as_str())
+                .await;
             if registrations.current(universe_id, environment_id.as_str()) != Some(connection_id) {
                 return;
             }
-            observe(
-                &store,
-                &environment_id,
-                RegisteredConnectionObservation::Connected,
+            let stamped = EnvironmentStore::stamp_registered_seen(
+                store.as_ref(),
+                StampRegisteredSeen {
+                    environment_id: environment_id.clone(),
+                    at_ms,
+                },
             )
             .await;
+            let restore = match stamped {
+                Ok(true) => false,
+                Ok(false) => EnvironmentStore::read_environment(store.as_ref(), &environment_id)
+                    .await
+                    .is_ok_and(|current| {
+                        current.state == EnvironmentState::Open
+                            && current.registered().is_some_and(|source| !source.connected)
+                    }),
+                Err(error) => {
+                    tracing::warn!(target: "temporal_runtime", %error, environment = %environment_id, "registered liveness stamp failed");
+                    false
+                }
+            };
+            if restore
+                && let Err(error) = EnvironmentStore::mark_registered_connected(
+                    store.as_ref(),
+                    MarkRegisteredConnected {
+                        environment_id: environment_id.clone(),
+                        daemon_build,
+                        at_ms,
+                    },
+                )
+                .await
+            {
+                tracing::warn!(target: "temporal_runtime", %error, environment = %environment_id, "restoring a registered connection failed");
+            }
         })
     }
 }
@@ -1374,26 +1671,90 @@ impl Drop for AbortOnDrop {
     }
 }
 
-async fn observe(
-    store: &Arc<store_pg::PgStore>,
-    environment_id: &environments::EnvironmentId,
-    observation: RegisteredConnectionObservation,
-) {
-    let result = EnvironmentStore::observe_registered_environment(
-        store.as_ref(),
-        ObserveRegisteredEnvironment {
-            environment_id: environment_id.clone(),
-            observation,
-            observed_at_ms: now_ms(),
-            metadata: Default::default(),
-        },
-    )
-    .await;
-    if let Err(error) = result {
-        tracing::warn!(target: "temporal_runtime", %error, ?observation, "registered observation failed");
+/// Startup repair, before the environment-gateway listener accepts
+/// connections: every registered row that reads connected loses its
+/// connection now, since this process held all of them (one
+/// environment-gateway replica per deployment). Persistent rows then get
+/// their full reconnect wait while their daemons reconnect.
+pub async fn repair_registered_connections(
+    runtime: &UniverseRuntime,
+) -> Result<u64, store_pg::PgStoreError> {
+    store_pg::repair_registered_connections(runtime.stores().pool(), now_ms()).await
+}
+
+/// The registered sweep of the environment-gateway role, every
+/// [`REGISTERED_SWEEP_INTERVAL`]: [`sweep_registered_universe`] for every
+/// universe with registered environments, then [`revoke_ended_routes`].
+pub async fn run_registered_sweep(runtime: Arc<UniverseRuntime>) {
+    let mut interval = tokio::time::interval(REGISTERED_SWEEP_INTERVAL);
+    interval.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Delay);
+    loop {
+        interval.tick().await;
+        let universes = match store_pg::list_universes_with_registered_environments(
+            runtime.stores().pool(),
+        )
+        .await
+        {
+            Ok(universes) => universes,
+            Err(error) => {
+                tracing::warn!(target: "temporal_runtime", %error, "registered sweep could not list universes");
+                Vec::new()
+            }
+        };
+        let now = now_ms();
+        for universe_id in universes {
+            if let Err(error) = sweep_registered_universe(&runtime, universe_id, now).await {
+                tracing::warn!(target: "temporal_runtime", %error, %universe_id, "registered sweep failed");
+            }
+        }
+        if let Err(error) = revoke_ended_routes(&runtime).await {
+            tracing::warn!(target: "temporal_runtime", %error, "route revocation sweep failed");
+        }
     }
 }
 
+/// One universe's registered sweep at `now_ms`: rows whose liveness stamp
+/// went stale become disconnected, ephemeral rows away past their key's
+/// grace close (`ephemeral_grace`), persistent rows away past the key's
+/// `offlineCloseAfterMs` close (`offline_timeout`). Every closed
+/// environment's routes are revoked.
+pub async fn sweep_registered_universe(
+    runtime: &UniverseRuntime,
+    universe_id: Uuid,
+    now_ms: i64,
+) -> Result<RegisteredSweep, EnvironmentRegistryError> {
+    let store = runtime.stores().store_for(universe_id);
+    let sweep = EnvironmentStore::sweep_registered_environments(store.as_ref(), now_ms).await?;
+    for environment_id in &sweep.disconnected {
+        tracing::info!(target: "temporal_runtime", %universe_id, environment = %environment_id, "registered environment's liveness stamp went stale; marked disconnected");
+    }
+    let signals = runtime.environment_signals();
+    for (environment_id, reason) in &sweep.closed {
+        tracing::info!(target: "temporal_runtime", %universe_id, environment = %environment_id, %reason, "registered sweep closed an environment");
+        signals.revoke(universe_id, environment_id.as_str());
+    }
+    Ok(sweep)
+}
+
+/// End the live routes and control connections of environments that are no
+/// longer open, or whose provider binding is gone or disabled, when that
+/// happened outside this process. Returns how many environments it revoked.
+pub async fn revoke_ended_routes(
+    runtime: &UniverseRuntime,
+) -> Result<usize, store_pg::PgStoreError> {
+    let signals = runtime.environment_signals();
+    let watched = signals.watched();
+    if watched.is_empty() {
+        return Ok(0);
+    }
+    let ended =
+        store_pg::list_revoked_environment_routes(runtime.stores().pool(), &watched).await?;
+    for (universe_id, environment_id) in &ended {
+        signals.revoke(*universe_id, environment_id);
+    }
+    Ok(ended.len())
+}
+
 async fn send_text(socket: &mut WebSocket, text: String) -> Result<(), axum::Error> {
     socket.send(Message::Text(text.into())).await
 }
@@ -1434,8 +1795,8 @@ mod tests {
         routes::canonical_origin,
     };
     use environments::{
-        BeginCloseEnvironment, CreateEnvironmentRegistrationKey, EnvironmentRegistrationKeyId,
-        EnvironmentStatus, FinishCloseEnvironment, InMemoryEnvironmentRegistryStore,
+        BeginCloseEnvironment, CreateEnvironmentRegistrationKey, EnvironmentCloseReason,
+        EnvironmentRegistrationKeyId, InMemoryEnvironmentRegistryStore, MarkRegisteredDisconnected,
         RegistrationKeyPolicy, RevokeEnvironmentRegistrationKey, mint_registration_key,
     };
     use serde_json::json;
@@ -1487,12 +1848,12 @@ mod tests {
             .expect("mint");
         store
             .create_registration_key(CreateEnvironmentRegistrationKey {
-                secret_hash: minted.secret_hash.clone(),
+                secret_hash: minted.secret.secret_hash.clone(),
                 record: minted.record.clone(),
             })
             .await
             .expect("create key");
-        (store, minted.secret.expose().to_owned())
+        (store, minted.secret.secret.expose().to_owned())
     }
 
     fn policy(mode: RegisteredIdentityMode) -> RegistrationKeyPolicy {
@@ -1501,6 +1862,7 @@ mod tests {
             identity_mode: mode,
             max_active_environments: None,
             ephemeral_disconnect_grace_ms: None,
+            offline_close_after_ms: None,
             expires_at_ms: None,
         }
     }
@@ -1677,15 +2039,18 @@ mod tests {
             .await
             .expect("created");
         assert_eq!(created.admission, Admission::Created);
-        assert_eq!(created.environment.status, EnvironmentStatus::Ready);
-        let metadata = &created.environment.metadata;
-        assert_eq!(
-            metadata.get("lightspeed.envd.version").map(String::as_str),
-            Some("0.1.0")
-        );
-        assert_eq!(
-            metadata.get("lightspeed.envd.protocolVersion"),
-            Some(&ENVD_PROTOCOL_VERSION.to_string())
+        assert_eq!(created.environment.state, EnvironmentState::Open);
+        assert_eq!(created.environment.request_id, None);
+        let source = created.environment.registered().expect("registered");
+        assert!(source.connected);
+        assert_eq!(source.connection_changed_at_ms, 2_000);
+        assert_eq!(source.last_seen_at_ms, 2_000);
+        let build = created.environment.daemon_build.as_ref().expect("build");
+        assert_eq!(build.version.as_deref(), Some("0.1.0"));
+        assert_eq!(build.protocol_version, ENVD_PROTOCOL_VERSION);
+        assert!(
+            created.environment.metadata.is_empty(),
+            "build facts are columns, not metadata"
         );
 
         let connection = ControlConnectionId::new("connection_1").unwrap();
@@ -1698,10 +2063,24 @@ mod tests {
             receipt.environment_id.as_str(),
             created.environment.environment_id.as_str()
         );
+        assert_eq!(receipt.daemon_id.as_str(), source.daemon_id().as_str());
         assert!(receipt.daemon_id.as_str().starts_with("daemon_"));
 
-        // Reconnects ignore the key entirely, even a wrong one.
-        let reconnected = admit_registration(&store, &register(&key, Some("lsrk_wrong")), 3_000)
+        // A dropped connection, then a reconnect that ignores the key
+        // entirely, even a wrong one, and records the connection again.
+        store
+            .mark_registered_disconnected(MarkRegisteredDisconnected {
+                environment_id: created.environment.environment_id.clone(),
+                at_ms: 2_500,
+            })
+            .await
+            .expect("disconnect");
+        let plan = plan_admission(&store, &register(&key, Some("lsrk_wrong")), 3_000)
+            .await
+            .expect("plan");
+        assert!(matches!(plan, AdmissionPlan::Reconnect { .. }));
+        assert_eq!(plan.environment_id(), &created.environment.environment_id);
+        let reconnected = commit_admission(&store, plan, 3_000)
             .await
             .expect("reconnect");
         assert_eq!(reconnected.admission, Admission::Reconnected);
@@ -1709,35 +2088,152 @@ mod tests {
             reconnected.environment.environment_id,
             created.environment.environment_id
         );
+        let source = reconnected.environment.registered().expect("registered");
+        assert!(source.connected);
+        assert_eq!(source.connection_changed_at_ms, 3_000);
 
+        // Closing a registered environment is immediate and spends the
+        // identity for good.
         store
             .begin_close_environment(BeginCloseEnvironment {
                 environment_id: created.environment.environment_id.clone(),
-                updated_at_ms: 4_000,
+                reason: EnvironmentCloseReason::Requested,
+                at_ms: 4_000,
             })
             .await
             .expect("close");
-        let closing = admit_registration(&store, &register(&key, Some(&secret)), 4_100)
+        let closed = admit_registration(&store, &register(&key, Some(&secret)), 4_100)
             .await
             .unwrap_err();
         assert!(matches!(
-            closing.data,
+            closed.data,
             ErrorData::FailedPrecondition {
                 reason: PreconditionReason::EnvironmentClosed
             }
         ));
+        assert!(!closed.is_retryable());
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn a_reconnect_planned_before_a_close_is_refused_as_closed() {
+        let (store, secret) =
+            store_with_key("rk", policy(RegisteredIdentityMode::Persistent)).await;
+        let key = daemon(9);
+        let created = admit_registration(&store, &register(&key, Some(&secret)), 2_000)
+            .await
+            .expect("created");
+        let plan = plan_admission(&store, &register(&key, None), 3_000)
+            .await
+            .expect("plan");
         store
-            .finish_close_environment(FinishCloseEnvironment {
+            .begin_close_environment(BeginCloseEnvironment {
                 environment_id: created.environment.environment_id.clone(),
-                observed_at_ms: 4_200,
+                reason: EnvironmentCloseReason::Requested,
+                at_ms: 3_100,
             })
             .await
-            .expect("finish");
-        let closed = admit_registration(&store, &register(&key, Some(&secret)), 4_300)
-            .await
-            .unwrap_err();
-        assert!(!closed.is_retryable());
-        assert_eq!(closed.kind(), ProtocolErrorKind::FailedPrecondition);
+            .expect("close");
+        let refused = commit_admission(&store, plan, 3_200).await.unwrap_err();
+        assert!(matches!(
+            refused.data,
+            ErrorData::FailedPrecondition {
+                reason: PreconditionReason::EnvironmentClosed
+            }
+        ));
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn only_an_ephemeral_departure_closes_its_environment() {
+        let (ephemeral_store, ephemeral_secret) =
+            store_with_key("rk-e", policy(RegisteredIdentityMode::Ephemeral)).await;
+        let ephemeral = admit_registration(
+            &ephemeral_store,
+            &register(&daemon(10), Some(&ephemeral_secret)),
+            1_000,
+        )
+        .await
+        .expect("ephemeral");
+        assert!(departure_closes(&ephemeral.environment));
+        let (persistent_store, persistent_secret) =
+            store_with_key("rk-p", policy(RegisteredIdentityMode::Persistent)).await;
+        let persistent = admit_registration(
+            &persistent_store,
+            &register(&daemon(11), Some(&persistent_secret)),
+            1_000,
+        )
+        .await
+        .expect("persistent");
+        assert!(!departure_closes(&persistent.environment));
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn connection_transitions_of_one_environment_run_one_at_a_time() {
+        let registrations = Arc::new(RegisteredConnections::new());
+        let universe_id = Uuid::nil();
+        let held = registrations.transition(universe_id, "env").await;
+        // Another environment's transition is independent.
+        drop(registrations.transition(universe_id, "other").await);
+        let waiting = {
+            let registrations = registrations.clone();
+            tokio::spawn(async move {
+                drop(registrations.transition(universe_id, "env").await);
+            })
+        };
+        tokio::task::yield_now().await;
+        assert!(
+            !waiting.is_finished(),
+            "a second transition waits for the first"
+        );
+        drop(held);
+        waiting.await.unwrap();
+        assert!(
+            registrations.transitions.lock().unwrap().is_empty(),
+            "finished transitions leave no lock behind"
+        );
+    }
+
+    #[test]
+    fn a_failed_admission_hands_the_environment_back_to_the_displaced_connection() {
+        let registrations = RegisteredConnections::new();
+        let universe_id = Uuid::nil();
+        let handle = |id: &str| {
+            let (commands, _) = mpsc::channel(1);
+            let (supersede, _) = oneshot::channel();
+            let (ended, _) = watch::channel(());
+            ControlHandle {
+                connection_id: ControlConnectionId::new(id).unwrap(),
+                commands,
+                supersede,
+                ended,
+            }
+        };
+        let old = ControlConnectionId::new("connection_old").unwrap();
+        let new = ControlConnectionId::new("connection_new").unwrap();
+        assert!(
+            registrations
+                .install(universe_id, "env".to_owned(), handle("connection_old"))
+                .is_none()
+        );
+        let previous =
+            registrations.install(universe_id, "env".to_owned(), handle("connection_new"));
+        let ended = previous.as_ref().expect("displaced").ended.subscribe();
+        assert_eq!(registrations.current(universe_id, "env"), Some(new.clone()));
+        assert!(registrations.uninstall(universe_id, "env", &new, previous));
+        assert_eq!(registrations.current(universe_id, "env"), Some(old.clone()));
+        assert!(
+            ended.has_changed().is_ok(),
+            "the restored handle keeps its routes"
+        );
+        assert!(
+            !registrations.remove_if_current(universe_id, "env", &new),
+            "a connection that is no longer current removes nothing"
+        );
+        assert!(registrations.remove_if_current(universe_id, "env", &old));
+        assert_eq!(registrations.current(universe_id, "env"), None);
+        assert!(
+            ended.has_changed().is_err(),
+            "dropping a handle ends the routes paired under it"
+        );
     }
 
     #[tokio::test(flavor = "current_thread")]
diff --git a/crates/temporal-runtime/src/gateway/service/environments.rs b/crates/temporal-runtime/src/gateway/service/environments.rs
index 92e8cadaf..6e183bbc1 100644
--- a/crates/temporal-runtime/src/gateway/service/environments.rs
+++ b/crates/temporal-runtime/src/gateway/service/environments.rs
@@ -62,20 +62,31 @@ impl GatewayAgentApi {
 }
 
 /// One API mapping for resolver failures everywhere the gateway resolves an
-/// environment on a caller's behalf. `NotReady` is typed so wake-on-use is
-/// distinguishable from rejection: the resolver has already set desired
-/// power to `running` where that applies, and the caller's correct move is
-/// retry-with-backoff, not failure.
+/// environment on a caller's behalf. `NotReady` and `Unreachable` are typed
+/// `environment_not_ready` so a wait is distinguishable from rejection: the
+/// environment is provisioning, waking on its data route, its daemon is
+/// reconnecting, or the dial failed without a typed refusal, and the
+/// caller's correct move is retry-with-backoff, not failure.
 pub(super) fn map_environment_resolve_error(
     error: crate::environments::resolver::EnvironmentResolveError,
 ) -> AgentApiError {
+    use crate::environments::resolver::EnvironmentResolveError;
     match error {
-        crate::environments::resolver::EnvironmentResolveError::Store(error) => {
-            map_environments_error(error)
-        }
-        not_ready @ crate::environments::resolver::EnvironmentResolveError::NotReady { .. } => {
-            AgentApiError::environment_not_ready(not_ready.to_string())
-        }
+        EnvironmentResolveError::Store(error) => map_environments_error(error),
+        EnvironmentResolveError::NotReady {
+            environment_id,
+            reason,
+            retry_after_ms,
+            ..
+        } => AgentApiError::environment_not_ready(format!(
+            "environment {environment_id} is not ready ({reason}); retry after {retry_after_ms} ms"
+        )),
+        EnvironmentResolveError::Unreachable {
+            environment_id,
+            status,
+        } => AgentApiError::environment_not_ready(format!(
+            "environment {environment_id} is unreachable ({status}); retry with backoff"
+        )),
         other => AgentApiError::rejected(other.to_string()),
     }
 }
@@ -89,3 +100,26 @@ pub(super) fn activate_environment_command(
 pub(super) fn deactivate_environment_command() -> CoreAgentCommand {
     CoreAgentCommand::ClearActiveEnvironment
 }
+
+#[cfg(test)]
+mod tests {
+    use api::AgentApiErrorKind;
+
+    use super::map_environment_resolve_error;
+    use crate::environments::resolver::EnvironmentResolveError;
+
+    #[test]
+    fn an_unreachable_environment_is_not_ready_and_a_failed_one_is_rejected() {
+        let unreachable = map_environment_resolve_error(EnvironmentResolveError::Unreachable {
+            environment_id: "env-1".to_owned(),
+            status: "connect refused".to_owned(),
+        });
+        assert_eq!(unreachable.kind, AgentApiErrorKind::EnvironmentNotReady);
+
+        let failed = map_environment_resolve_error(EnvironmentResolveError::Failed {
+            environment_id: "env-1".to_owned(),
+            message: "boot failed".to_owned(),
+        });
+        assert_eq!(failed.kind, AgentApiErrorKind::Rejected);
+    }
+}
diff --git a/crates/temporal-runtime/src/gateway/service/mod.rs b/crates/temporal-runtime/src/gateway/service/mod.rs
index 2c7f0ccf5..f692ae908 100644
--- a/crates/temporal-runtime/src/gateway/service/mod.rs
+++ b/crates/temporal-runtime/src/gateway/service/mod.rs
@@ -10,7 +10,6 @@ pub(crate) mod channels_api;
 mod common;
 mod controller;
 pub(crate) use crate::environments::lifecycle as environment_lifecycle;
-pub(crate) use crate::environments::power as environment_power;
 pub(crate) use crate::environments::providers as environment_providers;
 mod environments;
 mod errors;
@@ -46,7 +45,6 @@ use catalogs::parse_client_context_key;
 use common::now_ms;
 pub use environment_lifecycle::ReconcileFailureLog;
 use environment_lifecycle::parse_registry_environment_id;
-pub use environment_power::PowerReaperStats;
 use environment_providers::map_environments_error;
 use environments::{activate_environment_command, deactivate_environment_command};
 use errors::*;
@@ -566,6 +564,7 @@ pub struct GatewayAgentApiBuilder {
     model_discovery_anthropic: Option<Arc<anthropic::Client>>,
     provider_controller_connector: Arc<dyn ProviderControllerConnector>,
     environment_gateway: crate::environments::gateway::EnvironmentGatewayClientConfig,
+    environment_signals: Arc<crate::environments::signals::EnvironmentSignals>,
 }
 
 impl GatewayAgentApiBuilder {
@@ -649,6 +648,15 @@ impl GatewayAgentApiBuilder {
         self
     }
 
+    /// The process's environment signals; a fresh instance by default.
+    pub fn with_environment_signals(
+        mut self,
+        signals: Arc<crate::environments::signals::EnvironmentSignals>,
+    ) -> Self {
+        self.environment_signals = signals;
+        self
+    }
+
     pub fn with_continue_as_new_history_threshold(mut self, threshold: u32) -> Self {
         self.continue_as_new_history_threshold = Some(threshold);
         self
@@ -772,6 +780,7 @@ impl GatewayAgentApiBuilder {
             model_discovery,
             provider_controller_connector: self.provider_controller_connector,
             environment_gateway: self.environment_gateway,
+            environment_signals: self.environment_signals,
         }
     }
 }
@@ -799,6 +808,7 @@ pub struct GatewayAgentApi {
     model_discovery: ModelDiscoveryService,
     provider_controller_connector: Arc<dyn ProviderControllerConnector>,
     pub(crate) environment_gateway: crate::environments::gateway::EnvironmentGatewayClientConfig,
+    environment_signals: Arc<crate::environments::signals::EnvironmentSignals>,
 }
 
 impl GatewayAgentApi {
@@ -832,6 +842,7 @@ impl GatewayAgentApi {
             model_discovery_anthropic: None,
             provider_controller_connector: Arc::new(WebSocketProviderControllerConnector),
             environment_gateway,
+            environment_signals: Arc::default(),
         }
     }
 
@@ -3629,6 +3640,21 @@ impl AgentApiService for GatewayAgentApi {
             .map(AgentApiOutcome::new)
     }
 
+    async fn update_environment(
+        &self,
+        params: EnvironmentUpdateParams,
+    ) -> Result<AgentApiOutcome<EnvironmentUpdateResponse>, AgentApiError> {
+        self.authorize_method(
+            METHOD_ENVIRONMENTS_UPDATE,
+            Some(ResourceRef::Environment(params.environment_id.clone())),
+        )
+        .await?;
+        self.environment_service()
+            .update_environment_record(params)
+            .await
+            .map(AgentApiOutcome::new)
+    }
+
     async fn list_environments(
         &self,
         params: EnvironmentListParams,
@@ -3698,6 +3724,30 @@ impl AgentApiService for GatewayAgentApi {
             .map(AgentApiOutcome::new)
     }
 
+    async fn update_environment_registration_key(
+        &self,
+        params: EnvironmentRegistrationKeyUpdateParams,
+    ) -> Result<AgentApiOutcome<EnvironmentRegistrationKeyUpdateResponse>, AgentApiError> {
+        self.authorize_method(METHOD_ENVIRONMENTS_REGISTRATION_KEYS_UPDATE, None)
+            .await?;
+        self.environment_service()
+            .update_environment_registration_key_record(params)
+            .await
+            .map(AgentApiOutcome::new)
+    }
+
+    async fn rotate_environment_registration_key(
+        &self,
+        params: EnvironmentRegistrationKeyRotateParams,
+    ) -> Result<AgentApiOutcome<EnvironmentRegistrationKeyRotateResponse>, AgentApiError> {
+        self.authorize_method(METHOD_ENVIRONMENTS_REGISTRATION_KEYS_ROTATE, None)
+            .await?;
+        self.environment_service()
+            .rotate_environment_registration_key_record(params)
+            .await
+            .map(AgentApiOutcome::new)
+    }
+
     async fn revoke_environment_registration_key(
         &self,
         params: EnvironmentRegistrationKeyRevokeParams,
@@ -3737,20 +3787,6 @@ impl AgentApiService for GatewayAgentApi {
             .map(AgentApiOutcome::new)
     }
 
-    async fn put_environment_idle_policy(
-        &self,
-        params: EnvironmentIdlePolicyPutParams,
-    ) -> Result<AgentApiOutcome<EnvironmentIdlePolicyPutResponse>, AgentApiError> {
-        self.authorize_method(
-            METHOD_ENVIRONMENTS_IDLE_POLICY_PUT,
-            Some(ResourceRef::Environment(params.environment_id.clone())),
-        )
-        .await?;
-        self.put_environment_idle_policy_record(params)
-            .await
-            .map(AgentApiOutcome::new)
-    }
-
     async fn activate_session_environment(
         &self,
         params: SessionEnvironmentActivateParams,
@@ -4853,10 +4889,6 @@ pub(crate) fn allocate_environment_id_public() -> ::environments::EnvironmentId
     environment_lifecycle::allocate_environment_id()
 }
 
-pub(crate) fn allocate_incarnation_id_public() -> ::environments::EnvironmentIncarnationId {
-    environment_lifecycle::allocate_incarnation_id()
-}
-
 #[cfg(test)]
 mod tests;
 
@@ -4870,10 +4902,15 @@ impl GatewayAgentApi {
     pub(crate) fn environment_service(&self) -> crate::environments::EnvironmentService {
         crate::environments::EnvironmentService {
             store: self.store.clone(),
-            environment_gateway: self.environment_gateway.clone(),
             provider_controller_connector: self.provider_controller_connector.clone(),
+            signals: self.environment_signals.clone(),
         }
     }
+
+    /// The process's environment signals.
+    pub fn environment_signals(&self) -> &Arc<crate::environments::signals::EnvironmentSignals> {
+        &self.environment_signals
+    }
     pub(super) async fn put_environment_ingress_record(
         &self,
         params: EnvironmentIngressPutParams,
@@ -4910,15 +4947,6 @@ impl GatewayAgentApi {
             .await
     }
 
-    pub(super) async fn put_environment_idle_policy_record(
-        &self,
-        params: EnvironmentIdlePolicyPutParams,
-    ) -> Result<EnvironmentIdlePolicyPutResponse, AgentApiError> {
-        self.environment_service()
-            .put_environment_idle_policy_record(params)
-            .await
-    }
-
     pub(super) async fn list_environment_records(
         &self,
         params: EnvironmentListParams,
@@ -4943,12 +4971,6 @@ impl GatewayAgentApi {
             .await
     }
 
-    pub async fn reap_idle_environments_once(&self) -> Result<PowerReaperStats, AgentApiError> {
-        self.environment_service()
-            .reap_idle_environments_once()
-            .await
-    }
-
     pub(super) async fn create_environment_registration_key_record(
         &self,
         params: EnvironmentRegistrationKeyCreateParams,
diff --git a/crates/temporal-runtime/src/gateway/service/session_jobs.rs b/crates/temporal-runtime/src/gateway/service/session_jobs.rs
index 31696a893..0f0abf97a 100644
--- a/crates/temporal-runtime/src/gateway/service/session_jobs.rs
+++ b/crates/temporal-runtime/src/gateway/service/session_jobs.rs
@@ -357,12 +357,10 @@ impl GatewayAgentApi {
         result.map(|()| entries)
     }
 
-    /// Resolve the environment through the shared status-aware resolver so
-    /// job calls participate in wake-on-use: a powered-down
-    /// provisioned environment gets its desired power set to `running` and
-    /// the call fails typed `environment_not_ready` for the caller to retry
-    /// — the shape polling automations lean on. Plain record reads would
-    /// dial a sleeping data plane and fail generically, waking nothing.
+    /// Resolve the environment through the shared use gate, so a
+    /// provisioning environment or a reconnecting daemon fails typed
+    /// `environment_not_ready` for the caller to retry — the shape polling
+    /// automations lean on — and a closed or failed one is refused.
     async fn read_job_instance(
         &self,
         environment_id: &EnvironmentId,
@@ -390,7 +388,14 @@ impl GatewayAgentApi {
                 .with_request_timeout(JOB_API_REQUEST_TIMEOUT),
         )
         .await
-        .map_err(map_environment_client_api_error)?;
+        .map_err(|error| {
+            // A powered-down environment wakes on this dial; its typed
+            // refusal is `environment_not_ready`, like the gate's waits.
+            match crate::environments::resolver::route_refusal_error(instance, &error) {
+                Some(refusal) => super::environments::map_environment_resolve_error(refusal),
+                None => map_environment_client_api_error(error),
+            }
+        })?;
         if initialized.capabilities.job.is_none() {
             let _ = client.close().await;
             return Err(AgentApiError::rejected(format!(
diff --git a/crates/temporal-runtime/src/main.rs b/crates/temporal-runtime/src/main.rs
index 8723f02cd..b1ed64699 100644
--- a/crates/temporal-runtime/src/main.rs
+++ b/crates/temporal-runtime/src/main.rs
@@ -9,7 +9,7 @@ use temporal_runtime::{
     gateway::{
         DEFAULT_GATEWAY_BIND, DEFAULT_MAX_REQUEST_BODY_BYTES, DEFAULT_TEMPORAL_NAMESPACE,
         DEFAULT_TEMPORAL_TARGET, GatewayRoutes, GatewayState, gateway_router,
-        prewarm_single_universe,
+        prewarm_single_universe, registration,
     },
     roles::{Role, RoleSet},
     universe::UniverseRuntime,
@@ -177,9 +177,20 @@ struct RunArgs {
     max_request_body_bytes: usize,
 
     /// Externally reachable base URL of the gateway (OAuth callbacks,
-    /// webhook ingest URLs). Defaults to http://{bind}.
+    /// webhook ingest URLs, and the origin registered daemons sign).
+    /// Defaults to http://{bind}.
     #[arg(long, env = "LIGHTSPEED_PUBLIC_BASE_URL")]
     public_base_url: Option<String>,
+
+    /// Further gateway URLs registered daemons may dial and sign, comma
+    /// separated: for example a cluster-internal Service address. Only
+    /// their origins count.
+    #[arg(
+        long,
+        env = "LIGHTSPEED_ENVIRONMENT_REGISTRATION_URLS",
+        value_delimiter = ','
+    )]
+    environment_registration_urls: Vec<String>,
 }
 
 impl RunArgs {
@@ -554,14 +565,17 @@ async fn run_roles(args: RunArgs) -> anyhow::Result<()> {
         .await?
         .with_blob_cache(temporal_runtime::config::blob_cache_from_env()?);
     let reaper_stores = stores.clone();
-    if roles.has(Role::EnvironmentGateway) {
-        // Daemons sign the gateway origin they dial; refuse to serve
-        // registration under an origin the gateway cannot name.
-        temporal_runtime::gateway::http::registration_origin(
+    // Daemons sign the gateway origin they dial; refuse to serve
+    // registration under an origin the gateway cannot name.
+    let registration_origins = if roles.has(Role::EnvironmentGateway) {
+        temporal_runtime::gateway::http::registration_origins(
             args.public_base_url.as_deref(),
+            &args.environment_registration_urls,
             args.bind,
-        )?;
-    }
+        )?
+    } else {
+        Vec::new()
+    };
     let public_base_url = args
         .public_base_url
         .clone()
@@ -594,8 +608,18 @@ async fn run_roles(args: RunArgs) -> anyhow::Result<()> {
     let mut workers: Vec<(Role, temporalio_sdk::Worker)> = Vec::new();
 
     if roles.has(Role::EnvironmentGateway) {
+        // Before the listener accepts connections: this process held every
+        // registered connection the rows still call connected.
+        let repaired = registration::repair_registered_connections(&universes).await?;
+        tracing::info!(
+            target: "temporal_runtime",
+            repaired,
+            "registered environments marked disconnected until their daemons reconnect"
+        );
         background.push(tokio::spawn(universes.clone().run_environment_reconciler()));
-        background.push(tokio::spawn(universes.clone().run_power_reaper()));
+        background.push(tokio::spawn(registration::run_registered_sweep(
+            universes.clone(),
+        )));
     }
     if roles.has(Role::Sessions) {
         let activities = WorkerActivities::with_runtime(universes.clone());
@@ -684,7 +708,10 @@ async fn run_roles(args: RunArgs) -> anyhow::Result<()> {
                 api: roles.has(Role::Gateway),
                 environment: roles.has(Role::EnvironmentGateway),
             };
-            let gateway_state = Arc::new(GatewayState::multi(mode, universes, public_base_url));
+            let gateway_state = Arc::new(
+                GatewayState::multi(mode, universes, public_base_url)
+                    .with_registration_origins(registration_origins),
+            );
             let app = gateway_router(gateway_state, args.max_request_body_bytes, routes);
             let listener = tokio::net::TcpListener::bind(args.bind).await?;
             tracing::info!(
@@ -801,6 +828,20 @@ mod tests {
         assert_eq!(error.kind(), clap::error::ErrorKind::UnknownArgument);
     }
 
+    #[test]
+    fn registration_urls_are_a_comma_separated_list() {
+        let cli = Cli::try_parse_from([
+            "lightspeed-runtime",
+            "--environment-registration-urls",
+            "ws://gateway.internal:18080,wss://gateway.example",
+        ])
+        .expect("parse registration URLs");
+        assert_eq!(
+            cli.run.environment_registration_urls,
+            ["ws://gateway.internal:18080", "wss://gateway.example"]
+        );
+    }
+
     #[test]
     fn code_role_accepts_its_own_queue_and_interpreter_capacity() {
         let cli = Cli::try_parse_from([
diff --git a/crates/temporal-runtime/src/roles.rs b/crates/temporal-runtime/src/roles.rs
index 109c2a379..608b1e252 100644
--- a/crates/temporal-runtime/src/roles.rs
+++ b/crates/temporal-runtime/src/roles.rs
@@ -11,8 +11,9 @@ pub enum Role {
     Gateway,
     /// The environment data plane: the public routes outbound daemons dial,
     /// the internal route workers use to reach environments, the lifecycle
-    /// reconciler, and the power reaper. Registered daemons hold their
-    /// connection in this process, so run exactly one replica of it.
+    /// reconciler, and the registered-environment sweep. Registered daemons
+    /// hold their connection in this process, so run exactly one replica of
+    /// it.
     EnvironmentGateway,
     /// Session, sub-agent, and environment-job workflows with their
     /// activities and the promise reaper.
diff --git a/crates/temporal-runtime/src/universe.rs b/crates/temporal-runtime/src/universe.rs
index 31d5bf5a8..183406e8f 100644
--- a/crates/temporal-runtime/src/universe.rs
+++ b/crates/temporal-runtime/src/universe.rs
@@ -23,6 +23,7 @@ use std::{
 };
 
 use auth::{GitHubApiClient, HttpGitHubApiClient, HttpOAuthTokenClient, OAuthTokenClient};
+use futures_util::StreamExt as _;
 use llm_clients::{
     anthropic::messages as am,
     openai::{audio as oai_audio, completions as oai_completions, responses as oai},
@@ -34,7 +35,7 @@ use uuid::Uuid;
 
 use crate::{
     config::{DeploymentStores, TaskQueues},
-    environments::gateway::EnvironmentGatewayClientConfig,
+    environments::{gateway::EnvironmentGatewayClientConfig, signals::EnvironmentSignals},
     gateway::GatewayAgentApi,
     subagents::AgentApiSubagentRuntime,
     worker::{ActivityState, AudioTranscoder},
@@ -44,6 +45,9 @@ use crate::{
 /// only needs to be long enough that busy tenants never churn.
 const UNIVERSE_IDLE_EVICT_MS: u64 = 4 * 60 * 60 * 1000;
 
+/// Universes the environment display sweep observes at once.
+const DISPLAY_SWEEP_UNIVERSE_CONCURRENCY: usize = 16;
+
 /// Hard cap on cached universe states, evicted LRU-first. Sized far above any
 /// expected concurrently-active tenant count; the idle sweep does the real
 /// work.
@@ -141,10 +145,6 @@ struct UniverseEntry {
 /// pinned universe); the worker never creates, because a workflow for a
 /// universe the gateway did not create is a routing error, not a provisioning
 /// request.
-/// How often the power reaper polls daemon idle reports. Idle thresholds are
-/// minutes to hours, so a coarse cadence keeps the data-plane load negligible.
-pub const POWER_REAPER_INTERVAL: std::time::Duration = std::time::Duration::from_secs(60);
-
 /// How often bot trigger Schedules are re-converged in the background.
 pub const BOT_SCHEDULE_RECONCILE_INTERVAL: std::time::Duration =
     std::time::Duration::from_secs(10 * 60);
@@ -156,6 +156,7 @@ pub struct UniverseRuntime {
     stores: DeploymentStores,
     clients: DeploymentClients,
     environment_gateway: EnvironmentGatewayClientConfig,
+    environment_signals: Arc<EnvironmentSignals>,
     states: tokio::sync::Mutex<BTreeMap<Uuid, UniverseEntry>>,
 }
 
@@ -192,6 +193,7 @@ impl UniverseRuntime {
             stores,
             clients: DeploymentClients::from_env()?,
             environment_gateway,
+            environment_signals: Arc::new(EnvironmentSignals::default()),
             states: tokio::sync::Mutex::new(BTreeMap::new()),
         })
     }
@@ -224,6 +226,11 @@ impl UniverseRuntime {
         &self.environment_gateway
     }
 
+    /// This process's environment signals, shared by every universe's API.
+    pub fn environment_signals(&self) -> &Arc<EnvironmentSignals> {
+        &self.environment_signals
+    }
+
     /// Drop the universe's cached runtime state (operator purge). In-flight
     /// work holding an `Arc` finishes on the old state; nothing durable is
     /// lost because states hold no durable data.
@@ -262,52 +269,43 @@ impl UniverseRuntime {
         Ok(state)
     }
 
-    /// Run the one active deployment lifecycle reconciler. Provider calls are
-    /// idempotent, so process restart safely resumes any persisted intent.
-    /// Each tick is one deployment pass: every provider is dialed at most
-    /// once, and a provider whose connection fails is skipped for the rest
-    /// of the pass in every universe. Every
-    /// [`STEADY_OBSERVATION_INTERVAL`](crate::environments::lifecycle::STEADY_OBSERVATION_INTERVAL)
-    /// a pass also observes steady environments, and each pass first dials
-    /// providers whose controller facts are not recorded yet.
+    /// Run the one active environment reconciler (environment-gateway
+    /// role): the work loop and the display sweep, concurrently. Provider
+    /// calls are idempotent per owner, so a process restart resumes every
+    /// scheduled row.
     pub async fn run_environment_reconciler(self: Arc<Self>) {
-        use crate::environments::provider_controllers::{
-            ProviderFactsRefresh, ProviderPass, WebSocketProviderControllerConnector,
-        };
-        let mut interval = tokio::time::interval(std::time::Duration::from_millis(500));
+        tokio::join!(
+            self.clone().run_environment_work_loop(),
+            self.run_environment_display_loop(),
+        );
+    }
+
+    /// Every [`WORK_TICK`](crate::environments::lifecycle::WORK_TICK), or at
+    /// once when nudged: start a work pass for every universe and provider
+    /// with due provisioning or closing rows and no pass in flight. Passes
+    /// run as their own tasks, so a slow provider never delays another
+    /// provider's or universe's rows.
+    async fn run_environment_work_loop(self: Arc<Self>) {
+        use crate::environments::lifecycle::{ProviderWork, WORK_TICK, clock_ms};
+        let mut interval = tokio::time::interval(WORK_TICK);
         interval.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Skip);
+        let work = ProviderWork::default();
         let mut failures = crate::gateway::ReconcileFailureLog::default();
-        let mut facts = ProviderFactsRefresh::default();
-        let provider_store = self.stores.store_for(Uuid::nil());
-        let mut steady_at: Option<std::time::Instant> = None;
         loop {
-            interval.tick().await;
-            let scope = if steady_at.is_none_or(|at| {
-                at.elapsed() >= crate::environments::lifecycle::STEADY_OBSERVATION_INTERVAL
-            }) {
-                steady_at = Some(std::time::Instant::now());
-                ::environments::ReconcileScope::WithSteady
-            } else {
-                ::environments::ReconcileScope::Converging
-            };
-            let mut pass = ProviderPass::default();
-            facts
-                .run(
-                    &mut pass,
-                    provider_store.as_ref(),
-                    &WebSocketProviderControllerConnector,
-                )
-                .await;
-            let universe_ids = match store_pg::list_universes_with_pending_environments(
+            tokio::select! {
+                _ = interval.tick() => {}
+                _ = self.environment_signals.work_nudged() => {}
+            }
+            let now = clock_ms();
+            let universe_ids = match store_pg::list_universes_with_environment_work(
                 self.stores.pool(),
-                scope,
+                now,
             )
             .await
             {
                 Ok(ids) => ids,
                 Err(error) => {
                     tracing::warn!(target: "temporal_runtime", %error, "environment reconciler scan failed");
-                    pass.close().await;
                     continue;
                 }
             };
@@ -322,55 +320,60 @@ impl UniverseRuntime {
                 match state
                     .api
                     .environment_service()
-                    .reconcile_environment_lifecycle_pass(&mut pass, scope)
+                    .start_environment_work(now, &work)
                     .await
                 {
                     Ok(_) => failures.succeeded(universe_id),
                     Err(error) => failures.failed(universe_id, &error),
                 }
             }
-            pass.close().await;
         }
     }
 
-    /// Run the one active power reaper. Every pass reads daemon idle
-    /// reports for ready environments with an idle policy and records power
-    /// intent; the lifecycle reconciler converges the provider. Failures are
-    /// logged and retried on the next tick.
-    pub async fn run_power_reaper(self: Arc<Self>) {
-        let mut interval = tokio::time::interval(POWER_REAPER_INTERVAL);
+    /// Every [`DISPLAY_SWEEP_INTERVAL`](crate::environments::lifecycle::DISPLAY_SWEEP_INTERVAL):
+    /// observe the open provisioned environments of every universe.
+    async fn run_environment_display_loop(self: Arc<Self>) {
+        use crate::environments::lifecycle::{DISPLAY_SWEEP_INTERVAL, clock_ms};
+        let mut interval = tokio::time::interval(DISPLAY_SWEEP_INTERVAL);
         interval.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Skip);
         let mut failures = crate::gateway::ReconcileFailureLog::default();
         loop {
             interval.tick().await;
-            let universe_ids = match store_pg::list_universes_with_idle_policies(self.stores.pool())
+            let now = clock_ms();
+            match store_pg::list_universes_with_open_provisioned_environments(self.stores.pool())
                 .await
             {
-                Ok(ids) => ids,
-                Err(error) => {
-                    tracing::warn!(target: "temporal_runtime", %error, "power reaper scan failed");
-                    continue;
-                }
-            };
-            // Providers whose daemons timed out are skipped for the rest of
-            // the pass, in every universe.
-            let mut unhealthy = std::collections::HashSet::new();
-            for universe_id in universe_ids {
-                let state = match self.state_for(universe_id, false).await {
-                    Ok(state) => state,
-                    Err(error) => {
-                        tracing::warn!(target: "temporal_runtime", %universe_id, %error, "power reaper could not resolve universe");
-                        continue;
+                Ok(universe_ids) => {
+                    // Universes are observed concurrently, so one slow
+                    // provider never holds up the others.
+                    let swept = futures_util::stream::iter(universe_ids)
+                        .map(|universe_id| {
+                            let runtime = self.clone();
+                            async move {
+                                let result = match runtime.state_for(universe_id, false).await {
+                                    Ok(state) => {
+                                        state.api.environment_service().run_display_sweep(now).await
+                                    }
+                                    Err(error) => {
+                                        tracing::warn!(target: "temporal_runtime", %universe_id, %error, "environment display sweep could not resolve universe");
+                                        return None;
+                                    }
+                                };
+                                Some((universe_id, result))
+                            }
+                        })
+                        .buffer_unordered(DISPLAY_SWEEP_UNIVERSE_CONCURRENCY)
+                        .collect::<Vec<_>>()
+                        .await;
+                    for (universe_id, result) in swept.into_iter().flatten() {
+                        match result {
+                            Ok(_) => failures.succeeded(universe_id),
+                            Err(error) => failures.failed(universe_id, &error),
+                        }
                     }
-                };
-                match state
-                    .api
-                    .environment_service()
-                    .reconcile_idle_power_pass(&mut unhealthy)
-                    .await
-                {
-                    Ok(_) => failures.succeeded(universe_id),
-                    Err(error) => failures.failed(universe_id, &error),
+                }
+                Err(error) => {
+                    tracing::warn!(target: "temporal_runtime", %error, "environment display sweep scan failed");
                 }
             }
         }
@@ -427,7 +430,8 @@ impl UniverseRuntime {
                 self.clients.openai.clone(),
                 self.clients.anthropic.clone(),
             )
-            .with_environment_gateway(self.environment_gateway.clone());
+            .with_environment_gateway(self.environment_gateway.clone())
+            .with_environment_signals(self.environment_signals.clone());
         if let Some(public_base_url) = &self.public_base_url {
             api = api.with_public_base_url(public_base_url.clone());
         }
diff --git a/crates/temporal-runtime/src/worker/activities/environment_jobs.rs b/crates/temporal-runtime/src/worker/activities/environment_jobs.rs
index 01624d55c..738d2a4d9 100644
--- a/crates/temporal-runtime/src/worker/activities/environment_jobs.rs
+++ b/crates/temporal-runtime/src/worker/activities/environment_jobs.rs
@@ -496,19 +496,7 @@ pub(super) async fn start(
         jobs.push(job);
     }
 
-    let instance = deps
-        .environments
-        .read_environment(&environment_id)
-        .await
-        .map_err(activity_error)?;
-    if matches!(
-        instance.status,
-        environments::EnvironmentStatus::Closing | environments::EnvironmentStatus::Closed
-    ) {
-        return Err(non_retryable_activity_error(anyhow::anyhow!(
-            "cannot start jobs on closing environment instance {environment_id}"
-        )));
-    }
+    let instance = usable_instance(deps, &environment_id).await?;
     let client = job_client(deps, &instance).await?;
     let response = client
         .start_jobs(&StartJobsParams { request_id, jobs })
@@ -546,11 +534,7 @@ pub(super) async fn poll(
             resolutions: BTreeMap::new(),
         });
     }
-    let instance = deps
-        .environments
-        .read_environment(&environment_id)
-        .await
-        .map_err(activity_error)?;
+    let instance = usable_instance(deps, &environment_id).await?;
     let client = job_client(deps, &instance).await?;
     let result = poll_jobs(deps, &client, &environment_id, &job_ids).await;
     let _ = client.close().await;
@@ -703,11 +687,7 @@ pub(super) async fn cancel(
     if job_ids.is_empty() {
         return Ok(EnvironmentJobCancelActivityResult { jobs: Vec::new() });
     }
-    let instance = deps
-        .environments
-        .read_environment(&environment_id)
-        .await
-        .map_err(activity_error)?;
+    let instance = usable_instance(deps, &environment_id).await?;
     let client = job_client(deps, &instance).await?;
     let result = cancel_jobs(&client, &job_ids, request.scope, request.force).await;
     let _ = client.close().await;
@@ -759,8 +739,34 @@ fn configured(
     })
 }
 
-/// An initialized data client for the environment's current incarnation;
-/// the daemon must serve the `job` family.
+/// The environment through the single use gate before a job call dials it:
+/// the activity retries a wait (provisioning, or a daemon reconnecting) and
+/// fails for good on an environment that is closing, closed, failed or away.
+async fn usable_instance(
+    deps: &EnvironmentJobActivityDeps,
+    environment_id: &EnvironmentId,
+) -> Result<EnvironmentRecord, ActivityError> {
+    use crate::environments::resolver::{EnvironmentResolveError, EnvironmentResolver};
+
+    let now_ms = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map_err(activity_error)?
+        .as_millis();
+    EnvironmentResolver::new(deps.environments.clone())
+        .resolve_for_connection(environment_id, i64::try_from(now_ms).unwrap_or(i64::MAX))
+        .await
+        .map_err(|error| match error {
+            EnvironmentResolveError::NotReady { .. }
+            | EnvironmentResolveError::Unreachable { .. }
+            | EnvironmentResolveError::Store(environments::EnvironmentRegistryError::Store {
+                ..
+            }) => activity_error(error),
+            other => non_retryable_activity_error(other),
+        })
+}
+
+/// An initialized data client for the environment; the daemon must serve
+/// the `job` family.
 async fn job_client(
     deps: &EnvironmentJobActivityDeps,
     instance: &EnvironmentRecord,
diff --git a/crates/temporal-runtime/src/worker/session_tools.rs b/crates/temporal-runtime/src/worker/session_tools.rs
index 0c9132aa5..009195c47 100644
--- a/crates/temporal-runtime/src/worker/session_tools.rs
+++ b/crates/temporal-runtime/src/worker/session_tools.rs
@@ -476,6 +476,28 @@ impl SessionTools {
                 environments.environment(environment_id.as_str()).cloned()
             {
                 (Ok(environment), false)
+            } else if let Some(resolver) = self.environment_resolver.as_ref() {
+                // The single use gate, as for the active environment.
+                let resource = match now_unix_ms().and_then(|now| {
+                    i64::try_from(now)
+                        .map_err(|_| io_error("current timestamp does not fit in i64"))
+                }) {
+                    Ok(now) => resolver
+                        .resolve_for_connection(&environment_id, now)
+                        .await
+                        .map_err(RuntimeEnvironmentError::Refused),
+                    Err(error) => Err(error.into()),
+                };
+                (
+                    match resource {
+                        Ok(resource) => {
+                            self.runtime_environment_for_resource(session_id, resource, None)
+                                .await
+                        }
+                        Err(error) => Err(error),
+                    },
+                    true,
+                )
             } else if let Some(store) = self.environment_store.as_ref() {
                 (
                     match store.read_environment(&environment_id).await {
@@ -483,15 +505,13 @@ impl SessionTools {
                             self.runtime_environment_for_resource(session_id, resource, None)
                                 .await
                         }
-                        Err(error) => Err(map_environments_error(error)),
+                        Err(error) => Err(map_environments_error(error).into()),
                     },
                     true,
                 )
             } else {
                 (
-                    Err(io_error(
-                        "environment store is not configured on this runtime",
-                    )),
+                    Err(io_error("environment store is not configured on this runtime").into()),
                     false,
                 )
             };
@@ -1067,14 +1087,7 @@ impl SessionTools {
                         .await;
                     }
                 };
-                let mut output =
-                    environment_model_view(attachment, Some(&environment), active, policy);
-                if crate::environments::resolver::wake_on_use_applies(&environment) {
-                    output.status_message = Some(format!(
-                        "Environment is {}. Tools that use this environment will automatically wake it and wait until it is ready. You can proceed normally.",
-                        format!("{:?}", environment.status).to_lowercase(),
-                    ));
-                }
+                let output = environment_model_view(attachment, Some(&environment), active, policy);
                 self.succeeded_tool_result(
                     call,
                     &output,
@@ -1115,7 +1128,8 @@ impl SessionTools {
                         .await;
                     }
                 };
-                let ready = environment.status == environments::EnvironmentStatus::Ready;
+                let status = environment.display_status();
+                let ready = status == environments::EnvironmentDisplayStatus::Ready;
                 let reference = tools::environment::handles::environment_reference(
                     environment.environment_id.as_str(),
                     policy
@@ -1127,7 +1141,7 @@ impl SessionTools {
                     environment_id: reference.clone(),
                     active: true,
                     ready,
-                    status: format!("{:?}", environment.status).to_lowercase(),
+                    status: status.as_str().to_owned(),
                     access: attachment.access.describe().to_owned(),
                     working_directory: attachment.working_directory.clone(),
                 };
@@ -1142,7 +1156,7 @@ impl SessionTools {
                         "Active environment set to {} (access: {}; currently {}; availability is checked when an environment tool uses it).",
                         reference,
                         attachment.access.describe(),
-                        format!("{:?}", environment.status).to_lowercase()
+                        status
                     )
                 };
                 let mut result = self.succeeded_tool_result(call, &output, summary).await?;
@@ -1217,12 +1231,13 @@ impl SessionTools {
                 )) => return Err(io_error(message)),
                 Err(crate::environments::resolver::EnvironmentResolveError::NotReady {
                     environment_id,
-                    status,
+                    reason,
+                    ..
                 }) => {
                     return Ok(environments.with_active_blocker(
                         ActiveEnvironmentBlocker::NotReady {
                             environment_id,
-                            status,
+                            reason,
                         },
                     ));
                 }
@@ -1252,13 +1267,7 @@ impl SessionTools {
             .await
         {
             Ok(environment) => environment,
-            Err(error) => {
-                return Ok(environments.with_active_blocker(
-                    ActiveEnvironmentBlocker::Unavailable {
-                        message: error.to_string(),
-                    },
-                ));
-            }
+            Err(error) => return Ok(environments.with_active_blocker(error.into_blocker())),
         };
         environments.insert_environment(environment);
         Ok(environments)
@@ -1269,7 +1278,7 @@ impl SessionTools {
         session_id: &SessionId,
         resource: EnvironmentRecord,
         working_directory: Option<&str>,
-    ) -> Result<RuntimeEnvironment, CoreAgentIoError> {
+    ) -> Result<RuntimeEnvironment, RuntimeEnvironmentError> {
         let gateway = self
             .environment_gateway
             .as_ref()
@@ -1286,12 +1295,17 @@ impl SessionTools {
             gateway.connect_options("lightspeed-temporal-runtime"),
         )
         .await
-        .map_err(map_environment_client_error)?;
+        .map_err(|error| {
+            match crate::environments::resolver::route_refusal_error(&resource, &error) {
+                Some(refusal) => RuntimeEnvironmentError::Refused(refusal),
+                None => map_environment_client_error(error).into(),
+            }
+        })?;
         let cwd = match environment_working_directory(&client, working_directory).await {
             Ok(cwd) => cwd,
             Err(error) => {
                 let _ = client.close().await;
-                return Err(io_error(error));
+                return Err(io_error(error).into());
             }
         };
         let remote_connection = RemoteEnvironmentConnection::new(client)
@@ -1414,16 +1428,36 @@ fn environment_model_view(
                 .iter()
                 .map(|attachment| attachment.environment_id.as_str()),
         ),
-        provider_id: environment
-            .and_then(|environment| environment.provider_id().map(|id| id.as_str().to_owned())),
         display_name: environment.and_then(|environment| environment.display_name.clone()),
-        status: environment.map(|environment| format!("{:?}", environment.status).to_lowercase()),
+        status: environment.map(|environment| environment.display_status().as_str().to_owned()),
         access: attachment.access.describe().to_owned(),
         default: attachment.default,
         working_directory: attachment.working_directory.clone(),
         active: active.is_some_and(|active| active.as_str() == attachment.environment_id),
-        observed_at_ms: environment.map(|environment| environment.observed_at_ms()),
-        status_message: None,
+        status_message: environment.and_then(environment_status_message),
+    }
+}
+
+/// What the model should know about an environment that is not ready: a
+/// powered-down target wakes when a tool uses it, a disconnected daemon may
+/// come back, and a failed environment says why.
+fn environment_status_message(environment: &EnvironmentRecord) -> Option<String> {
+    use environments::EnvironmentDisplayStatus as Status;
+    match environment.display_status() {
+        status @ (Status::Paused | Status::Suspended | Status::Stopped) => Some(format!(
+            "Environment is {status}. Tools that use it wake it and wait until it is ready."
+        )),
+        Status::Away => Some(
+            match environment.registered().map(|source| source.identity_mode) {
+                Some(environments::RegisteredIdentityMode::Persistent) => {
+                    "The daemon is disconnected; tools wait up to two minutes for it to reconnect."
+                }
+                _ => "The daemon is disconnected.",
+            }
+            .to_owned(),
+        ),
+        Status::Failed => environment.state_message.clone(),
+        _ => None,
     }
 }
 
@@ -1804,14 +1838,14 @@ impl CoreAgentTools for SessionTools {
             ToolCallExecution::EnvironmentNotReady {
                 call_id,
                 environment_id,
-                status,
+                reason,
             } => {
                 failed_result(
                     self.blobs.as_ref(),
                     call_id,
                     active_environment_blocker_message(&ActiveEnvironmentBlocker::NotReady {
                         environment_id,
-                        status,
+                        reason,
                     }),
                 )
                 .await
@@ -1825,12 +1859,12 @@ impl CoreAgentTools for SessionTools {
 pub enum ToolCallExecution {
     Completed(ToolInvocationResult),
     /// The call did not execute because the session's active environment is
-    /// still provisioning or booting. The workflow waits for readiness and
-    /// re-dispatches the same call.
+    /// provisioning, waking, booting, or its daemon is reconnecting. The
+    /// workflow waits for readiness and re-dispatches the same call.
     EnvironmentNotReady {
         call_id: harness::ToolCallId,
         environment_id: String,
-        status: environments::EnvironmentStatus,
+        reason: environments::EnvironmentWaitReason,
     },
 }
 
@@ -1975,12 +2009,12 @@ impl SessionTools {
             match environments.active_blocker() {
                 Some(ActiveEnvironmentBlocker::NotReady {
                     environment_id,
-                    status,
+                    reason,
                 }) => {
                     return Ok(ToolCallExecution::EnvironmentNotReady {
                         call_id: call.call_id,
                         environment_id: environment_id.clone(),
-                        status: *status,
+                        reason: *reason,
                     });
                 }
                 Some(blocker @ ActiveEnvironmentBlocker::Unavailable { .. }) => {
@@ -2063,50 +2097,84 @@ impl SessionTools {
             }
         };
         let mut last_status;
+        // A `disconnected` route refusal carries no bound of its own (the row
+        // still reads connected), so consecutive ones are bounded here; once
+        // the row records the disconnect the gate's own bound applies.
+        let mut disconnected_since: Option<tokio::time::Instant> = None;
         loop {
             heartbeat().await;
             let now = i64::try_from(now_unix_ms().unwrap_or_default()).unwrap_or(i64::MAX);
-            match resolver.ready_for_use(&environment_id, now).await {
+            let poll = match resolver.ready_for_use(&environment_id, now).await {
                 Ok(_) => return Outcome::Ready,
                 Err(crate::environments::resolver::EnvironmentResolveError::NotReady {
-                    status,
+                    reason,
+                    retry_after_ms,
+                    until_ms,
                     ..
                 }) => {
-                    last_status = format!("{status:?}").to_lowercase();
+                    last_status = reason.as_str().to_owned();
+                    if reason == environments::EnvironmentWaitReason::Disconnected
+                        && until_ms.is_none()
+                    {
+                        let since =
+                            *disconnected_since.get_or_insert_with(tokio::time::Instant::now);
+                        if since.elapsed() >= REGISTERED_RECONNECT_WAIT {
+                            return Outcome::Failed {
+                                message: format!(
+                                    "environment {environment_id}: the daemon did not reconnect within {} seconds",
+                                    REGISTERED_RECONNECT_WAIT.as_secs()
+                                ),
+                            };
+                        }
+                    } else {
+                        disconnected_since = None;
+                    }
+                    std::time::Duration::from_millis(retry_after_ms)
+                        .clamp(ENVIRONMENT_RETRY_AFTER_MIN, ENVIRONMENT_RETRY_AFTER_MAX)
                 }
-                Err(
-                    crate::environments::resolver::EnvironmentResolveError::EnvironmentUnavailable {
-                        status,
-                        ..
-                    },
-                ) => {
-                    // Marked ready in the registry but the route probe failed;
-                    // keep polling until the deadline, the daemon may still
-                    // be coming up.
+                Err(crate::environments::resolver::EnvironmentResolveError::Unreachable {
+                    status,
+                    ..
+                }) => {
+                    // The dial failed without a typed refusal: a gateway
+                    // restart, a provider 5xx, or a daemon that has not yet
+                    // missed its heartbeat. Keep polling until the deadline.
+                    disconnected_since = None;
                     last_status = status;
+                    temporal_workflow::ENVIRONMENT_READY_POLL_INTERVAL
                 }
                 Err(crate::environments::resolver::EnvironmentResolveError::Store(
                     environments::EnvironmentRegistryError::Store { message },
                 )) => {
                     // Transient store trouble: keep polling.
+                    disconnected_since = None;
                     last_status = format!("store error: {message}");
+                    temporal_workflow::ENVIRONMENT_READY_POLL_INTERVAL
                 }
                 Err(error) => {
                     return Outcome::Failed {
                         message: error.to_string(),
                     };
                 }
-            }
+            };
             if tokio::time::Instant::now() >= deadline {
                 return Outcome::TimedOut { last_status };
             }
             let remaining = deadline.saturating_duration_since(tokio::time::Instant::now());
-            tokio::time::sleep(temporal_workflow::ENVIRONMENT_READY_POLL_INTERVAL.min(remaining))
-                .await;
+            tokio::time::sleep(poll.min(remaining)).await;
         }
     }
 }
 
+/// Bounds on a not-ready wait's `Retry-After` between readiness polls.
+const ENVIRONMENT_RETRY_AFTER_MIN: std::time::Duration = std::time::Duration::from_millis(250);
+const ENVIRONMENT_RETRY_AFTER_MAX: std::time::Duration = std::time::Duration::from_secs(10);
+/// How long consecutive `disconnected` route refusals of a persistent
+/// daemon may last before the wait fails; an ephemeral daemon's refusal is
+/// already terminal.
+const REGISTERED_RECONNECT_WAIT: std::time::Duration =
+    std::time::Duration::from_millis(environments::REGISTERED_RECONNECT_WAIT_MS.unsigned_abs());
+
 /// Model-facing text for a call that cannot use the active environment.
 /// A job handle names the session's active environment unless the model
 /// says otherwise: `job_submit` and `job_run` only ever start jobs there,
@@ -2132,10 +2200,9 @@ fn active_environment_blocker_message(blocker: &ActiveEnvironmentBlocker) -> Str
     match blocker {
         ActiveEnvironmentBlocker::NotReady {
             environment_id,
-            status,
+            reason,
         } => format!(
-            "active environment {environment_id} is {} and not reachable yet; retry once it is ready",
-            format!("{status:?}").to_lowercase()
+            "active environment {environment_id} is not reachable yet ({reason}); retry once it is ready"
         ),
         ActiveEnvironmentBlocker::Unavailable { message } => {
             format!("active environment is unavailable: {message}")
@@ -2239,6 +2306,48 @@ fn map_environment_client_error(error: ClientError) -> CoreAgentIoError {
     io_error(format!("environment data-plane call failed: {error}"))
 }
 
+/// Why an environment record did not become a runtime environment.
+#[derive(Debug)]
+enum RuntimeEnvironmentError {
+    /// The use gate or a typed data-route refusal answered.
+    Refused(crate::environments::resolver::EnvironmentResolveError),
+    Failed(CoreAgentIoError),
+}
+
+impl RuntimeEnvironmentError {
+    /// A wait keeps the call for re-dispatch; anything else fails it.
+    fn into_blocker(self) -> ActiveEnvironmentBlocker {
+        match self {
+            Self::Refused(crate::environments::resolver::EnvironmentResolveError::NotReady {
+                environment_id,
+                reason,
+                ..
+            }) => ActiveEnvironmentBlocker::NotReady {
+                environment_id,
+                reason,
+            },
+            other => ActiveEnvironmentBlocker::Unavailable {
+                message: other.to_string(),
+            },
+        }
+    }
+}
+
+impl From<CoreAgentIoError> for RuntimeEnvironmentError {
+    fn from(error: CoreAgentIoError) -> Self {
+        Self::Failed(error)
+    }
+}
+
+impl std::fmt::Display for RuntimeEnvironmentError {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::Refused(error) => error.fmt(formatter),
+            Self::Failed(error) => error.fmt(formatter),
+        }
+    }
+}
+
 fn map_blob_error(error: BlobStoreError) -> CoreAgentIoError {
     io_error(format!("write tool error blob: {error}"))
 }
@@ -2270,13 +2379,13 @@ mod tests {
     use crate::environments::runtime::RuntimeEnvironment;
     use environment_protocol::ids::{JobId, ProviderTargetId};
     use environments::{
-        CreateEnvironment, EnvironmentEndpoint, EnvironmentIncarnationId,
-        EnvironmentIncarnationRecord, EnvironmentProviderBindingId,
-        EnvironmentProviderBindingStatus, EnvironmentProviderBindingStore, EnvironmentProviderId,
-        EnvironmentProviderStore, EnvironmentProvisionRequestId, EnvironmentSource,
-        EnvironmentStatus, EnvironmentStore, EnvironmentTemplateId,
-        InMemoryEnvironmentRegistryStore, ObserveProvisionedEnvironment, PutEnvironmentProvider,
-        PutEnvironmentProviderBinding,
+        CreateEnvironment, DaemonBuild, EnvironmentEndpoint, EnvironmentProviderBindingStore,
+        EnvironmentProviderId, EnvironmentProviderStore, EnvironmentProvisionRequestId,
+        EnvironmentSource, EnvironmentState, EnvironmentStore, EnvironmentTemplateId,
+        EnvironmentWaitReason, InMemoryEnvironmentRegistryStore, ObservedTarget, OpenEnvironment,
+        PowerState, ProviderCredentialChange, PutEnvironmentProvider,
+        PutEnvironmentProviderBinding, RecordTargetObservation, RegisteredIdentityMode,
+        RegisteredSource, TargetPhase,
     };
     use harness::{
         BlobRef, ContextEntryKind, FunctionToolSpec, RunId, SessionId, ToolBatchId, ToolCallId,
@@ -2877,9 +2986,7 @@ mod tests {
             let sessions = InMemorySessionStore::new();
             let (session_id, binding) = workflow_tool_session(blobs.as_ref(), &sessions).await;
             let registry = Arc::new(InMemoryEnvironmentRegistryStore::new());
-            let tools = tools.with_environment_resolver(
-                crate::environments::resolver::EnvironmentResolver::new(registry.clone(), registry),
-            );
+            let tools = tools.with_environment_resolver(test_resolver(registry.clone()));
             let sleep_args = blobs.put_bytes(br#"{"ms":50}"#.to_vec()).await.unwrap();
             let workflow_args = blobs
                 .put_bytes(br#"{"status":"complete"}"#.to_vec())
@@ -4189,36 +4296,7 @@ mod tests {
         blobs: Arc<InMemoryBlobStore>,
         process: Arc<RecordingProcessExecutor>,
     ) -> RuntimeEnvironment {
-        let target_id = ProviderTargetId::new("test").unwrap();
-        let resource = environments::EnvironmentRecord {
-            environment_id: harness::EnvironmentId::new("test"),
-            request_id: EnvironmentProvisionRequestId::new("request-test"),
-            source: EnvironmentSource::Provisioned {
-                provider_id: EnvironmentProviderId::new("test-provider"),
-                binding_id: EnvironmentProviderBindingId::new("test-binding"),
-            },
-            display_name: None,
-            status: EnvironmentStatus::Offline,
-            desired_power: environments::PowerState::Running,
-            idle_policy: None,
-            incarnation: EnvironmentIncarnationRecord {
-                incarnation_id: EnvironmentIncarnationId::new("incarnation-test"),
-                provision_request_id: Some(EnvironmentProvisionRequestId::new("request-test")),
-                provider_target_id: Some(target_id.clone()),
-                template_id: Some(EnvironmentTemplateId::new("test-template")),
-                adoption_source_target: None,
-                power_states: Vec::new(),
-                created_at_ms: 1,
-                updated_at_ms: 1,
-            },
-            public_ingress_enabled: false,
-            public_endpoint: None,
-            metadata: BTreeMap::new(),
-            last_seen_at_ms: None,
-            lifecycle_error: None,
-            created_at_ms: 1,
-            updated_at_ms: 1,
-        };
+        let resource = open_test_record("test", "test-provider");
         let fs_context = tools::fs::FsToolContext::new(
             Arc::new(tools::fs::InMemoryFileSystem::full_access()),
             blobs.clone(),
@@ -4442,6 +4520,49 @@ mod tests {
         }
     }
 
+    fn test_daemon_build() -> DaemonBuild {
+        DaemonBuild {
+            version: Some("test".to_owned()),
+            git_sha: None,
+            protocol_version: environment_protocol::ENVD_PROTOCOL_VERSION,
+        }
+    }
+
+    fn test_create_environment(
+        environment_id: &str,
+        provider_id: &str,
+        created_at_ms: i64,
+    ) -> CreateEnvironment {
+        CreateEnvironment {
+            request_id: EnvironmentProvisionRequestId::new(format!("request-{environment_id}")),
+            environment_id: EnvironmentId::new(environment_id),
+            provider_id: EnvironmentProviderId::new(provider_id),
+            template_id: EnvironmentTemplateId::new("test-template"),
+            idle: None,
+            display_name: None,
+            metadata: BTreeMap::new(),
+            created_at_ms,
+        }
+    }
+
+    /// An open provisioned record, built without a store.
+    fn open_test_record(
+        environment_id: &str,
+        provider_id: &str,
+    ) -> environments::EnvironmentRecord {
+        let mut record = test_create_environment(environment_id, provider_id, 1)
+            .record()
+            .expect("provisioned record");
+        OpenEnvironment {
+            environment_id: record.environment_id.clone(),
+            daemon_build: test_daemon_build(),
+            at_ms: 2,
+        }
+        .apply(&mut record)
+        .expect("open record");
+        record
+    }
+
     async fn register_test_environment_provider(
         store: &InMemoryEnvironmentRegistryStore,
         provider_id: &str,
@@ -4452,8 +4573,10 @@ mod tests {
                 display_name: None,
                 controller_endpoint: EnvironmentEndpoint::parse("ws://controller.test/control")
                     .unwrap(),
-                metadata: BTreeMap::new(),
-                credential: Some(auth::SecretValue::new("provider-credential")),
+                data_route_base: None,
+                credential: ProviderCredentialChange::Set(auth::SecretValue::new(
+                    "provider-credential",
+                )),
                 updated_at_ms: 10,
             })
             .await
@@ -4461,117 +4584,162 @@ mod tests {
         store
             .put_provider_binding(PutEnvironmentProviderBinding {
                 universe_id: store.universe_id(),
-                binding_id: EnvironmentProviderBindingId::new(format!("binding-{provider_id}")),
                 provider_id: EnvironmentProviderId::new(provider_id),
-                status: EnvironmentProviderBindingStatus::Enabled,
-                expected_revision: None,
-                metadata: BTreeMap::new(),
+                enabled: true,
                 updated_at_ms: 10,
             })
             .await
             .expect("register provider binding");
     }
 
-    async fn observe_test_environment(
+    /// Create a provisioned environment and open it, as the reconciler does
+    /// after its first handshake.
+    async fn open_test_environment(
         store: &InMemoryEnvironmentRegistryStore,
         environment_id: &str,
         provider_id: &str,
-        observed_at_ms: i64,
+        opened_at_ms: i64,
     ) {
-        let target_id = ProviderTargetId::new(format!("target-{environment_id}")).unwrap();
-        let environment_id = EnvironmentId::new(environment_id);
+        let created = store
+            .create_environment(test_create_environment(
+                environment_id,
+                provider_id,
+                opened_at_ms.saturating_sub(1),
+            ))
+            .await
+            .expect("create environment");
         store
-            .create_environment(CreateEnvironment {
-                request_id: EnvironmentProvisionRequestId::new(format!("request-{environment_id}")),
-                environment_id: environment_id.clone(),
-                incarnation_id: EnvironmentIncarnationId::new(format!(
-                    "incarnation-{environment_id}"
-                )),
-                binding_id: EnvironmentProviderBindingId::new(format!("binding-{provider_id}")),
-                template_id: EnvironmentTemplateId::new("test-template"),
-                display_name: None,
-                metadata: BTreeMap::new(),
-
-                idle_policy: None,
-                created_at_ms: observed_at_ms.saturating_sub(1),
+            .record_target_observation(RecordTargetObservation {
+                environment_id: created.environment_id.clone(),
+                provider_target_id: Some(
+                    ProviderTargetId::new(format!("target-{environment_id}")).unwrap(),
+                ),
+                observed: ObservedTarget {
+                    phase: TargetPhase::Active,
+                    power: Some(PowerState::Running),
+                    message: None,
+                    observed_at_ms: opened_at_ms,
+                },
+                public_endpoint: None,
+                observed_at_ms: opened_at_ms,
             })
             .await
-            .expect("create environment");
+            .expect("record target");
         store
-            .observe_provisioned_environment(ObserveProvisionedEnvironment {
-                environment_id,
-                provider_target_id: Some(target_id),
-                status: EnvironmentStatus::Offline,
-                power_states: Vec::new(),
-                daemon_build: None,
-                observed_at_ms,
+            .open_environment(OpenEnvironment {
+                environment_id: created.environment_id,
+                daemon_build: test_daemon_build(),
+                at_ms: opened_at_ms,
             })
             .await
-            .expect("observe environment");
+            .expect("open environment");
     }
 
-    #[tokio::test(flavor = "current_thread")]
-    async fn environment_read_status_message_only_describes_supported_wake_on_use() {
-        use environments::PowerState;
+    fn test_resolver(
+        registry: Arc<InMemoryEnvironmentRegistryStore>,
+    ) -> crate::environments::resolver::EnvironmentResolver {
+        crate::environments::resolver::EnvironmentResolver::new(registry)
+    }
+
+    #[test]
+    fn status_messages_tell_the_model_what_a_tool_call_will_meet() {
+        let open = open_test_record("environment-1", "allowed");
+        assert_eq!(environment_status_message(&open), None);
+
+        let mut paused = open.clone();
+        if let EnvironmentSource::Provisioned(source) = &mut paused.source {
+            source.observed = Some(ObservedTarget {
+                phase: TargetPhase::Active,
+                power: Some(PowerState::Paused),
+                message: None,
+                observed_at_ms: 3,
+            });
+        }
+        assert_eq!(
+            environment_status_message(&paused).as_deref(),
+            Some("Environment is paused. Tools that use it wake it and wait until it is ready.")
+        );
+
+        let mut failed = open.clone();
+        failed.state = EnvironmentState::Failed;
+        failed.state_message = Some("no capacity".to_owned());
+        assert_eq!(
+            environment_status_message(&failed).as_deref(),
+            Some("no capacity")
+        );
+
+        let away = |identity_mode| {
+            let mut record = open.clone();
+            record.source = EnvironmentSource::Registered(RegisteredSource {
+                registration_key_id: environments::EnvironmentRegistrationKeyId::new("key"),
+                daemon_public_key: "00".repeat(32),
+                identity_mode,
+                connected: false,
+                connection_changed_at_ms: 3,
+                last_seen_at_ms: 3,
+            });
+            record
+        };
+        assert_eq!(
+            environment_status_message(&away(RegisteredIdentityMode::Persistent)).as_deref(),
+            Some("The daemon is disconnected; tools wait up to two minutes for it to reconnect.")
+        );
+        assert_eq!(
+            environment_status_message(&away(RegisteredIdentityMode::Ephemeral)).as_deref(),
+            Some("The daemon is disconnected.")
+        );
+    }
 
-        for (status, power_states, expected_status, expected_message) in [
+    #[tokio::test(flavor = "current_thread")]
+    async fn environment_views_report_display_status_and_wake_messages() {
+        for (power, expected_status, expected_message) in [
+            (Some(PowerState::Running), "ready", None),
             (
-                EnvironmentStatus::Paused,
-                vec![PowerState::Running],
+                Some(PowerState::Paused),
                 "paused",
-                true,
+                Some(
+                    "Environment is paused. Tools that use it wake it and wait until it is ready.",
+                ),
             ),
             (
-                EnvironmentStatus::Suspended,
-                vec![PowerState::Running],
+                Some(PowerState::Suspended),
                 "suspended",
-                true,
-            ),
-            (
-                EnvironmentStatus::Offline,
-                vec![PowerState::Running],
-                "offline",
-                true,
-            ),
-            (EnvironmentStatus::Paused, Vec::new(), "paused", false),
-            (EnvironmentStatus::Suspended, Vec::new(), "suspended", false),
-            (EnvironmentStatus::Offline, Vec::new(), "offline", false),
-            (
-                EnvironmentStatus::Ready,
-                vec![PowerState::Running],
-                "ready",
-                false,
+                Some(
+                    "Environment is suspended. Tools that use it wake it and wait until it is ready.",
+                ),
             ),
             (
-                EnvironmentStatus::Failed,
-                vec![PowerState::Running],
-                "failed",
-                false,
+                Some(PowerState::Stopped),
+                "stopped",
+                Some(
+                    "Environment is stopped. Tools that use it wake it and wait until it is ready.",
+                ),
             ),
         ] {
             let blobs = Arc::new(InMemoryBlobStore::new());
             let registry = Arc::new(InMemoryEnvironmentRegistryStore::new());
             register_test_environment_provider(registry.as_ref(), "allowed").await;
             let environment_id = EnvironmentId::new("environment-allowed-1");
-            observe_test_environment(registry.as_ref(), environment_id.as_str(), "allowed", 10)
-                .await;
+            open_test_environment(registry.as_ref(), environment_id.as_str(), "allowed", 10).await;
             registry
-                .observe_provisioned_environment(ObserveProvisionedEnvironment {
+                .record_target_observation(RecordTargetObservation {
                     environment_id: environment_id.clone(),
                     provider_target_id: Some(
                         ProviderTargetId::new("target-environment-allowed-1").unwrap(),
                     ),
-                    status,
-                    power_states,
-                    daemon_build: None,
+                    observed: ObservedTarget {
+                        phase: TargetPhase::Active,
+                        power,
+                        message: None,
+                        observed_at_ms: 11,
+                    },
+                    public_endpoint: None,
                     observed_at_ms: 11,
                 })
                 .await
-                .expect("observe status and power support");
-            let resolver =
-                crate::environments::resolver::EnvironmentResolver::new(registry.clone(), registry);
+                .expect("observe power");
             let tools = SessionTools::new(blobs.clone(), Arc::new(TestCatalog::default()))
-                .with_environment_resolver(resolver);
+                .with_environment_resolver(test_resolver(registry));
             blobs.put_bytes(b"{}".to_vec()).await.expect("arguments");
 
             for tool_name in ["environment_read", "environment_list"] {
@@ -4606,15 +4774,11 @@ mod tests {
                     &output["environments"][0]
                 };
                 assert_eq!(view["status"], expected_status);
-                if tool_name == "environment_read" && expected_message {
-                    assert_eq!(
-                        view["status_message"],
-                        format!(
-                            "Environment is {expected_status}. Tools that use this environment will automatically wake it and wait until it is ready. You can proceed normally."
-                        ),
-                    );
-                } else {
-                    assert!(view.get("status_message").is_none(), "{tool_name}: {view}");
+                assert!(view.get("provider_id").is_none(), "{tool_name}: {view}");
+                assert!(view.get("observed_at_ms").is_none(), "{tool_name}: {view}");
+                match expected_message {
+                    Some(message) => assert_eq!(view["status_message"], message),
+                    None => assert!(view.get("status_message").is_none(), "{tool_name}: {view}"),
                 }
             }
         }
@@ -4627,9 +4791,8 @@ mod tests {
         let blobs = Arc::new(InMemoryBlobStore::new());
         let registry = Arc::new(InMemoryEnvironmentRegistryStore::new());
         register_test_environment_provider(registry.as_ref(), "allowed").await;
-        observe_test_environment(registry.as_ref(), id, "allowed", 10).await;
-        let resolver =
-            crate::environments::resolver::EnvironmentResolver::new(registry.clone(), registry);
+        open_test_environment(registry.as_ref(), id, "allowed", 10).await;
+        let resolver = test_resolver(registry.clone());
         let tools = SessionTools::new(blobs.clone(), Arc::new(TestCatalog::default()))
             .with_environment_resolver(resolver);
         let policy = test_environment_policy(&[id]);
@@ -4699,11 +4862,8 @@ mod tests {
         let catalog = Arc::new(TestCatalog::default());
         let registry = Arc::new(InMemoryEnvironmentRegistryStore::new());
         register_test_environment_provider(registry.as_ref(), "allowed").await;
-        observe_test_environment(registry.as_ref(), "environment-allowed-1", "allowed", 10).await;
-        let resolver = crate::environments::resolver::EnvironmentResolver::new(
-            registry.clone(),
-            registry.clone(),
-        );
+        open_test_environment(registry.as_ref(), "environment-allowed-1", "allowed", 10).await;
+        let resolver = test_resolver(registry.clone());
         let tools = SessionTools::new(blobs.clone(), catalog).with_environment_resolver(resolver);
         let arguments_ref = blobs
             .put_bytes(br#"{}"#.to_vec())
@@ -4762,24 +4922,14 @@ mod tests {
         register_test_environment_provider(registry.as_ref(), "allowed").await;
         // Created but never observed: the environment is still provisioning.
         registry
-            .create_environment(CreateEnvironment {
-                request_id: EnvironmentProvisionRequestId::new("request-pending"),
-                environment_id: EnvironmentId::new("environment-pending"),
-                incarnation_id: EnvironmentIncarnationId::new("incarnation-pending"),
-                binding_id: EnvironmentProviderBindingId::new("binding-allowed"),
-                template_id: EnvironmentTemplateId::new("test-template"),
-                display_name: None,
-                metadata: BTreeMap::new(),
-
-                idle_policy: None,
-                created_at_ms: 10,
-            })
+            .create_environment(test_create_environment(
+                "environment-pending",
+                "allowed",
+                10,
+            ))
             .await
             .expect("create environment");
-        let resolver = crate::environments::resolver::EnvironmentResolver::new(
-            registry.clone(),
-            registry.clone(),
-        );
+        let resolver = test_resolver(registry.clone());
         let tools = SessionTools::new(blobs.clone(), catalog).with_environment_resolver(resolver);
         let arguments_ref = blobs
             .put_bytes(br#"{"path":"README.md"}"#.to_vec())
@@ -4829,7 +4979,7 @@ mod tests {
             execution,
             ToolCallExecution::EnvironmentNotReady {
                 ref environment_id,
-                status: EnvironmentStatus::Provisioning,
+                reason: EnvironmentWaitReason::Provisioning,
                 ..
             } if environment_id == "environment-pending"
         ));
@@ -4838,19 +4988,16 @@ mod tests {
         let result = tools.invoke_call(request).await.expect("invoke call");
         assert_eq!(result.status, harness::ToolCallStatus::Failed);
 
-        // Once observed ready, resolution no longer blocks (the route probe
-        // itself is exercised by live tests).
+        // Once open, the gate no longer blocks (the route probe itself is
+        // exercised by live tests).
         registry
-            .observe_provisioned_environment(ObserveProvisionedEnvironment {
+            .open_environment(OpenEnvironment {
                 environment_id: EnvironmentId::new("environment-pending"),
-                provider_target_id: Some(ProviderTargetId::new("target-pending").unwrap()),
-                status: EnvironmentStatus::Ready,
-                power_states: Vec::new(),
-                daemon_build: None,
-                observed_at_ms: 20,
+                daemon_build: test_daemon_build(),
+                at_ms: 20,
             })
             .await
-            .expect("observe ready");
+            .expect("open environment");
         let outcome = tools
             .await_environment_ready(
                 &temporal_workflow::AwaitEnvironmentReadyActivityRequest {
@@ -4875,20 +5022,17 @@ mod tests {
         let blobs = Arc::new(InMemoryBlobStore::new());
         let registry = Arc::new(InMemoryEnvironmentRegistryStore::new());
         register_test_environment_provider(registry.as_ref(), "allowed").await;
-        observe_test_environment(registry.as_ref(), "environment-failed", "allowed", 10).await;
+        open_test_environment(registry.as_ref(), "environment-failed", "allowed", 10).await;
         registry
-            .fail_environment_lifecycle(environments::FailEnvironmentLifecycle {
+            .fail_environment(environments::FailEnvironment {
                 environment_id: EnvironmentId::new("environment-failed"),
                 message: "no capacity".to_owned(),
                 daemon_build: None,
-                observed_at_ms: 11,
+                at_ms: 11,
             })
             .await
             .expect("fail environment");
-        let resolver = crate::environments::resolver::EnvironmentResolver::new(
-            registry.clone(),
-            registry.clone(),
-        );
+        let resolver = test_resolver(registry.clone());
         let tools = SessionTools::new(blobs, Arc::new(TestCatalog::default()))
             .with_environment_resolver(resolver);
         let outcome = tools
@@ -4960,12 +5104,9 @@ mod tests {
         let registry = Arc::new(InMemoryEnvironmentRegistryStore::new());
         register_test_environment_provider(registry.as_ref(), "allowed").await;
         register_test_environment_provider(registry.as_ref(), "denied").await;
-        observe_test_environment(registry.as_ref(), "environment-allowed-1", "allowed", 10).await;
-        observe_test_environment(registry.as_ref(), "environment-denied", "denied", 10).await;
-        let resolver = crate::environments::resolver::EnvironmentResolver::new(
-            registry.clone(),
-            registry.clone(),
-        );
+        open_test_environment(registry.as_ref(), "environment-allowed-1", "allowed", 10).await;
+        open_test_environment(registry.as_ref(), "environment-denied", "denied", 10).await;
+        let resolver = test_resolver(registry.clone());
         let tools = SessionTools::new(blobs.clone(), catalog).with_environment_resolver(resolver);
         let arguments_ref = blobs
             .put_bytes(br#"{}"#.to_vec())
@@ -5023,7 +5164,7 @@ mod tests {
         );
         assert_eq!(first_environments[0]["active"], true);
         assert_eq!(first_environments[0]["access"], "read, edit, exec, jobs");
-        assert_eq!(first_environments[0]["status"], "offline");
+        assert_eq!(first_environments[0]["status"], "ready");
         assert_eq!(
             first_environments[1]["environment_id"],
             "environment-allowed-2"
@@ -5035,7 +5176,7 @@ mod tests {
                 .any(|environment| environment["environment_id"] == "environment-denied")
         );
 
-        observe_test_environment(registry.as_ref(), "environment-allowed-2", "allowed", 20).await;
+        open_test_environment(registry.as_ref(), "environment-allowed-2", "allowed", 20).await;
         let second = tools
             .invoke_batch(request)
             .await
@@ -5058,7 +5199,7 @@ mod tests {
             .as_array()
             .expect("second environments");
         assert_eq!(second_environments.len(), 2);
-        assert_eq!(second_environments[1]["status"], "offline");
+        assert_eq!(second_environments[1]["status"], "ready");
     }
 
     #[tokio::test(flavor = "current_thread")]
diff --git a/crates/temporal-runtime/tests/code_capabilities_live.rs b/crates/temporal-runtime/tests/code_capabilities_live.rs
index 1ac73f4b4..afcb60895 100644
--- a/crates/temporal-runtime/tests/code_capabilities_live.rs
+++ b/crates/temporal-runtime/tests/code_capabilities_live.rs
@@ -325,7 +325,7 @@ where
         let environment_id = if environment {
             let key = state.api.create_environment_registration_key(api::EnvironmentRegistrationKeyCreateParams {
                 display_name:"Code capability test".into(), identity_mode:api::EnvironmentIdentityModeView::Ephemeral,
-                max_active_environments:Some(1), ephemeral_disconnect_grace_ms:None, expires_at_ms:None,
+                max_active_environments:Some(1), ephemeral_disconnect_grace_ms:None, offline_close_after_ms:None, expires_at_ms:None,
             }).await?.result;
             let connect_url = format!("ws://{address}{}", environment_protocol::routes::CONNECT_PATH);
             let mut registration = environment_daemon::config::RegistrationConfig::new(connect_url.clone(), environment_daemon::upgrade::resolve_discovery_url(Some(&connect_url), None)?);
@@ -338,7 +338,7 @@ where
             Some(tokio::time::timeout(Duration::from_secs(30), async {
                 loop {
                     let records = state.api.list_environments(api::EnvironmentListParams::default()).await?.result.environments;
-                    if let Some(record) = records.into_iter().find(|record| record.status == api::EnvironmentLifecycleStatusView::Ready) { return anyhow::Ok(record.environment_id); }
+                    if let Some(record) = records.into_iter().find(|record| record.state == api::EnvironmentStateView::Open) { return anyhow::Ok(record.environment_id); }
                     tokio::time::sleep(Duration::from_millis(100)).await;
                 }
             }).await??)
diff --git a/crates/temporal-runtime/tests/environment_provider_live.rs b/crates/temporal-runtime/tests/environment_provider_live.rs
index ba421c6a8..25dc0884e 100644
--- a/crates/temporal-runtime/tests/environment_provider_live.rs
+++ b/crates/temporal-runtime/tests/environment_provider_live.rs
@@ -1,45 +1,49 @@
-//! Minimal live environment control-plane acceptance test.
+//! Live environment provider acceptance tests.
 //!
-//! This deliberately uses the fake controller, served on loopback and
-//! registered like any provider, with real Postgres and the real deployment
-//! reconciler. It covers the durable provider and ingress seams without
-//! requiring an Incus installation; the separate Incus live smoke test owns
-//! backend connectivity and topology.
+//! These use the fake controller, served on loopback and registered like
+//! any provider, with real Postgres and the real reconciler. They cover the
+//! provider seams without requiring an Incus installation: create until
+//! accepted and opened by one handshake, close until gone, the
+//! synchronous power and ingress pass-throughs, wake on a data route dial,
+//! the display sweep's provider-ended close, and per-row backoff while a
+//! provider is down. The separate Incus live smoke test owns backend
+//! connectivity and topology.
 
 mod support;
 
 use std::{collections::BTreeMap, sync::Arc, time::Duration};
 
 use api::{
-    AgentApiService, DeploymentApiService, DeploymentEnvironmentAdoptParams,
-    DeploymentEnvironmentProviderDeleteParams, DeploymentEnvironmentProviderPutParams,
+    AgentApiService, DeploymentApiService, DeploymentEnvironmentProviderDeleteParams,
+    DeploymentEnvironmentProviderPutParams, DeploymentProviderBindingDeleteParams,
     DeploymentProviderBindingPutParams, DeploymentUniverseCreateParams, EnvironmentCloseParams,
-    EnvironmentCreateParams, EnvironmentIngressPutParams, EnvironmentLifecycleStatusView,
-    EnvironmentListParams, EnvironmentProviderBindingStatusView, EnvironmentTemplateListParams,
-    SessionConfig, SessionStartParams,
+    EnvironmentCloseReasonView, EnvironmentCreateParams, EnvironmentIngressPutParams,
+    EnvironmentListParams, EnvironmentPowerPutParams, EnvironmentPowerStateView,
+    EnvironmentSourceView, EnvironmentStateView, EnvironmentStatusView,
+    EnvironmentTemplateListParams, EnvironmentView,
 };
-use api_projection::model_to_api;
-use harness::SessionId;
-use support::live::{
-    LIVE_TEST_LOCK, fake_worker_activities, read_session_view, require_storage_live_env,
-    run_with_live_worker, wait_for_environment_status,
+use environment_client::conformance::data_route::expect_refusal;
+use environment_protocol::{
+    control::target::TargetOwner,
+    ids::{EnvironmentId as ProtocolEnvironmentId, ProviderTargetId, UniverseId},
+    routes::{DataRouteBase, DataRouteRefusal, provider_data_route},
 };
+use environments::EnvironmentStore;
+use support::live::wait_for_environment_state;
 use temporal_runtime::{
     DeploymentStores, UniverseRuntime,
-    environments::fake_controller::{FAKE_INGRESS_ENDPOINT, FAKE_TEMPLATE_ID, FakeController},
-    gateway::{GatewayAgentApi, GatewayDeploymentApi},
-    pg_store_from_env,
+    environments::fake_controller::{
+        FAKE_INGRESS_ENDPOINT, FAKE_TEMPLATE_ID, FakeController, FakeControllerOptions,
+    },
+    gateway::{
+        GatewayAgentApi, GatewayDeploymentApi,
+        request_context::{RequestContext, with_request_context as calling},
+    },
 };
 use temporal_workflow::{DEFAULT_TEMPORAL_NAMESPACE, DEFAULT_TEMPORAL_TARGET, connect_temporal};
-use temporalio_client::Client;
 use uuid::Uuid;
 
-#[tokio::test(flavor = "current_thread")]
-#[ignore = "requires ./dev.sh infra or compatible Temporal + Postgres env"]
-async fn environment_provider_lifecycle_and_adoption_round_trip() -> anyhow::Result<()> {
-    let _ = dotenvy::dotenv();
-    require_live_env()?;
-
+async fn live_runtime(name: &str) -> anyhow::Result<(Arc<UniverseRuntime>, sqlx::PgPool)> {
     let temporal_target =
         std::env::var("TEMPORAL_ADDRESS").unwrap_or_else(|_| DEFAULT_TEMPORAL_TARGET.to_owned());
     let namespace = std::env::var("TEMPORAL_NAMESPACE")
@@ -47,362 +51,596 @@ async fn environment_provider_lifecycle_and_adoption_round_trip() -> anyhow::Res
     let client = connect_temporal(&temporal_target, &namespace).await?;
     let stores = DeploymentStores::from_env().await?;
     let pool = stores.pool().clone();
-    let suffix = Uuid::new_v4().simple().to_string();
-    let provider_id = format!("fake-live-{suffix}");
-    let universe_a = Uuid::new_v4();
-    let universe_b = Uuid::new_v4();
     let runtime = Arc::new(UniverseRuntime::new(
         client,
-        format!("environment-provider-live-{suffix}"),
+        format!("{name}-{}", Uuid::new_v4().simple()),
         Some("http://127.0.0.1:18080".to_owned()),
         stores,
     )?);
+    Ok((runtime, pool))
+}
+
+fn deployment_caller() -> RequestContext {
+    RequestContext::local(api::AccessScope::Deployment)
+}
+
+fn universe_caller(universe_id: Uuid) -> RequestContext {
+    RequestContext::local(api::AccessScope::Universe { universe_id })
+}
+
+/// Create a universe, register `controller` as `provider_id` and bind it.
+async fn provider_universe(
+    operator: &GatewayDeploymentApi,
+    universe_id: Uuid,
+    provider_id: &str,
+    controller: &FakeController,
+) -> anyhow::Result<()> {
+    calling(
+        deployment_caller(),
+        operator.create_universe(DeploymentUniverseCreateParams {
+            slug: None,
+            universe_id: universe_id.to_string(),
+        }),
+    )
+    .await?;
+    calling(
+        deployment_caller(),
+        operator.put_environment_provider(DeploymentEnvironmentProviderPutParams {
+            provider_id: provider_id.to_owned(),
+            display_name: Some("Live fake provider".to_owned()),
+            controller_endpoint: controller.controller_url().to_owned(),
+            data_route_base: None,
+            credential: controller.credential().map(str::to_owned),
+            clear_credential: false,
+        }),
+    )
+    .await?;
+    calling(
+        deployment_caller(),
+        operator.put_environment_provider_binding(DeploymentProviderBindingPutParams {
+            universe_id: universe_id.to_string(),
+            provider_id: provider_id.to_owned(),
+            enabled: true,
+        }),
+    )
+    .await?;
+    Ok(())
+}
+
+/// Remove what [`provider_universe`] made, best effort.
+async fn cleanup(
+    runtime: &UniverseRuntime,
+    operator: &GatewayDeploymentApi,
+    pool: &sqlx::PgPool,
+    universe_id: Uuid,
+    provider_id: &str,
+) {
+    let _ = calling(
+        deployment_caller(),
+        operator.delete_environment_provider_binding(DeploymentProviderBindingDeleteParams {
+            universe_id: universe_id.to_string(),
+            provider_id: provider_id.to_owned(),
+        }),
+    )
+    .await;
+    runtime.evict(universe_id).await;
+    let _ = store_pg::delete_universe(pool, universe_id).await;
+    let _ = calling(
+        deployment_caller(),
+        operator.delete_environment_provider(DeploymentEnvironmentProviderDeleteParams {
+            provider_id: provider_id.to_owned(),
+        }),
+    )
+    .await;
+}
+
+fn create_params(request_id: &str, provider_id: &str) -> EnvironmentCreateParams {
+    EnvironmentCreateParams {
+        request_id: request_id.to_owned(),
+        provider_id: provider_id.to_owned(),
+        template_id: FAKE_TEMPLATE_ID.to_owned(),
+        display_name: Some("Provisioned live VM".to_owned()),
+        metadata: BTreeMap::new(),
+        idle: None,
+    }
+}
+
+/// Poll a read until `done` holds, with the background reconciler doing
+/// the work.
+async fn wait_for(
+    api: &GatewayAgentApi,
+    environment_id: &str,
+    what: &str,
+    done: impl Fn(&EnvironmentView) -> bool,
+) -> anyhow::Result<EnvironmentView> {
+    let started = std::time::Instant::now();
+    loop {
+        let environment = api
+            .read_environment(api::EnvironmentReadParams {
+                environment_id: environment_id.to_owned(),
+            })
+            .await?
+            .result
+            .environment;
+        if done(&environment) {
+            return Ok(environment);
+        }
+        if started.elapsed() > Duration::from_secs(15) {
+            anyhow::bail!(
+                "timed out waiting for environment {environment_id} to {what}; it is {:?} ({:?})",
+                environment.state,
+                environment.state_message
+            );
+        }
+        tokio::time::sleep(Duration::from_millis(100)).await;
+    }
+}
+
+fn target_id(environment: &EnvironmentView) -> Option<String> {
+    match &environment.source {
+        EnvironmentSourceView::Provisioned { target_id, .. } => target_id.clone(),
+        _ => None,
+    }
+}
+
+fn public_endpoint(environment: &EnvironmentView) -> Option<String> {
+    match &environment.source {
+        EnvironmentSourceView::Provisioned {
+            public_endpoint, ..
+        } => public_endpoint.clone(),
+        _ => None,
+    }
+}
+
+#[tokio::test(flavor = "current_thread")]
+#[ignore = "requires ./dev.sh infra or compatible Temporal + Postgres env"]
+async fn environment_provider_lifecycle_round_trip() -> anyhow::Result<()> {
+    let _ = dotenvy::dotenv();
+    require_live_env()?;
+    let (runtime, pool) = live_runtime("environment-provider-live").await?;
     let operator = GatewayDeploymentApi::new(runtime.clone());
-    let controller = FakeController::start().await?;
+    let suffix = Uuid::new_v4().simple().to_string();
+    let guarded_id = format!("fake-live-{suffix}");
+    let open_id = format!("fake-open-{suffix}");
+    let universe_a = Uuid::new_v4();
+    let universe_b = Uuid::new_v4();
+    let guarded = FakeController::start().await?;
+    let open = FakeController::start_with(FakeControllerOptions {
+        credential: false,
+        ..FakeControllerOptions::default()
+    })
+    .await?;
     let reconciler = tokio::spawn(runtime.clone().run_environment_reconciler());
-    // Direct service calls carry an explicit local request context.
-    use temporal_runtime::gateway::request_context::{
-        RequestContext, with_request_context as calling,
-    };
-    let deployment_caller = RequestContext::local(api::AccessScope::Deployment);
 
     let result = async {
-        for universe_id in [universe_a, universe_b] {
+        provider_universe(&operator, universe_a, &guarded_id, &guarded).await?;
+        provider_universe(&operator, universe_b, &open_id, &open).await?;
+
+        // Registration ran the handshake; nothing it advertised is stored,
+        // and the data route base is derived from the controller endpoint.
+        let read = |provider_id: String| {
             calling(
-                deployment_caller.clone(),
-                operator.create_universe(DeploymentUniverseCreateParams {
-                    slug: None,
-                    universe_id: universe_id.to_string(),
+                deployment_caller(),
+                operator.read_environment_provider(api::DeploymentEnvironmentProviderReadParams {
+                    provider_id,
                 }),
             )
-            .await?;
+        };
+        let guarded_view = read(guarded_id.clone()).await?.result.provider;
+        assert!(guarded_view.has_credential);
+        assert_eq!(guarded_view.data_route_base, None);
+        let effective = guarded_view
+            .effective_data_route_base
+            .clone()
+            .expect("a ws:// controller has a derivable data route base");
+        assert!(effective.ends_with("/routes"), "{effective}");
+        assert!(!read(open_id.clone()).await?.result.provider.has_credential);
+        // A controller URL that names no controller is refused outright, and
+        // so is a guarded controller registered without its credential.
+        for (controller_endpoint, credential) in [
+            (
+                guarded.controller_url().replace("/control", "/elsewhere"),
+                guarded.credential().map(str::to_owned),
+            ),
+            (guarded.controller_url().to_owned(), None),
+        ] {
+            let refused = calling(
+                deployment_caller(),
+                operator.put_environment_provider(DeploymentEnvironmentProviderPutParams {
+                    provider_id: format!("{guarded_id}-refused"),
+                    display_name: None,
+                    controller_endpoint,
+                    data_route_base: None,
+                    credential,
+                    clear_credential: false,
+                }),
+            )
+            .await
+            .expect_err("a definitive handshake refusal is refused");
+            assert_eq!(refused.kind, api::AgentApiErrorKind::InvalidRequest);
         }
-        calling(
-            deployment_caller.clone(),
-            operator.put_environment_provider(DeploymentEnvironmentProviderPutParams {
-                provider_id: provider_id.clone(),
-                display_name: Some("Live fake provider".to_owned()),
-                controller_endpoint: controller.controller_url().to_owned(),
-                metadata: BTreeMap::new(),
-                credential: Some(controller.credential().to_owned()),
-            }),
-        )
-        .await?;
-        // Registration ran the controller handshake and recorded its facts.
-        let registered = calling(
-            deployment_caller.clone(),
-            operator.read_environment_provider(api::DeploymentEnvironmentProviderReadParams {
-                provider_id: provider_id.clone(),
-            }),
-        )
-        .await?
-        .result
-        .provider;
-        assert_eq!(
-            registered.controller_features,
-            Some(api::DeploymentEnvironmentProviderFeaturesView {
-                adopt_target: true,
-                ingress: true,
-            })
-        );
-        assert!(registered.data_route_base.is_some());
-        // A controller URL that names no controller is refused outright.
-        let mispathed = calling(
-            deployment_caller.clone(),
+        let exclusive = calling(
+            deployment_caller(),
             operator.put_environment_provider(DeploymentEnvironmentProviderPutParams {
-                provider_id: format!("{provider_id}-mispathed"),
+                provider_id: guarded_id.clone(),
                 display_name: None,
-                controller_endpoint: controller
-                    .controller_url()
-                    .replace("/control", "/elsewhere"),
-                metadata: BTreeMap::new(),
-                credential: Some(controller.credential().to_owned()),
+                controller_endpoint: guarded.controller_url().to_owned(),
+                data_route_base: None,
+                credential: Some("token".to_owned()),
+                clear_credential: true,
             }),
         )
         .await
-        .expect_err("a mis-pathed controller URL is refused");
-        assert_eq!(mispathed.kind, api::AgentApiErrorKind::InvalidRequest);
-        for (universe_id, binding_id) in [(universe_a, "primary-a"), (universe_b, "primary-b")] {
-            calling(
-                deployment_caller.clone(),
-                operator.put_environment_provider_binding(DeploymentProviderBindingPutParams {
-                    universe_id: universe_id.to_string(),
-                    binding_id: binding_id.to_owned(),
-                    provider_id: provider_id.clone(),
-                    status: EnvironmentProviderBindingStatusView::Enabled,
-                    metadata: BTreeMap::new(),
-                    expected_revision: None,
-                }),
-            )
-            .await?;
-        }
+        .expect_err("credential and clearCredential exclude each other");
+        assert_eq!(exclusive.kind, api::AgentApiErrorKind::InvalidRequest);
 
         let state_a = runtime.state_for(universe_a, false).await?;
         let state_b = runtime.state_for(universe_b, false).await?;
-        let caller_a = RequestContext::local(api::AccessScope::Universe {
-            universe_id: universe_a,
-        });
-        let caller_b = RequestContext::local(api::AccessScope::Universe {
-            universe_id: universe_b,
-        });
+        let caller_a = universe_caller(universe_a);
+        let caller_b = universe_caller(universe_b);
+        let api_a = state_a.api.as_ref();
+        let api_b = state_b.api.as_ref();
+
         let templates = calling(
             caller_a.clone(),
-            state_a
-                .api
-                .list_environment_templates(EnvironmentTemplateListParams {
-                    binding_id: Some("primary-a".to_owned()),
-                }),
+            api_a.list_environment_templates(EnvironmentTemplateListParams {
+                provider_id: Some(guarded_id.clone()),
+            }),
         )
-        .await?;
-        assert_eq!(templates.result.templates.len(), 1);
-        assert_eq!(templates.result.templates[0].template_id, FAKE_TEMPLATE_ID);
-        assert!(templates.result.templates[0].resources.is_some());
-
+        .await?
+        .result
+        .templates;
+        assert_eq!(templates.len(), 1);
+        assert_eq!(templates[0].template_id, FAKE_TEMPLATE_ID);
+        assert_eq!(templates[0].provider_id, guarded_id);
+        assert_eq!(templates[0].power_states.len(), 4);
+        assert!(templates[0].public_ingress);
+
+        // Create until accepted, open after one handshake.
         let created = calling(
             caller_a.clone(),
-            state_a.api.create_environment(EnvironmentCreateParams {
-                request_id: format!("create-{suffix}"),
-                binding_id: "primary-a".to_owned(),
-                template_id: FAKE_TEMPLATE_ID.to_owned(),
-                display_name: Some("Provisioned live VM".to_owned()),
-                metadata: BTreeMap::new(),
-                idle_policy: None,
-            }),
+            api_a.create_environment(create_params(&format!("create-{suffix}"), &guarded_id)),
         )
         .await?
         .result
         .environment;
-        let create_retry = calling(
+        assert_eq!(created.state, EnvironmentStateView::Provisioning);
+        let retried = calling(
             caller_a.clone(),
-            state_a.api.create_environment(EnvironmentCreateParams {
-                request_id: format!("create-{suffix}"),
-                binding_id: "primary-a".to_owned(),
-                template_id: FAKE_TEMPLATE_ID.to_owned(),
-                display_name: None,
-                metadata: BTreeMap::new(),
-                idle_policy: None,
-            }),
+            api_a.create_environment(create_params(&format!("create-{suffix}"), &guarded_id)),
         )
         .await?
         .result
         .environment;
-        assert_eq!(create_retry.environment_id, created.environment_id);
-
-        let adopted = calling(
-            deployment_caller.clone(),
-            operator.adopt_environment(DeploymentEnvironmentAdoptParams {
-                universe_id: universe_b.to_string(),
-                request_id: format!("adopt-{suffix}"),
-                binding_id: "primary-b".to_owned(),
-                source_target: "legacy/hand-built-vm".to_owned(),
-                take_ownership: true,
-                display_name: Some("Adopted live VM".to_owned()),
-                metadata: BTreeMap::new(),
+        assert_eq!(retried.environment_id, created.environment_id);
+        let environment_id = created.environment_id.clone();
+        let opened = calling(
+            caller_a.clone(),
+            wait_for(api_a, &environment_id, "open", |environment| {
+                environment.state == EnvironmentStateView::Open
             }),
         )
+        .await?;
+        assert_eq!(opened.status, EnvironmentStatusView::Ready);
+        assert_eq!(
+            opened.daemon.as_ref().map(|daemon| daemon.protocol_version),
+            Some(environment_protocol::ENVD_PROTOCOL_VERSION)
+        );
+        let target = target_id(&opened).expect("an open environment has a target");
+
+        // A provider without a credential works the same way.
+        let open_created = calling(
+            caller_b.clone(),
+            api_b.create_environment(create_params(&format!("open-{suffix}"), &open_id)),
+        )
         .await?
         .result
         .environment;
-        assert_eq!(adopted.incarnation.template_id, None);
-        let adopt_retry = calling(
-            deployment_caller.clone(),
-            operator.adopt_environment(DeploymentEnvironmentAdoptParams {
-                universe_id: universe_b.to_string(),
-                request_id: format!("adopt-{suffix}"),
-                binding_id: "primary-b".to_owned(),
-                source_target: "legacy/hand-built-vm".to_owned(),
-                take_ownership: true,
-                display_name: None,
-                metadata: BTreeMap::new(),
+        calling(
+            caller_b.clone(),
+            wait_for(api_b, &open_created.environment_id, "open", |environment| {
+                environment.state == EnvironmentStateView::Open
             }),
         )
+        .await?;
+
+        // Pages of one; each universe sees only its own environments.
+        let second = calling(
+            caller_a.clone(),
+            api_a.create_environment(create_params(&format!("second-{suffix}"), &guarded_id)),
+        )
         .await?
         .result
         .environment;
-        assert_eq!(adopt_retry.environment_id, adopted.environment_id);
-
-        let created_ready = calling(
+        calling(
             caller_a.clone(),
-            wait_for_status(
-                state_a.api.as_ref(),
-                &created.environment_id,
-                EnvironmentLifecycleStatusView::Ready,
-            ),
+            wait_for(api_a, &second.environment_id, "open", |environment| {
+                environment.state == EnvironmentStateView::Open
+            }),
         )
         .await?;
-        let adopted_ready = calling(
+        let first_page = calling(
+            caller_a.clone(),
+            api_a.list_environments(EnvironmentListParams {
+                limit: Some(1),
+                ..EnvironmentListParams::default()
+            }),
+        )
+        .await?
+        .result;
+        assert_eq!(first_page.environments.len(), 1);
+        assert!(first_page.next_after.is_some());
+        let next_page = calling(
+            caller_a.clone(),
+            api_a.list_environments(EnvironmentListParams {
+                limit: Some(1),
+                after: first_page.next_after.clone(),
+                ..EnvironmentListParams::default()
+            }),
+        )
+        .await?
+        .result;
+        assert_eq!(next_page.environments.len(), 1);
+        assert_ne!(
+            next_page.environments[0].environment_id,
+            first_page.environments[0].environment_id
+        );
+        // The last page carries no cursor.
+        assert_eq!(next_page.next_after, None);
+        let listed_b = calling(
             caller_b.clone(),
-            wait_for_status(
-                state_b.api.as_ref(),
-                &adopted.environment_id,
-                EnvironmentLifecycleStatusView::Ready,
-            ),
+            api_b.list_environments(EnvironmentListParams::default()),
         )
-        .await?;
-        assert!(created_ready.incarnation.provider_target_id.is_some());
-        assert!(adopted_ready.incarnation.provider_target_id.is_some());
-        // The Ready transition ran the data-plane handshake and recorded the
-        // daemon's protocol version.
-        assert_eq!(
-            created_ready
-                .metadata
-                .get(environments::ENVD_PROTOCOL_VERSION_METADATA_KEY)
-                .map(String::as_str),
-            Some(
-                environment_protocol::ENVD_PROTOCOL_VERSION
-                    .to_string()
-                    .as_str()
+        .await?
+        .result;
+        assert_eq!(listed_b.environments.len(), 1);
+
+        // Power is a synchronous pass-through: the answer is recorded.
+        let paused = calling(
+            caller_a.clone(),
+            api_a.put_environment_power(EnvironmentPowerPutParams {
+                environment_id: environment_id.clone(),
+                power: EnvironmentPowerStateView::Paused,
+            }),
+        )
+        .await?
+        .result
+        .environment;
+        assert_eq!(paused.state, EnvironmentStateView::Open);
+        assert_eq!(paused.status, EnvironmentStatusView::Paused);
+        // The data route dial is the wake signal: a paused target refuses
+        // `waking` while it resumes, then upgrades.
+        let route = provider_data_route(
+            &DataRouteBase::new(effective.clone())?,
+            &TargetOwner {
+                universe_id: UniverseId::new(universe_a.to_string())?,
+                environment_id: ProtocolEnvironmentId::new(environment_id.clone())?,
+            },
+            &ProviderTargetId::new(target.clone())?,
+        );
+        let options = || {
+            environment_client::ConnectOptions::new(
+                temporal_runtime::environments::gateway::runtime_client_info(),
             )
+            .with_bearer_token(guarded.credential().expect("guarded credential"))
+        };
+        assert_eq!(
+            expect_refusal(&route, options())
+                .await
+                .map_err(anyhow::Error::msg)?,
+            DataRouteRefusal::Waking {}
         );
+        let (client, _) = environment_client::DataClient::connect_initialized(&route, options())
+            .await
+            .expect("the woken target upgrades");
+        let _ = client.close().await;
 
-        let listed_a = calling(
+        // Ingress is a synchronous pass-through too; the endpoint is cached.
+        let ingress = calling(
             caller_a.clone(),
-            state_a
-                .api
-                .list_environments(EnvironmentListParams::default()),
+            api_a.put_environment_ingress(EnvironmentIngressPutParams {
+                environment_id: environment_id.clone(),
+                enabled: true,
+            }),
         )
-        .await?;
-        let listed_b = calling(
-            caller_b.clone(),
-            state_b
-                .api
-                .list_environments(EnvironmentListParams::default()),
+        .await?
+        .result
+        .environment;
+        assert_eq!(
+            public_endpoint(&ingress).as_deref(),
+            Some(FAKE_INGRESS_ENDPOINT)
+        );
+        let removed = calling(
+            caller_a.clone(),
+            api_a.put_environment_ingress(EnvironmentIngressPutParams {
+                environment_id: environment_id.clone(),
+                enabled: false,
+            }),
         )
-        .await?;
-        assert_eq!(listed_a.result.environments.len(), 1);
-        assert_eq!(listed_b.result.environments.len(), 1);
+        .await?
+        .result
+        .environment;
+        assert_eq!(public_endpoint(&removed), None);
 
-        let ingress = calling(
+        // External environments have no provider to pass through to.
+        let external = calling(
             caller_a.clone(),
-            state_a
-                .api
-                .put_environment_ingress(EnvironmentIngressPutParams {
-                    environment_id: created.environment_id.clone(),
-                    enabled: true,
-                }),
+            api_a.create_external_environment(api::EnvironmentExternalCreateParams {
+                request_id: format!("external-{suffix}"),
+                endpoint: format!("ws://127.0.0.1:1/{suffix}"),
+                display_name: None,
+                metadata: BTreeMap::new(),
+            }),
         )
-        .await?;
-        // The put records the intent; the reconciler realizes it.
-        assert!(ingress.result.environment.public_ingress_enabled);
-        calling(
+        .await?
+        .result
+        .environment;
+        let external_power = calling(
             caller_a.clone(),
-            wait_for_public_endpoint(
-                state_a.api.as_ref(),
-                created.environment_id.as_str(),
-                Some(FAKE_INGRESS_ENDPOINT),
-            ),
+            api_a.put_environment_power(EnvironmentPowerPutParams {
+                environment_id: external.environment_id.clone(),
+                power: EnvironmentPowerStateView::Paused,
+            }),
         )
-        .await?;
-        calling(
+        .await
+        .expect_err("external environments have no power control");
+        assert_eq!(external_power.kind, api::AgentApiErrorKind::Rejected);
+        let closed_external = calling(
             caller_a.clone(),
-            state_a
-                .api
-                .put_environment_ingress(EnvironmentIngressPutParams {
-                    environment_id: created.environment_id.clone(),
-                    enabled: false,
-                }),
+            api_a.close_environment(EnvironmentCloseParams {
+                environment_id: external.environment_id.clone(),
+            }),
         )
-        .await?;
-        calling(
+        .await?
+        .result
+        .environment;
+        assert_eq!(closed_external.state, EnvironmentStateView::Closed);
+
+        // A target the provider removed on its own ends its environment at
+        // the next display sweep.
+        assert!(guarded.end_target(&second.environment_id).await);
+        calling(caller_a.clone(), api_a.reconcile_environments_once()).await?;
+        let ended = calling(
             caller_a.clone(),
-            wait_for_public_endpoint(state_a.api.as_ref(), created.environment_id.as_str(), None),
+            wait_for(api_a, &second.environment_id, "end", |environment| {
+                environment.state == EnvironmentStateView::Closed
+            }),
         )
         .await?;
+        assert_eq!(
+            ended.close_reason,
+            Some(EnvironmentCloseReasonView::ProviderEnded)
+        );
 
+        // Close until gone.
         for (api, caller, environment_id) in [
-            (
-                state_a.api.as_ref(),
-                &caller_a,
-                created.environment_id.as_str(),
-            ),
-            (
-                state_b.api.as_ref(),
-                &caller_b,
-                adopted.environment_id.as_str(),
-            ),
+            (api_a, &caller_a, environment_id.as_str()),
+            (api_b, &caller_b, open_created.environment_id.as_str()),
         ] {
             calling(caller.clone(), async {
                 api.close_environment(EnvironmentCloseParams {
                     environment_id: environment_id.to_owned(),
                 })
                 .await?;
-                wait_for_status(api, environment_id, EnvironmentLifecycleStatusView::Closed).await
+                let closed = wait_for(api, environment_id, "close", |environment| {
+                    environment.state == EnvironmentStateView::Closed
+                })
+                .await?;
+                assert_eq!(
+                    closed.close_reason,
+                    Some(EnvironmentCloseReasonView::Requested)
+                );
+                anyhow::Ok(())
             })
             .await?;
         }
+        assert_eq!(guarded.target_count().await, 0);
+        assert_eq!(open.target_count().await, 0);
+        let closed_power = calling(
+            caller_a.clone(),
+            api_a.put_environment_power(EnvironmentPowerPutParams {
+                environment_id: environment_id.clone(),
+                power: EnvironmentPowerStateView::Running,
+            }),
+        )
+        .await
+        .expect_err("a closed environment has no power control");
+        assert_eq!(closed_power.kind, api::AgentApiErrorKind::Rejected);
         anyhow::Ok(())
     }
     .await;
 
     reconciler.abort();
     let _ = reconciler.await;
-    drop(controller);
-    runtime.evict(universe_a).await;
-    runtime.evict(universe_b).await;
-    for universe_id in [universe_a, universe_b] {
-        let _ = store_pg::delete_universe(&pool, universe_id).await;
-    }
-    let _ = calling(
-        deployment_caller.clone(),
-        operator
-            .delete_environment_provider(DeploymentEnvironmentProviderDeleteParams { provider_id }),
-    )
-    .await;
+    cleanup(&runtime, &operator, &pool, universe_a, &guarded_id).await;
+    cleanup(&runtime, &operator, &pool, universe_b, &open_id).await;
     result
 }
 
-async fn wait_for_status(
-    api: &temporal_runtime::gateway::GatewayAgentApi,
-    environment_id: &str,
-    expected: EnvironmentLifecycleStatusView,
-) -> anyhow::Result<api::EnvironmentView> {
-    let started = std::time::Instant::now();
-    loop {
-        let environment = api
-            .read_environment(api::EnvironmentReadParams {
-                environment_id: environment_id.to_owned(),
-            })
-            .await?
-            .result
-            .environment;
-        if environment.status == expected {
-            return Ok(environment);
-        }
-        if started.elapsed() > Duration::from_secs(10) {
-            anyhow::bail!(
-                "timed out waiting for environment {environment_id} to reach {expected:?}; current status is {:?}",
-                environment.status
-            );
-        }
-        tokio::time::sleep(Duration::from_millis(100)).await;
-    }
-}
+#[tokio::test(flavor = "current_thread")]
+#[ignore = "requires ./dev.sh infra or compatible Temporal + Postgres env"]
+async fn environment_provider_outage_backs_off_per_row() -> anyhow::Result<()> {
+    let _ = dotenvy::dotenv();
+    require_live_env()?;
+    let (runtime, pool) = live_runtime("environment-provider-outage-live").await?;
+    let operator = GatewayDeploymentApi::new(runtime.clone());
+    let suffix = Uuid::new_v4().simple().to_string();
+    let provider_id = format!("fake-outage-{suffix}");
+    let universe_id = Uuid::new_v4();
+    let controller = FakeController::start().await?;
 
-async fn wait_for_public_endpoint(
-    api: &temporal_runtime::gateway::GatewayAgentApi,
-    environment_id: &str,
-    expected: Option<&str>,
-) -> anyhow::Result<api::EnvironmentView> {
-    let started = std::time::Instant::now();
-    loop {
-        let environment = api
-            .read_environment(api::EnvironmentReadParams {
-                environment_id: environment_id.to_owned(),
-            })
-            .await?
-            .result
-            .environment;
-        if environment.public_endpoint.as_deref() == expected {
-            return Ok(environment);
-        }
-        if started.elapsed() > Duration::from_secs(10) {
-            anyhow::bail!(
-                "timed out waiting for environment {environment_id} to report public endpoint {expected:?}; it reports {:?}",
-                environment.public_endpoint
+    let result = async {
+        provider_universe(&operator, universe_id, &provider_id, &controller).await?;
+        let state = runtime.state_for(universe_id, false).await?;
+        let caller = universe_caller(universe_id);
+        let api = state.api.as_ref();
+        controller.set_reachable(false);
+        let created = calling(
+            caller.clone(),
+            api.create_environment(create_params(&format!("outage-{suffix}"), &provider_id)),
+        )
+        .await?
+        .result
+        .environment;
+        let environment_id = environments::EnvironmentId::new(created.environment_id.clone());
+        // Each pass that cannot reach the provider counts one attempt and
+        // pushes the row's next attempt out; the row stays provisioning.
+        for expected in 1..=2_u32 {
+            calling(caller.clone(), api.reconcile_environments_once()).await?;
+            let record = state.store.read_environment(&environment_id).await?;
+            assert_eq!(record.state, environments::EnvironmentState::Provisioning);
+            let source = record.provisioned().expect("provisioned");
+            assert_eq!(source.attempts, expected);
+            assert!(
+                source.next_attempt_at_ms.expect("scheduled") > record.updated_at_ms,
+                "the next attempt is backed off"
+            );
+            assert!(
+                record
+                    .state_message
+                    .as_deref()
+                    .is_some_and(|message| message.contains("unreachable")),
+                "{:?}",
+                record.state_message
             );
         }
-        tokio::time::sleep(Duration::from_millis(100)).await;
+        controller.set_reachable(true);
+        calling(
+            caller.clone(),
+            wait_for_environment_state(api, &created.environment_id, EnvironmentStateView::Open),
+        )
+        .await?;
+        let opened = state.store.read_environment(&environment_id).await?;
+        assert_eq!(opened.state_message, None);
+        assert_eq!(opened.provisioned().expect("provisioned").attempts, 0);
+
+        // A close while the provider is down waits for it; nothing is
+        // abandoned.
+        controller.set_reachable(false);
+        calling(
+            caller.clone(),
+            api.close_environment(EnvironmentCloseParams {
+                environment_id: created.environment_id.clone(),
+            }),
+        )
+        .await?;
+        calling(caller.clone(), api.reconcile_environments_once()).await?;
+        let closing = state.store.read_environment(&environment_id).await?;
+        assert_eq!(closing.state, environments::EnvironmentState::Closing);
+        assert_eq!(closing.provisioned().expect("provisioned").attempts, 1);
+        controller.set_reachable(true);
+        calling(
+            caller.clone(),
+            wait_for_environment_state(api, &created.environment_id, EnvironmentStateView::Closed),
+        )
+        .await?;
+        assert_eq!(controller.target_count().await, 0);
+        anyhow::Ok(())
     }
+    .await;
+
+    cleanup(&runtime, &operator, &pool, universe_id, &provider_id).await;
+    result
 }
 
 fn require_live_env() -> anyhow::Result<()> {
@@ -415,403 +653,3 @@ fn require_live_env() -> anyhow::Result<()> {
     }
     Ok(())
 }
-
-#[tokio::test(flavor = "current_thread")]
-#[ignore = "requires ./dev.sh infra or compatible Temporal + Postgres env"]
-async fn temporal_live_environment_power_intent_converges_and_wakes_on_use() -> anyhow::Result<()> {
-    let _lock = LIVE_TEST_LOCK.lock().await;
-    let _ = dotenvy::dotenv();
-    require_storage_live_env()?;
-
-    let activities = fake_worker_activities().await?;
-    run_with_live_worker(activities, run_environment_power_live_client).await
-}
-
-/// Power intent is recorded through the API, converged by the lifecycle
-/// reconciler against the provider, and a powered-down environment wakes
-/// transparently when a session selects it. Idle policy round-trips and the
-/// power reaper treats an environment without a reachable daemon as
-/// untouchable.
-async fn run_environment_power_live_client(
-    client: Client,
-    task_queue: String,
-    session_id: SessionId,
-) -> anyhow::Result<()> {
-    use std::collections::BTreeMap;
-
-    use environments::{
-        EnvironmentEndpoint, EnvironmentProviderBindingId, EnvironmentProviderBindingStatus,
-        EnvironmentProviderBindingStore, EnvironmentProviderId, EnvironmentProviderStore,
-        PutEnvironmentProvider, PutEnvironmentProviderBinding,
-    };
-
-    let store = pg_store_from_env().await?;
-    let model = support::live::openai_live_model();
-    support::live::seed_agent_default(&store, &model).await?;
-    let api = GatewayAgentApi::builder(client.clone(), store.clone())
-        .with_task_queue(task_queue)
-        .build();
-    let suffix = uuid::Uuid::new_v4().simple().to_string();
-    let provider_id = format!("fake-power-{suffix}");
-    let binding_id = format!("binding-power-{suffix}");
-    let controller = FakeController::start().await?;
-    store
-        .put_provider(PutEnvironmentProvider {
-            provider_id: EnvironmentProviderId::new(provider_id.clone()),
-            display_name: Some("Live fake provider (power)".to_owned()),
-            controller_endpoint: EnvironmentEndpoint::parse(controller.controller_url())?,
-            metadata: BTreeMap::new(),
-            credential: Some(auth::SecretValue::new(controller.credential())),
-            updated_at_ms: 1,
-        })
-        .await?;
-    store
-        .put_provider_binding(PutEnvironmentProviderBinding {
-            universe_id: store.config().universe_id,
-            binding_id: EnvironmentProviderBindingId::new(binding_id.clone()),
-            provider_id: EnvironmentProviderId::new(provider_id.clone()),
-            status: EnvironmentProviderBindingStatus::Enabled,
-            expected_revision: None,
-            metadata: BTreeMap::new(),
-            updated_at_ms: 1,
-        })
-        .await?;
-
-    let policy = api::EnvironmentIdlePolicyView {
-        pause_after_ms: Some(60_000),
-        suspend_after_ms: None,
-        stop_after_ms: Some(3_600_000),
-        close_after_ms: None,
-    };
-    let created = api
-        .create_environment(api::EnvironmentCreateParams {
-            request_id: format!("power-{suffix}"),
-            binding_id: binding_id.clone(),
-            template_id: FAKE_TEMPLATE_ID.to_owned(),
-            display_name: Some("Power VM".to_owned()),
-            metadata: BTreeMap::new(),
-            idle_policy: Some(policy.clone()),
-        })
-        .await?
-        .result
-        .environment;
-    let environment_id = created.environment_id.clone();
-    assert_eq!(
-        created.desired_power,
-        api::EnvironmentPowerStateView::Running
-    );
-    assert_eq!(created.idle_policy.as_ref(), Some(&policy));
-    assert!(created.incarnation.power_states.is_empty());
-
-    // Before the provider reported power support, power changes are refused.
-    let premature = api
-        .put_environment_power(api::EnvironmentPowerPutParams {
-            environment_id: environment_id.clone(),
-            power: api::EnvironmentPowerStateView::Paused,
-        })
-        .await
-        .expect_err("power change before observation is rejected");
-    assert_eq!(premature.kind, api::AgentApiErrorKind::Rejected);
-
-    let ready = wait_for_environment_status(
-        &api,
-        &environment_id,
-        api::EnvironmentLifecycleStatusView::Ready,
-    )
-    .await?;
-    assert_eq!(
-        ready.incarnation.power_states,
-        vec![
-            api::EnvironmentPowerStateView::Running,
-            api::EnvironmentPowerStateView::Paused,
-            api::EnvironmentPowerStateView::Suspended,
-            api::EnvironmentPowerStateView::Stopped,
-        ]
-    );
-
-    // A malformed idle policy is rejected; a valid replacement and a clear
-    // round-trip.
-    let bad_policy = api
-        .put_environment_idle_policy(api::EnvironmentIdlePolicyPutParams {
-            environment_id: environment_id.clone(),
-            idle_policy: Some(api::EnvironmentIdlePolicyView {
-                pause_after_ms: Some(10),
-                stop_after_ms: Some(5),
-                ..api::EnvironmentIdlePolicyView::default()
-            }),
-        })
-        .await
-        .expect_err("non-monotone idle policy is rejected");
-    assert_eq!(bad_policy.kind, api::AgentApiErrorKind::InvalidRequest);
-    let cleared = api
-        .put_environment_idle_policy(api::EnvironmentIdlePolicyPutParams {
-            environment_id: environment_id.clone(),
-            idle_policy: None,
-        })
-        .await?
-        .result
-        .environment;
-    assert!(cleared.idle_policy.is_none());
-    let restored = api
-        .put_environment_idle_policy(api::EnvironmentIdlePolicyPutParams {
-            environment_id: environment_id.clone(),
-            idle_policy: Some(policy.clone()),
-        })
-        .await?
-        .result
-        .environment;
-    assert_eq!(restored.idle_policy.as_ref(), Some(&policy));
-
-    // The reaper sees the candidate but no gateway serves its route here, so
-    // it cannot read an idle report and leaves the environment alone.
-    let stats = api.reap_idle_environments_once().await?;
-    assert_eq!(stats.candidates, 1);
-    assert_eq!(stats.unreachable, 1);
-    assert_eq!(stats.powered_down, 0);
-    assert_eq!(stats.closed, 0);
-
-    // Pause intent: recorded immediately, converged by the reconciler.
-    let paused_intent = api
-        .put_environment_power(api::EnvironmentPowerPutParams {
-            environment_id: environment_id.clone(),
-            power: api::EnvironmentPowerStateView::Paused,
-        })
-        .await?
-        .result
-        .environment;
-    assert_eq!(
-        paused_intent.desired_power,
-        api::EnvironmentPowerStateView::Paused
-    );
-    assert_eq!(
-        paused_intent.status,
-        api::EnvironmentLifecycleStatusView::Ready
-    );
-    let paused = wait_for_environment_status(
-        &api,
-        &environment_id,
-        api::EnvironmentLifecycleStatusView::Paused,
-    )
-    .await?;
-    assert_eq!(paused.desired_power, api::EnvironmentPowerStateView::Paused);
-    // Paused is a filterable lifecycle status.
-    assert!(
-        api.list_environments(api::EnvironmentListParams {
-            metadata: Default::default(),
-            status: Some(api::EnvironmentLifecycleStatusView::Paused),
-            ..api::EnvironmentListParams::default()
-        })
-        .await?
-        .result
-        .environments
-        .iter()
-        .any(|environment| environment.environment_id == environment_id)
-    );
-
-    // Selection only records the environment. A paused machine stays paused
-    // until an operation actually needs to use it.
-    api.start_session(SessionStartParams {
-        access: None,
-        metadata: Default::default(),
-        session_id: Some(session_id.as_str().to_owned()),
-        display_name: None,
-        config: Some(SessionConfig {
-            model: Some(model_to_api(&model)),
-            features: Some(api::FeaturesConfig {
-                environments: Some(api::EnvironmentsFeature {
-                    version: api::CURRENT_FEATURE_VERSION,
-                    selection: false,
-                    prompts: None,
-                    skills: None,
-                    environments: vec![api::EnvironmentAttachment {
-                        environment_id: Some(environment_id.clone()),
-                        inherit: false,
-                        default: false,
-                        access: api::EnvironmentAccess::Exec,
-                        working_directory: None,
-                    }],
-                }),
-                ..api::FeaturesConfig::default()
-            }),
-            ..SessionConfig::default()
-        }),
-        profile: None,
-        delete_after_close_ms: None,
-    })
-    .await?;
-    let started_view = read_session_view(&api, &session_id).await?;
-    assert!(started_view.active_environment_id.is_none());
-    api.activate_session_environment(api::SessionEnvironmentActivateParams {
-        session_id: session_id.as_str().to_owned(),
-        environment_id: environment_id.clone(),
-    })
-    .await?;
-    let activated_view = read_session_view(&api, &session_id).await?;
-    assert_eq!(
-        activated_view.active_environment_id.as_deref(),
-        Some(environment_id.as_str())
-    );
-    let selected = api
-        .read_environment(api::EnvironmentReadParams {
-            environment_id: environment_id.clone(),
-        })
-        .await?
-        .result
-        .environment;
-    assert_eq!(
-        selected.desired_power,
-        api::EnvironmentPowerStateView::Paused
-    );
-    assert_eq!(selected.status, api::EnvironmentLifecycleStatusView::Paused);
-
-    // Suspend and stop are ordinary intents on a provider that supports them.
-    api.put_environment_power(api::EnvironmentPowerPutParams {
-        environment_id: environment_id.clone(),
-        power: api::EnvironmentPowerStateView::Suspended,
-    })
-    .await?;
-    wait_for_environment_status(
-        &api,
-        &environment_id,
-        api::EnvironmentLifecycleStatusView::Suspended,
-    )
-    .await?;
-    // Wake-on-use through the jobs API: creating a job against the
-    // suspended environment fails typed `environment_not_ready` (never a
-    // generic rejection) and flips desired power back to running — the
-    // retry-with-backoff contract polling automations lean on.
-    let job_not_ready = api
-        .create_environment_jobs(api::EnvironmentJobCreateParams {
-            environment_id: environment_id.clone(),
-            request_id: format!("wake-probe-{suffix}"),
-            jobs: vec![api::SessionJobStartSpecInput {
-                name: Some("wake-probe".to_owned()),
-                job_id: None,
-                argv: vec!["true".to_owned()],
-                cwd: None,
-                env: BTreeMap::new(),
-                stdin: None,
-                timeout_ms: None,
-                depends_on: Vec::new(),
-                dependency_policy: api::SessionJobDependencyPolicyView::default(),
-                queue_key: None,
-            }],
-        })
-        .await
-        .expect_err("jobs/create against a suspended environment is not ready");
-    assert_eq!(
-        job_not_ready.kind,
-        api::AgentApiErrorKind::EnvironmentNotReady
-    );
-    let waking = api
-        .read_environment(api::EnvironmentReadParams {
-            environment_id: environment_id.clone(),
-        })
-        .await?
-        .result
-        .environment;
-    assert_eq!(
-        waking.desired_power,
-        api::EnvironmentPowerStateView::Running
-    );
-
-    api.put_environment_power(api::EnvironmentPowerPutParams {
-        environment_id: environment_id.clone(),
-        power: api::EnvironmentPowerStateView::Stopped,
-    })
-    .await?;
-    wait_for_environment_status(
-        &api,
-        &environment_id,
-        api::EnvironmentLifecycleStatusView::Offline,
-    )
-    .await?;
-    api.put_environment_power(api::EnvironmentPowerPutParams {
-        environment_id: environment_id.clone(),
-        power: api::EnvironmentPowerStateView::Running,
-    })
-    .await?;
-    wait_for_environment_status(
-        &api,
-        &environment_id,
-        api::EnvironmentLifecycleStatusView::Ready,
-    )
-    .await?;
-
-    // External environments have no power control.
-    let external = api
-        .create_external_environment(api::EnvironmentExternalCreateParams {
-            request_id: format!("power-external-{suffix}"),
-            endpoint: format!("ws://127.0.0.1:1/{suffix}"),
-            display_name: None,
-            metadata: BTreeMap::new(),
-        })
-        .await?
-        .result
-        .environment;
-    let external_rejected = api
-        .put_environment_power(api::EnvironmentPowerPutParams {
-            environment_id: external.environment_id.clone(),
-            power: api::EnvironmentPowerStateView::Paused,
-        })
-        .await
-        .expect_err("external environments have no power control");
-    assert_eq!(external_rejected.kind, api::AgentApiErrorKind::Rejected);
-    let external_policy_rejected = api
-        .put_environment_idle_policy(api::EnvironmentIdlePolicyPutParams {
-            environment_id: external.environment_id.clone(),
-            idle_policy: Some(policy.clone()),
-        })
-        .await
-        .expect_err("external environments have no idle policy");
-    assert_eq!(
-        external_policy_rejected.kind,
-        api::AgentApiErrorKind::InvalidRequest
-    );
-
-    // Closing wins over power intent.
-    api.close_session(api::SessionCloseParams {
-        session_id: session_id.as_str().to_owned(),
-        force: false,
-    })
-    .await?;
-    api.close_environment(api::EnvironmentCloseParams {
-        environment_id: environment_id.clone(),
-    })
-    .await?;
-    wait_for_environment_status(
-        &api,
-        &environment_id,
-        api::EnvironmentLifecycleStatusView::Closed,
-    )
-    .await?;
-    let closed_rejected = api
-        .put_environment_power(api::EnvironmentPowerPutParams {
-            environment_id: environment_id.clone(),
-            power: api::EnvironmentPowerStateView::Running,
-        })
-        .await
-        .expect_err("closed environments cannot change power");
-    assert_eq!(closed_rejected.kind, api::AgentApiErrorKind::InvalidRequest);
-    api.close_environment(api::EnvironmentCloseParams {
-        environment_id: external.environment_id.clone(),
-    })
-    .await?;
-    wait_for_environment_status(
-        &api,
-        &external.environment_id,
-        api::EnvironmentLifecycleStatusView::Closed,
-    )
-    .await?;
-
-    let _ = store
-        .delete_provider_binding(
-            store.config().universe_id,
-            &EnvironmentProviderBindingId::new(binding_id.clone()),
-        )
-        .await;
-    let _ = store
-        .delete_provider(&EnvironmentProviderId::new(provider_id.clone()))
-        .await;
-    Ok(())
-}
diff --git a/crates/temporal-runtime/tests/environment_registration_live.rs b/crates/temporal-runtime/tests/environment_registration_live.rs
index bf84c0c17..d3dd9a1ac 100644
--- a/crates/temporal-runtime/tests/environment_registration_live.rs
+++ b/crates/temporal-runtime/tests/environment_registration_live.rs
@@ -1,11 +1,20 @@
 //! Key-based outbound registration, end to end against the real gateway:
 //! an in-process `lightspeed-envd` dials the environment gateway with a
-//! registration key, becomes a `Ready` registered environment, serves a
-//! worker route through a reverse-dialed stream socket, goes `Offline` when
-//! its control connection drops, reconnects by identity alone, loses to a
-//! newer process with the same identity, keeps reconnecting after its key
-//! is revoked, closes its ephemeral environment at once when it says
-//! goodbye, and is told to exit for good once its environment is closed.
+//! registration key and becomes an open, connected registered environment
+//! that serves worker routes through reverse-dialed stream sockets. Its
+//! connection is written on transitions only: a dropped control connection
+//! marks the row disconnected, and the worker route then refuses with a
+//! typed refusal (`away` at once for an ephemeral key, a bounded
+//! `disconnected` wait for a persistent one). The daemon reconnects by
+//! identity alone, loses to a newer process with the same identity, keeps
+//! reconnecting after its key is revoked, closes its ephemeral environment
+//! at once when it says goodbye (`departed`), and is told the environment
+//! closed by an in-process close at once and by a close made elsewhere at
+//! the next revocation sweep. The registered sweep closes ephemeral rows
+//! after their grace and persistent rows after the key's offline bound; a
+//! parked daemon waits for its stop signal instead of exiting. Rotation
+//! keeps the key's group, startup repair marks connected rows disconnected,
+//! and a configured registration URL is an accepted signature origin.
 
 mod support;
 
@@ -13,15 +22,16 @@ use std::{collections::BTreeMap, path::Path, sync::Arc, time::Duration};
 
 use api::{
     AgentApiService, DeploymentApiService, DeploymentUniverseCreateParams, EnvironmentCloseParams,
-    EnvironmentIdentityModeView, EnvironmentLifecycleStatusView, EnvironmentListParams,
+    EnvironmentCloseReasonView, EnvironmentIdentityModeView, EnvironmentListParams,
     EnvironmentReadParams, EnvironmentRegistrationKeyCreateParams,
     EnvironmentRegistrationKeyReadParams, EnvironmentRegistrationKeyRevokeParams,
-    EnvironmentSourceView, EnvironmentView,
+    EnvironmentRegistrationKeyRotateParams, EnvironmentRegistrationKeyUpdateParams,
+    EnvironmentSourceView, EnvironmentStateView, EnvironmentStatusView, EnvironmentView,
 };
-use environment_client::DataClient;
+use environment_client::{ClientError, DataClient};
 use environment_daemon::{
     DaemonRuntime,
-    config::{DaemonConfig, RegistrationConfig},
+    config::{DaemonConfig, OnClosed, RegistrationConfig},
     server::DaemonExit,
 };
 use environment_protocol::{
@@ -43,14 +53,20 @@ use environment_protocol::{
     ids::ProcessId,
     metadata::{DisplayName, Metadata},
     paths::EnvironmentPath,
+    routes::{DataRouteRefusal, canonical_origin},
+};
+use environments::{
+    BeginCloseEnvironment, EnvironmentCloseReason, EnvironmentGoneReason, EnvironmentStore as _,
+    EnvironmentUse, EnvironmentWaitReason, REGISTERED_LIVENESS_STAMP_MS,
+    REGISTERED_RECONNECT_WAIT_MS, StampRegisteredSeen,
 };
-use environments::EnvironmentStore as _;
 use support::live::{LIVE_TEST_LOCK, require_storage_live_env};
 use temporal_runtime::{
     DeploymentStores, GatewayAuthMode, UniverseRuntime,
+    environments::gateway::{EnvironmentGatewayClientConfig, RouteKey},
     gateway::{
         DEFAULT_MAX_REQUEST_BODY_BYTES, GatewayAgentApi, GatewayDeploymentApi, GatewayRoutes,
-        GatewayState, gateway_router,
+        GatewayState, gateway_router, registration,
         request_context::{RequestContext, with_request_context as calling},
     },
 };
@@ -66,6 +82,8 @@ use uuid::Uuid;
 
 const POLL: Duration = Duration::from_millis(200);
 const SETTLE: Duration = Duration::from_secs(30);
+/// An in-process close reaches the daemon without any polling interval.
+const IN_PROCESS_NOTIFY: Duration = Duration::from_secs(3);
 
 #[tokio::test(flavor = "current_thread")]
 #[ignore = "requires ./dev.sh infra or compatible Temporal + Postgres env"]
@@ -85,10 +103,14 @@ async fn registered_envd_dials_out_serves_routes_reconnects_and_is_spent_on_clos
     let universe_id = Uuid::new_v4();
 
     let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await?;
-    let base_url = format!("http://{}", listener.local_addr()?);
-    let connect_url = format!(
-        "ws://{}/environment-gateway/connect",
-        listener.local_addr()?
+    let address = listener.local_addr()?;
+    let base_url = format!("http://{address}");
+    let connect_url = format!("ws://{address}/environment-gateway/connect");
+    // A second name for the same listener: accepted only because it is a
+    // configured registration URL.
+    let alias_connect_url = format!(
+        "ws://localhost:{}/environment-gateway/connect",
+        address.port()
     );
     let runtime = Arc::new(UniverseRuntime::new(
         client,
@@ -107,11 +129,26 @@ async fn registered_envd_dials_out_serves_routes_reconnects_and_is_spent_on_clos
     )
     .await?;
     let caller = RequestContext::local(api::AccessScope::Universe { universe_id });
-    let state = Arc::new(GatewayState::multi(
-        GatewayAuthMode::Single { universe_id },
-        runtime.clone(),
-        base_url.clone(),
-    ));
+    let origins = temporal_runtime::gateway::http::registration_origins(
+        Some(&base_url),
+        std::slice::from_ref(&alias_connect_url),
+        address,
+    )?;
+    assert_eq!(
+        origins,
+        [
+            canonical_origin(&base_url)?,
+            canonical_origin(&alias_connect_url)?
+        ]
+    );
+    let state = Arc::new(
+        GatewayState::multi(
+            GatewayAuthMode::Single { universe_id },
+            runtime.clone(),
+            base_url.clone(),
+        )
+        .with_registration_origins(origins),
+    );
     let gateway = tokio::spawn(async move {
         axum::serve(
             listener,
@@ -172,41 +209,67 @@ async fn registered_envd_dials_out_serves_routes_reconnects_and_is_spent_on_clos
         "the environment-gateway process serves the connect route"
     );
     api_only.abort();
-    let reconciler = tokio::spawn(runtime.clone().run_environment_reconciler());
     let api = runtime.state_for(universe_id, false).await?.api.clone();
     let sandbox = tempfile::tempdir()?;
 
+    let urls = Urls {
+        base: &base_url,
+        connect: &connect_url,
+        alias_connect: &alias_connect_url,
+    };
     let result = calling(
         caller,
-        scenario(
-            &runtime,
-            &api,
-            universe_id,
-            &base_url,
-            &connect_url,
-            sandbox.path(),
-        ),
+        scenario(&runtime, &api, universe_id, &urls, sandbox.path()),
     )
     .await;
-    reconciler.abort();
     gateway.abort();
     result
 }
 
+struct Urls<'a> {
+    base: &'a str,
+    connect: &'a str,
+    alias_connect: &'a str,
+}
+
 async fn scenario(
     runtime: &Arc<UniverseRuntime>,
     api: &Arc<GatewayAgentApi>,
     universe_id: Uuid,
-    base_url: &str,
-    connect_url: &str,
+    urls: &Urls<'_>,
+    sandbox: &Path,
+) -> anyhow::Result<()> {
+    // Workers reach this test's gateway, not whatever the sourced dev
+    // environment points LIGHTSPEED_ENVIRONMENT_GATEWAY_URL at; the route
+    // bearer is the deployment token the gateway state checks.
+    let gateway = EnvironmentGatewayClientConfig::new(
+        urls.base,
+        runtime.environment_gateway().deployment_token(),
+    );
+    ephemeral_scenario(runtime, api, universe_id, &gateway, urls, sandbox).await?;
+    persistent_scenario(runtime, api, universe_id, &gateway, urls, sandbox).await?;
+    ephemeral_grace_scenario(runtime, api, universe_id, urls, sandbox).await
+}
+
+/// An ephemeral key: admission, the data path, the coarse stamp, immediate
+/// `away` while disconnected, reconnect, supersede, revocation, departure
+/// and the in-process close notify.
+async fn ephemeral_scenario(
+    runtime: &Arc<UniverseRuntime>,
+    api: &Arc<GatewayAgentApi>,
+    universe_id: Uuid,
+    gateway: &EnvironmentGatewayClientConfig,
+    urls: &Urls<'_>,
     sandbox: &Path,
 ) -> anyhow::Result<()> {
+    let store = runtime.state_for(universe_id, false).await?.store.clone();
     let minted = api
         .create_environment_registration_key(EnvironmentRegistrationKeyCreateParams {
             display_name: "registration live pool".to_owned(),
             identity_mode: EnvironmentIdentityModeView::Ephemeral,
             max_active_environments: Some(2),
             ephemeral_disconnect_grace_ms: None,
+            offline_close_after_ms: None,
             expires_at_ms: None,
         })
         .await?
@@ -216,55 +279,58 @@ async fn scenario(
     assert!(secret.starts_with("lsrk_"));
     assert_eq!(minted.registration_key.active_environment_count, 0);
 
-    // First daemon: a fresh identity admitted by the key.
+    // First daemon: a fresh identity admitted by the key, open and
+    // connected, with both connection stamps written at admission.
     let root_a = workspace(sandbox, "a")?;
     let receipt_a = sandbox.join("receipt-a.json");
     let daemon_a = spawn_daemon(daemon_config(
         &root_a,
         &sandbox.join("state-a"),
-        connect_url,
+        urls.connect,
         Some(&secret),
         Some(&receipt_a),
+        OnClosed::Exit,
     )?)?;
-    let environment_a =
-        wait_for_registered(api, &key_id, 1, EnvironmentLifecycleStatusView::Ready).await?;
-    let EnvironmentSourceView::Registered {
-        registration_key_id,
-        daemon_id,
-        identity_mode,
-    } = &environment_a.source
-    else {
-        anyhow::bail!(
-            "expected a registered source, got {:?}",
-            environment_a.source
-        )
-    };
-    assert_eq!(registration_key_id, &key_id);
-    assert_eq!(*identity_mode, EnvironmentIdentityModeView::Ephemeral);
-    assert!(daemon_id.starts_with("daemon_"));
-    assert!(environment_a.last_seen_at_ms.is_some());
-    let metadata = &environment_a.metadata;
+    let environment_a = wait_for_registered(api, &key_id, 1, is_connected).await?;
+    let registered = registered_source(&environment_a)?;
+    assert_eq!(registered.registration_key_id, key_id);
     assert_eq!(
-        metadata.get("harbor.trialId").map(String::as_str),
-        Some("trial-1")
+        registered.identity_mode,
+        EnvironmentIdentityModeView::Ephemeral
     );
+    assert!(registered.daemon_id.starts_with("daemon_"));
     assert_eq!(
-        metadata.get("lightspeed.envd.version").map(String::as_str),
-        Some(release_info::VERSION)
+        registered.connection_changed_at_ms,
+        registered.last_seen_at_ms
     );
+    assert_eq!(environment_a.state, EnvironmentStateView::Open);
+    assert_eq!(environment_a.status, EnvironmentStatusView::Ready);
+    assert_eq!(environment_a.request_id, None);
     assert_eq!(
-        metadata.get("lightspeed.envd.gitSha").map(String::as_str),
-        Some(release_info::GIT_SHA)
+        environment_a
+            .metadata
+            .get("harbor.trialId")
+            .map(String::as_str),
+        Some("trial-1")
     );
-    assert_eq!(
-        metadata.get("lightspeed.envd.protocolVersion"),
-        Some(&ENVD_PROTOCOL_VERSION.to_string())
+    assert!(
+        environment_a
+            .metadata
+            .keys()
+            .all(|key| !key.starts_with("lightspeed.")),
+        "build facts are not metadata: {:?}",
+        environment_a.metadata
     );
+    let daemon = environment_a.daemon.as_ref().expect("daemon build");
+    assert_eq!(daemon.version.as_deref(), Some(release_info::VERSION));
+    assert_eq!(daemon.git_sha.as_deref(), Some(release_info::GIT_SHA));
+    assert_eq!(daemon.protocol_version, ENVD_PROTOCOL_VERSION);
     let receipt = read_receipt(&receipt_a)?;
     assert_eq!(receipt["environmentId"], environment_a.environment_id);
-    assert_eq!(receipt["daemonId"], daemon_id.as_str());
+    assert_eq!(receipt["daemonId"], registered.daemon_id.as_str());
     assert_eq!(receipt["identityMode"], "ephemeral");
     assert_eq!(receipt["admission"], "created");
+    assert!(receipt.get("incarnationId").is_none());
     assert!(
         receipt["controlConnectionId"]
             .as_str()
@@ -275,24 +341,39 @@ async fn scenario(
     assert_eq!(key_view.active_environment_count, 1);
     assert_eq!(key_view.registered_environment_count, 1);
 
+    // The liveness stamp is coarse: a stamp within the interval of the
+    // last one writes nothing, one a full interval later writes.
+    let environment_id_a = environments::EnvironmentId::new(environment_a.environment_id.clone());
+    assert!(
+        !store
+            .stamp_registered_seen(StampRegisteredSeen {
+                environment_id: environment_id_a.clone(),
+                at_ms: registered.last_seen_at_ms + 1_000,
+            })
+            .await?
+    );
+    assert!(
+        store
+            .stamp_registered_seen(StampRegisteredSeen {
+                environment_id: environment_id_a.clone(),
+                at_ms: registered.last_seen_at_ms + REGISTERED_LIVENESS_STAMP_MS,
+            })
+            .await?
+    );
+
     // The worker route reaches the daemon through a reverse-dialed stream
     // socket; concurrent routes each get their own socket.
-    let record = runtime
-        .state_for(universe_id, false)
-        .await?
-        .store
-        .read_environment(&environments::EnvironmentId::new(
-            environment_a.environment_id.clone(),
-        ))
-        .await?;
-    // Workers reach this test's gateway, not whatever the sourced dev
-    // environment points LIGHTSPEED_ENVIRONMENT_GATEWAY_URL at; the route
-    // bearer is the deployment token the gateway state checks.
-    let gateway = temporal_runtime::environments::gateway::EnvironmentGatewayClientConfig::new(
-        base_url,
-        runtime.environment_gateway().deployment_token(),
+    let key = RouteKey {
+        universe_id,
+        environment_id: environment_a.environment_id.clone(),
+    };
+    assert_eq!(
+        gateway.route_key(
+            universe_id,
+            &store.read_environment(&environment_id_a).await?
+        ),
+        key
     );
-    let key = gateway.route_key(universe_id, &record);
     let options = || gateway.connect_options("registration-live");
     let (first, initialized) = gateway.connect(&key, options()).await?;
     let (second, _) = gateway.connect(&key, options()).await?;
@@ -335,27 +416,42 @@ async fn scenario(
     first.close().await?;
     second.close().await?;
 
-    // Dropping the control connection makes the environment Offline; the
-    // same identity, now without any key, reconnects the same environment.
+    // Dropping the control connection marks the environment disconnected.
+    // An ephemeral daemon is away at once: the gate refuses the route for
+    // good instead of waiting.
     daemon_a.exit.abort();
-    wait_for_status(
-        api,
-        &environment_a.environment_id,
-        EnvironmentLifecycleStatusView::Offline,
-    )
+    let away = wait_for_environment(api, &environment_a.environment_id, "disconnected", |view| {
+        is_connected(view) == Some(false)
+    })
     .await?;
+    assert_eq!(away.state, EnvironmentStateView::Open);
+    assert_eq!(away.status, EnvironmentStatusView::Away);
+    assert!(
+        registered_source(&away)?.connection_changed_at_ms >= registered.connection_changed_at_ms
+    );
+    let refused = expect_route_refusal(gateway, &key).await?;
+    assert!(matches!(
+        refused,
+        ClientError::UpgradeRejected {
+            status: 410,
+            refusal: Some(DataRouteRefusal::Away {}),
+            retry_after_ms: None,
+        }
+    ));
+
+    // The same identity, now without any key, reconnects the same
+    // environment.
     let daemon_a = spawn_daemon(daemon_config(
         &root_a,
         &sandbox.join("state-a"),
-        connect_url,
+        urls.connect,
         None,
         Some(&receipt_a),
+        OnClosed::Exit,
     )?)?;
-    wait_for_status(
-        api,
-        &environment_a.environment_id,
-        EnvironmentLifecycleStatusView::Ready,
-    )
+    wait_for_environment(api, &environment_a.environment_id, "reconnected", |view| {
+        is_connected(view) == Some(true)
+    })
     .await?;
     wait_for_receipt_admission(&receipt_a, "reconnected").await?;
     assert_eq!(
@@ -363,7 +459,7 @@ async fn scenario(
         environment_a.environment_id
     );
     assert_eq!(
-        wait_for_registered(api, &key_id, 1, EnvironmentLifecycleStatusView::Ready)
+        wait_for_registered(api, &key_id, 1, is_connected)
             .await?
             .environment_id,
         environment_a.environment_id,
@@ -372,7 +468,7 @@ async fn scenario(
 
     // A second process with the same identity (a cloned state directory)
     // wins; the older one is told it was superseded and exits instead of
-    // fighting for the identity.
+    // fighting for the identity. The row stays connected throughout.
     let twin_state = sandbox.join("state-a-twin");
     std::fs::create_dir_all(&twin_state)?;
     std::fs::copy(
@@ -384,9 +480,10 @@ async fn scenario(
     let twin_a = spawn_daemon(daemon_config(
         &root_a,
         &twin_state,
-        connect_url,
+        urls.connect,
         None,
         None,
+        OnClosed::Exit,
     )?)?;
     let superseded = tokio::time::timeout(SETTLE, daemon_a.exit).await??;
     assert!(
@@ -394,10 +491,11 @@ async fn scenario(
         "unexpected exit: {superseded:?}"
     );
     assert_eq!(superseded.status(), 5);
-    wait_for_status(
+    wait_for_environment(
         api,
         &environment_a.environment_id,
-        EnvironmentLifecycleStatusView::Ready,
+        "connected twin",
+        |view| is_connected(view) == Some(true),
     )
     .await?;
     let (after_supersede, _) = gateway.connect(&key, options()).await?;
@@ -409,9 +507,10 @@ async fn scenario(
     let daemon_b = spawn_daemon(daemon_config(
         &root_b,
         &sandbox.join("state-b"),
-        connect_url,
+        urls.connect,
         Some(&secret),
         None,
+        OnClosed::Exit,
     )?)?;
     let environments = wait_for_registered_count(api, &key_id, 2).await?;
     let environment_b = environments
@@ -419,7 +518,7 @@ async fn scenario(
         .find(|environment| environment.environment_id != environment_a.environment_id)
         .cloned()
         .expect("second environment");
-    assert_eq!(environment_b.status, EnvironmentLifecycleStatusView::Ready);
+    assert_eq!(is_connected(&environment_b), Some(true));
 
     // Revocation without cascade stops new identities but not reconnects.
     api.revoke_environment_registration_key(EnvironmentRegistrationKeyRevokeParams {
@@ -431,9 +530,10 @@ async fn scenario(
     let daemon_c = spawn_daemon(daemon_config(
         &root_c,
         &sandbox.join("state-c"),
-        connect_url,
+        urls.connect,
         Some(&secret),
         None,
+        OnClosed::Exit,
     )?)?;
     let refused = tokio::time::timeout(SETTLE, daemon_c.exit).await??;
     assert!(
@@ -444,7 +544,7 @@ async fn scenario(
 
     // A deliberate stop says goodbye and the daemon exits cleanly. The
     // sandbox is finished, so its ephemeral environment closes at once
-    // instead of sitting Offline for the key's disconnect grace.
+    // (`departed`) instead of waiting out the key's disconnect grace.
     daemon_b.runtime.shutdown().cancel();
     let stopped = tokio::time::timeout(SETTLE, daemon_b.exit).await??;
     assert!(
@@ -452,19 +552,25 @@ async fn scenario(
         "unexpected exit: {stopped:?}"
     );
     assert_eq!(stopped.status(), 0);
-    wait_for_status(
+    let departed = wait_for_state(
         api,
         &environment_b.environment_id,
-        EnvironmentLifecycleStatusView::Closed,
+        EnvironmentStateView::Closed,
     )
     .await?;
+    assert_eq!(
+        departed.close_reason,
+        Some(EnvironmentCloseReasonView::Departed)
+    );
+    assert!(departed.closed_at_ms.is_some());
     // The departed identity is spent: a restart is refused at register.
     let restarted_b = spawn_daemon(daemon_config(
         &root_b,
         &sandbox.join("state-b"),
-        connect_url,
+        urls.connect,
         None,
         None,
+        OnClosed::Exit,
     )?)?;
     let refused_b = tokio::time::timeout(SETTLE, restarted_b.exit).await??;
     assert!(
@@ -473,24 +579,43 @@ async fn scenario(
     );
     assert_eq!(refused_b.status(), 4);
 
-    // Closing the environment spends the identity: the daemon is told the
-    // environment closed and exits for good.
+    // Closing the environment in this process notifies its control
+    // connection at once: the daemon is told the environment closed and
+    // exits for good, and its routes end.
     api.close_environment(EnvironmentCloseParams {
         environment_id: environment_a.environment_id.clone(),
     })
     .await?;
-    let spent = tokio::time::timeout(SETTLE, twin_a.exit).await??;
+    let spent = tokio::time::timeout(IN_PROCESS_NOTIFY, twin_a.exit).await??;
     assert!(
         matches!(spent, DaemonExit::EnvironmentClosed),
         "a closed environment ends its daemon: {spent:?}"
     );
     assert_eq!(spent.status(), 4);
-    wait_for_status(
+    let closed = wait_for_state(
         api,
         &environment_a.environment_id,
-        EnvironmentLifecycleStatusView::Closed,
+        EnvironmentStateView::Closed,
     )
     .await?;
+    assert_eq!(
+        closed.close_reason,
+        Some(EnvironmentCloseReasonView::Requested)
+    );
+    let refused = expect_route_refusal(gateway, &key).await?;
+    assert!(matches!(
+        refused,
+        ClientError::UpgradeRejected {
+            status: 410,
+            refusal: Some(DataRouteRefusal::Gone {}),
+            ..
+        }
+    ));
+    assert!(
+        list_by_key(api, &key_id, false).await?.is_empty(),
+        "closed environments are hidden by default"
+    );
+    assert_eq!(list_by_key(api, &key_id, true).await?.len(), 2);
     let key_view = read_key(api, &key_id).await?;
     assert_eq!(key_view.registered_environment_count, 2);
     assert_eq!(key_view.active_environment_count, 0);
@@ -498,15 +623,297 @@ async fn scenario(
         key_view.status,
         api::EnvironmentRegistrationKeyStatusView::Revoked
     );
+    Ok(())
+}
+
+/// A persistent key, dialed under the configured registration URL: the
+/// bounded reconnect wait, startup repair, rotation, the cross-process
+/// close at the revocation sweep, and the offline bound with a parked
+/// daemon.
+async fn persistent_scenario(
+    runtime: &Arc<UniverseRuntime>,
+    api: &Arc<GatewayAgentApi>,
+    universe_id: Uuid,
+    gateway: &EnvironmentGatewayClientConfig,
+    urls: &Urls<'_>,
+    sandbox: &Path,
+) -> anyhow::Result<()> {
+    let store = runtime.state_for(universe_id, false).await?.store.clone();
+    let minted = api
+        .create_environment_registration_key(EnvironmentRegistrationKeyCreateParams {
+            display_name: "registration live fleet".to_owned(),
+            identity_mode: EnvironmentIdentityModeView::Persistent,
+            max_active_environments: Some(3),
+            ephemeral_disconnect_grace_ms: None,
+            offline_close_after_ms: None,
+            expires_at_ms: None,
+        })
+        .await?
+        .result;
+    let key_id = minted.registration_key.registration_key_id.clone();
+    let first_secret = minted.secret.0.clone();
+
+    // The daemon signs the alias origin; the gateway accepts it because
+    // the alias is a configured registration URL.
+    let root_p = workspace(sandbox, "p")?;
+    let state_p = sandbox.join("state-p");
+    let receipt_p = sandbox.join("receipt-p.json");
+    let spawn_p = |key: Option<&str>| {
+        spawn_daemon(daemon_config(
+            &root_p,
+            &state_p,
+            urls.alias_connect,
+            key,
+            Some(&receipt_p),
+            OnClosed::Exit,
+        )?)
+    };
+    let daemon_p = spawn_p(Some(&first_secret))?;
+    let environment_p = wait_for_registered(api, &key_id, 1, is_connected).await?;
+    assert_eq!(read_receipt(&receipt_p)?["identityMode"], "persistent");
+    let key = RouteKey {
+        universe_id,
+        environment_id: environment_p.environment_id.clone(),
+    };
+    let environment_id_p = environments::EnvironmentId::new(environment_p.environment_id.clone());
+    let (client, _) = gateway
+        .connect(&key, gateway.connect_options("registration-live"))
+        .await?;
+    client.get_idle(&GetIdleParams {}).await?;
+    client.close().await?;
+
+    // A persistent daemon that drops is waited for, within a bound: the
+    // route refuses `disconnected` with a retry hint, and the gate turns
+    // into `away` once the bound passes.
+    daemon_p.exit.abort();
+    let away = wait_for_environment(api, &environment_p.environment_id, "disconnected", |view| {
+        is_connected(view) == Some(false)
+    })
+    .await?;
+    assert_eq!(away.status, EnvironmentStatusView::Away);
+    let refused = expect_route_refusal(gateway, &key).await?;
+    assert!(matches!(
+        refused,
+        ClientError::UpgradeRejected {
+            status: 503,
+            refusal: Some(DataRouteRefusal::Disconnected {}),
+            retry_after_ms: Some(_),
+        }
+    ));
+    let record = store.read_environment(&environment_id_p).await?;
+    let since = record
+        .registered()
+        .expect("registered")
+        .connection_changed_at_ms;
+    assert_eq!(
+        record.use_gate(since + 1_000),
+        EnvironmentUse::Wait {
+            reason: EnvironmentWaitReason::Disconnected,
+            retry_after_ms: environments::WAIT_RETRY_AFTER_MS,
+            until_ms: Some(since + REGISTERED_RECONNECT_WAIT_MS),
+        }
+    );
+    assert!(matches!(
+        record.use_gate(since + REGISTERED_RECONNECT_WAIT_MS),
+        EnvironmentUse::Gone {
+            reason: EnvironmentGoneReason::Away,
+            ..
+        }
+    ));
+
+    // Back by identity alone.
+    let daemon_p = spawn_p(None)?;
+    wait_for_environment(api, &environment_p.environment_id, "reconnected", |view| {
+        is_connected(view) == Some(true)
+    })
+    .await?;
+    wait_for_receipt_admission(&receipt_p, "reconnected").await?;
+
+    // Startup repair (here for this universe only): a gateway that
+    // restarted held none of the connections its rows still call
+    // connected. The disconnect counts from now, so persistent rows get
+    // their full reconnect wait.
+    let before_repair = now_ms();
+    assert!(store.repair_registered_connections(before_repair).await? >= 1);
+    let repaired = store.read_environment(&environment_id_p).await?;
+    let source = repaired.registered().expect("registered");
+    assert!(!source.connected);
+    assert_eq!(source.connection_changed_at_ms, before_repair);
+    assert!(matches!(
+        repaired.use_gate(before_repair + 1_000),
+        EnvironmentUse::Wait {
+            reason: EnvironmentWaitReason::Disconnected,
+            ..
+        }
+    ));
+    // The daemon's next connection records it again.
+    daemon_p.exit.abort();
+    let daemon_p = spawn_p(None)?;
+    wait_for_environment(
+        api,
+        &environment_p.environment_id,
+        "reconnected after repair",
+        |view| is_connected(view) == Some(true),
+    )
+    .await?;
+
+    // Rotation retires the live secret at once and keeps the key: its
+    // group, identity mode and environments. Admitted daemons are
+    // unaffected; a new daemon needs the new secret.
+    let rotated = api
+        .rotate_environment_registration_key(EnvironmentRegistrationKeyRotateParams {
+            registration_key_id: key_id.clone(),
+        })
+        .await?
+        .result;
+    assert_eq!(rotated.registration_key.registration_key_id, key_id);
+    assert_eq!(
+        rotated.registration_key.identity_mode,
+        EnvironmentIdentityModeView::Persistent
+    );
+    assert_ne!(
+        rotated.registration_key.key_prefix,
+        minted.registration_key.key_prefix
+    );
+    assert_ne!(rotated.secret.0, first_secret);
+    let root_r = workspace(sandbox, "r")?;
+    let stale = spawn_daemon(daemon_config(
+        &root_r,
+        &sandbox.join("state-r"),
+        urls.connect,
+        Some(&first_secret),
+        None,
+        OnClosed::Exit,
+    )?)?;
+    let stale_exit = tokio::time::timeout(SETTLE, stale.exit).await??;
+    assert!(
+        matches!(stale_exit, DaemonExit::Refused(_)),
+        "a retired secret admits nobody: {stale_exit:?}"
+    );
+    let root_s = workspace(sandbox, "s")?;
+    let state_s = sandbox.join("state-s");
+    let daemon_s = spawn_daemon(daemon_config(
+        &root_s,
+        &state_s,
+        urls.connect,
+        Some(&rotated.secret.0),
+        None,
+        OnClosed::Exit,
+    )?)?;
+    let environments = wait_for_registered_count(api, &key_id, 2).await?;
+    let environment_s = environments
+        .iter()
+        .find(|environment| environment.environment_id != environment_p.environment_id)
+        .cloned()
+        .expect("environment admitted by the rotated secret");
+    assert_eq!(
+        registered_source(&environment_s)?.registration_key_id,
+        key_id
+    );
+    assert_eq!(
+        read_key(api, &key_id).await?.registered_environment_count,
+        2
+    );
+
+    // A close made outside this process (here written to the store
+    // directly) reaches the daemon at the next revocation sweep.
+    store
+        .begin_close_environment(BeginCloseEnvironment {
+            environment_id: environment_id_p.clone(),
+            reason: EnvironmentCloseReason::Requested,
+            at_ms: now_ms(),
+        })
+        .await?;
+    assert!(registration::revoke_ended_routes(runtime).await? >= 1);
+    let spent = tokio::time::timeout(SETTLE, daemon_p.exit).await??;
+    assert!(
+        matches!(spent, DaemonExit::EnvironmentClosed),
+        "the revocation sweep ends the daemon of an environment closed elsewhere: {spent:?}"
+    );
+
+    // The key's offline bound closes a persistent environment whose daemon
+    // stays away (`offline_timeout`). The daemon, configured to park,
+    // then waits for its stop signal instead of exiting or crash-looping.
+    let updated = api
+        .update_environment_registration_key(EnvironmentRegistrationKeyUpdateParams {
+            registration_key_id: key_id.clone(),
+            display_name: "registration live fleet (offline bound)".to_owned(),
+            max_active_environments: Some(3),
+            ephemeral_disconnect_grace_ms: None,
+            offline_close_after_ms: Some(1_000),
+            expires_at_ms: None,
+        })
+        .await?
+        .result;
+    assert_eq!(updated.registration_key.offline_close_after_ms, Some(1_000));
+    assert_eq!(
+        updated.registration_key.display_name,
+        "registration live fleet (offline bound)"
+    );
+    daemon_s.exit.abort();
+    wait_for_environment(api, &environment_s.environment_id, "disconnected", |view| {
+        is_connected(view) == Some(false)
+    })
+    .await?;
+    tokio::time::sleep(Duration::from_millis(1_500)).await;
+    let sweep = registration::sweep_registered_universe(runtime, universe_id, now_ms()).await?;
+    assert!(
+        sweep
+            .closed
+            .iter()
+            .any(|(id, reason)| id.as_str() == environment_s.environment_id
+                && *reason == EnvironmentCloseReason::OfflineTimeout),
+        "{sweep:?}"
+    );
+    let closed = wait_for_state(
+        api,
+        &environment_s.environment_id,
+        EnvironmentStateView::Closed,
+    )
+    .await?;
+    assert_eq!(
+        closed.close_reason,
+        Some(EnvironmentCloseReasonView::OfflineTimeout)
+    );
+    let parked = spawn_daemon(daemon_config(
+        &root_s,
+        &state_s,
+        urls.connect,
+        None,
+        None,
+        OnClosed::Park,
+    )?)?;
+    tokio::time::sleep(Duration::from_secs(2)).await;
+    assert!(
+        !parked.exit.is_finished(),
+        "a parked daemon waits for its stop signal"
+    );
+    parked.runtime.shutdown().cancel();
+    let stopped = tokio::time::timeout(SETTLE, parked.exit).await??;
+    assert!(
+        matches!(stopped, DaemonExit::Shutdown),
+        "a parked daemon exits cleanly when stopped: {stopped:?}"
+    );
+    assert_eq!(stopped.status(), 0);
+    Ok(())
+}
 
-    // Ephemeral grace: a key with a short grace closes an environment whose
-    // daemon stays away, through the lifecycle reconciler alone.
+/// Ephemeral grace: the registered sweep closes an environment whose
+/// ephemeral daemon stays away longer than its key's grace.
+async fn ephemeral_grace_scenario(
+    runtime: &Arc<UniverseRuntime>,
+    api: &Arc<GatewayAgentApi>,
+    universe_id: Uuid,
+    urls: &Urls<'_>,
+    sandbox: &Path,
+) -> anyhow::Result<()> {
     let short = api
         .create_environment_registration_key(EnvironmentRegistrationKeyCreateParams {
             display_name: "registration live short grace".to_owned(),
             identity_mode: EnvironmentIdentityModeView::Ephemeral,
             max_active_environments: None,
             ephemeral_disconnect_grace_ms: Some(1_500),
+            offline_close_after_ms: None,
             expires_at_ms: None,
         })
         .await?
@@ -516,19 +923,45 @@ async fn scenario(
     let daemon_d = spawn_daemon(daemon_config(
         &root_d,
         &sandbox.join("state-d"),
-        connect_url,
+        urls.connect,
         Some(&short.secret.0),
         None,
+        OnClosed::Exit,
     )?)?;
-    let environment_d =
-        wait_for_registered(api, &short_key_id, 1, EnvironmentLifecycleStatusView::Ready).await?;
+    let environment_d = wait_for_registered(api, &short_key_id, 1, is_connected).await?;
     daemon_d.exit.abort();
-    wait_for_status(
+    wait_for_environment(api, &environment_d.environment_id, "disconnected", |view| {
+        is_connected(view) == Some(false)
+    })
+    .await?;
+    let early = registration::sweep_registered_universe(runtime, universe_id, now_ms()).await?;
+    assert!(
+        early
+            .closed
+            .iter()
+            .all(|(id, _)| id.as_str() != environment_d.environment_id),
+        "the grace has not passed yet: {early:?}"
+    );
+    tokio::time::sleep(Duration::from_millis(2_000)).await;
+    let sweep = registration::sweep_registered_universe(runtime, universe_id, now_ms()).await?;
+    assert!(
+        sweep
+            .closed
+            .iter()
+            .any(|(id, reason)| id.as_str() == environment_d.environment_id
+                && *reason == EnvironmentCloseReason::EphemeralGrace),
+        "{sweep:?}"
+    );
+    let closed = wait_for_state(
         api,
         &environment_d.environment_id,
-        EnvironmentLifecycleStatusView::Closed,
+        EnvironmentStateView::Closed,
     )
     .await?;
+    assert_eq!(
+        closed.close_reason,
+        Some(EnvironmentCloseReasonView::EphemeralGrace)
+    );
     let short_view = read_key(api, &short_key_id).await?;
     assert_eq!(short_view.active_environment_count, 0);
     assert_eq!(short_view.registered_environment_count, 1);
@@ -890,6 +1323,7 @@ fn daemon_config(
     connect_url: &str,
     key: Option<&str>,
     receipt: Option<&Path>,
+    on_closed: OnClosed,
 ) -> anyhow::Result<DaemonConfig> {
     let mut metadata = BTreeMap::new();
     metadata.insert("harbor.trialId".to_owned(), "trial-1".to_owned());
@@ -901,6 +1335,7 @@ fn daemon_config(
     registration.display_name = Some(DisplayName::new("registration live daemon")?);
     registration.metadata = Metadata::new(metadata)?;
     registration.receipt_path = receipt.map(Path::to_path_buf);
+    registration.on_closed = on_closed;
     Ok(DaemonConfig {
         listen: None,
         cwd: root.to_path_buf(),
@@ -925,6 +1360,72 @@ fn spawn_daemon(config: DaemonConfig) -> anyhow::Result<Daemon> {
     Ok(Daemon { exit, runtime })
 }
 
+fn now_ms() -> i64 {
+    i64::try_from(
+        std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .expect("clock after the epoch")
+            .as_millis(),
+    )
+    .expect("millisecond clock fits i64")
+}
+
+/// The registered facts of an environment view.
+struct RegisteredFacts {
+    registration_key_id: String,
+    daemon_id: String,
+    identity_mode: EnvironmentIdentityModeView,
+    connection_changed_at_ms: i64,
+    last_seen_at_ms: i64,
+}
+
+fn registered_source(view: &EnvironmentView) -> anyhow::Result<RegisteredFacts> {
+    let EnvironmentSourceView::Registered {
+        registration_key_id,
+        daemon_id,
+        identity_mode,
+        connection_changed_at_ms,
+        last_seen_at_ms,
+        ..
+    } = &view.source
+    else {
+        anyhow::bail!("expected a registered source, got {:?}", view.source)
+    };
+    Ok(RegisteredFacts {
+        registration_key_id: registration_key_id.clone(),
+        daemon_id: daemon_id.clone(),
+        identity_mode: *identity_mode,
+        connection_changed_at_ms: *connection_changed_at_ms,
+        last_seen_at_ms: *last_seen_at_ms,
+    })
+}
+
+/// Whether a registered environment's daemon is connected; `None` for
+/// other kinds.
+fn is_connected(view: &EnvironmentView) -> Option<bool> {
+    match &view.source {
+        EnvironmentSourceView::Registered { connected, .. } => Some(*connected),
+        _ => None,
+    }
+}
+
+/// Dial the worker route and expect the gateway to refuse the upgrade.
+async fn expect_route_refusal(
+    gateway: &EnvironmentGatewayClientConfig,
+    key: &RouteKey,
+) -> anyhow::Result<ClientError> {
+    match gateway
+        .connect(key, gateway.connect_options("registration-live"))
+        .await
+    {
+        Ok((client, _)) => {
+            client.close().await?;
+            anyhow::bail!("the worker route upgraded for {}", key.environment_id)
+        }
+        Err(error) => Ok(error),
+    }
+}
+
 async fn read_key(
     api: &GatewayAgentApi,
     key_id: &str,
@@ -938,31 +1439,35 @@ async fn read_key(
         .registration_key)
 }
 
+/// Wait until exactly `count` open environments are listed under the key
+/// and one of them is connected.
 async fn wait_for_registered(
     api: &GatewayAgentApi,
     key_id: &str,
     count: usize,
-    status: EnvironmentLifecycleStatusView,
+    connected: fn(&EnvironmentView) -> Option<bool>,
 ) -> anyhow::Result<EnvironmentView> {
     let deadline = tokio::time::Instant::now() + SETTLE;
     loop {
-        let environments = list_by_key(api, key_id).await?;
+        let environments = list_by_key(api, key_id, false).await?;
         if environments.len() == count
             && let Some(environment) = environments
                 .iter()
-                .find(|environment| environment.status == status)
+                .find(|environment| connected(environment) == Some(true))
         {
             return Ok(environment.clone());
         }
         if tokio::time::Instant::now() > deadline {
             anyhow::bail!(
-                "timed out waiting for {count} environment(s) under {key_id} with one {status:?}: {environments:?}"
+                "timed out waiting for {count} environment(s) under {key_id} with one connected: {environments:?}"
             );
         }
         tokio::time::sleep(POLL).await;
     }
 }
 
+/// Wait until exactly `count` open environments are listed under the key,
+/// all connected.
 async fn wait_for_registered_count(
     api: &GatewayAgentApi,
     key_id: &str,
@@ -970,26 +1475,30 @@ async fn wait_for_registered_count(
 ) -> anyhow::Result<Vec<EnvironmentView>> {
     let deadline = tokio::time::Instant::now() + SETTLE;
     loop {
-        let environments = list_by_key(api, key_id).await?;
+        let environments = list_by_key(api, key_id, false).await?;
         if environments.len() == count
             && environments
                 .iter()
-                .all(|environment| environment.status == EnvironmentLifecycleStatusView::Ready)
+                .all(|environment| is_connected(environment) == Some(true))
         {
             return Ok(environments);
         }
         if tokio::time::Instant::now() > deadline {
-            anyhow::bail!("timed out waiting for {count} ready environments: {environments:?}");
+            anyhow::bail!("timed out waiting for {count} connected environments: {environments:?}");
         }
         tokio::time::sleep(POLL).await;
     }
 }
 
-async fn list_by_key(api: &GatewayAgentApi, key_id: &str) -> anyhow::Result<Vec<EnvironmentView>> {
+async fn list_by_key(
+    api: &GatewayAgentApi,
+    key_id: &str,
+    include_closed: bool,
+) -> anyhow::Result<Vec<EnvironmentView>> {
     Ok(api
         .list_environments(EnvironmentListParams {
-            metadata: Default::default(),
             registration_key_id: Some(key_id.to_owned()),
+            include_closed,
             ..EnvironmentListParams::default()
         })
         .await?
@@ -997,11 +1506,12 @@ async fn list_by_key(api: &GatewayAgentApi, key_id: &str) -> anyhow::Result<Vec<
         .environments)
 }
 
-async fn wait_for_status(
+async fn wait_for_environment(
     api: &GatewayAgentApi,
     environment_id: &str,
-    status: EnvironmentLifecycleStatusView,
-) -> anyhow::Result<()> {
+    what: &str,
+    ready: impl Fn(&EnvironmentView) -> bool,
+) -> anyhow::Result<EnvironmentView> {
     let deadline = tokio::time::Instant::now() + SETTLE;
     loop {
         let environment = api
@@ -1011,15 +1521,25 @@ async fn wait_for_status(
             .await?
             .result
             .environment;
-        if environment.status == status {
-            return Ok(());
+        if ready(&environment) {
+            return Ok(environment);
         }
         if tokio::time::Instant::now() > deadline {
             anyhow::bail!(
-                "timed out waiting for {environment_id} to be {status:?}; last {:?}",
-                environment.status
+                "timed out waiting for {environment_id} to be {what}; last {environment:?}"
             );
         }
         tokio::time::sleep(POLL).await;
     }
 }
+
+async fn wait_for_state(
+    api: &GatewayAgentApi,
+    environment_id: &str,
+    state: EnvironmentStateView,
+) -> anyhow::Result<EnvironmentView> {
+    wait_for_environment(api, environment_id, &format!("{state:?}"), |view| {
+        view.state == state
+    })
+    .await
+}
diff --git a/crates/temporal-runtime/tests/profiles_live.rs b/crates/temporal-runtime/tests/profiles_live.rs
index 57522cf9e..5665e6ca8 100644
--- a/crates/temporal-runtime/tests/profiles_live.rs
+++ b/crates/temporal-runtime/tests/profiles_live.rs
@@ -13,7 +13,7 @@ use api_projection::model_to_api;
 use harness::SessionId;
 use support::live::{
     LIVE_TEST_LOCK, fake_worker_activities, final_assistant_text, live_workflow_handle,
-    read_session_view, require_storage_live_env, run_with_live_worker, wait_for_environment_status,
+    read_session_view, require_storage_live_env, run_with_live_worker, wait_for_environment_state,
     wait_for_terminal_run,
 };
 use temporal_runtime::{gateway::GatewayAgentApi, pg_store_from_env};
@@ -42,6 +42,88 @@ async fn temporal_live_profile_selection_leaves_environment_lifecycle_independen
     run_with_live_worker(activities, run_profile_environment_selection_live_client).await
 }
 
+/// Registers the fake controller as a provider bound to this universe,
+/// directly through the store: the deployment API is deployment-scoped and
+/// these tests drive one universe's gateway.
+async fn register_fake_provider(
+    store: &store_pg::PgStore,
+    controller: &temporal_runtime::environments::fake_controller::FakeController,
+    provider_id: &str,
+) -> anyhow::Result<()> {
+    use environments::{
+        EnvironmentEndpoint, EnvironmentProviderBindingStore, EnvironmentProviderId,
+        EnvironmentProviderStore, ProviderCredentialChange, PutEnvironmentProvider,
+        PutEnvironmentProviderBinding,
+    };
+
+    store
+        .put_provider(PutEnvironmentProvider {
+            provider_id: EnvironmentProviderId::new(provider_id),
+            display_name: Some("Live fake provider".to_owned()),
+            controller_endpoint: EnvironmentEndpoint::parse(controller.controller_url())?,
+            data_route_base: None,
+            credential: match controller.credential() {
+                Some(credential) => {
+                    ProviderCredentialChange::Set(auth::SecretValue::new(credential))
+                }
+                None => ProviderCredentialChange::Keep,
+            },
+            updated_at_ms: 1,
+        })
+        .await?;
+    store
+        .put_provider_binding(PutEnvironmentProviderBinding {
+            universe_id: store.config().universe_id,
+            provider_id: EnvironmentProviderId::new(provider_id),
+            enabled: true,
+            updated_at_ms: 1,
+        })
+        .await?;
+    Ok(())
+}
+
+async fn delete_fake_provider(store: &store_pg::PgStore, provider_id: &str) -> anyhow::Result<()> {
+    use environments::{
+        EnvironmentProviderBindingStore, EnvironmentProviderId, EnvironmentProviderStore,
+    };
+
+    let provider_id = EnvironmentProviderId::new(provider_id);
+    store
+        .delete_provider_binding(store.config().universe_id, &provider_id)
+        .await?;
+    store.delete_provider(&provider_id).await?;
+    Ok(())
+}
+
+fn profile_with_environments(
+    profile_id: &ProfileId,
+    model: &harness::ModelSelection,
+    environments: Vec<api::EnvironmentAttachment>,
+) -> AgentProfileInput {
+    AgentProfileInput {
+        profile_id: profile_id.clone(),
+        display_name: None,
+        description: None,
+        document: ProfileDocument {
+            config: Some(SessionConfig {
+                model: Some(model_to_api(model)),
+                features: Some(api::FeaturesConfig {
+                    environments: Some(api::EnvironmentsFeature {
+                        version: api::CURRENT_FEATURE_VERSION,
+                        selection: false,
+                        prompts: None,
+                        skills: None,
+                        environments,
+                    }),
+                    ..Default::default()
+                }),
+                ..Default::default()
+            }),
+            ..Default::default()
+        },
+    }
+}
+
 /// Closing and deleting a session never closes its selected environment.
 async fn run_profile_environment_selection_live_client(
     client: Client,
@@ -50,11 +132,6 @@ async fn run_profile_environment_selection_live_client(
 ) -> anyhow::Result<()> {
     use std::collections::BTreeMap;
 
-    use environments::{
-        EnvironmentEndpoint, EnvironmentProviderBindingId, EnvironmentProviderBindingStatus,
-        EnvironmentProviderBindingStore, EnvironmentProviderId, EnvironmentProviderStore,
-        PutEnvironmentProvider, PutEnvironmentProviderBinding,
-    };
     use temporal_runtime::environments::fake_controller::{FAKE_TEMPLATE_ID, FakeController};
 
     let store = pg_store_from_env().await?;
@@ -65,77 +142,36 @@ async fn run_profile_environment_selection_live_client(
         .build();
     let suffix = uuid::Uuid::new_v4().simple().to_string();
     let provider_id = format!("fake-profile-{suffix}");
-    let binding_id = format!("binding-profile-{suffix}");
     let profile_id = ProfileId::new(format!("live_selection_{suffix}"));
 
-    // Serve a fake controller on loopback, register it and bind it to this
-    // universe directly through the store: the deployment API is
-    // deployment-scoped and this test drives one universe's gateway.
     let controller = FakeController::start().await?;
-    store
-        .put_provider(PutEnvironmentProvider {
-            provider_id: EnvironmentProviderId::new(provider_id.clone()),
-            display_name: Some("Live fake provider".to_owned()),
-            controller_endpoint: EnvironmentEndpoint::parse(controller.controller_url())?,
-            metadata: BTreeMap::new(),
-            credential: Some(auth::SecretValue::new(controller.credential())),
-            updated_at_ms: 1,
-        })
-        .await?;
-    store
-        .put_provider_binding(PutEnvironmentProviderBinding {
-            universe_id: store.config().universe_id,
-            binding_id: EnvironmentProviderBindingId::new(binding_id.clone()),
-            provider_id: EnvironmentProviderId::new(provider_id.clone()),
-            status: EnvironmentProviderBindingStatus::Enabled,
-            expected_revision: None,
-            metadata: BTreeMap::new(),
-            updated_at_ms: 1,
-        })
-        .await?;
+    register_fake_provider(&store, &controller, &provider_id).await?;
 
     let environment = api
         .create_environment(api::EnvironmentCreateParams {
             request_id: format!("independent-{suffix}"),
-            binding_id: binding_id.clone(),
+            provider_id: provider_id.clone(),
             template_id: FAKE_TEMPLATE_ID.into(),
             display_name: None,
             metadata: BTreeMap::new(),
-            idle_policy: None,
+            idle: None,
         })
         .await?
         .result
         .environment;
     let environment_id = environment.environment_id.clone();
     api.create_profile(ProfileCreateParams {
-        profile: AgentProfileInput {
-            profile_id: profile_id.clone(),
-            display_name: None,
-            description: None,
-            document: ProfileDocument {
-                config: Some(SessionConfig {
-                    model: Some(model_to_api(&model)),
-                    features: Some(api::FeaturesConfig {
-                        environments: Some(api::EnvironmentsFeature {
-                            version: api::CURRENT_FEATURE_VERSION,
-                            selection: false,
-                            prompts: None,
-                            skills: None,
-                            environments: vec![api::EnvironmentAttachment {
-                                environment_id: Some(environment_id.clone()),
-                                inherit: false,
-                                default: true,
-                                access: api::EnvironmentAccess::Read,
-                                working_directory: None,
-                            }],
-                        }),
-                        ..Default::default()
-                    }),
-                    ..Default::default()
-                }),
-                ..Default::default()
-            },
-        },
+        profile: profile_with_environments(
+            &profile_id,
+            &model,
+            vec![api::EnvironmentAttachment {
+                environment_id: Some(environment_id.clone()),
+                inherit: false,
+                default: true,
+                access: api::EnvironmentAccess::Read,
+                working_directory: None,
+            }],
+        ),
     })
     .await?;
     let start = || {
@@ -171,12 +207,7 @@ async fn run_profile_environment_selection_live_client(
         })
         .await?;
     assert!(!applied.result.applied.active_environment_changed);
-    wait_for_environment_status(
-        &api,
-        &environment_id,
-        api::EnvironmentLifecycleStatusView::Ready,
-    )
-    .await?;
+    wait_for_environment_state(&api, &environment_id, api::EnvironmentStateView::Open).await?;
     api.close_session(api::SessionCloseParams {
         session_id: session_id.to_string(),
         force: false,
@@ -184,14 +215,8 @@ async fn run_profile_environment_selection_live_client(
     .await?;
     api.reconcile_environments_once().await?;
     assert_eq!(
-        api.read_environment(api::EnvironmentReadParams {
-            environment_id: environment_id.clone()
-        })
-        .await?
-        .result
-        .environment
-        .status,
-        api::EnvironmentLifecycleStatusView::Ready
+        read_environment_view(&api, &environment_id).await?.state,
+        api::EnvironmentStateView::Open
     );
     api.delete_session(api::SessionDeleteParams {
         shared_only: false,
@@ -202,37 +227,30 @@ async fn run_profile_environment_selection_live_client(
     .await?;
     api.reconcile_environments_once().await?;
     assert_eq!(
-        api.read_environment(api::EnvironmentReadParams {
-            environment_id: environment_id.clone()
-        })
-        .await?
-        .result
-        .environment
-        .status,
-        api::EnvironmentLifecycleStatusView::Ready
+        read_environment_view(&api, &environment_id).await?.state,
+        api::EnvironmentStateView::Open
     );
     api.close_environment(api::EnvironmentCloseParams {
         environment_id: environment_id.clone(),
     })
     .await?;
-    wait_for_environment_status(
-        &api,
-        &environment_id,
-        api::EnvironmentLifecycleStatusView::Closed,
-    )
-    .await?;
+    wait_for_environment_state(&api, &environment_id, api::EnvironmentStateView::Closed).await?;
     api.delete_profile(ProfileDeleteParams { profile_id })
         .await?;
-    store
-        .delete_provider_binding(
-            store.config().universe_id,
-            &EnvironmentProviderBindingId::new(binding_id),
-        )
-        .await?;
-    store
-        .delete_provider(&EnvironmentProviderId::new(provider_id))
-        .await?;
-    Ok(())
+    delete_fake_provider(&store, &provider_id).await
+}
+
+async fn read_environment_view(
+    api: &GatewayAgentApi,
+    environment_id: &str,
+) -> anyhow::Result<api::EnvironmentView> {
+    Ok(api
+        .read_environment(api::EnvironmentReadParams {
+            environment_id: environment_id.to_owned(),
+        })
+        .await?
+        .result
+        .environment)
 }
 
 async fn run_profiles_live_client(
diff --git a/crates/temporal-runtime/tests/runs_live.rs b/crates/temporal-runtime/tests/runs_live.rs
index b82013fef..3ab485362 100644
--- a/crates/temporal-runtime/tests/runs_live.rs
+++ b/crates/temporal-runtime/tests/runs_live.rs
@@ -156,9 +156,10 @@ async fn temporal_live_steering_during_final_turn_adds_a_turn() -> anyhow::Resul
     // steering is materialized while the call is in flight, and instead of
     // completing on that final output the run gets one more turn whose
     // request carries the steering — so "steer" never silently does
-    // nothing.
+    // nothing. Zero tool rounds: every session carries the core blob tools,
+    // so the fake model would otherwise spend its first turn calling one.
     let (activities, counters) =
-        fake_worker_activities_for_run_control(Duration::from_secs(4), Duration::ZERO, 1).await?;
+        fake_worker_activities_for_run_control(Duration::from_secs(4), Duration::ZERO, 0).await?;
     run_with_live_worker(activities, move |client, task_queue, session_id| {
         run_steering_final_turn_live_client(client, task_queue, session_id, counters)
     })
@@ -175,9 +176,12 @@ async fn temporal_live_queued_runs_return_promptly_and_run_in_order() -> anyhow:
     // Queueing: runs started behind an active run return `queued` at
     // once, are visible in the session view, can be cancelled while queued,
     // and start in order after the active run ends. Cancelling the active
-    // run leaves the queued one untouched and it runs next.
+    // run leaves the queued one untouched and it runs next. Zero tool
+    // rounds: every session carries the core blob tools, so the fake model
+    // would otherwise spend the first executed run's opening turn calling
+    // one, making that run take two generations.
     let (activities, counters) =
-        fake_worker_activities_for_run_control(Duration::from_secs(5), Duration::ZERO, 1).await?;
+        fake_worker_activities_for_run_control(Duration::from_secs(5), Duration::ZERO, 0).await?;
     run_with_live_worker(activities, move |client, task_queue, session_id| {
         run_queue_live_client(client, task_queue, session_id, counters)
     })
@@ -509,7 +513,8 @@ async fn run_steering_final_turn_live_client(
     session_id: SessionId,
     counters: temporal_runtime::worker::FakeRuntimeCounters,
 ) -> anyhow::Result<()> {
-    // No tools: the fake model answers in one turn.
+    // No workspace tools, and the worker's fake model takes zero tool rounds,
+    // so it answers in one turn.
     let api = run_control_api(&client, task_queue, &session_id, false).await?;
     let run = start_text_run(&api, &session_id, "answer directly").await?;
     wait_until(
@@ -683,8 +688,9 @@ async fn run_queue_live_client(
         wait_for_terminal_run_with_timeout(&api, &session_id, &fourth.id, 40).await?;
     assert_eq!(fourth_terminal.status, api::RunStatus::Completed);
 
-    // Exactly one generation per executed run (first, third, fourth); the
-    // cancelled first run never got a second turn. Whether the worker
+    // Exactly one generation per executed run (first, third, fourth), since
+    // the fake model answers directly; the cancelled first run never got a
+    // second turn. Whether the worker
     // abandoned the first generation or it completed (and was discarded)
     // depends on heartbeat timing with this short delay and is covered by
     // the mid-generation cancel scenario.
@@ -699,7 +705,7 @@ async fn run_queue_live_client(
 }
 
 /// `wait_for_terminal_run` with a longer budget, for scenarios whose fake
-/// provider sleeps on purpose.
+/// provider sleeps on purpose or that drive many sequential activities.
 async fn wait_for_terminal_run_with_timeout(
     api: &GatewayAgentApi,
     session_id: &SessionId,
@@ -1100,7 +1106,33 @@ async fn run_unbounded_hosted_run_live_client(
             config: None,
         })
         .await?;
-    let run = wait_for_terminal_run(&api, &session_id, &started.result.run.id).await?;
+    // Thirty-one generations and thirty tool batches run back to back, which
+    // can approach the default 30 s terminal-run budget on a loaded local
+    // stack; wait with headroom, since the test is about transition count,
+    // not latency.
+    let diag_started = std::time::Instant::now();
+    let run =
+        wait_for_terminal_run_with_timeout(&api, &session_id, &started.result.run.id, 120).await?;
+    eprintln!("DIAG128 run took {:?}", diag_started.elapsed());
+    {
+        let events = api
+            .read_session_events(SessionEventsReadParams {
+                direction: Default::default(),
+                before: None,
+                session_id: session_id.as_str().to_owned(),
+                after: None,
+                limit: Some(80),
+                wait_ms: None,
+            })
+            .await?
+            .result
+            .events;
+        let base = events.first().map(|e| e.observed_at_ms).unwrap_or(0);
+        for event in &events {
+            let k = format!("{:?}", event.kind);
+            eprintln!("DIAG128 +{} {}", event.observed_at_ms - base, &k[..k.len().min(60)]);
+        }
+    }
     assert!(
         final_assistant_text(&run).is_some_and(|text| text.contains("Fake agent completed run"))
     );
diff --git a/crates/temporal-runtime/tests/subagents_live.rs b/crates/temporal-runtime/tests/subagents_live.rs
index 4f7881ae3..3f000d1b5 100644
--- a/crates/temporal-runtime/tests/subagents_live.rs
+++ b/crates/temporal-runtime/tests/subagents_live.rs
@@ -1314,47 +1314,14 @@ async fn run_agent_run_inherit_environment_live_client(
 ) -> anyhow::Result<()> {
     use std::collections::BTreeMap;
 
-    use environments::{
-        EnvironmentEndpoint, EnvironmentProviderBindingId, EnvironmentProviderBindingStatus,
-        EnvironmentProviderBindingStore, EnvironmentProviderId, EnvironmentProviderStore,
-        PutEnvironmentProvider, PutEnvironmentProviderBinding,
-    };
     use temporal_runtime::environments::fake_controller::FakeController;
 
     let store = pg_store_from_env().await?;
     let suffix = uuid::Uuid::new_v4().simple().to_string();
     let provider_id = format!("fake-inherit-{suffix}");
-    let binding_id = format!("binding-inherit-{suffix}");
     // Serves the controller and data routes until the test returns.
     let controller = FakeController::start().await?;
-    store
-        .put_provider(PutEnvironmentProvider {
-            provider_id: EnvironmentProviderId::new(provider_id.clone()),
-            display_name: Some("Live fake provider".to_owned()),
-            controller_endpoint: EnvironmentEndpoint::parse(controller.controller_url())?,
-            metadata: BTreeMap::new(),
-            credential: Some(auth::SecretValue::new(controller.credential())),
-            updated_at_ms: 1,
-        })
-        .await?;
-    store
-        .put_provider_binding(PutEnvironmentProviderBinding {
-            universe_id: store.config().universe_id,
-            binding_id: EnvironmentProviderBindingId::new(binding_id.clone()),
-            provider_id: EnvironmentProviderId::new(provider_id.clone()),
-            status: EnvironmentProviderBindingStatus::Enabled,
-            expected_revision: None,
-            metadata: BTreeMap::new(),
-            updated_at_ms: 1,
-        })
-        .await?;
-    let environments_feature = |attachment: api::EnvironmentAttachment| api::EnvironmentsFeature {
-        version: api::CURRENT_FEATURE_VERSION,
-        selection: false,
-        prompts: None,
-        skills: None,
-        environments: vec![attachment],
-    };
+    register_fake_provider(&store, &controller, &provider_id).await?;
 
     // Child profile: inherits whatever environment its parent has active.
     let child_profile_id = ProfileId::new(format!("live_inherit_child_{suffix}"));
@@ -1390,11 +1357,11 @@ async fn run_agent_run_inherit_environment_live_client(
     let independent_environment = api
         .create_environment(api::EnvironmentCreateParams {
             request_id: format!("inherit-env-{suffix}"),
-            binding_id: binding_id.clone(),
+            provider_id: provider_id.clone(),
             template_id: "rust-v1".into(),
             display_name: None,
             metadata: BTreeMap::new(),
-            idle_policy: None,
+            idle: None,
         })
         .await?
         .result
@@ -1505,12 +1472,11 @@ async fn run_agent_run_inherit_environment_live_client(
         .environment;
     assert!(
         !matches!(
-            environment.status,
-            api::EnvironmentLifecycleStatusView::Closing
-                | api::EnvironmentLifecycleStatusView::Closed
+            environment.state,
+            api::EnvironmentStateView::Closing | api::EnvironmentStateView::Closed
         ),
         "inherited environment must stay open after the child closes, got {:?}",
-        environment.status
+        environment.state
     );
 
     let mut all = vec![session_id];
@@ -1523,6 +1489,56 @@ async fn run_agent_run_inherit_environment_live_client(
     Ok(())
 }
 
+fn environments_feature(attachment: api::EnvironmentAttachment) -> api::EnvironmentsFeature {
+    api::EnvironmentsFeature {
+        version: api::CURRENT_FEATURE_VERSION,
+        selection: false,
+        prompts: None,
+        skills: None,
+        environments: vec![attachment],
+    }
+}
+
+/// Registers the fake controller as a provider bound to this universe,
+/// directly through the store: the deployment API is deployment-scoped and
+/// these tests drive one universe's gateway.
+async fn register_fake_provider(
+    store: &store_pg::PgStore,
+    controller: &temporal_runtime::environments::fake_controller::FakeController,
+    provider_id: &str,
+) -> anyhow::Result<()> {
+    use environments::{
+        EnvironmentEndpoint, EnvironmentProviderBindingStore, EnvironmentProviderId,
+        EnvironmentProviderStore, ProviderCredentialChange, PutEnvironmentProvider,
+        PutEnvironmentProviderBinding,
+    };
+
+    store
+        .put_provider(PutEnvironmentProvider {
+            provider_id: EnvironmentProviderId::new(provider_id),
+            display_name: Some("Live fake provider".to_owned()),
+            controller_endpoint: EnvironmentEndpoint::parse(controller.controller_url())?,
+            data_route_base: None,
+            credential: match controller.credential() {
+                Some(credential) => {
+                    ProviderCredentialChange::Set(auth::SecretValue::new(credential))
+                }
+                None => ProviderCredentialChange::Keep,
+            },
+            updated_at_ms: 1,
+        })
+        .await?;
+    store
+        .put_provider_binding(PutEnvironmentProviderBinding {
+            universe_id: store.config().universe_id,
+            provider_id: EnvironmentProviderId::new(provider_id),
+            enabled: true,
+            updated_at_ms: 1,
+        })
+        .await?;
+    Ok(())
+}
+
 async fn run_agent_spawn_cancel_live_client(
     client: Client,
     session_id: SessionId,
diff --git a/crates/temporal-runtime/tests/support/live.rs b/crates/temporal-runtime/tests/support/live.rs
index 5b190bfc4..2d88060b2 100644
--- a/crates/temporal-runtime/tests/support/live.rs
+++ b/crates/temporal-runtime/tests/support/live.rs
@@ -472,10 +472,12 @@ pub async fn read_session_view(
         .session)
 }
 
-pub async fn wait_for_environment_status(
+/// Drive the reconciler of `api`'s universe until the environment reaches
+/// `expected`.
+pub async fn wait_for_environment_state(
     api: &temporal_runtime::gateway::GatewayAgentApi,
     environment_id: &str,
-    expected: api::EnvironmentLifecycleStatusView,
+    expected: api::EnvironmentStateView,
 ) -> anyhow::Result<api::EnvironmentView> {
     let started = Instant::now();
     loop {
@@ -487,13 +489,14 @@ pub async fn wait_for_environment_status(
             .await?
             .result
             .environment;
-        if environment.status == expected {
+        if environment.state == expected {
             return Ok(environment);
         }
         if started.elapsed() > Duration::from_secs(20) {
             anyhow::bail!(
-                "timed out waiting for environment {environment_id} to reach {expected:?}; current status is {:?}",
-                environment.status
+                "timed out waiting for environment {environment_id} to reach {expected:?}; current state is {:?} ({:?})",
+                environment.state,
+                environment.state_message
             );
         }
         tokio::time::sleep(Duration::from_millis(100)).await;
diff --git a/crates/temporal-runtime/tests/vfs_transfer_live.rs b/crates/temporal-runtime/tests/vfs_transfer_live.rs
index e1a0c5ef2..b00fd2209 100644
--- a/crates/temporal-runtime/tests/vfs_transfer_live.rs
+++ b/crates/temporal-runtime/tests/vfs_transfer_live.rs
@@ -130,6 +130,7 @@ async fn temporal_live_vfs_transfers_follow_profile_grants_and_publish_large_fil
                     identity_mode: api::EnvironmentIdentityModeView::Ephemeral,
                     max_active_environments: Some(1),
                     ephemeral_disconnect_grace_ms: None,
+                    offline_close_after_ms: None,
                     expires_at_ms: None,
                 })
                 .await?
@@ -161,7 +162,7 @@ async fn temporal_live_vfs_transfers_follow_profile_grants_and_publish_large_fil
                         .environments;
                     if let Some(environment) = environments
                         .into_iter()
-                        .find(|e| e.status == api::EnvironmentLifecycleStatusView::Ready)
+                        .find(|e| e.state == api::EnvironmentStateView::Open)
                     {
                         return anyhow::Ok(environment);
                     }
diff --git a/crates/tools/src/environment/control.rs b/crates/tools/src/environment/control.rs
index 9145bf382..d2513d948 100644
--- a/crates/tools/src/environment/control.rs
+++ b/crates/tools/src/environment/control.rs
@@ -35,14 +35,12 @@ pub struct EnvironmentDeactivateArgs {}
 #[derive(Clone, Debug, Serialize, Deserialize, schemars::JsonSchema)]
 pub struct EnvironmentModelView {
     pub environment_id: String,
-    pub provider_id: Option<String>,
     pub display_name: Option<String>,
     pub status: Option<String>,
     pub access: String,
     pub default: bool,
     pub working_directory: Option<String>,
     pub active: bool,
-    pub observed_at_ms: Option<i64>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub status_message: Option<String>,
 }
diff --git a/docs/documentation/deployment/configuration.md b/docs/documentation/deployment/configuration.md
index ef5195ca4..580b73f9d 100644
--- a/docs/documentation/deployment/configuration.md
+++ b/docs/documentation/deployment/configuration.md
@@ -74,7 +74,7 @@ callers:
 | `LIGHTSPEED_GATEWAY_BIND` | `0.0.0.0:18080` | Address inside the runtime's network namespace where HTTP listens. |
 | `LIGHTSPEED_API_URL` on Platform | `http://lightspeed-runtime:18080/rpc` | Private Platform-to-runtime JSON-RPC route. |
 | `LIGHTSPEED_PLATFORM_BASE_URL` | `https://lightspeed.example.com` | Public browser origin used for Platform authentication. |
-| `LIGHTSPEED_PUBLIC_BASE_URL` | `https://lightspeed.example.com` | Public runtime origin used for OAuth callbacks, bot hooks, and environment addresses. Registered daemons must dial this origin, because they sign it when they register. |
+| `LIGHTSPEED_PUBLIC_BASE_URL` | `https://lightspeed.example.com` | Public runtime origin used for OAuth callbacks, bot hooks, and environment addresses. Registered daemons must dial this origin, or one listed in `LIGHTSPEED_ENVIRONMENT_REGISTRATION_URLS`, because they sign it when they register. |
 | `LIGHTSPEED_ENVIRONMENT_GATEWAY_URL` | `http://lightspeed-runtime:18080` | Private base URL workers use for environment routes; omit `/rpc`. |
 
 An address containing `localhost` is relative to the process using it. Inside
diff --git a/docs/documentation/deployment/operations.md b/docs/documentation/deployment/operations.md
index 7f3c5430d..e369e1510 100644
--- a/docs/documentation/deployment/operations.md
+++ b/docs/documentation/deployment/operations.md
@@ -112,7 +112,7 @@ The runtime binary supports five roles:
 | Role | Work it owns |
 | --- | --- |
 | `gateway` | JSON-RPC requests, OAuth callbacks, and bot webhook ingress. |
-| `environment-gateway` | Daemon connections, worker environment routes, environment lifecycle reconciliation, and idle power management. |
+| `environment-gateway` | Daemon connections, worker environment routes, and environment lifecycle reconciliation: creating and closing provisioned environments and sweeping registered ones. |
 | `sessions` | Session, sub-agent, and environment-job workflows and activities, plus session/promise maintenance and CAS collection. |
 | `bots` | Bot controllers, trigger workflows and activities, and schedule reconciliation. |
 | `channels` | Conversation workflows and core channel activities. |
diff --git a/docs/documentation/deployment/overview.md b/docs/documentation/deployment/overview.md
index 976742383..4c0c94462 100644
--- a/docs/documentation/deployment/overview.md
+++ b/docs/documentation/deployment/overview.md
@@ -74,7 +74,7 @@ One `lightspeed-runtime` executable supplies five roles:
 | Role | Work it owns |
 | --- | --- |
 | `gateway` | JSON-RPC, OAuth callbacks, and bot webhook ingestion |
-| `environment-gateway` | Worker routes to environments, outbound daemon connections, environment lifecycle reconciliation, and idle power management |
+| `environment-gateway` | Worker routes to environments, outbound daemon connections, and environment lifecycle reconciliation |
 | `sessions` | Session workflows and activities, plus session and blob retention work |
 | `bots` | Bot controllers, trigger work, and bot activities |
 | `channels` | Chat conversation workflows and core channel activities |
diff --git a/docs/documentation/deployment/self-hosting.md b/docs/documentation/deployment/self-hosting.md
index 3fb98a77c..d70ae0d51 100644
--- a/docs/documentation/deployment/self-hosting.md
+++ b/docs/documentation/deployment/self-hosting.md
@@ -320,9 +320,10 @@ headers, pass WebSocket ping frames through, accept messages of up to 16 MiB,
 and do not close a quiet connection sooner than 60 seconds. Match those two
 routes exactly; forwarding the entire `/environment-gateway/` prefix would
 also expose internal worker routes. Daemons must dial these routes on the
-host of `LIGHTSPEED_PUBLIC_BASE_URL`: they sign that origin when they
+host of `LIGHTSPEED_PUBLIC_BASE_URL`, or on a URL listed in
+`LIGHTSPEED_ENVIRONMENT_REGISTRATION_URLS`: they sign that origin when they
 register, and the runtime refuses to serve registration on a non-loopback
-bind without it.
+bind with neither.
 
 The Platform checks login, membership, role, and session visibility before
 calling the runtime with its deployment key, universe selector, and actor ID.
diff --git a/docs/documentation/deployment/troubleshooting.md b/docs/documentation/deployment/troubleshooting.md
index 8b3e43323..cf7a028d9 100644
--- a/docs/documentation/deployment/troubleshooting.md
+++ b/docs/documentation/deployment/troubleshooting.md
@@ -21,7 +21,7 @@ are authorized to see them.
 | Sign-in or universe access fails | [Authentication and universe access](#authentication-and-universe-access) |
 | A run is queued, waiting, or apparently stuck | [Session progress](#session-progress) |
 | The model rejects a call or tools are absent | [Models and MCP](#models-and-mcp) |
-| A machine is offline or a command cannot see a file | [Execution environments](#execution-environments) |
+| A machine is disconnected or a command cannot see a file | [Execution environments](#execution-environments) |
 | A larger upload or stored payload fails | [Blob writes](#blob-writes) |
 | Chat messages do not reach the agent or return | [Chat delivery](#chat-delivery) |
 | Closing work does not reclaim storage or compute | [Retention and cleanup](#retention-and-cleanup) |
@@ -161,9 +161,11 @@ explains execution modes and discovery behavior.
 
 ## Execution environments
 
-Begin with the environment's source, lifecycle, and power state. A paused or
-stopped VM needs a wake path; an offline registered machine needs its daemon;
-a provisioning failure needs the provider and template that created it.
+Begin with the environment's source, state, status, and state message. A
+paused or stopped VM wakes when a tool connects to it, so a call that keeps
+waiting points at the provider's data route; a disconnected registered
+machine needs its daemon; a provisioning failure needs the provider and
+template that created it.
 
 For a registered daemon, inspect its own output and both public WebSocket
 paths. The control connection can be established while data routing is still
@@ -173,8 +175,9 @@ and token. Retain the daemon state directory so a restart proves the same
 identity. A closed identity cannot reconnect as a new environment merely by
 reusing its key.
 
-For Incus, inspect provider `/health`, the universe provider binding, selected
-template, instance boot, and guest daemon. Follow the specific procedures in
+For Incus, inspect provider `/health`, the universe provider binding, which
+must be enabled for its environments to be reachable, the selected template,
+instance boot, and guest daemon. Follow the specific procedures in
 [Bring your own compute](../environments/bring-your-own-compute.md),
 [Incus VMs](../environments/incus-vms.md), and
 [Networking and ingress](../environments/networking-and-ingress.md).
diff --git a/docs/documentation/deployment/upgrades-and-recovery.md b/docs/documentation/deployment/upgrades-and-recovery.md
index 80ba7b98e..50cd1b22d 100644
--- a/docs/documentation/deployment/upgrades-and-recovery.md
+++ b/docs/documentation/deployment/upgrades-and-recovery.md
@@ -236,9 +236,11 @@ An outbound daemon and its gateway must agree on the environment protocol.
 The release metadata records that protocol, and the gateway reports a mismatch
 when an incompatible daemon connects. Provider controllers have their own
 protocol number: redeploy every provider together with a runtime release that
-changes it. A provisioned machine whose baked-in daemon speaks another version
-fails when it becomes ready, with an error naming both versions, so recreate
-such machines from an updated image.
+changes it. A provider that runs idle policy also reads its daemons' idle
+reports, so it moves with the daemon protocol as well. A provisioned machine
+whose baked-in daemon speaks another version fails when it becomes ready,
+with an error naming both versions, so recreate such machines from an
+updated image.
 
 `lightspeed-envd upgrade` installs the build named by the deployment's discovery
 document. It verifies the archive checksum and checks the candidate's version,
@@ -258,7 +260,11 @@ daemon replaces its executable and re-executes with its arguments, working
 directory, state directory, and identity retained. The daemon attempts one
 upgrade per protocol version the gateway names, so a stale discovery document
 cannot cause an upgrade loop. Network failures while fetching the document or
-archive are retried; a checksum or build-fact mismatch stops the daemon. See the
+archive are retried; a checksum or build-fact mismatch stops the daemon. Keep
+automatic upgrade off for daemons in containers and on read-only root
+filesystems, and roll out a new image instead; see
+[Run registered daemons](../environments/registered-daemons.md#provide-the-daemon-binary).
+See the
 [daemon reference](../reference/environment-variables.md#environment-daemon)
 for discovery URL and private-CA settings.
 
diff --git a/docs/documentation/environments/bring-your-own-compute.md b/docs/documentation/environments/bring-your-own-compute.md
index bff9bf095..f0db1f9fd 100644
--- a/docs/documentation/environments/bring-your-own-compute.md
+++ b/docs/documentation/environments/bring-your-own-compute.md
@@ -7,7 +7,9 @@ inbound daemon port.
 
 This walkthrough connects a machine, selects it for a session, and runs `pwd`
 to verify the connection. It uses persistent registration so that restarting
-the daemon brings back the same environment.
+the daemon brings back the same environment. To run daemons as services, in
+Kubernetes or under systemd, continue with
+[Run registered daemons](registered-daemons.md) afterwards.
 
 ## Prepare the machine
 
@@ -96,9 +98,12 @@ For the local quickstart, run:
 
 For a remote installation, replace the gateway URL with its public endpoint,
 for example `wss://lightspeed.example.com/environment-gateway/connect`. Use
-the host of the deployment's public base URL: the daemon signs the origin it
-dials, and the gateway refuses any other. Plain `ws://` is accepted only for
-loopback connections. Leave the daemon running in this terminal.
+the host of the deployment's public base URL, or another registration URL
+the operator configured: the daemon signs the origin it dials, and the
+gateway refuses any other. Plain `ws://` is accepted only for loopback
+connections unless the daemon is started with `--allow-insecure-gateway`,
+which is meant for a trusted private network. Leave the daemon running in
+this terminal.
 
 The daemon opens an outbound control connection. When a worker needs a data
 connection, the daemon opens another outbound connection for that route.
@@ -106,9 +111,9 @@ This command does not start a passive listener on the machine.
 
 Wait for `receipt.json` to appear, then reload the **Environments** page and
 confirm **My workstation** is ready. The receipt records the assigned
-environment, incarnation, and daemon identifiers, the control connection, the
-identity mode, and whether this admission created the environment or
-reconnected to it. It never contains the registration secret. Keep the state
+environment and daemon identifiers, the control connection, the identity
+mode, and whether this admission created the environment or reconnected to
+it. It never contains the registration secret. Keep the state
 directory: it contains the daemon's private identity key.
 
 The daemon sends the registration key only until its first admission. After
@@ -153,8 +158,9 @@ the directory printed by `pwd`.
 
 Press Ctrl+C in the daemon terminal. The daemon tells the gateway it is
 stopping and exits with status 0. With persistent registration, the
-environment becomes offline and remains in the universe; reload
-**Environments** to inspect its status. To reconnect, use the same state
+environment stays open and shows as disconnected; reload **Environments** to
+inspect it. A tool call that needs it meanwhile waits up to two minutes for
+the daemon to return, then fails. To reconnect, use the same state
 directory and omit the deleted registration-key file:
 
 ```bash
@@ -171,10 +177,13 @@ environment returns under its existing identity. Reload **Environments** and
 repeat the `pwd` request to verify access.
 
 For short-lived machines, a registration key can instead use an ephemeral
-identity mode. Those environments close after their disconnect grace period.
-Once an environment is closed, its daemon identity cannot register again: a
-running daemon is told so and exits with status 4, and a replacement needs a
-fresh state directory and a valid registration key.
+identity mode. Those environments close as soon as their daemon stops, or
+after the key's disconnect grace period when the connection is lost, and
+tools never wait for them to return. Once an environment is closed, its
+daemon identity cannot register again: a running daemon is told so and exits
+with status 4, or parks until it is stopped when started with
+`--on-closed=park`. A replacement needs a fresh state directory and a valid
+registration key.
 
 Run one daemon per state directory. When a second process connects with the
 same identity, the newer connection wins and the older daemon exits with
@@ -191,6 +200,15 @@ Revoking a key alone blocks new identities. Already admitted environments
 can continue reconnecting until you close them. Closing a registered
 environment does not shut down or delete the underlying computer.
 
+A key's **Edit** dialog changes its group name, active environment limit,
+disconnect grace, **Close when offline for** setting, and expiry; its
+identity mode is fixed. **Rotate** replaces a leaked or expiring secret: the
+old secret stops working at once, the new one is shown once, and the key
+keeps its group, policy, and admitted environments. Daemons already
+registered are unaffected because they never present the key again. Use
+**Rename…** on an environment to change the display name its daemon first
+reported.
+
 ## Direct attachment for local development
 
 The full local launcher also offers a shorter, direct connection path. On the
@@ -220,7 +238,8 @@ the runtime and daemon run on the same host; in a container deployment,
 | Restart fails after deleting the key file | Remove `--registration-key-file` from the command and retain the original `--state-dir`. |
 | The daemon reports incompatible protocol versions | Use daemon and runtime builds from the same release, or run `lightspeed-envd upgrade`. `lightspeed-envd --print-build` reports daemon build and protocol information. |
 | The daemon exits with status 3 | The gateway refused registration for good, for example an invalid, revoked, or expired key, or a protocol version the daemon cannot upgrade to. The log names the reason. |
-| Registration is refused because the signature does not verify | The daemon dialed a different host than the gateway's public base URL, such as `localhost` instead of `127.0.0.1`. Use the exact public host. |
+| Registration is refused because the signature does not verify | The daemon dialed a different host than the gateway's public base URL and its configured registration URLs, such as `localhost` instead of `127.0.0.1`. Use one of those exact hosts. |
+| The daemon refuses a `ws://` gateway URL | Plain `ws://` is accepted only toward loopback. Use `wss://`, or `--allow-insecure-gateway` on a trusted private network. |
 | The daemon exits with status 5 | Another process uses the same state directory and identity. Give each daemon its own state directory. |
 | The agent has no process tool | Enable **Environments**, select the active environment, and apply the setup to the actual session. |
 | A command cannot start or find a program | Check the daemon user's permissions, installed programs, Bash, and working directory on the machine. |
diff --git a/docs/documentation/environments/incus-vms.md b/docs/documentation/environments/incus-vms.md
index 628893b85..214af7e53 100644
--- a/docs/documentation/environments/incus-vms.md
+++ b/docs/documentation/environments/incus-vms.md
@@ -7,8 +7,10 @@ create machines from those templates, then attach them to sessions or profiles.
 
 The provider runs as a separate process. It talks to Incus using an HTTPS
 client certificate, exposes a private controller to Lightspeed, and relays
-environment operations to the daemon inside each VM. It does not connect to
-Lightspeed's database or run session workflows.
+environment operations to the daemon inside each VM. It also owns the VMs'
+power: it pauses and stops idle VMs on its own schedule and wakes them when
+Lightspeed connects. It does not connect to Lightspeed's database or run
+session workflows.
 
 This walkthrough uses one standalone Incus server. It builds an image,
 registers the provider, binds a universe, and provisions a test environment.
@@ -27,12 +29,14 @@ Prepare these files for the provider process:
   project, network, image, profile, and VM operations.
 - A trusted server CA file for validating the Incus HTTPS endpoint.
 - A provider credential: a random secret of at least 32 bytes without
-  whitespace, which Lightspeed presents to the provider.
+  whitespace, which Lightspeed presents to the provider. It is optional, but
+  leave it out only when nothing but Lightspeed can reach the provider's
+  listener.
 - A provider configuration file with the endpoint, storage pool, and templates.
 
-The provider must be able to reach Incus and the guest networks. Its
-controller and data routes require the provider credential as a bearer token
-and refuse other callers before the WebSocket upgrade. The guest daemon
+The provider must be able to reach Incus and the guest networks. With a
+credential configured, its controller and data routes require it as a bearer
+token and refuse other callers before the WebSocket upgrade. The guest daemon
 listener inside each VM has no authentication of its own: keep guest networks
 private, and do not expose the provider or its guests as public agent or
 browser endpoints. [Networking and ingress](networking-and-ingress.md)
@@ -115,7 +119,6 @@ This example leaves public application ingress disabled:
 {
   "controllerListen": "127.0.0.1:19090",
   "credentialFile": "/run/secrets/lightspeed-provider-credential",
-  "dataRouteBase": "ws://127.0.0.1:19090/routes",
   "incus": {
     "mode": "single",
     "endpoints": ["https://incus.internal:8443"],
@@ -136,7 +139,11 @@ This example leaves public application ingress disabled:
       "imageFingerprint": "<immutable image fingerprint>",
       "cpu": 2,
       "memory": "4GiB",
-      "disk": "40GiB"
+      "disk": "40GiB",
+      "idle": {
+        "pauseAfterMs": 1800000,
+        "stopAfterMs": 14400000
+      }
     }
   ]
 }
@@ -148,16 +155,26 @@ as `4GiB`; the provider reports them to Lightspeed in bytes. The sample
 controller listens on loopback, which works when the environment gateway can
 reach that same host namespace. For separate hosts or containers, bind an
 appropriate private address and register that reachable address instead.
-
-`dataRouteBase` is the URL at which Lightspeed reaches this listener's
-`/routes` path, so it must use the address Lightspeed dials, not necessarily
-the bind address. The provider advertises it during the controller handshake.
-When Lightspeed reaches the controller through TLS, for example behind a
-reverse proxy, `dataRouteBase` must use `wss://` as well.
+Leave out `credentialFile` to run without a credential.
+
+The listener serves the controller on `/control` and the data routes under
+`/routes`. Lightspeed derives the data route URL from the controller URL you
+register, so the same address serves both. Only when the environment
+gateway reaches the data routes under another address, for example through
+a separate proxy, register that base with the provider in Lightspeed.
+
+The template's `idle` block is the idle policy its VMs get: pause after 30
+minutes without activity, then stop after four hours. Thresholds are in
+milliseconds and must not decrease in the order `pauseAfterMs`,
+`stopAfterMs`, `closeAfterMs`; `closeAfterMs` deletes the VM. Incus VMs
+cannot be suspended, so a template refuses `suspendAfterMs`. Leave `idle`
+out to keep VMs running until someone changes their power or closes them.
+The provider checks idle VMs every `idleCheckSeconds`, 60 by default; see
+[Let the provider manage power](#let-the-provider-manage-power).
 
 The network block denies the metadata-service address in this example. It
 is an explicit egress rule, not a complete network policy. The provider also
-separates sibling binding networks. Choose additional denied destinations for
+separates the networks of different universes. Choose additional denied destinations for
 your deployment, avoiding overlap with allocated guest network ranges.
 
 Start the process:
@@ -180,8 +197,8 @@ prove that the image can boot or that a guest daemon is reachable; the first
 environment test covers those steps.
 
 The complete [example configuration](../../../crates/environment-provider-incus/config.example.json)
-also includes optional relay settings, an image server, and ingress.
-`relayIdleSeconds` cannot be set below 60, so a quiet long read is never cut
+also includes optional relay and idle-check settings, an image server, and
+ingress. `relayIdleSeconds` cannot be set below 60, so a quiet long read is never cut
 by the relay. The provider config has no provider ID or list of authorized
 universes. Those belong to Lightspeed's registry and bindings.
 
@@ -195,38 +212,43 @@ provider**. Enter:
 | Provider id | `incus-local` |
 | Display name (optional) | `Local Incus` |
 | Controller endpoint | `ws://127.0.0.1:19090/control` |
-| Credential | The contents of the provider credential file |
+| Data route base (optional) | Leave empty: Lightspeed uses `ws://127.0.0.1:19090/routes` |
+| Credential (optional) | The contents of the provider credential file |
 
 Choose **Register**. Lightspeed connects to the controller and checks its
 handshake. A wrong path or credential refuses the registration; a provider
-that is not running yet is accepted and checked again later. The credential
-is write-only: Lightspeed never shows it again, and leaving it empty when
-editing the provider keeps the stored one. The ID is a stable
-deployment-wide identifier used by its universe bindings. For another
-topology, use the private endpoint reachable from the environment gateway
-rather than its own loopback address.
-
-Choose **Bind universe**, select the **Universe**, leave **Binding id** at the
-provider-ID default or enter a stable ID, and choose **Bind**. There can be at
-most one binding for each universe/provider pair.
-
-An enabled binding lets that universe list the provider's templates and create
-environments. The provider lazily creates a restricted Incus project, managed
-network, ACL, and profile for the binding. You do not need to add the universe
-to the provider JSON or restart it to add another binding.
+that is not running yet is accepted and checked again on first use. The
+credential is write-only: Lightspeed never shows it again, leaving it empty
+when editing the provider keeps the stored one, and **Remove the stored
+credential** deletes it. The ID is a stable deployment-wide identifier used
+by its universe bindings. For another topology, use the private endpoint
+reachable from the environment gateway rather than its own loopback address.
+A data route base you enter must use `wss://` when the controller is reached
+over TLS.
+
+Choose **Bind universe**, select the **Universe**, and choose **Bind**. There
+can be at most one binding for each universe and provider.
+
+An enabled binding lets that universe list the provider's templates, create
+environments, and reach the ones it created. The provider lazily creates a
+restricted Incus project, managed network, ACL, and profile for the
+universe. You do not need to add the universe to the provider JSON or
+restart it to bind another universe.
 
 ## Provision and verify a VM
 
 In the bound universe, open **Environments → New environment**. Choose
 **Small development VM**, enter a display name such as `Acorn build machine`,
-and choose **Provision**. You can leave the idle policy empty for this initial
-test, then configure it under [Power and cleanup](power-and-cleanup.md).
+and choose **Provision**. The dialog shows the template's idle policy and
+power states; **Custom idle policy** replaces the template's policy for this
+VM. Incus cannot suspend, so only pause, stop and close are offered.
 
-The environment progresses through provisioning and booting toward ready.
-Expand **Details** to inspect the environment ID, provider, template, and
-provider target. Attach it with **Run commands** access and select it in a session
-with **Environments** enabled, then ask the agent to run `pwd` and a harmless
-file check.
+The environment stays provisioning while the VM is created and boots, and
+becomes ready once Lightspeed's first connection to its daemon succeeds.
+Expand **Details** to inspect the environment ID, provider, template,
+provider target, and what the provider last reported. Attach it with **Run
+commands** access and select it in a session with **Environments** enabled,
+then ask the agent to run `pwd` and a harmless file check.
 
 The provider configures the guest daemon during provisioning. The stock setup
 listens privately on port 19091, starts commands in `/workspace`, and keeps
@@ -239,12 +261,33 @@ and execution check. Finish the test by closing the disposable environment
 and waiting for its status to become closed. Closing releases the VM and its
 disk, so save any needed output first.
 
+## Let the provider manage power
+
+The provider owns its VMs' power. Every `idleCheckSeconds` it asks the daemon
+in each running VM how long it has been idle, and applies the most escalated
+stage of the VM's idle policy that is due: pause, then stop, then close. It
+keeps counting while a VM is paused, so a later stage still fires. Running
+processes, running jobs, and services a command left running keep a VM
+awake, and the provider never powers a VM down while Lightspeed has a
+connection open to it. After a provider restart, the idle time of a VM that
+was already powered down starts again from zero.
+
+A VM keeps the idle policy it was created with. A template's `idle` is the
+default; `environments/create` can pass another policy for one VM.
+
+A tool call wakes a paused or stopped VM: its connection to the VM's data
+route makes the provider unfreeze or start it, and the call waits until the
+daemon answers. The **Pause**, **Resume**, and **Stop** buttons ask the
+provider directly; its idle policy still applies afterwards. A VM the idle
+policy closed is gone, and its environment shows **Ended by the provider**.
+
 ## Update offerings and manage access
 
 Publish a changed image under a new fingerprint and a new template ID. Set
 `deprecated: true` on the old template when it should stop appearing for new
 environments. Deprecation affects only new environments: existing ones keep
-waking, powering, and closing normally. Edit the provider's `templates`
+waking, powering, and closing normally. A changed `idle` block applies to
+VMs created afterwards. Edit the provider's `templates`
 configuration and restart its service: configuration is loaded at startup,
 with no hot reload.
 
@@ -256,11 +299,13 @@ another environment protocol version than the runtime fails when it becomes
 ready, with an error naming both versions; recreate it from a current
 template.
 
-Disabling a universe binding prevents new provisioning. It does not close
-environments already created through it. Binding deletion is refused while
-nonclosed environments reference it, and provider deletion is refused while
-bindings reference it. Removing registry records does not automatically remove
-all provider-side projects or network infrastructure.
+Disabling a universe binding prevents new provisioning and makes the
+universe's environments from that provider unreachable until it is enabled
+again. It does not close them. Binding deletion is refused while the universe
+has nonclosed environments from the provider, and provider deletion is
+refused while bindings or nonclosed environments reference it. Removing
+registry records does not automatically remove all provider-side projects or
+network infrastructure.
 
 ## Use an existing Incus cluster
 
@@ -287,8 +332,9 @@ before adopting that topology.
 | The provider cannot start or its health check fails | Check configuration, Incus HTTPS trust, client permissions, topology mode, and endpoint reachability. |
 | The universe has no templates | Check provider registration, the universe's enabled binding, and template deprecation. |
 | Incus cannot find the configured image | Use the immutable fingerprint, make it available on the target, or configure a trusted image server. |
-| Registering the provider is refused | Check the controller URL path, the credential, and that `dataRouteBase` uses `wss://` when the controller is reached over TLS. |
-| A VM boots but its environment is not ready | Check the guest daemon service, matching binary architecture, provider-to-guest routes, private daemon port, and that `dataRouteBase` reaches the provider from the environment gateway. |
+| Registering the provider is refused | Check the controller URL path, the credential, and that a data route base you entered uses `wss://` when the controller is reached over TLS. |
+| A VM boots but its environment is not ready | Read the environment's state message. Check the guest daemon service, matching binary architecture, provider-to-guest routes, private daemon port, and that the data route base, derived or entered, reaches the provider from the environment gateway. |
+| A VM never pauses | Check the template's `idle` block, running processes and jobs, services a command left running, and open sessions using the VM. |
 | The environment fails naming two protocol versions | The image's daemon does not match the runtime release. Rebuild the image and recreate the environment. |
 | A command cannot write outside the workspace | Inspect the stock service's systemd restrictions and daemon-user permissions. Customize the image deliberately if the task needs more access. |
-| Adding a binding fails during network setup | Check Incus permissions, subnet availability, denied-CIDR overlap, and cluster uplink configuration if applicable. |
+| A universe's first provisioning fails during network setup | Check Incus permissions, subnet availability, denied-CIDR overlap, and cluster uplink configuration if applicable. |
diff --git a/docs/documentation/environments/networking-and-ingress.md b/docs/documentation/environments/networking-and-ingress.md
index 2ea21afd9..267aa6114 100644
--- a/docs/documentation/environments/networking-and-ingress.md
+++ b/docs/documentation/environments/networking-and-ingress.md
@@ -29,8 +29,11 @@ outbound connections; external daemons and Incus guests are reached over
 private deployment networks.
 
 Run exactly one **environment-gateway** process per deployment. It owns live
-registered-daemon connections, lifecycle reconciliation, and idle power
-management. Worker routes must reach that process. Other runtime roles can
+registered-daemon connections, the worker routes, and the reconciliation
+that creates and closes provisioned machines. At startup it marks every
+registered environment disconnected until its daemon reconnects, which is
+correct only while a single process holds those connections. Worker routes
+must reach that process. Other runtime roles can
 scale independently; distributing this gateway's live connection ownership
 across replicas is not currently supported.
 
@@ -52,15 +55,18 @@ through an HTTPS/WebSocket-capable proxy:
 | `/environment-gateway/data` | Additional outbound data sockets opened when the gateway requests a worker route. |
 
 Use `wss://` for a remote gateway. The daemon accepts plain `ws://` only for
-loopback. For a private certificate authority, configure
+loopback, unless `LIGHTSPEED_ENVD_ALLOW_INSECURE_GATEWAY` opts in for a
+trusted private network. For a private certificate authority, configure
 `LIGHTSPEED_ENVD_CA_FILE` with the additional trust anchors.
 
 The daemon derives the data path from its configured connect URL, on the same
 origin and under the same path prefix, so both paths must be published on one
 host. The daemon signs the origin it dialed when it proves its identity, and
-the gateway accepts only the origin of its `LIGHTSPEED_PUBLIC_BASE_URL`.
-Point daemons at that public URL; a daemon that dials the gateway under
-another hostname is refused.
+the gateway accepts the origin of its `LIGHTSPEED_PUBLIC_BASE_URL` plus those
+listed in `LIGHTSPEED_ENVIRONMENT_REGISTRATION_URLS`, such as a
+cluster-internal service address. A daemon that dials the gateway under any
+other hostname is refused. [Run registered daemons](registered-daemons.md)
+shows the in-cluster setup.
 
 The first connection uses a registration key and the daemon's identity. Later
 connections use the retained identity, and requested data sockets use a
@@ -90,23 +96,26 @@ working directory does not make a publicly reachable process service safe to
 expose.
 
 For a provider, the environment gateway reaches the controller URL registered
-for it and the data routes the controller advertises during its handshake.
-Both require the provider credential as a bearer token. For Incus, those are
-the provider's `/control` and `/routes/...` paths, advertised through its
-`dataRouteBase`. The provider then dials the guest daemon over the private
-guest IPv4 network, normally on port 19091. That guest listener has no
+for it and the provider's data routes. Unless a data route base is
+registered with the provider, the routes live under `/routes` on the
+controller's scheme, host, and port. Both carry the provider credential as a
+bearer token when one is configured. For Incus, those are the provider's
+`/control` and `/routes/...` paths on one listener. Connecting to a data
+route also wakes a paused or stopped VM. The provider then dials the guest
+daemon over the private guest IPv4 network, normally on port 19091. That guest listener has no
 authentication of its own, so keep guest networks private. The provider's
 connection to the Incus API uses HTTPS client credentials and server trust
 separately.
 
-Standalone Incus uses a managed bridge per universe binding. Cluster mode
+Standalone Incus uses a managed bridge per universe. Cluster mode
 uses a managed OVN network over the configured uplink. The provider and its
 application edge must be able to route to the resulting guest addresses; API
 access to Incus alone does not establish guest connectivity.
 
-The provider separates sibling binding networks and applies configured
-`deniedEgressCidrs`. That list defaults to empty. Add the destinations the
-deployment needs to block, and avoid overlapping the binding subnets. These
+The provider separates the networks of different universes and applies
+configured `deniedEgressCidrs`. That list defaults to empty. Add the
+destinations the deployment needs to block, and avoid overlapping the
+universe subnets. These
 specific rules are not a general application-aware egress policy.
 
 Relay connection timeouts and VM idle policies control different resources.
@@ -212,10 +221,10 @@ Public requests do not reset the daemon's idle activity clock, and browser
 access does not wake a sleeping VM. A sleeping target can therefore return
 404 even though ingress remains configured.
 
-A tracked running root process keeps the idle reaper from treating the
-machine as idle. A service left behind by a command that already exited does
-not. Set the VM's power policy according to how the application should remain
-available, and inspect the distinction in [Power and cleanup](power-and-cleanup.md#understand-the-current-staging-limit).
+A running process keeps the machine awake, and so does a service that a
+command started and left running after it exited. Choose a template whose
+idle policy matches how the application should remain available; see
+[Power and cleanup](power-and-cleanup.md#set-an-idle-policy).
 
 Choose **Disable public ingress** to remove the route. This does not stop the
 application process. Stop the tracked server separately when it is no longer
@@ -232,7 +241,10 @@ The API equivalent is `environments/ingress/put`, with params such as:
 }
 ```
 
-See the [API reference](../../../crates/api/contract/api-reference.md) for its
+The call waits for the provider and returns the environment with the
+endpoint the provider reported. It fails when the provider cannot be reached;
+nothing is retried later. See the
+[API reference](../../../crates/api/contract/api-reference.md) for its
 response and the environment's endpoint fields.
 
 ## Locate a connection failure
@@ -243,7 +255,7 @@ response and the environment's endpoint fields.
 | Worker calls fail while the daemon looks healthy | Check the worker's gateway URL/token and private route reachability. |
 | Incus health passes but guest operations fail | Check guest daemon readiness, guest IPv4 routing, and the provider-to-daemon port. |
 | A loopback endpoint works locally but fails in containers | Replace it with the private address reachable from the actual connecting process. |
-| **Enable public ingress** is absent or disabled | Check template permission, provider ingress configuration, and ready status. |
+| **Enable public ingress** is absent or disabled | Check that the template offers public ingress, the provider's ingress configuration, and that the environment is open. |
 | The public endpoint returns 404 | Check the original Host header, enabled route, and whether the target is ready rather than asleep. |
 | The public endpoint returns 502 | Check the edge's Incus lookup and connectivity to the application on the approved guest port. |
 | HTTP works but WebSockets or long responses fail | Check upgrades, streaming, and timeouts at the deployment TLS proxy. |
diff --git a/docs/documentation/environments/overview.md b/docs/documentation/environments/overview.md
index 91019e4d5..972a5cc63 100644
--- a/docs/documentation/environments/overview.md
+++ b/docs/documentation/environments/overview.md
@@ -46,10 +46,12 @@ not need its own inbound daemon address. A registration key admits machines
 into a particular universe. Each admitted daemon then uses its own persistent
 identity to reconnect.
 
-A provider adds machine lifecycle management. The included Incus provider
-offers operator-configured templates and controls VM creation and power. A
-Platform admin registers the provider and enables a binding for the universe;
-Operators and Admins can then create environments from its available templates.
+A provider adds machine lifecycle management. Lightspeed asks it to create a
+machine and, later, to close it; the provider runs everything in between,
+including power, idle policy, and wake-up. The included Incus provider offers
+operator-configured templates and runs VMs. A Platform admin registers the
+provider and enables a binding for the universe; Operators and Admins can
+then create environments from its available templates.
 
 ## Select an environment for a session
 
@@ -65,10 +67,12 @@ fills an empty selection when that profile is applied. Contributors can use
 existing environments in sessions they control; Operators and Admins manage
 the machines and profiles. See [People and roles](../access-and-security/people-and-roles.md).
 
-A profile attaches existing environments and, for sub-agents, can inherit the
-parent's active machine. For a provisioned environment, the runtime can wait
-for readiness before executing an environment-dependent tool call. The
-session does not need to guess how long provisioning takes.
+A profile attaches existing environments, can give every session a new
+machine of its own from a provider template, and, for sub-agents, can
+inherit the parent's active machine. For a provisioned environment, the
+runtime waits for readiness before executing an environment-dependent tool
+call. The session does not need to guess how long provisioning or a wake-up
+takes.
 
 **Environment selection tools** lets the agent switch among its attachments.
 The agent keeps the same tools across switches, but each call must be allowed
@@ -97,27 +101,28 @@ the work it is running.
 
 ## Power, disconnection, and cleanup
 
-Provisioned environments can expose power controls. The states available
-depend on the provider: Incus supports running, paused, and stopped states.
-An idle policy can lower power or close the environment after configured
-periods of inactivity. Tracked running processes and jobs prevent the idle
-reaper from treating the machine as idle. Processes left behind after a
-command finishes do not keep the environment awake. Later policy stages do
-not automatically escalate after the machine has paused or stopped; see
-[Power and cleanup](power-and-cleanup.md#understand-the-current-staging-limit).
-Using a supported paused or stopped environment requests a wake-up, and the
-runtime waits for it to become ready.
+The provider owns a provisioned environment's power. Its template lists the
+power states the machine supports (Incus offers running, paused, and
+stopped) and a default idle policy, which lowers power or closes the machine
+after periods of inactivity. A machine can be created with another policy.
+Running processes, running jobs, and services a command left running keep
+the machine awake. Using a paused or stopped environment wakes it, and the
+runtime waits for it to become ready. Power buttons pass a one-off change to
+the provider; see [Power and cleanup](power-and-cleanup.md).
 
 Registered and external machines remain under your control. Connecting a
 workstation does not give Lightspeed a way to power it on after shutdown.
-A persistent registered environment becomes offline while its daemon is away
-and reconnects under the same identity. Ephemeral registration closes the
-environment after its configured disconnect grace period.
-
-Closing or deleting a session leaves its environment available. Environments
-are created, credentialed, powered, and closed independently. Profiles attach
-existing environments or, for sub-agents, inherit a parent's selection; they
-do not provision machines or attach cleanup to a session's lifetime.
+A persistent registered environment stays open while its daemon is away, and
+the daemon reconnects under the same identity; a tool call waits up to two
+minutes for it. An ephemeral registered environment closes when its daemon
+stops, or after its key's disconnect grace period when the connection is
+lost.
+
+Environments you create, register, or attach directly have their own
+lifetime: they are credentialed, powered, and closed independently, and
+closing or deleting a session leaves them available. A profile's **New per
+session** attachment is the exception. It creates a machine for each session
+and closes it when that session closes.
 
 Closing a registered or external environment removes its availability in
 Lightspeed; it does not delete or shut down your computer. Closing a provisioned
@@ -146,7 +151,9 @@ the injected credentials, so their permissions remain part of the environment's
 trust boundary.
 
 Start with [Bring your own compute](bring-your-own-compute.md) to connect a
-machine or [Incus VMs](incus-vms.md) to configure operator-managed provisioning.
+machine, [Run registered daemons](registered-daemons.md) to run a fleet of
+them as services, or [Incus VMs](incus-vms.md) to configure operator-managed
+provisioning.
 Then continue through the task guides:
 
 - [Using environments](using-environments.md): create machines and select them
@@ -158,7 +165,8 @@ Then continue through the task guides:
 - [Environment credentials](credentials.md): assign secrets to commands and
   understand their resolution and lifetime.
 - [Power and cleanup](power-and-cleanup.md): pause, wake, retain, and close
-  environments according to their source and ownership.
+  environments according to their source and ownership, and read their
+  state and status.
 - [Networking and ingress](networking-and-ingress.md): connect daemons and
   publish applications through the supported provider edge.
 
diff --git a/docs/documentation/environments/power-and-cleanup.md b/docs/documentation/environments/power-and-cleanup.md
index 214e05f3a..c22bccdbd 100644
--- a/docs/documentation/environments/power-and-cleanup.md
+++ b/docs/documentation/environments/power-and-cleanup.md
@@ -3,163 +3,173 @@
 A session's lifetime and a machine's lifetime are separate. You can leave a
 session available while its provisioned VM is paused, share a running machine
 between sessions, or close a disposable machine when its task ends. The
-environment's source and cleanup policy determine which operations are
-available and what they remove.
+environment's source determines which operations are available and what they
+remove.
 
 Use an Operator or Admin account, then inspect the machine under
-**Environments → Details**. Its **Source** determines whether Lightspeed manages
-the VM or only its connection. Check its power state and idle policy before
-changing a machine that other sessions may also use.
+**Environments → Details**. Its **Source** determines whether a provider
+manages the machine or Lightspeed only holds its connection. Check what the
+provider reports and its idle policy before changing a machine that other
+sessions may also use.
+
+## Know who owns power
+
+A provider owns the power of the machines it creates. It applies its own
+idle policy, wakes a machine when work needs it, and may change power on its
+own schedule. Lightspeed asks for a change only when you press a power
+button or call the power API, and it never reverts a change the provider
+made. What Lightspeed shows is the provider's latest report, refreshed when
+you change power and otherwise about every five minutes.
+
+Registered and external environments are machines you manage. Lightspeed can
+close their records, but it cannot power them on or off or delete their
+files.
 
 ## Distinguish power from closure
 
 | Operation | Effect on an Incus VM | What the next use needs |
 | --- | --- | --- |
-| Pause | Freezes execution while retaining memory and disk. | Resume the existing machine. |
-| Stop | Powers off while retaining disk. Running processes end. | Boot the machine again. |
+| Pause | Freezes execution while retaining memory and disk. | Nothing: using it resumes the machine. |
+| Stop | Powers off while retaining disk. Running processes end. | Nothing: using it boots the machine again, which takes longer. |
 | Close | Releases the VM and its disk. The environment identity is terminal. | Create and select another environment. |
 
-The included Incus provider supports running, paused, and stopped power states.
-The protocol also supports suspended state for providers that save execution
-state to disk, but Incus does not currently offer that state through Lightspeed.
-The UI displays controls according to the provider's advertised capabilities.
-
-Registered and external environments are machines you manage. Lightspeed can
-close their logical records, but it cannot power them down or delete their
-files through provider lifecycle controls.
+The included Incus provider supports running, paused, and stopped power
+states. The protocol also supports a suspended state for providers that save
+execution state to disk, but Incus does not offer it. The UI shows the
+power buttons the environment's template lists.
 
 ## Pause, resume, and stop a provisioned environment
 
-For a disposable test VM from [Incus VMs](incus-vms.md), save any needed output,
-then expand its **Details** and choose **Pause**. Wait for the observed status
-to become paused. **Resume** requests running again.
+For a disposable test VM from [Incus VMs](incus-vms.md), save any needed
+output, then expand its **Details** and choose **Pause**. Lightspeed asks the
+provider at once and shows the state it reports. **Resume** asks for
+running again.
 
-You can also leave it paused and ask a session using it to run `pwd`. Using
-a sleeping provisioned environment with power support requests a wake-up;
-selecting it leaves its power state unchanged. The tool waits for readiness
-before executing. Ordinary model conversation and VFS work do not need that
-machine to wake.
+You can also leave it paused and ask a session using it to run `pwd`. The
+tool's connection to the machine wakes it, and the tool waits until it is
+ready. Selecting the environment leaves its power unchanged, and ordinary
+model conversation and VFS work do not need the machine to wake.
 
 **Stop** retains the disk but ends execution. On the next use, the VM boots
-again and starts its daemon. Job records can survive on the disk, but unfinished
-daemon jobs become interrupted; stopping a VM does not preserve an ordinary
-process for later continuation.
+again and starts its daemon. Job records can survive on the disk, but
+unfinished daemon jobs become interrupted; stopping a VM does not preserve
+an ordinary process for later continuation.
 
-Manual power controls do not check the idle reaper's “no running work” condition.
-Pausing can freeze active work, and stopping can terminate it. Inspect running
-tasks before choosing the action.
+Manual power controls do not check for running work. Pausing can freeze
+active work, and stopping can terminate it. Inspect running tasks before
+choosing the action. The provider stays in charge afterwards: its idle
+policy can pause or stop the machine again later, and the next use wakes a
+machine you stopped by hand.
 
 With the [CLI connection settings](../using-lightspeed/sessions-and-runs.md#continue-from-the-cli)
-configured, the same power requests are:
+configured, the same requests are:
 
 ```bash
 target/debug/lightspeed environment power "<environment-id>" paused
-target/debug/lightspeed environment read "<environment-id>"
 target/debug/lightspeed environment power "<environment-id>" running
 ```
 
-Use `stopped` instead of `paused` to request a stop. Each request records desired
-power; it does not wait for every provider action to finish. Read the environment
-again to observe convergence.
+Use `stopped` instead of `paused` to request a stop. Each request waits for
+the provider's answer and prints the environment with the state the provider
+reported, which can still be a transition. A request fails when the provider
+cannot be reached or does not offer that state; nothing is queued for later.
+
+## Interpret state and status
 
-## Interpret readiness and status
+Every environment has a lifecycle **state**:
 
-Desired power is Lightspeed's request. The status is its current observation
-of the environment. During a transition, they can differ.
+| State | Meaning |
+| --- | --- |
+| Provisioning | A provider is creating the machine, and Lightspeed has not yet completed its first connection to the daemon. Registered and external environments skip this state. |
+| Open | The environment can be used. |
+| Closing | A provisioned machine is being released. |
+| Closed | The environment can no longer be used. Its close reason says why. |
+| Failed | A provisioned machine could not be created or broke. Its state message says why. |
+
+The **status** badge combines the state with what is known about the
+machine:
 
 | Status | Meaning for the next operation |
 | --- | --- |
-| Provisioning or booting | The machine or daemon is still becoming available. Session environment tools can wait for readiness. |
-| Ready | The environment is available, subject to its advertised capabilities and current connectivity. |
-| Paused or suspended | A supported provisioned environment needs to resume before use. |
-| Offline | A provisioned machine may be stopped; a borrowed machine may have lost its daemon connection. The source determines whether Lightspeed can wake it. |
-| Closing | Cleanup is in progress. Do not submit new work. |
-| Closed | This environment can no longer be used. |
-| Failed or unknown | Inspect the environment's lifecycle error and provider or gateway diagnostics instead of assuming readiness. |
-
-Provider trouble does not fail an environment at once. While a provider is
-unreachable or answers with a temporary error, the environment keeps its
-status and records the latest problem as its lifecycle error, shown in its
-details. An environment that is still provisioning, booting, or unknown
-fails with that error once the problem has lasted 30 minutes. An environment also fails when its machine disappears outside
-Lightspeed, or when its daemon speaks a different environment protocol
-version than the runtime; the error names both versions.
+| Provisioning | The machine is still being created. Session tools wait for it. |
+| Ready | The environment is open and, as far as Lightspeed knows, running or connected. |
+| Paused, suspended, or stopped | The provider reported a powered-down machine. The next tool call wakes it and waits. |
+| Disconnected | A registered daemon is not connected. A tool waits up to two minutes for a persistent daemon to return; an ephemeral one is not waited for. |
+| Unknown | The provider could not tell, or reported something unexpected. Inspect the provider. |
+| Closing or closed | Cleanup is in progress or finished. Do not submit new work. |
+| Failed | Inspect the state message and the provider or gateway diagnostics. |
+
+The details show the state message while an environment is provisioning,
+closing, or failed, and the close reason once it is closed. Provider trouble
+does not fail an environment at once. While a provider is unreachable or
+answers with a temporary error, Lightspeed retries, with growing pauses of up
+to five minutes, and shows the latest problem. An environment that has not
+opened within 30 minutes of its creation fails with that problem. An
+environment also fails when the provider reports its machine broken, or when
+its daemon speaks a different environment protocol version than the runtime;
+the message names both versions. A machine the provider removed on its own,
+for example after its idle close threshold, closes the environment with the
+reason **Ended by the provider**.
 
 A session can retain the ID of an environment that has closed or become
 unavailable. The runtime reports that failure; it does not silently select a
 replacement. Update the session or profile explicitly when choosing another
 machine.
 
-Standalone API calls can encounter a not-ready response during wake-up. Follow
-the retry rules for the operation rather than blindly resubmitting new work;
+Standalone API calls can receive `environment_not_ready` while a machine
+provisions, wakes, or reconnects. Follow the retry rules for the operation
+rather than blindly resubmitting new work;
 [Processes and jobs](processes-and-jobs.md#start-jobs-through-the-api) covers job
 creation identities.
 
 ## Set an idle policy
 
-Open a provisioned environment's **Details → Idle policy…**. The fields
-**Pause after**, **Suspend after**, **Stop after**, and **Close after** use
-minutes. A blank field omits that stage. There are no automatic default
-thresholds: an environment without an idle policy remains available until
-another lifecycle action changes it.
+The provider runs idle policy. A policy names how long a machine may stay
+idle before the provider pauses, suspends, stops, or closes it. Each stage
+is optional, and the thresholds must not decrease in that order. The
+template names a default, shown in **New environment** when you choose the
+template and in the environment's **Details**. An operator sets those
+defaults in the provider's configuration; see
+[Incus VMs](incus-vms.md#configure-and-start-the-provider).
 
-For a development VM you want to keep but avoid leaving active, set only
-**Pause after** to `10` and leave the other fields empty. Save the policy.
-The CLI equivalent is:
+A machine keeps the policy it was created with. To create one with another
+policy, pass `idle` to `environments/create`:
 
-```bash
-target/debug/lightspeed environment idle-policy "<environment-id>" --pause-after-min 10
+```json
+{"requestId": "acorn-build-1", "providerId": "incus-local", "templateId": "dev-small-v1", "idle": {"pauseAfterMs": 600000, "stopAfterMs": 14400000}}
 ```
 
-The command replaces the entire policy. To remove automatic idle action:
-
-```bash
-target/debug/lightspeed environment idle-policy "<environment-id>" --clear
-```
+There is no way to change the policy of an existing machine. Create a
+replacement, or use the power buttons for a one-off change.
 
 Idle time comes from daemon activity, not time since the last chat message.
-Filesystem, process, and job operations affect that activity clock. Running
-processes and jobs prevent automatic idle action. Initialization, idle
-polling, and the prompt and skill discovery that runs before each agent run do
-not keep the machine busy by themselves, so a chat-only session does not hold
-an idle machine awake.
-
-The runtime checks periodically, so a threshold is not an exact wall-clock
-deadline. To verify the policy, leave the VM without tracked work and without
-calls that keep it active, then observe its status. Another session using the
-same environment can keep it busy or wake it again.
-
-## Understand the current staging limit
-
-Thresholds must be non-decreasing in the order pause, suspend, stop, close.
-At a poll, the reaper chooses the most escalated supported stage already due.
-It only evaluates environments that are ready and still have desired power
-set to running.
-
-Once a policy pauses or stops the machine, later stages do not continue
-escalating automatically while it remains powered down. A policy with pause
-after 10 minutes and stop after 60 therefore does not promise a stop 50
-minutes after pausing. Use one automatic stage when that is the behavior you
-need, or manage the later lifecycle action explicitly.
-
-Idle detection also has a process boundary. A long-lived root process or job
-counts as running work. A command that exits after leaving a child service
-behind no longer keeps the daemon busy on that child's behalf. The machine
-can then be paused or closed by its idle policy while that service is useful.
-
-Public HTTP traffic to an application does not pass through daemon activity
-accounting and does not wake a sleeping VM. Choose a power policy compatible
-with the application's availability needs; see
+Filesystem, process, and job operations reset it. Running processes, running
+jobs, and services a command started and left running keep the machine
+awake. Initialization, idle polling, and the prompt and skill discovery that
+runs before each agent run do not count as use, so a chat-only session does
+not hold an idle machine awake. A provider also never powers a machine down
+while a connection to its daemon is open.
+
+The provider checks periodically, so a threshold is not an exact wall-clock
+deadline. The included Incus provider checks every minute by default and
+keeps escalating after a pause: a policy that pauses after 10 minutes and
+stops after 60 stops the machine about 50 minutes after pausing it. To
+verify a policy, leave the VM without running work and without calls that
+keep it active, then watch its status. Another session using the same
+environment can keep it busy or wake it again.
+
+Public HTTP traffic to an application does not count as daemon activity and
+does not wake a sleeping VM. Choose a power policy compatible with the
+application's availability needs; see
 [Networking and ingress](networking-and-ingress.md).
 
 ## Choose who owns cleanup
 
-Every environment has a lifetime managed independently of sessions. Create
-machines through **New environment**, configure their credentials and idle
-policy on the Environments page, and close them explicitly when finished.
-Closing or deleting a session or bot never closes its selected environment.
-Profiles only attach existing environments or, for sub-agents, inherit a
-parent's selection.
+An environment you create under **Environments → New environment** has its
+own lifetime. Configure its credentials on the Environments page and close it
+explicitly when finished. Closing or deleting a session or bot that attached
+it leaves it open. Profiles only attach existing environments or, for
+sub-agents, inherit a parent's selection.
 
 Session-owned job promises are canceled when the session closes. Standalone
 API jobs have no session promise, and ordinary remote processes may outlive
@@ -167,14 +177,18 @@ agent cancellation. Those lifetimes are explained in
 [Processes and jobs](processes-and-jobs.md); a session close alone is not a
 universal operating-system cleanup command.
 
+Closed provisioned environments disappear from Lightspeed seven days after
+they close. Closed registered and external environments stay listed under
+**Show closed environments**.
+
 ## Close a machine deliberately
 
 Before closing a provisioned environment, save required output to durable
 storage outside it, such as a VFS workspace. Inspect other sessions and bots
 that name it, and choose replacements where they still need compute.
 
-On a provisioned environment, use **Close environment** in its details.
-The CLI works for all source types:
+Use **Close environment** in its details, for any source. The CLI equivalent
+is:
 
 ```bash
 target/debug/lightspeed environment close "<environment-id>"
@@ -186,16 +200,16 @@ holds, public ingress included. For Incus, that is a guest shutdown of up to
 30 seconds, then a forced stop, then deletion of the VM and disk. The
 operation is asynchronous. Lightspeed closes by the environment's identity,
 so a machine whose creation failed midway is still found and removed. A
-provider error can leave it closing while reconciliation retries, so inspect
-the final status and provider diagnostics when cleanup does not finish.
+provider error leaves it closing while Lightspeed retries, so inspect the
+final state and provider diagnostics when cleanup does not finish.
 
-For an individual registered or external environment, use the CLI or
-`environments/close` API. Closing their records removes access
-through Lightspeed while leaving the computer and files under your control.
-An outbound registered daemon is told its environment closed and exits with
-status 4; an external passive daemon is not terminated by the logical
-close. Neither path is a comprehensive cleanup of programs started
-on the machine. Inspect and manage those processes and files explicitly.
+Closing a registered or external environment takes effect at once and
+removes access through Lightspeed while leaving the computer and files under
+your control. A connected registered daemon is told its environment closed;
+it exits with status 4, or parks until it is stopped when it runs with
+`--on-closed=park`. An external passive daemon is not terminated by the
+close. Neither path is a comprehensive cleanup of programs started on the
+machine. Inspect and manage those processes and files explicitly.
 
 Environment closure does not delete the independent VFS workspace or revoke
 the universe credentials assigned to the machine. It also does not retain
@@ -203,32 +217,39 @@ machine files just because a session's transcript still describes them.
 
 ## Handle borrowed-machine disconnects
 
-A persistent registered environment remains offline while its daemon is away.
-Restart it with the same retained state directory to reconnect under the same
-identity. Lightspeed cannot switch on that machine for you.
-
-An ephemeral registered environment closes after its configured disconnect
-grace period, which defaults to five minutes. Once closed, its daemon identity
-is spent. A replacement needs a fresh state directory and a valid registration
-key. The grace period concerns disconnection, not inactivity while connected.
+A persistent registered environment stays open while its daemon is away.
+Restart the daemon with the same retained state directory to reconnect under
+the same identity. A tool call that arrives meanwhile waits up to two minutes
+for the daemon to return, which covers an ordinary restart or rollout, then
+fails. Lightspeed cannot switch on that machine for you.
+
+The registration key decides how long an absent daemon's environment
+survives. An ephemeral key closes an environment as soon as its daemon stops
+deliberately, and after its disconnect grace period, five minutes by default,
+when the connection is simply lost. Tools do not wait for an ephemeral
+daemon. A persistent key can set **Close when offline for**, which closes an
+environment whose daemon stays away that long; without it, the environment
+stays open until someone closes it. Once closed, a daemon identity is spent. A replacement
+needs a fresh state directory and a valid registration key.
 
 Revoking a registration key blocks new admissions. Existing identities can
 continue reconnecting unless their environments are also closed. The key
 revoke operation can optionally close those environments; that still leaves
 the borrowed computers under your control. The full connection procedure is
-in [Bring your own compute](bring-your-own-compute.md).
+in [Bring your own compute](bring-your-own-compute.md), and service
+deployments are in [Run registered daemons](registered-daemons.md).
 
 ## If cleanup or wake-up is unexpected
 
 | Symptom | What to check |
 | --- | --- |
-| The VM never pauses | Check the idle policy, tracked running work, and calls from other sessions. |
-| A paused VM never reaches its later stop threshold | Later stages do not escalate while powered down. Choose a single stage or perform the later action explicitly. |
-| An application goes offline despite receiving traffic | App traffic does not reset daemon idle time or wake the VM. Review its power policy. |
-| An environment disappears while a session uses it | Inspect its idle close policy, explicit close requests, and provider lifecycle. Session closure never closes the environment. |
-| A borrowed machine cannot resume through Lightspeed | Restart its daemon or machine directly; it has no provider power control. |
-| A provisioned environment remains closing | Inspect provider reachability and deletion errors. A recorded close request does not prove the VM was removed. |
+| The VM never pauses | Check the idle policy in its details, running processes and jobs, services a command left running, and calls from other sessions. |
+| An application goes offline despite receiving traffic | App traffic does not reset daemon idle time or wake the VM. Review the template's idle policy. |
+| A VM paused by hand is running again | A tool call or another session used it, and the provider woke it. |
+| An environment disappears while a session uses it | Inspect its close reason: an idle close by the provider, an explicit close, its session closing, or the registration key's policy. |
+| A borrowed machine cannot resume through Lightspeed | Restart its daemon or machine directly; Lightspeed has no power control over it. |
+| A provisioned environment remains closing | Inspect provider reachability and deletion errors in its state message. A recorded close request does not prove the VM was removed. |
 
 The [API reference](../../../crates/api/contract/api-reference.md) defines
-`environments/power/put`, `environments/idle-policy/put`, and the environment
-read/close operations.
+`environments/power/put`, `environments/create`, and the environment
+read and close operations.
diff --git a/docs/documentation/environments/processes-and-jobs.md b/docs/documentation/environments/processes-and-jobs.md
index a123fde77..f994fa93f 100644
--- a/docs/documentation/environments/processes-and-jobs.md
+++ b/docs/documentation/environments/processes-and-jobs.md
@@ -296,8 +296,9 @@ first receives a termination signal and is killed after a grace period unless
 `force` is set; it reports `cancelRequestedAtMs` and stays `running` until it
 ends, so continue reading until terminal.
 
-A standalone call can return `environment_not_ready` during provisioning or
-wake-up. Wait and retry with the same creation identity. Exact types and
+A standalone call can return `environment_not_ready` during provisioning,
+while a powered-down machine wakes, or while a registered daemon
+reconnects. Wait and retry with the same creation identity. Exact types and
 methods are in the [API reference](../../../crates/api/contract/api-reference.md).
 
 ## If execution does not finish as expected
diff --git a/docs/documentation/environments/registered-daemons.md b/docs/documentation/environments/registered-daemons.md
new file mode 100644
index 000000000..f395246f2
--- /dev/null
+++ b/docs/documentation/environments/registered-daemons.md
@@ -0,0 +1,379 @@
+# Run registered daemons
+
+[Bring your own compute](bring-your-own-compute.md) connects one machine by
+hand. This guide runs `lightspeed-envd` as a service: as Kubernetes pods
+whose identity survives restarts, as interchangeable pods that come and go,
+or as a systemd unit on virtual machines. Each section ends in a reference
+manifest to adapt.
+
+Every daemon here dials the environment gateway outward with a registration
+key, as in the walkthrough. Lightspeed runs no provider, template, or power
+logic for these machines: your scheduler or hypervisor starts and stops
+them, and Lightspeed records whether each daemon is connected.
+
+## Decide how long an identity lives
+
+A daemon's identity is the key file `daemon-key` in its state directory. The
+environment lives exactly as long as that identity, so put the state
+directory on storage with the lifetime you want:
+
+| Deployment | Key identity mode | State directory | Daemon on close |
+| --- | --- | --- | --- |
+| StatefulSet, one environment per pod ordinal | Persistent | A PersistentVolumeClaim per pod | `--on-closed=park` |
+| Deployment, interchangeable pods | Ephemeral | An `emptyDir` that ends with the pod | `--on-closed=park` |
+| systemd on a VM | Persistent | `/var/lib/lightspeed-envd` on the VM's disk | Exit, and do not restart |
+
+Three rules apply to all of them:
+
+- Never copy a state directory to another pod or machine, bake it into an
+  image, or restore it from a snapshot onto a second machine. Two daemons
+  with one identity supersede each other, and the older one exits with
+  status 5.
+- Run one daemon per state directory.
+- Keep the state directory outside the agent's working directory. Commands
+  running as the daemon's user can still read it, so grant **Run commands**
+  only where that is acceptable.
+
+## Prepare the key and the gateway URL
+
+Mint one registration key per group of daemons. For a StatefulSet of three
+pods:
+
+```bash
+lightspeed environment registration-key create \
+  --name "CI runners" --mode persistent --max-active 5
+```
+
+Set `--max-active` to the replica count plus room for a rollout, so a
+leaked key cannot add more machines than you expect. For a persistent key,
+`--offline-close-after-min` closes environments whose daemon stays away
+that long, which suits a fleet whose volumes you delete when scaling down.
+Store the secret printed once in a Kubernetes Secret, or in a file readable
+only by the daemon's user on a VM:
+
+```bash
+kubectl -n lightspeed-runners create secret generic lightspeed-envd-key \
+  --from-file=registration-key=./registration-key
+```
+
+The daemon sends the key only until its first admission, so leaving the
+Secret mounted is harmless. Rotate the key with
+`lightspeed environment registration-key rotate KEY_ID` when the secret
+leaks; admitted daemons keep reconnecting with their identities.
+
+Daemons dial `wss://<public host>/environment-gateway/connect`, the route the
+public edge publishes; see
+[Self-hosting](../deployment/self-hosting.md#configure-the-public-edge).
+Inside the same Kubernetes cluster as the runtime, they can instead dial the
+environment gateway's Service directly:
+
+1. On the process running the `environment-gateway` role, add the in-cluster
+   URL to `LIGHTSPEED_ENVIRONMENT_REGISTRATION_URLS`, for example
+   `ws://lightspeed-environment-gateway.lightspeed.svc.cluster.local:18080/environment-gateway/connect`.
+   Daemons sign the origin they dial, and the gateway accepts only the
+   origins it is configured with.
+2. Set `LIGHTSPEED_ENVD_ALLOW_INSECURE_GATEWAY=true` on the daemons when the
+   URL is plain `ws://`. The registration key and every data stream then
+   cross the cluster network in the clear, so restrict that path with a
+   network policy.
+
+The Service must route to the single environment-gateway process, and both
+`/environment-gateway/connect` and `/environment-gateway/data` must reach it.
+
+## Provide the daemon binary
+
+Each release publishes `lightspeed-envd` as a static x86_64 Linux binary
+that runs on any distribution's image. Install it in the image or VM that also carries the
+tools your agents need, including Bash for the shell tools.
+
+Automatic upgrade is off unless you set `LIGHTSPEED_ENVD_AUTO_UPGRADE`. Keep
+it off in containers: it replaces the executable in place, which a
+read-only root filesystem forbids and a new pod would undo. Upgrade by
+rolling out an image with the new daemon instead. When the workload image
+should not contain the daemon, or its root filesystem is read-only, copy the
+binary from an init container into an `emptyDir`, as the Deployment example
+below does.
+
+## Run a StatefulSet with persistent identities
+
+Each pod keeps its identity on its own volume. A rolling restart, a node
+drain, or a crash brings the pod back with the same volume, so it reconnects
+as the same environment. While a pod is away its environment stays open and
+shows as disconnected, and a tool call waits up to two minutes for it to
+return.
+
+```yaml
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: lightspeed-runner
+  namespace: lightspeed-runners
+spec:
+  serviceName: lightspeed-runner
+  replicas: 3
+  podManagementPolicy: Parallel
+  selector:
+    matchLabels:
+      app: lightspeed-runner
+  template:
+    metadata:
+      labels:
+        app: lightspeed-runner
+    spec:
+      terminationGracePeriodSeconds: 30
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10001
+        runAsGroup: 10001
+        fsGroup: 10001
+      containers:
+        - name: envd
+          # Your tools plus lightspeed-envd at /usr/local/bin.
+          image: registry.example.com/lightspeed-runner:2026.10.1
+          command:
+            - /bin/sh
+            - -c
+            - mkdir -p /data/workspace && exec /usr/local/bin/lightspeed-envd
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: LIGHTSPEED_ENVD_GATEWAY_URL
+              value: wss://lightspeed.example.com/environment-gateway/connect
+            - name: LIGHTSPEED_ENVD_REGISTRATION_KEY_FILE
+              value: /etc/lightspeed-envd/registration-key
+            - name: LIGHTSPEED_ENVD_REGISTRATION_NAME
+              value: $(POD_NAME)
+            - name: LIGHTSPEED_ENVD_REGISTRATION_METADATA
+              value: '{"k8s.pod":"$(POD_NAME)"}'
+            # The daemon key lives here: on the pod's own volume.
+            - name: LIGHTSPEED_ENVD_STATE_DIR
+              value: /data/state
+            - name: LIGHTSPEED_ENVD_CWD
+              value: /data/workspace
+            - name: LIGHTSPEED_ENVD_ON_CLOSED
+              value: park
+          securityContext:
+            allowPrivilegeEscalation: false
+          volumeMounts:
+            - name: data
+              mountPath: /data
+            - name: registration-key
+              mountPath: /etc/lightspeed-envd
+              readOnly: true
+      volumes:
+        - name: registration-key
+          secret:
+            secretName: lightspeed-envd-key
+            defaultMode: 0440
+  volumeClaimTemplates:
+    - metadata:
+        name: data
+      spec:
+        accessModes: ["ReadWriteOnce"]
+        resources:
+          requests:
+            storage: 20Gi
+```
+
+Each pod registers under its pod name and records it as metadata, so you can
+find the environment ID for a profile:
+
+```bash
+lightspeed environment list --registration-key KEY_ID --metadata k8s.pod=lightspeed-runner-0
+```
+
+Attach those IDs in profiles explicitly. The ID stays the same for as long as
+the pod's volume exists.
+
+Scaling down leaves the volumes, and with them the open, disconnected
+environments; scaling up again brings them back. When you delete a volume,
+its identity is gone for good: close the environment, or let the key's
+**Close when offline for** setting close it. If an environment is closed
+while its pod runs, `--on-closed=park` keeps the pod running idle instead of
+letting Kubernetes restart a spent identity forever. Delete the pod and its
+volume to replace it.
+
+## Run a Deployment with ephemeral identities
+
+For interchangeable workers, give each pod a fresh identity in an `emptyDir`
+and use an ephemeral key. A pod that stops deliberately closes its
+environment at once; one that disappears without saying goodbye is closed
+after the key's disconnect grace period. Each new pod is a new environment
+with a new ID, so find these environments by key or metadata rather than
+naming them in profiles.
+
+This example also keeps the workload's root filesystem read-only and copies
+the daemon from an init container:
+
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: lightspeed-sandbox
+  namespace: lightspeed-runners
+spec:
+  replicas: 4
+  selector:
+    matchLabels:
+      app: lightspeed-sandbox
+  template:
+    metadata:
+      labels:
+        app: lightspeed-sandbox
+    spec:
+      terminationGracePeriodSeconds: 30
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10001
+        runAsGroup: 10001
+        fsGroup: 10001
+      initContainers:
+        - name: install-envd
+          # A small image holding /lightspeed-envd and a cp binary.
+          image: registry.example.com/lightspeed-envd:2026.10.1
+          command: ["cp", "/lightspeed-envd", "/opt/lightspeed/bin/lightspeed-envd"]
+          volumeMounts:
+            - name: envd-bin
+              mountPath: /opt/lightspeed/bin
+      containers:
+        - name: workload
+          image: registry.example.com/sandbox-tools:2026.10.1
+          command: ["/opt/lightspeed/bin/lightspeed-envd"]
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: LIGHTSPEED_ENVD_GATEWAY_URL
+              value: wss://lightspeed.example.com/environment-gateway/connect
+            - name: LIGHTSPEED_ENVD_REGISTRATION_KEY_FILE
+              value: /etc/lightspeed-envd/registration-key
+            - name: LIGHTSPEED_ENVD_REGISTRATION_NAME
+              value: $(POD_NAME)
+            # The identity ends with the pod.
+            - name: LIGHTSPEED_ENVD_STATE_DIR
+              value: /var/lib/lightspeed-envd
+            - name: LIGHTSPEED_ENVD_CWD
+              value: /workspace
+            - name: LIGHTSPEED_ENVD_ON_CLOSED
+              value: park
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+          volumeMounts:
+            - name: envd-bin
+              mountPath: /opt/lightspeed/bin
+              readOnly: true
+            - name: state
+              mountPath: /var/lib/lightspeed-envd
+            - name: workspace
+              mountPath: /workspace
+            - name: tmp
+              mountPath: /tmp
+            - name: registration-key
+              mountPath: /etc/lightspeed-envd
+              readOnly: true
+      volumes:
+        - name: envd-bin
+          emptyDir: {}
+        - name: state
+          emptyDir: {}
+        - name: workspace
+          emptyDir: {}
+        - name: tmp
+          emptyDir: {}
+        - name: registration-key
+          secret:
+            secretName: lightspeed-envd-sandbox-key
+            defaultMode: 0440
+```
+
+Mint its key with `--mode ephemeral` and a `--max-active` that covers the
+replicas plus the rollout surge. An `emptyDir` survives a container restart
+inside the same pod, so a crashed daemon comes back as the same environment
+if it returns within the grace period. Once that environment is closed, the
+pod parks; delete it and the Deployment starts a replacement with a new
+identity.
+
+## Run a systemd unit on a VM
+
+On an enterprise VM, run the daemon as a dedicated user with outbound
+connections only. The VM keeps its identity on its own disk, so a reboot
+reconnects as the same environment. A VM someone powers off simply
+disconnects: tool calls wait up to two minutes, then fail until it returns.
+Lightspeed never tries to start it.
+
+Install the binary at `/usr/local/bin/lightspeed-envd`, create the
+`lightspeed-envd` user and the working directory, and put the key in
+`/etc/lightspeed-envd/registration-key`, owned by that user with mode
+`0600`. Then create `/etc/lightspeed-envd/envd.env`:
+
+```bash
+LIGHTSPEED_ENVD_GATEWAY_URL=wss://lightspeed.example.com/environment-gateway/connect
+LIGHTSPEED_ENVD_REGISTRATION_KEY_FILE=/etc/lightspeed-envd/registration-key
+LIGHTSPEED_ENVD_STATE_DIR=/var/lib/lightspeed-envd
+LIGHTSPEED_ENVD_CWD=/srv/lightspeed/workspace
+```
+
+and `/etc/systemd/system/lightspeed-envd.service`:
+
+```ini
+[Unit]
+Description=Lightspeed environment daemon
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=lightspeed-envd
+Group=lightspeed-envd
+EnvironmentFile=/etc/lightspeed-envd/envd.env
+Environment=LIGHTSPEED_ENVD_REGISTRATION_NAME=%H
+ExecStart=/usr/local/bin/lightspeed-envd
+Restart=always
+RestartSec=5
+# 3: registration refused for good; 4: environment closed, identity spent;
+# 5: another daemon with the same identity took over. Restarting cannot help.
+RestartPreventExitStatus=3 4 5
+StateDirectory=lightspeed-envd
+StateDirectoryMode=0700
+WorkingDirectory=/srv/lightspeed/workspace
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ReadWritePaths=/srv/lightspeed/workspace
+
+[Install]
+WantedBy=multi-user.target
+```
+
+Enable it with `systemctl enable --now lightspeed-envd`. The VM registers
+under its host name. `systemctl stop` tells the gateway the daemon is
+stopping and exits with status 0. `RestartPreventExitStatus` leaves the unit
+failed instead of restarting it when the environment was closed or the key
+refused it; `journalctl -u lightspeed-envd` names the reason. A replacement
+needs a fresh state directory.
+
+`ProtectSystem=strict` keeps the executable read-only, so upgrade the binary
+with your package or configuration management. To let the daemon upgrade
+itself when the gateway moves to a new protocol version, install it in a
+directory listed in `ReadWritePaths` and set
+`LIGHTSPEED_ENVD_AUTO_UPGRADE=true`.
+
+## If a fleet misbehaves
+
+| Symptom | What to check |
+| --- | --- |
+| A pod restarts in a loop with status 3 | The key is invalid, revoked, or expired, or the gateway speaks another protocol version. The log names the reason. |
+| New pods never register, and their logs report the key's capacity | The key is at its active environment limit. The daemon keeps retrying; raise the limit with **Edit** or close environments it admitted. |
+| A pod logs that its environment is closed and stays idle | The environment was closed and the pod parked. Delete the pod, and for a StatefulSet its volume. |
+| Two pods take turns connecting, one exits with status 5 | Both use one state directory. Give every pod its own volume. |
+| Registration is refused because the signature does not verify | The URL the daemon dials is not the public base URL or one of `LIGHTSPEED_ENVIRONMENT_REGISTRATION_URLS`. |
+| The daemon refuses a `ws://` gateway URL | Set `LIGHTSPEED_ENVD_ALLOW_INSECURE_GATEWAY=true`, or use `wss://`. |
+| Pods connect but commands cannot route | `/environment-gateway/data` does not reach the same environment-gateway process as `/environment-gateway/connect`. |
+| Closed environments of an ephemeral fleet accumulate | Closed registered environments stay listed, because a spent identity can never return. Hide them with the default list, which omits closed environments. |
+
+The [environment-variable reference](../reference/environment-variables.md#environment-daemon)
+lists every daemon setting.
diff --git a/docs/documentation/environments/using-environments.md b/docs/documentation/environments/using-environments.md
index ed8a05709..5fa9c4287 100644
--- a/docs/documentation/environments/using-environments.md
+++ b/docs/documentation/environments/using-environments.md
@@ -5,10 +5,10 @@ The session selects one environment at a time, while the environment remains
 a resource in the universe. Several sessions can select the same machine;
 selection does not reserve it or create a private copy.
 
-You can select a starting, sleeping, or offline machine. The selection records
-where work should run; a tool call then waits for readiness and requests a
-wake-up where supported. Failed, closing, or closed environments cannot be
-selected.
+You can select a provisioning, sleeping, or disconnected machine. The
+selection records where work should run; a tool call then waits for
+readiness, and its connection wakes a sleeping provisioned machine. Failed,
+closing, or closed environments cannot be selected.
 
 This guide starts with a machine that already appears under **Environments**.
 Use [Bring your own compute](bring-your-own-compute.md) to connect one you
@@ -26,10 +26,11 @@ Open **Environments**, find the machine, and expand **Details**. Check its
 source, status, and **Environment ID**. A display name helps you find it;
 the ID is the stable value profiles and API calls reference.
 
-![CI runner environment with Details expanded, showing its ready status, environment ID, provisioned source, running power state, idle policy, and controls.](../images/environment-details.png)
+![CI runner environment with Details expanded, showing its ready status, environment ID, provisioned source, the provider's reported power state, the template's idle policy, and controls.](../images/environment-details.png)
 
 *The demo's CI runner is a provisioned machine. Its **Environment ID** is the
-value to select; its status and power state describe the machine's current state.*
+value to select; its status and the provider's report describe the machine's
+current state.*
 
 Open the session you want to use. With no active or queued runs, choose
 **Session settings**, enable **Environments**, add the machine under
@@ -159,26 +160,32 @@ the sessions. Use separate directories for independent tasks and separate
 environments when they need separate machine state or credential access.
 
 Prefer a persistent registered environment for a profile that names a
-borrowed machine. An ephemeral registration closes after its disconnect
-grace period; once closed, that identity cannot return and the profile's
-saved selection becomes unavailable.
+borrowed machine. An ephemeral registration closes when its daemon stops or
+stays away past its disconnect grace period; once closed, that identity
+cannot return and the profile's saved selection becomes unavailable.
 
 ## Create an independent machine
 
 Use **Environments → New environment**. Select a **Template**, enter a
-**Display name**, configure an idle policy if needed, and choose **Provision**.
-The button appears when the universe has a non-deprecated template from an
-enabled binding. Configure [credentials](credentials.md) on the environment,
-then select it in a session or profile.
-
-The environment can be selected while it is provisioning or booting. Tools
-wait for readiness before dispatching. If provisioning fails, inspect the
-provider and explicitly create or select a replacement. Session creation and
-profile application never allocate machines.
-
-Environments remain available when sessions close or are deleted. Manage
-cleanup through explicit environment operations and idle policies; see
-[Power and cleanup](power-and-cleanup.md).
+**Display name**, and choose **Provision**. The dialog shows the template's
+power states and the idle policy its provider applies. Turn on **Custom idle
+policy** to set this environment's own pause, stop or close thresholds instead;
+only the stages the template supports are offered, and the policy cannot be
+changed after the environment is created. The button appears
+when the universe has a non-deprecated template from an enabled binding.
+Configure [credentials](credentials.md) on the environment, then select it
+in a session or profile.
+
+The environment can be selected while it is provisioning. Tools wait for
+readiness before dispatching. If provisioning fails, the environment's
+details show why; inspect the provider and explicitly create or select a
+replacement.
+
+Environments created this way remain available when sessions close or are
+deleted. Close them explicitly, or let the template's idle policy close them;
+see [Power and cleanup](power-and-cleanup.md). Use **Rename…** in the
+details to change the display name or metadata of an environment of any
+source.
 
 ## Use environments with bots and sub-agents
 
@@ -212,8 +219,8 @@ Enable **Environment selection tools** (`"selection": true`) when the model
 should list, activate, and deactivate attached environments itself. Without
 that switch, you can still select a machine through the client or profile,
 and the model can still read its active environment with `environment_read`.
-The switch does not grant environment provisioning and does not widen the
-allowed set: `environment_list` lists the attachments, and `environment_read`
+The switch does not let the model provision environments and does not
+widen the allowed set: `environment_list` lists the attachments, and `environment_read`
 and `environment_activate` accept only attached ids. Their results carry the
 attachment's access line.
 
@@ -257,8 +264,8 @@ accepts only an environment attached in the session's configuration.
 | Symptom | What to check |
 | --- | --- |
 | **New environment** is missing | Check that you are an Operator or Admin, then check the universe binding and available, non-deprecated templates. Borrowed machines use registration or attachment instead. |
-| Selection succeeds but the first tool waits | A provisioned machine may still be booting or waking. Inspect its status and provider health. |
-| A registered machine is offline | Restart or reconnect its daemon using the retained identity. Lightspeed cannot power on that borrowed machine. |
+| Selection succeeds but the first tool waits | A provisioned machine may still be provisioning or waking. Inspect its status, state message, and provider health. |
+| A registered machine is disconnected | Restart or reconnect its daemon using the retained identity. Tools wait up to two minutes for a persistent daemon. Lightspeed cannot power on that borrowed machine. |
 | A visible environment is rejected by the session | Check that it is attached in the session's configuration, plus the machine's capabilities and lifecycle status. |
 | A file, process, or job call is refused on the active machine | The active attachment's access does not cover it. The toolset is the union of all attachments; raise that attachment's access or switch to one that covers the call. |
 | A saved profile points to a closed machine | Select a replacement explicitly. The runtime does not silently switch to another environment. |
diff --git a/docs/documentation/how-it-works/architecture.md b/docs/documentation/how-it-works/architecture.md
index e10d69b2d..272de707a 100644
--- a/docs/documentation/how-it-works/architecture.md
+++ b/docs/documentation/how-it-works/architecture.md
@@ -39,10 +39,13 @@ configuration and grants. Changes take effect at safe turn boundaries.
 
 Environments have independent lifecycles. A session's configuration lists
 which machines it may use and what it may do on each. Selecting a machine
-makes it active for subsequent tool calls. Use checks readiness and requests
-wake-up where the provider supports it; an offline registered machine must
-reconnect. Closing or deleting the session leaves the environment available
-for other work.
+makes it active for subsequent tool calls. Use checks readiness; the
+connection to a sleeping provisioned machine wakes it, and a disconnected
+registered machine must reconnect. Closing or deleting the session leaves
+the environment available for other work, unless a profile created that
+environment for the session alone. Lightspeed decides only when a
+provisioned machine is created and closed; its provider runs power and idle
+policy in between.
 
 The `harness` crate is the deterministic agent core. It represents a session
 as events reduced into state. Admission checks
@@ -201,7 +204,7 @@ separating them lets the deployment give different work different capacity.
 | `sessions` | Session, sub-agent, and environment-job workflows and their activities, plus session and blob maintenance. |
 | `bots` | Bot controllers, trigger workflows, and related activities. |
 | `channels` | Conversation workflows and core channel activities. |
-| `environment-gateway` | Live outbound daemon connections, worker routes, environment reconciliation, and power management. |
+| `environment-gateway` | Live outbound daemon connections, worker routes, and the reconciliation that creates and closes provisioned environments. |
 
 The session, bot, and channel roles poll their own task queues. Cross-subsystem
 work uses workflow starts and signals rather than relying on one role executing
diff --git a/docs/documentation/images/environment-details.png b/docs/documentation/images/environment-details.png
index f70879e542415c48fecd0b50b75180cc3e7e232a..e5363bab35f6ca7bdbfa0352b79e719549e8065a 100644
GIT binary patch
literal 65993
zcmc$`WmH^U*Ck3I1Pj4Ec!1!+B|w5(fZz@Rg1b8eFI<8LclY2D+}+*X-Jy4$=X?7{
z_xQT+k2~(IKN&exojPZqz1Es*&bcb^tF$OGB0eG%6cn<!n2;P46wDteC}<gYXmEsw
zg2o;S3KdFRh+n}e>0l97Lt%Cv?u2#`5#kH+&iL^oC@=5ZH%CXu>A8lflB4?SlEuYE
z!Wl1Ni0%)F7{XZSvE^3%`A}*Unw|ai^<!<N<IqA<-FC`0&-PGSMt(m1h5)RBqM~AS
z_OraAoDw$V@9Qa)nT2@_yv9$p{WnN?d26_WH*i1G($enl@8eL*ZH%jpy?fR-FhCUg
z`+63UkdTN<Dldo^P!is`Uu_Qv2?;r{-9r6r3SP#>!lI(vXpR_Y;Pn_x8pi(NgIGl0
z+1T^T5iu_E(~xLeGqa@6e@}F=oKu(^5Y5WmPyERv8jGf|pde5lk`fvks;8@qj`8y)
z8F*zpH%>%HhlIQ)Cnvw<xp;;f>5(OOk(QFe`sdok5MS7tsHw^FHf3eWs2Wh5dd|(w
z?d}?fqy+x`d&OrWZeCu(7nL^(=znhrT;6H3;Xmhn+u7Ac_CqQ5si^YZ4~CplVnRZC
z)V~)k%aD<g5rjoc3Gt*8&KE;_(k1-oFcInpT54)i1p3?bovJEUuYbP(%(qPSELTZE
zF?xI)@AE%5?f$CGpkr7<j6XN~^a=T&?;8F*6S4x{*X)c0_xD_*hVJ!#g5s)NEG+UQ
z|Ga~T)J){0=-s~;(9HCM^6ybOC>W!^|B}Ie`0oz<2>R-@H(_0<kUzHG9bT&4LV9n^
zL+}gH$?fhU;ontWr%i%#8P5qdpQ}=my{)Rgx$)(5ztgI<dNJ;Jw9u7VUT$n-Q}OS6
zeQ15vIjhZP7t#e?_4V}`8B2q47`r+<_jinr7aJNB^5vlax&9VOei$QO-X@2`IbGeg
z4si<$`}vw<m1?uPi3x@8nN%_<(erW*j>oT&Tsb_S8oR@ZmzrF2zxPHRFEzPe4am6J
zZ}wq1T@HWR)}5Q4{>XVV7)23GM&6#8xvbsf0vlOxhKz(g(CtmkC!{l5p<mq5X*y+h
zdeM0O<PJ8@%;mna)R!+`Ih{^O2Ewx$w0OdW!LEk=XRSK1F0jM8LJ3xxNJ(`b?~rxH
z!FD}fa;H_aX>=TBsmUG~9Asl<MV-K=mV5W^-Ag=EdV2a<LXw;uN~hmKf#~t<%*=Ai
z%E!wso^Ec?27gy}Z?f<e3K5w)jQ3?Y@h36~K9>tfQ<I(_;wJd7{|zS-6B@0ZmDT6h
zn&lZV27ev~6WQ9anOgo`QenhIF9%!OPCc=nkGE~(xiZhU+l^pVx0>kWI<h6z=jN0!
z`L;U(F(@PxE$6GHA}HhaH+6J$y1H`A=fvbz;PX#8?e`Rfh8eY+nc3(A<4{G&U*gzq
zL_|h<u{xLQzA`p8{^y}Yt|8)o?(Xbdmz9?n{JL<uPQ~YT6OqcrVLs<AiV|MvG%-0D
z6Qf;g#l*sLzBg$aFJhvqsyf@7kC-F%B_x&4{cIyJ+^JAxvEIJ(76ux+sj>0j2xL?o
zfx26$v-RE(We<soe)3cdctZ$}<XU69ebpEj8Xg|!83eDA^i@%@pV?4M44&v`RK-)6
z==bkgoTLr3f|{C|O3-39daASja`N*3o)Y@K5tRFSmsCf-*oDPxg(_WnRh1pcY9k}H
z4u>v$%IIjMfj;Hvf`WoyI5}sKwEL!~al(gFcq@MwLp)utkJ>HXe)7=xCv<3D!y>1#
zFf)5R-Qs+yG9JGh{6%7U+#OED`<a1@fx!cO%dLjEf`WpI3NGc*a?AGic428Lqg#Fq
ztulF<qm7Nr$;#8<uj%ekg86j8dmKisf76^_I;sbp%Vfdi`8FdYTxMi^{C8Q|=idIf
z(zk@Py`Hj+-NelikG}<O9<S>V5D?&#BYiy{ZmeUuK6wlbSdX8XqG~oeo#v)ezN4g!
zr8iY9*A@2N$`lF3K8ETw=lC~yltQu<>qZ=pecQekC{WYV_W$CrbU(G!P*IO_eR}Zw
ziaRhcFg8Bk-roMt-p&xv)iqIzf5G~13=%-^2-N!d{5{o9i_gDDBcXBs%|g^a{?`Ma
zh5xQshCp_DdVWa>Wp+tX5uF<$9^P(#em*s|lbDpWH2RLZ4wMv#Fa;y9V6Tyb3kwU8
zv{Nf8f^sOIjCHsvC^jGOdoC{Qyqfuz+W7yzk+bTz{g*ET%~BUhu<Sun`#U@E7ne*h
z|C|IK{0$iy+1E2HN)8PMrahcE_}#k>gbTL+`ukTJn!dZcPTylF2bhoKZr7}AY#@yN
zh%xxgd~R->{>iY-(UFm-%7}1_i~GbM9X4*yw@bBPHw>T1goE<(^Qqop+Sn;)iWF;m
z-2N60X1|#((~&3m6(o~-my`8wo81#Uzt9i~Uq8Ps_V%%C(~}%t7dy|}vrB*f&Zb5p
zgir8<nu`KGpZE9nuox|TJ%xikV#08yN;5NQ-Il=;oV;0KlH|IhnsEl%u(2RJJ9$%)
zjg2kZ)O6dbLGE&ofm|d6s~I{e6CXdywUU*Um1%@r%*0@QsR<7LZ-o;^E%P|MPr<sQ
zMzQZ@{NWb!$mMu6QLYz|0lq<@EP>6`f=JzXx<o!0yZBsXvf2G3FAoD`9RALaSb}r`
zhSz+~Omk7@g@u8E!T0YSU7@B+jn4F#QK##<ASu(UT?CxC=c$Y`(bIP>KPR}QmzPu5
z>r=@Pb$(JMb-`?TZa(Qk4v%BhCJ_KdHGx?_=|N7j{-Q{Ad~$l)bh9t}Y!l>0a6}~a
z%MGHza7wuR^FRWI`J7#zV!!=Be0r%?)6Pu!ezE#=%BO1_u+PN!A<DL{`4TaG1RNzT
zR;#+n+!jbU49%|BOZE1Jg98ImQBe-ZOO<xJ+VQy_k9R+*WIpRSIo))H{*n!AQ!G@P
zDB3+cT^H3}rdlhwI-J-0mbP4`gRyH;Xtq#maeIaZ0$|WQ4&({nwyj-f4o*&ZSzjN)
zO`Ud;8nfA}k@O}poHxXLT@zK`ZEVJN$GaJ|csL9Ogx>82VU257e82R9X>fOIbh#!{
zX?FAL=;+v=E(Mtax6ov%@e<qyC@$3Mb>-#O!znO*(dA!cWUen7n{2nI9uDMA*C<YK
z@$eYj1pRDLF6L`2l}ewGtXY=WzANTRC#$A=7oRXr=F4Bl($DKtcYH*}!3j1}X)d$S
zbmUoMMZZ^caS@h`rK9-d^Hcu!TMn=2vYec*ay>XdOR^6qibh871swivXv{cKGVI=O
zii(pWq4;<A_bo1$Cf7%V@E9`5+=N(IY~MaV8w@6rnX+3h5x;u%>i+7m`|DLS^-omx
z5F*~b!9gs94%_XakKEjlLYJEp(%52^(Kq8@Q@5MQr0_h#HYmJrY$DFi%2H8_?Y!9N
z9gh@mwAs{En7DsKSU)$*wb1NN&c#JRO?}$t$KvJnqRHh_unT{@wbe3_%~W4URwUv{
zH?X86<$?R7!-4<K?L>YiNW1x(4Hmym7*ZEQne~fuq?7$T<58Q_+itPKP>3^5`GUrC
zr3vrPhbeqsA*X)O!AvnRHrAW#D=;(I>c(MADb{R&CX6oEqdH!w+iiuBu}0glh^*<7
zw6M6u=dcL#7`VTV6b&be7$nI|Pv<fkfiIF0&xaps167`qk}}P0sZoErMAN~+fm*AP
zQ^_x7@bTWU)5gwjZz4Y&R=e4)+4;PlR8VA1PY}g;IOT9hII!?=G*c#qW@v8@pOm!q
z7ke=R5)wunxL0%saZynYZf=vo#7#(4d0}TZHoe;A$!ZhfNA~`!Ll9t6zpCHMwsG?C
ze4(?p&JT5@WW7jsa^Y|Hm#VSQWRxcVnLKY5-r!39-A_-K?;E}*TE{+Ts+{~d5$_pT
zTMR_eQ2cPWYCmD)q*91`jrsh_meO=*CmRdP`rT#W{q-^WvUA5>SXfMX%*Y7ph1E$3
zVjZXFlR~N1Bl7DYQQ=K)6p-9E--o}hGP=J?1~?)AYr1zz%2EQ0;dGH|VRrU!!{L%Q
zgma56&nqjf?c2kto_80jYHDiWF(q<XPL=7vY^0!}kl+M!{&sg2-?C`;4_$0<1aWZe
zi|{idNu<_0<Pzstt~ERB-MSU(Es3zx?U|os+z{zbBD*>J8nKXkvD$A*F$j+67Ko%$
z&GXMi5Zr;OsW<%nL&;vV$|?m4#zh#B0|_it>c36Gt$2<J-)qj<T<ip{h33Zt2>7%=
zeOoWpxPths%z5IRiR8V5%tXtr_>)qqvby94$D7g0;^N0VSqzZMLQiV6n*7%ub|gs|
z2~bb^M$08?ETZ1+Ocurgh<0~PoS4nx^#*Us|C;yx4jcN@PG4HLj}&~=eU?2FYD8?T
z&H0w%YrKnnj+u@Q1v*htxW%*p6yE;0ngphGN1>narNNl8d-INEP9J5bOPWUd!8QQF
zP8plXYW%92K^@!Gb))A+5^<);<2$j;jp%5FBvc|IoXUm6Fm(Pz9_-Y_#6;bVwXV>@
z3cQFNdz%89hJHBP3|s#p{i|zKs<mGn{A(9~yxPkOf^mkMT{gpCI|gH$zua{nU^AHr
z3Jc@&d}3Yt{5qPGOHs6on~bc&<I!LDuElV;8I+}y%S!=mXlsXD=|$fK*jEy-zV<~^
zlY<5z(i>HIgBND)Ess*+R!Db_)Gv_1?2eZf;Som8$lyh^98TB#AcCm8dasa>g3&2L
zmRdX+pA@4(2nEyf(>`CBiyhAWE-ETQP1uO^7#e24O3KMGFf%K{Ehc@4XEA&MP5;th
zYb(2AAh7CNrij$@ohczS7mx6d=ygPZnjkyYOO4r{Pj!D0wd7{Gz0j~;*B6(&3B!#Z
zubTh_9^v#8DYuwqFOg=9aDZ72zkg5Dwz)a+=x~0&J8t+j6rT+(1t4Uoa>6cZD}#yr
zaVSR31_%9xTJasd!FVP-Qcm3k;b0|Jqml3HU6U1)Yf}6_Xd8xW#eZUh%JW{mI>~99
z!KTUcfl0Fd0Il(oUabl%PWYws$%@t&66BCt+r5cd09j5?PkXpCGkwyk9S*rw+M_5u
zbyKKh8sXl&4J$faY^ceGL#J6v4v|H-%ld$Cv)Kph`&3>|T(PX}<!cQ<sy{)*JoZyq
z7O1zq27l~Q`Cvw6oE~nx5)<*cq4H?1u3{>R;0&>(`6ej%=NkS%b%WYGO4T~v>Lc3I
zY#kpRU8UQp%YR4Ful9Q(;+shK(beHE&MQQ$g9r;zOpmpWNESosZz&TK(Ew>9)?xfS
zauTdCd<0GDdrM>E{Jy@#)a1csZS?Yk#RkuHkzOa8e7WqUW@HA{iVcwM0sQt1*)Y!j
z4;OH6{$?#BhBgi<Dvz>jrq;JsVRsC>g6%Drja>&sM?P1&>tbtA-IvEv{3bCeDG5{;
zttOYSNCzHaGyj))B#*Z*t>HD7c1G9H(#@9|ho+}pTfJLsG)Tu10|Nukw+2DaBVd5R
zPr^JRX12}AvX(cRNkwwj`p3h-AcsVJxb$e=5fu>ti*w|sx9iFXX``;FS!i0FL09pg
zm#SRsdo}5FPYm@Hug*5lAz6h=#bNMcvvu4RjpE{gA|hQ*m)og^fwcT5p-$2szo(`)
zVS5+%YdUjNQXEk~$I&YDzfMc#Ic+uc39PMEdHA_#{ucL!I^p^1kYJ+|jaTpP_B_{{
zb=35`0yJ@aU|=s}%LC2BBgI$H&NKZ0n0tKsrh~yNEX+bdLF;;5yTzl<cAE&Y3o66v
zh5|V!=X<`VXN&=vR6c%`7hY`8MvYXED1aN{cz<9Y!=cMGLm=>UW9fp^75e?3oUCvR
ziC#H&%(k^H1!BB-!HD)5tOU`=EzwfU+@Us5_!47<JQl~s5D8I|HhTuQ+3~%9q6BYD
zk-r1jn&+FH+G~$9fLw?Vo%&<xA08ge%+2fVb{qA&85kKE8||)-n*RKmE>sfFFqG_P
zes4Bav>QwR>&;uv_c__Z^VR0Wd~SKclA$%0%O0S*A8VpFLw8tKS37`4k@Sa1h{xGR
z`GwtEd6Om=WK<*4ySA@&H|ntPUJ}tCepePkG&_I!yydBIJ)CzGSnzWad<y7CZ6W>2
z|G@I?&sU*v0`?+-5JOXSrtrnjoHYi6+A8U|yhvkW2K}*@`u%F2zdji}DMA|^G?9d!
zoNOVEsi0bxkVv7g4+{I@U}DC{$FJ<E9bfK4HEMT<i8qG?)-Y30;GIKgTZQcGq905;
z=T|W>es<*U<iL-)o_FTzey5X=mKNF4P7)zukj~0A{0>koHKxq9udmRoL-}Y##5Zd-
z>|%gy5pS)|w=Tm78zxJaaa+rCa{S%yR3kj9P>5Z~FpARCwQ4M2UN%%9_Xa~E9&`bZ
zl^;H=M|U=F*+Oy~n&kwtY1w=a_b1masusz$K(ddTS;_E$01_w_Z1`fJ9bcVq4<8)7
zJ)5y@tZ{l46j=J(;bo=qj5Q@B5N{H(fSO%tHXEf{X+UCfadwu%VaeCm9fG%*ElKr&
z^yW<%1Y$Op#S|6t=FOF2A@?eA)Oc*He#dXpn^w6P8ZIJU7mb@SO&a)j{;=Y9Dc%~Z
zIZ~z_#CIz7cC9^;>u@MUfiN9CEu43u-C9krG9E_K-2t4jwk^EwCJsh@((w<%B8*)B
zS$ux9s4fP}ZZ=~#Uya=4it?62I!fE~`p7(%lLo1ST~(s&^1x49d=)TYyY;mbT{`4*
zg1XufIYFK3UZafso@A^F=p<yF>bcVHj@Kfba}AD`85@uHV&>-NvnciHv_21o4~e70
zs9A!q)(B`swkx!?1a;MuJ}VL5{|FcDfqQx3{cZ|HwZXxU<S~=eexKd#bj^85a??Q@
zO*#{Y@d53ChL(1<HbQ%t8Afi%$yTk(C^%(mwvx(LL)^v&QQC!t#rDfbZl%_QdW*#%
z^Lch`MvIGn#+Kg}iyp1s%YMWBH7`fc>uhtw-g1$MwM->CLYW&-a)mE9BcuP*T8Js9
zA9j7Syox(oYT94<s(N+Ng&fi}{W<Y9e;D2EWR>x`Zf8(IK>?Wyc2?wTEt9Dt{c_z-
zROybcu0Cwy4{4sG8Nz68mdnlL;g79D-{O1){PHMWzmd0nySX`SM{_0Ni`{%r%<FQp
zGio)<1BY_dD%KodifOq<$Yv68GZsepOTVRWW!D+!*0@NNkLiw(CJAb;rzZ<kZG3$E
zY>60=0V=Vh{>X=^mt><^SsPb}4JIZgon0O~W7#--qX0v#X7|SplM9t7O4>Y^$L};b
zpR3JR69ym?xF06MdF#DQRIjl>eOEWh3W$vh1=P=y(^GiFP(!((JtCiqwr8WG>$5vr
zSnmurELL}nD0$ZPxYC$YJ?%~i)dvaEcsz%f9RPtt9&CR9TC-V1&M&@;YsKwn4BE|K
zn;Vh6m5b=_NxW}N9d(bT8jHC^BO}q)P#i(at*#zN%(h4MI?~9*B*O$2c5@%Dy7O2G
zz?+!&IvVNT^h+lEXN3Iyd3o2I-@mLJbj$;Cz*{+Tthzk%fl~VOAC9{t8bDjNAdrCt
z5&PbKb_>T37`?dcjrIWC*(y4R0gs;|0A~kbPpa2nl=3`<usXc*x)Gg?xTx`lrwUg_
z!|WBgKX2|AV4uG(vT9CO%@7KdPOh&pnOy4X;v-p^EK-&C@u8^ulJo)z=P4y6B`6Q%
zz*cK(Yg#2bv}2_}2)yWr08W`JQKJY3;SBu1vDNl&g<`eCy~%!EQ8-fSJJ$AqaFIWN
zZ7ki9{cSXwqgd#ma_bFi`~4F-5&qp9>O(J>00Lax6fWDdUJT1}4F}thhlF>Znm~8d
z@f)70T+=t^qoYOS<H9d9Rc94v8=JL}^h|EYql8CA#?pYbwBBsVZNDUd@dfK^(q}Ep
z<G36SK0s@~I~X<Obib>utAoA6a=(8gu*u_ck!IIz^|E5UPlu}f3?T1skndAPb)e7g
zkQkZ$<4Z#Lp8sMwLwNreM`=z@PADFWY(z*8t4K#`boBeb0B{X8+s&t^)PCOq;=pb`
zm(<NOgM2!rdgl_Pq85WRIE74Ox29c=?OA!t@=+lRlAgX%lXR{{KxTP+ybZwn?o7EL
z4nq<XGqcOJaDdN7Np<zm_4w}XdblwBzCK44CZh!=F>x@7N~FD5^N0y3tL|9VJg_qQ
zFtleKpC~W(OXVx6CjLT|XF%XwUS0yuFX7Xd&<<@oI|YHZ?RI(^cntaR(ld&-gEI{7
z;4B{!H0^5k5ctOXv7tXTyPR9g)#e0|{&BpI2d+`%zWr<A{XHpLoWDRDbGjaY#|vn3
ztgiwB8WIxdui86Xs88uBsHpVdd26au5T`l%K6{#T%CE1lw{$JLQ31+IE;=YEsJ`Bx
z`)T~EvaBpt^P8+UXdJm&Sy?%hx!LZ)sg~rc>IP{o)x%HaqJJqaOG-^LK2lPxG|$Y^
zCqtrtlz=Cx|CSj0-<Y!hdB7tcYHqf!J~`Qkvp7E=&@*vl!ZuGI6Y64~O+hH(;$r?K
zMIbw=Uq}9C3ZuyaDSZ4r)jmzleZb1<wav`T^!BR0FC*f;+ubpGZaU)zjlsjssovEr
zXtwIUwQ9FH8uvs*ay2WTaog>18w_O8`E6}stDs_l%<}1($8<D9(ROQ~TW_{vO5lk2
zg+Ac7#y>r4ko^@3us*l4jBw?;0-oL6%*-1>w3`O(F?7Tnw_8MzCa;f|F;W4(0BD4&
zn~RvI7IdSOtM~H7iIUk8(gH^aHm>&)l?H>w+ATUn2p1)quB)1wwI|o&Kf7MOYQ|?;
zqte&kT;PN5dvk0aN!DoocNr10te&DBkC$N3-sk4z9L|)Vf_|Q<m&4(pBP1lepnwMc
z44YBQ{d6q>5Cf)@Hu7?EG>Qdwc6Jk>xPcVbnKbyTMq~vrcUb7?jo*78va*DtN#<QZ
z8)p4zVQ~aF?w+2WKdk8Ul$1H9(-LC?cXzJ<$HvCQ)Sd$v5|`CBJkxzd`@M<lGnaUM
zl>18p??W|}Xpg6d*?jrGy%LLl-^|1W=DQxCL9pqxK@!<CO{YsTGcvsG7_V$cGwP0)
zMS~<`7%el4iwRLrOm@edXW-rrfmk;)qsht6c6HL=1Oe>jwYt&E(%4AE$u$|zW-6hf
zVHR7ALz}bQa1EucT?$HeXVd{L=qKx3E^U&zk1Dc95b|X+v7z~hQ@eE$t~QPq=K*`x
z0bsf5_OP~6hOfAb3x0~j?$|s4#!CU`+cL>qwgS~rZ?CW7v^`uecKDQ1qN3_;w{w74
zvPM4N;)$aaCJdT~ku?6FyW^iI+FY*=wl@?AZ=dFCN{Knk2ry=s9UARRO6&pJ2WklF
ztRAgkK$xtuvg^&s6X;n1ecry-?yrOP)7SR~G(@~E7oV#GX0`FzOd6x2&MNfJPib<j
z;X&CdRiADG-B*3R%hFQ#)zKmz#`%lXH$x?$o3ScbDQ?G`%#jKh7zk+(xYn+-L2HO!
z@1^u%sWzQX0h|}m<&=t4LPY<PTknYxsR#@WluQoius|IK?I1}?5Z8))ZkXk4#hX(*
zIXPy^qs4~e>}-8wRqWFdP;votAMhG4J3n8x%BUPrYfH7(_TxEh{{9qqS20EDE|+Qy
z48QgFYib-Dt=EG%H5;l4$R^6lK75f$x<S&F7xLia3!kew4*81k>%Gzd$vu&7HP~@3
zuAiE1w_iDY78KMJciHLdD_9#uQ7QX^NBeRR5_PJ;gG#6P+vGQ`@=&R2<pMzSI@u(L
z^du3yHs7BC?Swj}SbF4*wYRsYraqs-<IG7x!F4|+8lHlRb@?=s{#XH?JqU+dyWO{K
zJ1r=cC55KEmX@VWu8s;tH@jQM;lwOxbV1`{z3b%))JUh)WAm<8W}Z(AAf;bn(ada>
zlO7a<o*V>qp%T6GWgoF<kQTp_6Rr#O8X5eWpx~!N|6l67Zm3k!Z@FEsUJ9tFt2Znx
zU5#baKRz^`_O6+O#t&4YkJ2eTL5{<7^*q>kpFC)m3_H3lmtG>j<<xj0Iyzt^<Savy
zTqXRo1SBRNC#%v(*+2$OmkhWH(`lu*(&IVwoicFzAIR4G;~3Lm0CDsaG?+lL0KJOE
z8eHPz_n+pN>Uca(FNZRcKh}IpLBR0%M=w6hwPGFt_v3nZA+D<nve_r{$cK$U4#daD
z)K@PXg@UHLx}^Ci8m(3}0CakA+aA&k88DKQLq`Of+BJxWEG#sc^<84mf#^ZTr53Nx
z8g4WVo-hdtzF$GDZ{6bIVaU$O0c#IACpm_MRG1+HnX-diu172lG3uAU<c1SwLP7%I
zpT%WlS{x3802x<~8o9YU9_7n`UI<BNT3z{i3z$66UBVh;SGrs#s<7k$?hG6MZm2CI
zgf7qh`iQ=w6CkWV*oK3N1vxo1^Ga7SkXdcKXdxkA%b7BXn~Ut;q4+<)lnRvyv%UfO
z1xQYeVi*H!54uOhj}d-Iahdn02MO911nAe;qwIVYJ3A=jxx-y|rP|j!qnV88Cj|v2
zVkaO<MKvBC@8Ru2%Y+-}#SR;4YyJHFw{EI)v$M&@u-;wcakPG<Zr=V&I%?uCM!l!2
zu-P12St0q<Le=tkmFwd}9vkBU>9n2mF#$$_e|-UN2;z2G0g=*OtkSRL<;Oupq@$#z
zryE;pBe;`Z&~^-C2Kam4G+Hdyhmp7Kw1(id5a8i$I#u*8E%n6|lEgH--;3B0jcoI;
zgkhlMrv6naFSz_LKEu6|u%JP$Y!i#5q@dVhHw2g-8vhH4N^4a@0+&EGkP*HlbF(lp
zwN6hP4yP15DJF@&1COs(>1O$!Ln4mBryCrGRFaNDx}zv0#jp8)3kFzJu<^J#X)k0%
z<of!)w5BaDFPD%=T}oJ4;qYw159ibx(3&oshI;O>!HSU~JqSRNbrNcx>fDq+@OXYY
z92f|PCmT-v6gnHBjq`4`0Reh{L5a)<6;&sdlMoY=L>iDM7=cSqj{y=$FxhZe^v#&K
zH^xL8)@T+%<IV@gH<5vkzgEcGZ=j%!sHhAH2{nD&JUsY3OAnECulara$*V<FLf*5~
z)DWiTsGt)PQZx(`SW+)ljb%&fxpY9vD>5s~$}p*HToGpXMM4v4XbU0kM0U7INd=jf
zKQN#gB4cAIhv@FVfGUT|tq0xoW>-hz>|$1ieb(8ph-)c{%NDz*I=JI@z5Cfy4*^tc
zSqns}A48v1v6Tb`cxm?B1JNm@lQ=^b=)3lRv77Tco#g5FWA`xXS{_4A-L2K0o{+Ny
zV2yVu{i6U0=6rV{-w|lEo15ytS&g#RGy(E;Z!cPBFabi)p9=U2P#*o`ab+ea*??r&
zQB-HN+?;$v<vLeqi^9WhGV%JkBZ^wy;7ckW^}R%e89Y-e-A{8Pqj&Q_+HE205<Uq~
zxGvMl1oR0=&lF<gdrmB{y~8Q-5DxKeLreV+^XJ=7Y^GDAqoY?>S5c2`2v^HpT@D~s
z%cR_Zj!wGg+<Z9n#(6M>mzPJQg3kM!UF?}hzG|hCghb!WBgpKaPcAc=+<VXEWQ7tn
zh^zjmDgp(p6=AZB9wwx6ROV(k7tQ;^G`Xj>ySp0!>`I~AliwbZQ0eLk%&|RuK=3j)
zF(EUOk6N+|={{O?T{i|eBtoJizM;u|lSz*<mQM9-?l)~@qz(;DR2tl>L7~#2?{kYM
zdBE~AJTfx>>xoQJVm-ZeZu>p*D8ZhXRChrVKlla<&E9G3NFr=Z-#_IZk0N3^iHWgE
zA01`Er_bYW0hDGj_=5dhtWpk70g#x}Gv8SyZR<y$5bCi0KWR?C*a<rX8tp3$hn0Ws
z%~o0hX7OxoO>(jRa&(%*Xe7<LT=%ZIS!-x$()AKQZDdKS!69FR%T%Zf@XV-b*ZUkD
zt?3mB33xUqz)Db6L1U_~D6Oe^h_vMJeW6^e#-a&yRE`cMOqNSyfWr)SjbE4SN#n3w
za(RBz1nr9PSQe}Uf_q?e^u+!&uN5<^#lja=iJPPYDgq*FZ_-~!hmR_Xipblz0#_D`
z;4}9E$jDOvsnkD)2BLZTo<E!ex*e2IX3r;W6e1_G1km)X0W^p>_QmkG3ESz!QZu^9
zHq*lKsx|e8lSx2n0F7L+(Fws<%KL)W?zibQnoYeYj43vU*C45~`S<V4wp$C}^O`Ll
zo44nN32P-AWdYCf3?38~qZwGn#=BfYKPC+sF;T203-t5zdx0=;f4i;9&(9x#a{SX1
zqe4ttIw&Lr^?CIhY%k%PNarG<daT}c&^e&puhni1BoL#W?!u9QJqNMdP2xiGc)XP1
z(QI~0H_MNXekbHb$Zgl;`Md<wKH%L@sx&wpJ}Q0?rF>$3RgWzuOfFrlRQ$?j7?f6O
z^(mLlzEA)!1vy?BTbk~lrMk~=D&NcQm9}6f{)+1=zc`pZUhAwJPPq;IyYl2B518oa
zZkKzTfLm#CTK%NkF@uCNq$|}QTijVr&L75+?tVYyY^D(X_+3!uv#_x7-36EBQX`+u
z#%G^bQm7TmB?pcA{q;OYAOBiaqLe$v3N&^a9NRcX^JK^Uk$*`gFi(w?aaNR_p`pkX
z0QG9t6Uw4DY7%^1gX{Iwaxh0SkF!~<bA)ckO@ou3$P=lEf~>5xgamdoJbEnr%Es~J
z6F%+e$jBc<-}f5LsNKQva*dnHDPds@N->Fvcd!I~1bmEHho{au4HYtfcNrZz0m098
z?LWQi6t~Xk7#JM{X`9#YM4gk&m{kH(v}8RTBLJ>D8}696__YK>h=GAYMCAXK^4{_&
zM*^szA0AtMT=lOl8{KXnCJS-6imxQ0(^#ojCG`<ZTE--ze%eBgZ9gvY9Ier>ERjKB
zQEjx3FgnejtGxSU`ZJa4ct^G8{QFOBgv`I5EV&7e!GFyQk0TLYTd8dSPfbw&cbnAz
z8}Imm_(ZGN_pj+BV^~~rIO63<dV2al-WxRcFdb|1e=QM0Sx~P={-!S>#BcwYDgJ*u
z@WYeyhmtI?1Ign+c7A~>#m>$yFQ?0xxDy~-6wmjBAao%kkB0ba_1GJ>e^XMc<&8?C
zlLa46>W5VvDXCDP@F6`{^~EHQkB_^%5%uC+9e$i?O+N!<T5__c%jF&;c1~8-3N9dO
za0v*=Q6GN<VN#EkE{{mW6hHvoeyQHzpb7+p&qB+zlKmAxh*VUL%Ssw~4V-9qyW>>x
z4Dwxl3kz#^m$Y^CH?w$<9VATFAK2+HuFhOYq(y~%w>?`isNNLjy+>O1VmIdoZmsVK
zX_d8Bt9CXvL6x?lXPf4r<2yeeULPNqhs_`k{VC5TG~C?06vvqAXjdecEBy#KIwH<8
zNs^4?$saG;qhn$KmW+yyo+(y82K=y05+@BWFGvX7MlolQ@J}CM(A>S+5Yk{^w3ljE
zNwt|>ue^c6Iy=ji))1lvs*5Kw0egu`xh|04I|@N-DxWg|vL$By1aKXO6D^ji*LXF!
zt{V<Nj3kkhnj0HW*4fGo_|qK&J00*iels!Qvsl;wD)3aE>^|`80l>uLc$8JEV6^j5
zsA_dp2Lw7Hr&Vorwe+`@!p(jhvP}Q<5+FGxBqjoiL?@C~nPH<g1&zE54;NQ=>-IcO
z&$h-=d-(Lj@$&U+1ZUf)hkW2%L?+_Na6X^v4kJW`c(7t)$2u*vcq-dn+=F`od5szP
z)wE3}^6CI`Mn)biD=R}LP!bXmd5!x)Ls{7obi__rY_QJ2^%j@*RZx%+=IafpIHeWY
zz_c<|td56&hb?{tK-cW-tmi}g?)v&~{eEsQ2qKi!ua@UZa0|NJ^z^@FQc0DRHb?w{
zh?$X<<=fTYy?qL3p?dp$`TQshW_c|w6qL6!`&&wk{ja4GtBRCMUzqIA*R&QYGXnJ)
z10rVaXL}FKiGjt%J~zWXJt`4Omj#N2nb7yQw;5=~T1`ry{~%#t$m{8`H14gf6{M%H
z9zLRy+Kgs&egzjAd^6da9+jF}lafM|p%uMQZ?7pOl?f<C6$zkgmOFvU#-PbffPt}?
zAxvOyu4$d0A$$qo`yaskC-{CNjKkGXGMO$3o(v;?X1N+{UzY=RpazFzbMr%6jbYFb
zMWN|ZQIL^d-`TGihEGplGl`6#ZXyYNBGJ}n<N=LYCg}C<?)>{>2er#}nIyg%s#lx+
zijMxv-=b4Uq}`=03NOpal;+i@T|7zlvLXW2dU9+`fY8zAu4)1-y=?L*f9GqU16bJ=
zg_M-mT(8q8CPl7dL-L?Ta(|bX3sY6wY!-;IOC@u6EiVr*KN~way{`~9Y9!)0v9mAU
zUXz<29^RfRCQvM#`ka=e|7yZI%j3gWP`xNvDx)$*Wl$kI!I;uep|5OqMr7Ao00$lD
zcf90xF!x*k@ea%TVvD|`*84kMuT(_!IPhVT8z$-V24fEbd!UbxAl7SzV)Yug<z_;o
zxlv!`LM6?lRRF#~Rpl>Li}*g;2l3mVdbB@TIRczAyouw%%sY#6yIp4Z&CwIR1^|A_
z)HL`DluHxVU3hpcsVFH)dVnc)ropjQfG;cS9q?lzfTgTz02C=O7y=Sxw@B3%*l;MW
z^q3}sO+a8W=GEaQjgF16bJX;hQ{-8+JoCXQ<~SV6ND}e^qi4!tdOE2Jfrznyz!K3X
z4`5^R$@`^PpnwI|FP1Lh{v<s&CdR(SLlB!mW46}X7L$y{FAGIPUKRtSx^$gRlD(<o
z{n5S7&Q2~a;A@20b8>OvHu&R2cUL3EbL#paq@81Bv0CeX|0+sm%}!$>w{!{?7IqEo
zlAWAfP*IVMj}M!^@aNBSpj`q3TGA&^ntK;Aa*Asib(QEY&~gu-Ldw6<X%#5oF*5cp
z_5!ZxkKUI7IG%#S!a&J%=Pq)FxA7Plz{!leBnLQ8ax=TuQ<)?TLJMoM?#uT=^70s&
z^U$Lx@X2GjGLJ;O_2Hyx_4Wi)rOT+994(KOcqPuyeCYPr=OlrCUle!8>fTh6JYiF9
z#ML_<V?U*fzf!1Ct$f1VUgf|HM1*HEyT6hGDD=&nnEC3%nG9j|@A-{Q&)cpafkg;D
z5#YVhcbF+Ow1(zuvg(Qo3I+o=f=b@6t~-%Dy&#whoG)0tr)w;I_&&}9BPB2bhbZBV
z>k4p->gc39u`*Eye*fSfVoe&cS<orMoeGrI)l*<I>)}9(8r{|{FK1dqfugQTIr!k6
zQ&8Za()9TPW^dUu-bXMy5JMEW$qBhCP;~4z`=q_A$bKby?0t`Aps$nRCWH2A!Ane>
z(@ih27>$qLp)>ud-PhH%1Ux-9-*yI@JqXLJ*YS7dTy~}qg)Xw~>@GZ>-AQc}L4vwG
zbGbQ~9S8Yyc5coPA+5n~*Vyvd39yiirEoBCVIMxcPtoViE8batx|(P7W<~b(f2~Rb
zZdIAH#!5vs#@^Nz=XrKsdB~jowBH%`BowF<Y=8d~G*WX+(vk1;Dzt;O1jl=AsoC8}
zp$c$02PuW7i-8!qlX<cqYZ5Tf*CKIh%FD;6rUuPZOeRfg8#sW({y}7<Yzv6_@L=n+
zwmZG$ut3CLk%&pMnhS2}g;*1P&$aSbE-tomru+{Vpaw&z`LY#=+1KaiAbZ$3IJ8DE
zsVy9s{-pP-Uv6;p%<5iS)AjN30cN*0i2Q8DCZ+U4w(B(?G@3j0>(ypYV%a8_!B@zM
zYHG3j6XIvt&`h==79YmGNJ~!w?~#tKF0d1LV~@|xbuBbT7Zfn7vEJgjxix;^_MI~~
zF=4makOAfp1-Uy05BT7n0C`Tl9Z;0PM(z4ma-(N8TiHlW-3t&fgJQu&@<)zy6@tVi
zAGm8^(?zqUNjw3>pt$Gz&y6^hViuC_5Ag}b8|!DA!T!huAHV(i5JGZ)=aLE{r{)qg
zWCgC*&GC5d*C2E@YY~Ko$1=s7FZVh@l-?3JT=)ne^Ljjdz#mN)6kRu#lN$pBD6BX=
zr)otOm%tv#oIij5R4&!>A2<blL4o4Whd103Bff^(zaHdvR7$j45EU&!H?rO>b2!33
zHV_aHU@=psMv?&yMBJyHQ4FBlG4i?JjGV8wyLz*-Y_7>Q$fSB1y$7DVpaO2wDGk<S
zz={`XHDSw%ov{?Dl+O$dG#W@Lf3H|uTl;#-#VvH9|5v<meQsLnS1*e9APU@jXkSs*
z)#W*Ed)JpCgfI?zm(zYIW?;zV=B`(Ll18OLv-##+gebYYx2LZf1N0A)LoOsC1>A`V
z)*u`XL}cXNfq@=#B6oKf*5sY;3?+}~K4zG{-&J;JC8I*oaP4a%%l7}`&kId{C{51m
z|H9Uy|Lrir{~aa&LBadn(9lq0IxYQ=`TA~4!IyXhP+oL&bikKM_g9ucb5{qh-dEy*
zfo&+8z?C8z_SW_Jsp+#&5UpI681Q%kU-7y&&}uU?GyU4WeOG837+|HLq3KrsT~$>+
z+S3ESx(~eMw8|wK7V1<P0*3nfz_N@+Ow8y;h>xEL>JP1Ey`5N30~j^9jSIr2pUM=y
z215;bc^c#|d^x(hD0FpoUuLxVV;7@ZtO9%NQvbfSkkCzoBPp<|Vj=;f9BAZsK~hWm
zE5(3W7UbJo-URkT9P3vc95sNN%JZlz#tsIKRMK}F^lA%#{y-@!EAzXYckNGm0qI_|
z;(O!?7dS_q`~8#`3|w1#`$?(${ncclG76$gF~A<mpw<T}2HNU=0wN4BWPM-{$UftI
z2{u!Htui0q5<GlI8vsIURyi`M{xRR4Hv8j{gq90+J1_pm$`k1I-V7Ngtx8Kv3$)Uy
zR@`h264W)#fg48&?*|+VW^-7p58SHN#YGUvY*I;l?t49vrEHjPyJMXkmRjot70%~5
zKYqkL-d$q!k75JPesi;b8<-#(?Dt>I8G%NZt3+qMnjWk$Hl#Vs`_%|%4A{vfB_*I!
z%>#FGeK;=~LLC|sl9Zf`Lc~*RG^)#*aCC(H6&Dk80<hfHt&!xSKr8`{N}3wBVNj%{
zezAiE1%T;swOzDK0CTBfo9o*jz*KlkNlATbu-pN~Pcc7gJ=Jqaz0pZrM8qF_TWoA>
zMFq3gB<L@urm(l^)D%h`4%GmcQV00f2vVQO)c!+MFv>AqX&CMUhk{JV{Y6U3d@ylx
z4Zn=Wt^?=>6`s#tff!VNzP|86%QYZ%hT}5XwD|@C@uwpnxUj5M8BhDo7VFJ7`(o;v
zg8F_Nk8c4Y6Hz-r#XNB5mukiLUBHR@mVN`?yRfh@@U`}~g&_C*sja<nK7Ybw{2G8l
zTv1aB>U<b@V8iiD^6KjQ3w11jdz)2mGlh0n1k(qAyDP}dJYQ)Q1d}(o;;kh88@(8v
zabRD7>v-5s^`xYt0`_HS3gC=lkj;4MulM0_PwgIzRK)+`0UwTj=5V{Qigw%?dGW##
zAb}Fi2LCd}#&s~haMk8_ewO(MGF?d*=7}p2J2+BrKi?UQqsI|O#GBad1%QPP7&p=D
z3K5Pe1ov+dFjA_$+|eO)@VPU{0X$S|t1?l1?dqt@eU1>qj}E|;1bP=NNVDbA(vnfC
zRs9=$RwuyF@1WM#);^qe6HkMW1J|;@`v)VR*{|szLYb0)Q-Z^62A%>pp|#447i^Et
z6C{C?yUTt1-7#T0q0ZB*t2U$8+`XWo5fuk6a{w{?H#l;TU%zJ5toI$@@Gp+|5~Vov
z<A*X5HXUk!dkU{>5Gi^2TNaIGH#`<SwAaYM&=b5llT=!YV$ekfBvMq!(`1FR2!CS!
zBJgs74Imq~2d0vkXCE-Aq=k3|V4cr8a4r?-28v@hi-D`WmiZe--oZ?g$_%iVu$!wP
zjkW4T13nas4f7lzfBCn&SXu3rDJj=qA#o8UU<&GDun@pkT~yr7>!ZcrHI6+MTpHfM
zKI_%-_EpKK!*abn(kM#_QQkdZw?te+^Pud(B!Qxs0Vx}3fRwFU!5G3il(mslu+7`>
zw$AU%&F;9t*xQlF<m5U5vig{Oo=4&3c5lO+l6wzzg%w7i>Vb2`JIk1EQDN_Le;Sy)
z>X*f0O(ev`MyBJc67yd5a0BNhJ{z(4zHo4C8fw!3&2#_I5cVcF_Z+yu`-3;QxI4<d
zBFf65ZdhK71*s7zV&SW3_l#n;!*zrLqZv_%)I>!9NtN)6h;-`H&NjO@02D=|TtY_#
z3aFR$FGQ?9a!iklol#KLIV={yF4_k$8%zalZEbyYFl#s31)edG#KCM!VE@(eGO_uu
z++3<ytU?6cO%PyNxw&9AiI<erV{d}mNNBXjSS&9y9I$5;z;s*m41_*0N@phxY+K2A
zxJ(tWg*D1`VY?t;Jd8ptpbq#`AhTb^(Jnr6ai!yg+5k0cv;SEj_2F!j7E<(!&6Ec9
z(REV=Pd1EZBuiY6g{4xjJB)O54&?Pzk2{1-U>^m%7dqwFlJs;Sn!70olE$fBspgqx
zOC*4?v|%tD^b5msx+5nvRI0;1!vd`3-a_3u5KMnpS1(nYBlSfx&Q}_85S0(-9e}(8
zELo^oyk6M!i7oE;*yrmi(#hOFeq_2GgoT64Y$pFSS+3WOMH|Zjc49EOctE*sBT%T(
zW|JVad>#)fO)hL-$nU3GJU?wfTlI(?29^t9gSmx{OXShc7+Rv4i?QrrSn;=V#*cUQ
z{{H?T2OuILb>I86x5iL~2V=?dd-{=+kU)ix=Sa0Uo$AKMF@rlE_B`K`%CbST5)~G{
zz5gUA4sOCmgM|SDi*^nv)fUVF&?wq8IkIqZ2|pQYXe5yYh6i_dxLH}<q%ts?e7owb
zB!(t4ez^(C1G)`5`k6Gz9Y3qlN=bHhAZ39xAqT4ym?`UNh99$*;i%zWJ5&_=m>##Y
zMpkEyXFiZEiPIHMe0@GVE)w>Z$zb69>tZr-JyTPk95IhUFn~5wqIv)4&*!QIK=oAp
z{tW~)`NKc(DERmE>ebTmANV6Yly!DSNP+cN!~{=fG>6?{K`6q*6Y$?&J$j0TTV}et
z6}p{$z+jjDc9z`n`p(G0^Ujz~tzxQpex<<M=G{-!DI}q1IW8rU4Q*KCd&N>MccvG<
zn3p|~<V;80I&DrN2=g;DYl=Y824rj~;m59aK{>_B>57{h&RKtuiVTg71NSIRUqq6M
z@YH{6ZF4@~THQTe@4mPU)?XI%Ef(~D-6=F#AT1V(F!qZGOu&K)?H7wL!xZ)|7Nlli
z3HoGRhLeBlhlFDX2oL}=RFxp`DvdJC0F8l+8IO9ti9*a5m5My-9WT}u^YZaZE}O1w
z8vq>-k7n@ReJt+V{i)*TO`P88@(5VV1(m3t?#b6U7>zY+_QylX^ZNa<!s1Ifw0GgO
zMxuKI36-4M+XD%qW~lxKuaNO4()fLNwm_xE;&#UM2G$~{B~vihfX%EUro8^HYbI#M
zo`J-U+nV}zH`hAP>~P+*mr-1ABM(eu?rg1n8@<O-x62@otgJlGlZE%bC)Ww-DpI0X
zE`Q6WW+wbKU-mwN486apkqEeE(zXM6P+u8-FrpQ+G!gjoIIZp3TdLalvA=yC(Z;~S
z!eVEwM72`n3V2K}Pay2#Zb5Xvt4`!$MY&azPR`HUGeNeV>C0$aYB>({1RXW@cK4Bv
zkYq^8CeFLN>)vAKAeqPr^h`s3bPc`^Tsjj9vQIph7mWdGwnqzi9nqWpo_7_RS89|k
z^g>JR0VslI^t6A|c{woYeIf+*R{*4wx$XJ4x$dPcmYW5W;NN%@=2NS_T^G*F(!F>M
z@@Gv|6?!=AtaiBwxn*dahK5ZoY=3umjdJM{7+UFwVB6}DTa$T3+D-R~ppR*cLQFI~
zk_LPIX=mrzQ|3FEEi##Q;I&$Tl3M|}Rrn(0rdgxT28dd~QC`8Q4=gmhg#pgmMLVBL
z(q6FE7q|N(cS8;SHYG|=KL#CSnA3B+DD|va#ja!=0|g}|*_}qco$-<>5swq3rR6yU
z@9(%CyO|2((nl{AK4xa<_RnH$fh|L%@1YyKAjE{T04<Tn(LG1GRj4KnouY!k3-2Gd
zY<UdwX|mt<cha*9qb0o?q6eJ|uq)WwBFW3Myv)aqMeEnkbqAULc(doZhY(*j1O(M|
z$s%r5G1vnD)5^vG*g)B`1^i}?`%^HNH6R3lGpOTRxtj$p5@HnP^LV&SV2fzrL+lOf
z>9O{t&|607Z_%pU>Izwy_;rAkq<Z%b*oJzZE3hiQLXWm65XHzQ#m01Zb&<L#DJhA3
z3|?V7voxwZT6(lo{th0XC17+xDitcCrsW^s+S~IlLw|9))*0;W4ITMrxH*lpi?&6L
zjct<d(<dr14^8Q)CXpW6BNZW`mnIiLEw3p3z{RzDu{#cu{o`hwF~kn;HLlg+oIO8!
zoO0x#PZqP2>-{%;QTkK~8Oi?D9l)tsKRwie=CG@q>gMJK;#Ug+F00;VyPcI2<BN~S
z!B~&oSZ&2T0J5>O&<0*8Hn|)D8xbf2Xz$25hs@_aBu<s`zLDSGL93`lGiWWm=j7x(
zo&>^TMy^VAk^T7=y+mAf#|$cBp<-c}zWy_4ng{fd!BCUPFtel%sA_NDz6CU$wM{_~
z8^ljUgyK6MGbRzY-TNBBKlU%kwXw1F%ap6Dv67Pu16h)|?Gcgsw5=h{w)y$SMrI>I
zo9yji5(n)IAXC4%1^HqpVr=++03+1gyWfUn*x9idG-@OC`9sd%5OU+fB*PCz=C{cK
zaVi4D;hrK7*%@}~)d6)~pyXTCp-9e8B`i{4j3wfi?ti#|&X&J^oBe~s!_DJo4Rv*O
zrEV}ZjRtwjKFbU7W<965H=viRgM^PN_yq*$p_Naq5VtLZ0lh6l^&K@7JZ1&H>Z7^e
z`?2)uT_Je#^>%nwmrll@+~2CkfO%P({DW(g$h*sPS2D^hA8+pt!u`454Y}Ly@1{3!
zgw`Ie4%I7iL9ft3?(bR7`NrgArL`iCQY!JsADm<de*6`(IJ(%(k+uwl*her=0cPL8
z-sFGlZC6XT2`EXnta2);s0HSu9hH2O$pX(fT8HwC=V*a@N#8Z(LBBVuOsD(qeqs)c
zTR4(mzP!I^BD-56IlR~i)CRzQ^gy%DMt>lF)cZTDZ7|8;>-19*+b|`Q)wWJm?1}Ml
zfb@=rl0SmHvIx)x|J^3sY$2{cXs(DjEX;reA3?f5p3CtnlZiEY-U0yX7w0mGtZ0FS
zj>iJIQunaw&j+)%0LcK0>NtzxP+F5HQm9?+=L^OdQT><iegTXNytozoKCggDIOr3X
z{m#fL_)P@h?s5U6$3ToUnkj1qgohua_bKtmkMm%+GiWtt0TDs$Rq(Zk+Z1S#)oLu<
zj~2K>xb$!fw3_O*w3gP&!AKaGkVekCk<a<kB?$<KpW3L#yI^rv@x7zpRs+u|>*}$(
zkX3w-I5D>!YJv?8PMl7=Kbb3i&Wu&@&QcTL;y8daD-a1Os;?reR_p;y-E`juz=`!U
zil-6Ot}0M|#=*ohfOjjQit_U9_Tov}qacWKA0j;aenAig2Ix1p!^k%RN;K+x4N#sx
zVBXJLRx)Zo**UI&C<Ge?9}6qyF~9<}XqI|<!6SIj5exwQ6RFu*4{(r^W3)Ps=M09w
z<pQvQn4kLqj8}`!{xKC15sCes-ZEF9Xc|Htj!#ji%uGjD<oWz!#yRAW3@r?@I<0M}
zLo3FgPP$>PaA66SS%{*dqC%s|1&apSr5XnAjlgOM9t#~ky)0aEax&TjX-712l|iY#
z^GDC8x8BMd+Mux|7299w2>c0KM?l!=5-^vn&p#pY8V}4Lxla`(cwab{e4T~uWmIK5
zKdD_1q2c56m@3k)+*kpZUuQVX03eDk%G<c2R1f^;hdMB2K)HNe+X&Qku?GjCZ{J8t
zP}bx!MZ-(JrZ@ilIj-$V->wcqS%KR2c2XA(SUP4igl)|TUBmL4)N4v+TEHdi78Ruk
zX<AwmYicHg&8R1aH$S+pEBtINOjq33^laj(5eIpK{X0SIL{qJG8&IU;hsX|JYKvq7
z=;OS+_uHOAVh^xNr?~>(BcN+43*)<$AWu@DNg^gbMj_T+SXcnb>GAQgav|CeQP*6v
zxy&B|X4QWn65!y_zRv>{4j79o7}X$Fbd;1`kRRtNWlF_rDj)7U;kp$Y91g+sm?4T`
zxms4$Ip=qcM5|G!vkv7i6f3(YtL<o;pkr}r^%kBi;2Qo#b-RwT*{9l%Eqej3-^IT(
z^dD#KV_pXoemf&H)*rC@M-b3*Bb$!E#C7bk2u82oUmofLhJ}qyN@lo+nORW#514H4
z?4%$eSpn~cmQDGOITz{$>oXa}Ul!^AFv<Qu{ki}7)c?l^noFV7goOdIq4_Tfrj-v5
z>*M6u>b<#U2gaTDr(eV|B%fb-ymN~Lrn%9HiFhvC3b)m0>K1J3GwY)TRcJJ<_-y@I
zFcND>-ROSb1<bL2(3NHHSv($wLH)isbxv9bK!@Y%+Vk$pJmRy^ExYsC7a-fHB7(UT
zI?O0AhC47w4|q#5RN1G$qA9QY-uC8Ynv*p-4o(elx(_F?@RE^z`MMB@5um6LU5QEN
zq9nIgOey3?&dO>BoI&w<^4*I)c^yE%{}5VIdLmV2K7YDU_w#jHAg0a13_lEvpuK%4
zP+f2CTmTJ=;8y@t(xD+Xu;iQCt1m~qycjJPPEfN3t$>DNW_AExi;Dzc1ZR6k1r|?V
zQnGL;*>!K901Rim<*vFuU5E30D4*%>24-A(mA=l--|qJefQ+!R&Mz)5e%u*#-zdMk
zA`H1DCvT7306*`7_Ab&c5{QgCgT$W<bZ6<+r_!yi4q#^xU53R>59ezHNiujSC@3Jm
zC#R;CMn=9SiEQG3_~vxgcX_sH`|%?jMK;;?P%`*Yn|$?YUN$!S?V&-SIPOoGkL1ao
z=gPPzCl!DR*i>$Npm+735zwety9K-f65(K5yWnsV*Xc?6_ClTH*QGT6aiFV!h&>1N
zh7VkL+w0z5aiH6RscP@fLR_ck=dI*>B+xrQe#jtOT+tZ(EAfJ;S1eZ3dwxoejEsbN
z^%|IgI$k3noZ?bw)!B$&#a4;`jGZi~BavnEe6k54G@q~LC&?J5-Wagh9aC}=x>FSu
ztx;iehYOJK@K|zjaWSHlwb`GtXJbPa>gwt;0D~RU(nD)<!2Ej($-*St$`B4tcLDv$
zn{fbXrNzZtT{>pL5d6xH3SMi?ztSO)Wr76E%?T$Sc6Rc>I1en@9a)_s!xvz9h6D$j
zP8HdMpEH2ZjERW>IWSmRHnVl9IVzxASVNrK;lRK^NupX{V$BOiG;LGldr?8b9I)+S
zYBkd#L;`hzL7Oi%B7zg_-mWf6BBD6(13Cang#6GV$$02356Ukn$SW*tsGo8LggpS7
zz)1VGD(?x1oTE`>b5rBAlp6}OksboR$q5O8LANVjxnReC<-{}E$cXS88>a=@E*hA&
zpM(4l=H4?Zt3B)XRKWl$g5)3>MS_Tel7l1>6G)Cq2FZewF#wX2q=O0)6hr|@B1#g;
z8N@&kB!i&joO(XzR8`-%`;P80-g`%nu2CN>&#~m$&))yN)?9P`*88A2h2T+kzo|cc
z@;W+hUoyD@9916?()n4s=nLR*9=~a8`=G_SKI(a!OKeti6*2-ZMq_ws53%$GOU>Tj
z&095x0lA-V38n=Rtfe<z!K?6)Oj$80w;TV~e$0uSUg>Xbc_Zt1kklPrg2QmUVCBv0
z*RPhk^LH7bZG7#uwonfZ^yrnuu<R*VqN|+J8Zb&;9}c{t{r$tj!h&X2cUQL<MizM>
zQlK&y^;(OMj1<hK%NX6)27%YV@f<3iY9U4nFU>FwJ~lQo0mvJ}9nWvU`fnK-`In-L
zTmk?3TeYy5&BaL>b>*hxgr^*%+DKOQpAiv1p`_sslu^>;Q(E9VU#6wb5KgzBhI84d
zteRWxrJ5P!4A`Hhbqn<)trSi8q}}!M(u!G&bJj?hb2Gnxr;}Z?RXBN?SM=uBq(Pg!
ztP&rV<K*pe4XI8TwhakN=+DLM;Vek|9CaZpZDFG09#42}M8sKbV!8T5EZ(}u7@X8E
z9$;Z)U<l+2C>c3xeM5CmI6hB>bS~%mowNY%v!a@Uf_G_n`TXz91oY*wTBS-KJ*M)<
zw<$G`GV&Y@kcx();fXi3wKG_odCNU$^<hQHYtQJz{1Jn!{QO&dx&_+C#%fouKC{_c
zp5`D{ZvEcT+Nu|^kY8wGB8@LJpnNVDqdh8kgrBFUlgO)I-~CeGvV=l1_{Y!jac&*a
zyhg9J165*oes?ECMxvQc<J-?}>#vknix%mAAhftZ12gu9@K(*-3K``w%+Yzu%EA{H
z54yOxU^Leib(lI9E|B@r-<ug$pJNHBo`@eAs<)zD-IV9lEk*Vocmv^MBa~5VWK1cX
zUbqAyc07^@1q$w?X5>A7h>Wb#6$7VR7n>eRdF>fE{Klrs69$Q?U|uZ*jp1Bt!-(~w
zGzM1u{00%8MfD7FHTQ=fBZ``d9w=-Aq3+!i;RY!^A+ygbD()5(sGluzhoK(i9{aDa
zzhErdk|fPVt|}GHcYL)$HkM}zw(70}bytS07Jn5IT)yi(kr66pwHG3KoSZVlOk+iy
zFUq^|J`tcWcI6J&QZ+cl+<UF$ohr`mlXV`yI&<L+A?>ITlQih)b$8W|N|NT_@alOR
zim{BO$I`9a*|P(31=?lSUrzaUqNM%Z@57zfi8yIX>({{X{JCs>7U`{R*6IE)zpp*N
zrlG+o=8Q*h6tf7Awa&e%7Y7EC|NIGsc?{XhlragD8WwHh2baNr5ZuO7=SV>(>7G(n
zwuRAObaXVXz}Gb8{YFOiimmdiY<<oHV`Gm>gEqaS6)7BB@FKY3NoP9_p%<gIsy%0G
z8@$(-T$=o&Z-2{{+|AzbkUds&q)$n4Uq7+f$2?0BX-tUxPdLS%b8$H+0VoVcXc<(Q
z`gLNEK|P!3>RT_RB#ycs<I>D{{W>b1PT;)VW6c&!)}+G2!kEo}hQ`Yqv4-=!NJ#;a
zqXU_vTVt0IIC-hrJW}cR8Ci{3e(pD1Tx)8mgQDA4xVVmz_RBlv8M_GAz7O3Hg2zhz
zJN`QKp$HHbJ5T64IjPyD%4qB9>Sl^O?U4X`he@7&?Ub9kAn|9qslvjn@nQAmii(-7
zO^=6UzhjId_>Z^Ke(vbldO`m;3@n9(;Z)lOW!Hb(Va8n`oi_OA4_-tg=~t34KpNsU
zDyzJ^lgJJOFVDUD1_nwYbTA}xpuq9*@yTub{@oQFA$LK3{)by*VKNIz(I&sS`OtVx
zBK$cS7ZlWhCZ4<=_N)M|=PGfRRaCC1s8A+>1M{P*Y5}MGuFWDe>a@Cha6YSw{Ptye
zR9gC}D<7V}O8X!0kCSi43E6zVK3GLkxtt6}*yYO_=y<!Juj(XcXP+Pycea$iJ*7Pm
zOvgae|ISekW~mLz0Pl;UU&AUp-rV@aQnZ^EB&%eKLkAAjc>o8{jTgbmQ>TmvD*d{Q
zP#@3>TdP+GQ46B|yM}UkeOdCs{atula<-hb>Zn2iN-FQ?y1#b3-Q@l4-zPTWTM{MV
z-3nwr=AN{RVp9%@n4S#PA%sp=D+yD>nT^%?%DC=wA0wov&dJHeM7w@w*vxQxeZ<df
z`Hv*VF|^*MD5;y~YMb)&-<~M<-h98ZLfo|4HM)h?#`w&!^h^x79B<v4gi<WSnNFTS
zdFRgZw;ZAzgAeab>)CbK4!^f(d7{|(ka++ars?n4;NV~kM@VPwx3@OAUn1Lowe2SC
z>=z+j9)5Lr?6vyKsPsAKJDLC10>&gATQCh8%_YL1>bpLoC8H8PTTc=a#7NQ7j-Xi|
zJOEftvFEB2^Ud+jm#6pS^_QC54%*_~TALJ5r#Cf?Y>T4Sd~G>BvPic${^J9=pd^aZ
z70_G&1eAX=Fj&3cvU*<ocMx@>s$b*}5;E@xyboAQsjeT?9>YEGMi&VNy2A>hr^LR$
z7a4o!IOJOy(bIQ1L8!jBq;qwimN>=d=~T>#vz7sZRFsG3XijrngXf1Qb}w<s+?;!X
z$MT7RTX5h6XR&H+Vt&els;+UjGVO9P-#hu6VcbS_Tzl&HPyRDdty@XqZ!ys;MpnfE
z6otIrpjfX$oR%(k>;s749E(VzTo1Rs!JBt6-`^jh8#Bk9B&4LeZ*6ogTnL&{v$D12
zZwYyKF68WZ`AhO$;~vWrID!^NFTH`#`MM2xw63nzpC2Ct)9^zVeeuDANY=fvE?I8x
zm(I=?7ylB&v=BrrSurWVS)RXs9bzRZDT&Or<3UWDE1WUjgVM1I^n%3g>-}Ytm@<O5
zkaT+N&fdKb11W1$+dwJ${$2Y?GT3vNUC(KMYJOaD>%o>BrZK3*Zm-V86yMse`W~zu
zP%|}LKZKVahf-K~k-ZP5PHn@_NNIUBU&}oti<dR(-|<8D(4p{N&EQqse(#ZdabN63
zFAVE1&v}8}&^KWTyyfg%F?zK&*F3tmstT>@OH7;~>#vT)B{jzI9;4E>^O&5NK*9#k
z<>avTgwtu1EJ&g1m$(80v;=WY_6JpCI}?kj6P3%@Ej`LM?wgjD2k1|kZf_A~l(Vt1
zapMJ^0cWfTk?uT9b-wz>cbWFL`~2z3ul@Mop+DIX|C#F;;=0-JDxFWk({c-~_vg>s
z(tItBg@J)2brhyXp9qiGr%$!vNmnzYi?u<O3Sni8qnJe{X$^_7+De`l47!>Rw)RGj
z-%s|n%=T;SyTeyiT@9?E_i){SWz0yUqZkxJdP-a@%dWiLqaV9M=HEdg#uF?r+T97b
zN={BVjpXs;B<=ij4ct~7?YiE~1s^jwGa{h$b+otBob85k)bF#+QR`yt!=uhEU^F=4
zMwkQcYWE@ewQtu2K`Zrg@6ztVn<gp9W{Zi571{lGoBI+WF=qZ*jDXwojO$!~R_p|m
zgigwndyf#tr~zj@8lshTzKXidbw+VDS4~t@RA9#0VEEo=TPi`Y(=e@+Lh|un%I5Gw
z3S`q^WLwpA{tTK4YPaKT{Z6kMyOuRs*OnV{J4Q6c+lu6+3Sn#EF24OcVM-%}EJk2k
zdL9WTsm9IA1TEZVaA9qc5e|8+fm?aCJ49)gCcmA9{nKqQi265zZTA}~oNNP}^X++y
z=&r*Np#2-O6vnf5d>+TAzcl3M<(+%e_u&r9LQ(rpkYmn}Ixa#M$T6uUlai8xyj1()
zUSq1r_QOMh5JPI@G5^2})qkTvW?R{4Hnu-bK-%k)FdN&>_BX5(ym7V4#}!+Xgk63K
zU=A)b9^&uWl~>;8QZtAlLS)k3vE1TfQAL}`8pU}5JKm#5j~2PGtJ+#v@ES#F)0NAd
zTQI?i85$NwlMXe4b5GmgvN@*qp+51hn`^?q;#id@nHeNp$-55~l=byV;k~+N&zg>P
z3aj$2iR&_y^;xq+J_#ppY!GY^w}1P`{Cr+eP%u1fI=du)G5A3uu3}+fp=>@aBV%xS
zUd{2O|I4M0Fh88Hnxp}t(NSA_^w*c|L+|j^Bqqg}hVOLZli#Hmar-BrRB53hLFL|0
zBfRuPYj$ws2ZjgQ06m%DfiTV^YD6#?G<y`zk+bagS>~3I$ZlxBySCV2U;}1@Dq+&q
z>F?h~ayM{geRAf_3awjqZEAT{?+{y$KYm%9_=Cs~d~$Bykl;s8qDAt-pMri}*Pz;(
zmDQ;A+7cu&9(@LKIf00Vyvw<9A&G)DPe&R-<hUAHWhKaZ7x|lg^4o5hD=OA#J$aj(
zOL1)1F3x_#q%*eeu_yju7VCeAWzTs!0bS13BO&0QX}uhb9!h9;#zS|IL5Q3q6G<2)
ze9%#+yr$7{ZIXlNn2$uxIo`R`Uu2)-`F_8b`S86wzNjZpQc~u&`Q7bYMA!QcZ$387
zInu>zU{^@Q@!nF+&(q;{c5Lk{Hn#0~uVipt1$AAV){+{}g)Lt)6OiW&CA;06Q0Uug
z%UetL3<JaQ*x>Su=qK;fnamC<?0YtEm?e>Ge|H9XklM?aw^^R8uS#0Ar#u(Iu=VFq
zt>IunV14=rIhB}G@ZxZ^`FuIMd3kMXbG<zpQ|OX&yBQ4(N?%?}Cymm}m`<KaPpY}0
z4|B)uyuXfJeiD$}ckGHMi-halwZD4!L%3_(;4R3iy3ENi#3tvzFG_&-iH4SzeMg#A
zs$wW)i}^l5n+%jHbXCxJs(d$^d*!#K#P9r3)6h_$mV2P}VJUqN@+$cg6BBf0n48Lp
z1A6pq&q2;R+=}wP9O=T)a7*6b)G{<W4QI0^`q+*RHE8Goe+>-|-g<m(BOxg;P<f)`
zdG*d~Zn)cI#h8TKD=MyP!l_76bx^xJQq{2EqR!FY#o0OcjERYfP<DKTmrCIH!$;3=
z50`h4MA@(RW?oI+fI+L>$QJWv%r*Tg?@rl(G}C5hp3}IBiHe`v^9u)Aq?qE4m^K4F
z_q?v7a^iD3l#nVPt!&q-+S)iitHfGs)y>&I2$SyKNvW&bZD<(Y&i}Dx$Vtd)cwbk-
z?AEha_Lkb7H~{t?+FBX<eB=~7DoW|Qll`7QA1S_Nv3o6tCt84_50)Ya7Z-&Fr473r
z)@ITA^rux;>iNg7y@=)2T0&+Mz#Y|*s<<{M*z{LNn<w*<PN0KwA1WX_bO^=LJZuZ|
zbV0wrX6>y>e{0(ll*JLlwZt0vh>VP^ulUw_wgDknGbgdDUW*q^aNtP>ezBul8}nE0
zjrZ^Wi&{V+r~c8gfnNgaUsXLldr>;J`|5ufrC?b5v)n&cS7uUhXIe_=9Ox5n+ZU+z
zXbT$pT8~doqHj5UYm~1`C2#k0TK|it?rnl7o~t+469>;ndLDACkK)QG$q4N0+un9z
z8O{`}d2jvYg0!@e&_lN=#idf)_7u^tUrXFh6Su{SI1NY0ESNN?iO*#?cfqG$)!)ye
zV=eR=y%g=|8VF*a2KTY3il4malXQvAtlq-5_Z>-cT2YY}<`kwmqjW^W+K^dX4_w$@
z>dARG1#?R(B7=C9+RyQ}+7?2^t@-e9$9vUO|3R~zeh}MU>Es_hp_FG&O4`vQeZt`V
z%+y~jqkn;LbK>#fQS#KG?m~~{%NJkk70Eu^&iqg7M57qlW+Uyhwe6!qB7BC6OPJ?Z
z>4r@}9bgdcUq>yTj$caousR%=v{6Ld*2XR!+E*+izugE8I_vz^t5;*4OfAVfjc3O8
zdl#R(bm>Q5nep|XlYB0sN_AWyin1}ldaiO@eS)}NvbH+nAqKC_vy3iAC5LEeo>Q$c
zJJ8e-4{`6>wM#GnuH%gyn$*E}oI$F22kw*0$$i2{G^;-{EOL4?osQ=0n#Hbvbww1r
zEVm3!5OP)j54hz2cZcKuH~&V(GPTUB3}6smLUIxSuJLttHZ&L?5?-mzb?(VYMo#pR
zMx?WU2CHAeALHi}%6PUY_azWa0Mzk#Mk+rthh_LZG|0bY<@d#3K6q~i%^cy@yjX7D
zEQTZrAY;4Q!|S`c%;tva@wmbU43{CFPU`dLp*$Ns_VbYK91{2YnO6E*A=I)s^X~hL
zOX-N3K)0HM)VYgdqzB=;o`Q*h7jFRvfYgWp5dlBCkqYvUIGn#0Elk@}Px6BLOWYna
z(NYLVfx1d6FTLwYHqW^mu4|pGjgzvogNi3k*kS&WblSpQzA8?r6cGVrl3LWX)9RGC
zo=<aKg9m=%t*tl#mM17^$h!7z^@2;*`AGJ`s#1?4ctqij+0CwYF%m=x<SsO__1z$g
zVoHxH^E(KjzAUodJX_13+bBnr{-aA*0Q|WV@Mq+W^YioX+_B%7`YS2bB!&Pj)YWzQ
z(@WX)=ll0~xra+I^!yB$rdeNc1vGEBO7XjQZ|(cdP%r{Jfd8;azPG=j`U1I;c<EE8
zn3Vs3Eg{>zXL(xsz|E}{LCQwZi^=@*Ed(kwF)f~3_IYpLPv+=z@ltbb=wqCRg_v?p
z^_Nq62)oX3U%Qq+Je-zqafSU8e~ZKR)(@QeyvM0O(jXoYvU_nMh>ZSJchhU2O&dZP
z;}A|_FX!P4=#w^Q6u;ep!W-|BuLV}Trn`V;aWFt-p<p?#cW?Zm+K1ae5U{;znc?9f
z-LhpJ7IS$|;WW(oKxJg?I`5xlxT&S4wu?q~1hmlP^Aud24S*cf6(wMdgJE>{C%ID%
zozS;JM64_=Q_KvC?9AY}3Z~{owu!IA)LfIaaH`_o4-8PL0?zXs9VJT8%`JR-#`bcm
zVsk`8_4UgbU&5VqZmqs?a^N13M`V9}7Fx@>;-^oEbR~%gb#=vDCf@@X@~5|$em|*`
z1_pjMpZuwznE^8;b8Tz%61lZdLN&qzE9>iKU9S=)*TqFORFst^U4D%h-i)hKy!FXn
zBR=2Rs*!@jTQ}D@^0}FgPIX-U`k>sxQ{G`RqyHkCFGK;8u(+^5UY;@xf4H?ZgQb3G
zX!F(6PoF%geop>iaQ1f(t9;YATI%TEn)!IXaWv^9g~j9#kGrWRX2ks&HX4~Cc;Qm}
zSr)(2xFt&z;;;Xf5qJ|cU)kA<=)WoG=|%rXxx4LrPj`3lX;woe(~T`JQ>2R=Lo4pb
zQ?{SpHMz1vr+?vU>4=t}<ic!Z=ltG766i2YuU`*vW!MXF=FX`agldUXSV*mn$66#2
zQoAZn-fiBxV?=wx)S)|dK>pFx*jR9^)6a?<+*4m}%8WE<7?qRBFN7?4{H&mu3m*UV
z%i7ZNdS(4f_r_S;M^RDPHzG#2|E&cWmWJqt(=3mu_~1QeVsfoSH~$6iuctXVMVMa{
zyUi!$<v9f&K5CiR7Q4E-iZ=>TV50jX!@lCPaq)^&7$1V2F!}3?0l8x88g2pF9QLQ2
zn#u(wTo<BcZU*eX|2;a6$INlGi9|zV1l(iue#*TM8<6nX%?2A^HY9E1)R!Q-#ewcz
zZG|swb*lQ|xVV-`I-l6f@{Lm-eI?~>ZlS@!3ZIV03g`;KymF9?Oyg?nw=BJ|1GB)C
zs9wQy0uAM1W@bWRVQ5g0HRS!O3UyOswZnyE%{+6Tf#1Az<qB;hI$^5Ab4x3;a%glz
zg4~UsU(m>9N}g|s2?qb>u~`l}!aS?b)}}d;S~a5%Un*Ky=`~B;FFE=HC&4ULa)@5Q
zCdGZR8$-NzYOJUFa!o!@m$%B?$kKHg*7D>2_<5cz(U^HduIjE;!ED{dAq|^ztZT^u
zF_xQaF-l=m;GtSA(L23zK7|7qHXnuGH6r0L8lutPd$i!!*8z|a5yIVj$|_ye!yZG6
zCgT~J>MCdYC$FSk)i@bhpx^N{Tfd8hi-g1xM=+<@nj~{%?Z=g4H7*4HtYXdhXVT(t
z`lfz_<iTn?IbndcFku2vUdqSnYXx_VW8@oylXdy|ZRI}=s$p6o?XiS&^bYx6i+;+I
zAij<~v;DiRYPIW<S`9s6P4T<6fA5|^ayx%tVn{FNgdc@|hc|nuy)s3JIr2rNiRE|?
zwmYajZ-AYpM6al?(7KrYb4VudcJ)Veue<BLzFe6J(7-B%eI53^yE;DQn{OU(Iod<2
zRww!=W`&x2fAA?+`E>m$kSp5<q6Xy&qW<M6f041zD819q$@SAS(8L*O(Dd~gS`M|F
zDKU$Qh*-h^hG<iDm3-760!oOLewX{BkuMTFPY+m^ilF_!<qU87h3k>%*@FDQhv2_f
zbKy(?=b;DZGKvSaNMH%|^XVuot*+>d;T>zAC<T8}M!xu@kkDby=Kl4nDq`a1VA>qT
z6jH8+1|GN0-tlqEfoYn9jTh3nnhT<$f;?m7r9L1)IT&$@n7E`O^*fD8fJo!nyMhwD
z=Na$VRCjhxwR5mZ&y}r^du<a28gE6yb58mCDSJl~xsBYJzTY055|z3HX!o<x?_HwC
z3ugocm1!DDqjZnlt374Lx4FSd^lp4_ZH>1KJALHYJbm1K6r4mK-4XXXC*|u``ia9o
z3AYFPd2hv3y6j!X!6$;l+XIybnJDsEi}ybdd1p|<Kui0mHbL+c-hcq;-M*a-Ek701
z&Wni>x~yxC@(Kzh9n%MVeM@Bd>*lPzd5*Xz4ieWy5-TT(?g|d@x_<JkK<F9aqoZ<5
zmpE+At=C@i-ZU|p9#q?}lS?3$sTYBtcHh|-85sTR2ll$~v$GfYY~NT~3PYS@X3qVj
z!_R$04+f3C>NjX9J9<*{e*66SQFBC(z!(tPY<|9))WvTwXAC)@{3a~+NO*N{T%GML
zHzV9~KK+B)9QO9g4-3%HfWd!6$ddC#^)xSQ%9pk_&|fz&QX3va^A_4*lw<e_;i%hx
zdavCcqRQmX(>Z@NhF{Nau*wL^*rTMZ)SHiEV}Ffmwl-wG{!hM2&yz$|fPDo70u##f
zuBi+rmu-rG5&H3AxjG{@{K{9olhtC=gM&f2{2`|RU`R7>Ms!!QPEek8t%a@Cx7K@e
zPcl20!s>h%RUY*UX}o<cJg1$M<!osQtQP>4-@)4vtFbh0r$?&E`SXh`1|dt`vXV>M
z@o6VHIF3l(Kq9s4K1wbGMlsU1u{SEdGrfgqU3(w_KD^5=WLK(DLR1tdc_fqkb3m`4
zGHow@bK55-pfB>E!B5=|<P}|wn>QJ6&8uZ*HgtEtH)_*w$Ta<uDIDRg$QyFwx#tuW
z!}7;*qC-p~OrNEs4DI{(+|Zdy4-GW{W+1OAB#ziBNwhZjQ2U`Yhh5_(J{{D;P%tHd
z3SsN5T4@0(>*O2W^F%jix6BWPtIW-(X8m|;%VF)*nz$L!t5BrPXH;lSKd1L!COx*3
zK8LiZDU3i`hy*?gX=>Qd1|}!Hwl<DCVyVbG<f%a$V_@1CZA+GnzctaZs;v{w>~*s<
z!!KfOynS=-)#0>$=PC#4%30i}hGm}22A=XHNKjX}{GJ)`LbXbCOv0LdEw}D)GW+!=
zEt{T`YE;b3zy9>mIXc*(q*1j8D;fF3_$N;a?0%3&zeZVOYU-MAp4HZrI)_;H`G}=h
zh_Vj5Bluna^wukd|Ix}EM$7F`QsBMGGj(XrbdYv0)Jz`o_U&`AMR+@n=K$)$B=Tkq
zob&s`ykbgUI@Q4h>M6XLgP0)PkjZ`xABqtZ+Mcdn`>=D9`&ASYxiZ1U?u&UF!&&X}
zDfP@}Y=ml_owSA-jg}Mx%$qhg5;otpXBBPT5)+Fs1$6vaKZ`Pj=(w?!#vd<J-<eC#
z<{DE5He}QjB=cWopHM!Zj;RzW6i1bdA+$usI5Gi@De>NHKvL!BT;!7{@wP3*`ZRO-
zy83m_E-ut!CsL+K8C2394h@;yddyaIp~!XC`bw)f#HF_O_IfpqFGz?{9iQvsJ5}Q;
zSjMMEV<Ju$Uo+D(TyIjvlEVoE>9?~or+r5cxco|uo>6FizS77z_`78_uCyIEiE2MC
zVd2$VkJp><o?bWA?#*!cbFbx?LTVG!bnwdkHXTkQ1+)Sfls<|&jQ`Fh&gZwSnlD_G
z783GsOPVj%c#l%OuRL6yy3SBTy2oLwbYi<$j^UGRcehwT9q@n0ImN^-Jc-zTF-<EJ
zmnZOtmveo$d_rl<m0jWw+D~sjE3?{@0O~}*_(T5#LO$=G5Pp4rC!8sSUr<%-`1>FJ
zw|?W_!8GYKV}<qM;bE4+)+JpX9hAM$Irbaf%g#2;H@}1fkcE+P856kNwu*{37)hzB
zszUTt#>gx>Mgy1(-%4cpkxw`TndIlspJ2C`cU^_30&u{wW5-COPwCh2^YM|+>Z)QO
z0mOWX>#W*s$1`Woe*5}$>jJGzgESY{bAr#4p1#z3Q>>Q00amTsoTpE7tg9fPfC$XY
z@^akvt$t}5Vc|u9iL0xsh8_21>{ke;sg~H)u7x&kGiy7#2!o*q4?aP(txiWZ4VNIJ
zw0FtO4|rZD&@fncI#7`6p%&75t(~2c!Y+k}72fv6c01?_$uI~5LWa*J2jwaDgh5Jn
z_MeG~t^%vm>Y*4)V17hmM4UViDj1e{RHtie0CNHhxe0j29pFoTL+rxH9q@VhQ$ZZ^
ztJJKJs|$anmDAnTWnB63V=j6)=uP;Uy!7>7&nS?4>X-gXPEF;I!bf(;b9{1OXlQdl
z?g0DAdt0KIMoqM*iW^&AM4y1MgcaO7bEoO(V_-S|4LTnpnVxP)L9{oZYretoqYgdg
z0md`>D{F8c-r3sN{Y2s%8&vp%x;3!VqpK6CrDr%}Qvg~%Uhjy!;iAnS+BgpEgZ~D!
zlf3lFZ}uXdD{p2vwEvX?tMpgFTr1ev#KZ@?WN70OAfM#FeVcf88v0SWMWyfT@#8Pi
zh)+O%O2nM(H9<!-vL0(Wf<+B*hGy#IpZP@_)rQ+gp%|DiNMLweEt=P;pMJp~>-w%P
z;_@qPhMH=ITnf6PZa^X`>)=<lm=8r55$wY6_g2PLil=5~0tERT?hQvr#j23tw=(_r
z5Vu?U^<}<2RS7Q(`jgjLjpY~4%mxPMye}?>`L+7<yxr1n!NfP_&A;Bgdxt4Yflb#h
zkoLx3V&ta0vgW-yg6k<x(ogDdiy;Lcxfi7$xy%r$Hxh$wZFg4g%ng%-ya^a_nfwZ?
zJ}omd4a(@c$WL`|?79nb;kkJyws&ti#k>rnI2b>Qb#!n~e9K9)dAdC9VXP4!FXG6q
zR!%`N02UOsdYqMBfAAFUwpu6-5AGXcuh+l?0*h5~5s{Vtx`ozUEpOpp0lvs&B*$nk
zf^52PUBgD+k-{a*K>6p-A8ir_1t!|CKVP#RBYiO_G0v3wDs*>}^fHzgv6(+AWh|C`
zzt8^shucSx##+W#hV3u#f>n2Q>74n5!CY<(th;FAPYka&x7uED@WR~v@DdYm)fbux
z(tBGTRkvK%7OZye%yGEQ*2pbB;v|s@(ejYGOxGa#LBddx_4gJy>8nU|8Xt^#evDDb
z@-9z^u*oI_y2dghQM=uLb>g8!H^?M@+qogSURw_O9C^1fY*V-N_?Hf@htuyOB8o77
z)Zg&t1_$y6dc{s$);oV`sjElFhyDQq8sy@d@T51!)ucv7Nl+!hCGM=Re~F~!{RPrD
zccu-QILLmrr#=+PfH^GC#o?3xqFc!;?eL-^+Sp1)_OMJdY2q#oif=Tpm-1O2N|>@#
z2eW+*Ck=~&EjNg^2)kF<lf!t28)A58Kr#BP&E`}ej~y+%Z~eYtqVuh<PgbA$jBn$v
zuvvsl=N?;reNCS?cP)LZ1UEfSG}xK-bYt;tXRTz0g`El8Cw^CDGG5Sxc<rrXIP)R|
zb$Gj>22onP#z1s9O7&WmmYm!y#RH3_-RT$qx}Qv9YI_Lv1D;qMe@H>$uv^I2lOL(H
zdO%5iY0p-2W>Dyn7VRfQA_J=Vco+f?KRM*>eZ|4<Cl$5aE#!PeNCXA3-|J$)k2h2K
zff4G8o79YaPrex62#evehdoQlgW>RDc5*K-1Ta<kBS#_iV5Y|DFWb(@eCDDWf8;JW
z49+r3N@S-ng_56GfY;&UU!h_?Ge6mcRPPV>85sy!Wpr2u!jC49O{wL^=eoW107duZ
zM822sXdjX5u>5#`HA6M&2UmeMtoCP4p9aralR)ugV0;`PkZg^&MnEWc1LGN+yJ?+9
zKASNS5qG~r1eKU}a+LgT@tXKs9+E@TUHP;mL--P(^|t4B;G}*t2h+WupC3ZDd-DTL
zY~3n$JbC$&Ue|H<I2rxWx2>&KQ}K`&&Io0Kh6>2_1foH6^P^*LkHv2{#HfUYkqH=<
zRBbFRQDb+3&+S7K{YnxK+v8VPR-V->_!eP|D4$#WR28#i(>vn(qFykm2Oash7SP_-
zbkWIzLd_VMVEJ);*LGOqMznV+HAx?%>?7iDAIHbzBoaGy>M%zOj<o20cRRh0Z%(;~
z3kv4GlS0zPZQHy4^SgJh5|WOC@^-JP%QP~smf<|FYZ|DE?I&ljQs?3es5?x{G<D`{
zpp&3gk;k%K*Ap}i)SRLc%6oSRm&y{|k?+Bo_wfee2KlhN(|I8uceCeh*7wa8GQGb<
z9M8GCuR+}>P!jgkRP(H}1!z^{wydtLB}6BtsK=HZ>vD{mq*BC&j5A)mSo>xawe_HU
z8^Q|n^}$NN;O{h$zxvAs&adr=%dO7HuoSeIh2=s2wZjo{mtVf$l`Cl07bczp#)35Z
zYL+wXt`WWGKU1ixT)p}eT7rSW%|^p&1_y=iH#bbItuv=8&-Wj2_k#HG=tnKfQ9r5l
z6{_T8bC-}It1o+2=pw34zYt)`g_(uy6>4GCI!c~65Kb{}fsy3lTSn@!ihEx77d8MZ
zVGzH4QAVZ$Zv!AF?$7Vkx{Hf!ee)&)2f6sax0G}|Y;4|n;o{G#7RNKP43epG0r?bT
zXLS4c_0FV*4QuMm-IZcX7{b6rQOSoqpiGK7`8sZqz<X)*r_EE`Dy|7Vuj^zNg;8BZ
z-&#=D_b1&*-CisU`qSV47O#7FM{zfP%juV)3^>CfENnKVt=w@3Q`iWlk1^dfH8gPt
zoGp?h=jB3U$_w{9x((HYLYh1tETWJRge3$?n~B7l5IK<3S0_%u3#B>}#(-$0VhQy{
zHaX5LZv^Z_gk(F4nEkF(5xuNCL=wf@X{+Cz=bMg?iP}xSkmsSEtiu#)0;|r98%|Dh
zu;`nOd~d+Oi6V}5r@v(652?i3$4NbjoiDHL-T4uR*|Cf9cju6{KX61WO*OR!FAj?F
z^1UA^6`gil>FztoD5ksbCk}8YJtCUgi6HARtExg6EU*nh1QD-JudYi$mf!Gg&rjxT
z`wVH?jq$&K9gs%B5%g{Elh}Rq6uX12%v#&MQeeWO9wmvMd_2wH@9vCh5mn62Rh6Cl
zVJ2QxIQMO@;2(Jljo#-7R@<D92>DLO>P{zU%sFVUE*bJz*yj7p%Ir{A5&P0MItLay
zx`4hdyaizb*~aW?Rjxv?!H7E2s-|InMI=Hvt~BWTZk0fL7aTHz?BUU(DHiG$B@64*
zJ^|k<kfR^^{q(GTnd`UXQEqshCJ&l0lm`40OVrWlUt`Qz*9qJ8bg!e{yE3*vwPW{#
z59h787VR$H&#^=-dj*5ZlUuB9XYc(X%^n!1Y@lV&a6v|NDsTKY1om@f#1^}aH9IwR
z{_OdbpK*M}G`~Mb+HH<%_JNekFHXgfYN>eE(ku)GSL0<8=?rR-alD#-l^zPi7IKGm
z^g|aFm1s>8Pn$PY*kIV#?0Clcg5X-v9+ikh4|w5V2-|yD(@i~g%HdRM!?VN5xivAe
ztZQqe30_s&QID<>cBh$!JJb`_jnq<%yn6=@YGArlCo<<99X#QS&s^j~fAt$V(e71z
z(U#-2Ev44vl<Z{OJA=f1h6^&ot>1Q?+(sfHf~6tvjH&+IJikf7JIe#aR(kB`vssV2
z#WnVnc|8=NVA`O0YAzckQlzA$^EHTrB-#sbX2rmdH)+O6o_X9I??PPAT4O9D<BD|E
zy;PZn5EA`6phlP)Jv=<JL^x^}e|`DHp{qZ8T+OVbvh~>FgwX^nK!e2ZpWRQJ$V}{^
zk70BUi4;@NMjm;W`g>R|uVWh15Ks`YE?-zJ-AN`XX|S4@mZC>7lB?Sp)|+A>%kUQO
zzyq^hh1OqA?s^afHaMT8-fW{rUe50!?JAPA=9vJdc-DiOZAq<ad(BX-J;c^V-T=NI
zy}g<0j=JbeV%;*;U$XmXNO-MLop67r9&{z&hiR@6mEkL+@}2M}!SeGfMPa{cN1C$X
zEHP`~-B0pAxynrFgeW<UhPIp=VOI{%6JW1Vgc!nf^7_y3xh7~@9ts0Wb;*<3i)gko
z;4Ec0-3aBl-p9HS*5>>=TK3%gr+?))f>U2#mUcpqJUq{T4>^6RAY>baj;kpTqkQwP
z6?5sWN{7>k;#iv+hYW3xzPj20UN+O#vP32e%2u_I2(WyG!`kSNRF?3n(A4GF{&-LS
zV-AQ~68ZiMvZvcJT5+piw<O_6gq%mqDV>ofz^|oX@@RYUnNJ`^5{Ln)HTM4=B)Gt=
zxRg%Nn_L-`h~G!zcC5S;z=<@Msmrm2W~ReTk``9NpF5<yCZtpfp6V5synBb&$x^e|
zl(b^u)%t3-Gkf>0PpRBU6X)X-Qej)`M{c|Ft$E9nLZ^`n13qM&9JN-ecJ|(O9`_y3
z%Kk|?zGav=HMz84^k8283HcRsL?U`yGWbjv_XR$mnQ`FMiCjk=oD)B#uBG)U@R*V9
z?ukRfHC3JrTFqmcd3Cmh_X`ADOk|16_NFbN3d3@)kh?G^(g~i3joDQ9`+l<j-Ry+_
z^{(B-fz}g4=_)$RjFr?F#xetnS;5Na<l(A<#|+C?IHj+|zDf~k3t5)+OxPTXFuINH
zXXn2Su-_f7#Nklo@ofG@j?u;U-L74aX(%Y}Whgvp5u7>K`tj@6(MrE7?FXEeL<q%T
z;1#p!2Xu;`i+pcUqY5FV9^M~$rlobW?BmCeIvp}}%(9J(e|~HirDv3kR~lefXk(tp
zPE(em@1~YFZ>Ad1Y-Jz0U+_FEJp56=2JrAxA0mfr6oM~go;2>~J3VHglLrEW_*w<r
zUjg~E1vWao5|Xz@A(Ax{r{uhNMn6vAmOLTkg7D_W81Z=UQ7<nq)#lf)rOckTyMx10
z@1bEy4YO6a;x6Iai`L3>du&g?cr0Yavn6+Qakzea^@T)@8pt0!-YkM=>v&@LRwv?q
z&VBynnTyVo?G1T3-M~K?!mcrTNq3>OuX9}JA?QM@V=BKCUXC4K&3E#cztuxIoIMj@
z7_>t5$@D&_#VA{wPZYQ|BJE|R!*?2(r99(%=&6~R?+vJ@xe-rXJ(bsDyo%=Q<hW6)
ze{gPYJ^Hb!DI0{(ygWS}*4X@xYa(q|#9GQ3oaoov+QU?D_jzN=I$!1)6V(DkjEd&m
z!b{VYp1KU;`v$Uyqb^65`X;mKTT4hv`Uwa_kV4O5!qnB-c|bg{<yQa&M;_C;*jL7A
zHi(to*Wa%Qt=F=ZZ?Vbk;n-<oXP9Z;tP4k3lZQnWb69+-9JxT52?}*AG7O(xkf5oG
zXI!F53SOb2y(qD`v_vs3es@QEb2B3EmppZIQzWeknNO(?tO@5ARL%M?DzFA8roGnV
za^LD@37tS)pU)ReDYG>469pKlPZ7sln_6SP^8JtO&R<Ngm~H;X^DJ)F{MaYR+3`<u
zcgk$Thdk4JcbPY@z<d^my}7lD*hPRZ`{lEp1@TcYbw2OD*FD<&xZ3`&XJpUZKB>@s
z1-pD0_P)t4uh#!O<(&UDHujMIYW(KpUHByx4d9k2&Y7m1on~MXbEaEWUEm;;Y*X!6
zkQ+oRaDp2kw;{_W6sz}RLKuYAR;)1;eLyC8`xNK!Z(t1Oiq)};P_@UXlyn@R_Rey%
zRl$3`!+)RY`$VE1J;IvT4-NyBu-su5L~`60g$e0Gk}oqALngW~0sVJ7RHx7dIEkkM
zV!(ag+u6w$0pP2YW;ek}q&s87-BJYRBx1x5RHLEK1upMP?k1x<c^y9n=;d+S><JO;
zZjZeVMUod5@O>`4spaAEur>QkFx<m78L(-Jd_jfb%b{=}XuiL;b{);@K2nO>Aui4k
zxWs~06Oj5E-p)~BJ>synA-Z}v<nchlTXYd9gw9y87Z(8q^jL>X_O=GoY4ZbpHHd?<
zvGA!(n{A8al~|3tu#Q$#-}tSo?7h>Zx9iTu5?Lk}mRgunK~D1@h2j0~tA4-zV-9uL
zfa%8c4FW;#1jf+>ND-D0(3EGsg8}AV84+F+GM9>dwhd9Dpr{TBCmEafC5e((UZPZs
z;EWGr<5R4VG;3(Z^04tgc&ky3wIbQvwwGDh+F7dTgV*|7EQf&&k@?se-PkEnd*2`0
z12DB+J=-p>@RQe@S1ZE%>5h+%gbJdm$?3_#7&43Fmu*bD@cIHW(EC6VylQ+!4N(!S
zs~_yqIz?`-#ISDuk)7x;Gu?i3F0G(3I+rS-?8W`Q%3NFm+_j-G=Y-x`eKrpnZh3r`
z_SnM01l`Z4Qa59V^~A9h8x1$d(XZJC-%35sQl*S?JZ7)^@z-6I9sbUM)Kq=djUXe3
zEg+>MWin)EEt)^G@~o2|!qxK9Eoo8EiGx2u#s2WevwI$4`6F*#mz;8An!V!!{QZxf
zy0XamE5+^WmoF0lj#zBhrHI_NF}b#L+td$Dnuzmw#EfWh=_(YmddDkmLa3HEpsLV0
z(57)zuUs9j?HrdLfyjW<o+>T07q@ns(5UKDWQM-Ib4&%Oy2Nc>k;WICo!?b~Cb)Y(
zN{6JphRh@;_6xRC+`H#iaDF5WJ`KZLC8{6GWb4%yY524Y+!rrYH5eKi0@^fZXnPwv
zoKcBud&NDXDsgdX&j73bvIi?_5TPJg3zYdXc)?|y<g=yYsk}uRp?4k-XHFI3pnv6h
zgQ>S}%tBl~g7b8p?c(DzUZYL)SY%C^Rz%f!NYG+iWcZu3eV?cP<#wNn1qf6T?#_2|
zatO<Ek9@i?vt`19-J-hKSoXUA(~uM6OJw(T^1Wlc`o-4yZ`>C$2o)O6)Zj$|<=A=q
zd6d;@E0X!WCqfpQub&?XmmURx^N~pQ9Bld!B~oihIw(&yN=o1TN*QQT)%&gvUDs~M
znJ1$8s$n&VVEW;qY-v?g-F;H}S0roc?tRosbzk>Et+Nl%jNCZ)qe|tSW}WqCTs`Qc
zWmcbS@b(-z!|1Q%5Svn1DLt!6=rE)_jt*<<Af|n{Owd1soXes$j?zoTZ$54xiY)(~
z*JeBP<u81li3X09o&8jJ<k!||<4ATaw#(mW@lS~u!M>UkucgVJU?8WI>L>2Gax$UG
z`pXko0$kET{~q9N+#2Qhn6#XDok~wZK~!b`rR^hm<)e$Emrg3W<f&)(X69oDE9mmN
zIiMOQ88QFzzS{P<cP+wAUuZ6N**ae?O)ovH2d3Np^6;j)!@JrtHJ(NsxF#f2_2FT*
z6#Ew62pyBsQRd>iCE>dtl7j|wTeM+)D8gd5luzrwwSb#9X_=V#`re1yj?7;<mSS&j
zY#c%^Uw78#ypB#W`Sx8VYW5Iw#5YZgKS@cqks;kax^#9U@6o2PJ}>VpUtixT7o$Yi
z`9m#zB{#3x<qz;x2WW=HQLHwcTX=es&u#(o^m2I*zP8?8DK9yCl47{eg8KWn1*S>7
z9-d4IdUBQ7hb(SxX|Q@eS?*zDnT?jrhRFCj=l*AiCK?@hwm%6b^x$9>85x<_=^dMK
z%f4l2&o>ymF0bD5A#3oV2a|2~ae&`_mc3p{CoiU<`bo~+pR&F0-|%Ib9nI217YQ+$
z|K9+acl`Tj`@eyqS7>%F!0QD-8({@#JMD28xx6=P;G6-eac`OGp7&7G38-nWNZ2*8
z$p=1A8BmSy23<Xggd<1;WiFGtm=J>9L{C2BR2R{1ZqD`S(KUp6JO`^NR{x?<glVa%
zrDbcV_96>Q4suk$KR18L>Z$lqI-76d9Tuj6I@rd{49KlJ!$m;oV(vOO_gvcCvNL1#
zb9xz&kZNjCplTstW5yS74ol{M;{#O)-o*g$+5^TXc@4Vr2v#Y&|M->6Z%#%$?;g}R
zTeOzZ&0X~wz?Tv)Mo!HosLmseJ-!bg{_ZPv`B^c5+0eavIk5sp@r2|7E`a48UD#+1
z41Rnm>;n^+or9w`e4D;~9?O3*_iFo!<6O&o6owNKF-;^>?)@j_is|0jbU^rye*G5!
z*svYD9w0&+mbfZjy5zMolS{`@bKttYQT?YO_Uyy3*q=Vli*+!I@K9m(1>R&Ikj2QD
zx^Q9R@b2~^a?1ISwPS)u!PPBsUyMq=F+26;Yh4|khOnsUYH#s1@Rc!AIlPrUr4alJ
z?;1ce35%SdH?FKp=jTBSx_6Y_k4lJ$U(9W;4qL>odZ?=A=odSz%t%q4&@CVYtIyiG
z)|tQ3&Q&{K*E3Xm=*Iht^slhShFPpYi8aNi5;OtiqJR8&%+1S-CCb7=3%0JVt{AS`
z+Dui^Bghi`cB!va9EDwuW^*;X8*>`@7TZ{~U5orAS{z$DI|?c)Zt`}mCFJ<h$DX2J
zWp{^ZwjsCM-_I{m$_ps2d6*$AZ$vuP_`X|t@8YANP>Q8Hot>TCxh9W-g3wp;0(f)l
zcY+K7eY?x@z<~j{L=G^6^G&&5(A?KB&xUy+YUk<%fh(&b;wryz=p53inYLCEs1Pn_
zhMA-Jr^ZUnoEf^qb9*qP>}>k}o!IeoiUrl$>MHBq69(NuJB8Yd;!Fy?7V0QXN|3HX
z?u}|cY<SfGe%==%MVO~T-rXJBj(I9A?*){p!|=y0-*mr#!9<^qG9Yni(Abo)QtjEV
zf6-qhzI^#2cZ4QjoP}%2o0fl#gNNsWf&x8J8D<r5JyLUOeBaleUsiT6DoPDIED_Fm
zX{GG=5{q_b=_n`&cM^UY0&5!Ea_oEGx&Q8t!AZ*~Y<&XP@>+b+$&@UG^tXtAX4Igi
z#z%s|OTOd04%;0K@Wc*C+|aMDuP?Uga-ux8)ln+$(-St%GCHzI9*&z%F0A<Gw>|*v
zPM_joE9*>e-Jz$qzLUt`WDTnh{$n4|FSI_GmekJTJv#`GZ9lQGnFL6E36J%LwQVso
z^Q*)*s8=svVh&{TUY^7R7lpuc^y&9!Ta6JTZoqb@+8y@)jNum-CLRH)mf8y&)8Hs_
zAvwB*e5X#O$UV&7Tt5W0#rTu|7X;o?+p;7*U0D)_BRPC{v|84N>p8e7j9_a2FR@O<
z;~x=_=j!z@?@aH+k`FwjL#&6}&(1H|w&B;ky}v@4B?W7(Jz(Lfs!Bur0vggwEW>~u
z9*cgXjS%lCv5m@TqslGdSuT6y6MR8QNkCAL4O7rsEvzw_iI0lnBX7S$WFjvp$Wk>y
z!{3dX+_NeEBdA;4(cACuM@1d335M^Tn0+n1UP~`B(Xbr~UGA;m?uKaw3a^96WRlJ^
zTmH4O@?FBvZ2aQFktlnA3YOaH>Kp80VmysDmf;vjdmYQe-BmEx@PhC^B#pR;K&t?+
zBFFcD&^FoMeE<Izj3OF|;;6%vemSY2Zy-inLP$@_FGx=Gm3{~eoWL~#vpzOAcNQ=c
zEaft_u+XY_fl?CabgXRZMgd74z<mX7d!w^NKVVjeNQxty1<ndC78d&f@iYGpFG`;>
zFfcfl&T~YpfCVr=@6qkwMg2ffC6#WV;zLNo2Gml(*@%&j&0&<8?ki2#$sffx9jC3M
zBPu3F2wbzK<dAd?g3AM5pj6U4M>n7^PD^uGpN8Sg?_qV9udjiv7?EQmZUdqg5g~{#
z*egUqM|bxIYpw+A&zQJxsW>|E6G~!73_8ysK#`w%ZT0pyH(%mwHH<@|aTVUJra<R8
z^c;{B?LNN<Wv%y^cq-{}R6^o_z*A`-fFBIJHxbbZ4-bc}IR9LalcS^CrWpBSndFBL
z_iApfPnQRu269LJ3FQaXGEYCIL%_N7bC0{AgwBs<Evd7$M=;~TgZ^hT(28`(?u~mq
zP<@KwL7)ZSWs@g;#m#@2JV)zE%R_q@*t@tI;w>G$I3>}{Juh%n;8NWu>AWDTD~aI@
zEw)DT7Q0Noh*TwUY{q1?n(X>@`dfp~G1VNq9SEZ`ukQ|b=u#Oc|4;NO%yLz8JBju%
zi#inm@q?H575F)EO)+#!!U`5nF0S9b#d3t}5gMujO$7?E0J2U<eH<VqUBhyplVfFG
z9!y7$j5R-&wrH8gAx(KKEG`Qa+BbGT#PCV3IqO+2=4K(7MwEl1j7h@vjZt}7JYYup
zXdK9xC4`*EPYMec3g6TmbG-^5I6XZ*zwX9%gce9<$UI@Y>f@fi!Dl#?0kPomSP%N-
zKYN>OEt{U6x~Q;F)Zyn(teuNcpt-3O=JeVbxtOVr=acysTLS|F@fGE$JEFrGg!g>L
zLIV&?X^)z>CUTs&b4VEeW4PUxEH^(U@TQ=k_pNR4JM+$~2M>l~;6BywgLtnpvVp}0
z>;YSgf1{9D=-H?$AlgWI2Gq1&S&Ac!2tAhU^ICW*yri+j8c{NAZ@I+zJcu@K!6X0M
z2qH3HVO{F$+e!Zdq@!=Iv}j)r;!XDRxH;5os?mwIWTH8ZcqM(}opxv~`S~uSr>FB4
zWPw%myDNWxj=P&AmMXVH*nk!n`f6`t3QL*ekYdv{B(u>E#GSAeweG9~DYKC!EPZSf
zvt>3?<dZ{la+aaV2wGs4$;Y4N)Z2pyg7GNS-sG8&57tqW&2`;OnLZfRu+Ol%K#)fP
z1uIgY)p43RhJN|q8X7KmZ%xHqj__@-rI-*C*J{jj>WuvBv;{_R7d&~I#Ta9FEkY+?
zxfc}|f1HqT<2?p7P-Wq>s?I6j;%WJ-hYK!Kt<!vVY3x+-7{>ZP!g(iaX=%B(F0F8e
zmW1=bj}-Y!mq0n;s(t?iUBhM0W5)pcgMBIC@nb?>S4*qN>Y8%ZUl9@Hl$0DT4;BG?
zK|I?lZ(JwYmhIqCJBkTY)0Q{X5?C|E&0K8@Mxs<?kep&yON*v=7rY?6S`r{bwxfLp
z@d>gmJtLzu!b{<$UYND?PkQQPCFIL2c*%KdJ(1zB(7s@oKcYF|>v{U*$q3v12G`^V
z=5oODGuX0PQt_2pV7a<)r%-n>B8aH;W#L$)2z}+JKwt0@o9L#$X7NVlohzF>rE4bZ
zt~6Q~nVMI!FyDGDHxup-+OKbkt?GjPi=lzd`Jv~nld=FOiSlU3G=L-ZkJ6DDesFIJ
zw!)FzB5;ld<zK3e%F5akr%W?O)eg!ds?%RW5*x$eprNW7E7_dYLDC_WX(M(Bi)Qm|
zvCyJE{3wQ272@~CrE|#t+#?_uYt-<4hgx?*_CfpzdHEyPG&N;y6;{SaN55jCuHz;(
z=>)Im_3PKsP@hZ;PKSj7yvdKmhf6otm%*euhwYI!Z1=yZ{8!S-%`C)dY?gN?9#@4^
zO*JnnVSI?#gIY(-bLG69$9@<`rm=$zvmAbYeq<ha$-Vk7M02;pZ-Ri<KnNt&kk=3r
zI7E78qg+3k+QpFJ>e`x{j}8w<-=XsY<px_Bov#__>sx~WHywMF-3@jR0-deD-=`*I
z0`_D=;HXwFj$e<4o?g(R#irn8e1$YN#h`#7LX#U780a?ha|_*D6>%1~hk@e4@iN~k
z>KD~|e9s_HL-@fhs_>-`!M{h3hGT2-JSJ1ajQlIkcE4VPtxE5c6=&GyV5ivlU1TID
z*AE5a@1zn_H|#Ok!gc?_gVK@`@{8;1(v7zExq%P`@U2btl~PjT$H!>XUPP6U$@E%3
z)A<smT0?^*@{(9~_fNLU`P8jf&Tk<2bdt>~S=reBcIs*Cd?^i{>+P<*=g64QauzQ7
zlo|8BdOY`8=LCiPw!7a9*Ev;e2Z^{cH#<vMm>Dqs;i3N-At7}sJ-!AX11!f;v|Ay7
zKrhR`+PQP5s5f=a&mItj-WKK1k&~kyJmDG1=fT_Y<;&@_XO{uO!`D($TAC<1&jLq|
zTHUIs34W;6hndNE1Km4vFJLR~hGXiv{m%k{lEh9{ymxueKe!}cOhGgrc0?R^(iPq(
zMgy$uhtuc@)ofU)$MW2(Z2A5}=KomT=JwN%pIbT1h9ice-DfY+-$|$cZRw^-eWHqg
zYXOARl-mD}=#z{rktHMJ2eZbn1FD*NmhG8Xo;_^Q1<0X*PTtWXEeLl`E?LKhuk^hl
z{GIGPeA^Ctbd`^PJCdRC>hk&$HuPyz6F#r%4ONP=1Wc<-TnFrJ4P^E7@Iu6qza0}D
z{p`gHLF>*dh!%jw1S+TLX@myS)wqsPQ=4H|^Iozkms_v2vJ&<i4`Ri``icbBFo4DM
z35+Uf@1}*>+3q~EBQ*848iX=W-l$cpshi#Iwo~R3&{5LT{iyz-ulrY`7T3{^c3bV}
z|Msn?A@hky`m39gv~k^7AqWpuhHjxEG_8%zB>#sG@%Y2gy7iH$^?%ZkCiG+yjEezf
znK|+I{AXs~;DZ<srYF4!60|FJ`ieazP>yQ~0t0nks?o%+%&@JsC6^*V5lnmboM*_J
zb$C-@lVYH!Pm=OFaGLcl8Ht<6#tNIPyS;M^kH(=R-H(R;{TF~*6HKKV`}hR=V=@vF
znqz2r!#IU@8ROK(!_;6%o!SSQ{onR?P0iTXN;<1POBXI(I?~j1p(SB4UHg7hK|+FJ
z*gxORS|%xj42NKd(mxogcy67JU9xYc!c4Jpz%j+NUd<KpU8O0&h1_Db{wFImPLv0B
zc1EKj0@>n>T{NUI*elV!Sz9~(kADLIqnt;NB7ejyC3OPr2#7n}3v=$AWkIj=alx@m
z1@1kZSg1D+96H4RkLMai!wI84#V5^GRYIbo)s2(MNQM-<y@WHt*7gS=Kvjd#D}ebx
z%niXTCnu+{z}2?&R#xKA*vQlB_^+=%=9E*Ba$w-OovixVx`qBvpOzy3<KnVNwD&fk
zXUQeNbb;E1Fc9d&aG0ScCQg2vlyn8WBf(qML1fsM!}`>7v}qP|M&ep9ZdAu7+<Gcg
zE?Qgv!oCXtxPM^}Pg9c(8pjx3aiEaz7qW$xf}=y+C7ONVAAFoOin3tBatK02MCVik
zDP&+^d;69XLJCU@CHZ%z$&MU3Vj4DL0aR8{h>N-T3s1IlZo^TL&o$N5*0^KLD6uNe
z^`f%!*3`dlggw~);J3ufgcQljF{8Nwxz6?FNP7AS9n7KKhm@9t<&~5IDT@_8>6{yr
z&{QBi1`9D%y8p7>8Xcmy+*-Z)_XE27e_>n1e-4y?CmMHOOFJJ4d!~?mpT3UHDll%w
z$q5PWSWAN8yVLsTUcwI|FHM8^3UzYD>({S=M16)DPU_P6^H8Azv0e%<KuB82P;_9r
z{d*s6z!o*>08JRm-J4ccClGnj<o`xOc@&FuzyQ(s=MtagvD|@uCDs-eMa~m>UHN0I
zlUT$@BVC?OLqn5C4@(>M;kh&H>;#M{#)UdGXHW6u;*URj_APz@MczoG7I|Z1^zmDh
zUz=xUPL>Ga4U9z*=;Gyzu_~HCJgJ1|5ckLZ>fMCvmSUgrtjM9nW4Q%;Q>Lt79L9R-
z5=>MyI}m1qaL>cbd)BJM70d;I*CUKP=SM@~`hDlVXl*`Pi#mf3SWy%o;9bz3(C5}w
zpT@98S-BoG3qG~9fU+_vW=Ke;=H^Rapdzt@x9P)LGY^lweI|c5ul*NqY?0Ou*FPdm
z7ymYtYU>cNq>%A{KsE+2Pf1B>brp&Q1r4^Am0@!<pvz)jYZq~(T<rtu6qKwJ+Hc-~
z4su=s?016*?<={;R0kx2ITIAPwm6B+$#0>Pp|AYsYbcAs=@S|nijrB>anKi8RSc~R
zN?cW!I`FouCc(u{NJyAd!E)cu?BDJ`EAGMUg0`p#HTb@=$WMw6AzDRto6a1IEl-oa
zUd=I-lwiM0lN5B%rPST!Ul;W`xwqdZPzxa=LYX3fHZk47jnGiez{tpZ8Ei0fqa~0x
za4FAUyod;53>wM!du03ff5HlNv+6*&PXkX+{<>h792T_Z>=WRc8UWEphH%?0WKo^l
zvo<pz7mx@jLl@$IeC@aTnwpy_B=P31g{qd<g52KWMv8zTNBBqahzGP_I>s4m1Ttwj
z8hk1Mdb^0inVFgY77f~q)Y=Xd#Kyi2z2t}U0irnyxFA0$LJ)3Nr}7#a8e9wBp3uro
zAym;Ix`e00`wdeWl7;eE42{!E@QS<pdy#ESD|1I3hiYQERoVIZv!D+gKYkqjH1$94
zl^7^KCr$_xPc%~_Il##awx;|J{w)!ZR<oreXV(^Qaz558u>3RNNdIyY^BMHAE+9Gq
z5E3uG+zK<6ux&Ri`D+c-;an;-*uDx6JAR8Ws=~I1kAnf-;?CoAEG)<VS?|L8H?lN5
zgnUaBe6ZWMsj=9d`gF6aE~c`;My#%{gZbLf_GSeWB~_Tk^USiqst5>%nft1$s`v7r
zr~h2<gY?L6j}eVCVeRGa<G<Mzg03^vPXG>d_n&_rzUED2DLXgM@ZQcY8&PSz!BkXK
z{`t&XR{vRUQ;Ov_@jiisJ(U6DM&Ub!2<5|nORxdklJIAb|L?$w$|!Kt0USWswHh#9
zOToavLxtLCe3xC~KfhC{Cqnqe|5}{ke<2d_jGgdhwo9XNEVXP;fy)ucBkssu)R}l=
zs|Oa~`9;<_IpUx5f6ao9j*f;`QwZP}LBZokkHQXn?b$gb*VA~CjqMCiiLJ@0cdp|*
z+_$^t?|{a*-ZfQK;nSxTs+gFWKfYU?{OIwR9mQKnSx{Km(uX_Ags|Jk8D>IJn_~Y9
z{qOtt?*o1V^+7M`17(SRx?d@9T7uc{{_!U}7$#<MCPE-60KsFRc5G@&9}mcYbWQjB
z68JWNb+S8cX=R1kpRAUaz`6?eS!m6;y4)<CUxcv(z-xt^qpiqqnQ6KNP4U%}=!USJ
z_vi1PpV%wY^w;TiuqW_rgED-$>;=5jp)AsdE7lHt5QM18v|K+y%s02x*5_9D*(?M-
zwG<}Y;^sE2r9sLQIc+u-(OoyAr+bR7;B}MID!X>=$`vS?k;P;7ho;@s)YRbiCXM$!
z;p_1XqZ{<)SSJw)3#@R212#b1e?FoWl8g+-eGa1n%g7lQo9}OS$|ld0GKe@_PgOkF
znp8fs<&}2T6_$4BZRka~2{WQ^Y1p9iMBlP}-|X}CXW3a<)YR1c8-yL4_vM{zZ1iz*
zJbPA9;4Cbxk$jyr;U3Z_wR?dNkaGC>jBo->bc|qd4xuqmj}^KqIr$6^J9{s7B>|6P
zx*x69o?`3hq1p5#?{k5;zz#Ey@xJERBEyQKloVs6mnR}3ico!nLVM!qTbu#HCr@5g
zQ>$!>Z^@I!8UYMuLGAd&5TQ_G!#&mclF~f!tUdFfoDGGF2EbxdQz4aTcp75iswON}
zLbBy%cYzgzn_*f{w4Q{mFChG}XR|0TgO(Psd^*6R3|;_&__8U|2aT<+0p?UB&>s9B
zyuD>uS9|yFt8@#}N=S%+QX-|&-67r5B`ICf-BOCu4blQq(w)*sNSBh*aRzHW&pzk8
z+}HKr`|Vm>@?-wyoZm6-agWb!FF)uG$JTSV!{C||(4^Xbuev1F7UNIZy;WrO$!x`f
z<2(BIb^fbIib`L!dG;9Q-n`VQFyY7n9>U_<G16A^%ziHme;7L~KjVL#ffd;~qCU96
z`a$|kH}y?~ip9UR?E;ED{jifKMq0oWz*h^XE`t}+lza%;9n>3sH!#`>3_c~nY85Wr
zcvo?7K0(v~&{kAn;THn~!)hd}ObC-%o12mig^2hHeNt=N0pzWNCJBhli5BAEWTui3
zTbeC901>s<ZoqQlC72+hXWZcK!SEUdlRH$hAQ6BLV0W^cexpRhI%k;!GYmY@ZHGCs
z_h%~2GmDD0*N)*gzn%S71%PwkX9Zw=@Pp?K<U5y()3tmMB*aS#)6<75&Eo)s3Wi_<
zP6(9>=H~Y}*@fZ<0*s*E5HOgWI1ZVd***5Yx}kgwJa7Vrw+)=2dW{|-2jx%)K&pvA
zEtDbSFZBhkA=@2Df!n`fV+!DBW$jQMga~r-#e)P3T6=q&2k4Ql)aA(FwGR><lKg&V
zm!$3u9)qXXpy`1*0^>|z5pIq-te8u99${(b`oe)3L1YT=^(s^<RtV>>iZwYXDfK+;
z!HZL*l#Q|4y~paHm0MkXClcWt;FtI75rG_5-g;w#5(TA-fe&^M&^~{D?&#K+#0I|s
zu8GItI^Ne8;EblB>FzeQvQkPHI)w<BC7G7{y5&ZaeNm*i@2~edcc7R9nUHEu%%kY!
zt&tWSJ72ziL-`tcYy<!zZvShZRC^w>`bvX#$g%kdrdL#CWDt&EhNc7$|Czjy*?VCA
z9>0V?<la-G(p?_2#o-g`5dm!ofS?(KR5QjR?yKG|({;Yy_Uw+**TTIC@w6DJz~cG@
z1Sic%ht*4AN0&9iY3oRgUli+LeWXGV-XzYK%6f@M7FNAxuoE*Z;-Zri{?K3wY!ss1
zP~;(-KLtw0kLho|g@s#bg0XSJNBM?V7=%{8f0M&@YH-pyL<7J<U8w2^W8#F*pRK{z
z6HO>q8Pq;II}3FHGZ^mws|C<EJpw&VO+^Jb5T3wd>WQxqdlqh{a#UOc`XTLS%Lyk@
ztDuEDrZZq;-<t%BQ$1tHr+swuWRSs=J|^CTfI*bU>q{_LbTC5)-GLz;&ln(#Z`xW5
z)j7x69l#1LNZ^@;u0Sai85s}YayTjR(y3LVc=?^SNpvlKg8M}*!r^7#&vAg%76H0=
zA)C#x!+>}Fd)JWz_|<pmomN@dGt@^htnxq=N1L}CwQaufaR#VC?Z(VZeHpH)mZ$Fk
z-`JEJlpq9ncx>R(hKy707ix)KZM?=Mi#nq6t=;*Ij1)xT+|1XyD^A>i5T1Yt*25^n
z=Fe$sem<Btr?<V&o(B_C|KPw)@{`EDt{5tD223(<2m*<UItI!JRG&qfDzSA%>cf9p
z0vx(jAQ&7*_s<1m@d~-Xf^O&azTV@M>>BW){-n__;H{#Of*%Hx<i+ZFum18`c*pR$
zEQCBMPfabU`3xSPn>e?TY)md2DU{zg2{DPKce+qP7!H<xGgVG%*%}zV8duDCo}v!n
z!lt~uI|i5F-x8*BLZ9LlynAdT8Ui^`LgLFy3Qu7Pj*N~72mn~VR=+;d``@}(rUqEn
z%d@{t4r@4W$`U+F@9>0aTnPEQAmfXspSkf>mmsLt<SW5aF<YYD;9lwPXTseNwRFEc
zt5Rp4%hR{kz1zD;X`m-)9~5Xw;qDua7X@j~M8tT)&w!b~SO_OD-Xn-yMUUMsZ-x~q
z*5O=vo0rrRk0r{p3d>85K&4$20dy#GcmJc<A2@gyuo;dd*)=Kgb<Ny7);c9B>J9~-
zR@jQfc<B7y??@D&em>HAWYAxKhrQZyb^Y>OB5Mw|5sQn8q8G$>dRmtld*JSPS91g@
zYp{lL1|-tui70Kb-&a=@nI3KPz_}p!-eYeu;Ds}739Ned=!)9Nlii-Iv5R|9o7oET
z_D`I(IbQjCbU4$Y=Kt`*nK|PC0wa;2E@8Z-qeE_KX^Er{XQEi$Jj6H)!W!<lgmh3q
z00;*66i?u;P~>+0LrEe5p<y2r6T!<BasGEpE5kpAgh3W8h7X~6fbtnvY?X~DVu(Dm
zKS=-=3=g-BC}5sIgX!BY`$X?5@$=_7nAZRJ0nYlQNH$ZWM|e4gePq8-#de@$3%DRR
z5jX@=2;LJ8^AV9ET=O9q_4kOCI;7wiwqTUa!do3Grq^1*!K@EhBxv%W7Xc=S<ngQf
zc4%VLY}`@KX;vDAH-UDIA-*Q1!?UEo9zH!-gI3O$rZdQSrH7F0;N9&@K%db|Aj%r)
zwkOBbi|iKUswqdW8XG^Bl#`2<T{6Ud6kSA^g>G(V_cAcBF;2e5B<PTp0(c{Bd%-Xk
zI#n|?Fu0m)%RTSMQ|RdIq}gVEm4n4s0M0IGHjVX)t<>88ii>)Fc*MBLO99NXwp>Zc
zR1<vRxoz?H2?@+I-(2o@nEvxco51!HcL+SnR2@~|I%r>l8Vz=ceB?0qdm0-X;nZMK
zT7K2Z&{>kkX*Q$}E0`zrd#>pd8w(2$_z9@b*^?;wBpRKfSC}(?;ymKx!x4OG!7}&e
zE$QAJ6@=H7H~ob@${h;-8eDu1%WrAP6kKv6NSUH@u<vt}4D`=;oNkZ?Ly|AHJqh;&
zteTD&sJx0s`2fQ$m;L3CurSQeU_zi0Xrbrr7+f2?W~Zk|YyMJmvwZh}+s-jQJP+nC
z)G6`B*Wg>lr<1XmZ=3~1zw|RWD}z^{({3ZVf|(Kw0M-`tqi#*i>Bc@4zNK3HffhCV
zf^D3~Wp@a)wX7p}mqy^3W5q57v(`i;;%bLf-&$ZhPw{>B&T6`nN4Mp{*X-<vzR$_-
z#g=mWgVCd>;~FpUwS)(dZ_y-Ri1_>WV+#u}zBhWd$o&GD_kDDGE6tmNo$oGj1LK}a
z;!g?3(Jnyzxju{*sNBB>+>bp#Jl|Tk?PCz~d7eWsx+WMUZX9*xtCkbA$5jvB;S;Cw
z985sZxa81dXxgTg0c%S%%)VxKO$XsFJW#)}qX!c}VMZlkgK~F&dFvc0s{F+`9v(()
z+mUhlt;PjbQJy)3G8o{be8@vzpG+@Lmu8f(iE7SOfb=UZtvV1@ysX<>-ZRAQeb$$_
z9bXLdy2VG2{d|z^GPJn5&)?~ad*Ps}oWXERXr)tM6wKwepC5=b-_*p{v2?|JQr980
zKWb-3AI}}|m=0`jO*}LlK%>MHrydu2PMSOm!I=D)&v1k<eT~9B0}>M83Ff+qv>nWr
zzNT!@m!YWDwbLYHN))7Fmay?9%&LCh)zePd!0Ua5K+(|PxjE(_{x-~f`C&UL^x3%5
zz(u`+wY=aEWJ&Kdy4ZL){0-<7Whz!Vb074(hdNMy#$!+7X>r5NgX;1CM*nCldty`=
z#Ep%<CTU>G^ts5Wt*wQ#1jGTyx0Ntf3A6XllK60T$_vI9==?eP9(i<}o!zi^M0u!n
zvLsS@-Q8CErr>k`GLui``()e??TO$H(#8m^Y{N_tW=BBo+=t?8Pf0-FR!_`#@u%Lf
z(o-%9XHfV+zd!m?nZ1fi6<CQIysy0gqUpMQeQ}Ce)+&*lnOOmf{mUqo{R1cUM`9R|
z2l(rtL#eBj`gz}714i1Y);{dW8@${NM$=_)1h(zkL~77BUZ->}n&0?B%W#7N9idU7
z*!Ts4MMhgo3w6}|rr4Ew^c*_89;gSRK8%<C%6*}-tD*Pp?cU$5G^oKaV=38wMn+Iu
zR98M>ciGj)N?Uf}UMwAeU=`tuh-yrgmDI~|&{T$xCF@@)OWl=(VZxJY9ykbw(lVzA
zm!y}U0j+Ah!t_oXI)t8lHw2)^5U!!})c9BG#bKyc;TEPiW!czydwCtrmxISmO0o_)
zd(|*Y^1@$~a6FnX#6d$7L8!D)$p!o`lq*$lHw^YV<dVTZ#qn%(Ydrp^m{w&T#eQ4x
z+p;@oOl_o65b@EO0xsA%?AWzSzkV3_{ek`U3<e}~Zgt$o5TP2>Zy-d%H$x?~35{WA
zWbFGZU_nywy?^^8I#V?8ZrQ!qwDsd{P)y(;pcj7z+7UY<A|e_4Tt29L4{(V1DW+!p
z1--NW3_le5Mqw%}B((UR;Z=LxQ&w7^uA0}aC<ZQ%{ET*4nq*qtpmXw*ASTa&7Ws9+
zBC*a&<DawZRR5-H_96^?C{YHyK8hqD$LK=P0N6J|>)bs>2EnEQgEeRqddk;exG+%h
zWM$v<9d|_MPaHUG5l~oI5$9CG_aCJ6mk(}@dltArb|m2=xND-400_PTj*G*CgM<Bj
zX4NA44!+V5GWnkTSKeYacP>MLSS*m`zPliJXj{s(=P4jI-`t$8QkdX-$Z2+HIV>o`
zf<U?l3*yU8+&8PXzLW<GG9;{NHzZm9>x;0P_p_cw7jAcTFBJ0tzs0@)20ege_Sk&O
z_^(bp;rt9PX&Zg2Y5U%4uAbrLOPDn-X^hi&J=_Mh7GOfI7rY#<osp8N<@PI~a039Q
z4Sk9&D`Ca72KX-JHo?3AEEDO#7kp`OtL-rOF%H?}M5E^mBt+M~<R!882c>EypAAAa
zmCFo71>G<U6B0OE_{~GeTPXZL-9+9se)umc5joHqsS_VoMe6Mn5~H!cR#uASeQ2l`
z3c!Ho$n}^B3kwU3C9EV=%lE%=tcyZ7grO%69iM^W((<b&<YVNZ{AfV0`UeDr=nahy
z4S|Y3aQ=okNZHrd*T2czSj=gM`%D6sFJVDywJh)_4r<+=ZU*Z$5*9oTcaVy6;U#er
zhvF)L6po}y(Ygd(_tR(3o~V7PFG6Z<LZgI|e-23H(7GXS$acdws8MC%n9A1x>LC^9
zI!N5bIx}ysF8E_gs!HiI3k!chPfjO$FVj=JE(%L?@N>iPI&3goUYwwxA5-S(Hca~<
zp2wWVHsKLy)PikSKY%+0stxK^fbgmqi9S}lI;6P`#iX;7QwP<98;N@vN)^c_24{2)
zhx)Vq73u9?aPYw$8RIE;s`45yOPieh;qWeOB}9vK3jW>Ux9yC4Gs&Cv9S*1fTa9SC
z=Xha@xU3XcU;)7MA1%^&(OC_6ege|Ddhg%NcWxYBOz-G!G^D}Uxnna@($lNLD+U{2
z*Tazc34h+Z1wzRuQ!J#xL@c_&S${!Y1bW*T7#UzY^Kqg5=})fkpx(g#3So;WNS@yN
z=8^8>!}oL%)}2#7v0t-3pd=?}qL?tfmcTwk2YwC;64HMJF(B%4LY|SNq^#s=(DjFE
zG`zJB9EGqtOd}k=>vnMx0_p(aRYR6HrySwwhA+|(^5wsiTn41!iqO#gV?2J$kr&h`
zXxF48&W&kJMha+p)U-E$$VFI01cbRWc9pmcCpNo-^cixjM^EBq4^M^2yt13yG(0B2
zvnO1i8JS=qBEP)7)1<)quNK%yzBfLzZq`kC$iX^fN^v&x{XE?H9K^Ln`E$=b>>+An
zPfx$Brt4A88>Q3pjlm(&{rkBY8QS$V>6IcInePPxq=2Olm+#dpVLd&5W@hGR&#-np
zZ)cjqP{!*Ym35tRZ}0Lv&);7JmK;S~;FE|}K2k{U>FSb@gv%j|jpOw(B}Kcm>-3uK
zpReX@JQ_)~k#tX6O3L2FrCdNS`PtqRIRYWv{(qH1$_HZh1|+ic0x>P_nWO?gntT!x
zA`=o+jf`sGO>ij8(6W1qs*I+0q5akB)As!K6z29eS%5Do&weh%YoO~H4QHqv9mOB;
zK))w8X$omSK38fpUq8V;{&A)dYBp#40_Nq9k&&Mv=;msz1k(L-a-8`78K>z$Fx=kZ
zh6CIlI@zHW3VBiqm8Dfx#ErojHls~_TzPs$E$|tl=u`CMU?#8zrZk{-P~hQl8g)rP
zq(u6yPy$7$Uu0rLr`CF>AYFbpd6msisHxV_+Il!!dhlW}Dp~qHeas+e<2xC}#T915
zlyQ%uJa-qsv*CwVf*Ftt({V5Z5jT!{pLd2d3SJrz(otu43;g=og7*)J1LYb4QSb6}
zEfzX@0I*Qw|IB~IMT^E(+Gx_R2Qn#q_6*ZOuWV_poUE)Ah?0RwBX!t@Q3bjpEGD{N
zKG*-d*`)M}e^xwd3Lwv1?njj;F5P-z8xuC`ol(h9bC7V``U5@+%!XAVDQigo)dDON
zVaDQ{SfExi_C@CrHnyzyb*=`rO;Nql!(7(`FGAYa8Z1vvwn|>H%@%1`x}Qsd9@_pk
zisBOLh8y1FT*Ket%=5)U_#g_eUb$cW^ak%Z*!lsYBtonFMH?BOLb9d(6--6?8H`8}
z)UF^V^%^GN;H$2-(MxQ|DzSl#hQ6RXJGC{V5Ny=ovey@YnX3p8T$Z`HsA%R-?55uW
zM3b3y-1Hy1gn<<rmKtc?wVpj21=C3}%xi6YVL-RgoC%XD01DvEE|Pax$$qFT(wfkD
z_3ANfjX~;2Y#e??VwY2nI@={stbl<)M@zeKDgHjiSiY_L9^7oZpHEIt7cOCEwx;+^
zI|$_PiUUuXY)W%?z9vwqV7t!K11R~LOxK@HPv2i&roxbuYzNGN-n_1hkn8EDHsJ=7
zvL9n(kP8O#CeTMo_I`_|T>g_*CHc*HG;fa{Y@2%f++;CjWgBoEZ^l0jhMgu32Tvy}
zOLh#4SkLnfEVqWho?jnlXIFM|SjKZI3$Q!hUg{IH-R57i-v=mp$|-k}qI;7=?tIaz
z<^x9!NHI$=iH7{6$4znUCKq123w+yzIo_9!bDw!<_U25k1<KN4XIi<)EQ)U#yyv!G
zdrN3{j+xE}Os9Nu<u5IO-zBTv;C9*-<LSHHDSmB=YGA;(?4mtYh&a9q>Z=1vkn8o8
z&Xj7ohq}S*qqF$zo<v3!2!K=sUO0SZ1=>@!Kn}zt>T4Fww9>GAe*<~^S;H_lcL&&-
z&7=YB3fdv{7s{_sJ-tqb*rSd^VPaB&!Na?{{e-mC>zG+YZ{GI%yL7Z7sDN{dik>=c
z8@;EAGc{8ulYM%xG?M&b8OJotg*72I83-U|0EdL4;gJ^MJvFdBeBgK}d>wpuNC4K~
zi%bWvKnmt|+FpR{9&mB%!dXZ|11sdfRR<yKvFhiQV?A8;q~v&l9n?I)Fyi@@l_fuj
zxQ>28yw(i3p(1cqh)q87%y$DrI36OEKIDd3mFUJc;ec|_whfEeKv&RH$q8418Ny2S
zNR_1x65FH?#BIg!w(s@mw!k>hB%X0>mk+>#W@829EeJO$MnJ#50*WJyN1@e(fXkP*
z`dl~;hwCAXj237#ZPm!Hu?@6o|CSZ78PZX$PS!b#gBlNY`T}{!{mFV)OA*IlDZA~-
z>+Og8=OF?&*^=<UK!!$*<%BL8(#kO{504~gZbAYPLe;h5&dY@i?tAo&hs-M91AWy?
zkLN76@40hXz&d4F$6!((TS!NOI=<}ar296ZyNzO*J~1YJ=-~kQZbMyjzpL|uM`qva
zuXoxSYNw_c>Oi#Z`|}#gR{CigaUAG{aP~1r#6{?Jz7>`1==y`dtWl?K;Dh+Eg>kkL
z2-jZpNl*q-aF-JA-|Lx~zkV)4`{8Z`eF5<jnc3dKntbLxJlG)l<G7`2tW9<siEJNq
zX_8>IJTN~$LjP3YUXVsdwSs^5?s(BDI~^U00p1?Ro#Hx7k>9Wu!pbbPntsL3%?>76
zy<*LNUiYt=nqXx`v&%`AOj<NsSDSHyalhOBN{g`%d4u4>fw?y6npXb@#}$G(b(?R=
z6Fma(<tSFWA8kWwC%PE<H`3tH&=ID@x!&9Pf&+{80xDfW5+!AoUsz_P`5r9ry|;!v
z=7(d%5{}Z+y;AYYTee{N_@Y1y(Q-=|`-g`B{+jbcJwE)5m|W}6agbuCgC~SWWkc&u
zwhqSZj8yhluR&|RZT4!CzjSf@%O(DRv62$?H`BwC^)=l_ET4IFXYA>FpWa5?b1b7u
z(I=4r>EK6Ybcx=vaM0#f9V+8(8&Jr8e0|diok$BtyOu-*JbIHeFAVM{5I%(r)>#M^
zR%ADXCr1cnhzlgD*6C?FW@ZXcb{PXTH7+v(JkuXJRZujBhlTm{K(O)`-3AyI4C)g~
z7yK;=XiI+>-%Alr{;<l+_i*$jh7pm>6Ovs)L7(-kvR+ta;h-tfI)1dMU1Mu9U0I7u
zuMmXhPvpI~2u!dDh2>=STp<IY3{b%u)XNqX<m{^i8U*hN=`{0S{jNS06pVuM6a5AD
zT_QW&UnAK~cxdOi_C2$_O{&2us9oZY7zYcU6#QPmYO1AYxF<ajGMB)l^X+1)BG+FO
zRRt*@3>tEh548rHr4p4<Y`wx|pzWmH$r$VD?(Ts}1DAP*g{<R+hk{kEJY{uhsSsW%
zOP{iT>jd%Fyq~stYm4okBab7o%JJ~=XKU;nQVfT*8XM1He=2*xm8bX>FilmzSftzm
zIii&(-_`8olV+X3ryzfS05^p6ncAATxw{Lu3f5(Q-Wtu1`qtpst0zU-fDKP`WFZ)+
zA9LUTg%K1O*tN&@w6A9F&_wqj*i5|gLzcbijEfslyU$zpG_5c4{FmB0E4J`XwnOO3
za{gnkqxUWGWh1?>@8|bSTDMzog$Dq*o9%_aWwDVYWjMC(!*ZMu{~&RhBv#T8Gg%R%
z{ksVVMef#SV}w-xxUp<gG->JGLPEL%yorz1D9D$Oet*Oy+!si^!$aTcv;MQuv-eRd
z)(2j9yeFGraT31wt*$QffCw+me0O4uBelL4lEoIDwD604z{Ox-kg9o=MAPw@={P56
zh!hN13WF~9@0}?*7zf<CQU$FB2zP+z9>bLGK}F#ctArzqho@G;0-ZYlux#@-&g!a3
z*Ioa12p3u*XnU#}Y`90X`Va-<Ll7uvc54H(zhuIaCUqX)0g~<A`#wH*0!|<0zqcc~
za&sY2UDJzyW2GN^PbF7_DNn23AC2UtOHE2nkT_l!gNr?EyZNtzI|c=bh#*Tf*u>+a
z!SjXem|*#GZ=xRiqi+J%87;<Zgc=r8Py2nmPFVZh{3SP*UTHe8cou65ToL#^c8UIx
za~ZyeB^AN*77wR8`=bwFigMM+NJn}6Cm_`-U7OAB4nDz{3*5?{xl)zdV~UC~Lap6F
zV$Z+TNo=G!nlQ#o`uO;OcV~P4nteM!7|s0iZ8K-dTtPPO=AT`a<_@-W;QAMHAW5)m
zFs3^&h!4w(Ee<(Rwn2H@8$Y-5&SXqVuez*_Ht^5iZ1--ELh$5R>4F!2l&J5ah8scb
zx9M6vF>?_vn<zC2Lx{*-U2k0rI+oWlrhfN6;0mD)OCKGQC7}lx2V?i?U7sv%`y%r$
z%n0_uNJi+g7SGMIi#SOJr05_4|5l8qU09p&N$XB+N|O+we<?cwJ9jT|-<Mjw?lCwb
z{U(^N{AZ?G+C{o_(KeV)md|$;ckead##{w*YQF5pC^qxRxqE#0N`B}}&noB2(-N^U
zF=16Bp}<L|pNjfN7z4Xe7aD;PguAoKLd9Kj|8~zUJlc3wTjEa*KutOo#O~tXNB5R1
z)YOl?ygU}Qf{(i#9jz~UIm&tR#`WOaYq6`-15;aU0Nr!gF5vcESq41OKB<s+#I0UM
z6H91W1OycJuM!Xc#xW@Vf^}WItH-ozR#rtPXp3T2X&g&S*Ba+On@>48M=Xr{p8*4U
zy56-AL_HyPl@eXd8B!yG>UZ{bMvd2A<5iYkFklwQe%;a9+k0P*k+$kj{z#r8du;(8
z__AKe-ci|^ir4L^9FXz<F3F@@zZ^=~bbdZh^8Bs8wJZh)cz)=Xrw`T&rVxu!0@xr@
z%PRaOgoTHE5NxM-;l#@R*F<3z*^T|(+sdB!(_X>qGES=@2g-suX$r*8Q00SGO%POP
zzhba6cRBo=ei#ldZSAM-FY;wNT)o1+QTyWxRd%g%3@LQ4r)q2O8~h;*eC8(jwh#6T
zKR-2o{v5)g&j4AA>s4Ii39)R;;95Y&ASlwQ<9p^@sQPC3H$yx|)~!1-MJw-2pJ>bf
z>S*pM)@x#;ZXHc|{x=tLDO;5S7S^Y$xL!6v<FszFvD3uzecbm;3(A?HL^1|pfj~f(
z8j=yZ?o%>7`p?6eonYkQTcV~(<>dS-fxAh{d{63)arPx{tlTHJ2ksyq`LP9}yA`*F
zTnN)YxTZgc(e<*0os$#v6$(@3@!;_u>W2`<*10)6#@!%F6GA3UGWKDJjqgcq`raMa
zsRu_K_YdrtJBJsiud;@UwJ6mWVB)AeALb<LhF{9GHEOO<q~47|$e76R3I~6Mx?YZ4
zCGPa(y-!_~X8cm7o1+%2FJU0wCyCg6F^3_T@w&~}#AG^4(&4?1b6;Fa%9C-^Euu$y
zjlPiK*oICgesoZWRU2~D;`5TXflU<;)4@@mu(klEq>xPKN3H)<@Sp~sZ;O)Y=4L@Y
zDr2}0oR2S9|KhE$s1Quy7N#iP=jIw6Be|tvZf(t=bpoY?aj%n}2OCN|zlV#reYuiD
z#!|%J9IgY>G%mz%D?Jx0(ap8FA@KdjhsR}E&!SviP1vEo^t=b@-kI;-xsPb=b-V<1
z@sF!08kN71z|o*i#z*l)kCmSJ7fu(*w;{0(lf)dR9kLR^eu9&^g92~I)@gtXhbFnU
zbxy#noXE^uX888)Axl$Uf(IPKU)_)SAR7U|Wn;scsIZR!kOkRaRB$WnZ%?9UipziJ
zTnz(t9xKBBq}0X_CBky7AZ&m{e4^)0BxYFe@bKx;n=ubI0xA!_G7{zJ*jUE=sz?{W
z%v&EeMi)<t`9c}5+UeTw7)KNK8)SvbH|KWeN1qgsT;k~WAt#SxNm%Z+kjDFaK}0zp
zxUCh2fPBYUZT{o-X;7L^K!{*)$qog*gd$TCu6Tag?E|1aut1P%4v{*l{wXTb%RGhj
zk!UKtg3NYcA>Ze$fR{Vxf;EVm_AUMlUEO7dL6;ZI=Bpws+=oeQ_z%KqtG3mvnSV2o
z$)}=#$xu;=|DAFF2YwFc;Wx&LzxBL%k>mXk#`6@N2U0{c(%IaHpo=Zu4A_U(8?2n<
zbTTBxDrD;tdA#cq63_5lf8=nGBpmMWtJk+v4Us85&+UN&H0DXcJx4HR?!SL;)GxgC
zhdO`!c52}0XTD3*?Z*k>n3V&409a2Oby#B-?AcX_k+j)a1nuYSWQjR11K4^%2Qgah
zbLA$q3k^LGuNH*W3>a*&ziu&-tTI^&Sp5}Aw%31CA@K2z^uDvMJ=Dc<6Rg_eJ%%bX
zW#(IAeU_%G7vVs)dSW;`K6V6NNlJ|>wWiVP-EooXF93u}chtQpDoOR1H&)2cn9s4e
zOG*=;2`^kXzZuy+|3$8;HPbby;7-F@F}(6PUh*CTN$ci-2ZjyO5zw~?E3N33GSQrz
zoD2jDP8{9wa01Tyx#nR%_2<Y4yi)roe*9Mp;3TS*V?kC98-K39+}zP2R(SMw3tyG8
zyg<Wg7Ppwdz#xNNJ#le0fl`;d{JE*zv`v0miz4+Yx?f480S@a9OZF?WV%6~;;f|`k
zGoPo7k+=S)vgr9lN3TgrmPDkzl_!++<j+=D%p`88GrD^+uVA&|X<=xX>n^szN&nND
z{)XE=dsC*{#JJ94t;e4BQn5!oB=zcULbmC1P`x=7ySzzF6YF=h1+F`Nc%EDT<eK+j
zXO1&qdjw9cCZT|r;Jw=I5FLTHEE?4{2Ynhk)J#HXY`4(XulIMb@ZrDu;~KCM4E^&1
z{v@}MpZ)U#R44+sWpDnUQ1ER9f&cv2t^e5{%TaPNG&eT}4_;2o=wuSYr<>2{UvC5M
z9|DYQgzNV`{{AiuTHSKDfz7eJun@dWoe9KCsceLqyZ?U39pcHFmf<R()RdRQ>ZQD_
zY<zi$75)%xNx)?L*DpLt$&mm2=ru*D9hFo7bASv4-ok0FMjxBC{lGmz{ejle(Gd{1
za^2|uxduEKXv$s6sHpDj><$bsx=?O@InoXf?Q(#~Ki5Md5<)-Qy1VgORC=CHJxC)b
zBWrD?q5bDV3fZ$p7vX+UO6V?l2dem8X_^1ue}}DkrSYzU8x2*3G5$XvjE4eEjh&sH
z!O}=YfCd#KK<MT~M5ChZMEv!^@%E>&&dKEDW}lpQ|9-mKTWD%sYVgC3-mn9FrHS#+
zh3F;}s4=<BEkAuV^FR4LYFttg{`+^8e|mZpi9=K{|1(lTSvv|V(f;m#?gd)Z*R+zR
zAF2<_25Ev$#Kp#^o48bZ80u|q|6X2BfmRuix4Aj1DN;jG$;q{ei4)*b`1hjhH|A}`
z5^vVFeAc-Q*i)_1fj>%Ns$)9Z1C1UGD_C>$_twFWJzu}!y*5w`Q@)!M1T0ZV;5yn|
z>BT+$+s}m$Uc~}ZYF(HD&%r(!u&G6rL_-M#^<h`#W;zt{)VL>fcVWR4CU>1a%j957
zV23{Uu>Ad8+3qm7=2Cevg;ZlqKn%p&?|ziJ@QRCz%WAEE>mKgztq?6uO`w74g7l<Q
zf5K&D^|MBi44D*mfT?cYJ+wbS8!51vmoM9ECtgCqxp>)N22O?&<@^t-`rtF1oyC;c
zNrDk$|ED^Uv!P^Ocg5tVgjvTz6D^`RT;^_tvURD2%I!1ADuutTC(%k=H>({AmFs4|
z&Zg7Jz98C<1{!bbJMfBgy_^LHiJKb{*!PMX8W0h{L^%vr4xo|1?x3OJTs<<Jc^xRa
zz_<*Kh#;H+qd3>or)Q6TbeK<#V|ft9e%))m!_R3s{&QjiCi{G_%RBKg`!Et>g-*e0
z^+fAyy#!v#yLa#Oymhi%pDbU%&b*6Oq3S1i{H%bxr@S4e2Hpf2S(QdFSf@?-q(d7Y
z_a^6~{LQ^#^e!f*Y@HV>9&oq+!7}J65Xcb@8UVLKoCN0{pGtT{hz8%|LXzx74Uc-0
zlL~(qq;Fc9Qy-F&?_Hk{es__V<_0I>?}dfkja<LB&|t7U1@DSm0JSPJBje)YLL_Yx
z-0D(taxsY54_R4v!BN0&azh8o2J@ubk7lYv3d{XvNw7-8$t*7^nap>Y3qx&?GSW}F
zIyzRt+pemr3jDzY&y|xCm*T@RcWv#T;iNyn@j!p`JyK%8KeRKNUsvbe2#8&v^s#}+
zf#B)U<Fql-+TBfhxdCeF&V1AP?`r;^VBMFB--LuZ==}24%PfG-^y@j3_KAc3g5mZ^
zhUg3+20niLX!zV2*ahphKVBI8p8gxN4I1O@&wcN+4TYpv>FF%O!ormNIFk+T_o?BQ
zu7LVQVFvd1U|$e%+d_r_A~TERJ_W+W9+?lEspLA^`yFi}*H`C4SwEm0GP9m^b={u?
z58l<)xi3s`{PjCyA4)S2gyKKK*_qCkA|0@VUK8*4N-uHKCFh+^QT;^b23Wzk?dg5#
z_U&%A`*9=S<^oB;!}F}%AGZN@?0%Bq%0&K;H1i)sPEM|0bPm7}s-vt-E5)n-U4b%n
zWU|KTcMtRht*fvFKLRQeqiWGz3W{$g{i$78j7UIBG?kZ@k`iDC2^fKW6Wmx3?@<eZ
z0e^hp_XY@}<xBy?<Kf45npLkYExF#VcY!e#{wB$Skh5lpt@OT1ekkqLni&+*-Tl~N
z%-Ul}&Bnirc{XRZ<}1@~$f3=_XIdx_<M*6lZmdL9`t>WH!|Jn}=ibe5Su(D%0pcXV
z+XKo;y-V5aevMLnL6VV0gGLyHW@&mW$#_&+PROaLX(vR)6p_uhwh9|zl_&xn^E+&m
zH^559_&Ddy>v&)A78A5%(aT2gyS%{-ezZPJ>=PL&H&m4*qg$~$n3O~k%qUV()&J_N
zm1|eg!a~|-UVfjDuP%G_;0o7mK+#W>iZAdyRJ084g(47Ye~8z+O-e=(s?ewDeY&ES
zGzt#Ghn4!>v3x@@)V{g76K8)50Vg?{CTPf2?E!yXI5=02n;>?41dMnTyk{a}fh;;_
zT5tkFkr<3b#cVUX-#MKA1Qq*U<ag+ez<_Ab8Oa0$IGgE8<CUH<GV)JwZ(jg*fDA97
zeHgFUr2ku$<phMKZRW^Yve6EGd`*7^5hH)5DrP5~ZD5~|s^`axyt(g(wsv-~sE^tc
z&_Z3<MT?+V4NKwxuKNz1Gu6~hBwLZDmR7nVj9&Dutxr$aGD~}5xEbvgM)ZdEZ!8HW
z<^lG7RnSFFm*WN%WQq}2`nLjaqZe5Jo+c#u0#`FnOQVjHf*0fadw0+uY5&p+fT9BP
z5+>uv$i>AGW9)bV_Mbnv$>Y3D7eZ#k!H+%ch}b%*Gwd9=zTELfdFV@kfapgXk8OqB
z|G{p#v~;($RDqb7*woZievlf(8l{}(bqquW9&$;?olFQwVr(KsUvy8`s%Czb>&4O;
z<j4FJ<ukvx?zhTKB_Br^E~UzUI{S2Utb5=JM8m<f1<X|_8B|rrA@#Ssv=o$X1h)>5
z^fD5g9Jj<eBWH&qsP|)N8bLf1>5HN1Y~Aqxiy2g-!5+U|_^*hFLp~k!8vz+3o<$Fx
z;ei6*5VZM~IN0Z;-+;h3#aarL2CwIt_Gu<OF*-GAq4TA$@oQ><zvVx62@N54o5VOU
ziRq3ZtPBB>QqUk&Ck+=|FFx3BkLi&KUc<p6m&)h5F@lUFbf%WCgoyLlzY_wMG7`lZ
z(l`{ET{e@viTEB{q<NmpP136rXn%fbZb2c6gN=Q<6s2eLbJs5v&QiV}<dCA{G&e*x
zzGf|}aPk*>lV!r7W8g9fcM1K41D4DY=eKUU(8HvmJP!iBlNG6KCC+_N`6KRedtWI-
z;L7!xC9lxtgpG2Z0@b=cDr)Dv*GEc%Lm=UQOrjT1f*ojjbyitbWK{mY`%1}y?519+
zv9T8mx9RY`+O*aUXQu_QGle`nkJFIxP#*=pFD834ZMD&Go<P?DX6lA&n>hQsJCXwY
zu6KjuNDv90{RX^0ELyKGy;6D_4QtatiZui^19QAQi%+d`5uQEXpN3%f`N)|cz6lpI
zl8mPu^k29kkV1pRsmh=h32sVayldlrxDI<#i8Ny2>aceObAJ(i1%>FYq%^SiP}{)E
zZF8;xssWzDZYY$at7+KSD0G&g?b0{JC`S3U{!5XBIo{<yAt6M)8Q}3ekulb3Q0C{P
zqNdhvxD=X9hAsGLyH~jb?_Yf_E!`eU54#v2ly}#;o#VZCyz%2%9U~u~+!fl0wv_-^
z*i5uh+9|YoL*>R=XwGKMOj;v<c8GIG-Yq67S0fSuP{O~hP1>L4)8wStveW+ZhP_1q
zru(;=<$yl~HmNTqUjXpoce{@KEtKETi%nPWOg3GcN+69<2jYK2b#xvq;ldqJRq8bc
z$$K=`;}DvT(n1JACykqtAo9K6gE0lK89M6kK?$Q`99OW<8`=}J#lj~V92bXq4|B#3
z_1e(U-G#u;(GiwJ5?sQlkgU8M{ph3_FAtO|t<r@kzE#;Rw#EEv?Nry8f=yOpM(uo=
z*z)*#q697)8ihU<=`#tQ@MGFE7HtLW4XDN{V6Td$@gxKC#Fd<GtuW>%IH`wJ<E|%Z
z4~6<+PAZg9kdUau+FQyoZnME&H|%V+F-F2z13W_aE2!YB$y3g^@7Rz@Il)GH3$w4A
zDw6gXs$kTuz0v$7>4d({nUbc@jQJ1KF37NwGGV;@!o}96V?#i`)%8Za%Ze>nRgj2Y
z)$`<__R~Q?ppdYznH=1St*R=Hi>r8Fi^cCn#_F_f>oN$6A|=oMV>^N}IuWH_aYdxV
z6V{0UhDarP0?FX0rlpP$ZBoInaDE8}w>~947m5mvAZ6G6_~s92KzoZ1)rwAL=dU}4
z(ys}mw$fPi0<(zG7WO0Wafq-_g%TEmBh6xKJR*@<$A7M!GZ3}Q=~s(ro5eO@J%pF|
zTx{i~DEs1;cB1&@VDgrrjM2l%%#3nZqh{1MiqGOzzLHAW8*_7}Kf_q)=)=X>k{mfw
zfJc;rbsHewP+cav$XlizZ%@Hm7aP>Ni|x|-a&0|~vimpMeL+S8Tfa|)jP9MMKt}sM
z#qM!p%g%lPkiqnb%Zo3eQGjO!Y5xG~#hTjMW^_(k6$l!hAFWVi|GmBM@pr5Ss!qT+
zb)_1p1B%B8lGovqKM=CAvMOk5>CAmk#{T@d1yD8s;c|1J#-4X4vZQ9|e#9dpnyV_b
zu$X9RSp)@dy>pL9vs63^7$&1piu`q4h^5jo)VfK>;`}e%4o~3Cy4B%R;8(>k-;7d=
zVoE$skN|N->`&z=uiip>?}Pp~Rz>M2FwJyY>3Nu>2h<CDK}O{~=){{;3Xj%{sODk0
z0D{VwKqCG*iz)Nz48H}oCNUg+_HHSgR9iPdUIPw?>-ksyZGcK{0WBW%8o{06G3Na^
zU=+E#5<--s7-4ol#v|7MY5~qehX{X_O7*GoRKj)p`eXpm8~HqF+vi+2SI*C%T}sFs
zt~!hNm9J7D5-O@7>VHJQ*3Xn)NkGQ3E9R!pG*fU{^E}I9lAqAJk0#Eh^;MavxDle-
z4)qo<FQcU(YzE$1u4jiZ^dB<4bQ_b+hvf-+UF|U-uf)$bxKBXO!ZAT)nQ_|sc>iu{
zQqnpyCK2=@V55sC^xR+W24{x>iT`h~AxagnSuX=8+6!`Bx^chg{?%&o@`MIxx225l
z@@=##O2QKj=y@*nvjK^9?^jZ&&}zFl_hOl$_(~F#(y;h~Olc^NMzxH1>n<njZg*P<
z;}WUdqwwXqhI9FkoUZ3b{l!|&Krn#luKmri-uCS#U8PqlyeB@0byR8Tfe-&uFCb$c
zUKq3nV46b9@*`WCrS^wj-O(V7CyALfw-=f{VOAfvqw2=%sbcE6K6C}uPXFfy{ms!3
zFvwXCXJG5HT7rJ@Bm?GBhrbKm5X7{#>$%Ss+c7&LKe4(UA}Lmqzu=_FCx3C}YXrMS
zq8=U>1uD{Dc>vIhZhehBD21ZWTwMd{z)-&a!*t<it+c{@Kz94f{XJs-a-6n-yotP&
zaF1hiAh|+98AoOj^lGY^r4CPCtEA1_C@`g&t1zwWimlI3IWXN4SpkXuV4+zL=q=b&
zK)C!qTQ|*5LX2yBz599|7N#-<ho39_j<p!LF0+2~01~MER0_vy9JfqR1{GZ`twls2
z*&zg*A?Wo#s+C3K0@FJuEF7Ex50CIlSO~G1J4`IUBQ0I{)L4q&1^1na97|+vZNMJ~
zYBv5@L3f&|yAMNQ?UrNh+Kl?9Se<+K7tN5Kk55&JKT-J4L$+kAA*ORWx}0^8kTTiv
zrzR(jI>Kwg7V7`CmDT}<_vz%9mn9}9dPaArg$M4xv~p<xm}fs2bJSCq3}3%S*2u3)
zAdY>;xXE$b6tv!iPe!&1G6j}BcN<XqA3WOd=>sxm=zVOC3Z{IuJn3YyY6VRJj%F*O
zt!G%%Y+;ow>Sm(F(?|Cwwl1HQOIJ7M0y~+_DX>S4DMe?$aVK@(D@UwH_3qt8pnN6S
zkzsuRYE=~iP^adBh=djExs|JMBQ#Mmwzv_Pxyhj9n@ax0dTdNLR*_Y%90!hiz|Fmb
z9XMF80v`%Z+@^++61xr1T;c3Oa^xt~#V#l$hH$Pdu5{zg4PG-89?3fmi(?NqQUsrW
z`2KoSWiWY)EzCcE$L+AZ${jb;)7oWb>X(hJZ*zbralH-d*?dcHZ*O0p_Tyb>kr&g~
z|It#G^*To;m(6~x@*TMzdb!b1mmm2wXy}ndpOdY7hruqi#J_qCYFu=zw&C^Xe}obf
zO-fN(#xLR~;|1Om7iviVifY}2%Vg;(6gwMiPXEd@9wh%0+FG>A?N70>239hJa{nk)
z_P24rM3>wsO-Cy9?_oXs|D!bhqaEo8z`FE*q(BMgTP=k9Dn0i!2#2JyN7~v%{;NMh
z3dq?G<~oP~Xl5{*3;9Q#izdUOEd-LXfr0OPj`CkuO~Jvo;^L_P@Be)4U-;g*Tu=a<
zP(WF%`}R%p-#>L(LR&|NN`p!}`$-(HeA+Ae*p}8-7;@Dl`2F(_FVjCzpn3&L+5?U3
z?eEGxbkXV1*>H1n!~P0Gyi|aY55I<YAH_d%7geAE95@yhC^E9LW!T9dnC2=T%pg@}
z>Gpzm%;fd!koxJ#$p@_$5&x=J`&T{@m@kMEtc8Sx#&_<GQolg1yrt21q<!~Bz`%_a
zP7{{-=feG;lRE!*h0}NW?>T<X&OZF-0}9#S0aCpZ5h#ZPi@*LAaJzME(NX`s82=ZP
z+W-BJ|F2f6i%OJP2;tlL$?+li`E1yoKSQ5Be8{IkTBuwvAt4b{j*Ve<^Cw16bQzlH
zc1=(BO^Q(0l3{smhxh;P>-)s?B(<$wlmV35cQlOu{Gj){$^G)GOt-7=0)819Y|moL
z{kGqx!N%71@8A9X{Xi~|mEp_#!OR2hp8)EoPoFX{45xWsw_9{~PYq<NNEwxn_`+9i
z=u@%&`VCFY9RisrKSO1t63Rnkauc1`dvO_hxp{bAa8Gu&wb2v6Z3nrJ5nD1>p5YLt
ztega!!+}BKU|a?=jj>6mceSRy{Z|L`_`Au~)`CK4-QCMorB4KIUkc(A5Z{kYdSHAT
z#CZ^jAu?}&Z4i|lin7z@Lei5@3O182M^DuAm5p%O#Z{!`2Ar6Sm8j!RiD><!Q{?gP
zYoWpu=TRd<`;ad@BBuNn(p%Mun`a7g<^=oU_g@n~!_Fy&Xn2wQJ+1~bp5p)YL1ex@
zpz>eFD3U$(2)L7CWxiO1VTOq*4G$@|?}#`0d*W<PX>W43fue+zl;7H#*&?eEOcH2R
zwFnM~JLHF7D~i{bgNZq5WAC#LM$QOVWHtZdTmecvGxMLORkV!yy}doC?Wm|&-cER~
zPX4dU`t;_{Kiy@GRZ5&FS}{M5vc?GxIbH7CP!5^*q2$wWPU|PcFs7pcpJ6!J=|d|<
zhGRb^5X!QT^99HD`MM3hg0lidC4K8FIqeQ-#q6$9PypZ0bQyj9y=`@{Toz}KMOwXZ
z-aI^Pes-8@ggl=qJ_wsf8xf~^3a1nl0iQsX6zZx=PsyYibvTZDv~_;AICd~9S<kez
zyJ}-||5e;Q<^f}JvQjEk&5s|Jt14Lsn&)M@UMn8HFwtJjpe{tXr^(2`P!W}-Tj%r_
z{M%3-6=kPWA%Lbt-*j<V0_qL1(f}PB8yg~dvR##Slb0;>Hf$r($)2gY>D4=a1+yjW
zmc2dx^Ba@|m<mH1I!pZt=l~Zx-b=GTwX?lhY+}XY`P>L>e@~C$(FBI=YE+m2agygC
z)O)orH9A;TAFNKeV9FzAICnYOg<V4FDg;=yzbSGVeoXP%>R-b*kxeGt!30&s5!gm8
zkzrj)g{TG^*}cQV*m5ygWr762CoJt0Tz?)vdSu$b2FR4>W<#b*1DQZC0vx_}<HcZj
zCaem(9Imrz`aop{Y8f7<)cf69*llU_JcnQCx;bhd{y6LHhj;4%j-pS~AjKK#>aW?l
z4Z{yTcbz;oMh*&;n=Q5TM_gWXbgq@S{q=&qsj|AdKaGD9RC_JQCx4U<%M(6k%F}c-
z^$XO&a1V~+`+GE}U9GE&Db0|p)Ia5_5%EFxF#d7SuHx0j3i*7TWy08NB$<`vWf@-C
zJ9pb!GlMsyb8<Y-4wGLve^&K}<U%rT+wVXM1-T9uWnVh~xd5PGRtkpHn-5pihv9|D
z18O27NR6L>8>CfvV)p&r6&u?yAc3DWxX(SGfd$Zjap>Cjp&`;NG~;mo!vgCo#fq6{
z(Numg`UCL*b3?D^W0qnz!08bUJHnkD9L~?SLO@%`!NTgfAldQE*m~DPmE3of!o#nn
zxtdlo9j=AD!ajb=^b>SAP$l$V2EOSM9EGqeL<USS++i%?mVwO*pPjt|`~LV=1dr!g
zB@8kod9aj+VNX=y4(ZE<i;p&Rzua4?$P;_pM8=Rn(FZ5|Z@^z=XOBU4iJke|^&vSM
z{OGs(Ix*p;PdV($O3@@GJd#hQU+oIx<1fAM7PWel8IOVgiN#e-y7%E&;mpU6mw%V{
zR!VIr$0*$i&gxx4O53vh-~@?WlT$uitaD}w3X<lDzm8}2Ts01!cklk?e&+j*1??{u
zc7!hMHynN2BozRcZtqWY{6-2sZDUICRp0Z*n;P7C>J-EdR`6Gn#tad#VczrgjW^Zq
zIMX%Ug`u;*)&Qfub#++><s3oax}Nu&K+zy_Jcsk6Vo<i*b8W9y`_DzUGd`ZU(>!}d
z5b)`lx&6T^<*zqjju?5|k}lk6kO((2+9v?0<ijd?+5=l(*f|b4ft;vZuoWX3`?z%_
zvYd+tLEjLoeAjdvrWZjtmlvQ00rnp@nPHWkk~V%pYwviTnAWi{1VjA(-}PY~C5><u
z5xzZQQAi{VIJCx9nQm~Ghlw??Ibn}O;Ccem=6n!QB{pBrz*>C_>gfFf<suJ(Okn#V
z)V9AAm~Zr4&Qc%~X`SLQ>7y^sd?5R*2ON$H3Ggc|JTVU3XTNcjw#KZ+&;;$Ts`P)}
zdLy#1p&`=t(rG(*+!vc?Mjs{=8ODlb8H7d(t<*D%%0R$)$;|f5pZm6g7#Z;k11VGu
zQEH{>l_gZi0CsGA!EcH0=0bhXBN>IB(e6)~`ejvTE2ImRioPy^{J8t5_jv4$Ag2tI
zfZq1BoKn}eq%)lK{CJ-6&Q%nDLbETh63M7{W}I)mpe|J}yZgfVj}S1p)qn{~mES)N
z7w@&%qY>Cvv2%95UW$5V*#x6|P&8HYysHQ^@EHvC^yY<6_g93`<d%S!uxSE`Wv^gG
zsTUSWsQ$!6z*{TKmTVm$8L<a}XcBKg7B%R5*RVS9$@}jnT#`%Ez9a^xo45t~7Vy)A
z5&ca#=JmROEy<?M;tT*hO-@hqxgROxG)J<2jOhZN>I+9DS-%uscN3uFVu()TBR*Cs
z2+yQJh^?yV^}~Jq*s^Pj$H9c(BkwF$8?Xh#8KR=g@F)WtPPKx<=&i#G+l2?})91(M
zXXo=R;%F({do!?3)?N1?A9TauH<e3pQYd<m%uOmHeYKulJ=|cQBu};(N{h+MgPE7F
znHkRLF3143A}NGp1uDdK(BL8e4nzCMb)D@fU!aNu`}hGr93MM{{Z|Xfv7S9U$%Agu
zK#S|XXsFAgdY<cca3;<DJbEK^WN`WD8kvJm!A<{RXOLgbBEo985nf;dz7p3EdG;Qy
zd3(OX)O$`1`!8xL|HR(O9v(4EPf1i1C8hnZmwcLD*S9mwe@{-eB5u0ER=0!AEZ@~)
zdnoFi4!y?kU9XZa3bJl)ZePCWoZH6Hg%zk4Zp3~i>TMrclunKH9xGX!sbOou)X)mE
zmDl=68qY{=>(JmvBb6{zhm%#3IHBq23vX|xt>~|~`flwQ^NB1`&&qZp&#-M3kRk&^
zbeld`h)yF1ce%_|NZ^@bhRFr+V&qfCMvyl>*8Ac;oUyevikH99UpjZF5)(!ss5(RR
zq_pI9>u>B$=l$K?uNAY()n6ucbRQ}Wjyc*@ZK7R(RyU4}VfF{J!qvGIMZ(Fx);>o}
ztc&R>L%x+gu@%;1MQyjvdWYK)EHsC80homaSUo7^nU)iONZW!01al)JVDpynvFi3(
z>e_b&i0Z{p$(r{%CoI34(FS#KZy~+*bEJW!^vw~m$cqfgxDM~@OUN-s1!Fpw#e1pa
z?|sY~<!!Qur(74quda4mk3mWd4G*`PZ{%%DoomZJmb)1&9mC1GLD)RS^9EtM9r<H{
z>!kS)ufwAw-7<rlv=W#!9f4SKc6^-$Br5o|@KE`WPBwaed_OC|Re1g91G_0v<Xn~{
zyTmonT6Df;#lA?Q({1wNEdasFb^VIX4vWp-L$ye~xuxaq4DJnB*Zp+g*bn9JBbk%b
zL+0kgOL$?nhbZUBn5#|H6A=}3y5dmsVGY0<L^I^b(4>YDUk9QAG)wdo_?1x}eTQY?
zmB<R9SHm`?_;XOS^FUcOStOZJ&R0Tqpn-lFmVU+|8toZ>RYgTHOf<kB2-N^WcezRb
zJ%&$WNZjZ!)`UT&sJ#4*<Y|^eW2*Jc+Q48DKscZ!!B*_^elu4)w!EgSwtSpB6pz>u
zhB43pR6!%<cC@V_v-+SA0HT{Zwx^SZbGJGJMu!@Z-af`~PX`o_6_Do%b5<wx<Z%)G
zs&8!q#pVql;C2rW0sGwtJYw)clLLm;ansp_A-)F~5MIZ#&as*p@Ge3$odA<whY`Z)
z9fYRKqx;0fYT@(?WRR^|so(4i1O6{c*%l#p`KT|wF8M+tBYlhrY`_8uzBCgnh;_>Z
zwFjio&Pw!qFo-wa>?p6OuAb<pZGlIy6kPV}%0{g#DqIWxijkQWDO@5X{8xn;qAJL)
zRcf9DZ-8l|5CJ?CF;ef7U!73I^?%^_(bxC(?`D;O9=&K4!d#a7Ita1Dd5Saytel*>
zIBloq#>O0`17zWmHyKTUioA1iaWGi^PPcs7Swy|k>=#HZqSo!&*a)IXGOq-Xr>6@#
zgigF_Tz_0o=y{9EWIdr2wXs&@N4taW>QjMW!zK-uHs)tHE0Yhanxje#!qG%Az@W~c
zUBlWKO(o3stR>*i3V`e6p%c$bSYPh~eDbdhVbRwLfCtV?OEU!lFKDQflTHf&zJVg}
zWzA+wPr$N*@L{2RQ#<MMZeQ{bZf^y4Fv`Hw2@$fmM?Th^X)SCSwvLXi>v)M{zQ~v`
zU8Wx3(q@2|*DA9Y$}a-@NdgR5IUP6ee2Cbev61%hkYdt0>I9$?-_?m>Ff7VV_>^EZ
zhbGQ^%t4Z#DfC}G`u@nitG_GH$8=Dx-d^-EUE7}rHa4^_3{Q$G{Voqf3404C8oe|}
z>x7$yxM-+7Q+b6?cE$>qYK9^)AtK_>_P(>aS-8+}S#)P!Y<A_{?X?x;GD~X%gkQQH
z&0f~=jHhFIc*w<XHotxQ+M~Cyz#fkr>6hUAww|1D#mahkh^ar^GMS%$P8a=7H3vs~
z;HTu|$uc?J3Ej`1*`!20%AYo1ZOQ5>MIj9hVzVgjPlgeX)8({EzfaPseHwYr%}G=j
zb)>k`6dU(rbbqB`+bW9J`<Ib5+gIg$6l?4K#wDqE-!MuN;+diTVw>TN?)>~jA(ak?
zaG{WhAhxoR7pt>hkUA$G);~}GJS^Ob{#c22mLswh>-F1TVHECy-rsiw)gpe|G@f=0
z?rcKgLshT&Rp#L1UO$=|iZ%Xw(zk;!?T26^w542;kVQCH{q7PDr@hpdT$DZl+u_yK
z)%E#2Qt&{k*9V;2x5uEax<5f~Ld^aALa6Uc%P(n3NtpTZr%C-K5}a?;g~n~215V86
zh8>4M@bUgTriM!iXd$sqbkAGZK}KM=$lgX28-*wK0?1I$^98xaYaJ#4Xk!fy6F1D{
zo9fl9WRRaSknL9eNU_$n&`0Z;ufj@OHm^w+J>E%QE=B#wa+cKBPs{pZ#DnC?dG$r3
z0>FfEK0bobHQ|P_CJbE~dIVg#Lun2z5`Ii)#5oK?-ejOblv^M^U9MjXwcTWLtVR5C
z0<fOU$<F`^-9qP&s6*X~$7;0?$F2U-?k~R~47VkLBf(C!0%hb!-D!fU21M<xt%yut
z?&IU}o#j20^Mgt!)K^$(9+rT^)$Gtx^zD~%$oT*R^mT4ax;n#_Sp#Ax&ga`sL+p@|
zc&!GaqZ4C)rP()L>t;v6%mj=v8YvBVGF^#HSJU9^-=mcg?rsICYZngl+K=eyAv9th
zw;wLUG%!9;%;y>)TqK5u`1GHFv?wN;&HGcq`7)3s88UX!UmR`a#`19+Ko_y{L@*$8
zPM4ew;ZI%GJ$I`lK2OaK<YZ3ShZQ%lE#F{)t{cdQ)aDCf%h5bzQ&YdMFyP2i$`1|;
zYki9!86dwi?|tjxqx>Ap>2D32siijR>Lkl_B2*TcdQDf<P(~_0S=6hwKLyK+?H}0D
zs<Qp%!SjgZWtwA0BsrovCN}ncLLV4!lN7-y>N!0<F5T9<+XYitWtE6H2y%{+j-93>
z#Cjg+8w_574M3fCa|rtm4>t`?2jtMct?@X$D~Im?zyt(k+xKt>g{0^YaTs=BiGVjm
z6Xtf1Sr@)T?ZE?0FhZx0G_+|A@1_L+JB-<8rmYQwsHWBl2!l6*0LE{QuRi5*BmHy^
z-x?KtoX+Dh_EA`ypff5J*3@7n)3MI!@~;V^p^m?N5-SBh--)%=%-7kj7(J<iutHN9
zu!$^|-eRT0TSIKCG|_5Z66iPN4t?V?2UMPBdQEB(Kj?yN?qEIR;<Siq5;!;Pd>X9r
zBudAhS~6yT`e1)YY-^(^T|7=nX_|ufZfc6s^qiMsl|=(@!$k`VhrP2nhTi!p)j;Ot
zWX|c&0}TxhTgM6xj*p%{yv6l#TVAtQGpOtT`TcR<Cp>GEPghsrn~ofrxcVp9dju=5
zPP%W?T<v3OtR~xEs>;e7rfbPbBlh;1*XvZHo8qSjZ@ex@&V|y&=oqX;#CjUbzqfVe
z9dEpfGF%#sR}i)d{F}qVQkLZS!~6P&si|J0f7k^*opnYkWd|baeJ+MVqIulQf+kZr
z)b{q)+903ViQa?tgEfPB<KvwY95m<;rzT1j2_NNVAO8Wf&ppOAeny1*BXw)!7-on4
zyB`A##N<(ENO0bw?Ct4<Us0Gy<}1PKB8!bpYOdAPQ?wv++D@MwAE)=DTtokCwaESf
zDWvMn3`*R9!Ptj-58S}ytb}1(OJ6^gcpPC(C3ki=d~X|sd-kXqFcNY8L-zl4b=FZ)
zE?gI<L%QJ(Eh3<Ft8_?7OEVxP0+#^+X;50aQ>0r!L_!G>h7ggE5Q}c<lIA^J-}ioN
zegCnB#WTS?Gtb#)@84!j02l?UuTNAi(Tu{cXOeC_0NI2ZS@;}*L7oqfdHV*Y>YkDX
z6^}u$biDLyPP4#+Vu6oPIoDv_U4MxNX{y6oPR&GrX4Ow^8{&2uXE(*L!*P6$k8k6o
z1_QqP6ZEZ4<zSvv>;baG6fa!Y{52Z;9Oyz?poUH5c05YixxA0nJu>;23+u*e{$Ik5
z@rf?OL!CgDGYVNcb0)x}vFaEYAUl@dC{9zA<mAC$F+lZ!duaA8IoU=B7jE^gZm>X*
zPZwVQB|!LiO|MKlK0ctH(GV6IsogDadCiCUGqPP}6(Ic(257rNJbmyT6{S-Hw)V|?
zCIOIO^PZ(D5agjn0JMjEFkS0$)zNxWSwO%Spc}v(!c&NFua78(PYCVsQsqP9AGP-z
znj`UK>0nW}Xayau`ULjGcZ&LGa2#~`dTjUfUle|>Ry|<e+2W4jB-az)t{J(litr_7
zk;dXI9gmHPdGfqt87HeA)Ex*rzC78P{}{eZ>c>+}h}nLcQl_2PT=+Iy-=oI*_om@b
z$^|~?dL{^sl%>Y+6&2FmqbS!@Y%|2iaffRSKJz04YWO2>Yk?vYu#TuL)Zi?qs^A<X
zyJXDW_;CL7+=t2ciFCq}J-5O_?U`yqU=wpaBZAO4?w#j|)NgQKj_w_5`)%YEO*ybg
zxM*wAPTrb9k7X(J39ypc|AN(Iv)7gxN(?EQu_8<F*V{mQE0B40eVw!Z^b{2l1C5Uk
zV*-ECoe|l6N1NRAAjpxCeeEhDP8RX>J>i#v9z^TdOk&CyCrUc>lCh~=)^mRbEWyYI
z?W)0I>HTtC6L1|&Po3!$+|c+c%&#DJOV^*|(i_6V3ADLKyMo3nO2_o3y+MMdoTFn6
z>v39dc{R25UcJ`y*LN9J%+P+NsTy3G&x8)mmeh^DY0@r)zNoC!xYN*b^m&*ASw_7g
z8GLc6p!r^g9V-x3A+u)~cw25#CNhS*6egV?{iLnihAXDRnDs>8$K?m38cO7mr91J&
zt{Vr=%%rJ;8=FlSD_@88u1If^M5vDDD@EBdvIM~uwU}jVzUL||wg6BpxEIYWOyH>E
z;@4oct>cFI_`1cyKn_t3hF%|ZYarij4-j)?p0M6)d8)oaq|y*ZVzHCHM~f*H?w3X%
z&9xg_s-aTUpWQ^wk7V5EAVx?yEPWrG9jl(yX5x*jtc0e}v?3>HXea4meoGrsGTre`
z*5d<_mMs_|^3~Yd0Xt0~7&!qz7ZFc2gK%wPooc>iPn;Y5aWd<V!@}yW;{&Ud6d}gA
z_Z8e^Z~+V!wekUJ#4X!io7d6{SIAra4uvEig0W3tL<dLk4O_T^8v9qc6yIArep<M)
zy7QDGlXKgF<eqb$hdV;2KXIH(C%<sFSM&=O@3qu(wQ}6twJF&+rsGlg#BsOo{StIx
z{CuKas$2A`k%{DnswZ7b8picUm61og!*b-NGN-$GFb%of4LDvChkfxo-``ccu?ab&
zm-|JYnIA|$m}q{`8JRNWU%s|-4Q#K;v%jh))1`b<$CX8Wyo)~hzgKh`%AaqT)TBn`
zwV{Q`S~#v=TU#4`^@QY8(sWF2hJf>JDwP#C%7VYRZhgYVfH7bw`uvl4dCArb(`lkr
zoBwG6zXy2Zh-k0FNzR?<LvjSZ6^=b2%48+CYTw`bBzZ^!cN5)eW%6kt)>Y^hB{p~p
zYS5nU4indm8y2#Pg^0WhJeR|JLsOym+Njx!&}<X->$1jhE`~F<+7HbP4#vL^#s^(^
zW!tt+YJZ7>(PFDCICvI7de<6Md@PA~wr%aZW6Lub#u*PtDOMy~81v2GRO=F0D2OwG
z;z|-9b8$pQp6rtos{;Kpp_dKwE~SAsmH^AFwJUqb_gtBuV!Qr_enz8r-hR6U$(&^)
zU#ae$jLf6X&Yg!MM0=K^%7+8~JMm8qR`4fcn*7R2O6aanKbe^DGAAHm@?A#hT^>CU
zHYn3j(^-2crF%?!BY`y*i^?QK)?YeC%an(6KT&^Xk44?y(2^WSgmmsf!I8mNrowIm
zm4G5!;T{*C<#$IaH2Erb5*qHJEKVnay-i*{@D7tri^H8kGVzTrO&;R@@T|l0S^tsq
zYeeUhbHPrl+u|5vw3d^OuhjYWHM4Q+<3}mplD55tfPdmO5(orv-xc+vrJuM*#QnRe
zyn(=V#`&&|jcQKNM9sj3(YGeg0Vs)@+K}f1@E~Pv{%2n~6a}b=afilp__|sVFX!gw
zSOQNl9mtSVaC2v?z|?fK{MX#;(BolIYgcC^mlgBEyu!r42{nn-C<K>i3+VU>2`iXI
z-@YvWY@)lh!E{sq(74e>4v^lR*B4=+Mz3pQkk>6aC)5C(LuCVlJ{~k?Pz_RZCT-oT
zUQUVxddyc;ckvp(qL=;w770bKBDHcv54ioXvkZEuA^#$TC#+p@&7hRosxI*S45A@U
zKro{sbqC&+Umdg5+tF$Z6bNW=QjGTEncbJzh4J7(x5#f$St8Z>@+E+rMh~&tEdpEa
zij&<EHu{B8O%Nl#E{#GlsM8+nKM2=IJ+9r1K;bM>u3**+iWKctAnu3^`4TP}P@CQ8
zt38LY0EoT&zYRa=Q6)JYPdpZl)yQ9CP02kF+_TwQq0j`;5F94>T}~jahYE$g&XjPS
z$ya)J?@>VKrP0b#NXIHg`9PBuu|a9!`61%LwU2^~?Gkf41L17a$=Yk*>Vz^{Kp^)5
zb<2x7OgbrCIm71stfi-8?t@;gap0jXpPe0}klzibEV0UYIy8IvUyFUC6#)|0iZxF$
zcbMq~DoU`Brk0PNl8R8p>gI<Gl<E|q)jU<}>=(ISOY~O&qZJUyvd@K|sLB8l7`)_U
zOh=OLSDhZL0wndIZ*d>yDqzIGf5v}*m7Bu}u62PLL6|uJmEzFz6kj>pttG2Fn5m-Y
zU-BMHU;48Xgz^!FXH!0CTY@{$wJ;E^!5i!e{z*5>N9b3o77qvR`Flfl&dgj#SI(tR
zVabG+0<#*9;KopPg!Za5ee5A>Q`4JuM4K-a!sA?*Q=pw@*#BbxMBr^&6;?s~MNs;j
zD<jN#y@+XbHjyUtT?>{BBCw*V(0{QJ&?Q+}KVu@hy6AI0vk`8!Xl6S=k6=thPkDbo
z>;*#KHQnU0Z>N!I-p7#&eMuS}H>{?ekjTS+GPkio$LxBe<JXqE3IXFJ?ct8Nt0z%p
zlyBnnpkNEJy74U1oj7_e<4jzso<A&%*>{Vb?U3YM31=A9#uLvO*^ajr+Id($KD$!k
zq=!D<-iX&t+IEm@&HrxN=rRN=6~Td6q@us!Sw@_Ub9K{4DD?$;uKU5J-0l^tx5l@6
z73ii1rmH8=7nszIA5aM`CrhorGZAp4iK4LFZ^I1{($vuBb)c5a5t?rThxh3$*{G8=
zkN5s+PK`QL8j;s3Ma2mOpU<aV_Q)Q(j%C4^66}4?HP}R6KB#mW#1hy=lmK>N@N{CL
z6SOcHn;vo%DVqoLy?4`5m3p`9BCyQ&E)s<FR+ng~x<B7+d;dNF9YImb!br3;1)|8%
ziTg<D5WS(_`Ki8YOV2%^ZGkiuY!tHFP4p&c9C8ACAg;t?-MY$U?ZhZCb^OJ`^vbBy
zhFkh6?9`UQL<h4I;Cu;KG_N6C%7Em^9r>d~%R+T+{DEjb#^1j|)}JcM+t?UY7i}Wx
z#8!<F%sTNBJ$OMr0}j=;1DyNZY6*u_4*^;~jvIu*%n=>f<6cSN!;jfQ17E<-B3nQu
zbJ>MG$x|BEu*A&F{F-c@Dm1A3ZT+`gXXfC|op<4uC-QC7=T5m2=jJtoMrq4zZMg>H
zS1^x5u0tdQ>c(-7t;$co)m04Exg@hWT0San2!O%alV}ecGltILxOPD3_+SwPP|u}7
z*U8pX^53vDscx0prB-Zc6u>$IolDyPXsYl1UXYxMmsk2it4W)1Y6BHj5@h%(SiVDE
zq~kE!jVuM|tB))uu`};Ry3v%-+RTHexrPY{@zU+05^f9EmvmHHjIb`>ppcP}pkKUN
zDAwQg1p97On9jL`A*>Us_!~Y{r-|_Hq$ezmlnwW1mt)e~2%@iShYfka$`g;6K4Jv&
zjl<wx8$Yoh(~>?cR88WHzz8>TrubwdDjsmMbqp4|{FEzuGmL#+ZQ)(F2<u^KQkkMa
zoCIq&nF|1)D?}9Qtvbu0>+6>tb}d&mi%RX`XAU9<-&y6+zq1dRWkap8i#k}R(<~N1
zjUm%L`#pIVc?`;p(jChD55eh6bcBRfmuJ(nm}MO1)(yHxJ#<DLuF4~mJ>4I(#cYmZ
zl5L5ztJ>B*;$D5yaQnGT`0=$=2lsuh=*=}bt@b3!nwv;cyM@g-qVdvotPl!c35mwr
z3GCKthhF33=?sY9P>h0Ls=Fg<nDHp=YKhwI92wNqf>?pBlGnf*5iR&45Jkw=6y}!|
zWcV_u@_lwsTpSxSzQStp4&AYFhTTHN=ej!;20xGHTqW^u&jqe^h|h6w2-Y+gSU0qX
zqLgl%6Z$rg)e3L#Zj;_^nn7W<CbA|7&K8fBS?9ljw8YZOAqDF$<6fcVpAtp5b`S1F
zunP;U>5iymuqHiq#Ju0$*~t)4I5C+$X3CoZU#Q@CD7onw?Nm@ZLftEnmzN~;h^zMb
z8f-o-Ly}x$?%`bF-wb_xv2KSFaL~G=lVO6JFrS!+0M>YH{)1r1Ip<EG6<$ooUTyWs
zzpAWF4jqzDeTFG2h}uVyL7d<+Z=1rOVE#+KB63%Z-9!>d-9BkH_CbvDOn>>LTAgtK
z0`fu_t^tVL`=>fhkIY*HJ@{dMlP~b{^__%GC{s%*doZm?GFTbg7@0)u<KIrjiO2+H
zGccZ*y?BwrAm!r(K3!O7vQHr2JoEt7dnQ$y!Rvbua)H;60V=T;2PU^EDoZatQ}_9@
zNRLAa=FJCqDP&n@75N-{)@RS9NfJ@7sB<&oGbd{KqTYy#H@LXD(Qwal%{VA!La^Wa
zpx9Z9>UDBUON-I)39aNvRt$05S0P|{0)zv4fg_I{+@E}pk+XAhidH<s)_3vSai>Dh
z%srf6IX+rB-8C96PO3ttpgf1sV}0(rkU-CV)|o#yScp~)Fsv?1!)h`$`BZI!yT7&>
zMR#(UJt3g7*_(nFS!PB<{!;m8g*=lcui*spG^={tbGGC5uTk|Yj&B>I`SrfZ`K#mo
zm}jZ7@U0r#6|(D6)`Q7@VKoTnGPUY27HL30xd5eb-)`aWIHu0}q|n1LpFK|;yncg8
zUW1_zIxjNTy-pgveu%~jwODmBoSnHeiFzjMw^k=i5SOH#ZBlmL^rl|-o5AT~=1ZkD
zT^TbCI6uo-K{(MGR;=6J|GqoOrs^+j%de&7rlC_@D4VI(<Vs>??q-2LtO#f+oJ)3I
z$)RzaS(k2v@C_|(H}cl`*hYD>v|+nK(e<g-L~(F*{FLdVG|vVi+5L1D;|;Ng*VCiA
ziG`Y_S{(RW91g#DpMR~=&O3qcY31kxtp1|pj_uSnGr&?5H*F4_c?bl)f{})wUuy&@
z+ooXT31GnQ_<Q#UgTeqUDj$)uH7k7cq{@`e8r!-i1Uu=>g%!|0#lJi$^P{Ra^4_=w
z!k|>57?IgWV4vO%E4MY*6&r1{=CRu_TN-?+5?*b`WsBOga^j$=uX(}~W56{m6Je9@
zqnJG(^`%JQrLgeb<tdI(gT~-D#_|sz;zcpW=N5!^ehl&4`<admt5rd&M-8IU$xh}g
zCmTfeVD`|{OBx?P|KU$lUoUnkR0yPm>Te%wMiY~2v(+n-du#?TtWTyr(T~HhkOl?C
zC6$#ES}bVA-!g8>ZpOkN9@v=6-uEDJ*Vos7AA~zIOEvM`WcnFKF)om&<rRjriTX4C
zJyvrKE+N}oFs8HpJK_7yYfhcjk@l38+CQRV6H1@UxWD4bO;Ll2rNZD~|M8p17uf|a
z?(PI+aoRjI%St`}?=T#Oxf-g1qWvRDj3e?HbJEFQr_r{{_gJj*4Q_oI`|x3C{6I?T
z#+(I?t)eQl^<5ru%-YqwyV&-B=A+?%o>+vIf!bU!r)lOmdT5ASnn){*F56aL|241#
zqmC#ZD=T*`%Y5T*fZ8Q1sA{maU0zzE2eSy{3FCafEZ1E8zsDo~`@+jbW0aX5!LoCi
zg@+;%O>dhj^180>PO39Ib+eCH`3ke&mT5PTl^9MaJ)D6xB?%HYH#Z>`9~+xoL`Za<
zyk_aY1}k2ZcyjrN(#6VM();_I%Fk9#1XMNeyrH2f>zUDWtv#S7Wr(>yqRt}r>Q+y*
zc8}!0uQL6}#S`195wBI*AVhF9P?1wH9Uk!$HsgNXq=ueX2{z|5A}0HVyYjK+|GT%a
z&l%*~Y!qcGe&k6e7nZv8q-QLok;!vcU0rpI4F-Z%Pq<N!@_jxOUEIwl;TXt}-^3OA
zWoMK4uT_s5g&e5k($k$uN~uxnj0y>H@*{PA^k1(Y8Foaa<!IcB?aszZ0vUE}=|A2{
zh?M{NJ-IybW2_5Y3%C=p1vFJP7kG{TSU{U8dh8<ZTZhWuvuZab{NrQv#*Y6)KG3CB
z)ZP~@W32kmp?VOHox;4t47if++*$r__Iw+UHH+p_QH^e1?thceb1|j3uN?@(g+xV1
z(IGMhfBshGt*n%S7<BnmFk92n&^$nGuwH~b;Q@SR(_%h`u%uHue5xW4h@xV(1=`e0
zN{N50iUi(F2*mfoLXIL`u>2+NEAT)Gnw?A0okI!IKL<c!vopvu1Q|D<E~XJotAIyP
zPvOF^?3UBSjDdmCs;VfbA41NK?M<9;ofbu)uP&jX@!7`R%nSmv%zHmW%|6Qg^FYpi
z0Zj==+7P+<zy_U0)r9u(>FJhMR*67JgzP)i()@WyJ%MCiy`-eE@o30XW=@k2`aH+T
zjwjDaP9`9MP<o+$fi_oSQp(8iKQHf`0`BK8X!J;*hQD?0(NhnB=X;kdFJHTswX6Gt
z=5ISrN*(ZJ+*kT1${$aboIGdK*yZrcXuSKwa_5N*Jc0A`+YS?A@B`k(Gr`9AMUq#U
T`_AbQZoyDh(p0RHw+#9ZZFA8|

literal 56307
zcmcG$Ra6yxw=b+nC<usB0v6p!3DO9HfONNXceiw>gaU$qfHcyLbV+x&fOI#U$@A>@
zTzucyW1n+z)|EqG#Xsi!)m(v662j=H1gN)e-9i_6Cn$64)}3FsZrxtIiva(l^Jw1f
z)~yG(L<ITe91}ODk<_qHuaS3Bs$+y2=;h?zZ<zOPg%xv3^i~WOSHq)aD?_m58=)Y_
zC2#fOriVx2bDGt)>3w%Am!^&14%!Z%4R~h9<<*6SCENXCeKP#~GODVof`WoRCaaxA
z=ST~}Lo?$1WH<ce`v*$i%ejPtTuITbbfQ<hnn$h~N4z56)6>&4GDs;FDPB*WVj~-J
zb91Y!PltqrEG>PHj+SHb(eey{$Lg$@ygZJtj<`5F9i7>I3R2SMwl;&Wv^F0{`ubk7
zun4NP4pC82Az;Cy-y=LDgWR|?p#K@K`+ITm7!Of#0Rh>g;IOc;z`%Q{Hm0Vg&dybQ
zH*fAB+2>_qboBSsR4>Pn`H~WraoOu<-y)NwUEr5nzyH_sJvHuyCvR<Sef;=w(f!NU
zd?tp5&(%n{_sh_UZyt}Mld;mUVm^KP)Dn*5j?uU9l`xn4(an3&^SU3pnp;qi{P}Z$
zraaP`gZT%!H*dWDd2K=E=hP%GNnW98e;gSemOnv%a`TP^N#A@BGHv}>6&s5?z+&M>
ze)9sIw-K1NnH!lAO7yLn{_FqF5SsOU4CK+#yJ4OFS)>4KpRtggT#UV0H1U6)3iZV+
zv4LXPjuT(|fBqx-&duN0@xOih{N`y>r=+B%ac<T(fN~W7Tj0$<qJQ1`=a0W5A{*ZP
z4l&tFzJERnmFMmFn_qZ$@9&$dEZIzZUsRkVUJv*65wmdzu{dh^hv73b3`jSBlA5e}
zg}9ohT3%u{DWraBV`62s>vncf>w3!Mw>?|$FN}tk^Zh&NzdK72hgoj9G4``o!2ihD
z*x20MTrpoQFf?><bd=NbLvmhT-oHDw9W{E(%+PQwUtRV7`$YCE`^~D&Ne5b$5+zYl
z)a-uQjQ2g}`EKXOetyUdY8Ah_H^-a&F>~|syuI&e*15jmsn+i{=Hm3Y;=1qR<b;TL
z!k}74N=!`4!LipGYVz)H5iTyBO2A`Y*MP>Fw?XUy#iKu@FLxJ(BO~YM=TpkfrwdC;
zn%f(^QM8<Y+bwsJ{Z36udGX+8kEs|6$}L%p2JpjocXtzBnc=pPQcxWK9nO5yf*Ssm
zr_-EXm5|WP%*;mx2Pfv++y}W_J3Bi)hmT6i$_vUiHa7S1D5dzs#Bw~YuV9@%=f3ep
zT_4GN!sQr{i{x`CnauNoESbZu$W*!QAz6^ltyA_FFK(lAaBvU{=x~w$I_OSdZF<O9
z`|l#j@2Pm^t4|_@H#EH1Bk4`%t^aW4MWdL%#Kj=m?2E=3O)oEW62)xLGd4E1HC6ej
ziPdBzA`}xHy|l2<c(Uw?pP8xY4!hX|%lDOXi&<sm@j0sIRWBs8t35GJtFwax+vtwa
zP;psV*?;z#czKzXudTIpURqdKRcZzf1+VK#L;_X0>9}9p`l!X6w5F!!tE;_b8n`%Y
z=2OitMY~{&W2j%>i|VC~cX5H8a0)0l9?DZyOuV{u(PU#|`}a_oz!PiMIAVqW`ST|`
z`+9b$Kh0l2!25V>`s;p;m6g?AJ@M_}I|KyrUo!5aqBiQhd83`N3wyEfaU=h}cz5r<
zd(@SWuplB5N*8W);%^It7dOX}tHb1Do!dD^BMoXTr@bj&+t}nJn_(ZHs;VmO{S_fW
z!SByIx(W34_3<rjX(?RkBqb%e>ReBYY_ph7UKd{f>Lz59{K`T0&#o`~*C4MR92~%h
z*7_!%FmiR}{`9FitoU2H*RNigcg5yanvzmeQ?syO-wA)l>pH)wr>#xwng<L1qE9hf
zZf$Ll!eMKQfYbiHKgOnJ{Sns9<qFsn;Bmz~m?&MxrB}no!?Q3n{9s_<&uB4QN26Ki
zb%An-?Y`@~p-JOYe-)4S>{<A#slM^q#p(WgS@*N(6wCfSx`2GON+$CuA9xVICF+c&
z3pV7jUivXNH%Fx4ee)8O$8tnL*l4Gmntvkm^33{E-@-{aAD*?6&Q+3rmdy6Xy|Ae0
zjU5*)?fZYKL?=b8g2L(Jf6K$wG%a1;-aIbGKll6^<G(Eu_xt{-IHFQ`|GcK=+WNYQ
z$-1$TQFd0=z1jCdLP9DkDl#%MZ{E0yiU#q`qTOME{gbZiA0B39WW3C%R2Gt#mzV8?
z^3KC^)#MLrZR=TADf#d7o;JY&?(2JZLb1BGW@KU_Ea*c)L4kG<y8HB|YNfh<(A7PV
zOgF&loIyg1hjNX25X$&Z9b1mc&(DvH{JA43D=*K=%>2k5nS*13fPkQ}SEReSnT4KS
z;^tGQ7U-Fqd+t!X-a#iA;&s|PSsyK!t#gY@Sd;eeX>V^o?!{KfQLvdP;Z-R!4Nh(i
zO^BmaZk?QDe*K!NdJS$|khP<s;XC_Bxk^7%_-^kT^gb<6DSezW+r9Z^=TqP4Xs^HG
z#IIk4e4bt>r$TrdhMJnQd?!D%a&mMq=NJbab#!ENxn?>Y6%-X228-k4<M9hJGm}dj
zvgLCypYaHtApic2YG`Dn1!uQyNX|NP;v4^`nOYQ7So8z=h#z%_naIWZAw;X|gs8Kv
zEx`toNn8XtIPyihS-e-D3$n6erlX;H3Jvw7WZglr*Q|F}CQ^`=#&V}V-FeZtHfYd=
zu$3v9+}PAqZmPVpy-l<9X?HQRwWWn#<05WHhf=l7)!2A1N0DJ!SVc)`zG&n3mq#a&
zq0KlgQ<cGRSg-zsN^Z~G;c*Z7!lajbp{8DSkSpEPGB{|~9lyM{XmxM0)Fc_!<lgMB
zjd8Ty5nhigTPQ!qBe~qp2NC5KZXEU-&c|D!qXnAx;3It}H8Y#uNV2xhuF&hs=!z>C
z%93^2T}a1#$~9JD<XsvgFC#NB<8~g$pz3M#ceH@bsgpEBFkqs_X&vr6qxE#vFstzp
zU(w#d0d@k1qh<Y<FGfv%;xE;*q6YtT6DsDZ)S69(<)RJuNeM@8sk;80P7}sNK)8q?
zCVE1H@q`0b-Cj8SDPQFSd0rEfgy!aEn-vN5N^7ly)j)FcjMi3icu%~xh6Voqgrat2
zqS2!7L+YLO&$48N`{jah&9-K0FON0}l^1bwaciB?Y1PJFaC2|YH&weFZM1h&$52W$
z$x@$V>}3|bc=__fbXAOMSuU^3(f5puR*U*>TIHgW9fsj7*<*#g2?K)1_^Zzd34^()
zd5g@aksWKSms1_p^$ZPlb#y3rZ#%PL(<6{+nVIE1q6oV?+j4$vA@Jr+mHj3il&#1;
zfH=h-qGAF9X(FFm3p7Nw8pi593etUB#%)%lo1gU6YX;+XOS7t0Sk`^XT5It3m(ovS
z(tFq%@|1g^rDb`sZ43>M9-2>(IJe8u@2RO8({U#Jt^PF5cy60NYW7`kKjPMrIUF0@
zU40vb-Lw-;HAqKGTcA-(goD$cA`r)<N3=a%{WUr|F(SfpZJ_dad-m|}aDiObKpaEz
z@$s?6OpScXn<K9!6M_4Db=_f4s!6z$xm_A3CyN#Gs(N~c>njM}_3E^~*QmCqLH60E
z^r&myYVxPt5Vpd9?0j{x?2U|`{8G#3d1a=CMc+5AvHA)h=gSF~Ccj|?g;zRl663Wl
zU7skDX>tcME}<#axnE{Ov1KzFXdD`1VPaZ1*%c_dr(05L*Js_I+VVies-wtgFy6<<
zF+{V%vL%#IF-I;-qwoX2TJ3!2pWQ{21xK}2IE>Gj>zwwTC(F<U{6c=2c+-5pJa<^2
z7Bwvs4(E}O=uuIb;OD=sTAq)Fj*hcZ>pop-zv+yO?B^I)pjrQr>T!;Wl=0et9bD3}
zT9*XVY4h2-{#<1-8=K(5LMf~J*<H_g1pR#wIoYvs+E|Q-Oxwc57hY12kJnZbvKWSB
zTfYB|a(_|gyWRSc(#p`#P^RRwt%*_`65%kSaOYPu9<i|sh8}HU-KFb8IU3z$BqWz3
zdFvHJkB+&D+)wv#N=r)tBw6`-*HY^)4x|^?Iv=vJ(tRwiyTKHlCkvN^)%KejMY_sa
zGGthfdz0%6%{QI7xoa=ak4r4ByV8Wi!--xy?=I+BSXd;k!;$usoBm-%f|!YnP5|(p
zjDkXki3OJNkNI@f(fX)EqmKxyu^i^7PWPC)Q$-vKGBPN?#HZf`0}eL+I`59;nG9z3
zW=W^v24$N~l!ONdKXUoQ%{3L-7J-AME*eKKTWvqh?J{Fv*4L9SWo`X1>OS?<U0!MF
z$kzoQKPR=k{qW&*4{0_J`|Gts_2OZj{bo^qK0Ol+eG0jFd{_{-=<&PW3gXAFt-b2&
z3$n9CYn?+|)}-^xfBt++K(9HIrCP3m?@bv(%lYA#l*>8s9vulw8taCG=In8M9GO^b
zJd>WEV^dvS-E9s88Clr~?a2D`<7ZyFRAFtt81&vrJZ?U<Tsp0qhNnv%X@=RF^)D7C
zpTsDtE&KTTPStx5+K9)q+zFH&$*8ZN{i)->bA|ufI`O%9M@I*hqreA3=IKrM%QGDQ
zD7S>5dKG15IHWqx<A{_83fXdR?c*>ze^;;v2M2doVKS1$(qLc`vEMfVJbKDzp+Ou8
zz)K=xs!gp>r8K_3zaNhwiJ7fjP*{YFV&xM>xS*g9G_iNI*T);<<;KH*lajW=pH7z-
z7H$n?B}CL7Z<9TtJUTkMAwA1%yZatJJ@PwaxyplsnUX~8g?N#_8XBIy7@Ot&FkaLG
z7nk1|m-O{O{)gMqC8-ffyX*Ta=Gr9l^H}`+4W-7z)G8%+y&N%?SGEO&h1tl-h2EP4
zJhS;j`=+l^XnYL2lZ8xMb+NS@DjGoNZLfnz+Ngwrv(;f?Jzhv%yWVFUe>%0+iVkSc
z8wzIgFfPUOC4e{W1SlmYC56=?BT8ZKFlI<5^ABea^Kk*UU@UraMzz!PLpJk8QkB#G
z#MsYIeRwZ*T1f>hb*IS06xdA1Y`bFZiu9#@OG`?)Z2l~LVQ$+s8O)%YEZh8OT;jMw
zZ(M7$($id%De<JqUAPZ><?z6k(^}A)0ju*DK*IXVSGZ#Q2tvc-J^3%+nB}S1^)(jh
z?K6hP#c?9gWS3z+o%&?{ZYQ3#3$deCkRVU>IyEcHcS@~5gGA0FQi0iw6}7dYfgehk
z)FkfrQ>BRS#){*J_*;Vp&+{JvkMf#eK4Xg5c=Cis*SKwL4AG+Q<1G(<XFE@tA#app
zwQ6#a6>pUAzR~N8KmqK2#R3iDcRadAQpNga*q^Pm{E>fd!rA1nd=lq9hEw6!#6m^Y
zA)hmXT||L9y}7YbtZ)hJj?&;RSLNx0`L4LAX6v1wgGfjJ(E{dDx)aJje3MFf6VUVO
z)hi%V&fDwfZO@7$gGX|e$=<zb0nTP)mH)=~nm7C@r@iaRP718Z<EF_nvo5Qc0UwKd
zto)3N#I*B@ON!Whj32bMsqIs`2w9C09!`wp5lW4!mKeq~BFoDUKYaM`Pj8&<VOr66
zq1Ge0Z_pf~r%~GnicfOb`%>RlD;D71ot<I3*Y|@PZNNvdEO#mYD*>x9^k{*IE5g@~
zv@+i*?NOp^mpkRHe#)ndvdXDGdh|$2q@`Fk^XkQ`sH7y%k2JHUy9-e{LBio%LG`JH
zLATU%l|&f%fNso{Ht?Blzyd3cPq%K*dR+Cy{o>;tYH1<-D~*BoosA5S)-XRKBk19F
ziIE3t6mj`;^`?i~AKi~O0@({3MLx#c%E?JwSM_!$C~`V%dA`2}ptIaLd<WrT3GMgH
zjD`}27b^mbamTw3V6ndmzM<bIO-{s_bp;anIbFct{B3Zo<K9w3nHgbUC5Z$s0Rb&W
zjmt6eZ30Dvg)$xIp)M;#dJV48&Q9b*I~0H7F}|8Eaq;e=b@Yz*_FuHEt=AWLN)NHH
zE^Yfb^Kx?bTRNU{JBJjT<tWerU6Rh0%c583*d8w)?e2ae$z5^%Yjo71dt%t@`;x&m
zu!KL|31+iD58LO{xLs`HN(*gP^0k`W^Az$_K1fN~9{3Z*9@6pfQ@*SJoo~BV^uvgl
zkL1(yvW)ck>nutJWaKjvw^Gw_g^PRy-G??dIZS$;$jHbk`4<3f<c=rGw|%C3RZ=eE
zf?Us{we<ANbah!i{3;L;2~2pE_qMf3##-Z3E}Q8GJ<;eL+`3?khu?y6>FD1*dTO8l
zyu+)1tkUa1!DwS@X-Sv2{<xyu(kg3Z{Tu^HZo`n@xmW_~d<GU_1D~yJv}^H#Vmc`)
zDQqngzq3W%NzMf!(q?;Iyy{VSV`h3f3AsK2mA=~=@3U(sWhFzYh<f(K`1rl!gU4^^
zrz&l7WHYx8*V&}uERKvsG4P@dL<F7D=Mxq7*sZ^M(}{_S+CK44>GKldqg{!;9mg<b
z{qFdQ3~?9i78*tSR^xAfFZPzvj7*ZRX7X9a(=JXlJ)Q&_v(f7mmbaW6SS#6VsMf@I
zdm-E~WZ*Y4Z|rZY<ZcDtLkuSo3Q_r~J^uR(^UJ6GPFEMc_`J>sKYG4$&QrX6`4TvX
z(I7b`Q!K-_Ql$*p#W!{{%@Z3DtogR-X;4n~C?peqYq`nD4%SJ3#I3)B7@DR4VA$E#
z3N4DZ+H$G=-YP|$yFoz0*m-ChFo95f#;etSZ%T>LELo4ODKaGw>=fw_Z$l+V{&=G}
zNTZsL6|VJsO>jAW%5I<gy)I0{ZTHXE24&6kY4!A-uh+K;Sk<Eye~#bH0yK~NJzaZO
z;e%S-oHH@0;KK($i~o+8eYB=MI)tZsNzTNCKxRCSS2dh7`ruIUG<LQoQZ62=v*iPI
zhRrxzK}sPVMu291$f#sH5~4GIl(P3|L7Xk+>Z&2h#Mwzrk5m3eUETu=l3dKj{HiK~
zGPJ|P_m9*nty7#2<MUK5wT+CN<{OoLL+23gC|bjgvEe>^IU`BPmfxz1N_cp_T`X-2
z*eq;^j8aEuCK#{xDX+Uygllf8YR_#IHKL${n|?+`MNbd3O=(`8=y;pg(l(d!{P4(3
zWVSjcM$ggFC--Ey#K=ZRhh*sLrA!1a%C20oKArgc5NS@(F4IhpZr?f6;cv%>8{cE)
z#)Eo_o<(j_h?T<ZI#rR<{`AK?eO=dl=~Tk&@#2&sqcEcJ@T3dOXQ?3fsp#Ah4!gLp
zklL836+g<mAO4h^&yC~7iz`C)TT5{l_xg~~R7MJBl~h$Hd-5%PQ6;>V>Jmd81s{rw
zif;9#B!q=+wS_;cvR(6y&(B$Z%Vl@?mrQU;rS$Kd3V#jVe9u?H%?Udq4qH%xMychk
zh5Dv`>J&fE%FFm1AHN`q6ys4cQs;)}<|a_XC7w{$Tu`9tQ8z>>*Is9{@|1^%VX|b6
z((GE)e1vG!E1<^Fz+r9RQJi2vW<V6?vzacf*qt4y$YRfvKvN4W$LMOZ2d46{*V)Ob
z6XX8l-N~)yoN|*<dV_MH_?9Rr9mkEJ%Hl9+XfL%}8T2Fy9;0B;0c?6hACR2aECEo2
zQn~2;<yk0VhXLY~)Kp@tA+1~65*zk4-eR$|p;7i(GEv*jPRI0$*UhkJAf7%ojjpnO
zZDncs$0K>W$sd3GrKpid`Il4jQ2WgZd;)-Lbxi&qLInMfv;<DJv~_GmH}AgHcE(+*
z>c)u@KO*T$wwQm(#<o3_rMf;+A5ATPG+kZJY#?#(Zp0AN?n8PN7L=4qxAPv*gj%~Q
zoe!CQ;*oH1-M3(kw${78i{6<|DVHY2VLG<j8S~X*s)Af&Rjt-}{MWC$Bv>c7w4Y->
zf9@;NBcw%J)?lGOdU7{vGFm`t;3>N${=m`czClgRRLgGB<f~?$=-eig5nA-SJ8d;e
zh}vZNp1PXH<OzyTt4O0hJ@UA;(_QJ|F6LSPb0k;u^g+R+qAG{&vWhZgi=T0?o%Sg0
zsZft9^w}M@Sm?$4FrEyTZ$FP-YGLs2i8ymn#m*%qsJB~puC!h@=#C#PHR&xjket`P
zgZI*F33ZQt&#g<r%&H|SF_FpnK#+fcWDq;>*}1}v#Ia09O6q!nPvWWrN-Y${nUTD4
zch?8I&zbhnX0L>tG8d%2E4{NU+zAc54k|tQ+O4Vd0tbh=7=g0k&lCZ5?p|`QDzLCO
zE6ZIgXt=ca7xD?-3;9V&SK&7O%nn-*qjU7wO6F2=@$8Gl2GnHa<pmyKqM<!Hm)*(9
z)p?tA5`OP;x6MKs?Juy5Xcth|{rrR)c}cmspWG82FX8JfDk-`6qgh1PDQ=6K@+#5B
zxhIA7;4Y%aX3MS4R$jTdhMupgQhsrlXDx224;G3}mYIq)aU}eDzR6~WG2Y1U%l-bC
z&-yOSwYB3DEK0jH2P^~wV%@|M++=675H9n+#K*U^v~-xS+$_c!%KsLq+y_bN+|kTH
zQ3$`zs`mJ_t>}3*Qg;&04Sg5Ojm=61;Zkh*ns@mhnf!nugWmPwjl>l|88?JP{*Pv!
zs<uc+1fNP!Q1rvce*}CPgn#5MtjLG|k=b_!5m%|@vty|iDKXYpSIaDB-@;=)dOY-c
zw6DMa6)WBI8=bMA_eH_&st*lbCZp!V0|T8bGcD;!`T0+gX=!QU&xx0mdy_5?4-c=*
zYs^cHS$W-Lb}nCZ$Cs)A+}aU1I~<KfJ&vitcv2Pil$&bso$BP9&scXrPLj>+Q7O{h
zOni+NN3X6}Vrcc^JnmzW@z9U)i_<Q|8v%@~-33X-s<PbWcm@|Y7N1hHPG&T})~AL_
zI`zAsU+ZEUW{alD(2vX2em7rP9;ZFal^(jr@V4<v=hHn2d?|VPnzqiEoR=me7eE77
zr1-Zda9oCscNgl(#R)FArW59y+Oo2<^^PA(DU6k8XV;kB*bjT89#>S`JZ{JeKcuK$
zzt%h6q61R=FxV9+zo=v{-;TVj?AywN&X|2*#G~2rD33FwQW~YDrO%Jdj`#MOqv=#i
z@-*us^YhI=e7i2vLj!2|Qb<;I@npA2`@GbIZD-f%D=-Kx>@qq!IyO@!Pc0ptK`fG1
zCFSuC{RX{B6|SeQy9;FNLq>Cdj#vf>j@H=_JF+ab&J_!4dXu<M&$n$d-aq~n6%~R2
z{H~b%J-$YoAKHkxy84slna`gwq5p)2ggjWGRxXN$t5EG=5l8<uIWjWrH;3(NyG(i~
zxLq3c?#s=AO&J;bvKhY}w~k7z(~Y4hg@s;zHd+HMsn!J(#7+j)qkVNsWx{*t=v7ut
zI5Z3iIWEUMlqDqlPL36UI)&uGINZ*U(EZBICJQa+QPtAHOG6znRR>61V!ylaWq(Do
zi$J=f43v)3jq%05!zO_Y<4_#%XqDVo`;t&Fx3prN4+&nGj+vev1Zty!pabFtH8O}*
zPA5A&*jL3{_8S}rufOq`8yWfPdMq?YrU<lw=(x~bsMp2u+eBaC!&o7s<12c4&?}z6
z>O|&gjbsXe=rFADQ~O0yOJRKc8DOOwu&{*$O~~Om69r?V!Nf-qWjjBLOw7dCSZnmH
zuyCo_Bo;&8PaTv3^=dD9nG^j_4TtZ`&1>(Yhk^nLTnBC*{mpGyesd+an47mbQlN>0
zjop{o`~0HHCUeRC&eG84BwH#eSa~6y{+Qb@&L<}E_>*QzO=t#oB3`7~+LpkssFoVL
zoFCbd<{==_o*l)MNR=9+H*+eVhlSz52O!5F!D+cELVntg1K*AA+Q0(s?l{iWxfyU)
zH!ArA28xWZ3i{;9Wd$Wn7K5yola&R^bD*6DD=Yeav;nm+yWpT8L4`-8afsf{mDGy%
zb<T%-RdzH_h=M?~kvkju^^i;yEXh?6IG`E-P$}gg7#d}x)W{uL8x#ifu!!Dm=tp3G
ze<Vna(V-m^ceN99)?51e=6Vy>WO`fD^Q+JIL9Ff4b`TOmev{3fo1gC~%vt?rp`ha9
zc)iC;j-m$WCBhlMwfL1(pFH^rtvgq_7@&dTn2b*k^l}b6f}r9L&q+z8i1O8|dFbg1
z)mM6x-xSiTSG~8deu77#q4CsF58iJWKI7IePj%3d+Gc1pY7q6mywu7rD?6I0<-EAO
zg!@eIf$1=kiScYEn8zQ`h_;zn9KFj@`;`|`ceU->+WcCX!?wLCMpVhkU%4N1KEK@n
zx2S!bA8x=sJ*oLSlvTZf)P11;i4I%rF_W&~yLatd)02e)g%~$jO?qod5{aO{dvcQI
z#S8O`lPnI7Dh-V-{6H0kph(I{V!MtwA5b>@2eyOplJ@`5(aC3<YHJe<@wi{~&CcTK
zy<IZ8;BeS_KYjqp)epU(`p&IcJ~A9E<HNstN>hjH`G$kP_%sud^>mtfl+i%QXdpo?
zr~HN*mEhNnV~%8;lfYIWCMH&GwP@^(EZ!WcrKPpf^R@9-S^B%kR4>wQ#TuKHj0%h&
z+QjQ=?4k3A>xw=;h<Mbx3}~ed4W3Gd39p_MHY*ore9NF$RTvR!{#)=~e&z3vK=YXz
zg_DbvjvoA95>1ER)#uE)^4l|)NF7KY<JoJK&g<RITNhe#q{~5*duxyOa8$vyBQ=fp
zeKHT>=4_1<dW=5y94m{|+cIniY(XKv`GLD)%`-yi_?*vDWarI=eF;SrBc=?du=zEo
zR^C<lqTvOGgfw<l>38payj73KP@~_gF}JGpbYE1n838r9k!O3N6fcU~Z?_ff9;P}j
zod0M66V(nB`L{s=h4MYOB=>j}X8><`69n;{!9uN1P|<XP`??rG;X*>gm4mywITM8Q
zm5GUGbD|V!oM4pe4hlw-@!TfG&4qOnxk5Db5#tJy*NT1zwYVtZ;jkeh!TsmCAMn#n
zqF+Tad7PW+gR+yEd46@txs%Ht`mV;~PNl-h>^Ym%UNZ^PC-%ppfsQ3VBYhMRx1f)8
zs5qV-{HzdsA-ub5wIIXO+M1o^Hp6_^-h-Dg+?7h90E=vwBy6<rgi8;o;`5GU`r&N1
z{I9(3*3YQ&l#64b9Jl4_>qpIL6n@jQw3M<BZGVnHd=%K^?!Mi8`+IAn?~}9RYk7{n
zTHCbLmdu&@YcBMKjP&#v_Qa-%AcilF<@Yq04lv(Y4FB+w;Yi&H#(U~f{wI8c$FT3E
zDJT6)s9D96n?(bhN8TH+wm>+p!G*18-PxJf(N*=&J8|LLl?7~UI92f)ms;qwudh%v
zCVOFmPf-ys$CDMCLP!l4B`PY4$2DTZLrvvw)Lu=-x7BWP7tIvou!V!f*TK47Z!6DE
z_pj@J`rLpH&eKQVY$V0j_n+LIc&Gvv4mhSDVZGhNZR!8hJqaK=U+L#NcU<8%)YVx$
z|K;sjJ}S8gR{`Iz_++YOrt6!RudT=_D8dQZSgP$FY^S$+LCHnKrlh32vrnuG+WX!>
zy3Ig$zl4|=PR<`<UA3R=)PD!kDV`FtnfpDn`W;Qh3_4tNY2<sfpuoUL`J(RMsGYGq
z7BjTEYNR^RRsI-Hme<#V-&4Ko`U?^*DEpGMEeYRkip!WjZw%+efiKe!B87to{kh+#
zp06$d()HIz4mC8AfG$6>p4uG8(kvJ+&h+;c`O_l*AYaJZ9d#QKth-$K9EJKscB=|l
zKj`|eT^)Hv*D3@X3M0^zXHCcK7Vv8h-pwzzqCfhcOe=`aLr?z?>h1KkI1EKxTYF5o
zmU0$AKv6Y~HPLLr%crz9Q;X@oIqmXXhQN8VD<+2>@G>D`0u%#3fB&HJqtvspDm$0?
z>+M;oolC+OFZkQ}z^ek^95hFssKf&rs=E99j}F_b><C}HO5viVyw~uP-@BDkOGSD7
zcS5<GTJHwDTiw=>j)mU8!(uP>dlDZ<Mq+82B9dtk5^|cxWf^&vnQ;b?{9K2d`kl(x
zi;;T#M|`lP-TDaVRV7+YH$GERlKHzt00>gXW)?HHbPBmXp`n|H>v33p=ZAy~t4jS7
z6UeM5P}Om%WJ(PCwFACu{+tALpHU3@X=uoMP>9MtH0&+3hy|GZ*rB4K$%&<#B;qIm
z=wk*=>6iPjGYX2#sVX~k3qNvkmAP8dY6mhDSWwWRDJ9YhH@B|ti<g>Tq7ie(UX5x7
z@6!L1AF+PnLEWcaD{~e6#bV0RY_<+9YWBNG8XPeHRlfu8qG!fIKUk_OhFX552)Oiv
z!d;c~Np=}<mrj0jv*6DQwHyWY==;)NdbY06t*mGiXo(oL8-IV<-&xO79R+tXuqwBa
zRnR)>`moV=kkX7;8H^jz21LU%S)tfU9*fzDQX2Pjvp?TO>UB=K36pi&Fyg=9L~Q!J
zkBWM@OM($xE-5H1Old0UK7R77tX8)}W`XTiYO1NBp^qm3**Lm&${ELxq8FVp!Fp(-
z5)$#8ihJwugYB7GR>MBajp47H<x4eXdkkMry74PYe(~@(jEq+j1QkJt6o}F&)<??^
z=wp&$K-j`_sJ_TQAuR<{4ghZNm*NMTAZ6?>ci|PW{yxKAFa=l&E)r6QgZt<+M(vG@
zQx6bWU0Q<By_Uj`sskn*9rT>Vi`^L<N7yC-!A+DH@j|JsNNVV5UPfG~IC(Kjw8aVd
zoH#0TVNObJBl;RcO3{3(VtlDXCt_a8H%5|+G7D^WgG+>p<*re1+ZG$Vs~0vx3AB#-
zzhv+SVo6KZFp?ZgeUwvF6np>vVI3-J>|M*fV`GnCp$EFV1RcZ`cPE1<vNw)2AG^8T
zVTp-~+QUKXe5}C`y}9eGRavCCNn_8ce|o|wG++PmQ<Lo8Af&N^+4#B&0^hu@8Q1N*
zoB#e~oFCp|C-;y|{W^EwJ8I~m0ZhvEHf(RH2jAHaKI5s;w7+hJy9MwnuTYuaDNCkt
zv=iI7UYbNi1a;5Nelnp+y~asR6;aBHkH^ow#k^N5cB+J&SG;FUxqY{reD>}jGxQg#
z^=gHGg9+}&Klt{OS^pch^*@K2{*zbuZwcG~{Zn{xToo4=|C_H`6$9mt^fm`6so)LW
zBu-^uWTyG0%6>x}|4%Yk{}0~Y|DTd#q8Os1i;Ih!c?Q&Rva;HVi4n50vU&!%t7uvg
zwEQf{%cFT9{qzT#llP*1e`?I0j;q@&gE|LWT(RWmm*T?04y_@9jlA6*9j{qghnp6^
zT(sA@p>T325b?TyF186x;yw=~k(H5wzuKItJY8(V_gtm;o}E2WFxv+ip@8~2*R@)$
zrl6aoM}WJW$7QJ?gd&K-f`VL+HaY?y`6KE{q}5*xq=W6P(|X@%Fhc;$^tMpK&a|Y}
z97qfWTO!!oxDaFb`};4uw}K3im2>?7sSv6vBp38h`yh_9SFcg$$^+&I@KoS=nUdEg
ze}}BHvZxUHdoyIn489vkN``}`70aLr2{UKNNO0R4hVu#X(u3H82~~1vaIiojPv09k
z6rlWr2Xi??Msi$P+>VxP92`+=Unm*&DER7KR&3TsSWg*?4H(=nC#p@y_aN*7?f`^H
z@L!oG{`|Q+Rmr@Q8yL6-_I{P+ylEtH3uK9sxLwrB&C~qQ6SO-~aT4`^f8Lmr`Ysli
z^!dL042kd&q$HXrChRxHs6a>j^(;&>nTcMF-DY>;@tT^rm-mf|hJ%Y+WicD(dB=Y~
zybDMQxDbhvk>;kROpZI05Ws<I``dbRg3NdG{xhDQ=4Qm4a>IUOTHt)DsBHTkpM*U<
z-2o!esg^a)H8g=~LxX!Oz@6R~_4VBD&OG-Iom%H*GZPa7EiEdZ;R>r@Wc2ve)m0xq
zKhud44q{^0xnJ|(33SDFw-vL?@VGr3$yX1GRFPTb(I}k599Qe_mj>bX9tH+qWVOe2
zO1fCw<-yt~|F(UgZ>WONY|nUHA4p1?n@f6JyS?hszT3xYT+#kjDB<M%JdRG4o{Gw8
zvh0vS)7i+#2t4PRk+KI8UMVRJ+MF#xF^2uA-K8dRI6YqXKrr3hP!o?xI!sKYE>JGU
zHjwuWSX%1k?gJ}4U5qn`7j)MT_hn4ML`vrM_`AFu_=z%XzuZD|k<`q{$lCyfjnK4-
z=}RgE$O<vG&fNzyV`){Xp{wi39kAg9HK8N0v9gvz)Agzx8YVk-nvVdwhah9u6>G-m
zX-mJPu?Tj5+HQXug_Da5{Ai#d#Sl!x{*9B}LC|jUH67kcoh-*mz!J!gVbHe${{v@C
zO`YNFwDx-8$k~}kQbdHm6EDF14fK4+L@p<N2*|t_?}n3E=zRDvBuge;B}ZWs8r(Ck
z3jaHg{ll}f3G#K&(L<Xbx2(Tk`)CySFx}S9ZhAUdKL5fgAJ$#F^QR7lmX}5?@|<OB
zI)k%aVq*5UM!E;mGjq`^OG|2*65jmYev68U0=p;mnbJDIErIz6iGv*JiU0b;ua`iC
zd3Xvy*R<5fo@8WU`9;NEtqj6~T5$#%eM)5EE*rnB==0R;7+##!ARL-SVIm>?>0$#y
zWGVcaY6n78X^6#@mowP^`Mvw6TXi&7`FyqivVDY+k@3f417iaSgv`%tp%cD>fT4P|
zeN1?77qkfRFHBA2kCoM|ZIImGIt(YUS@_+5tYu)p&{L|_B)YU{y-fY>R+-7Df}LGA
zIK6oErrVolT84%J2O*6&=PE<ut9+gcy5eY;@+1fw5Y5|MSXcntg=$GcMkdPBGllQq
z(VIvkNN<1;3aJq)cgqYx-+Q%9>|D|>;ZCYRSWQ<~Fc>$_O20cFOHH8X3-gmZX+q)=
z-8c{CRu*LNGIfc<`T0Eocefz2Uqq%@&7lcKqf|^m`G{b@*h_cd<Kr7K0*!CyC=WB=
zPWlUEt*BH=@G&fRQO6q_TYGx8f{W#{WVj*R+@Ct`NDY#L2MQu_C$R^@L9I)<wCh8E
z9UWeelAhV?Cr_;;#3g(ChUCJ7&jXt9SNcJ7!ljhj*;}?zp2XTt#_b*dp@bHN{q*Cw
znHh+sbYa-MwVCOMr}6k}$`J=<Z__iy9-67Bh#DJbS5-OBH%7Vt1<*PtoH#IXwm*yE
zyGe<p#ZCMsu(~$To#+Qmz3b`1c(D;BY1)KbfkqRf4*50cwz#+o?cMD9jG^V_C=!Va
z{NJV2)N<LM^NxZgwBsE{5}liyX9mt0gM_!w%?X3VEnLL=>DmVw_S-X=I&Jx!4(2^9
z=&6M}$K&FvswkO_Y!<G~nO@$PILL;l$`8Kv_mZ9mT=-)~B4ANP@!mdz4B#)m`u8ND
zadxo$0qX-=LFL=vS6(H^iRvcWdJ_W!9F&x|zRLa(f(CFkopJIx=hIKe`q9(<%$D=w
zer#jY*4B*9vQIdjn-DmGATkzQt~<#0=@j!Xngi2P)6&A8aDK#BPw{%xDh!EMW#!<(
zfMb!x4;Kei5Mq!d3cS)F68xg_DLKd1Ncdo%h}-$rXf5!@GE-%WuU!vDOAxS@#hsm<
z-@GA0-kPnSu5n5L#ZR9t-O*Z1LZZ>Ar?pjq$Vgi|R$#GcUkk`5bfD5wyH8OMLCU3m
z5J?PNE*P6iA+u+N+ColFE@QhWqSEE~6@o2P4r1cQ$jV}q?&(WqNG+TnJ%Oee*cz&O
zHwyDT7gjVL{%ZIjxFUy)AI!`qA^0|!8J@P2VW}NG_`AD%_xP?`U(tXHxqP-9jdGFg
zeB;sGK0}ZNWfA%%SGT5B@Ag4B3RK*?qAgSM>s|lR0@6ieuD}6%eyRKL%;O9g#?}=P
zUe(<Or~;ZbJEjBQ3yW>gmrUWDeWul%p-fnxZ#w@G1l2i(+HbLarY_*qC!6>0ZIgMt
zu`=QqG@k=}z$YXG;TDhk-Q5aua&m~ko-NQ;Ak)kJu-yM+mX=1s7#D#C@=imv%?f>J
zcsMi5($^rtpk>LA^wO!=?#=T*e!OGkOS6nIDq30+^zh(KG`UHX37A}6)j{6LaI)-<
zL<hSsNoE~1Dg#BO_Q)~sM5EupxWGE`b|%bkgb@QU$rIE$Pd@dh3D>6x2ty}7`8ynp
znrYPc?dS8_!$(gvARfHnFxD@LD!iH{+Xia-`FcSb;u`v;YPqOr3p=W**(SBz4<9kX
zp?nY{lVW4N!bo;q`WS_3)Ttk>srfcnT544~?Q;-0uaD5d^BenPs3UgdDW^a|!wI0Y
zfC&e16JNXwS5EAQQncHm{K{16wN~RcX!p$`FDWVeCMNy_7eh7xZp&s^m;^O-)YdHQ
z0HmqV1P|)vh=_uqEZyZL)zSGxggRX5|8(i(<Rs+2`wChA^-H$$Mm@8PY9<JS0j^-a
z<m5j)^Ru#gW@CtIv$jsCYb+`zCLE#h8lI{b>UdCaaM!ZPgW()#=c#Q_Ce99{s~(Zx
z?@~!6K4V~Jrr8ldxp6kmk}Mg)L6@|pgrF*15lER0j~;*J6SV%1t?}{JSKjLgRDk9%
zhk^M2H9h`k49%<e(Y)^)|M}4-_~)tDQK@f(!w6WRr+7?AKK=&6D68AqHmHRC9wLja
zp&m1X$zPN`=~Q1qI&M+;`B}$h^z}onlsCR0Uuo1jQ$2{>larSZ#-X9d$jr#7af#!-
zmau5>LPAGJ2T3h$M_FCHmiTRuqmz@quI}C0j~N-UwY9b3z3Uc3JpJLn+S@Ax0~a80
zi|zgfV#9D7?qgz>gIvZ|{s2(%={^HiEX~U5))wy5r?^B!C62q=R!hEUK)-qYWvN<|
zdE7){Vuhr(R<oV{tI25olLvF#b8`{u#h;PlvY}yMVa-Dsa<H<(`p#x?a#jbK(bl46
zF<*w$^@94RTooQm?U9fGys%yEOEDhKc6YBkJ41FX)9Z>g6is}%4&7}2*RNZ&7&gm=
z_X=H4t*!F7xVc56DXGG8Rm<sL8MKD186pls@L2Tune;r7D_AtUEAve#j=YOcG%Bt2
zURYQfPSv_lR2x8!$7VC$1j3lU7CL?3JjaOc+!63x)%-hs?qF`-d$c)8L&$70@*5EF
zOuYx@%2yQ3XYCRq74fz9n*<WB3t6afarkSCi-V;midG1TsGtsc-G)_G9Hn7*(-D3D
zoO6&0V*YH2VT@!wN$lxCBsi~f`j$FAZEm2d*EotiKRX2gzxbgkOHoYBWT{;m1@r0O
z$?|Z=TL}pXidiy9^LA?kdhB{&mfs?Ab91Y9*rxAcw_a)=Dk&in)!bj{wU{i+%UK`R
zbT{(Y7-M7!h=gq;c=<t!kMCP)%rM?)_f*YuY7HFfXaIZ-MS5L>gM;Yz?*l+;;e7z+
zBb4ohXz;lqpZ}TL1%rMa-hj`Untj4cz}o-<h+bR6E@**u1|a^CDxd7c#Dq5rCXemv
zPP51-Z|`y5x4cylAPdK5v~Fw`0f~>_naA$0ZqG^&!$h51+eE2Ju?q<3E~@2bz4<&}
z9e|7=^w&>(yt)(ij8{unmy}TU8{cgR0t5uyO?22WHERnwb#-Cs>4IF>Sd9~!#5eZd
z?3^65C>jF+z(+TW92!ctIrm)w0{{Hp$ZQrf3wz6A3u}@u5~m<7b$Ya!aCM1N<Fs$T
z+=;W`=-W;0!%QpD3@_?c6~QK+@M?H;wA%Ib>6spMJ_xFSfMQ+mez}WXWduP<AJ6$F
zf5`DY6#i3Xw+>G(S7E6|x~5WU3<*bqUWqSENc)}Tr*jPgiGG~+8>`#fv*0a-K+VfI
zku%*8E@8G_+JRA)Kpo3>H$xMHD&mRk_r&o0Crga{HFT^hw3__J&Dxi{6rp}XK&29L
z4k;WEeYEpU=&Sdrhw+8>_5j!?xSPYd%8#B5-n+M}O>$xa8$|25YB2ZbPnpNH`+d{d
zGITfLinE&#6O7HQ4`q21%jT(+wuV0oM{D1lEFaEM)KpZ2gpK7wa|b(WAG3~@*8Gy3
zh-s!py}OP6b>P0OH}WCm(K$^<o_QTqw5F4jL%>oKQm|lA^-T}es*dKVmVqw>d;f&T
z^)3pJ%r?ZmIqd$DJ}smye8OW}0X|$sMks_eAbACc0@3L8=3ImK=PO7~Zf$L`{{V3R
z@~Itz?fKkz_%j_)m1rJZ=2TWy#ZpQWub&)kaxMg{_SX_REAP^rX$9fZ1*N%wN#Zqi
zPws_@i3z{6>gXp5NnHoOx%YJX=3l;YI@qm~Q!&FlLZ%E^CKSaOhV8Ko@dWrKeY5@G
z6}?msPnb@D#arly%qA~B-%@B$5N>i*Ond};OV{9HTX=zLx&6=&X-c;gLy*ImLTF(|
z>I+l)@?;3aZAn?xr-Shr?rLfq8_WFEZh21v4s**LRw^oy*d!bK>nk^Y6%xGfr7Ih+
z8v3LL_@`=|Y^*LO%Pk-VFt>jGns0mTr@-^Gdk_V=9}WrUvXT-?>C}o^H?73yZmu(?
z(^csp-u|$dALXz!hSeBsN$<Hl$FvktPI=P;#ZxQ)>hf%UBUpC3P)nfyr#B;{QXi3r
zVBWp^OQak^Qjk1EDqbAxkL_!0h6#bvqN2S$XHV<sG@VLdIdL>AlxrjdqrzbxX9sJr
zSU?wwEM|F@ZVk17!5EbG5bLoA8z3&*wSl+aFCfL1itKmS9fCBZhX7bn1+Te(T3Ia|
z>N+|iX7_t7)u<td!*%ZN-hk+Pu5=nln628^1*yhiS|JXwsQ-pn*<T|6RRDn$lD)WX
za~A;;>b_=wTs6qg9QZ!=$ktO(%R44=*iFRHC^B)U@1$|DBbAv?cf!srlkLiWEK1;D
z5&@88OUvMT@64A*!M1a2d}#^$R8vPs2T3G3P8s6e&}>gLcgjiDH<a0Kix8yLsIayi
zTlx9;pbGK^`k@ofG2y6Ff>O*cfesl9NsEB*^z@}IlQ|JdRxwHt47g9is99-k)aYXc
zDao)~+{Qxzx9=c>P6+n@Uw{>RbeQ-rZ-sA8Tzb`G)?eqlY|nfhNEh?>@d@Zn^+#EA
z0>Jr*{QZOP$@2J2x|V4|p$uy5;hNrFUhyoEf-r9I)$<MtOq;NCD)RGyAi4=DH^!^J
z6oJF_QD!D4h>WrnIl^#UWEtZXOg`D$+avUQBq^OWyd^)ATW(t<kgsWux&C!0j6Jcx
zFO(VNouSVysn)>Hi(XBBb9dtcm6T@C3|~2+`?Ti$!S=WK@(bF^P$nQuTT}H?=mULy
z_$-D}808|rfR9Rbg4OdU@DYWL`RUfQ%a5QGwb1oBK*z%{Y1Ymh-S8k9%8frp#?ht+
zR<r}aaJ2<Y!dLeRRdbbgd9P03@V=JMlF@4pz=DvwfY!a1If$SJE)HH@St4K<lMca2
z2wIf3kdTnbhs>;;+|s1OHo?1aTkH_53dLNd7qff5Xi;@(&??L(%Z6`aCRqb#hwFO1
zBXLQ74j|xMQDZ!R6kK0brGbN@QRC<-436XOSljJ$kZ~{AU&~`>w*7^uK+u}9yHM&i
zyV|`p!QoQXQJ7JjLp(d*9<)pe-fd`T*mO7Y?;0I1zK#~30%y*^z~DD=QnZe?c99A0
z6VVgzLaioeSy^T^$jWez!gN!$K2GDI<#4vVmDFN5GP3S7C(^UW%ZCC!R#rco{LqEx
zS6~<tV#*$utim<d^Pi$knZ^rqa%h4o{{H>j701w9xeTr5{N&{KXGU%o7Tv*&(1kW~
z$e`k5VQD}Jl~($~9)th!4@wer+pVcnNa(;!<d>vQmR!q6Qp^I^d&wSGo}q8m^W<}4
z$64PTcsDT`T4*-+<QK-oum;Jm#$vT~%^dmpMO}^m_(3^NOO=(Sq7oIpzdc^t#;5tL
zwgf^7%_-4q<Xx)e=5X8>p}Kd+vqI_VO(?g}eWvo@J9njHw3`dSx$n;}@$*k;s*;*-
zFF9KAZIFir1l*5%W4F1x*am}^1n~q^RM)dDKKU;^S7*`Uve?(Vzc3T7J-TzkuP;Aj
zN8Jx`k@-i&+Zc&_kRzgZX90pjcjSu(W6>#M!YAiG!#||cpyPu*G%w`_f#{RdXTFd~
z^TC}cGduqqa|}@5Y8OoUSoLDm`4Fe0jW3YD)p~T(h!{OrGt+PKRl0&aQ?Wi`B8kei
zHC+40%w-k7>6D9n{QWaGyq%r=c{yM#;795`O|;sX<<6M5F<}n2{k?bX(xB|oD-~M8
z@ZOiCH{JMIc#$d*?rjq9-t80{^fqs&7nPNP6biBB*U`DQwziiSGii5FR~ltAB@VZF
z`P^r~lf<P_C~<S?C|654H{Aat4ht%fg?}fMfK}-8OqE?%qi^ubFV9aMB84QAug?2Y
znqUsf=Y65oBKhtoNpQZDerh`%{$;hw)oSIvPOP<F77Y=e&wd;H2fDCkk*-LwzIgvR
zt-TVIoyWtwfaAOJ5d*FkEpt=4MyIFM?KOm`CPqfc2jk}FFcHpNz-dg1in?fdwQF!2
zg@Af$Pct>WP&w6u5dvpUmk&~Yvz-};The3m`Xz_&T|KdRw|`ovAjnIQXj@yO@$I)O
zAmtpzg0RQTDiPn8%)Gu!B!28t`59H>X!VCdkL_ijun3g2S{P2j;<YBN?ni*kLx}P2
z*iW54RbM6>_)*lSPmwLfs-e*Mw9Z66kwdpfL_$jA<zQtsgJm=%x_!3L5)3(q7<Vl_
zB#;wNL^{GnBqTZsY|_%wtUZL9l6@&8lXMBPZr*lz@?P>Dd1}pr?J%ja!FVIxV*PGu
zgKX9Eo?K;SnE#bV7K*}6o`8hX05hs|5kpmEH>dd&qJsmb;K~!uGKarI_bwZuM&aSb
zL!f;Jq=YUXA3@vOFz@mFHCZ}Xb#P-BYLu%BEo+1BJ%|?$!Dn>X(uC32>1u~I$P<1Q
zs3g$34CmE<;R`rHb<Ru<CIi)%CLx%1V3D4dW}>6BxVW#9RmsA_A{tA3xZta3Uv7s(
zt0bka&V9`N=CekGJD;d4m*=bhXaVjZ)f>Y&pN$gGJLxMX@Gt%y6^{n>pvL!~+0u9S
z{#&DB$XD_v-2ow<hcy3tHdM*$-}!dd|8jBu52nxm+ZXr`1^u5%=6{~z<R?N2d}TpK
zM%lm9(`hnzd&o`>U~Mc|Iy?InY^y4c25)Wk`V=r}HL^T;GX0pDyfge_vz!;i8Bm~J
zJdjR$&5ljTtS^%h3A4#F<re-C2B4LPJiDIE5I5oG!oJ4(p;_ONqc{V)I;cYvOC8KG
zbITM8+EHPIB#`)tv9akYJMrhKQ!t#2TkE>E`RAzlckYK!f>IO=qE`kz2Rl1b{7xV(
z$|@>$u{>N;mY09~JoVxM0fF^upT_;6tU;g+`)R_*I%7b^chpNvMt5O|3qGSLghvCu
zDBq@|+k9m<0mBcD&Q<qLv-P`gkch!Y^3GZaAaBo{2B18p?z=ogr-C5O7p5@KUk{It
zvZWe~z^lf<cne}WXjW&tI=>@H&Zno6t`0|KfCYmrsg?hCSRHb0RoX471gvWRIv61w
z3ia;ZjBbL0pEEKPL`9j%VbFGS*256^8?W2h()_OL`B5nTYnP)1$kc6Y2E&B)!d$~N
ztPbUi7ZO}5aK#Lajma?<=Lpy>9Y?&^A;1KTx9#l)%&{IG9KaV2eDt<D-ZEqNfqxEt
z7eTYIz@*5`?&uH!c3R^!DDTdHV+YLEC4ji5q_hh9UlNxSyTy!k2&lV{|GZ6p7|RNF
z$oq)TpB?8LzkuCyPw;y?Bsm<1hKGeex}P8I-(y>Up>Jje%qALiN`)*Lbc$wh>cCf7
zcpr3cVL=<{Bk0%hhws6mH8EHrVE>IrrxJ>>1ik=>DrBdwm@HnjPo>>oLA0NV$=Wt|
zZh1M(v%y>V?>gb!kCCAvp~kYp!mxn5F#H(A9v3Xe&4rA3LO_^+|M>CZ&Ql&&+OShd
zvXPUK>4dN=7iiq+n*%$zk8@*5F5T@sA3yMua}4z`RGyg{C%OmyiXB^XjXMwoSX@{D
zwQ6xg?FplbynLQ;xVs~6TSZ-+d!;oFKyfdPR2Zt97{iWYr4(NxdC&(^MP5oufAPw#
z#H0d^7{R5Fw|L>y-@A8ju}!kLu&}~?niXubI8BZheIROcqGB@I*>#`<s;T{j(OSs<
zTOX|6gXAuoxf*2FVd|^Gk*V9c5QrqgJwhh}ls_<d212&)MHb&^&gc*8<!oS5s~;Nm
zw$?{yDwtYN(#2MwgR+{A!B=(IZBEETEFGpmU+Hz;H(1FAM`nGd)&iUiFp7Z+`HLAS
zo5aSB0QqLmOSMr3uX4Uoe&GZ>04UZ;9CmUMq=(w<do42t*c}QmB=w+wv~z3D`LOf+
zU~RFkZX52D{n5s~p;}8lhy$V%eO?Fw>0{^U$n{|L3gQDKT3r~rAPUha_M{cOW?><v
zqsy~f*A$JR29)>(vJ$CXt5cPqz&@H|K*q4aPJ;0WM!Ubc#>2(|dasDjh<*K)TwRHh
zIBfp-<g6osVZu&AqOoWxFwt}RK4@kU0qHkmI-g+WC*Io}BqSuPtT=5;0Nku9Qj^~i
zg&%|nb8?EP|J_s-@nvUcf6mR_G%|7pD(!UDAq+&81qMFOPmpeoD%FQs-*?WrTu2=#
zj|OjO!dfPd6`*i4&}dw(nAGTl@4&P#0+w4I5k@{tT5zRu_zGi}=r;Wj2!1pd(Wdj^
z+cW*2MMbftfoMiUG5u~Ks9)Gyhkn0zPl0cVnEMG1>j_qylIrBWf47{GFBm1u*O%<+
z<%KKK+G~#2%GMOR7$}@rRAk^#gc9bzR;vs`VgB0*W3G@=`A31z$jq#Dzl86t5VoZz
zBPZ|h@S`FoR*O)3%vs|&Pya5z*pA2jy@-g&o4uobmvTsy@(;L~2DH;dQC(i1qn7&i
ze1N%gpyEFGzfqyWZB{T(E>$&CY~Ug!bhg_6rT&<Ng#|ynVg`5nPqU^UxU*0}dhjrR
zI&9C(0cjOYO6tWb0^*8Q;6zT=$#9dC`m=SFYcv=OaepB^%f(i@m#y8K_nyLWQ%P-x
zNr&LsN*h^sXAcieB8c^|1%-qZmNR%sQ1S<0eJ__-P^6$(`TThm(#eaGzaZBN$GW(H
zr{e73vE#;ALoA&K7HQkzU<pe{2R;hxUdi*zC0SeBrH{9p7)>?$-bA>M>#YrhF=#lR
zp4PT~fsxuXPY9Nel)>a3kJ}mC0|O+uC-v3F*DDY9<3<wRvU{GLpM!Ok=C~^Z3RTfA
zDyIDbYf71Xr8VmXwf&Pv(mi`C0zR*gZ@+l(?6vi;-?@DC?gF{FraejAhks+(T3sBu
zB*ny<ejTn~@6Wp>dOK`Rq-JEyqzP*pto$vi8UmCjod{zlV%JyoLT`Ox9geos4eo+<
z_4=9Gp8sdZ!mcn!Fce|JNzcT@1=K^^$0>35F2&FZSR~$uz@(JvNbYdRV;e?JiH`P8
zucZ(5Uc3lkj6uaysdWyFkDvH>TY&LPW+uuYv$VOc?z=Ey!IfP9&lf2{!DC>}fpD<d
z<o^Q=ucx`CC9p-`7v+4qn$0Tvtw^<4oCfTtSCF@Wv|1+WERwSkd^JnY<$;h;tFnt-
zX^HL5=fp(H2hw#if9GJ9H4eUk0ZehF3un=Bif2r$0Rf2-&np=o#WlnCLnvqRQ&_vY
za-Drcf{`o?|IdDYe<0=#Dej0QU~+2dqK92^y}`*(upQx~5MuidTkb(L=0P1AQHQ8_
za$@cW=L=6MM*{LxE_k(~!a{nv_L<?sH!?EX_HI&!bgZmziF)!gDapvbJkudQ<9JP^
zT|wz~c?SEf_cbvQ2KZnm3BKcofBa`F^Z#P)J)pV%`@iw_phO56*;x_UGkc{_LRO(k
z*()nb$d*WiY*`_Dl|9NzR<dPPMmBLje80czf8Y22KIeb#`+x51e9yVgb*^vu_<Y`<
z*X#LwOm+>!$?0jgZi1b>3zGIrN69B$w!E+WBLvy{{(nBiG!(ikC1EMUF3MwAM(i^=
zp%E|FxV85{f3d6H>h7YVB8-OdR-<*0Ai!&Rd?&EsQ?v*v6Yg18Ksg?hQp&^aAx40m
z`Vi<qX9RBS+^q}l^HpM!l7=*wi!6s>jh{D?_Qsm0bM0EW>xM$ywjffPT++|uEx)(E
zIOrAoJi%lQA0vpj@0ISC=+}AfcBT#|`jS35^%x00&o9>kLOntwd|pt~$mkRk_BAQ{
zpE|?oFC)o&a&OuwDV=rO7a#k)DuJnzK4QD<wq*!3YZpfVj<-7TZL+{Drz<D7iupTF
zGCe)rJ3S28mT}SDFSlZ1=#Z|m@W<JGbCuW16LUM!DakAJP4#-h5TbugQWYAWu-)41
z1;}4he>xS}BXWz!AeMF?ty8P2sv1*-Z~p)jk3k8WOQx(hk)XwZI6wattrtR>?X4<1
zZwrv`K?tdbZ`%)jaO;)267$-)_8GiDyC)uANXyEK`BRg3d)uQCaFV$5GELYvzSkVY
zjg8)4lo3S$r3+{Vlir1-+z_@&xO|CjOX`yVKvg+$0o%%N=ng_wMO;?T)?LZG_O-QD
z+h}lCHMAFUmq)_LIj`2dh!q}(WZzn6H_&)4ZZ0me%OhOrNl5`AMK9gvhHNZ4@jhf3
zmcNoEd@X9nZCEA;+WY+C;5%$%G<>NI%Tr(U1atL86dfFdXcV#68#~?FT%DJcl+5jS
z8gCj0R{5jt=k(Wf%R>nzq{Kr(l}9`mFYUf|J_>Bdovv>i`%C0_>Bwoh45Am(RhuJC
z3k!fT7UXf-0x|(RaC$~Mf;QTxot%`6%*R(FO`eUczS4QS1>s8-uFhUO@X~XK^O@8w
zf~BD8Ouw30r9@+!Yw4ROqFE8FcA$Zq61bzjKIat|)iAcm>fGFOj&s)`x&$@W5cH|f
zTwPtg`e}e!S4Lz^47U_Z*Qw?zO>ndvfiSnrD{p-8*z4xz#(6bE>EgxTU(-`ougs6&
z90}p9DU;q-TO*ExoCFrsxJQr9n{jgXD%sfl!RG`d-xOcWL!XysR0HqX24WPKyL{QE
zDQxh-5z3e0;jBs{*&g`)9qFm4sb{99e9s_cintm;4n~m)xZFiDK74$<0W_rY`o}5}
zn=NZwTPQor=*ul~<BE%gcRz)-#QF}y7Y)V5S@>Aq{Qh1FHG}Iw*_v@QdE#m9=#KaA
z-?v5C&JDf62sIS;SQcS6sd)NceyFK=56rwf%b+<+_d?L0HXw7;-4;d2x(W*;lU`4u
zmz4Ys(qz0@%-BkJU}I^<Z=RR;)M>R>{kb>O5kqhxN-!Tf7@3%xg$3Y0KG{|<uREwa
zw%xqFwYi4hz|O9Gy_x4%5Utp)trd3b^V_@YgJN-7uXl9piw;8&M99@+w4&lx9b-e+
z8znRp6n3_wk$u8Zqm*R1jk^dGN7joG+XAAMR@9bq<RdUGYn^Zzws?RrHeDG~9UWWS
zXSI9GWn?x%$>bKiyZ&)=Zf@={DeDOi)6;=im#a=4H8CNb*T%JiT&ZW(N@T#Vs|UEX
zvwmh*5|K<+su(on_4EXREj}q?E!@(yFgkA^&42g!fv3k#b-mS6z3|xK+(13h`3mcC
zg1XV@SF(A+^cu=4Dk?H1<jxk~l;6LIWffiDOLUwjcy^!?t3L%rADAcRyI%LfS|nXb
z3tcdw6L-X$dd*|9GSPYEH=tX<#3z^~l$JDtNSK8-1^$Z~2@IK>WQ+ENMtz4FX}>9c
z{romQr=uVQX<tFyS}Ovao;|V;AAe{-K)&!MKI&qdiKdu`3uA{bnh4t@{0vw$XDRRa
z{Uzntma*;69uiWJ3H80bRCeqP-MM1nd0Cm~7iW{^;+lU?ei;6-!=j`lhCT!y)0;O*
z%b^kfWOEUUmnK{9>Xz4~XL|=*A4Ce6h0n3*o_kak0&r4QNy*3GAAvmn5fKzyG;g||
zCPvxm_TGGiM=q`xEYEPz%b#h{Q7^nz&Q(2}9dOMus?17AKm?e%e~pn6Pc{Xum_0tC
z^Mk@2J{cw6e%l%e3jZWpow>%Z=z1+~JJID(TW`o~qOT{vIQ<6;m}fn~bIHnQB#bqA
zf(MBh5RjPR_<2OS2GfA$l)u|^$bXtHJ$_u@)pb=~zV^HksLdZExnP>|%t*ba`EIH-
z2l;|(@YyoC*KNNxH~d(5b8+e%=FHeAE6aEF#|~J=2RsX<QE8~aIV$IR@`VAg5wcrY
z68LC+Jr@&TVUn{l>o3XynNdBA!Hoi0W73+<%5^W^IXWBPyY{MQ$_W%PK<wf76x7t5
zO6h8zeE+X^yzR@ET6O`U&pSB&x?EfSjF4$HR=x%`rhndEY$}dqtwVFT1MsY_uGif*
z2(LP#ju;dQiiiMep{2?8>b|~fmoM*SS;I#$(VrncW+D#oOf`7ZV10Y$83~gD_q8(O
z+9|L;8rv{<MW5K*+^pG+lr633^h1kAOGo$ea}V(ad}OD(L1E!=CDD|r_RDRLJ-6_!
zrlF<1IjUjDeKo_e*g6pG@yFPwxD>cUn>v#ngPFoc%ekc_8F-a1%gWN&TfU<>sP2fj
z^A9fCz-o0GZmqXr!t`zrU8g(mMsize2-1lzYQM|N)611x5b?%Cuaz;G`0nPFe5lwC
z5YarM`x<%f_TnthTFIk~*q>?YZx}Dm;X5wZn1a~?TxjsNqmjxzj_LD}xA0xNdU<2}
z?mutlnf6NMt^_7r1mD|3Fda|o7&dq{y|8KWVqkc)P^n^JcQ(95OV`b%>qwj>b0|Oe
zyL7E|ZkM~d1m|`!T0?^5XhQk+M*}6aiwcigiglfYEL7spjno6i<j`8*t~7@e;LP^c
z^`z`s=ibc3t5?HE&cBhdcdKyQ^H<xoyEQSvh&-hOFfbAb5vXMe-i&f>vYp9aPEMiH
za$~u&fi*_hiZP3Io=BmuZa!^Joh;Fto4ZJ_P~nmaq4c_M9fK_M3bTQ*yCE|8Fj3%h
zT^srJLPs4aIe@x(@56hqS_|2b{@wW5o2M-+yVslYq9aI1V#OFS2g!f=ho&%gzuO0q
z6b8OZx^Mj1v*yLA%28wu*{r`L;pi2PNJ(VIguah7!TkC6Fi1HRY3}T}LXMx4a9(LK
z2&=YY2He=FfH9Fqk*zP{yKic66{HnH=dtXD3l|%oUuI{CkG+_jz_fDkwdp|V$}<Wc
z!F!!-WHI2CwF@5@Fi6FTe)}C^FC2Zlb?dVFK&@Xy+jDXAp0k_1(qDfDNo}d$TLxCG
z3r&+0LSTIS{E&C^`He2kR*!R$as8=%Q%**+@GMVG#+<t?xJ45{BO=qqw|tCy34V^B
zND4GC#UCfFkBW?Z(-3gSW9rYsuk(v}&EC6U0Il}%nFBHWW{k<LKs&fAdaU{4h^4xE
zTNryKIs1s^Ojp3pP8Lj>*qwlByC(J#AeF|75}NhpU!y;kF>pcS+5&Q@<qc<nYQ%%0
zcLT*X2g3t3!yWhg24;Tv@Ik`a{@3?X$lhfd+N-<>VKsa_I#^Y;XD<jxVxO&YOM~ej
zKLni?5;20NB)V)J+yjKh`zUo_!s>tLGnT0mTsMxzz5la1Kl(GvM4m+@T+TgYHF5<5
zWJ|P&>T>7ywm|R^7n!7k6m^)+9&WCNJbj;{R51?pY1m?apq#_XL~cl`Rzi^7=T~2`
z$PL@RtiESz@D0>+d_J&!hVv#vHNGa060?7452==p_!=ku*ww`aLf$~qnPfHU+Dk{_
z#@Um{BsntqVV7Hlj!e^{!}b4%Rv6yL;e7SR0d-;PswamL{P_1ztJK`>3ApZrui5Ba
zZ5g9(&FTf7VlvBcUg%yY@!m6fDk>I`TD&zZ7u}*^plQB#{{BYO3soMYiVv}Y@Mn#*
zCKve>tvYW0>MOK3R<#bMaQ}L?rj;ezNh&G^7o+hek$8*R`iXq=BY{0*V_^_itu+#m
zbC}+{_sr)0gT9(Kep5(#8k1sqM0%!4qezs(XVU$R_~SgEpKg*=SMIbqKhCSwcCqma
z54VS&WU$;hc1q{!p?p&=HhTK=^zqqAozkb3D)_65OdF5W(Zvu*X{>ymxo&2b&^htw
zoHUD03HfZBFY{PzzmT7yRoJnbFs{ey8UQq(1YZy_9Ijc6^~~~hXZ<&U^shg0+}f=5
z&e}xs-_uC{1Lpo;6z=~o%J~0%Ncn$!6|PeE?oIdgmF&osS}*K`3-a<xuU^AetQwJZ
zf1pgj?G^uB-M3dFpFCN8_l|f+^WM@Tz<McW`1h8$prC>qf<~xq?UqJIN4Ga^Zk&JQ
zE=kt_5*FLX8eE6SE#tq__6}bixAjG3`gnc49ODG2StBA!S7(Z>Dk0v$l3GP^o9k-E
z7`!w<&}gZsLY8!)7&|F2jW{aIc4Im0@!LdL=77&tx=gtOQjVt0%rFN|cJ*DH7liK&
zT3;<XIFsTRoFHi^tq-KVaOo0-58I_HVXpu%str2=;{tcik0`~3ezJD=XC=X>2Fm{w
z+s&Ljfc*ys>clH)xrk8(>cW0GIr`bNrkQRYq5IbY)@>2JwPPL&4eiV~J9Rpx33MU=
zi(dofM!mU#_#d1GeL0Z71N?w++<Dpj&%Be?zXJJ(&dyq?L;NOnV^9Hl_$<5tfZCb!
zK0m+z`}bT)Kk@IC+ie|5&GFZN{);y+w6?^QuYQh-z`@w@<;%*SKL(X<HzCx#)oA;(
zxqcjY5$sYw`tqA8VWyFX@e{0>Wdq*oAAmkb=VHYi4#ec<u=C&glvwS(f+bgvKK|#h
zT<`x1Ka-C-FHY*EX=>3F<9isareA8mH(JXoZup4v=IRYQyL^};Og1OmpBo!Xeu|Me
zGvg~<nha)ap}5b~!iX#gakF4K6{nZ}ID4OCYpH;r(tV>#QBRLrmx^?V{m3Yp-|)it
zYs)xToWOY(J$<_Vf^!1b_>RCa%XIJFy#N+>?0)Z6E?pw^VKdUb)@M82X`rUIv~Jf8
zlq)UOH0v&?yIlu&AZ2m!7!eVzyMq<!n|TeN5msk0unNu132t*K%b{$_$fcf$SeTHJ
zP)ofRyn)%*w+5P;Bk(X`g0BmFJvREMqpAx35VUrs4kPnwYHEs=SR>FfzO%cVM>~sA
z)I;ma6%19+W-cX8ztu8x+oXg!VhJCP@8x(K%2tR#^~)R!EN^&c892MH691ZFFFrjs
z^~HOYDQ-?K;~hI=Q!D|$N;7`806%|C8ZS5Z@{-x??!B1Ko@VG5>jV$HMXqHeUQtrY
z?JKG3^S{1zBZaysJX0qpH+xo$mi8BHT3Q)8`)|)9{sT(Er(RxmvjYcH40GoHMW2Ck
z4syUtr%2{&RKDQ0I63g-@E1Nc^(=j_xVR56k`RP8j~X|$Ax|nIc31rm=#2I?-jK{!
z3K>CEY{tu}9_^w@+<>D&yEqK7P3+$7#?5U9t^{#O1qd$Gk@F&W(ROI-C9pNZ{|Rpv
z6Vv9=OnkYxx-P-Q1o`*=atY6|bE?-s;FUaF%6;|f+HjRT_&IV4ij}!x1O53C(XPS4
z!W-4MbT8Ei7vH}B%m;>(Q8MJcJR|)DBzXtVPfqrjCYjb8$!qvh)FZ&hr=USlUf$58
z)Dd)QP;q~Wj91gkUAG@B4j2!08!0yRab0OJ+`O>&%ei(T<C`}F6mud3&$dbJq>lCp
z2ZOEJQE>-0t~W~2ERB2ssjcxu!IyI;$HLq^)UG|1Ur|9}=#n>mG4DE&TTR!F@7?~_
z@vJ%n10Di7X2q=^qZdwTe`wSWrm1xkR<hDh2<MWhV0O5)wq8Mz0w;*v)veK>{i%As
zChDI;Eg%I54j%unkA0Wx=+l{Eo73a<^o-wndY)Am6nI%FCG4GSeD00e6e=$T_26yz
z^v*sCWYFJTU*kf28Ftk_JJB*$=GU+LG!Ft61mg2qPG0_SDCK>>KUu!Mcav{l)(o|z
zA1!fcKA{{yrO1-?{G1vSVZETBy`#VX5pBnxw+-;^e@{91#`bPKkbNKoL(9Kr0I^tn
zFOg6HjjT!^UkOYbaX6Ygxv3wANoi=9oePlWI-=p9VyRDk@?>O``xbv?q^`8pu8IC+
zH9Z`^qj3HgY2NQlbxM|J6DNsa)8H_>EVr0haj<W2+ZC!+Y<hm&3|C&aQ~PO>?s-oy
zlF}yuX!vV7g>YV9Z?BV+@&g-N8|P>BFhUOp$rL_tZF^z<-~l&rd*R}U*VuBs+us8(
z*e_QYRlXT%c+an_!hP+%Fh?66$K_@D=;-KnCUHoNLEeAv-1D}Dn|lf1f@X%!;b>Q@
zmz?6u;I!=QmblK`H$68JtgWp*+ijr)+Q@lndUjH0=X-}qWHnDcE!5`v_3N4)-R|YA
z?Ulzwoq|Jg;%UE;NxD&8H!^1hFRydKrC1MGTd2>TUkKStgA_a`6VI)`-Xm>r!RHGH
zWM(FQaM|9vZ%g_$%ivV?k00ShVYTO%rn&9yy~tyH$OYx)fY;~Q|IE@W<YQz+j6wKL
z6r``OVg9|t3M2b`jn5qbr$;}q>N5<M>~QFZU(P>!7-$Bny@RSFH;_h4$wb^P^k?ew
zfr|kck9pKTxHJTlU|D0MBMjYO+f!97i|9;!pfh$e;Ybg5m~2aO-!@8!hYP_lDvgAu
zGnES2M!f9oR@G0nWCZIaISdgu4VE<gvm=-wsMHt<j-2E_lJW=9OT!j2*RDMS%pHRa
zK_tst7u^3gG&}3f!AGQU#S1cE2=3W?^MI^YZizN^buB{}Q*>6+YQz$kI#Qp6-&>Jz
zUbI<T5DCkv57@X5fe^x^A)^<z-n+*IQ`P8*rUSAe2rktSL@_dwAM}nN{7v1CBtx97
zFWxfa$nj%{@~Jom(;jH*qN1Q)wYa3D$MqS5OvScS>o~Vy64JYLiRa6WsAiK>-)o>F
z&UMl_Q0+@IF{}Js0s9HQCY7CE1rXN?=(RQ~^o>@!(Mh2Pk`EWJlahYH0y|bIpsA-v
z(T$|a?XO8>>i@w4Y}lwyo<x?=h_O~M-6Mj^Fo_voog0_swsmja+P^SCH~G`0_G8`R
zg~iuNDJkQ@G5h7)b)W1x$6fiQLo<)Apjdp_Y9Tzf5VZ8ehwB?Fv&IiuH4l9RZga`)
z0{)|~A5FieFMTE1m)!7UlRGOzse1?849RD`w?2Gp1?2w*?zkgJu=1<-p?@Omw_g08
zqv-$R+=lTo<aj53G%2ZjjeC5azDRvd4cZ7yJ$$xQ0h7N4>>C^`<sOldk@0YG@=Zbl
zDJA79RBdZ1koDuMKu1kYK~B!H`DyNU8RTIAD<cKx(s2Xj$orj;l(aB)_W)G~D!ay=
z@70zxImZ?A?yNHdU$?e)-@ThQ(tw<h<ix}UTjj;?pbEB%w!<8NegpV~AcTjw-CY*9
z1MF~blahcyB;a_4T!bAd*;r7kw51!0-2T2wOG{hjJnjU79CGKUH!vL_lRAu3`>G2E
z>kpGJ$)8<Z3<=lH1Vsg7eduSqoXmfKhPF99HPse>1lV{^&MB{KPx`<EAkb=zKyrSE
zi}Hx$!-v;-pvJu%=ic%;N(c-B3(=_Y-PJh~AOvKIDXL|YP#BT>OqQ;`*=C;wvqgh^
za~Q(>50jpb3x3M=EmQB<<~njE-8Oy+4V(Sy&HGkUWBTKhF0$hwkv#dVElSXWEEeg{
zY#o1)Q8M$@3?ZHu3=CeYM(~`Zq$JpR$#e2b@0D7q1<f<AW<IpEw1j9K2;DOX_viBU
z4YKdtNe!YpS8z*>Vsn2MGBAS~WcRJ_z7WlScxnx+A6^s~+-69+zz-+AZQ3~NyG6BT
z`Lo=4`vKr%?3U#YvspV6^k_{A5aFST2~N6U%1XehP(eeP1?VvsV*K1*^1#`Sd_Q4v
z@MciM(+FGAb8+zt3*P~Jn=6mM2V9oJ%lXFV^?<X>+_z)S%NccGA$+uJo9bNh=w$T`
zyNMQBNcQI0_wmW41_xi?j23ZLP*v3nrhAO-vhh~^M`$CgrLWb0uW&7OJYu|uf`Y=z
z6Fb~Uuw3&U_u6OVy4vT5HPu(SMur~sP56@5hwN#WfxSWX1&6N|jCYspKO28nXQ|x>
zB4xJi&Eri?{9z5a27zD1y)OeP1a9~;sj|RHziI;g3YVMcVW6Y?z2j66wSDPP;fAAg
z|6NZxtz+MO0%VF$QhQa3jGT(aM?d~fJLN*8XV+N@d!HV=a63{s6ZH)YkbBq;M524n
zyoJZRY-exgN$hbewGVx3*&KcbmQ8;TK;Ch21BFIX%p99YY}V!XxyJW&-n+efMdFp~
z;v|Dgr}5>;tvk*976bh~J(LvGz^aZOI)q90YzZ4;T<Im#Q&RlSR1pkig9c96zg|(|
zFtd)`1OikEmsR3f#<E=D!tgVC7hMX_z~HDmKV62f0Q-|KyuU#C7j#zo`t=VmvDAhL
zKf&hzlvnsT@1qrfc4oCHbH|;XD~Vg18-DL0`I`;gQ+R%H>Wdic!e5u(u9|u5*<X`#
z;qxcvLf_O>pV4{kt<Th_qFav~IRb?6bd*Htys;Q+JA^awWZmBge2p#(yj8eoi0gu&
zADwJ7;<a3y)R2{}K5^z1S|8Nu<9R;L$7f~+Fg1Ls9vx0lWKkiLa-5_$W@)K+Uj7Y1
zPABLe*hj9WUt8)nV)?2_^SD7Pw|B>*ZEk+{EMi!JJs^({xbv}tvrz0q&85BtOGkv4
zS1pieCMHIlP?C_$uO;0s3_~LZV)ETLDUsFF&Z(_`j5c)hBn3r~5x|Dm26;L{8Sdo|
z?MUn)(r(~6l;R$}!OIlN!pD1++K-rdzWe~4M&ole-y60*+L;`_nL2V1&STeD`Ss1>
z=FNPE*%&wlG7L(=Qyt04hr*k{fju0`sa4P&z}IW*>xcKmAp<&6a5puC{$CfyX>($F
zEW<uv%L?50{ChLQ;Fb>w)5E1{s^iCjpetYT(as3g|4`=k>(AKK<s(WC-3*1ec*UJO
zjlg6+Wl@lq$H{cmol+yR!gh+!Fc&FWR8-1_^%vaV--JG&O%f}@>RR~<qGGJlSe#Fs
z8Cv?Ddz16w;p9u(-+@fW%{DZqX(EQS_C^^o0Q1_Y6N<6I2kP6u30W-v>`l+k<`D~M
z3S-l--r96>Oc^HjfdWI^F?e-h*qA)Rhk=1Xm=bX2)0G&+T-PO7mDLERqI|^X`RbT5
zDHJD6#33|x3{qeQGoYI^isoWtOI3cJOxf1eMI~(csG>qzU*DW)bo}r7OdH^}8@paa
z;WWpjbGIS*qwsD>K&~^d8$z1@v4tzXAJpQ*`oPc+Pc%s{hAUm6qoX?&p8%uuI*{A5
zbn@dkFWI;l{P2rEF?n}WRXG_yx4+8kPjeW%*!A=7(cclr>n}w}88ppvv3!9F`^7Xt
zL@qSeuwpPWJ^T6@=ou3qTxGtMBfURg)v}cMsow9rNuD(Z8S(nctoQCKvw*UEckkOT
ztx4y`A*GAhC7Gwf$Z~IccY{gVIwA_zL^TC}%3?S(I^SXc!QDcsAv~k0K2U8^YF`;g
zytOe~0;L?gK?(oc(S@i-N&#{>5CTCE4Ru#;trNP}yp!)Or_qVuya<DMMNxXrHw{*7
zc?<aFI+zc7jPc)YF)F(9;WFf^)nS1DY#kh`vyuNYxA0H{BDo`@9LDqUUIrz$C!(}g
z6~FcO(*&g&F(#v>#O`<h-TFWreI-5)-b`6qSwEvgLtSPEB*;c{I5DuXwmEdazngcI
zx+@|37BD$1vLg*2KAfLdGcz?s_RGwLl=iMny|uM9fd~Ek92}b3+O6FywA_twUOY7!
zp8Aq9BDVWGA2guEgodQ2FMjxX9V30a<i(81HcFufKXHHWV_etUVs1%kjhVQ`r<*@o
z>qp_4Xlokz$1xI%2d{*zi%S_QiVn1Gto46ZqoJbSKsJsxpdB&mF(2V~&V^&YJ#qEK
z@1@Y<z9KsxhKaM}QO&nqxi-K01TOez6x?ZN)IXq|s!noq2m}n{-TU85_J9Ao`f(q^
zdsFk8erVdW$J4y3jg%~1JOTpq6iB@3u9lV-wp}LvtFNgc5m<Q6z!GQ8MU-I5Nknf$
z*x{_YZ_3UM6&)GQXP!eWF*LuvWQG-1Uila`295O#UpljmP6c7XCvzu1i0*~cTd$VJ
zgJTP!#e*$IFW2<&)m!r;@}A7{0_4_D{HV;sUcY`_RId<pl6}*_l_Ga70j)ky>LJr7
zqC9H}U3n4R`JF5};@H|joq1<E%N%AUf{v~|u0|bE$px4gpp>@(sez2@5DBjb2d##%
z<H>}7VH*&^5b>e**V><n{{9#SmQlXL-Pb9F?WX_iXCS&jqcU<fYq718A=xI{z5Rw~
z4Ao8|z@`17X9TpiwC9hX=-et~_CMJ=F|{qJVnfHnRN8PN@nD|tqvw&12j4U_HHlVM
zRQXO;(hDxzc&KbX;9J~A6dqIiNor~&*i}9}!!Fu1Sj@mQGaV`E`tZ)3JF}AIa4~+#
zHZscTNy|(KVB!@Q*N;}9IWNJ*`s1-MYlLbebLp-9cW?50Q<1nFQ>GQRjJr{NpkX(<
zhU!*TUPRaMWfrM4eECfm>s<Zii_~@q*wb*yWS`0(@8bSdzngR<9-cfU`<F+MJL|#g
zlGL@vOOGq;#G5LX*!cJ~gZp(h*EYCwD`*z}T*U4QSKO+q582H0^fUQGMxGK}N*qL1
zxvx=4@ndR9hNfjvQSXVXR*7vI9t@lS>${`$bBy=TcZY>_RvuinySwd=L_Fa4tAH8K
z=)Dgs&tUBBmK^!?(yk6y{wZ<C^H2^mGmp)Wp3XN@mCT|qcyyrlE*hA4J%s&tuk8_h
zI-c#}tF(Fo{!kgq-rSot!?6Dl4u1MpI7{>MSG$q#FgEMv3I|^w>jWH0Bj>^1917Jt
z8G}8GI4vEZDZslARM+gKv0f*?d2{0yD|-c$fbr{`fr{Qd3wN|8-Xh;&XGq38`?f5G
zj!vnE?M8e8l@xwNk>h+QmxQdns)o{uuF4*BRvlg`sX^FN8tWXLoe4ur$+*hO#6t+j
zEA{t$q=@)i_+Wsnq6=&T60AJ4EcF{9y>5U9!C)*>P&&gDFvb?gRr}fy&-e)0ioYm^
zViNt<OaAt1<~mw4tPQEGd=V{IpO76JTU3wwjleP6U(;V{Zn-R9(2NTE-qew0AhtRE
z`!_?|vFmWZ9V$iLN*zfAyM%jt82j`6cT=7um^hW~wGtlHUi?OXA0dw?4hqx_NpMBc
z{Sp%uZF0-RW+7J-v}#u<w;c!cw)xNEVuogt3Z~EYGk_mihNGqi-9KPE#pUkBLGo5H
z?HK`wTo~=XB9u_sk|H3Qh8^bOa(Lt@63aKS^rSjKjT~2f(CQwJalnqS9qz<NZf*X#
zq)RAVhfoZUB6~d4@WtIQ28X$08E{?14TD7hNjI{isV(sbbp<1I>OYr|&2t+%?cTi`
zGvKeT%qVZ~35uxC`;x4<c7zV6Bx^8j?qB+Ww~d8`#aC+r=pGVE*L!jjzysB>Zm!P+
zBli(ky=DWg#Vp0v*4DxbF*W66!g`=<5snsCHReKr1X=MftokLkRGg301cij^iQojM
z*s{m0QK6CWl)#8+jm7P_<eQ5|ImYro|KODnga(C)+%(8Z>1ZXp7%jXz&m_J5wEEXx
z>`7-PT8+*>sdB6KQY8B3Rb1y!<vKjF*6ZF<P*8AOD$8}~gS3a+F8tMXdg~bK76w<!
zfOhn6suH~<k-r)JN+Z?qy(3AMAJ>^PSOTHQC_`}+Ug*faXGhM=m`Dd5&Dw>R=eIWz
zJztZjdrKW+ffE3`YaTS_#hnJCUapj2V%MfX#I_{sT4QdM#EfIF1a)NGYA0f3Y+r`6
z>;35OwGpNsPiA`QBL`_itoYq{`d^#i@AWM$=WszCI5H`9jiC3zOu?_e>&v=DmYBRN
z<NCi9Suxq}V<M@mbF0uULgqW%Y$y3l&$_8MRTYbiicW*Nf*#<N;QeXO{eP?^70v>I
zPuaA#(NRfuW`^YmJu`h6=Sqr;k%pyyBd_<b>m$r@Of=VZm9{;(_^)#P2Mbs<QoTF4
z^=GC3bBsg^T3tp?9PTJ}u5Fz-+>y$#;TL8wx}Siot*tHW)H%2v_<bh*PrXMpp6tAy
zB;S1*T)LRZy9%?%2#*?%j)>Y%vdyryu3I-0?$nrJX^Is)y>?I+!|v?|H#92UP!(8y
z!TE@QyuS8z+E)T*(?9j|;roIV*^CK*sT2&Ix#?tH?sk7SH{Jf)O}-LH$NBZhh~zD1
zl&Rt2n7f5-QdJEN#2<yeP#oH6F5E3Tp?$k4EG^|?Y=6G0^*2`?9ZK%hIie|`iny$?
z<#r&^6YV*fMIC*)A`H^jiYx;h%gaO%OVkfPP1xnVE%aB^CO)>ka6RG>eCJzm;nK9+
zcXIgglZs5+4Z|8PslEa;KbxSRCO_rE_S$~N`Uq`rotxWMgJ+~lWvZ&Kj*btLhC!W(
zp12S-B_*6!ak)`x0&7#_<oGf4^k+pxl!rx43&VJtihDEo1@fVwfV;@4OUhQ~0fad7
zSGuzQHd0wXjf|u^?w&lKI{fDNHvAne-!#!&6SnsziO58REM3Wv#@dPP7t&mu5#Jvm
zV-xoP)<g>HqlBn6dH$X0;x^G_#rYeYY-~!wZgeCRJF|A}M<LUOY)7GsulNr~><l@f
zuEhjI#5rb@Q87)vZVEtr-1^;{HvDkx?}+L)?wrkf3qw%K&(}BPwxv@Q<9nDlRD?Cd
zgMyB6<mVpyHcnzhw4TCm-h=pH+FXl7=@ku}w^R|n6_XQ0ZH!k`P+<0$=yK9Dr`+~U
zwx+&s-!@juenc+JK-Y+rI@N~LE+Uhso@m;_w*+kn-b->?S{7mr?oH}F{|YP}9`E|>
zUJ|sUul)aTr~F?)jQ;okifNev2q|~Ey5!`ff`WsI8ICQSjQdmM_)jueETP5lKN(^F
zYiRWUKOXWQJnR49)%|1B`74W6G9VxT26@mf`_>QOp&&heT++oySxt>(;qX7v4((Fa
zpE4dH8TZ<?>H44?h`IN;?!}FK^5it+4XDrzL>BVG-v9b{KXi0xs_Idvar5$O#96Q^
z%lQ1$@>nf-?C@cd1^<<QSYB6)REgWBrcb=R&Plin!KYVb{4s`N;Xm|g0}{#dvEcw6
zpfNi^5+ap9?;ec12jEX-W#ya^(Cm3kzA(ndGbs=6L%t0hEHJkN@joY_6)%Su|GB70
zc&BBsLQYneG^wqjfz6{L`w~?w06+DBmIft?ig3h7OJ0cs!bC|tgbapZ5u00sC3d60
zbBKtDstPgjRsu@E=z@(K*B0Yu>bvUOpI*lBbYEJ)LT)uTv|F*>x>v0&?{*Nh4)6t|
z(rurazm(%#+>X_#_`10{8TE!n+$_<O8yP{)wpUrBw{slAP~N<GV+DmK4jRZiQl%fS
zXK5SI{;a(5G)8nuh>0lyVE~5)>ws<$6L_84krx1003MyRSwdp?-gzYkGsoz<A|9W3
zi^D7z$fUj8!=NBRg4C5O@8?Jn!v4bWNezsp9AdNhz_1m_42<RPL86x*1--a9;=81Q
z2SV@h2m98NtsSJ7>=)kwB6pY_^z!yDE-lTs7&H_deR^~z<m*|wAPB6gDQRg9uH-`D
z;X2-QQ%cI{i8UOjM-J}a|MbZ|=&}^K%qty-z52xLX;|wllb6yAN|zsdAFHa8X|KvL
zQT*E3dG@%OmoE-xpGQ6{##z?mG*}RLH7g!Kt!9Aw04Tn3;aYr2&foOMC{ygbLR5z!
zA_H@&vuB4ee4s}wS6~pJ6BLKcdW&1%AMM_2I*N{?QOIlOaiP4`$r)*Ue!8X?*Z~i>
z_VBG+-K;93MRFtu&r16qXSq4!zWkHQA9+lvtDMV%ZXkwfp8{U}@$2uNU)Kvaw>J2#
zJb_CCgmVV{-E-z;kwU;UqN3`45O(+ney&-BuvRB{lVT=}{j!2NLFtYIL3i*tfzUxL
z@-|2y^_PpHJj=_wlLWZ++|u}S_H2J!XD9fN%-F#VY>#XLqa(G1a6mrm^>W|Sbz%m(
z_`LpBV+)I*<8QsZM4pCty<5P;cUgEGLPp4lUm1w?{Bhc@`v8~!qer_;w;@l1b|?dv
zvZrYfKbjWKTUYJK)`+7zuV^8u2M&C>JIIO1rDvai0LA~_EN8>Y<&RAEirZU%!6AS+
z&yfW}M-8FeAr4%i>6k8ez7Xo_zQ=0~3=A|Vmlqci8Y9aD<Yjr`Awwl!Lm-|~HXx7c
zFm66OixMVw=?)EJ|8Trl5y8Z>qoa@WC2S`@0CWnen)#Z}`P96O1DGYk75seHt|L=i
z*Yq6vz$o$%9~bZX#QOayDylWW=;qBBTHAe!emIiS_o92T=Dd+R@RvhAxo4_sUY1)9
zSLwt;$Lr|mIPzE2a_AAvIX9*VgwB-;e*Z2pLdv|7ad6)O<73zTOry3}=Se^DS&u2r
zcQeQy8106tEPzg;L_0gCuTK;ZZMAj1Kh@*UANM&%zAFMK2Oh*^s^~-qB(1SxE7>yk
z_ITpdl$Fu)c@YXwQ&lLM1H;1w4ITJ%O&g8PJvUW@zyBCYgZ}IVjPzJNw=nWHg;iJ%
zNAG;mdnqMdDBUWAsV>g@Fe;sdl#wjVBW42d>xdlBrcLM97e(ap*Ye+j7D_}~E9LUS
z!Zoy;!F)n?(U+LT#bnL$m~Cs!jycspUq2A|Y3M}3eZAUmHuKg6=Do+~`#!!oB!iMJ
z_v_9Oj&LdYg@6mfnk4t;;oJ~|C;u<s%p2>N*YP}OLCDw8-{1pUF6~O%Lb>ybx&@js
znCJ~n>@Peb<E~`g0WDZ+@jwF83goAurts!Fr&2tUm+BJEez`y);1%X}`b~!E?@(KE
z_Ck0jE@oVFNF0S1^fLzl<8*Z)?yuAcq4+_|kQhJJ;?VD*JIZLwnC$m_xE$X4!}?M~
z<2B(({J2CDMEDw^k8wX<2M0fLe5NVUwb{w8oNLj6*jR-C@&~u<??aUJXRCa}@m^<x
z#+`%GR|{egyYYc(PfpRF5M!$=(c(_WDGvM0LZ=5EXyd2IJX5GV2XEk;DQygK@Ux89
z*s&Dl<c?4amH~CsdMm7IG!m10J4YL8b3}mL?auoC(iM>R!Ujj_=QN{A$&&Qot(-Gj
zuhU1GCSps*Sde(ce&^o3u^;-q<%$k9XFF5WJF0q(Xx6%oY{VtLySfe*7fYn;>uOGO
zK)+1h-JGh0@dS>%=k#elUtipO;1AWSfLrj$+1<}>qE4-bowxa0p``oPnqu-eG9ad>
zzSO5Oq6ha4s}C>E77>Tv$VApg8e@Rb#HYxBly^j_2a!Ye%;r~54sGTQX<6?r4l|CK
zushQ@FmSZVZJ-{ZN-3iQ2^{mC_;t_LRaF@eeeg)FzwznG;n8=IFaP3*oV-X;;RiUo
z!B9}J0H{pq_Rwz4yO_&PNx1nO3D8V;+&?$gIEwSp*O@?|0d<$g;)X{%AM*YHVFF5)
z#HqFm!SA*6N2vvB67ur}e$*ag6mYY%N_$cLN?1f>IOqO1!4a-&9fhyC8ve;NP^Thi
z{(2Ka^$3$Vhgm~M^WI!9`ZfCRuQEOxR$5)AAx_Vv7E&3o2gnw|qbhS+=G|&WY;5f6
z5*c7k&&3}ntX!^Nr)NEJaL#e6gGGFx$VoNWZMSJlRHQ)^fxLo3nd?dm!mU1j+#PYE
z=xr&3!5;+w1nG;}O<%Dkyb!xp>avkK&NO=K-bAa^ZEZx*hq=J-fCKCLg%HMVcf}2K
z`POa(;4@%V`aQ{ZM#{oI>d)LTlm4GDp4ru*kALx1W_qoiG0BV=bB&9V<D2|%uhc#}
zQI73xpnSt}V75)#IvXuxwHo0HzmRCMG`Vj_wWz@8dg6?xX?@`9-@kY6{omb{vBgf(
zym6Nz`KVA+EQ4|3S?80Xtdtb*fm=t0x^X%tXcr@%B$t?r+xY9-7r4&Y4ndjq`6Vyy
z?$&=BHW8_ry8h<dsWpQ8JLx-9<717aFU>j<eeV$8Y{Tky1<k$YD#KxS5bqp%%GelI
z{VNdBaW!{$AERCH99#DPhC{hNKIh^3`nt{tatlUAM*-U#LG!eq@CV_byrGnw4k~0Y
z)fko8-rXp;-(yX72V+iP;0DT%q?{OwH}>TyFYot;cf`X(8VL=TBw3j^w;d)L-GdBO
znkJ$?=I6iPr(C5<e!Je}&g8_ASHJ3%#P*y`dN~&?IUf6Wb^cGiL9N*NeT`<8oZQ@W
zFRtOS?@WX}hLkpQi123Uc7>|4xzVzO>qw2`bKgo<W|x6a7q-<C&HX~3UruaQaZ~dN
zYW<A6`<A`^Y+ry7FTp3{EQ11bDmwJucuCUhzrX$&(QfmhX{jz1mNH&qW=wE0_vhUf
z5<F4+qtIeN7^sPZ7rMC{E!>j*Mt=&P=H@=J^t0GzyK11$j>FAT=?LxmcnnO6@!Mq4
zxg<yTPt|A5vDq&&?$js<&eR|(@Po)nmNTYZcsQ1(zDyt#A^)DTr1w+CKBOgB4p4l{
zDRej=u?munM2mv!<;28{-tz2m9Ry>L1l;=?x|qt8?&Bp-694_l;pf54IFqm8tV4gM
z?<gq3C-<Q6sWdFIB>Bp_uOG0y?~HDeiq?@hH-ABBi#<=qM@H&my+f*2n{wcg$KhZv
zb%EKABtQD8mEW)IRHRSRM+w{yWN#ldOjHWNAZYSM{Yfor9K8;3aVxdpH|;DH2q@ck
zocRP<pPjAk6APYf@=3TvhTe{^-2GA`=9}|6b--j-(h{{0vrzJN2Mk$zrGPHTP#vcb
z8d(ixk#b)@>dYZ7zT+5*yrxi6%OsO244UH{HbWcqnbBOO_B1E`4;G+M#&VM4#t2u>
z8^;xKw@qPh-JNiZM4&fx(jA%aE;odvq>P>O+ktxB<#j2709=tS3~>rxPGkvq8#!d)
zRml2KOWj{_vzCQjfiZJL>wIk?AO%D?{MD=u<<$5|YRfL%BL=^_Vb>|<Draq)$u2eP
zi7kY#*yM@0ZY)6$S&K=zUAG<aSu`Ax4=T|D9&c{yteEZCI$`Agx!6wicoy-g5GD|l
zo?-q?zi~EW?iGWOn0}49;~sM}xJO6Fq8qOu2W~uxm{REgT>zy)*TElZua?djLL?(d
z_eMAP37fKZSyYrW&Vi5zyfmk_*V5(9%`-w+Fmu`ddX>Ifd%R&Vl@n5_XD@1Cc$qkx
zM4##W>~g$uX3XE)Tk2Wz`@lM*$@W-qtd)od8MlkGQ|5UljyDx|kkc?c>;{V5)fHK5
zeK*7z@2aRQ_)!e7O-VVfepq^DhKs{LAOKz`pLwMcwve6L5e)G6`wBjG#fU|$G2H|V
zRh@LaDGC3L$PPQ?`{q2xn!=)Fp;EUBoR6Lcq?Nj0GuVwN0W;AXRgRs1u=HW*K0!_{
zfN_SV%YC@2R%aN4#E{Hwz%(Kc(%&J7>Ai1^Cob{p&o%BS($aPtIu&b6cz^yxR8Ru^
z&F=(HiS=3&1cwRnj5ja65&sFavm&!~yIeKr?wvebL)a8e>H|N%1jsruXYhSwBj2F3
z;Of<@qjkzzE>?-Y+Jv5C0S`u}AJ(?E8kO}voM<sf4P?p}6YfFrGo>~Ufso?QF5MjC
z;=H_b$3=)<xG!HO+*zqvb(3^6BzW`+7)#kdf4YGFOZ6u5%F81r<{3F5Buy^3Gj)rt
zzapIrVvY7<o7;;Vh(S6*-U^Ei8IK{&Qnr!XntX-o;GogMup7XT)KrwV=r!}mTo68V
zJn{tUi=1ov0nw{d*NVcyMkc_wc9=K}a-5mY5SMaP#qgHQK=t$VW#FE4VGk~Ew&>&E
zr*bb^dzFv#!E-k~P>!1DLwA*E>0KyxCOm{aAeLGSZYfMrJ1(L5JNUpyTsbE56|3yu
z6)KXDbxYv#>My>mIex#t=rBh_(a2PLLTN?J0FLaC$F;P~-_#}-0e_5pALC_n8u=a^
z94vgZ$%1W&FtoGuP$S~j4j9vfNmDuZy&s(CLyFb`Wg%hVB3bW?t6F9IbzQ>Nx3%{$
z(5c-R!r`X7?NNT=9Of9Cg)w%=6wGVKrl@9XF#$5OvYK84(%d?mcVTpVaCdG>?zc}r
z`^XZ7ZfvZt8)p*%s-Nw<Fyk*2Ec_0^VpgcG@@lAY<N;zd4+O196D`Xbdf9Z#{#8Qb
z2(M5tud}Pg4+^ohV(=Ti4c>Fa?YxU3#o-d?eN*?_9DlW~Vw_b+E>H*t?F9<jJueT;
z?$alQ*e_c2m%~4cd{=g*ill*{%c>970u?t7vC&U~re0?S5s0$)z#^QcFIS8CqCZ+)
z94xqRrla$6Rp7uvn>?42RL+mzzgfG6Dkf_VD{DD}Lj%6smt#Wx)}-O%0x7mI)ytPn
z;68-yrl-(i5cGt)zpSuamaxm}b#J0yIS)lHq*=Zh$t=b&eO$GZalR|$d+AEtdG0Pt
zjd!wqAG0rBB=@pVs73a3#ilb&(Rvy}DbY7rxZ-!=(%pOadcS>RdV7m@CoTuE;~Cn5
z3y@KuqC4cNm%gkQxwgjO@4?lNKhV;~X|(>iG`r_Q63A#iI8?=hp-|LFZ*eNr(^D<E
zQX`b^c$ae{%bM&3uy`!Kk+Oun_ld4DX^y09uM9vIRe|csT2Idk%Q}k6>Wjmft?^)U
zhRrdQTlG@fZZk?EMsOTRENZ(EM#%#3&K9cfRO|RKR<~Ec08`P_OL*dwY<Yn?gY(|K
z_zILJ96KeTer1wa7Dw{y@NmTO4S>gmwGP!rZ-L^;xgHhKD&V>@4(#>NNx7X$p~ufz
z)$oWXBagz1Ahwcu2<DNFAcHj6zlVF#`b>XOzw`%3*A~Q*egbmqQg+j}UF_pgC8+84
zO}pz<Pe55Q^03%3$G9gI*@h@pBu!sIPC1Bc-xUc!G=#dHgM;o^n2>UI;`njR@`q|(
zr7eAZP4)GPtJik)XlMRGnKT}Zv7VnG;Y;%J^6IhUxtyxbK$e4<Xj~DwK$P+`STyK6
zL5>{F|F)A{wDfIa9|L8iSgEguDz|#vBS*q~e^`kLEGILzM#743o0(D5(w=!h@oIhK
ze*C|N1Su-p7a*O-yQLIfDk?=&3uZW2rFqf)NKH+J6u@V2WzHfA!jE_{>&m%&;<!KS
z3^F_DpQZ}RaFA$z?0B3;_OI^j%DGrTLfqRon~YAQ@=OWGn_ThAu&jScN!`j?opDpm
zhYx4J9A!50*!>Fd!el7|M|}eWJA~ROCO0~|yQ^bb$15*I>^-oflZ&4{!^p@d!hYE4
zV%+SWr7h1N`?a*RawfdQP5!B=TOYV`<q7gh5x|eEjlFwap;GgxIQmo1=8q?2+EzI^
zJrho=6SG@bJa%5m;<59gvI2{v^*X4|G`$0W(4)cwQ~B!Z>akPCK;0HtBnba~JGRNj
ziaR^Q-o3N*sNnrMy{XdrugRiaiu2TCTGvx$2Vaq0UP}wSWnl0ZB~m-(sqq#(r}iv9
zBd5M81p<Woa&lR)5ISLIk*PhW70#urm!)5;e^Ec~ymUrhGONY6)}IkZC2+P&mEJ}a
zivdCs7`h?NN!NC0{JRJ<ggkxAcny+DQ0@6r$YN@?vQ@Xl)-_3`MW!M*{|sm(k>PZ<
z(uA#>71i^#vM+(vkgVAd)}ycl0!%-)FGW^)46+IrUh%^%sIhwO?b}p0H`m-&*YU*(
zj$F4(0PheZ^6ADNEiD#9deb(j*#X&bMts5l!F0B5`|n0k|Al_Eal%gn)j1wK`^mO^
zR9Ium_7C{WHufAvT4db%W3`0G@Ivzc=NCd6S6wBuXYb!Vd-od+I;8H$@89(K7dyvC
zB^hX3NJwsAnS&4X{Ap+O0TNQ!!x6m`D)Big>t&&CUKiB<h@4r3qo6VLxzu)EIP}1n
zQqMUr&l*!sBb*1B8qlP|2xtgD%KP_Wka;6b<;W$_KIsOf7ez%yk-C3dWdQ2AGe#97
zp8MUe7nyYrAQAVqfEnLY6a~NzyM{=I>zMD{ULv-}X?9?z6YfMT_VG7JSqf@RKT3Ty
zF(qZ?w*;|rDl#n^?tyQ>=frzep@2+ZWN}&`?oRu0Ufy;J?&y$9&sbTLpPz1hxW346
zm5+sG9P#F>9~%ynx}huR$Jmwq)H<obuH9J@?T75!Q9%6nuj|cHc|AQ&2=IRO-RwDx
zdOg{v{s?RE4+;{qye_nSmes89z1{bcqkyzwl7L1l^ySN7JAd<={sC%jo-bb5xwvei
z6+9&LT&A*q|3trTvOm-EVNIrjhaYzRoa+Fvf{hy$?%u+?3CcmJU)Ju%HwC8-`~|V5
zs*Q^rOf5t-!er97hpS$ou?#5()>diViOQ<zQ8^Yg0ip6=w5IfzW24Tg&bcGqN9dsj
z@%x~44^4=d*Ne(+=d$^;Ww%=e`8896AE!*%XldnVSiI;+qD841`x;|ZQ4jDxB)Y1&
zwfCe)-b&NXCNUJ&Z@)1fL@VX8(h~4<AkuLdMBpfDyPQW*sD;rmc<?kfL^0GObrDp%
zZxve(R=n;h)HPDiP#&z1g>%vS`_ksx^VecR%@%iCHqOj6HMjba<57Nl4aQJnalfzC
z4Hq~c9Uy<8-BrCibJ(ul`M@vnhqguqVHbG9h52UYUrYrT=AU_z{u>M(GYbpw0Ed|_
zv-Wrqg!v1{opoyrbuy{ndiwfu{yn?0gymlw{XS*=G*t^Tn`4a$G|S|$M^TL1IAtIk
z$WiV`bum@W;g2Uziwg)W@tP!GcbVxz?E#_rw*p9P6tRxTo5~TH4U{dR?ykWGnte#V
zp9^>?J)x@2az|ZBG`$sfO=PZ|Z|LbubSQVdm7wq$y@qfz$)f@ZAtH6fdFMU$+`G4(
zCy#mQeL(@q>_O<jkB2@-umb&Ocld8c_+MTJ-i(B1AJ-1G)UNk;RZZjIGayH)k~UAH
z5)yZ!AL4tPYc+auECnY0W}YOoZplNtdo)kQMzH0-O*d<Zfj+3ay<LH;2i1I7EHd@B
zJ#`+1U;#%sm9X=2BI05{cvJ`9IYv9+eHIOYa?wk?<wbf#H2q9!B24XM%WuNNm$&|w
z?%A`sv9e7*nzI+*GS`*gYKb(9H&=d&(9ck=Ezt-);NV+qPdEtWWiV3?!-838SQvBE
z@$SQSRD$K6ZvpJX)^OZf6DI(PYt3Qe1=Nc>EKSQR)-T-uW*=&#lB|ukmi^Be)SyBj
z&!ablmY7y~9qoTRC?X@7g9To$gm^#FsFAsB?=J#Z!}9HxC??n=ciT^;YLK?=v7RV%
zI#(P0YAMq*-3tv8Or9nrIXPB`{Cb8L{8~f_t*K>}p|^dvU>Ng2r0iVC1K^8JKRz|0
zxS%WTawW#Z1y0{iKb^Ieim%-uiB>&D#k$$Fv#O9L51QV;@XqH~cBW@stSWCBtl?SY
zJ@gx^OsaM^LzZZ6)-G$Cu3wst!f^sfwGpPV<Ym{Bv*)>*Jjyx40CbyLO)ZmvoY}z;
zfu6MKPgW`yl`>$qeMTI_l&TcMh;6Zkgjq0D`2o?5HM<rkBd}$z8e3Q5NOphua*jU{
zjT{V7U76q5m_|uCJX8P1J?P9HB#t(+ijfsSL5Rp(vo~)Te0ad>Dx?8XTk>3t&6lGn
z%V?$!AtYyt{)4D_zn^}*!b}Bszic6BAG^ngY&1?<mI&~Ly4)QZsda}eo?!;UCvCS{
z^{tv`3<S`lFn+|O{YJrYN|SP=A;-kK<}ML!-^N0cHj))y@;)cNtzmWK@L`45l$UyY
zdKlw;p5I8o2g{`N=XtrS##&NQv4r%=Lj()Qjw~u3sOpn+b1`!BL}DAmGc?s83*rTO
zRrHH2PcntnR#$nV?bK(_#7M2py9DBP2oQsW^%Cl~XTy)RYv>$I<OJ;myWyLT?dh+C
z=Bym~FAtE4yRHk<e-L72JwU3X+iQA~N$+5d;$1>cjSYy3n>_b(BI`qR*M$3jumImX
zoO+~Q+2(+lG}I|nZGCEeP6BN_o|vQ6FJDCeahg`jO<hnmSzC9#r0i~|(%hUQs}f-y
zMpS%*O9~1ezz^7?&6aGu35!!rZt9^3#zUgUN3@DW_;ikjJ%_OI=?djS7w%OaePNa?
zr{qF{tOV22^;*JK#GQdeZ{j(*)N&zjC>IcbK8j@Z*JuVJp~hEyDr;Zw_D>t8pmoJT
zg<-;HuOBCT`20&3-oUIhMyBm;y#RIfR;NmKeWx`Rw3uwPCpdd1>LuqRnTU(+3qcsS
z0r!kO5|Lzvhb^Z%M641o*w2<<sMqe2rQ0AqJkZ{L*bfmUjxsWPvKTEhhMPWr|Nd)M
zVfhV-e&goyw+sBCX-td}-tWv`=T!*t{o=&n6OFb51)7h_BuSU$w4PLwo+j$;C70o)
zv{Dy5y1uw`31trsC8=s~5|lX3^EcIj;Tss>F%1}M@9$R;Y(^XxlVYIa?~lq9Rs{KM
zS5lz9Y@Nv0?)C`^LP)iYN_94h=NA6{@Z_H<bDzCj;lhFf2e6`YqR~-%_iUb}6Y2Q$
z=|Zp^u`;<Dm(u8-UFoK#rVx`d>M}KOJIZChUp3R$FMC?I{Zj}93}M$uRBFWdG{!%_
zcdsesOWZqq25>69;He-l0`l;z%CV=!M-meg;}o~t9sCZu)tvt`lg%`~oFehowc!#d
z2iYGV_)!Zh9bucyn>$5Fo?AcK91$BOZ!XjE!svO1CGTU}-{VVb%SJU^raV@we>WUP
zKEOc=*5{0rc9(W<Q`6ODu7T63<A{Kz=|1O3PV7`We@d#()L?hb<WE7x2P|LdB+LB5
zg2wvd<*CV}aRtcHHLYKjZVCT&kL$rqm)(M&!e@aQE*U|-@^d8nNOphApXsUGCMH|T
zF);osdC>8N7Z=ZDu}zA4+-o6=yGZ+ed~juqr`meJ0(k{el`A8=226C6y*PvIN^`|%
zVCyu!CpF`D^UfW5HqnY)x`oLM)IIL!=CF*$8JmPiJ~-=Em$1H%gc&o9oKd*LJnt@b
zBcxeYNB?$`;m)M)1z}La+2!dMh4g9j(SK*MS%ig<tu#slI*e`V4@XD5hD&emPUE++
znO^Fx&n2l8JEb%pb$#nLB{Eefn78>ix3#}ps?;^ovFMTAY=09p`8+)QX^X3NH=*NI
zRn>#7f)D!p8`C&KIW_l(hc3y=<6ye?y`;RLAQ_D=_b!5>Qc#e78eZwEOSk8gXOZK<
z(=8bs9B+Ho*w2~w+%a!>Moy>^4YX3L>#%xh?LN=<TO5NkXOteCI);kex5EBQ-JP9B
z2nj<5&ma&pjK^qrepHb%Mrbx@ZjN{=>|tu*o4`OiC$ewqGP1EtA3UB;{%z&Q*^^`}
z_U28fqlaho%O5$cA`waqOiX*l`UeIKGb%^o4-t~b%A6_}eiX8>;+CqCYWncS__vxC
z3&fD&4uo7xC-a)xk%@PE_7l9kT`0n5^MlLY!To9BLHoWKiErpu2`r?#7pXhQf$u9m
z{Z6Zpf^oA{f<c4cOr2y0*192rw{pH6DF2XQqY<^WO`ei+ZEEX|NL047Q+uK<y-=e1
z@EBitT+so92Od6d`1P#-R8t<ZJHFxKUJI4XGNoaHq0E@OrPl7krmi_ebp5aG_`JNu
zxjov70jHXn>OYw>EMG4)?>(Uh=j=3R#p|;Zc3aO}<<WtzEIGJ0fbo=P1~NM@T@niO
zM3AE&sZ9iT`PQmQ1;R9e$0BU*$sFQg$fY$2G*{*<^YZgE$2E^dQm1@^m7`Pr93QdQ
zQjN1ne}9aR)}@?E@;_ba-G_!hb#(k_m7;im?<)~Ianb`WnRVp~4_)o4`O$-HW(?YJ
z1kQnTy+iY&4C={Sg@<)m#wf42ggDj(?Ras<qJ^kt(o#}_4ur(us13~QYH!?3x`tV-
zdirbj;J&|oBi`GlZFjj1wg(Oo=(zuscygfk!N(Xm0gCc(3=AGc^i%!CVk%}z9_VzV
zeEmH&8K^Un)jo=|MaI&6&7ukgacyn%?;q`F5cP|dx3O_%bvfK&pLuNwRTf@umi*kD
z*LS+Ud8kDHYJ9IZe4!Tf>GhJ9!V5AAK{kHIlMpSU6$Mg*y;_@qsBX;OFirMKPPsjl
zySx4L%#Z7o0nH<&^iJO5@^LjYUi&e`eX6OskP&#>HNC-JVEM+%?{WkEY1k8*d4y)T
zJQHg++IxC*9&Xfc({M!&M80G>+jdHWZsyUcdB3m0QLt_8YrHQti<$Ci)$Qi+Sk+Ym
zqc$W%`kxfoeRvkt<cFLVUbOT47V_eZ-TTj>fQMmhZs2*!TyVYEK6g>|<KWWI_sCmZ
z!ZM=XdZMC<qFZF9qG`PX-~1-&t!>pO!k>|Xg%fub6EgC^svGIZn}CgCCV<B)(_vPc
zjf#;qzU9efVK;TJ>Hf4*`on`(XkDw`)uaIoda5&R!eg)4PMx-AS98RGaqGs@qv`F6
z;t%>QDBU)?CdL}8mCPZq%)$)SbW51(_8Hb2#goKP12jh%>SSRPao%8Dcs;5l;>o<`
zTCoCs!a1yrR)S#lawoOYPc%wxI1v?7%fH(Lu>gXl_CB1;IgD{y#vf~E(WWT<#{^m3
z{%IHwedPtLijjVc2TLKK46dwwudpUED#rx}y&!WS6s^hm`qJU^tDCakfv-et=oXUF
zXIR2E+ie2E=)1&7NuMM5-E-Y2nRkIR;8p*-8z#vY|L(2UnZWeWfWk@ODzDDoc(pow
z(cQfgSHrVWxEFa1g9om?LvhlYZf-?Whm&iH+Qwe7+Z)SjXqz?6H9e|etR1%!rxq2s
zUFr<eZ8qA&(vb3*e33Tdt_|@+bw7mMJ<UMD=0^#~%B9)u^i|Fi9%`hyPU%Q`O4Ld>
zdY7JaEJ<iGrIAMzPt2I)kRJTrs5E=#RQoE4?TgqSB&MLH6(ZNY*XpjCus{j8wz>Aj
z$Zg8MPs*?j=JhlBMaM1V%jBh$Z@TVWNmLRKM^FYxmT1?D6u!n2n9*yaSE8z3w6>g{
z+F+O=F#XQ$<^5Pj=s^*O%j`|jig%p2S%!Z9zM7zrnR1CGjdu2eo}O4|-?qEgc45e;
zsONsNI)+`YUTQ6i|2$V71S$fPzsV|&cG9Bv<lOiF*4tY~Wx2QSpGXK2(p^&0-Jmqm
z-HITMfV6Z-mq<u=r_v}Ppp=B9q;v^LNQpFaviI}+W@gQc`LCH-v(|pWM((=qE56rp
z9>?dHkBlVd$@B0c%5^Kr&u2ZqThA$VEt;nW<PSp(8!%3tp6s+ST`4%EzZqCNnnL#V
z_1(X(q>UOk-nlPd(snIowcM!zf!gqP$Sk5;eSISpA@bd~P#+aw63X7#Z%ugD@IN&*
z-M5)Pn8|vnTttLp=-j}GVj+B#yMpq#>FAJ=r@A9f!+e2@3E=&mYEpsA4z`15ELM+E
zr{{4T+Hh-<4}XSNT?2qM?x&XKl@&v6t4@^=vi<%WvXGj=cyGADw<b-`cg$DE88~~>
zcNUoUgZ*;jeV~Kp^|If2Wa3a0qQTmgW6wYo1CxJ`e+XxVi_y)+_1{9H7f5_G<uIT%
z>wc{;ExS&w9z%7BPFMqC@glK9{0)`*tkUEkRg6{>5%I|X?*i#RsOmHH|382uIUK8k
zFJ4fB{sz-Ne*PjCct5mfRt3dY1w}>o73k4VS;Ud}@@fMD0vhrls|m^N8_A3|&p#0E
zZ9+ruqc@|KK<$*Wsw&=rLMw_j@B_j52B%$kJlc(jD05xn8X=RAjhlb-3VeJ3%n7-O
z6?Zqd_mFM{=2Tn{@!?Kr1RLcRA-4_~fS`%92OE%jfK-O!59=G<J$xf9xT=gHmwnYh
z4B2}B1Kz*CL=Ek+v9@MfH84Wr>l-S?`{eQu8r;u1{9X9_@JcY8J(RFzWLTS#Bl{<=
z+e(S7*QrP202WAiANqbbn>jBVF_3k+JXX;2k_?(ib^I1?+Fo%l32+P#uVOCusWIqp
zKJNb)4oNAaYX+&CC(H9$H?`*=ZzUwUe<A;`U2@~AbCDlXa-j1qkq7VAbo7?O_FItZ
zN=s848&BaVg<^|f>U6j;$I;4uYBBz2yB@XV9KSxYb9HR9Q&wKDAURzb%WYeDI1I)o
zITBys5Kp`(4+yvgx>{EcOcx)?1o!(vs7ee_O{d(;LveI+;EvzkIybWGo1dqmYlf18
zG96Y-A(15FuYj(AE+=%1_<@a;L$BU=hUxd3ZvE|AaC?D<j{dnUZvZ&o&y>NawD&F~
z1SJ&WQ75~XqI|%6gQ7+0)9L*!Fz#_XZVb~nG3y8H?NOI6z<0KRDrnky0#p){XWvqK
zq1m*@zD71m7pg<qzxO~~4({;K7gC~CatT=l(68N;lHNgMUf$l**Bl03zT-BNWP)E1
z{JN^P<$R9ScbZ6uvM;TC+Yo%OE`*^?mN;1i9GKw7gAmp0IG8E`{=i97a}<Ve+*PJs
zWstfvLl6fv5EMl$??L<z(CX$Yy`effyp?TsV2nzG!k}7!@&n7V*;KZR)5op9Og+~$
zhHCDk{fs@7M?ib{TvPo4Mpqi>v~sfQV5YV-HAU=3MMaG|T!yAWRmk0^yfbQP0{x%s
zmGPQh7VNvN@;Zc!YP|+mW2I)GH}*R9eKX1NJs*UEJVK^ypCJOXqQV_>Q?k?yS8gGF
zzl-l1Ot0-sEkf=DQ-5}E3dx5wL3j5f80O*r4o~4S2^5;wV*&etfWR>%Hkaj{?s0Gk
z(5<|+E2u$4LV_caf|PU`0-0d7XSHJ#IL>dkfKmP-Y=t(J)IdTQwO+wLL41l+tgyV?
z`%hUp6gWT^9F(zl#YHG6r2hE24NPv>4%;vk0BhNigT_1k2;e{f((C;66be@M=0vGq
zv;9lV0kvKz8{B|Pz)lDC54brn@cfgI0142)pwB_!bxKMK5D<BQb^L8KPj&_hAoFT|
zt{mEQgc1rZS$^yUG5Q`oWG6x7q!6&vhJxCWK_H~VNf+WlpOFDn1fiCYI^V5{dSK7z
z8$QjE02*XEc#s^fF2vux-vK;PIJY%4gz#GzyW`&0di!53;CDdJto7I7VXk}kKxESa
z(w(->`2R_HrmfGn&^7`~L_jaJ9>U}m7hqNLHvTOcndNkI-d;^s9|vKT<K$d+vH8~V
z`YIFpzV8t-8J4ui32*xlCwr-+)s0OGf{5UEvNsRt0<LqQFjxJU^1+U=0#%lWhbQfU
zXHs(V6HxzwECiYYpgpk##G%ooH@*=-@>34~NA37y`poxt7!d8zZFb9qxtmez5fP^u
z^5)Zq176cjAe5#)Ja;c(elP>jq1UgEc4iK><Bj(Zx>h#i3s#M(XZ3_61-(&~59wxm
z_A^<AA#dmLz-c)+78R`$Y#JRyP(#=%v=5CrK-dNEk*~l1H8=p#`l{+{qhi!>uq_k1
z_w_${IPI5$f02MqzX}>$0eo7sxnuXDi?CzpCaN9>yHK}95TFTec8<zdW8n><hbx1b
z>0q#h2yjpw$mw7|luL%8*$j9JaLQtT;T*(@3EJsH+IFhNTikUX(2zX*{DoF(3QtR&
z*KD9<LZ$(n8|rX+^ZwIUI%Uol5^xL2k6pXx*2r;pbUB1}2%BrZfCcej78Igi6EB{b
zn7q8YC<SvqG3Nsqe30Se2c4WONgw?j*y4KNx?x={$ym%1z6iQBk07Uz$DaIaSkM}S
z3m0xbozIU4VEqnlZ&;pAi=T5%OlTl%q^_k!&1;E%zucf!6%L4p59dG$ds3t<9K!lK
z<;nZU0}%R!2AvP8nP*^*?zPWFm$NK>CJB+ZCU4J1YN4uf2!6?rl1%5zEdX=~&Npx~
z@)np2Hb3eTA@lL(jexFSN9Z`9c0fr!JUEc3;!yt#6X{;|(kUG1PJmS<3i8R{-`A`~
z-)inf+0S{I6$6bf{~r-KyVkUbG%mgRNtvGe7cCE7xY5O(l#*(-F*7UA%?r)e6<D|k
zrLgcVMz4GS9*d)`Q~suG_$yF!q1INm^wDr&oBykO3Zo*>h$O5ACy5XY&RRqih%!VG
zIC)$MDfaM7BX!i(X*&tAu#m-AT3W(5a2ess$MyI8AF#Id7kzb$V7+Y;U!GS(k^;?k
z5Y@E=0w6fR&-B!Fbf7Z&2pU<{^(KIr`%?GG6Og18baX8CmxYDMX+J=>-Q4HTIQYgb
zUYl!5l?e%}Q141DQuh^tt%01*wfEQ^!Nm;$WYySN1v@a*SeWmE-LjA9Xm6?Iosyi5
zjOHijwNLj>`4WN}8$*P^8#klRkde7H>9D$}egv)33JMWuyCpq&1~B%5(i#(x4L_Q8
zu`H`30v02@i{$er)sx(c3XKZGQ#cGCdLAIqQBtx(7w%KFA%vFi0R8H4gS)%GTY{a#
z!zGG|Wzd;8^FaaKWeTa}g;|br>H!l?6zd^Klgi*od8{_H-cVQawAl~z?v|E^gdEyS
z^4tN>p0x)rK+4>CeK5Msz4gbJAaDDH);GRyoW+)TB8Neat!^=Gc>rHF%%B&BtNgF+
zw*yeI?I+*Qob<%`k_0h1K=(kyYrH>af68GBS5?Mq`Hfwx8<#UWdSG3jkc{kgq|j|5
z&MVf353w@uq&$jE%H|yiUwlLMAaWn<HeG$s$P97soZ9HICyTk;n>~{oczi(3bb;$r
zj6jKl6aJBnLw%3qlk28492kl~)nK~wRDe=calRDt2H4b!^UEHU=4rQozjS&AunRDP
zbV@in4nuhjOx~GS$-EfQ3C}K6;n@9RCL<GkVhbZSs6~ecz8-K_0pa=)1t|dqTSZEV
zBvS7s6|h0zDSiRO3cMq*Y|P6x_VTh(Rz3pg6*>V^co|VQ2?+@Si#7=%YxSd0eDJ<(
zbw+UG#Vqf<S$2e850ADQ$h-dnMki-{{kziA@2$R8)0Ou2sSckyU&F-~dMcMI^<&v2
z&QDv23v>ilk;jbJ*86&T9ACDK<;iYAy<nT~mdnwGq*FbNHM{PpUv}juCSuu?ho?a8
z09{*mS6AMN2vivu*g_pa&KuTqFOGd90&C#BBcg~+I)QZ&z6mAdEkFuAv#1j4wBIjP
z#*nQxT#~2P-aIZdL5hx6F;~LI#+GjM0#D3FtXyq4=@g^>3xbrcI{?gPlE)YiEVv+M
zo?F5#IqNsN3oS!1mE*p+ktPNDs4$>TF!W>#Sc`moV}+b0^rqlB4fj@FdJXqqV8aIE
zSDV+LA27d6WZ!CA6h+xU#g26kgXk{Vb11|Z0q!pDfwa0hFzAsld_;xk6%5*bBTl;Y
zg}#K7JNRptCAykxLBb?i+1X*A?^@d3oyeEt{A2(t^wm{u=5;rSiise)f?eXDFDN@S
zlnA{VEGSb|CJcU=0xF}VQE2+5qw8whxk5LxW_4Xg5H@vQ+&A6IBp(%`yt2qh8%@o2
zFjG6HplAqjbC>#fGVW*1LEBv}I)_h0YimH|@0kdExut};DwA611&>gY<krc^0e6RF
znu<oewA0-9A4I?L(NW12@KMTQraUk(WF;I+Us*BJko<Uh?uNKuj`(b;U3``J$H(7`
zz^sARzdL_C_KR>eib5jYwOJ|dKw;oY_a)1M9b9K`7Bl>x-!fvu@F&7#8~@!0I6i-E
zr6B0I(EAxOqD{X&ev5JV^AeYeidG&k!AMHV=h34k{X!yshxrK*Dt~2#4^G)sTV~I_
zp3;Ev1p%wB)Vus^cb{VKoEzB6lJqyQr-5P=;a>aU!yBPi0JeZNT-t(cQlF&9i%xaW
z$7g<VoRZ%rp{QsAcp<nsK-lydcsw;f-_>OS%IwddKLLBFT{iu4OJH%Q#&Jo?RZ1lb
z{1VKYur{l)axxGAJyBG&dBH#X{+p5S<L{3@!uISdg7Lk_)ddQeAZ}LE>sHTlIOTs2
zNH~>&H8GH$+cuw?y79eI@;nm@BtvGp3XObxd<J*GSP11ovTfqDUrzS5z%iWhlFXHv
zuCUj?qZ`T~GBeB7GK4NG+mcMXDSoIaD_2!le;*!}sV0h`);O82Wn}WpeaET_If}K_
zRXZrHU*={R2>%VNFF5sqp&>X9hP^pD<!%uEVJZYFI8pgXp;D#zRZ7g!!9gK0qAPo{
zmpogF-qPrZ)U%wn=JQ&B<S)r-X^A$6SPE*=*l9RBAHY~xoyHzuSjU*l_+^V=qhN&^
z<}!#v{jL9S)s9thBk!>QP)F2=&G7i*&*U=T@vYLjXJ)j{0*|G3KIv5k2oG)iJTCA&
zoB-CrrNjy6so!<1B0x9bTl0lZ2}v*S4lwg@Rap(~!h=n6d_2FxHNDcXQS)lv)YBAO
zs>tNiILJV}fIG>#*UR1m#{sBJbtjRkS$w!Luz-Y2$_JlQbV*X6-^~ErztZU8eo%ii
z1hLH@2LRCbF3B+U7kI6wBn~Df0g1%f?RcP#v7|d6toA~-Xk~H=Zgtxv;Lbzh)%EW-
zrNJ@CMMp$LY>wLkDux$kkbxI^wM9x$3UySpRJZ*YN394ts;fV8{wR)Fwatp_g2L5=
zmwhndciWmM)+)}bN#})=1C&3kZfp<`tj0Ln*_Pj9i+l?<zg8FkL=jhJ@vi@cwn_op
z2|RJ831AfKXJF#C0X9uYG{20Us2vt&51p3loL2lgxFQ>1mi-7p$n(G&;?%La8j8?Y
zis5{k%F75K;JHREcPH!~d*38jaYf9xpn}i#miG!w%S$MTS#>p+q-x1ahXEo70d6S!
zB*PT<a>bTi7I-0IKUHNjTCmv>rqucw;c{Ic7=+TBeuF38Vb?>0VZa&3q7<?D`OQ=R
zq28ntFx;#j4>!Au{YN)c?Du%tsp#*<Yt-z9lK4BBv&H3vD)Ey%7=q7zS88~)9q%x0
zah{;VbP7NzjoI^keSMvs+7}ciev;QxH?-JKo~-lx`LV!`o%kIARWO4~e;(DsBF@pp
z<$V8oL<TNRzaRa0Uzrw*!zk~NMKBZ}{%S*+==aM(hL<m~2&yzN`qz#Ch$<Z{<Z8{y
zlK<j|s|VEhfbYSDmrfV&rPg#4#6oGnBLKS@c<8}E)vs3i{(aODr#~m>2aLH97!&oV
zg{srcyTx}%Y2<a|#ff%#(-3g*h4J^^{qT^6M)D#jcdDl0hsQTh-<l6We$J=M&+aoh
z07N0eSfhCCwdbm-y<d@0(6$&4$@fOve%lJqYcf%b72Er8v)TGre2tQgVU^VoR}4xX
z)}I@-`9=6;DAR%6b_#6Y6ls^g9CAVLIQ!Ussv*Eu&P}7ioS22O`B$~GtMI3vm-dtM
zKjeXFf;PQIMpW{njTyMC%x(52CMK|NqV*X-*$-yqPG3UStq{j0C3D%9Ht`Q7&vJ#|
zDY&ibJxVf7j2twW(U3oLaP_%}B)z6<bw@eNUS3?xNnFdWxPy&7)c@f|<k7ei(P|5b
zI%<}wX(FVWI4CQRwGuamKRwu;6a7ci@w@5e`8kceLA|(ekKj`8-)QY6fnP>WMke)P
ze)K<zk~q^pE;CwM2CjdBz5fp&y}^)ZJ37JyAIHC9Qdrnx<O$1abXiUw?W!c;!of*&
z6ReUs>X3Gn^&vdC4<7b{0{R=L+P{+2zYkEEM{>;zMUMKXY3@i`+FaJ|pTCA(fP|df
z7W65|b%3Ds8OK1}?*hasP_PP4pkx8c3I6j$!BuH&ag*nQ!53#_&Co~yQ5E=3JvdSS
zd7wIuI<D6D(b0c&Gmz`>&8<POgBvUGzrnO~Y>Yt0=HDmE&M7Ji-GD$e^la_Jip!_;
zVHDU90j(mu7eo?G$j`;4uC>xODs}U*u3y8audaftSzT=90k1?<Ckgw%@07e+Uis!P
z3XuQbZ{`07Pcatqsk*L?;AR_#`%%FGEk(7;FR|{lfAgMX#EIwIC2xNCUwC)SRJ!N?
z)dK!6*uDStnDYOv44cDov*AXrc}B+IzhSLObuE+n{q>}TETXq*cyS3CXUx()jQ_DG
zs;S5pR%K=7h9*f|qyMn^by7V%@kcE@Mj7<e|KyjiS@RrTwbx2qi?}s;d3;O8%*?*^
zSV?IH*tie_kY4d_+W}z#l6p|VW@ajerU?HxF*ynQh^Ee^t}h=fyFtN$GtPb1)3nQ=
z<|FdcFUHJgd6j;=_@HdQd+C~zb=?)4D_&HvdTI2=2V)oj-ZHHUN=jX+{LGu)*#;2W
z;N!>T;osib>1c1q$6I#cO@<qO$QQ|oY>F^4-oKB&5DL7C(9ovLOiE2NNJw(5pINzY
z3LXTtX&%WM|FygiiMEpRvNYQ*^rK2$39!ozNlN{LrlyhXAqUsz3(CwGZfY}A)6vn<
z;NN#KWS`>KbHm{X3*?46c?E@DPa<%$v9hv`jppTxgPqU+`}m_3{cM<+v9qfH4Gh!A
zDaqd_*^f^AgjLq~h|s|jZZJaPLW`=4iX^UWezCCN_V!9q0od@Tw4M-pp-^#XSjaWn
zOG#}ecr;X}@bSAe{iPl<O*=UeQs(rL`=_flZOTko?O1we)L|9Xzi=bU`Sj+aL|B)V
zp&dCCzfZ#cYYe-i?epj4P@kvGa>1p(2r=sX(o%)H-xm#l<anrYvb$`$QuVcJp(cG1
zb+&M!2m4BKgxGg~Kw0L<<uvkS+uVls3OX6$Co%1<t#QcDJ3`0{)L@gm{L@ocH}($N
z*KMKU7<%UJTq6@CVqqRtFSK_ME=*jQ?ZVrV^Mkk5dUEr&h`03WtQTlySHHgYyx4fI
zT?aiY5a)o4Mp4mK_+OCVi>z%~IbNGQ$Qtl;BM|FPb|+|!2A!&Up~n08>uh0JS=kih
z!g9aF!HFWXxvA;9{Cv6#JLlRT3%emFBEoH{ZRrp}sI!|^q_`449z<e`%)iy4)F|rZ
zKqiaAdO@Te`KT-Kep*VWRD@||HGOqA$3%&>wq1z^0U`M@N7uaU=fFHZjl3h;%eyCS
zb8-Ei?i5T6o!`#)C|sIrU21uoMHhT{o69R58ce(TYN*B!rp4PszOFnmxQxkFXX0<K
zNFn+93gLh_DNAg&y@vM5^RhA_64DQ2-=!r!sY~m0>8q%x7suWUOM3iR<iQ!Tc~aj8
z2J4=FF9~FyQutO6fMW=aL5shBwT}@%af?L+CW@!!RP*0o4?G;j+1QSbHnlj7yI~pg
zn(g<Gai?En#;IipZ50v-iBAfa*&@Ib^b<(VxWJ#X@$g{Mdg<X+(aA|W+~O^m(3>ME
z&Z9HHI5`Gzz)n<s?Xf7xg^yPnXTOuuh34f!Z4!!XF)`6XB3)w>#nDnNMmAR$7Yml8
zonPhQYSQ~(W*eNohlg8{Jc@lR=69h6?pm}uYm>E~x+v!dGY+-jD3<qt=JdH{Q9|N=
zPnnVJX=sma9vV|T-Z^~xL^mF6^A8_f#ErEBQp`je@A%*c3Dwo`!ov0b3R=P)EjL1S
z^IQwrQnUvag~AgP<#s<755v6vG^eKBleij7&>^$2F&WntJ<m?(U+eweZfWzYSwtvf
zXTrBoWhVN=hvH^87k)v;@@@h9?S;lDC-y7?D=X`UT4_{9Uf!Y)qs{hn0%!bu$wfZ~
zQlQ%BV*l$8u-J^1>kWN(Nvy9Y)S`RlNZO~o%fb*c*IaLV4c$Knf97~iAXuG3;{NxG
z?|IGO1gP+SSEp7*x_RHeIGQGuQo(ctnz3%$xQoh8SJP-I#C$x~RkM$d_*lz{k~vV|
zAThb|okH(1+O4PEm6LVY>Tz~@#<JR|7Sk=_*B2NCyogoN#VYB8+7N)u(ALobnvz88
z4FwcdlS$-<0RHJu;;^ux-rbe9v-`obUB_@b@diwUj(df0`^hBVIX&G4<k^1PmY|@^
ztIPA7b_c#q>F=y}*;y4)dWr6&Z*K4pk9nmh|5aWl%2YPFm6TFizM`fy|F%G7Z0y6#
zjNs^~*fEQrpGSk5>yc=#qg1WsL)&Wl#8uge<`<kspRKKISZm+C_qUsRRf=17>4i%~
z1o6-_W53iISLUts<K0XCgd-657f)qn9sq}!A>tU)3lP_hgU)5#C?d~$2v6>Iv)Daj
zBNen~O9G=mz)xXf&mwZx1$|MeHaXC&1GewOp9A8)XW!fxe6!!a{SGq$@MwMx=w2gK
zEzVvrk~!Sd4>zQ7aP)^LRwM(6_n)bD=C-1qc9a2Oj%WN%hSEuX&u0)N$5*4z>4xaT
z95uJbP8U~YNI?Z%g6WbzMl)s6eFKhWEmM#YA#8>f7s=&C05-)v6<ksQF6Tf~Qb?so
zcpj`e74(h~fEIMHr*Cd+i%r?Reh9|$*CAjZ3yd^frIbRjJd7d+P$r-R%xr9=h#u?n
z0hkfjRLZ+|eiDqWZDH6QRYVr^<$7wpI?h{j6CWP-1+RV?sm5rBQ4h_&!ndBDVrY|l
zdq(K=!K5&MV$WsDapuGOc&AQ6Nx$VG@sD);8MrXjpvAqfnjyh5vT%)a9M1OjG-N@x
z<sN?{W1OAj7rjU5CwB^{DJa56uzzapA0PW2tUlMDk{0|Zi7EQb89RI9_Osr-r4G1C
z;p$fn13T;ybkFRmFJ;kk*-lW@z~mj{_X4&gIx**MXkU$I=uf)jP^JELL-aBKfc^Rf
z@QuOCa?j3w{vH=s$_1Q$c&iGu)(5%TEL?=VzD>aqlqu$We6UvDb9>p=rsg4ciBGVG
zDZK-D-eqlabC){#zv_Y`Rj%UM699=$j@EE@FfT%|&V;yX2^!j}k!R+ciNP#vX=iQ2
zQk*LDawv_T{3U(kaEBT9G99J=wb=tIabDi7vC_BL)S*#yIXO@Ods7hrg$c0?s;Vt;
zG5*x@(cHp<<H-klLC%kA*$zErfV`k#rbojzI?ywB>8~>56pRzn>~>Zg8V?UTpyn}W
zGJqr_CqQfQin*MY&9_BOA+&=%=@#0ocz#NGFa7uYPSk*gI>3bGP!S5lq#$;V>Ks@V
zGh`o+7Ww8KoK2DE5PB*4Dny)D;bh9#^Een%{WOB)qHZUk+7s7@hS*MA1Rx>YN+3B<
z`?dQm)uo3}vwQbwcTTQM6RN>tkgJdT5^W1CnF#``8ai1IJPlQkcg7N&+<&wAAIMw?
z^73ISaWLFBVQ-}^8vDTU^QVZ<e0NXJ%OTpz`wTmg5vT00Dc31Xn5~w>ygMHG8T)zm
z_CAk#|5T2St_G**7!3o%V@kjEquJNN!XZhUg2K(`X82PrU*kBQ`aPdl-hB{jLPT`l
zh%8w5@kME|98rbccT0n<39U52uOEsjnwRCO9lfH6zBapZ6MXW|pr&2fS`5X)LPoT5
zIrN(Czo=S@*M0xU;4#(qSVX~n!4Bu|sPb3_m#y=}#7!?nH#fq~)2(e!-FKA*h==et
zO-*YC2B|Q7MO`<}yNKgw+U>+9>sjNUj+G^r#p5}9XV_ZpU`FFW_ho45U7L!I=wqtv
zxVWK~7Qv3N?t5m2vr2q3K;8Z9OcE9v`a9|gP-1(+U)-n3A8D|kUdAGXaTo<COyRE}
z1UmN!!{;}Zz---fI<0ZYqJ|BvhXv0DaY-o+=Y{<Fmf8jfA2T<1bwR=EaIQ352S}iN
z=n5Sj-O)mjmsiwjS!nEbO>tqN1vDo&Q~qSwwh<M5QsgDk?c?LNvAOva9HD}OdTM%l
zEQmFNt{br+xZLE<2YLacLO+?7k^=Z0%m~9zB(DN~zkkw#f*3HHiRS<yTO`j&O1sg5
z-cT%~6EA>L=c?C1100MmJnE%G8+f<rWRM{a0*$VwHW?jZmlzl!>`&@V>F+X5OIyQL
z{)U~6hZpE8H);K&?k@`wWigoA*c_&+mQ1cY;+f5ouTRXdA~Ea*`;ZZ3*_ufw$P%=E
zBL<K$bA)DkbP#1Wot<k4!`!#CvzpKIz}$H+3fBr?@ZWKC;3^Xp<9`Ye-AnM?MhN|8
z4ZM&6y0H_Bg{5U4Qjk5~Add_O2gjqf_P##FCr{G9B}nwC@4<Taqy0jXH(oCh6iwrA
zZ*RjiH_i{RH-)Yja<^!r_+WDK(CTh^L^7KRe@k}u0(4Y5H7&(TFAjeR@@WMm;$=T)
zn_-I=Kk`0&6@YMklmGWCwf`r_CEBJ(jwWz)zJ38J{+&sK3_rkX#!&1tE<tUWh1L24
zU$QTbnXC_eAKD!(N}`D{!bI4s$!j^4D*l<Ujj*UFIVGMsk{$xj)xBpycKA{Up|o(8
z`f<1(=koI#!;>Xz;6=ii6R*{@1S=a*eR4Mt-VErVq{VE)pUJZW3**{Wv(oN&lH5b6
zL`h~p_qHKwLWYe1JR6vjI{c{Xg*6O11_n?)qND?5NCbBoQwAV<tN**c6*N+FnkF0;
zydg_X4PD8uxT^Q>cL1WS!6qGwxj9{%EcC|Cp7hvy#Ld;U^VJR6ky~c?oxx#eCp|H-
zU`_9<TbC;<#&M2-B4<?1Ai;B{W|Ti9VwdOan(-!gBbv;Bd~ohJI5))v+6?E=yb)AW
zQ_HZf(yrnZLU5eOi6s4?w;8tFwL#sqwt+2ZbM*JAK}|UkoBpfa%c<&>xF<)BNu0*_
z1<8dDV5<UL{uhkeC8@C~Hh5nA7z6DNT+~@(l+J<6Qb{s-c`(V`+`OE7(Ovm@ACMgb
zzs9p3WI@68xaowt7`E~l@=jwpx)`o5#q{H3!Zb#sHat$xv{e3|$2-C%CYszdZeRJH
z+tI3f$0k`87N0jqtJwOw&FmIgcCfSOev1pI$!@DtA;(}>vHm)+^J3@qYpGF9m*DoR
zKLf@54m64P%>T+ODYZtT2cKUbxwicHcpX?f|I60KjfeZRXqPy^VPToouP(aP&s;aD
zRbsfMu4AFt{;5yM{=4^Ok+1F+WA%jYMw3}!gm}v4)$p(h`Xav`M}CC(WwmIalAhst
zNr|e>gq_Na+sT}su<(?Rh@i~$#OG%UTN6Z&AM4@0Jvt5C)YY9+R_U4<tgG>g&AJld
zEG{qIbj0Y-i;u_IJsz;jMGI*7<)2_sKZNY=Ms+f-*8(A`k-HFky^BRtKu(6~e@$o2
zJdy;M>jRkA*O0gGx4-12UEYL{8I4fR&OJ&;VO4o~$lcwdr4aYi-u|USv&VRF5S{J)
zKRp5mZRZug3ltjet4ZL8B+)T30aD*;IJ00W*cap07%VOG@@Pp~V#`b!_+I|110c`L
z^y%q2wVOM&56ruY$gF23Zfg?a5w&8V6IJADBMS-&#>qopkI*U(mIBPxG_vBO1rM<A
z9PB<7NTXh@by-)PDtMO}57|>v)r-!E6^%q_6bVj&8|YU5YcW@v8b0g2drWZ2bK|*2
z_Vn~TD{QeTdM&+C**0%C+wgpxMXm13UT9{9S8NY6GxLJ)UnE3W3-ezMV>-Tk`GsRB
zyA6Qw4_H{d1~aC8TTi>Kiet<vO1;Egd)nS9=ZU)=ZB)a#9Gn}_IzPQ|U7{Tf1R^LL
zjqeMw`Ra&8?_p4y8^q^(rff~d^!hH_U44ihqfvO=jQ`Za&BVNk;B?l4n<8rUW=w(p
zV@^&Msc!3bGcb9#Chy=Re=DxBn;yL>L@O!+3@{-PPZR1MKZKS-#W652!r$l1O)m#x
zwy#GLwgEZ-p!J!1cL6gYlW?O^!9pQDc5jk611TVY4b~1<x80I_2!|G4{f_D%d`<d&
z-v!gw!<#%&gcc!4>Hcg8i6Q!3%Ld}khQ`M5S{mXEwkh0%c>uCU5Wmr~><q_M|9JN<
z<=G#z7;0D5z(7Q7O4Gyd)ho$xjJLR~b9AVlQ^mxgAECDHK1?Y{N{tJ62p6!%xVZhl
z3;v9rtUK7^NB-x>SicCCz#-n76#@I5s)`DwSjKqshIqa=+=@=Lc)OGIGDT<mrM)`T
zs6V<YfXp_9&|=u`m&;gGq}w8>$cFU&7B0<JF`VtgyREJ79zKAs*$a_3HYJ)Bj5#Pl
z)Om01?mBI*)l)rHeE1N_+8#CR4JPA6P*Bi_g{hE=v7uqXyLXYx43`q_?(VL8!^zL4
zc>C*p&)wiob@SJ+XD_Tbf^u^1VP1X_TBwW2e1}NG>Q2~Hvr$S*X&CABO#jKXngIE|
z`}Ze?9H_6(jxRZwm=M;2j3_2)d>mAA`<$I?kPtbLk&$7*i^1se{M0`tP1foOJ>GIz
z&9g63+OrT;B1M<IEiX-u6m<UlximYQ)b~*zQ&R#N`@Hv=5!}1jnVaheMsobK?Na*M
zvw!;vKjoR)KAjtIbCV`FP*(Csm?5-vQY;`KFjQ4OtM{x8O?&(j3O_tPiDx~^@W^~s
zUzOVSUeDp_DsMGPMQ6f2??$QI!}@aliQXv>gLHv~$;ywXrx<u9qnF-8H8tB<SbAS#
zxwwS(c<$Q#*%Enq_v=?PIOP=?gtRlJrcyFg<YC%|v0^oP(usxnk}kM;qc)NzrMG(E
z_58BJUBC8n5oNG2Dc9w6ab6D%>k!5MwKNuK+b8F!CPeCXZYgD-#gXkkTD`>;^{9%s
z_k(DD{@>2-vhuQw-xDn@xnHtJG?b{soy*LK;t~T8v@W%qUxku&j2!TYU5#{v!Eosj
zH2*z;Ed0%l+P(+<zypPx<7bs_JHJkjHs7wUntPZ5)xT<XIMAq-LV0<S?5j4vIv!Y?
z!ur5G{T+r)BcDHelXIIEm}hXdmPAcpG<R2-iXc4xK7Z9RjaeU{)<e8HkZ0<?;)m$y
zxqrtXMvb8KU4!J^T$W+W@Z=oA;8jBZkP);$uMyZDp|uLUc+5J*tkBb;fQS^d2X&`(
za&m5Gs4QrkbeXr1ZhyX=bdj3|Ji><@92yro$2gG@5xu~?Xz|i9G{j8(jTWLv3t{qj
z3Fx*cEG+cgd`g*Pp>&*jn`^IA>BmP~R)!o_BbdM#cU#H#AaxRu2gm1p>`2h%C|fD7
zY}Jh=BUNTpJL?$6>UFcWPFbbGy?0Jhp+y7B8g`~5?z_|<{v6Ikq5EE(i~t%aRc)<1
zn*7A)Dx+mYMN8}H{*mxW0{tu8GFZ_|MnZ6KdwwT9J(-+}=q`SoNz8m3wg-<t5?<1&
z<JIj=1PR_aYyA6Ft#k=Qry`yQL(6)fR~_Nfi!!e$>qgJL&pwUoV|o#G!6)*pir4eO
zMD?S@2-|2q5uAuG$UZ-2M3vKoBG|qRWAPb4c5me2XWb;jk64!?m_du?!DnqA-0BzK
zg)$iyz5qReOxMO>DV!kyE(KB&9rE4Okr;iP?CjC+ntab&6!v*I=06=7Jwa(?2*Y{8
z7J@>uHPz}%j?8z&(S18E8gTpZ^|1bS?2}HgEwNpcXlKb#mw!vKig1@hY~(9GF(<lW
zqpPbhBO`Hyv?CoRw*Dt~bBc(ix`tVuC}QuN*}W&=0f|k=!h`r^2(sfu{`$8Bs^A87
zuGz%56!Jp+I6sTFJ`oR-cy#_*0*z>SLAI;K@2O>Fid5;nMp@cu^iS>it)U`yn>%&p
z;Tk?6&LINz%NYs7bw|gcq5eN+P#IcV661M(4pNq^Ccc<5DVcxS=EzeXgplg@qO=fe
zKoRd<ac=H6=88W%Q;i6Hv)?P8Y<&8g9xD_<n%vR!;mpUcqGZEf5uNP?(yg}E(9pE9
zU;7RE(>_0=WMm$)_EgOtbumBa?fGm)|51SU?F;gp-^M@9C$+4sBKXE9I5?P7Ei6=M
z>1HLgFaooDTH-Q-haPC)cD7uJ?;Xe&+7J(O&4k;sTCNX@J4H)pQ&EwJ>UQ;GVNFZo
zR67DB&t5{}b6+B>$uqMlr!Rr0;3W-N!=c3I?aci1bhvv}_l#k+2C#pNj~ANivFJxW
zE*OOs#QJ7Y2H#J${93ic=PlGeA0$5D*m0?@u{S>a(4!wqUmKO%koqHBGnkA*wNy1Z
zJ0IO0;du#=en)J%4z!vES^DrD4j~D{z-n|i#rUZyA!`f$MJOA9Yu;7UOaIRfkCcKY
z$f(@j-j9yxDe=6w;Q7GF<7DBj%o>#x<P{}QJ%DTzhJF5fy7tMoVp`H!97&a>;@bVC
zwSJEZZ!SRoqc0=$#*-q(%a4nu#@Kex5eM?by`KK$83pD$(+z5Fg?tWK8RT>!FZ%*#
z81<uE{@QE|jYHiGiOd!Xc>G8g>;>R0x<%4kv!9!2p+?(?5>l2e<b=20-(+$M#l4;Q
zHsypuU!7(X$r>Xgz2@tle+NLhnD_D6zzdw&VM<Y-+n6VkJYqKZ9Y^$R!u~7Myt*tP
z16&PK9^c}}Ao4OqZ>66v1Hw{#gv3%rhYU`7>Ucz?7o%`;4sFi-$ol@_AzeG}T;lAk
z&whsqiQ8aBo5zPc9V#l8`fat;S3P*t*>k?<ei%#X8Sy+h;>|cuy(}yUO9iK_%nP0*
zy?F~OqQ8{9T16LSMMd`Z^NW>jc#A&LQE%5a$`X@oGJAUDQ5qAQjhWu|^sGZy7W7=S
z=VY9CKm|%wc{wb^XYNu=iTj*5`mis9oq;AF9bn-2e>M7-PhAAW?d>aowrDXW7fu!)
z;$Tqzb1)M-Ad326Z|~JOdpcGTVt8@M=0+7#K|z?b$Ddz>=oB3?nC_9ATU(4SD*Pdu
z3R#vGA|#~JJB7&t(;KSxHV%v|%%`VUPo4Pqci;6A5k(}g5)ziWVEpawvP8r1o-7p|
z{&eeV6a)RyLSug4siZKih6#6b?~3yC<Uo2RHs)Rq-?jFE)q*xf<Ckn~e%I2nctxwF
z!N_RV9z)R$<Wht5J)ShuPS1T%NI6)25xG||lp?!KIIhm?ed6t&XE_wpuV|^K*}d8D
ztzl3e_bw&OEpia)E}{K_L}CfRA^3?SkSn^1OH2%A<76u->4I(96NbfaNFVt@OSn7K
zFwrt|QIHZ7hb_Hy|10U(&vmw0|0Sx_=Go?wbEA8u1Na=cUC}o0_+#|LFg<AY4T&%!
z-FDU1l*WoQ>Z52fVXq@=KE^MFFAm|1UPWyF3a?{J`41HGzPKofiUQHq>{;xg(z%gT
zE{^Gs?xF$Ml}z}&JlKNkp|8jf)AT@mJDcWu>MM=(EL6Tn6mZn`OfxscU<&3i&+m0c
zyu}o~*LtU|)%znh8!eLqTfl0dC$P|<DT?4TWPDJu&bXO`_5h}Lqhd~8Uk;^}-oA}Z
z6--1h-MuH`=D#F`z0cAZhT~;jl@F$>AGO8!30Q8avnCO1@~8&&A3o5kern)~p|-M$
z?KqM$$@AkTm^ZZaO4V-3cMm|6>4?dbh`KUS=1gFW@LXyS2}IPbaot$F*Q$gqMIo-j
zLYzN7*Ypy`tL7}-u%I1DeB9{V1<}oZFYDLaH!Eh#fitWyqBCu{|4uxYZ|Hl4O!I=~
z&!Su&C#swwTP>J=!YcPfx!tf0u*Y}T>T@mnb$gUGHSuDGBC|+&{hoYE@l6R0TzANs
zyoFWgv5zMdwQ;ARv1y;>cv}-qC1I(-$?VS`EFg^b`_MxbXs|H)bu;+J;j5?lE1isT
zd(AO8R@}4#n{1Vck}`xNsW2o2P{ygLn;^5q09Lr3Mw?CX&N)hixZAcz&G7Uz0}K{|
zq){>H7Uf^5(QuHG5UG#D)i0>}2E9w3{z26JjL&|yZn+V-s}jKQ-^&NVA@F5%7N$%a
zP#gPfwsai~$1|T!rK;+O<Oa?AdVw*2tDjTUglVX+EQ68rra+0m-n>`SzV-Yb9~NxB
zFtp?Orl-3sm~=T>A1(SV)rNHTepG`s^h*M2LUr=wqk>NW0!z>VQmh8<jFP1B*~O`g
zP{o4>M3Oa?#=k>u2|j&#7B8$wxW|>rZ)jC_(u}fcX#;o3>8yB3@}H2nL&=G11-<;&
z1a-8&FC7{=@;)s3XgwnH#CG}8TU9aub=mX}N}zpFQRl+Lx3OHJY!v=DK*H6+KX5L@
z3x0JUR~H<Qg;uljsv5E5>Ak(fU)6u9T3Y(A{p@BvVkI<h;E`$R53O!tS!V7%ZW$Y6
zRZuvUU8|ETQ{*qOE1wHUO0&4-LTqo5E!G0p3G^)tzZ;Z_@Y9;-r_jDD;PIt}&IqHs
zVJJg5D#dzbWH#QQ2RMMAJodp`w@t$ISnKbXU1c3!``HsnZn!Uf)>}n=e;08$#J6>`
zw#SU7CIEK`_9Nk`8Fxp=&mrf<+4omhKV?_E8ALcn^!D91MZh)Exr-Mzhf&zzxD*K5
zgVc(pxn;bLpWpcn0kjC%QFOs#uRAK+u2@7x&nJzG!(HS*>sGN;#|+z8XM-?2(%HA0
zP+3`7UfvHYv`|dX>)2?x0O!_p$55kAM%w0L$1`Uc85x}j+o3T$d_F2O6;@?NgZMi7
zHO-@aodc>&mIC88KXdotAyR%D%+zG5SZ_4R=-k=BAf!fnBvFR|G!@rh_w+}K^6cj3
z!sH3>Q`m0TeEds9kQ_6_F>P>O^9Nk^Cd9<aV0vtC`p%k}s?wd@@@aw&2L}g@a>!AR
z=NQp|!Aac^jPh{C5oJj>!P+dg?y+#s2!G7{JUuN9n!AU@uh<pSju8+rFcoAZwNL22
zIT$ZIgnhfW|8489-Ygl&7ACTnfF7Q=Ae&_qC~Xb>Oy7#7I1uT}=`jO%EWeSs&O=o7
zl_@qF8agKCY(w1612YdwW89s=OwrcXX26Eu45%!zM9E2Xq%BRsrJp=R%%;y(`R<f_
zbseS;;GBM>*&{D5Bvb;Q1lkV_4e3t_o4(J@U8Xy<LY$>BkTPyI^1P3OTEMO+0>Ai!
z!!`a=$;JlEgbW@FnDnJMB*n#risRi6l2Xsc6t(raL$Cv|7Tm#a-y|&Qc|TVLdWZ$n
zA@g13<(tX>#u!JnP}r^Q)PM+@t0qsu#$a~aXGcMW^OJ2DuhF}@1>OEx(`d1(b5DWd
z^vfN;Q)e!=Cx#C}sRMy!Yjy1K3zFO2JE2)sdvKEsMLuYch;v0r2m77^(-StcMO1a&
zYE)xd+70=QA{Z@O<R#C&#pT_(R*(^$^}dLGM!;=6eYq&HK9Js$nR(uCnXi9#3yndO
zR03BRa6iJrG>bbsDiqePS!$UgFD%9>=)^(U>xzgFz?kblI?@i6ij(ux(0F{ymQmWC
zC}EwSBGUhk+FvF7x9lI>Cga~e-rD*SYpHK6d^ejk!)$HzvyX$_>{@4MMNyIH_6`kc
z=D@T@5&oU+_b?^?fivr4L0F=|x|<~9(L&>}aMxxEr|DB`(S2is=@yOrl6UV`DvctH
zm5sF94HcBZ1@Wh@x-l-}Nc!?Dx~{HRLHSlJN|DFjj11%8GZ9Mia*wuHKLgSVOh$Yo
zmC5QK=C<BPIzAw!uKN2MLVE%;llA-J-xE2K=DNDp{Nna%rE#(=+Jl7Gd|W(C?j(=7
z)yX&3I$qv4;dyxXLjd?TemM80=!eJkfgG)nn=>@`BX#i4Y9FF>G>%R~XMe@$q~NQ@
z#DoItO714qE!-EifyM#FQ6~2LnG9K3tdO1?7$BDtGR+;!KxgKPeLRuRB3359lpb%&
z#u^5FTQ!yKtxhXxV3dni5lvv<pJWh>n`K6MCTL<DC;Z*<1<X2cmttuMc^#4bG%GPz
zNsOA6me26i=1Y3pB0<u0I9|>(<k?vGK4+fW=hh@I9i5g9zANLfYO?4i5vqcvWs>%g
z9QQ*n*RTh0UnvagFzhigm}Z!im&ns8HH>kyfq<0zd|)2(C?qiGG#|A0Q_z5Rw(T@F
zH}0&iuSe*WmfQZ?+<ZnLZ-Y-#0Z{n+ADdOO#lClSjSp62YEz^X2?dKCCnh<5&9&y`
z5!*j2FSdGRoRCp|dFLKBQ)FjnXAP}H4-0E~ID?QR6iHjU$aI>O_B5<oT3D>Ft!aDO
zn=C`)W&BzDh}0YEf?mgm!I8y5X;Os!l)LIxicSK3h;kUJPrSXK=$}+qb34<~;bxQ_
z&40Njv$V0XoJBV5dIy$Jwuf_!B9Gn1(UkfH&d%CqldpyJUS$1hhio<}NxVYuCJM?S
zNL`&OC<0nq3)VC9`YJCDF1>L{Q==g5WNr7_`jj@#!ERej)ttQij_!x*>M_gnZ|!-@
zN)ZvPbXgMHZd^QRFJ8Rw$Kvl;H#$4fSPrYCSz%^ne=+`Jum|mqB@q#o$LVN{lB2`d
zH%$-x7Fd&U1#tFaUOGKEJ^MpuKbjC7a3x|tc=W1VPpjc}d4Al;ZvlZUT-;)OJbFQM
z{RKS*`_O(xf9KjFqycgv<L0D<Y=?sTLZglS6&u#h7(WF>y)oF?i=Q3qmM;+z?P8Jd
zYbR9K#{TTjeh{diJWJ&C#(gueB8t_WQB#e#c3&l(><+RXKE6hk@^r9Hg`S<YwV}bS
zxg1F(4?lDx;=gJpc6Px6LZVLw(GbZ<dJwzP7V%TWd|4>!BR|OyWASR!A!p3i^Q#vC
zhGlYMqO_g)JqO1i6%~eYn<@#{vsVSEhPXDZMP*5mlimYdFMm~nrEy|-xTntxl^dW#
zUPU4rK3x6;vA!^a-ht6(fvYY;=%yUNE<t)-u65geO+yFRqzWzqMb8|w&F$?UA04Pe
zrA}ibF|2+1bb42F2c7HdNh}zOa*HgTCBKN~%1iPQGIXowB+=)ip7bet`2=h``-)+Q
z)&(lul~*^uC*R9?owcc!{|-|R&y{>pm{4z1d%X|cI$se3II3n-c8N!5<w!!PPEJmF
zqmAqFC1nR>0(MMW{SzcO6kHGD->wlqe$PH?lP54qP-sX%{fz)U<luK+AmZcg!9EK;
z<=3XSR8GH^etK20O<~<&2q9@GXYuqT<cYSq4elqQG-rO&j=ASy^@bTX&>UpAc*T;!
zs4f~+msYaIFUw5ag~}TumFtrfTvRA}8+nRkqyH%&e~`3wC5Q=Dtt>6ApWBX8)fbnS
zBcbYDRInK&B&5{Uxw;&lN#&N%V*9^;d=FK_bafiTxim!fvC7y%T3&)u<3G=N(R@<!
z98sI~I$2|6Qn06d_IrYhvolP@!D`V<H*{qHeb&GyU1(KF@I84&Pm6mV%Y%=PFJBiJ
z7}MOm@iw6JUCg|V!kwDpf&wPX_bmV21}uJDT1*6eZD_4Ek@Mnvx_1?$<BjPROEXwO
zd@w*kBpa~Ooe)J6+Z`}s0DrIM&_(5~26rr`t*xznj|X)dYxAnAV<gHd5DJgSJMJ|Y
zPkRAx3ebWL@27vy>&Q5ch0?yiZ{w+=(YI!XZHXQtbxKUb!pyCqWyO@uUm9{corsTz
zGo08Gp^n*!^;mZ*67nU>f)B<?y1KfC^{1zWNl8fw9Y%V;%LAB!3y&QKt*1G&9Lb}k
zv9WQu6UzFi6I=YN<jW%-8)+ptpVkGXO696wv5)EK32J<Q#+1#e#xokikmx0;Pxv52
zIx^n>r*Gu%)4HFZx(^KdYxUj^=be0%E`+b`^!4++_xYt~sVBMw%tmWJ3v|yWGFd#(
z!w9asE$frkQ&|YP>zJ5ekI_WxG;g!bDJ|{5=SmogV$m21w((CCgl}H`W>bd4P$gyC
z&bL)PdnkzTeV)uZ)>U&aC!Pg5hSmWFi?E9{9!m~0JP-VRfdVI+JZFKLdSOqPTiMN%
z-#ke|%qw*3e}5!EU!%)GO#A1lZ#Ev9_Gayu|M|N}P0c(*O-(6dCCQuDzIjLjhB+^5
zmMm>tO%1yAe}Ab?fH?gv(kizq_Uj7oe_n(DU6v+x0B5KV1tkRW7UA%Jf2}AiAt3!g
zT7sB~m9>1-y%lzkf8UA)(ihB|XYuJB7=WOH`G0>;phzmgB`v_aDm;98+6dEC!~l{1
z{gusMX@@=wwX^Kx)a)G`ga&~;eBu9jB=fy^nnaqEUOhspn9967LqkJ0Ji@Jw4YUxc
zVAB6?fROf5E7-l<f7gVxOZkLo`*G&%7naCFj`;PstSkfC|9qf6fARo{r+Rv*zZ$E!
zve`~0BzQAIIoJqnY;5*UZDiHIk3|;!XDeMW2JF8pEbLf6tf{F9|Ev5;N>@{Fa&=$3
zP(WP^KAig3Ux9&AcIt-8U3~w3ujp&Ma;YJIl2H)Fq#7GNS1TkHf~9a-bNUsfKDW!^
zfuj$MZkShPLGg<3;Z?3l6AG^Uv$QwT{$@9FvG~p>s^qHMkTS5*#-SZ^E3XCy2G-DC
rQ6nH+U*j(RVL(7YxP7xOMnW)LS#Z&+R-S?1ASlSH%2Y@_3;f>z8+4#E

diff --git a/docs/documentation/integrating-and-extending/environment-providers.md b/docs/documentation/integrating-and-extending/environment-providers.md
index 68eb35899..682d16975 100644
--- a/docs/documentation/integrating-and-extending/environment-providers.md
+++ b/docs/documentation/integrating-and-extending/environment-providers.md
@@ -1,15 +1,18 @@
 # Implement an environment provider
 
 An environment provider supplies managed compute through Lightspeed's
-environment protocol. It translates requests such as creating, waking, or
-closing an environment into the infrastructure it controls, then routes
-Lightspeed to the daemon running inside that environment.
+environment protocol. Lightspeed asks it to create a target for an
+environment and, later, to close it. Everything in between belongs to the
+provider: power, idle policy, wake-up, ingress, placement, and any pools or
+snapshots behind its targets. The provider also routes Lightspeed to the
+daemon running inside each target.
 
 The provider implements the controller plane of the
 [environment protocol](../reference/environment-protocol.md). It does not need
-Lightspeed's database, API implementation, harness, or Temporal runtime. The
-included Incus provider demonstrates that separation. If you only need to
-connect an existing machine, [outbound daemon registration](../environments/bring-your-own-compute.md)
+Lightspeed's database, API implementation, harness, or Temporal runtime, and
+it never calls Lightspeed. The included Incus provider demonstrates that
+separation. If you only need to connect an existing machine,
+[outbound daemon registration](../environments/bring-your-own-compute.md)
 already provides that path without implementing a controller.
 
 ## Separate control from execution
@@ -23,84 +26,97 @@ data operations.
 
 ```mermaid
 flowchart LR
-  Runtime[Lightspeed runtime] -->|controller plane, bearer credential| Controller[Provider controller]
-  Controller -->|provision and power| Infrastructure[Compute infrastructure]
-  Runtime -->|data route, bearer credential| Route[Provider data route]
-  Route -->|data plane, unchanged| Daemon[lightspeed-envd in target]
+  Runtime[Lightspeed runtime] -->|controller plane| Controller[Provider controller]
+  Controller -->|create, power, close| Infrastructure[Compute infrastructure]
+  Runtime -->|data route| Route[Provider data route]
+  Route -->|wake, then data plane unchanged| Daemon[lightspeed-envd in target]
   Infrastructure --> Target[Target]
   Target --- Daemon
 ```
 
 The two planes have separate version numbers. A provider speaks
 `CONTROLLER_PROTOCOL_VERSION`; the daemon in its targets speaks
-`ENVD_PROTOCOL_VERSION`. Both are matched exactly, and both are currently 3.
-A provider that never parses data-plane messages, and only relays them,
-does not depend on the daemon's number. A provider that bakes the daemon
-into its images still has to ship images whose daemon matches the runtime.
+`ENVD_PROTOCOL_VERSION`. Both are matched exactly, and both are currently 4.
+A provider that only relays data-plane messages does not parse them, but it
+still calls the daemon's `env/getIdle` to run idle policy, so it moves with
+the daemon's number. A provider that bakes the daemon into its images also
+has to ship images whose daemon matches the runtime.
+
+## Know what Lightspeed decides
+
+Lightspeed keeps durable retries for only two decisions: create the target
+until the provider accepts it, and close it until it is gone. It records
+what the provider reports, for display, and never acts on that record to
+move power.
+
+| Concern | Lightspeed | Provider |
+| --- | --- | --- |
+| Create | Chooses the provider and template; retries `target/create` until accepted. | Creates the target, or hands one out from a pool. |
+| Readiness | Proves the daemon answers with one data-plane handshake, then opens the environment. | Holds or refuses data route dials until the guest is up. |
+| Power | Passes a user's manual change through to `target/setPower`. | Owns every transition, including its own idle policy. |
+| Idle | Validates the template default or a create-time override and passes it through. | Runs the clock, escalates stages, and keeps busy targets awake. |
+| Wake | Dials the data route, and waits when the dial is refused with a 503. | Resumes the target when its data route is dialed. |
+| Ingress | Passes a user's change through to `ingress/ensure` or `ingress/remove`. | Realizes the edge, hostname, port, and TLS. |
+| Close | Decides when; retries `target/close` until the target is gone. | Destroys the target; may also end targets on its own and report them closed. |
 
 ## Serve the controller endpoint
 
 The controller is one WebSocket endpoint. The operator registers its URL in
-Lightspeed together with a provider credential. The URL may use `ws://`,
-`wss://`, or `unix:///absolute/path`, under any path; the Incus provider
-uses `/control`. Use `wss` whenever the controller is reachable beyond a
-single host.
-
-Every connection to the controller and to each data route carries
-`Authorization: Bearer <credential>`. Compare it in constant time and refuse
-a missing or wrong credential with HTTP 401 before the WebSocket upgrade.
-Treat the credential as a secret in the provider's own configuration, as the
-Incus provider does with its `credentialFile`.
+Lightspeed. The URL may use `ws://`, `wss://`, or `unix:///absolute/path`,
+under any path; the Incus provider uses `/control`. Use `wss` whenever the
+controller is reachable beyond a single host.
+
+A bearer credential is optional. When you configure one and the operator
+registers the same value, every connection to the controller and to each
+data route carries `Authorization: Bearer <credential>`. Compare it in
+constant time and refuse a missing or wrong credential with HTTP 401 before
+the WebSocket upgrade. Treat it as a secret in the provider's own
+configuration, as the Incus provider does with its `credentialFile`. A
+provider registered without a credential receives no `Authorization`
+header; run it that way only where nothing but Lightspeed can reach it.
 
 Run the shared JSON-RPC envelope and handshake on that socket. `initialize`
 comes first, a repeat is `invalidRequest`, and another protocol version is
-`versionMismatch`. The response names the `controller` plane and carries two
-facts the runtime records on the provider:
+`versionMismatch`. The response names the `controller` plane and the
+optional methods you serve:
 
 ```json
 {
-  "protocolVersion": 3,
+  "protocolVersion": 4,
   "plane": "controller",
   "serverInfo": {"name": "example-provider", "version": "1.2.0"},
-  "capabilities": {"adoptTarget": false, "ingress": true},
-  "routes": {"data": "wss://provider.example.com/routes"}
+  "capabilities": {"power": true, "ingress": false}
 }
 ```
 
-`capabilities` lists the optional features. `adoptTarget` serves
-`target/adopt`; `ingress` serves `ingress/ensure` and `ingress/remove`.
-Everything else is mandatory at this version. The runtime never calls an
-optional method the controller does not advertise and refuses the
+`power` serves `target/setPower`; `ingress` serves `ingress/ensure` and
+`ingress/remove`. `template/list`, `target/create`, `target/get`, and
+`target/close` are mandatory. Lightspeed reads `capabilities` on every
+connection, never calls a method you do not advertise, and refuses the
 corresponding API requests up front. If one arrives anyway, answer
 `capabilityUnavailable`.
 
-`routes.data` is the base URL of the data routes. Lightspeed never derives it
-from the controller URL. A controller served over `wss` must advertise a
-`wss` base; the runtime refuses a downgrade.
-
 ## Implement controller operations
 
 | Method | Provider responsibility |
 | --- | --- |
-| `template/list` | Return the approved templates available to the supplied universe and binding. |
+| `template/list` | Return the approved templates available to the supplied universe. |
 | `target/create` | Return the owner's existing target, or apply template policy and start creating one. |
-| `target/adopt` | Take over an existing target named in your own format, when you advertise `adoptTarget`. |
 | `target/get` | Observe the target without changing anything. |
-| `target/setPower` | Converge toward one of the target's supported power states. |
+| `target/setPower` | Move the target to one of its template's power states, when you advertise `power`. |
 | `target/close` | Destroy everything the owner's target holds, ingress included. |
 | `ingress/ensure`, `ingress/remove` | Apply or remove provider-approved application exposure, when you advertise `ingress`. |
 
-A create request carries the target's owner and a template selection:
+A create request carries the target's owner, a template selection, and
+optionally a display name and an idle policy that replaces the template's
+default:
 
 ```json
 {
-  "owner": {
-    "universeId": "u1",
-    "bindingId": "primary",
-    "environmentId": "env_1",
-    "incarnationId": "inc_1"
-  },
-  "templateId": "ubuntu-24.04-small"
+  "owner": {"universeId": "u1", "environmentId": "env_1"},
+  "templateId": "ubuntu-24.04-small",
+  "displayName": "build box",
+  "idle": {"pauseAfterMs": 600000, "stopAfterMs": 3600000}
 }
 ```
 
@@ -108,7 +124,8 @@ This comes from the protocol's
 [create fixture](../../../crates/environment-protocol/fixtures/controller/target.create.json),
 which also shows the response and a typed error. The request does not carry
 an arbitrary image, private address, or cloud-init document. Your template
-policy decides what the caller may provision.
+policy decides what the caller may provision. Validate `idle` with the
+protocol's rules and answer `invalidParams` for one that breaks them.
 
 Every target and ingress method answers `{"target": <observation>}`.
 The [protocol reference](../reference/environment-protocol.md#controller-plane)
@@ -121,16 +138,17 @@ a boot, or a graceful shutdown, continues in the background. The runtime
 follows it with `target/get`. Container and cloud APIs are usually
 asynchronous already: answer `target/create` with `phase: provisioning` as
 soon as the request is accepted, even before your backend has assigned an
-id, and include `targetId` in the first observation that has one.
+id, and include `targetId` in the first observation that has one. A target
+handed out from a warm pool can answer `active` at once.
 
 ### Make ownership survive retries
 
-A target belongs to exactly one owner: universe, binding, environment, and
-incarnation. You hold at most one target per owner. An ambiguous
-infrastructure response is normal: a create can succeed while its response is
-lost. `target/create` and `target/adopt` are therefore idempotent per owner.
-When the owner already has a target, return its observation and apply no
-creation policy, so deprecating a template never affects existing targets.
+A target belongs to exactly one owner: a universe and an environment. You
+hold at most one target per owner. An ambiguous infrastructure response is
+normal: a create can succeed while its response is lost. `target/create` is
+therefore idempotent per owner. When the owner already has a target, return
+its observation and apply no creation policy, so deprecating a template
+never affects existing targets.
 
 Every target method names the owner in a target reference,
 `{owner, targetId?}`. Without `targetId`, resolve the owner's target yourself.
@@ -138,39 +156,32 @@ This is how Lightspeed closes a target whose id it never learned, so
 `target/close` must work by owner alone and answer `closed` without a
 `targetId` when you hold nothing for that owner. A target that belongs to
 another owner is `failedPrecondition` (`ownerMismatch`). Knowing a native
-target id is never enough: an old incarnation must not reach its
-replacement or destroy it during delayed cleanup.
+target id is never enough to reach or destroy a target.
 
 The Incus provider derives deterministic names from the owner and records
 `user.lightspeed.*` ownership metadata on its native resources, so it can
 restart and reconcile without a private database. Another provider can use
 labels, tags, or its own store, but must preserve the same properties.
 
-Adoption transfers ownership. In the Incus implementation, it replaces the
-source VM's networking and profiles with the binding's policy, and a later
-close destroys the adopted VM. Document your adoption format and effects as
-part of your provider's contract rather than presenting adoption as a
-harmless label change.
-
 ### Report what you observe
 
-An observation has two axes. `state.phase` is `provisioning`, `active`,
-`closing`, `closed`, `failed`, or `unknown`. While `active`, `state.power` is
-`running`, `paused`, `suspended`, or `stopped`, in provider-neutral terms:
-a paused container and a frozen VM are both `paused`. `supportedPowerStates`
-lists only the states `target/setPower` can actually reach.
+An observation has two axes. `phase` is `provisioning`, `active`, `closing`,
+`closed`, `failed`, or `unknown`. While `active`, `power` is `running`,
+`paused`, `suspended`, or `stopped`, in provider-neutral terms: a paused
+container and a frozen VM are both `paused`. Templates list in
+`powerStates` only the states `target/setPower` can actually reach.
 
-Report infrastructure observation, not the state a caller requested. Set
-`state.daemonReady` only once your own probe reached the daemon on the
-target's data route; a WebSocket upgrade is enough, and you need not speak the
-daemon's protocol. Until then, a running machine stays `daemonReady: false`.
-When a target is `failed` or `unknown`, or a transition waits for something,
-say why in `state.message`; Lightspeed shows it to users as the environment's
-lifecycle error.
+Report infrastructure observation, not the state a caller requested. An
+observation does not say whether the daemon answers; Lightspeed proves that
+itself by dialing the data route. When a target is `failed` or `unknown`,
+or a transition waits for something, say why in `message`; Lightspeed shows
+it to users with the environment.
 
-A target that no longer exists is `notFound` from `target/get`. Lightspeed
-records the environment as failed, so a target deleted out of band is noticed
-on the next observation.
+Lightspeed reads each open environment's target every 5 minutes for
+display. A target that is `failed` fails the environment. A target that no
+longer exists is `notFound` from `target/get`, or `closed`; Lightspeed then
+closes the environment as ended by the provider. So a target you removed on
+your own, or one deleted out of band, is noticed within that interval.
 
 ### Close means destroy
 
@@ -187,9 +198,10 @@ Ingress follows provider policy. A request identifies an owned target; it does
 not let callers choose ports or upstream addresses. A template advertises
 `publicIngress`, and the provider decides the approved port and endpoint.
 Report the realized endpoint in the observation's `ingress`, absent when
-disabled; the runtime converges the environment's recorded intent against
-that field. See [Networking and ingress](../environments/networking-and-ingress.md)
-for the user-facing behavior.
+disabled. Lightspeed calls the ingress methods only when a user asks for a
+change, and caches the endpoint you answer with. See
+[Networking and ingress](../environments/networking-and-ingress.md) for the
+user-facing behavior.
 
 Templates report their size as typed `resources`: `vcpus`, `memoryBytes`,
 and `diskBytes`. Use `metadata` only for display facts, such as an image
@@ -205,21 +217,62 @@ branches on them:
 | Your backend API is unreachable or overloaded | `unavailable` or `busy`, optionally with `retryAfterMs`. The runtime retries. |
 | The template is deprecated or the target's owner differs | `failedPrecondition` with `templateDeprecated` or `ownerMismatch`. |
 | The template or target does not exist | `notFound`. |
-| A power state is not supported | `invalidParams`. |
+| A power state is not in the template's `powerStates`, or an idle policy does not validate | `invalidParams`. |
 | A power change on a target that is not active | `failedPrecondition` (`targetNotActive`). |
 
-Retryable kinds, `internal`, transport failures, and timeouts keep the
-environment's status and are retried. If such errors persist for 30 minutes,
-the environment fails with the last error. Other refusals fail a provisioning
-environment at once, so reserve them for requests that can never succeed.
+Retryable kinds, `internal`, transport failures, and timeouts are retried
+with backoff, up to 5 minutes apart. An environment that has not opened
+within 30 minutes of its creation fails with the last error. Other
+refusals fail a provisioning environment at once, so reserve them for
+requests that can never succeed. A refused manual power or ingress change
+is returned to the user who asked for it; nothing retries it.
+
+## Own power and idle policy
+
+The provider owns power. Lightspeed calls `target/setPower` only when a user
+presses a power button, and stores nothing but the observation you answer
+with. Your own idle policy may move the target again at any time, and
+Lightspeed does not undo it.
+
+A template names a default idle policy in its `idle` field, and
+`target/create` may carry an override for one target. Keep the policy a
+target was created with: Lightspeed never sends a later change. A policy
+stages `pauseAfterMs`, `suspendAfterMs`, `stopAfterMs`, and `closeAfterMs`,
+non-decreasing in that order. For a running target, read the daemon's
+`env/getIdle` over your own channel to the guest and apply the most
+escalated stage whose threshold `idleForMs` has reached and whose power
+state your template supports. The protocol crate's
+[`IdlePolicy::due_action`](../../../crates/environment-protocol/src/idle.rs)
+implements that rule. A powered-down target has no daemon to ask, so
+continue its idle time on your own clock if later stages should still fire.
 
 ## Serve the data routes
 
-A target's data route is your advertised base followed by
-`/{universeId}/{bindingId}/{environmentId}/{incarnationId}/{targetId}`, each
-segment percent-encoded. Lightspeed dials it with the provider credential.
-Check that the owner in the path owns the target, then connect the socket to
-the daemon in that target and relay frames unchanged in both directions.
+A target's data route is your data route base followed by
+`/{universeId}/{environmentId}/{targetId}`, each segment percent-encoded.
+Lightspeed derives the base from your controller URL, its scheme, host and
+port followed by `/routes`, unless the operator registers another one. Serve
+the routes there, or tell operators which base to register; a `unix://`
+controller always needs one registered. Lightspeed dials the route with the
+credential when one is configured. Check that the owner in the path owns the
+target, then connect the socket to the daemon in that target and relay
+frames unchanged in both directions.
+
+A dial is also the wake signal. When the target is paused, suspended, or
+stopped, resume it, then try the daemon. Hold the dial for at most 5 seconds;
+if the daemon answers in time, upgrade and relay. Otherwise refuse with a
+typed JSON body that tells Lightspeed what to do:
+
+| Situation | Answer |
+| --- | --- |
+| The target was powered down and is resuming | 503 `{"state": "waking"}` with `Retry-After` |
+| The target runs, but the daemon does not answer yet | 503 `{"state": "booting"}` with `Retry-After` |
+| No target exists for the owner, or it is closing | 410 `{"state": "gone"}` |
+| The target is broken beyond recovery | 409 `{"state": "failed", "message": "..."}` |
+
+`Retry-After` is in whole seconds, from 1 to 60. Lightspeed dials again
+after it, and a tool call that needs the target keeps waiting meanwhile. A dial answered any other way is treated as an unreachable
+provider.
 
 A relay is an intermediary under the protocol's liveness rule:
 
@@ -233,6 +286,26 @@ protected network on every hop, and keep those values out of logs, provider
 metadata, and traces. The [credential guide](../environments/credentials.md)
 describes the policy around them.
 
+## Meet the provider obligations
+
+Lightspeed cannot enforce what happens inside your infrastructure, so these
+rules are part of the contract. Every provider:
+
+1. makes `target/create` and `target/close` idempotent per owner;
+2. wakes a powered-down target when its data route is dialed, holding the
+   upgrade at most 5 seconds before it answers a typed refusal;
+3. decides idleness from the daemon's `env/getIdle`, so running processes,
+   jobs, and leftover process groups keep the target awake;
+4. never powers a target down while it relays a data connection to it;
+5. reports `closed`, or `notFound` from `target/get`, for a target it
+   removed on its own, such as by a lifetime limit or an idle
+   `closeAfterMs`;
+6. never snapshots or clones a daemon state directory that holds a daemon
+   identity.
+
+A provider with no idle logic is valid, but it gives operators no cost
+control: its targets stay up until someone closes them.
+
 ## Run the daemon in your targets
 
 Install `lightspeed-envd` in every target and start it as a passive listener
@@ -252,20 +325,24 @@ lists them.
   that user, and the filesystem root is a boundary for data operations only,
   not for commands.
 
+A passive daemon reached through your data route holds no registration
+identity, so cloning a golden snapshot of such a target cannot duplicate a
+daemon key.
+
 The daemon reports a new `daemonInstanceId` after every start. Process
 handles from an earlier instance answer `notFound` with reason
 `daemonRestarted`, and unfinished jobs become `interrupted`. A container
 runtime that restarts the daemon's process or replaces the container is
 therefore visible to callers; avoid restarting a daemon that serves work.
 
-`env/getIdle` reports how long the environment has been idle. Lightspeed's
-power reaper reads it before pausing, suspending, stopping, or closing a
-target under an idle policy. Running processes and jobs keep `idleForMs` at
-zero; handshakes, idle reports, and discovery scans do not count as use.
+`env/getIdle` reports how long the environment has been idle. Running
+processes, running jobs, and process groups a command left running keep
+`idleForMs` at zero; handshakes, idle reports, and discovery scans do not
+count as use.
 
 ## Test the provider
 
-Start with the protocol's fixtures and the two conformance suites. They need
+Start with the protocol's fixtures and the conformance suites. They need
 no Lightspeed deployment:
 
 ```bash
@@ -276,14 +353,21 @@ cargo test -p environment-client
 The controller suite in
 [`environment_client::conformance::controller`](../../../crates/environment-client/src/conformance/controller.rs),
 behind the client crate's `conformance` feature, drives your controller URL
-with your credential and one template. It checks the handshake rules, the
-HTTP 401 refusal, the data-route downgrade rule, per-owner create
-idempotency, that `target/get` never creates, owner fencing, close by owner,
-and `capabilityUnavailable` for unadvertised features. It creates and closes
-one target, so run it against a disposable account or project. Lightspeed
-runs the same suite against its fake controller in CI, and the
+with one template, and with your credential when you use one. It checks the
+handshake rules, the HTTP 401 refusal, per-owner create idempotency, that
+`target/get` never creates, owner fencing, close by owner and its
+repetition, strict decoding of every observation, and
+`capabilityUnavailable` for methods you do not advertise. It creates and
+closes one target, so run it against a disposable account or project.
+Lightspeed runs the same suite against its fake controller in CI, and the
 Incus provider's live suite runs it against a real Incus server.
 
+The data-route helpers in
+[`environment_client::conformance::data_route`](../../../crates/environment-client/src/conformance/data_route.rs)
+check a refused dial: a typed body, the status it names, `Retry-After` on a
+503, and an answer within the hold bound. Point them at the data route of a
+target you have just paused.
+
 The data suite in
 [`tools::environment_protocol::conformance`](../../../crates/tools/src/environment_protocol/conformance.rs)
 drives a data endpoint through a data client. Point it at one of your
@@ -292,38 +376,42 @@ behavior through: writes and reads, confinement, walks, process output and
 exits, and job identity. It works in a fresh directory and removes it.
 
 The suites do not cover everything. Also exercise ambiguous create retries,
-cross-binding access, stale incarnations, daemon startup lag, relay idle
-behavior during a quiet long read, every advertised power transition, a close
-of a target whose create failed midway, and ingress teardown.
+cross-universe access, daemon startup lag, wake on dial from every power
+state you support, an idle policy that pauses and later stops a quiet target,
+a busy target that stays awake, relay idle behavior during a quiet long read,
+a close of a target whose create failed midway, and ingress teardown.
 
 ## Register and verify it in Lightspeed
 
 Register the provider through `deployment/environment-providers/put` with its
-controller endpoint and credential. The credential is write-only: it is
-required for a new provider, kept when omitted, and never returned.
+controller endpoint and, when you use one, its credential. A data route base
+is optional unless the controller URL is `unix://`, or Lightspeed reaches
+your data routes under another address. The credential is write-only: kept
+when omitted, removed with `clearCredential`, and never returned.
 Registration runs the controller handshake. A refused upgrade, such as HTTP
-404 for a wrong path or 401 for a wrong credential, another plane, or a data
-route that downgrades a `wss` controller, refuses the registration. A
-controller that cannot be reached yet is accepted, and its features and data
-route are recorded at the first successful handshake.
+404 for a wrong path or 401 for a wrong credential, another plane, or a
+configured data route base that downgrades a `wss` controller, refuses the
+registration. A controller that cannot be reached yet is accepted.
 
-Create an enabled universe binding and inspect the returned templates. The
+Create an enabled universe binding and inspect the templates. The
 [Incus setup guide](../environments/incus-vms.md) shows the registration and
 binding procedure; use your provider's controller URL, credential, and
 templates.
 
-Create an environment, wait for it to become ready, read and write a
-disposable file, and run a harmless command. Exercise each advertised power
-state, wake it, and close it. Confirm that the infrastructure target and any
-ingress are actually removed, and that a stale identity cannot reach a
-replacement.
+Create an environment, wait for it to open, read and write a disposable
+file, and run a harmless command. Exercise each advertised power state, let
+the idle policy power the target down, wake it with a tool call, and close
+it. Confirm that the infrastructure target and any ingress are actually
+removed.
 
 | Symptom | What to inspect |
 | --- | --- |
-| Provider registration is refused | Controller URL path, credential, plane, and the `wss` downgrade rule for `routes.data`. |
-| The target runs but the environment never becomes ready | `daemonReady`, the daemon's startup, and the data route's reachability from the gateway. |
+| Provider registration is refused | Controller URL path, credential, plane, and that a configured data route base uses `wss` for a `wss` controller. |
+| The target runs but the environment never opens | The daemon's startup, the data route base, and the data route's reachability from the environment gateway. The environment's state message names the last problem. |
 | The environment fails with a version message | The daemon in your image speaks another protocol version than the runtime. Rebuild the image. |
-| An environment stays provisioning with a lifecycle error | Transient controller errors are being retried; the error names the last failure. |
+| An environment stays provisioning with a state message | Transient controller errors are being retried; the message names the last failure. |
 | Retrying create allocates another target | Ownership is not resolved before creation policy runs. |
+| A tool call waits and then fails while the target sleeps | The data route does not wake the target, or never upgrades after waking. |
+| A target sleeps while a command runs | The idle loop does not use `env/getIdle`, or acts while a data connection is relayed. |
 | Long reads fail after about a minute | A relay closes quiet connections or drops pings. |
 | A closed target still has public access | `target/close` did not remove ingress with the target. |
diff --git a/docs/documentation/reference/environment-protocol.md b/docs/documentation/reference/environment-protocol.md
index 39f2ce468..07b639a83 100644
--- a/docs/documentation/reference/environment-protocol.md
+++ b/docs/documentation/reference/environment-protocol.md
@@ -22,7 +22,7 @@ The protocol has three planes. Each runs over its own WebSocket connection.
 | Controller | The Lightspeed runtime | A provider controller | `CONTROLLER_PROTOCOL_VERSION` | Create, observe, power, and close the provider's targets. |
 | Registration | `lightspeed-envd` | The Lightspeed environment gateway | `ENVD_PROTOCOL_VERSION` | Admit an outbound daemon and ask it for reverse-dialed data streams. |
 
-Both numbers are currently `3`. They are matched exactly. A peer that states
+Both numbers are currently `4`. They are matched exactly. A peer that states
 any other number is refused with `versionMismatch`. There are no version
 ranges and no negotiation. A change to a plane's wire shape, or to the meaning
 of an existing field or method, needs a new number for that plane. The data
@@ -55,6 +55,11 @@ Generated from the manifest and committed under
 | `data.openrpc.json`, `controller.openrpc.json`, `registration.openrpc.json` | One OpenRPC document per plane: every method, its params, result, and summary. |
 | `data.schema.json`, `controller.schema.json`, `registration.schema.json` | JSON Schema bundles of every type the plane uses. |
 
+The controller documents also name two types that no method carries as a
+whole: `x-lightspeed-data-route`, the data route refusal body with its hold
+and `Retry-After` bounds, and `x-lightspeed-idle-policy`, the idle policy
+providers run.
+
 Each method also has a fixture under
 [`fixtures/<plane>/`](../../../crates/environment-protocol/fixtures/), named
 after the method with `.` for `/`, such as `fixtures/data/process.read.json`.
@@ -129,7 +134,7 @@ of any version can read them.
 | Optionality | No `null` except JSON-RPC's own `id`. Absent options and empty collections are omitted. Flags are booleans that default to false and are omitted when false. |
 | Numbers | Byte counts, offsets, and durations are unsigned 64-bit; counts, indices, and depths unsigned 32-bit; instants are signed 64-bit milliseconds since the Unix epoch. Every value stays below 2^53. |
 | Unions | Data unions carry a `kind` tag. |
-| Ids | Lightspeed-assigned ids follow the general grammar `^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$`. Provider-assigned ids (`targetId`, `templateId`, `sourceTarget`) are opaque: 1 to 255 bytes without control characters. |
+| Ids | Lightspeed-assigned ids follow the general grammar `^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$`. Provider-assigned ids (`targetId`, `templateId`) are opaque: 1 to 255 bytes without control characters. |
 | Bytes | Payloads are padded standard base64. Fixed-size cryptographic values are lowercase hex. Content digests are `sha256:<64 hex>`. Opaque fingerprints carry their own prefix, such as `scan:v1:`. |
 | Paths | `EnvironmentPath`: absolute, normalized, at most 4096 bytes; `.` and `..` segments are refused, not rewritten. Tree entries use relative `TreePath` values; the selected root itself is `.`. |
 | Text | Descriptive text such as a target `message` is 1 to 1024 bytes, without control characters other than line feed and tab. URLs are at most 2048 bytes. |
@@ -177,8 +182,8 @@ Reasons by kind:
 | --- | --- |
 | `permissionDenied` | `outsideRoot`, `daemonState`, `filePermission`, `invalidSignature`, `invalidRegistrationKey`, `registrationKeyRevoked` |
 | `notFound` | `expired` (the handle was evicted), `daemonRestarted` (the handle belongs to an earlier daemon instance), `unknownDaemon` |
-| `capabilityUnavailable` | `filesystem`, `filesystemWrite`, `process`, `processPty`, `job`, `adoptTarget`, `ingress` |
-| `failedPrecondition` | `inputClosed`, `ifMatchFailed`, `createCondition`, `notEmpty`, `isDirectory`, `notDirectory`, `notRegularFile`, `symlinkLoop`, `symlinkRejected`, `filesystemRoot`, `crossDevice`, `noSpace`, `jobIdInUse`, `operationIdInUse`, `transferPhase`, `transferOffset`, `digestMismatch`, `environmentClosed`, `identityInUse`, `ownerMismatch`, `templateDeprecated`, `ingressUnsupported`, `targetNotActive`, `notAdoptable` |
+| `capabilityUnavailable` | `filesystem`, `filesystemWrite`, `process`, `processPty`, `job`, `power`, `ingress` |
+| `failedPrecondition` | `inputClosed`, `ifMatchFailed`, `createCondition`, `notEmpty`, `isDirectory`, `notDirectory`, `notRegularFile`, `symlinkLoop`, `symlinkRejected`, `filesystemRoot`, `crossDevice`, `noSpace`, `jobIdInUse`, `operationIdInUse`, `transferPhase`, `transferOffset`, `digestMismatch`, `environmentClosed`, `identityInUse`, `ownerMismatch`, `templateDeprecated`, `ingressUnsupported`, `targetNotActive` |
 | `busy` | `requestLimit`, `transferCapacity`, `rateLimited`, `capacityExhausted` |
 | `aborted` | `cancelled`, `sourceChanged` |
 
@@ -246,16 +251,30 @@ requests as if each had been cancelled, and drops their replies.
 ## Controller plane
 
 A provider controller manages targets: machines, containers, or other units
-of compute. The runtime is the client.
+of compute. The runtime is the client. Calls go one way only: the runtime
+calls the provider, and the provider never calls Lightspeed.
+
+The provider owns everything that happens to a running target: its power,
+its idle policy, its ingress, its placement, and any pools or snapshots
+behind it. Lightspeed decides only two things, that an environment is
+created and that it is closed, and it retries both until the provider
+accepts them. Lightspeed records what the provider reports for display;
+it stores no power or ingress intent and never reverts a change the
+provider made.
 
 ### Transport and credential
 
 The controller is a WebSocket endpoint at the URL the operator registers in
 Lightspeed: `ws://`, `wss://`, or `unix:///absolute/path`. Any path is
-allowed. Every connection carries the provider credential as
-`Authorization: Bearer <credential>`. The provider compares it in constant
-time and answers HTTP 401 before the upgrade when it is missing or wrong. The
-same credential authenticates the provider's data routes.
+allowed.
+
+The credential is optional. When the provider is registered with one, every
+connection to the controller and to its data routes carries it as
+`Authorization: Bearer <credential>`; the provider compares it in constant
+time and answers HTTP 401 before the upgrade when it is missing or wrong.
+When the provider is registered without one, the runtime sends no
+`Authorization` header. Run a provider without a credential only where
+nothing but Lightspeed can reach its listener.
 
 ### `initialize`
 
@@ -266,42 +285,31 @@ The params carry `protocolVersion` and `clientInfo`. The response carries:
 | `protocolVersion` | The controller's number. |
 | `plane` | Always `controller`. |
 | `serverInfo` | The controller's build. |
-| `capabilities` | Optional features: `adoptTarget` serves `target/adopt`, and `ingress` serves `ingress/ensure` and `ingress/remove`. Every other controller method is mandatory. |
-| `routes.data` | The base URL of the provider's data routes. |
+| `capabilities` | Optional methods: `power` serves `target/setPower`, and `ingress` serves `ingress/ensure` and `ingress/remove`. `template/list`, `target/create`, `target/get`, and `target/close` are mandatory. |
 
 ```json
 {
-  "protocolVersion": 3,
+  "protocolVersion": 4,
   "plane": "controller",
   "serverInfo": {"name": "lightspeed-provider-incus", "version": "0.5.0"},
-  "capabilities": {"adoptTarget": true, "ingress": true},
-  "routes": {"data": "wss://provider.example.com:19090/routes"}
+  "capabilities": {"power": true, "ingress": true}
 }
 ```
 
-`routes.data` is a `ws://` or `wss://` URL with a lowercase scheme, a host
-and optional port, an optional path that does not end with `/`, and no user
-information, query, or fragment. It is never rewritten. A controller reached
-over `wss` (or `https`) must advertise a `wss` base, so the credential never
-travels in cleartext. The runtime checks this at every `initialize` and
-treats a downgrade like a failed handshake.
-
-A target's data route is the base followed by
-`/{universeId}/{bindingId}/{environmentId}/{incarnationId}/{targetId}`, each
-segment percent-encoded (everything except RFC 3986 unreserved characters).
-The runtime dials it with the same bearer credential. The provider serves the
-daemon's data plane unchanged on that route, under the liveness rule and the
-message limit above, and refuses a route whose owner does not own the target.
+The runtime reads `capabilities` from the live handshake of each
+connection and never stores it. It refuses an API request for a power or
+ingress change up front when the provider does not advertise the method.
+A controller that receives an optional method it does not serve answers
+`capabilityUnavailable`.
 
 ### Methods
 
 | Method | Params | Semantics | Errors |
 | --- | --- | --- | --- |
-| `template/list` | `binding {universeId, bindingId}` | The templates the binding may create targets from. | `unavailable` |
-| `target/create` | `owner`, `templateId` | Idempotent per owner. If the provider already holds a target for the owner, answer its observation and apply no creation policy (deprecation, binding, or image checks). Otherwise apply policy, start creation, and answer promptly with `phase: provisioning`. | `failedPrecondition` (`templateDeprecated`, `ownerMismatch`), `notFound` (template), `invalidParams`, `unavailable` |
-| `target/adopt` | `owner`, `sourceTarget` | Needs `adoptTarget`. Take ownership of an existing target named in a provider-defined format. Idempotent per owner. | `capabilityUnavailable`, `notFound`, `failedPrecondition` (`ownerMismatch`, `notAdoptable`) |
+| `template/list` | `universeId` | The templates the universe may create targets from. A provider may offer each universe a different set. | `unavailable` |
+| `target/create` | `owner`, `templateId`, `displayName?`, `idle?` | Idempotent per owner. If the provider already holds a target for the owner, answer its observation and apply no creation policy (deprecation or image checks). Otherwise apply policy, start creation, and answer promptly with `phase: provisioning`. Handing out a target from a warm pool counts as a create. `idle` replaces the template's default idle policy for this target. | `failedPrecondition` (`templateDeprecated`, `ownerMismatch`), `notFound` (template), `invalidParams` (including an `idle` that does not validate), `unavailable` |
 | `target/get` | `target` | A pure read: it never creates, starts, or changes anything. Resolves by `targetId` when given, otherwise by owner. | `notFound`, `failedPrecondition` (`ownerMismatch`), `unavailable` |
-| `target/setPower` | `target`, `power` | Converge toward one of `supportedPowerStates`. A target already there, or moving there, is observed without action. Answer promptly with the transitional observation. | `notFound`, `invalidParams` (unsupported state), `failedPrecondition` (`targetNotActive`), `unavailable` |
+| `target/setPower` | `target`, `power` | Needs `power`. Move the target to one of its template's `powerStates`. A target already there, or moving there, is observed without action. Answer promptly with the transitional observation. The provider stays the owner of power afterwards. | `capabilityUnavailable`, `notFound`, `invalidParams` (a state outside `powerStates`), `failedPrecondition` (`targetNotActive`), `unavailable` |
 | `target/close` | `target` | Destroy everything the owner's target holds, public ingress included: gracefully within the provider's own bound, then forced. Answer `closing` while it runs, `closed` once nothing remains, and `closed` without `targetId` when the provider holds nothing for the owner. Idempotent. | `unavailable` |
 | `ingress/ensure` | `target` | Needs `ingress`. Route the template's public ingress to the target. Idempotent. | `capabilityUnavailable`, `notFound`, `failedPrecondition` (`ingressUnsupported`) |
 | `ingress/remove` | `target` | Needs `ingress`. Stop routing public ingress to a target that stays. Idempotent. | `capabilityUnavailable`, `notFound` |
@@ -310,19 +318,20 @@ Every target and ingress method answers `{"target": <observation>}`.
 
 ### Ownership
 
-A target belongs to exactly one owner:
+A target belongs to exactly one owner, the Lightspeed environment it serves:
 
 ```json
-{"universeId": "u1", "bindingId": "primary", "environmentId": "env_1", "incarnationId": "inc_1"}
+{"universeId": "u1", "environmentId": "env_1"}
 ```
 
 A provider holds at most one target per owner. Every target method names the
 owner in a target reference, `{owner, targetId?}`. Without `targetId`, the
 provider resolves the owner's target itself; this is how the runtime finds
 and closes a target whose id it never learned. A target that belongs to
-another owner is refused with `failedPrecondition` (`ownerMismatch`). Knowing
-a provider's target id is never enough: an old incarnation must not reach or
-destroy its replacement.
+another owner is refused with `failedPrecondition` (`ownerMismatch`).
+Knowing a provider's target id is never enough to reach a target. An
+environment id is never reused, so a closed environment's owner cannot
+reach a later environment's target.
 
 Record ownership durably enough to survive the provider's own restarts and
 an ambiguous create, where the target was created but the response was lost.
@@ -343,10 +352,9 @@ that carries one.
 ```json
 {
   "targetId": "ls-3f2a",
-  "owner": {"universeId": "u1", "bindingId": "primary", "environmentId": "env_1", "incarnationId": "inc_1"},
-  "displayName": "Acorn build machine",
-  "state": {"phase": "active", "power": "running", "daemonReady": true},
-  "supportedPowerStates": ["running", "paused", "stopped"],
+  "owner": {"universeId": "u1", "environmentId": "env_1"},
+  "phase": "active",
+  "power": "paused",
   "ingress": {"endpoint": "https://acorn.env.example.com"}
 }
 ```
@@ -355,51 +363,159 @@ that carries one.
 | --- | --- |
 | `targetId` | The provider's id. Absent only while provisioning before an id exists, and in a `closed` observation of an owner with nothing. |
 | `owner` | Always echoed from the request. |
-| `state.phase` | `provisioning`, `active`, `closing`, `closed`, `failed` (broken beyond the provider's own recovery), or `unknown` (the provider cannot tell). |
-| `state.power` | Present exactly when `phase` is `active`: `running`, `paused` (execution halted, memory retained), `suspended` (execution state persisted, compute released), or `stopped` (powered off, disks retained). |
-| `state.daemonReady` | The provider's own probe reached the daemon on the target's data route. The probe is a WebSocket upgrade only, so the provider does not need to speak the daemon's protocol version. |
-| `state.message` | Why the target is `failed` or `unknown`, or what a transition waits for. |
-| `supportedPowerStates` | Power states `target/setPower` can reach. Empty when the provider offers no power control beyond create and close. |
+| `phase` | `provisioning`, `active`, `closing`, `closed`, `failed` (broken beyond the provider's own recovery), or `unknown` (the provider cannot tell). |
+| `power` | Present exactly when `phase` is `active`: `running`, `paused` (execution halted, memory retained), `suspended` (execution state persisted, compute released), or `stopped` (powered off, disks retained). |
+| `message` | Why the target is `failed` or `unknown`, or what a transition waits for. |
 | `ingress` | Realized public ingress, an `http` or `https` URL. Absent when disabled. |
-| `displayName`, `metadata` | Provider display facts. Metadata has at most 32 entries, and keys starting with `lightspeed.` are reserved. |
 
-Report what the infrastructure shows, not what a caller asked for. A machine
-whose daemon is not reachable yet stays `daemonReady: false`.
+Report what the infrastructure shows, not what a caller asked for. An
+observation says nothing about whether the daemon answers: the runtime
+proves that itself by dialing the data route.
+
+### Templates
+
+A template has a `templateId`, a non-empty `displayName`, and these
+optional fields:
+
+| Field | Meaning |
+| --- | --- |
+| `description` | A short description for people choosing a template. |
+| `powerStates` | The power states `target/setPower` can move this template's targets to. Absent or empty when the provider offers no power control beyond create and close. |
+| `publicIngress` | Targets of this template can serve public ingress. |
+| `idle` | The idle policy a target gets when `target/create` names none. Absent when the provider applies none by default. |
+| `deprecated` | The template creates no new targets; existing targets keep working. |
+| `resources` | `vcpus`, `memoryBytes`, and `diskBytes` in provider-neutral units, each omitted when the provider does not fix it. |
+| `metadata` | Provider display facts, such as an image fingerprint. |
+
+### Idle policy
+
+An idle policy names when a provider powers down or closes an idle target:
+
+```json
+{"pauseAfterMs": 600000, "stopAfterMs": 3600000, "closeAfterMs": 86400000}
+```
 
-A template has a `templateId`, a non-empty `displayName`, an optional
-`description`, and optional `publicIngress` and `deprecated` flags.
-`resources` states `vcpus`, `memoryBytes`, and `diskBytes` in
-provider-neutral units, each omitted when the provider does not fix it. A
-deprecated template creates no new targets; existing targets keep working.
+`pauseAfterMs`, `suspendAfterMs`, `stopAfterMs`, and `closeAfterMs` are each
+optional, but a policy sets at least one. Every set threshold is positive,
+and the set thresholds are non-decreasing in the order pause, suspend, stop,
+close. A policy that breaks these rules is `invalidParams`.
+
+The policy belongs to the provider. A template names a default, and
+`target/create` may replace it for one target; the runtime validates a
+policy and passes it through without interpreting it. The provider runs the
+clock. For a running target it reads the daemon's `env/getIdle` over its own
+channel to the guest and applies the most escalated stage whose threshold
+`idleForMs` has reached and whose power state the template supports; `close`
+always qualifies. The protocol crate's
+[`IdlePolicy::due_action`](../../../crates/environment-protocol/src/idle.rs)
+implements that rule. Running processes, running jobs, and leftover process
+groups hold `idleForMs` at zero, so they keep the target awake.
+
+### Data routes
+
+A provider serves the daemon's data plane for each target on a data route:
+the provider's data route base followed by
+`/{universeId}/{environmentId}/{targetId}`, each segment percent-encoded
+(everything except RFC 3986 unreserved characters). The runtime dials it
+with the bearer credential when one is configured. The provider serves the
+data plane unchanged on that route, under the liveness rule and the message
+limit above, and refuses a route whose owner does not own the target.
+
+The data route base is a `ws://` or `wss://` URL with a lowercase scheme, a
+host and optional port, an optional path that does not end with `/`, and no
+user information, query, or fragment. The operator may set it when
+registering the provider. Without one, the runtime derives it from the
+controller URL: the controller's scheme, host, and port followed by
+`/routes`, so `wss://provider.example.com/control` gives
+`wss://provider.example.com/routes`. A `unix://` controller has no derivable
+base, so its registration must name one. A configured base for a controller
+reached over `wss` (or `https`) must itself use `wss`, so the credential
+never travels in cleartext; registration refuses a downgrade.
+
+A dial of a powered-down target's data route wakes the target. This is the
+only wake signal: Lightspeed has no separate wake call. The provider may
+hold the dial for at most 5 seconds (`MAX_DATA_ROUTE_HOLD_MS`) while it
+resumes the target. If the daemon answers in time, the route upgrades and
+relays as usual. Otherwise the provider refuses the upgrade with a JSON
+body, `Content-Type: application/json`, tagged by `state`:
+
+| Status | Body | Meaning |
+| --- | --- | --- |
+| 503 | `{"state": "waking"}` | The target is resuming from a powered-down state. |
+| 503 | `{"state": "booting"}` | The target runs, but the daemon does not answer yet. |
+| 410 | `{"state": "gone"}` | The target no longer exists. |
+| 409 | `{"state": "failed", "message": "..."}` | The target is broken beyond the provider's recovery. |
+
+Every 503 carries `Retry-After` in whole seconds, from 1 to 60
+(`RETRY_AFTER_MAX_SECS`); receivers clamp a larger value. A 503 may succeed
+on a later dial; 410 and 409 do not. The body is an HTTP refusal, not a
+JSON-RPC message. The controller schema bundle names it as
+`x-lightspeed-data-route`, together with both bounds.
+
+The environment gateway's worker route uses the same body. It adds three
+states of its own and forwards a provider's refusal unchanged, status and
+`Retry-After` included:
+
+| Status | Body | Meaning |
+| --- | --- | --- |
+| 503 | `{"state": "provisioning"}` | The environment is still provisioning. |
+| 503 | `{"state": "disconnected"}` | The registered daemon is not connected. |
+| 410 | `{"state": "away"}` | The registered daemon has been away longer than it is waited for. |
+
+### Provider obligations
+
+The provider owns its targets' power, idle policy, and ingress. Every
+provider:
+
+1. makes `target/create` and `target/close` idempotent per owner;
+2. wakes a powered-down target when its data route is dialed, holding the
+   upgrade at most 5 seconds before it answers a typed refusal;
+3. decides idleness from the daemon's `env/getIdle`, so running processes,
+   jobs, and leftover process groups keep the target awake;
+4. never powers a target down while it relays a data connection to it;
+5. reports `closed`, or `notFound` from `target/get`, for a target it
+   removed on its own, such as by a lifetime limit or an idle
+   `closeAfterMs`;
+6. never snapshots or clones a daemon state directory that holds a daemon
+   identity.
 
 ### How the runtime drives a controller
 
 Providers can rely on this behaviour:
 
-- Until it has recorded a target id, the runtime sends `target/create` (or
-  `target/adopt`) on each reconciler pass. Afterwards it observes only with
-  `target/get` and never sends create again.
-- `phase: active`, `power: running`, and `daemonReady: true` lead the runtime
-  to run the data-plane handshake on the target's route. Success marks the
-  environment ready. A daemon that speaks another protocol version fails the
-  environment, naming both versions.
-- `notFound` from `target/get`, `target/setPower`, or an ingress method means
-  the target is gone: the environment fails, or its close finishes.
-  `phase: failed` fails the environment with `state.message`.
-- Retryable kinds, transport failures, timeouts, undecodable answers,
-  `internal`, and every failed controller handshake (a version mismatch
-  included) keep the environment's status and record the error. The
-  environment fails after 30 minutes of such errors. Other refusals fail a
-  provisioning environment at once.
+- Until it has recorded a target id, the runtime sends `target/create`, with
+  the same `displayName` and `idle` on every attempt. Afterwards it observes
+  with `target/get` and never sends create again.
+- `phase: provisioning` is checked again after 2 seconds.
+- `phase: active` leads the runtime to run the data-plane handshake on the
+  target's route. This handshake is the only readiness proof: success opens
+  the environment and records the daemon's build. A daemon that speaks
+  another protocol version fails the environment, naming both versions. A
+  503 refusal is retried after its `Retry-After`; `gone` and `failed`
+  refusals fail the environment.
+- `phase: failed` fails the environment with its `message`. `closing` or
+  `closed` before the environment opened fails it too. `phase: unknown`
+  is retried with backoff.
+- Retryable kinds, `internal`, transport failures, timeouts, and failed
+  handshakes are retried with backoff: 2 seconds, doubling per attempt, at
+  most 5 minutes. Other refusals, `notFound` included, fail a provisioning
+  environment at once, so reserve them for requests that can never
+  succeed. An environment that has not opened within 30 minutes of entering
+  provisioning fails with the last recorded problem.
+- Every 5 minutes, the runtime reads each open environment's target with
+  `target/get` and records the observation for display. `phase: failed`
+  fails the environment. `closed`, or `notFound`, closes it with the reason
+  `providerEnded`. This sweep never changes power.
 - Close sends `target/close` by owner, with the target id when one is
-  recorded, until the provider answers `closed` or `notFound`. The runtime
-  never removes ingress before close.
-- Ingress and adoption calls are sent only when the controller advertises
-  the feature. API requests for them are refused otherwise.
-- Connect and `initialize` each have a 10-second deadline, and controller
-  calls a 120-second deadline. After a timeout or transport failure, the
-  runtime skips that provider's remaining environments for the rest of the
-  pass.
+  recorded, until the provider answers `closed` or `notFound`. `closing` is
+  checked again after 2 seconds, and errors are retried with backoff. Close
+  has no deadline, and the runtime never removes ingress before it.
+- `target/setPower` and the ingress methods are sent only when a user asks
+  for a change, synchronously, with a 30-second deadline, and only when the
+  controller advertises them. No loop calls them, and nothing retries them.
+- Connect and `initialize` each have a 10-second deadline, and the
+  runtime's other controller calls a 120-second deadline. The runtime keeps
+  at most eight calls in flight per provider, over one connection.
 
 ## Data plane
 
@@ -432,7 +548,7 @@ any side effect.
 | Method | Counts as use | Abortable | Needs | Purpose |
 | --- | --- | --- | --- | --- |
 | `initialize` | No | | | Handshake. |
-| `env/getIdle` | No | | | `idleForMs` since the last use, 0 while any process root or job runs, and diagnostic counts including leftover process groups. |
+| `env/getIdle` | No | | | `idleForMs` since the last use, 0 while any process root or job runs or any leftover process group has live members, and diagnostic counts. |
 | `$/cancelRequest` | No | | | Notification: abort a pending abortable request. |
 | `fs/readFile` | Yes | | `filesystem` | Read at most `maxBytes` of a regular file from `offset`. |
 | `fs/writeFile` | Yes | | `filesystem.write` | Write a file atomically, with `create`, `ifMatch`, and `executable`; answers the new `version`. |
@@ -454,8 +570,11 @@ any side effect.
 | `job/cancel` | Yes | | `job` | Cancel jobs and optionally their dependents. |
 
 Methods that count as use reset the environment's idle clock. Handshakes,
-idle reports, cancellations, and scans do not, so discovery and power
-policy can look at an environment without keeping it awake.
+idle reports, cancellations, and scans do not, so discovery and a
+provider's idle policy can look at an environment without keeping it awake.
+The idle clock also restarts when the last running process, job, or
+leftover process group ends: a service that a command started and left
+running keeps `idleForMs` at zero like running work.
 
 ### Paths and confinement
 
@@ -590,17 +709,22 @@ Rules:
   never to a decode loop.
 - The daemon signs `"lightspeed-envd-registration/v2" ‖ nonce ‖ sha256(origin)`
   with its Ed25519 key, where `origin` is the canonical WebSocket origin of
-  the gateway URL it dialed. The gateway verifies against the canonical
-  origin of its own public base URL, so a gateway cannot relay another
-  gateway's challenge.
+  the gateway URL it dialed. The gateway accepts a signature over any of
+  its configured registration origins: the canonical origin of its public
+  base URL, plus any further registration URLs the operator lists, such as
+  a cluster-internal service address. Every other origin is refused, so a
+  gateway cannot relay another gateway's challenge.
 - The registration key is sent only until the daemon's first admission.
   `displayName` and `metadata` are read only then.
 - Before admission the gateway accepts only `registration/register`. Out of
   bounds build facts, display names, or metadata refuse admission with
   `invalidRequest`; other undecodable params are `invalidParams`.
-- The receipt names `environmentId`, `incarnationId`, `daemonId`,
-  `controlConnectionId`, `identityMode` (`persistent` or `ephemeral`), and
-  `admission` (`created` or `reconnected`).
+- The receipt names `environmentId`, `daemonId`, `controlConnectionId`,
+  `identityMode` (`persistent` or `ephemeral`), and `admission` (`created`
+  or `reconnected`).
+- `registration/goodbye` from a persistent identity marks its environment
+  disconnected; the environment stays open and waits for the daemon to
+  return. From an ephemeral identity, it closes the environment.
 - For each `registration/openStream`, the daemon dials the stream URL derived
   from its configured connect URL, replacing the
   `/environment-gateway/connect` suffix with `/environment-gateway/data`, with
@@ -611,13 +735,20 @@ Rules:
 - The newest connection for a daemon identity wins. The gateway sends
   `registration/closed` with reason `superseded` to the older one before
   closing it.
+- When the environment closes while its daemon is connected, the gateway
+  sends `registration/closed` with reason `environmentClosed`. A closed
+  identity that registers again is refused with `failedPrecondition`
+  (`environmentClosed`). Either way the identity is spent: the daemon exits
+  or parks, as configured, and never reconnects.
 
 The daemon's exit status says why it stopped: 0 after a deliberate shutdown,
 1 for an unexpected failure, 2 for a local configuration or receipt-file
 error, 3 for a terminal
 registration refusal or an unsupported gateway protocol, 4 when its
 environment was closed, and 5 when another process with the same identity
-superseded it. Retryable refusals, disconnects, and heartbeat timeouts never
+superseded it. A daemon configured to park on close instead stops
+registering and listening, waits for `SIGTERM` or `SIGINT`, and then exits
+with 0. Retryable refusals, disconnects, and heartbeat timeouts never
 end the process.
 
 ## Conformance
@@ -628,11 +759,16 @@ provisioning anything else:
 - The controller suite,
   [`environment_client::conformance::controller`](../../../crates/environment-client/src/conformance/controller.rs)
   behind the client crate's `conformance` feature, drives any controller URL
-  with a credential and one template. It checks the handshake rules, the
-  credential refusal, the data-route downgrade rule, per-owner create
-  idempotency, pure `target/get`, owner fencing, close by owner, and
-  `capabilityUnavailable` for features the controller does not advertise.
+  with one template, and with the credential when the provider uses one. It
+  checks the handshake rules, the credential refusal, per-owner create
+  idempotency, pure `target/get`, owner fencing, close by owner and its
+  repetition, strict decoding of every observation, and
+  `capabilityUnavailable` for methods the controller does not advertise.
   It creates and closes one target.
+- The data-route helpers,
+  [`environment_client::conformance::data_route`](../../../crates/environment-client/src/conformance/data_route.rs),
+  check that a refused data route answers a typed body with the status it
+  names, a 503 with `Retry-After`, within the hold bound.
 - The data suite,
   [`tools::environment_protocol::conformance`](../../../crates/tools/src/environment_protocol/conformance.rs),
   drives a data endpoint and checks file writes and reads, confinement,
diff --git a/docs/documentation/reference/environment-variables.md b/docs/documentation/reference/environment-variables.md
index 100e2368f..ae0f1045c 100644
--- a/docs/documentation/reference/environment-variables.md
+++ b/docs/documentation/reference/environment-variables.md
@@ -40,7 +40,7 @@ They do not configure the TypeScript Platform backend.
 | --- | --- | --- |
 | `LIGHTSPEED_POSTGRES_URL` | **Required**; falls back to `LIGHTSPEED_TEST_POSTGRES_URL` | PostgreSQL connection URL used by the runtime, migration commands, and schema diagnostics. Production must use this name. |
 | `LIGHTSPEED_PG_UNIVERSE_ID` | **Required in `single` auth mode** | UUID of the sole universe in a single-tenant deployment. Not used to auto-create universes in multi-tenant modes. |
-| `LIGHTSPEED_ROLES` | `gateway,environment-gateway,sessions,bots,channels` | Roles this process runs, a comma-separated subset of `gateway` (JSON-RPC, OAuth callbacks, webhook hooks), `environment-gateway` (worker environment routes, the public daemon registration routes, the lifecycle reconciler, and the power reaper), `sessions` (session workflows plus the promise-repair reaper, the session-retention reaper, both every five minutes, and the hourly CAS blob sweeper), `bots`, `channels` (also `--roles`). Each worker role polls its own task queue with that subsystem's workflows, activities, and background loops. Run exactly one `environment-gateway` process per deployment. |
+| `LIGHTSPEED_ROLES` | `gateway,environment-gateway,sessions,bots,channels` | Roles this process runs, a comma-separated subset of `gateway` (JSON-RPC, OAuth callbacks, webhook hooks), `environment-gateway` (worker environment routes, the public daemon registration routes, the lifecycle reconciler that creates and closes provisioned environments, and the registered-environment sweep), `sessions` (session workflows plus the promise-repair reaper, the session-retention reaper, both every five minutes, and the hourly CAS blob sweeper), `bots`, `channels` (also `--roles`). Each worker role polls its own task queue with that subsystem's workflows, activities, and background loops. Run exactly one `environment-gateway` process per deployment. |
 | `LIGHTSPEED_TASK_QUEUE` | `lightspeed-sessions` | Sessions task queue shared by the gateway and the `sessions` role. Deployments sharing a Temporal namespace must use distinct queues. |
 | `LIGHTSPEED_TASK_QUEUE_BOTS` | `lightspeed-bots` | Task queue of the `bots` role (bot controllers, trigger fires, bot activities). |
 | `LIGHTSPEED_TASK_QUEUE_CHANNELS` | `lightspeed-channels` | Task queue of the `channels` role (conversation workflows and core channel activities). Connector activities run on the per-account `lightspeed-connector-*` queues served by the connector host. |
@@ -48,8 +48,9 @@ They do not configure the TypeScript Platform backend.
 | `TEMPORAL_NAMESPACE` | `default` | Temporal namespace. Shared with the connector host. |
 | `LIGHTSPEED_GATEWAY_BIND` | `127.0.0.1:18080` | JSON-RPC and environment-gateway listener address. |
 | `LIGHTSPEED_GATEWAY_MAX_REQUEST_BODY_BYTES` | `67108864` | Maximum gateway request body size in bytes. |
-| `LIGHTSPEED_PUBLIC_BASE_URL` | `http://{LIGHTSPEED_GATEWAY_BIND}`; **required** for an `environment-gateway` process on a non-loopback bind | Externally reachable gateway base URL used for OAuth callbacks, bot webhook ingest URLs (`/hooks/bots/…`), and as the environment route base when the process runs the `gateway` role. Its origin is also the one registered daemons must sign: daemons must dial the registration routes on this host, and a daemon that dials another hostname is refused. A process running `environment-gateway` refuses to start without it unless it binds to loopback. Hosted deployments should set it explicitly. |
-| `LIGHTSPEED_MCP_PRIVATE_NETWORKS` | Empty (`localhost,127.0.0.1,::1` in `dev.sh` profiles) | Comma-separated exact hosts and CIDRs that outbound requests may reach on private networks: native MCP discovery and execution (where the MCP server record must also opt in with `allowPrivateNetwork`) and bot URL polls. All other targets retain public-only HTTPS/SSRF policy. |
+| `LIGHTSPEED_PUBLIC_BASE_URL` | `http://{LIGHTSPEED_GATEWAY_BIND}`; an `environment-gateway` process on a non-loopback bind needs it or `LIGHTSPEED_ENVIRONMENT_REGISTRATION_URLS` | Externally reachable gateway base URL used for OAuth callbacks, bot webhook ingest URLs (`/hooks/bots/…`), and as the environment route base when the process runs the `gateway` role. Its origin is also one registered daemons may sign: daemons dial the registration routes on this host or on a host named in `LIGHTSPEED_ENVIRONMENT_REGISTRATION_URLS`, and a daemon that dials another hostname is refused. A process running `environment-gateway` on a non-loopback bind refuses to start with neither. Hosted deployments should set it explicitly. |
+| `LIGHTSPEED_ENVIRONMENT_REGISTRATION_URLS` | Unset | Comma-separated further gateway URLs registered daemons may dial and sign (also `--environment-registration-urls`), for example a cluster-internal Service address such as `ws://lightspeed-environment-gateway.lightspeed.svc:18080/environment-gateway/connect`. Only each URL's origin counts; an entry without a WebSocket origin is a startup error. Read only by a process running `environment-gateway`. |
+| `LIGHTSPEED_MCP_PRIVATE_NETWORKS` | Empty (`localhost,127.0.0.1,::1` in `dev.sh` profiles and `scripts/dev/env.sh`) | Comma-separated exact hosts and CIDRs that outbound requests may reach on private networks: native MCP discovery and execution (where the MCP server record must also opt in with `allowPrivateNetwork`) and bot URL polls. All other targets retain public-only HTTPS/SSRF policy. |
 | `LIGHTSPEED_CONFIGURATOR_MCP_INTERNAL_TRUSTED_HEADER_URL` | Unset | Retired; a nonempty value fails startup. Use a scoped API key. |
 | `LIGHTSPEED_MCP_OAUTH_ALLOW_PRIVATE_NETWORKS` | `false` (`true` in `dev.sh` profiles) | Allows MCP OAuth metadata, registration, exchange, and refresh to use HTTP or private endpoints. This does not authorize discovery or tool execution; those use `LIGHTSPEED_MCP_PRIVATE_NETWORKS` plus the record opt-in. |
 | `LIGHTSPEED_AUTH_MODE` | **Required** | `single` (no credential check, ordinary methods use one configured universe; local development only) or `authenticated` (bearer keys with a scope and allowed method groups). There is no default: the process refuses to start without it. Configurator uses the same mode. |
@@ -154,21 +155,29 @@ route automatically. Every other process, including one that runs only the
 
 The `environment-gateway` role serves the worker route above plus the public
 registration routes `/environment-gateway/connect` and
-`/environment-gateway/data` that outbound `lightspeed-envd` daemons dial, and
-it runs the lifecycle reconciler and power reaper. A registered daemon's
-control connection lives in the process that accepted it, and the worker
-route for that environment must reach the same process: **run exactly one
+`/environment-gateway/data` that outbound `lightspeed-envd` daemons dial. It
+also runs the lifecycle reconciler, which creates and closes provisioned
+environments, and every 30 seconds a sweep that marks registered daemons
+disconnected when their connection lapsed and closes registered environments
+under their key's disconnect policy. A registered daemon's control
+connection lives in the process that accepted it, and the worker route for
+that environment must reach the same process: **run exactly one
 `environment-gateway` process per deployment** until multi-replica owner
-routing is implemented. `gateway`-only processes and workers may scale
-freely; they hold no daemon connections and do not answer the registration
-routes at all. Expose the two public routes through TLS on the host named by
-`LIGHTSPEED_PUBLIC_BASE_URL`; the daemon refuses plain `ws://` toward
-anything but loopback and derives the data route from its connect URL.
+routing is implemented. At startup the process marks every registered
+environment disconnected until its daemon reconnects. `gateway`-only
+processes and workers may scale freely; they hold no daemon connections and
+do not answer the registration routes at all. Expose the two public routes
+through TLS on the host named by `LIGHTSPEED_PUBLIC_BASE_URL`; the daemon
+refuses plain `ws://` toward anything but loopback unless
+`LIGHTSPEED_ENVD_ALLOW_INSECURE_GATEWAY` is set, and derives the data route
+from its connect URL.
 
 Provider controllers are not configured through environment variables. Each
-provider's controller endpoint and bearer credential are registered through
-`deployment/environment-providers/put`; the credential is stored sealed with
-`LIGHTSPEED_SECRETS_MASTER_KEY` and never returned.
+provider's controller endpoint, optional data route base, and optional
+bearer credential are registered through
+`deployment/environment-providers/put`; a credential is stored sealed with
+`LIGHTSPEED_SECRETS_MASTER_KEY` and never returned. Without one, Lightspeed
+sends no `Authorization` header to the provider.
 
 ## Rust CLI
 
@@ -208,14 +217,16 @@ from the environment of each process and job the daemon starts.
 | Variable | Requirement/default | Purpose |
 | --- | --- | --- |
 | `LIGHTSPEED_ENVD_LISTEN` | `127.0.0.1:19091` unless a gateway URL is set | WebSocket listener for the passive transport: `host:port` (or `tcp://host:port`) for TCP, or `unix:///absolute/path` for a Unix socket only the daemon's user can connect to. Set it explicitly to listen while also registering outbound. |
-| `LIGHTSPEED_ENVD_GATEWAY_URL` | Unset | Public connect route to dial, `wss://<host>/environment-gateway/connect`. Plain `ws://` is accepted only toward loopback. |
+| `LIGHTSPEED_ENVD_GATEWAY_URL` | Unset | Public connect route to dial, `wss://<host>/environment-gateway/connect`, or another URL in the gateway's `LIGHTSPEED_ENVIRONMENT_REGISTRATION_URLS`. Plain `ws://` is accepted only toward loopback unless `LIGHTSPEED_ENVD_ALLOW_INSECURE_GATEWAY` is set. |
+| `LIGHTSPEED_ENVD_ALLOW_INSECURE_GATEWAY` | `false` | Accept a plain `ws://` gateway URL toward a non-loopback host, such as a cluster-internal service inside one trusted network (also `--allow-insecure-gateway`). The registration key and every data stream then cross that network in the clear. Refused without a gateway URL. The discovery URL derived from such a gateway is plain `http://` and only named in mismatch reports, so `LIGHTSPEED_ENVD_AUTO_UPGRADE` with an insecure gateway needs an explicit HTTPS `LIGHTSPEED_ENVD_DISCOVERY_URL`. |
+| `LIGHTSPEED_ENVD_ON_CLOSED` | `exit` | What a registered daemon does once its environment is closed (also `--on-closed`): `exit` ends the process with status 4; `park` stops registering and listening, logs once, keeps open data connections until it is stopped, and exits with status 0 on `SIGTERM` or `SIGINT`. Use `park` under a supervisor that restarts on every exit, such as a Kubernetes pod, so a spent identity is not restarted forever. Applies both to a close while connected and to a closed identity's refused registration; a superseded daemon always exits with status 5. Refused without a gateway URL. |
 | `LIGHTSPEED_ENVD_DISCOVERY_URL` | `https://<gateway-host>/.well-known/lightspeed-envd` | Override the deployment discovery document used by `lightspeed-envd upgrade` and automatic protocol-mismatch upgrades. Must use HTTPS, except that HTTP is accepted toward loopback for development. |
-| `LIGHTSPEED_ENVD_AUTO_UPGRADE` | `false` | Opt a registered outbound daemon into installing and re-executing the build in the deployment discovery document when the gateway challenges it with a different protocol number. Accepts boolean values including `1`/`0`; automatic upgrade is attempted once for each protocol version the gateway names. |
+| `LIGHTSPEED_ENVD_AUTO_UPGRADE` | `false` | Opt a registered outbound daemon into installing and re-executing the build in the deployment discovery document when the gateway challenges it with a different protocol number. Accepts boolean values including `1`/`0`; automatic upgrade is attempted once for each protocol version the gateway names. It replaces the executable in place, so leave it off on a read-only root filesystem and in containers, and roll out a new image instead. |
 | `LIGHTSPEED_ENVD_REGISTRATION_KEY` | Unset | Registration key admitting a first-seen daemon identity. Read once and dropped from the process environment, and sent to the gateway only until the first admission; on Linux the initial environment stays readable through `/proc`, so use the file form for untrusted workloads. |
-| `LIGHTSPEED_ENVD_REGISTRATION_KEY_FILE` | Unset | File holding the registration key; mutually exclusive with the direct form. Delete the file once the receipt appears. |
-| `LIGHTSPEED_ENVD_REGISTRATION_NAME` | Unset | Display-name hint recorded on the environment at first registration; ignored on later connections. An out-of-bounds value refuses admission. |
+| `LIGHTSPEED_ENVD_REGISTRATION_KEY_FILE` | Unset | File holding the registration key; mutually exclusive with the direct form. The daemon sends it only until its first admission, so the file can be deleted once the receipt appears, or stay mounted as a Kubernetes Secret. |
+| `LIGHTSPEED_ENVD_REGISTRATION_NAME` | Unset | Display-name hint recorded on the environment at first registration; ignored on later connections, so rename the environment in Lightspeed instead. An out-of-bounds value refuses admission. |
 | `LIGHTSPEED_ENVD_REGISTRATION_METADATA` | Unset | JSON object of string correlation metadata (at most 32 entries; keys up to 64 bytes, values up to 256; the `lightspeed.` prefix is reserved), recorded at first registration only. Descriptive only. |
-| `LIGHTSPEED_ENVD_REGISTRATION_RECEIPT` | Unset | Path the daemon writes `{environmentId, incarnationId, daemonId, controlConnectionId, identityMode, admission}` to once admitted; `identityMode` is `persistent` or `ephemeral`, and `admission` is `created` or `reconnected`. The daemon refuses to start when the path is not writable and exits when writing it fails. |
+| `LIGHTSPEED_ENVD_REGISTRATION_RECEIPT` | Unset | Path the daemon writes `{environmentId, daemonId, controlConnectionId, identityMode, admission}` to once admitted; `identityMode` is `persistent` or `ephemeral`, and `admission` is `created` or `reconnected`. The daemon refuses to start when the path is not writable and exits when writing it fails. |
 | `LIGHTSPEED_ENVD_CA_FILE` | Unset | PEM bundle of additional TLS trust anchors for a gateway behind a private CA. |
 | `LIGHTSPEED_ENVD_CWD` | Current directory | Default working directory of commands, jobs, and relative tool paths. |
 | `LIGHTSPEED_ENVD_FS_ROOT` | Native filesystem root containing the working directory | Filesystem boundary of file, search, scan, and transfer operations and of every command's working directory. Paths stay absolute in the machine's own namespace; the root is not a chroot, and it does not confine what commands can access. |
@@ -233,7 +244,7 @@ generates a new identity on its own, and its exit status says why it stopped:
 | `1` | An unexpected failure. |
 | `2` | Local configuration, state directory, or receipt-file error. |
 | `3` | The gateway refused registration for good, or speaks another protocol version and no automatic upgrade succeeded. |
-| `4` | The environment was closed; the identity is spent. |
+| `4` | The environment was closed; the identity is spent. With `LIGHTSPEED_ENVD_ON_CLOSED=park`, the daemon parks instead and exits with `0` once stopped. |
 | `5` | Another process with the same daemon identity connected and won; the log names the identity. Run one daemon per state directory. |
 
 Disconnects, missed heartbeats, and retryable refusals never end the process:
@@ -435,7 +446,10 @@ independent migration systems contain overlapping table names. The script also
 supplies a fixed local `LIGHTSPEED_SECRETS_MASTER_KEY`; that key is public
 development material and is unsafe for any shared or production deployment.
 The key encodes `lightspeed-local-dev-master-key!`; changing it requires
-resetting local encrypted state.
+resetting local encrypted state. It also exports
+`LIGHTSPEED_MCP_PRIVATE_NETWORKS=localhost,127.0.0.1,::1` unless the variable is
+already set, matching the `dev.sh` profiles, so live tests that call loopback MCP
+servers work from a sourced shell.
 
 ## Tests and evaluations
 
diff --git a/docs/documentation/using-lightspeed/bots-and-triggers.md b/docs/documentation/using-lightspeed/bots-and-triggers.md
index 6cdf37e0d..a42e8741f 100644
--- a/docs/documentation/using-lightspeed/bots-and-triggers.md
+++ b/docs/documentation/using-lightspeed/bots-and-triggers.md
@@ -242,8 +242,9 @@ its ID available again. Closed conversation history remains retained and follows
 the separate [session deletion lifecycle](sessions-and-runs.md#close-and-retain-a-session).
 
 Profiles and environments remain independent resources. Closing or deleting a
-bot or any of its sessions leaves its environments intact. Manage machine
-cleanup through environment operations and idle policies.
+bot or any of its sessions leaves the environments its profile attaches
+intact; manage their cleanup through environment operations and their
+templates' idle policies.
 
 ## If an event does not produce the expected work
 
diff --git a/docs/documentation/using-lightspeed/cli.md b/docs/documentation/using-lightspeed/cli.md
index bc4cae2ea..645d51604 100644
--- a/docs/documentation/using-lightspeed/cli.md
+++ b/docs/documentation/using-lightspeed/cli.md
@@ -417,28 +417,40 @@ full context window rather than a specific rejected entry, use the
 ## Provision environments from the CLI
 
 A deployment administrator registers a provider controller and binds it to a
-universe. `environment provider put --file provider.json` takes a
-`DeploymentEnvironmentProviderPutParams` document; `environment binding put
---file binding.json` takes `DeploymentProviderBindingPutParams`, including its
-explicit `universeId`. The public API reference documents their fields. These
-operations require a deployment key; provider list/read/delete do as well.
-Binding deletion acts on the selected universe. Normal environment and template
-operations operate within the selected universe.
+universe. `environment provider put` takes the provider ID, its
+`--controller-endpoint`, and optionally `--display-name`, `--data-route-base`
+(required for a `unix://` controller), and `--credential-file`; omitting the
+credential keeps the stored one, and `--clear-credential` removes it.
+`environment binding put PROVIDER_ID --enabled` (or `--disabled`) binds the
+selected universe. These operations require a deployment key; provider
+list/read/delete and binding delete do as well. Normal environment and
+template operations operate within the selected universe.
 
 ```bash
-lightspeed environment provider list
-lightspeed environment binding list
-lightspeed environment template list --binding local
-lightspeed environment create --binding local --template linux-v1 --request-id provision-my-machine
+lightspeed environment provider put incus-local --controller-endpoint ws://127.0.0.1:19090/control --credential-file ./provider-credential
+lightspeed environment binding put incus-local --enabled
+lightspeed environment template list --provider incus-local
+lightspeed environment create --provider incus-local --template linux-v1 --request-id provision-my-machine
 lightspeed environment register wss://machine.example/envd --request-id register-my-machine
+lightspeed environment list --include-closed --limit 50
 lightspeed environment read ENVIRONMENT_ID
+lightspeed environment update ENVIRONMENT_ID --name "Build machine" --metadata team=release
 lightspeed environment power ENVIRONMENT_ID paused
 lightspeed environment ingress ENVIRONMENT_ID --enable
 ```
 
 Reuse the same request ID when retrying an uncertain provisioning or external
-registration request. Creation and closure can be asynchronous: inspect the
-returned lifecycle state with `environment read`. Outbound daemons continue to
-use `environment registration-key create|list|read|revoke`. Credentials bound
-with `environment credential bind` supply the environment's configured secret
-references; attachment access controls the agent's permitted use of the machine.
+registration request. Creation and closure of a provisioned environment are
+asynchronous: inspect the returned state with `environment read`. `power` and
+`ingress` wait for the provider's answer and print what it reported; the
+provider keeps owning power afterwards. `environment list` omits closed
+environments unless `--include-closed` is given, and returns one page at a
+time; when more remain, it prints the `--after` value for the next page. `environment update`
+replaces the display name and metadata, so omitted flags clear them.
+
+Outbound daemons use `environment registration-key create|list|read|update|rotate|revoke`.
+`update` replaces a key's group name and policy, including
+`--offline-close-after-min` for a persistent key; `rotate` prints a new secret
+once and retires the old one. Credentials bound with `environment credential
+bind` supply the environment's configured secret references; attachment
+access controls the agent's permitted use of the machine.
diff --git a/docs/roadmap/p193-environment-model-simplification.md b/docs/roadmap/p193-environment-model-simplification.md
new file mode 100644
index 000000000..d64801d0d
--- /dev/null
+++ b/docs/roadmap/p193-environment-model-simplification.md
@@ -0,0 +1,107 @@
+# P193 — Environment model simplification
+
+**Status:** Implemented in the working tree on `env-protocol`, 2026-10-27,
+not committed. Workspace `cargo check` and CI Clippy pass; unit, integration
+and live suites have not been run yet. Greenfield: one protocol bump (envd
+and controller protocol version 4), the store baseline rewritten in place
+(schema revision 11), contracts and TypeScript consumers regenerated. Every
+existing database needs `./dev.sh reset` and a fresh Temporal volume.
+
+Lightspeed becomes the inventory and router for environments, and whoever
+runs a machine owns what happens while it runs. Lightspeed keeps durable
+retries only for the two things it alone decides: **create until accepted**
+(and opened by one data-plane handshake) and **close until gone**. Power,
+idle, wake, ingress, placement, pools and snapshots belong to the provider
+for provisioned environments and to the operator's own infrastructure for
+registered and external ones.
+
+This reverses the power and idle policy of
+[P126](archive/p126-environment-power-and-idle-policy.md) and the
+provider-is-policy-free rule of
+[P117](archive/p117-environment-compute-plan.md).
+
+## Decisions
+
+1. **Providers own power policy.** The power intent, the power reaper,
+   wake-on-use writes and power and ingress convergence are deleted.
+   `environments/power/put` and `environments/ingress/put` are synchronous
+   pass-throughs that store only the returned observation; a change made
+   outside Lightspeed is never reverted.
+2. **Idle is a template default plus a create-time override.** The optional
+   `idle` on `target/create` is passed through to the provider; there is no
+   per-environment idle edit after create and no `target/configure`.
+3. **Sandbox per session: dropped for now.** A `provision {providerId,
+   templateId, idle?}` session attachment, resolved at session start or
+   profile apply into an environment that closes with its session, was
+   implemented and then removed before commit at the owner's request. The
+   attachment grammar stays `environmentId | inherit`
+   ([P173](p173-session-config-attachments.md)); there is no
+   `closes_with_session_id` column, session-close hook, backstop sweep,
+   `sessionClosed` close reason, reserved `prov:` request-id prefix, or purge
+   of closed provisioned rows. A caller that wants a machine per session
+   creates one with `environments/create`, attaches it, and closes it itself.
+4. **Leftover process groups pin idle.** envd's `env/getIdle` holds
+   `idleForMs` at zero while a leftover process group runs, as it does for
+   running processes and jobs.
+5. **The external kind stays.**
+6. **A bounded wait for a disconnected registered environment:** two minutes
+   for persistent keys, none for ephemeral keys.
+7. **Enrollment is deferred** (provisioned machines that register back to
+   the gateway; see [P119](archive/p119-environment-daemon-gateway-enrollment.md)).
+8. **Selector attachments are deferred.** Fleets use explicit ids plus
+   `environments/update` labels.
+9. **Key rotation through a child secrets table**, so the group, the
+   `registrationKeys` allowlists and the identity mode survive a rotation.
+10. **Closed registered rows are retained**: a closed identity stays spent.
+    Per-event work goes to the provisioned kind.
+
+Also decided:
+
+- The provider credential is optional on every endpoint scheme. Without one,
+  no `Authorization` header is sent on control or data dials, and the Incus
+  `credentialFile` is optional.
+- The data dial is the wake signal. A provider holds a dial to a
+  powered-down target while it wakes it, then upgrades or answers a typed
+  refusal (`503 {waking|booting}` with `Retry-After`, `410 {gone}`,
+  `409 {failed}`), which the gateway forwards. `target/setPower` is an
+  optional synchronous pass-through for manual buttons. Environment source
+  discovery dials with a no-wake marker, which the gateway honours by asking
+  the provider for the target's current power before it dials.
+
+## Model
+
+- One `environments` row with three kinds (provisioned, external,
+  registered) and a five-value lifecycle: `provisioning`, `open`, `closing`,
+  `closed`, `failed`, with `state_message` and `close_reason`. Provider
+  observations are display facts; the display status is derived.
+- One use gate (Use, Wait or Gone) used by selection, the resolver, job
+  activities, discovery and the worker route. Nothing that only reads a row
+  writes to it.
+- Incarnations, binding ids and revisions, adopt, cached controller
+  features and the provider-facts refresh loop are deleted. Bindings are
+  `(universe_id, provider_id, enabled)`; the data route base is optional
+  operator configuration, derived from the controller endpoint by default.
+- Registered liveness is written on transitions and as a coarse stamp at
+  most every five minutes. The gateway marks every registered row
+  disconnected at startup (one environment-gateway replica), runs a 30 s
+  registered sweep, and notifies control connections of a close in process.
+- New API methods: `environments/update`,
+  `environments/registration-keys/update` and `.../rotate`. Removed:
+  `environments/idle-policy/put` and `deployment/environments/adopt`.
+
+## Open
+
+- Run the unit, integration and live suites, including the rewritten
+  provider, registration, profile and sub-agent live suites.
+- Universe deletion with registered environments or environment credentials
+  may be refused by `ON DELETE RESTRICT` foreign keys, depending on cascade
+  order (predates this work).
+- The gateway and the environment client each carry the status fallback for
+  a refused upgrade whose body was not read; one shared decoder in the
+  protocol crate would keep them from drifting.
+- A third-party provider must adopt the slimmed `TargetOwner`, the typed
+  data-route refusals and the idle obligations in lockstep with protocol
+  version 4.
+- Deferred: enrollment, selector attachments, `target/configure`, a
+  multi-replica environment gateway, per-session provisioned environments
+  (decision 3).
diff --git a/docs/site/astro.config.mjs b/docs/site/astro.config.mjs
index f740fbc78..cc513375a 100644
--- a/docs/site/astro.config.mjs
+++ b/docs/site/astro.config.mjs
@@ -60,6 +60,7 @@ export default defineConfig({
         { label: 'Environments', collapsed: true, items: [
           { slug: 'environments/overview' },
           { slug: 'environments/bring-your-own-compute' },
+          { slug: 'environments/registered-daemons' },
           { slug: 'environments/incus-vms' },
           { slug: 'environments/using-environments' },
           { slug: 'environments/processes-and-jobs' },
diff --git a/platform/backend/src/routes/environment-deployment.ts b/platform/backend/src/routes/environment-deployment.ts
index ac0778293..4b808ae27 100644
--- a/platform/backend/src/routes/environment-deployment.ts
+++ b/platform/backend/src/routes/environment-deployment.ts
@@ -10,26 +10,32 @@ import { isPlatformAdmin } from "../context.js";
 import { parseBody } from "../http.js";
 import { deploymentClientFor, withGateway } from "./gateway.js";
 
-const metadataSchema = z.record(z.string(), z.string()).optional();
 const providerPutSchema = z.object({
   displayName: z.string().trim().min(1).max(200).optional(),
-  metadata: metadataSchema,
   controllerEndpoint: z
     .string()
     .trim()
     .max(2048)
     .regex(/^(wss?:\/\/|unix:\/\/\/)[^\s]+$/, "controller endpoint must be a ws://, wss:// or unix:// URL"),
-  // Write-only: required for a new provider, omitted to keep the stored one.
+  // Absent derives the data route base from a ws:// or wss:// controller.
+  dataRouteBase: z
+    .string()
+    .trim()
+    .max(2048)
+    .regex(/^wss?:\/\/[^\s]+$/, "data route base must be a ws:// or wss:// URL")
+    .optional(),
+  // Write-only and optional: omitted keeps the stored credential.
   credential: z.string().min(1).max(4096).optional(),
-});
+  clearCredential: z.boolean().optional(),
+}).refine(
+  (value) => !(value.credential && value.clearCredential),
+  "credential and clearCredential are mutually exclusive",
+);
 const bindingPutSchema = z.object({
-  providerId: z.string().trim().min(1).max(200),
-  status: z.enum(["enabled", "disabled"]),
-  expectedRevision: z.number().int().min(1).optional(),
-  metadata: metadataSchema,
+  enabled: z.boolean(),
 });
 
-/// Deployment/deployment environment administration. Universe owners consume
+/// Deployment environment administration. Universe owners consume
 /// enabled bindings elsewhere; only platform admins may mutate physical
 /// provider registrations or universe admission bindings here.
 export function environmentDeploymentRoutes(ctx: AppContext) {
@@ -84,12 +90,13 @@ export function environmentDeploymentRoutes(ctx: AppContext) {
     const body = await parseBody(c, providerPutSchema);
     if (!body.ok) return body.response;
     return withGateway(c, async () => {
+      const params: DeploymentEnvironmentProviderPutParams = {
+        providerId: c.req.param("providerId"),
+        ...body.data,
+      };
       const response = await deploymentClientFor(ctx).call(
         "deployment/environment-providers/put",
-        {
-          providerId: c.req.param("providerId"),
-          ...body.data,
-        } as DeploymentEnvironmentProviderPutParams,
+        params,
       );
       return c.json(response.result.provider);
     });
@@ -103,29 +110,30 @@ export function environmentDeploymentRoutes(ctx: AppContext) {
     return c.json(response.result.provider);
   }));
 
-  app.put("/universes/:universeId/environment-provider-bindings/:bindingId", async (c) => {
+  app.put("/universes/:universeId/environment-provider-bindings/:providerId", async (c) => {
     const body = await parseBody(c, bindingPutSchema);
     if (!body.ok) return body.response;
     return withGateway(c, async () => {
+      const params: DeploymentProviderBindingPutParams = {
+        universeId: c.req.param("universeId"),
+        providerId: c.req.param("providerId"),
+        enabled: body.data.enabled,
+      };
       const response = await deploymentClientFor(ctx).call(
         "deployment/environment-providers/bindings/put",
-        {
-          universeId: c.req.param("universeId"),
-          bindingId: c.req.param("bindingId"),
-          ...body.data,
-        } as DeploymentProviderBindingPutParams,
+        params,
       );
       return c.json(response.result.binding);
     });
   });
 
-  app.delete("/universes/:universeId/environment-provider-bindings/:bindingId", (c) =>
+  app.delete("/universes/:universeId/environment-provider-bindings/:providerId", (c) =>
     withGateway(c, async () => {
       const response = await deploymentClientFor(ctx).call(
         "deployment/environment-providers/bindings/delete",
         {
           universeId: c.req.param("universeId"),
-          bindingId: c.req.param("bindingId"),
+          providerId: c.req.param("providerId"),
         },
       );
       return c.json(response.result.binding);
diff --git a/platform/backend/src/routes/environments.test.ts b/platform/backend/src/routes/environments.test.ts
new file mode 100644
index 000000000..52e7928c3
--- /dev/null
+++ b/platform/backend/src/routes/environments.test.ts
@@ -0,0 +1,234 @@
+import { Hono } from "hono";
+import { afterEach, beforeEach, expect, it, vi } from "vitest";
+import type { ApiVariables, AppContext } from "../context.js";
+import { environmentDeploymentRoutes } from "./environment-deployment.js";
+import { gatewayRoutes } from "./gateway.js";
+
+vi.mock("./universes.js", () => ({
+  universeForSession: vi.fn(async () => ({
+    universe: { lightspeedUniverseId: "universe", gatewayUrl: "https://engine.example/rpc" },
+    role: "operator",
+    member: { userId: "user", role: "operator" },
+  })),
+}));
+
+type Call = { method: string; params: Record<string, unknown> };
+let calls: Call[];
+/// Providers whose `environments/templates/list` call the engine refuses.
+let failingProviders: Set<string>;
+
+function template(providerId: string) {
+  return { providerId, templateId: `${providerId}-small`, displayName: `${providerId} small` };
+}
+
+function engineResult(method: string, params: Record<string, unknown>): unknown {
+  switch (method) {
+    case "environments/provider-bindings/list":
+      return {
+        bindings: [
+          { providerId: "alpha", enabled: true, createdAtMs: 1, updatedAtMs: 1 },
+          { providerId: "beta", enabled: true, createdAtMs: 1, updatedAtMs: 1 },
+          { providerId: "gamma", enabled: false, createdAtMs: 1, updatedAtMs: 1 },
+        ],
+      };
+    case "environments/templates/list":
+      return { templates: [template(String(params.providerId))] };
+    case "environments/list":
+      return { environments: [{ environmentId: "env_1" }], nextAfter: "env_1" };
+    case "environments/update":
+      return { environment: { environmentId: params.environmentId } };
+    case "environments/registration-keys/update":
+      return { registrationKey: { registrationKeyId: params.registrationKeyId } };
+    case "environments/registration-keys/rotate":
+      return { registrationKey: { registrationKeyId: params.registrationKeyId }, secret: "lsr_secret" };
+    case "deployment/environment-providers/put":
+      return { provider: { providerId: params.providerId } };
+    case "deployment/environment-providers/bindings/put":
+    case "deployment/environment-providers/bindings/delete":
+      return { binding: { providerId: params.providerId, enabled: params.enabled ?? false } };
+    default:
+      throw new Error(`unexpected engine call ${method}`);
+  }
+}
+
+beforeEach(() => {
+  calls = [];
+  failingProviders = new Set();
+  vi.stubGlobal("fetch", vi.fn(async (_url: unknown, init: RequestInit) => {
+    const rpc = JSON.parse(String(init.body));
+    const params = (rpc.params ?? {}) as Record<string, unknown>;
+    calls.push({ method: rpc.method, params });
+    if (rpc.method === "environments/templates/list" && failingProviders.has(String(params.providerId))) {
+      return Response.json({
+        id: rpc.id,
+        error: { code: -32603, message: "provider unreachable", data: { kind: "internal" } },
+      });
+    }
+    return Response.json({ id: rpc.id, result: { result: engineResult(rpc.method, params), notifications: [] } });
+  }));
+});
+afterEach(() => vi.unstubAllGlobals());
+
+const ctx = {
+  env: { lightspeedApiUrl: "https://engine.example/rpc", lightspeedApiKey: "lsk_fixture" },
+} as unknown as AppContext;
+
+function app(platformRole?: string) {
+  const app = new Hono<{ Variables: ApiVariables }>();
+  app.use("*", async (c, next) => {
+    c.set("session", { user: { id: "user", role: platformRole } } as ApiVariables["session"]);
+    await next();
+  });
+  app.route("/universes", gatewayRoutes(ctx));
+  app.route("/admin", environmentDeploymentRoutes(ctx));
+  return app;
+}
+
+function request(method: string, path: string, body?: unknown, platformRole?: string) {
+  return app(platformRole).request(path, {
+    method,
+    headers: { "content-type": "application/json" },
+    ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+  });
+}
+
+const callsOf = (method: string) => calls.filter((call) => call.method === method);
+
+it("lists templates per enabled provider and drops a provider that fails", async () => {
+  failingProviders.add("beta");
+  const response = await request("GET", "/universes/u/environment-templates");
+  expect(response.status).toBe(200);
+  expect(await response.json()).toEqual([template("alpha")]);
+  expect(callsOf("environments/templates/list").map((call) => call.params)).toEqual([
+    { providerId: "alpha" },
+    { providerId: "beta" },
+  ]);
+});
+
+it("lists one provider's templates directly when asked", async () => {
+  const response = await request("GET", "/universes/u/environment-templates?providerId=gamma");
+  expect(await response.json()).toEqual([template("gamma")]);
+  expect(callsOf("environments/provider-bindings/list")).toEqual([]);
+});
+
+it("maps the environment list query onto one environments/list page", async () => {
+  const response = await request(
+    "GET",
+    "/universes/u/environments?includeClosed=true&limit=50&after=env_0&state=open&providerId=alpha",
+  );
+  expect(response.status).toBe(200);
+  expect(await response.json()).toEqual({ environments: [{ environmentId: "env_1" }], nextAfter: "env_1" });
+  expect(callsOf("environments/list")).toEqual([{
+    method: "environments/list",
+    params: { includeClosed: true, limit: 50, after: "env_0", state: "open", providerId: "alpha" },
+  }]);
+});
+
+it("leaves includeClosed unset unless it is true", async () => {
+  await request("GET", "/universes/u/environments?includeClosed=false");
+  expect(callsOf("environments/list")[0]?.params).toEqual({});
+});
+
+it.each([
+  ["limit=0"],
+  ["limit=501"],
+  ["limit=two"],
+  ["state=asleep"],
+  ["includeClosed=yes"],
+])("rejects the list query %s before calling the engine", async (query) => {
+  const response = await request("GET", `/universes/u/environments?${query}`);
+  expect(response.status).toBe(400);
+  expect(callsOf("environments/list")).toEqual([]);
+});
+
+it("clears an environment's display name when the update sends null", async () => {
+  const response = await request("PATCH", "/universes/u/environments/env_1", { displayName: null });
+  expect(response.status).toBe(200);
+  expect(callsOf("environments/update")).toEqual([{
+    method: "environments/update",
+    params: { environmentId: "env_1", metadata: {} },
+  }]);
+});
+
+it("replaces an environment's display name and metadata", async () => {
+  await request("PATCH", "/universes/u/environments/env_1", { displayName: "build box", metadata: { team: "ci" } });
+  expect(callsOf("environments/update")[0]?.params).toEqual({
+    environmentId: "env_1",
+    displayName: "build box",
+    metadata: { team: "ci" },
+  });
+});
+
+it("passes a registration key update through as the complete policy", async () => {
+  const response = await request("PUT", "/universes/u/environment-registration-keys/rk_1", {
+    displayName: "CI runners",
+    maxActiveEnvironments: 4,
+    offlineCloseAfterMs: 600_000,
+  });
+  expect(response.status).toBe(200);
+  expect(await response.json()).toEqual({ registrationKeyId: "rk_1" });
+  expect(callsOf("environments/registration-keys/update")[0]?.params).toEqual({
+    registrationKeyId: "rk_1",
+    displayName: "CI runners",
+    maxActiveEnvironments: 4,
+    offlineCloseAfterMs: 600_000,
+  });
+});
+
+it("rejects a registration key update without a name", async () => {
+  const response = await request("PUT", "/universes/u/environment-registration-keys/rk_1", {});
+  expect(response.status).toBe(400);
+  expect(callsOf("environments/registration-keys/update")).toEqual([]);
+});
+
+it("returns a rotated registration key's secret", async () => {
+  const response = await request("POST", "/universes/u/environment-registration-keys/rk_1/rotate");
+  expect(response.status).toBe(200);
+  expect(await response.json()).toMatchObject({ secret: "lsr_secret" });
+  expect(callsOf("environments/registration-keys/rotate")[0]?.params).toEqual({ registrationKeyId: "rk_1" });
+});
+
+it("puts and deletes a universe binding by provider id", async () => {
+  const put = await request("PUT", "/admin/universes/u1/environment-provider-bindings/alpha", { enabled: false }, "admin");
+  expect(put.status).toBe(200);
+  const deleted = await request("DELETE", "/admin/universes/u1/environment-provider-bindings/alpha", undefined, "admin");
+  expect(deleted.status).toBe(200);
+  expect(callsOf("deployment/environment-providers/bindings/put")[0]?.params).toEqual({
+    universeId: "u1",
+    providerId: "alpha",
+    enabled: false,
+  });
+  expect(callsOf("deployment/environment-providers/bindings/delete")[0]?.params).toEqual({
+    universeId: "u1",
+    providerId: "alpha",
+  });
+});
+
+it("puts a provider without a credential", async () => {
+  const response = await request("PUT", "/admin/environment-providers/alpha", {
+    controllerEndpoint: "unix:///run/incus-controller.sock",
+    dataRouteBase: "wss://incus.example/routes",
+  }, "admin");
+  expect(response.status).toBe(200);
+  expect(callsOf("deployment/environment-providers/put")[0]?.params).toEqual({
+    providerId: "alpha",
+    controllerEndpoint: "unix:///run/incus-controller.sock",
+    dataRouteBase: "wss://incus.example/routes",
+  });
+});
+
+it("rejects a provider put with both a credential and clearCredential", async () => {
+  const response = await request("PUT", "/admin/environment-providers/alpha", {
+    controllerEndpoint: "wss://incus.example/controller",
+    credential: "secret",
+    clearCredential: true,
+  }, "admin");
+  expect(response.status).toBe(400);
+  expect(callsOf("deployment/environment-providers/put")).toEqual([]);
+});
+
+it("keeps the deployment routes for platform admins", async () => {
+  const response = await request("PUT", "/admin/universes/u1/environment-provider-bindings/alpha", { enabled: true });
+  expect(response.status).toBe(403);
+  expect(calls).toEqual([]);
+});
diff --git a/platform/backend/src/routes/gateway.ts b/platform/backend/src/routes/gateway.ts
index 1933f852f..892c7b81e 100644
--- a/platform/backend/src/routes/gateway.ts
+++ b/platform/backend/src/routes/gateway.ts
@@ -17,6 +17,7 @@ import {
   type EnvironmentExternalCreateParams,
   type EnvironmentListParams,
   type EnvironmentRegistrationKeyCreateParams,
+  type EnvironmentRegistrationKeyUpdateParams,
   type McpServerInput,
   type McpServerAuthDiscoverParams,
   type McpServerToolsDiscoverParams,
@@ -166,11 +167,26 @@ const environmentIdlePolicySchema = z.object({
 
 const environmentCreateSchema = z.object({
   requestId: z.string().trim().min(1).max(200),
-  bindingId: z.string().trim().min(1).max(200),
+  providerId: z.string().trim().min(1).max(200),
   templateId: z.string().trim().min(1).max(200),
   displayName: z.string().trim().min(1).max(200).optional(),
   metadata: z.record(z.string(), z.string()).optional(),
-  idlePolicy: environmentIdlePolicySchema.optional(),
+  idle: environmentIdlePolicySchema.optional(),
+});
+
+const environmentUpdateSchema = z.object({
+  displayName: z.string().trim().min(1).max(200).nullable().optional(),
+  metadata: z.record(z.string(), z.string()).optional(),
+});
+
+/// `GET /environments` query: one page of `environments/list`.
+const environmentListQuerySchema = z.object({
+  providerId: z.string().trim().min(1).optional(),
+  registrationKeyId: z.string().trim().min(1).optional(),
+  state: z.enum(["provisioning", "open", "closing", "closed", "failed"]).optional(),
+  includeClosed: z.enum(["true", "false"]).optional(),
+  limit: z.coerce.number().int().min(1).max(500).optional(),
+  after: z.string().trim().min(1).optional(),
 });
 
 const environmentIngressPutSchema = z.object({
@@ -181,10 +197,6 @@ const environmentPowerPutSchema = z.object({
   power: z.enum(["running", "paused", "suspended", "stopped"]),
 });
 
-const environmentIdlePolicyPutSchema = z.object({
-  idlePolicy: environmentIdlePolicySchema.nullable().optional(),
-});
-
 const environmentCredentialBindSchema = z.object({
   envName: z
     .string()
@@ -210,13 +222,16 @@ const externalEnvironmentCreateSchema = z.object({
 
 /// Registration-key policy as the Environments page submits it. Identity
 /// mode is the key's policy; daemons never choose it.
-const registrationKeyCreateSchema = z.object({
+const registrationKeySettingsSchema = z.object({
   displayName: z.string().trim().min(1).max(128),
-  identityMode: z.enum(["persistent", "ephemeral"]),
   maxActiveEnvironments: z.number().int().min(1).optional(),
   ephemeralDisconnectGraceMs: z.number().int().min(1).optional(),
+  offlineCloseAfterMs: z.number().int().min(1).optional(),
   expiresAtMs: z.number().int().min(0).optional(),
 });
+const registrationKeyCreateSchema = registrationKeySettingsSchema.extend({
+  identityMode: z.enum(["persistent", "ephemeral"]),
+});
 
 const registrationKeyRevokeSchema = z.object({
   closeEnvironments: z.boolean().optional(),
@@ -1620,17 +1635,19 @@ export function gatewayRoutes(ctx: AppContext) {
     }
     return withGateway(c, async () => {
       const client = engineClientFor(ctx, access);
-      const bindingId = c.req.query("bindingId");
-      if (bindingId) {
-        const response = await client.call("environments/templates/list", { bindingId });
+      const providerId = c.req.query("providerId");
+      if (providerId) {
+        const response = await client.call("environments/templates/list", { providerId });
         return c.json(response.result.templates);
       }
+      // One call per enabled provider so an unreachable provider drops only
+      // its own templates instead of failing the whole listing.
       const bindings = await client.call("environments/provider-bindings/list", {});
       const results = await Promise.allSettled(
         bindings.result.bindings
-          .filter((binding) => binding.status === "enabled")
+          .filter((binding) => binding.enabled)
           .map((binding) => client.call("environments/templates/list", {
-            bindingId: binding.bindingId,
+            providerId: binding.providerId,
           })),
       );
       return c.json(results.flatMap((result) =>
@@ -1646,26 +1663,20 @@ export function gatewayRoutes(ctx: AppContext) {
     }
     return withGateway(c, async () => {
       const client = engineClientFor(ctx, access);
-      const params: EnvironmentListParams = {};
-      const providerId = c.req.query("providerId");
-      if (providerId) {
-        params.providerId = providerId;
-      }
-      const bindingId = c.req.query("bindingId");
-      if (bindingId) {
-        params.bindingId = bindingId;
-      }
-      const status = c.req.query("status");
-      if (status) {
-        params.status = status as EnvironmentListParams["status"];
-      }
-
-      const registrationKeyId = c.req.query("registrationKeyId");
-      if (registrationKeyId) {
-        params.registrationKeyId = registrationKeyId;
+      const query = environmentListQuerySchema.safeParse(c.req.query());
+      if (!query.success) {
+        return c.json({ error: query.error.issues[0]?.message ?? "invalid query" }, 400);
       }
+      const { includeClosed, ...filters } = query.data;
+      const params: EnvironmentListParams = {
+        ...filters,
+        ...(includeClosed === "true" ? { includeClosed: true } : {}),
+      };
       const response = await client.call("environments/list", params);
-      return c.json(response.result.environments ?? []);
+      return c.json({
+        environments: response.result.environments ?? [],
+        nextAfter: response.result.nextAfter ?? null,
+      });
     });
   });
 
@@ -1722,6 +1733,43 @@ export function gatewayRoutes(ctx: AppContext) {
     });
   });
 
+  /// Replace a key's editable policy; its identity mode never changes.
+  app.put("/:id/environment-registration-keys/:keyId", async (c) => {
+    const access = await universeForSession(ctx, c, c.req.param("id"));
+    if (!access) {
+      return c.json({ error: "not found" }, 404);
+    }
+    const body = await parseBody(c, registrationKeySettingsSchema);
+    if (!body.ok) {
+      return body.response;
+    }
+    return withGateway(c, async () => {
+      const client = engineClientFor(ctx, access);
+      const params: EnvironmentRegistrationKeyUpdateParams = {
+        registrationKeyId: c.req.param("keyId"),
+        ...body.data,
+      };
+      const response = await client.call("environments/registration-keys/update", params);
+      return c.json(response.result.registrationKey);
+    });
+  });
+
+  /// Retire the key's live secret and mint a new one. The plaintext secret
+  /// is in the response exactly once.
+  app.post("/:id/environment-registration-keys/:keyId/rotate", async (c) => {
+    const access = await universeForSession(ctx, c, c.req.param("id"));
+    if (!access) {
+      return c.json({ error: "not found" }, 404);
+    }
+    return withGateway(c, async () => {
+      const client = engineClientFor(ctx, access);
+      const response = await client.call("environments/registration-keys/rotate", {
+        registrationKeyId: c.req.param("keyId"),
+      });
+      return c.json(response.result);
+    });
+  });
+
   app.post("/:id/environments", async (c) => {
     const access = await universeForSession(ctx, c, c.req.param("id"));
     if (!access) {
@@ -1779,20 +1827,22 @@ export function gatewayRoutes(ctx: AppContext) {
     });
   });
 
-  app.put("/:id/environments/:environmentId/idle-policy", async (c) => {
+  /// Replace an environment's display name and caller metadata.
+  app.patch("/:id/environments/:environmentId", async (c) => {
     const access = await universeForSession(ctx, c, c.req.param("id"));
     if (!access) {
       return c.json({ error: "not found" }, 404);
     }
-    const body = await parseBody(c, environmentIdlePolicyPutSchema);
+    const body = await parseBody(c, environmentUpdateSchema);
     if (!body.ok) {
       return body.response;
     }
     return withGateway(c, async () => {
       const client = engineClientFor(ctx, access);
-      const response = await client.call("environments/idle-policy/put", {
+      const response = await client.call("environments/update", {
         environmentId: c.req.param("environmentId"),
-        ...(body.data.idlePolicy ? { idlePolicy: body.data.idlePolicy } : {}),
+        ...(body.data.displayName ? { displayName: body.data.displayName } : {}),
+        metadata: body.data.metadata ?? {},
       });
       return c.json(response.result.environment);
     });
diff --git a/platform/backend/src/routes/method-roles.ts b/platform/backend/src/routes/method-roles.ts
index 4b5729d81..524f22290 100644
--- a/platform/backend/src/routes/method-roles.ts
+++ b/platform/backend/src/routes/method-roles.ts
@@ -56,7 +56,6 @@ export const METHOD_ROLES: Readonly<Record<string, UniverseRole>> = {
   "environments/credentials/list": "operator",
   "environments/credentials/unbind": "operator",
   "environments/external/create": "operator",
-  "environments/idle-policy/put": "operator",
   "environments/ingress/put": "operator",
   "environments/jobs/cancel": "contributor",
   "environments/jobs/create": "contributor",
@@ -70,8 +69,11 @@ export const METHOD_ROLES: Readonly<Record<string, UniverseRole>> = {
   "environments/registration-keys/list": "operator",
   "environments/registration-keys/read": "operator",
   "environments/registration-keys/revoke": "operator",
+  "environments/registration-keys/rotate": "operator",
+  "environments/registration-keys/update": "operator",
   "environments/templates/list": "viewer",
   "environments/templates/read": "viewer",
+  "environments/update": "operator",
   "mcp/servers/auth/discover": "operator",
   "mcp/servers/delete": "operator",
   "mcp/servers/list": "viewer",
@@ -170,7 +172,6 @@ export const UNMEMBERED_METHODS: ReadonlySet<string> = new Set([
   "deployment/environment-providers/list",
   "deployment/environment-providers/put",
   "deployment/environment-providers/read",
-  "deployment/environments/adopt",
   "deployment/sessions/deleted/list",
   "deployment/sessions/purge",
   "deployment/universes/create",
diff --git a/platform/configurator-mcp/src/generated/tools.ts b/platform/configurator-mcp/src/generated/tools.ts
index 6d75ded68..f60db6e28 100644
--- a/platform/configurator-mcp/src/generated/tools.ts
+++ b/platform/configurator-mcp/src/generated/tools.ts
@@ -5062,22 +5062,19 @@ export const GENERATED_TOOLS: readonly GeneratedToolDescriptor[] = [
     "method": "environments/create",
     "group": "environments",
     "summary": "Create an environment",
-    "description": "Records an idempotent provisioning intent against an enabled universe binding, attributed to the caller. The provider validates its provider-wide template and provisions through its backend asynchronously.",
+    "description": "Creates a provisioned environment, attributed to the caller, from a template of a provider enabled for the universe. Idempotent per requestId: same inputs, same environment; others conflict. Provisioning until the target's first envd handshake, then open; idle overrides the template default.",
     "paramsType": "EnvironmentCreateParams",
     "resultType": "AgentApiOutcome<EnvironmentCreateResponse>",
     "inputSchema": {
       "$schema": "http://json-schema.org/draft-07/schema#",
       "properties": {
-        "bindingId": {
-          "type": "string"
-        },
         "displayName": {
           "type": [
             "string",
             "null"
           ]
         },
-        "idlePolicy": {
+        "idle": {
           "anyOf": [
             {
               "$ref": "#/definitions/EnvironmentIdlePolicyView"
@@ -5086,7 +5083,7 @@ export const GENERATED_TOOLS: readonly GeneratedToolDescriptor[] = [
               "type": "null"
             }
           ],
-          "description": "Optional staged idle policy applied by the power reaper."
+          "description": "Idle policy passed to the provider in place of the template's `idle`.\nThe provider runs the idle clock; it cannot be changed after create."
         },
         "metadata": {
           "additionalProperties": {
@@ -5094,24 +5091,31 @@ export const GENERATED_TOOLS: readonly GeneratedToolDescriptor[] = [
           },
           "type": "object"
         },
+        "providerId": {
+          "description": "The provider to create the environment with; the universe needs an\nenabled binding to it.",
+          "type": "string"
+        },
         "requestId": {
-          "description": "Stable caller-generated retry identity, unique inside the universe.",
+          "description": "Stable caller-generated retry identity, unique inside the universe.\nRetrying with identical inputs returns the same environment.",
           "type": "string"
         },
         "templateId": {
-          "description": "Immutable provider template-version identity.",
+          "description": "The provider template to create the environment from.",
           "type": "string"
         }
       },
       "required": [
         "requestId",
-        "bindingId",
+        "providerId",
         "templateId"
       ],
       "type": "object",
       "definitions": {
         "EnvironmentIdlePolicyView": {
-          "description": "Staged idle policy. Thresholds are milliseconds of daemon-reported idle\ntime and must be non-decreasing in the order pause, suspend, stop, close.\nStages whose power state the provider does not support are skipped.",
+          "additionalProperties": {
+            "not": {}
+          },
+          "description": "Staged idle policy the provider applies. Thresholds are milliseconds of\nenvd-reported idle time (running processes, jobs and leftover process\ngroups hold it at zero) and must be non-decreasing in the order pause,\nsuspend, stop, close. Stages whose power state the template does not\nsupport are skipped.",
           "properties": {
             "closeAfterMs": {
               "format": "uint64",
@@ -5156,7 +5160,7 @@ export const GENERATED_TOOLS: readonly GeneratedToolDescriptor[] = [
     "method": "environments/read",
     "group": "environments",
     "summary": "Read an environment",
-    "description": "Returns the durable universe resource, source binding, logical lifecycle state, and minimal current-incarnation identity.",
+    "description": "Returns one environment: its source, lifecycle state, derived display status, state message, close reason, daemon build, and the latest provider observation.",
     "paramsType": "EnvironmentReadParams",
     "resultType": "AgentApiOutcome<EnvironmentReadResponse>",
     "inputSchema": {
@@ -5172,23 +5176,74 @@ export const GENERATED_TOOLS: readonly GeneratedToolDescriptor[] = [
       "type": "object"
     }
   },
+  {
+    "name": "lightspeed_environments_update",
+    "method": "environments/update",
+    "group": "environments",
+    "summary": "Update an environment",
+    "description": "Replaces the display name and caller metadata of an environment of any kind. Refused for a closed environment.",
+    "paramsType": "EnvironmentUpdateParams",
+    "resultType": "AgentApiOutcome<EnvironmentUpdateResponse>",
+    "inputSchema": {
+      "$schema": "http://json-schema.org/draft-07/schema#",
+      "description": "Replace an environment's display name and caller metadata.",
+      "properties": {
+        "displayName": {
+          "description": "The new display name; omit to clear it.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "environmentId": {
+          "type": "string"
+        },
+        "metadata": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "The complete new caller metadata; omit or `{}` to clear it.",
+          "type": "object"
+        }
+      },
+      "required": [
+        "environmentId"
+      ],
+      "type": "object"
+    }
+  },
   {
     "name": "lightspeed_environments_list",
     "method": "environments/list",
     "group": "environments",
     "summary": "List environments",
-    "description": "Lists the universe environments, optionally filtered by provider, binding, or logical lifecycle state.",
+    "description": "Lists the universe environments in id order, one page at a time, optionally filtered by provider, registration key, state, or metadata. Closed environments are omitted unless includeClosed is set or state is closed. Continue from nextAfter.",
     "paramsType": "EnvironmentListParams",
     "resultType": "AgentApiOutcome<EnvironmentListResponse>",
     "inputSchema": {
       "$schema": "http://json-schema.org/draft-07/schema#",
       "properties": {
-        "bindingId": {
+        "after": {
+          "description": "Exclusive environment id cursor: a previous page's `nextAfter`.",
           "type": [
             "string",
             "null"
           ]
         },
+        "includeClosed": {
+          "description": "Also list closed environments; they are omitted by default.",
+          "type": "boolean"
+        },
+        "limit": {
+          "description": "Most environments per page; omit for 100.",
+          "format": "uint32",
+          "maximum": 500,
+          "minimum": 1,
+          "type": [
+            "integer",
+            "null"
+          ]
+        },
         "metadata": {
           "additionalProperties": {
             "type": "string"
@@ -5197,6 +5252,7 @@ export const GENERATED_TOOLS: readonly GeneratedToolDescriptor[] = [
           "type": "object"
         },
         "providerId": {
+          "description": "Only provisioned environments of this provider.",
           "type": [
             "string",
             "null"
@@ -5209,46 +5265,43 @@ export const GENERATED_TOOLS: readonly GeneratedToolDescriptor[] = [
             "null"
           ]
         },
-        "status": {
+        "state": {
           "anyOf": [
             {
-              "$ref": "#/definitions/EnvironmentLifecycleStatusView"
+              "$ref": "#/definitions/EnvironmentStateView"
             },
             {
               "type": "null"
             }
-          ]
+          ],
+          "description": "Only environments in this lifecycle state. `closed` lists closed\nenvironments without `includeClosed`."
         }
       },
       "type": "object",
       "definitions": {
-        "EnvironmentLifecycleStatusView": {
+        "EnvironmentStateView": {
+          "description": "The lifecycle Lightspeed owns. External and registered environments are\nonly ever `open` or `closed`.",
           "oneOf": [
             {
               "enum": [
-                "provisioning",
-                "booting",
-                "ready",
-                "closing",
-                "closed",
-                "failed",
-                "unknown"
+                "open",
+                "closed"
               ],
               "type": "string"
             },
             {
-              "const": "paused",
-              "description": "Execution frozen; wakes on next use.",
+              "const": "provisioning",
+              "description": "The provider is creating the target; the environment opens after\nLightspeed's first handshake with its envd.",
               "type": "string"
             },
             {
-              "const": "suspended",
-              "description": "Execution state saved to disk; wakes on next use.",
+              "const": "closing",
+              "description": "The provider is removing the target.",
               "type": "string"
             },
             {
-              "const": "offline",
-              "description": "Powered off; provisioned environments wake on next use when the\nprovider supports power control.",
+              "const": "failed",
+              "description": "Provisioning or the provider failed; `stateMessage` says why.",
               "type": "string"
             }
           ]
@@ -5261,7 +5314,7 @@ export const GENERATED_TOOLS: readonly GeneratedToolDescriptor[] = [
     "method": "environments/close",
     "group": "environments",
     "summary": "Close an environment",
-    "description": "Records an asynchronous idempotent close intent. Provider cleanup is resumed by lifecycle reconciliation; quota is released only after Closed.",
+    "description": "Closes an environment; idempotent. A provisioned environment moves to closing while Lightspeed asks its provider to remove the target, retrying until it is gone, then closed. External and registered environments close at once, and a connected registered daemon is told its environment closed.",
     "paramsType": "EnvironmentCloseParams",
     "resultType": "AgentApiOutcome<EnvironmentCloseResponse>",
     "inputSchema": {
@@ -5282,7 +5335,7 @@ export const GENERATED_TOOLS: readonly GeneratedToolDescriptor[] = [
     "method": "environments/external/create",
     "group": "environments",
     "summary": "Register an external environment",
-    "description": "Creates an environment backed by a Lightspeed-reachable envd WebSocket endpoint, attributed to the caller. Reachability is checked on demand.",
+    "description": "Creates an open environment backed by a Lightspeed-reachable envd endpoint, attributed to the caller. Idempotent per requestId. Reachability is checked on use.",
     "paramsType": "EnvironmentExternalCreateParams",
     "resultType": "AgentApiOutcome<EnvironmentExternalCreateResponse>",
     "inputSchema": {
@@ -5305,6 +5358,7 @@ export const GENERATED_TOOLS: readonly GeneratedToolDescriptor[] = [
           "type": "object"
         },
         "requestId": {
+          "description": "Stable caller-generated retry identity, unique inside the universe.",
           "type": "string"
         }
       },
@@ -5320,13 +5374,14 @@ export const GENERATED_TOOLS: readonly GeneratedToolDescriptor[] = [
     "method": "environments/ingress/put",
     "group": "environments",
     "summary": "Configure environment public ingress",
-    "description": "Records the public ingress intent of a provisioned environment; the lifecycle reconciler converges it while the environment is ready, and `publicEndpoint` shows the realized endpoint. Rejected when the provider does not offer ingress. The provider owns hostname, guest port, routing, TLS, and health; an intent its template refuses is dropped.",
+    "description": "Synchronously ensures or removes public ingress of an open provisioned environment through its provider; source.publicEndpoint carries the reported endpoint. Rejected when the provider offers no ingress; an internal error, safe to retry, when the provider is unreachable or times out. The provider owns hostname, guest port, routing, TLS, and health.",
     "paramsType": "EnvironmentIngressPutParams",
     "resultType": "AgentApiOutcome<EnvironmentIngressPutResponse>",
     "inputSchema": {
       "$schema": "http://json-schema.org/draft-07/schema#",
       "properties": {
         "enabled": {
+          "description": "Ensure (`true`) or remove (`false`) the provider's public ingress.",
           "type": "boolean"
         },
         "environmentId": {
@@ -5344,8 +5399,8 @@ export const GENERATED_TOOLS: readonly GeneratedToolDescriptor[] = [
     "name": "lightspeed_environments_power_put",
     "method": "environments/power/put",
     "group": "environments",
-    "summary": "Set environment power intent",
-    "description": "Records the desired power state (running, paused, suspended, or stopped) of a provisioned environment; the lifecycle reconciler converges the provider target asynchronously. Powered-down environments wake transparently on their next use. Rejected when the provider does not support the state.",
+    "summary": "Set environment power",
+    "description": "Synchronously moves an open provisioned environment's target to running, paused, suspended, or stopped via its provider and records the observation; the provider may also change power on idle. Rejected without provider power control or when the template lacks the state; an internal error, safe to retry, when the provider is unreachable or times out.",
     "paramsType": "EnvironmentPowerPutParams",
     "resultType": "AgentApiOutcome<EnvironmentPowerPutResponse>",
     "inputSchema": {
@@ -5360,7 +5415,7 @@ export const GENERATED_TOOLS: readonly GeneratedToolDescriptor[] = [
               "$ref": "#/definitions/EnvironmentPowerStateView"
             }
           ],
-          "description": "Desired steady power state. Must be one of the provider-reported\n`incarnation.powerStates`."
+          "description": "Power state to move the target to; one of its template's\n`powerStates`."
         }
       },
       "required": [
@@ -5370,7 +5425,7 @@ export const GENERATED_TOOLS: readonly GeneratedToolDescriptor[] = [
       "type": "object",
       "definitions": {
         "EnvironmentPowerStateView": {
-          "description": "Steady power state of a provisioned environment.",
+          "description": "Power state of a provisioned environment's target.",
           "oneOf": [
             {
               "enum": [
@@ -5398,84 +5453,12 @@ export const GENERATED_TOOLS: readonly GeneratedToolDescriptor[] = [
       }
     }
   },
-  {
-    "name": "lightspeed_environments_idle-policy_put",
-    "method": "environments/idle-policy/put",
-    "group": "environments",
-    "summary": "Set environment idle policy",
-    "description": "Replaces or clears the staged idle policy of a provisioned environment. The power reaper measures the daemon's idle duration against the pause/suspend/stop/close thresholds and escalates through the stages the provider supports.",
-    "paramsType": "EnvironmentIdlePolicyPutParams",
-    "resultType": "AgentApiOutcome<EnvironmentIdlePolicyPutResponse>",
-    "inputSchema": {
-      "$schema": "http://json-schema.org/draft-07/schema#",
-      "properties": {
-        "environmentId": {
-          "type": "string"
-        },
-        "idlePolicy": {
-          "anyOf": [
-            {
-              "$ref": "#/definitions/EnvironmentIdlePolicyView"
-            },
-            {
-              "type": "null"
-            }
-          ],
-          "description": "The complete new policy; omit to clear it."
-        }
-      },
-      "required": [
-        "environmentId"
-      ],
-      "type": "object",
-      "definitions": {
-        "EnvironmentIdlePolicyView": {
-          "description": "Staged idle policy. Thresholds are milliseconds of daemon-reported idle\ntime and must be non-decreasing in the order pause, suspend, stop, close.\nStages whose power state the provider does not support are skipped.",
-          "properties": {
-            "closeAfterMs": {
-              "format": "uint64",
-              "minimum": 0,
-              "type": [
-                "integer",
-                "null"
-              ]
-            },
-            "pauseAfterMs": {
-              "format": "uint64",
-              "minimum": 0,
-              "type": [
-                "integer",
-                "null"
-              ]
-            },
-            "stopAfterMs": {
-              "format": "uint64",
-              "minimum": 0,
-              "type": [
-                "integer",
-                "null"
-              ]
-            },
-            "suspendAfterMs": {
-              "format": "uint64",
-              "minimum": 0,
-              "type": [
-                "integer",
-                "null"
-              ]
-            }
-          },
-          "type": "object"
-        }
-      }
-    }
-  },
   {
     "name": "lightspeed_environments_provider-bindings_list",
     "method": "environments/provider-bindings/list",
     "group": "environments",
     "summary": "List environment provider bindings",
-    "description": "Lists this universe's revisioned routing and admission bindings to deployment-scoped physical providers.",
+    "description": "Lists this universe's bindings to deployment providers and whether each is enabled.",
     "paramsType": "EnvironmentProviderBindingListParams",
     "resultType": "AgentApiOutcome<EnvironmentProviderBindingListResponse>",
     "inputSchema": {
@@ -5488,18 +5471,18 @@ export const GENERATED_TOOLS: readonly GeneratedToolDescriptor[] = [
     "method": "environments/provider-bindings/read",
     "group": "environments",
     "summary": "Read an environment provider binding",
-    "description": "Returns one universe routing and admission binding. Provider-wide templates and physical resource, network, and ingress policy remain provider-owned.",
+    "description": "Returns this universe's binding to one provider. Templates and physical resource, network, and ingress policy remain provider-owned.",
     "paramsType": "EnvironmentProviderBindingReadParams",
     "resultType": "AgentApiOutcome<EnvironmentProviderBindingReadResponse>",
     "inputSchema": {
       "$schema": "http://json-schema.org/draft-07/schema#",
       "properties": {
-        "bindingId": {
+        "providerId": {
           "type": "string"
         }
       },
       "required": [
-        "bindingId"
+        "providerId"
       ],
       "type": "object"
     }
@@ -5509,13 +5492,14 @@ export const GENERATED_TOOLS: readonly GeneratedToolDescriptor[] = [
     "method": "environments/templates/list",
     "group": "environments",
     "summary": "List environment templates",
-    "description": "Reads immutable templates directly from the selected bound provider controller.",
+    "description": "Reads templates live from the controllers of the universe's enabled provider bindings, or of one provider: compute, power states, public ingress, and default idle policy.",
     "paramsType": "EnvironmentTemplateListParams",
     "resultType": "AgentApiOutcome<EnvironmentTemplateListResponse>",
     "inputSchema": {
       "$schema": "http://json-schema.org/draft-07/schema#",
       "properties": {
-        "bindingId": {
+        "providerId": {
+          "description": "Only this provider's templates; omit for every enabled binding.",
           "type": [
             "string",
             "null"
@@ -5530,13 +5514,13 @@ export const GENERATED_TOOLS: readonly GeneratedToolDescriptor[] = [
     "method": "environments/templates/read",
     "group": "environments",
     "summary": "Read an environment template",
-    "description": "Returns one immutable template version from the selected bound provider controller.",
+    "description": "Returns one template, read live from a bound provider's controller.",
     "paramsType": "EnvironmentTemplateReadParams",
     "resultType": "AgentApiOutcome<EnvironmentTemplateReadResponse>",
     "inputSchema": {
       "$schema": "http://json-schema.org/draft-07/schema#",
       "properties": {
-        "bindingId": {
+        "providerId": {
           "type": "string"
         },
         "templateId": {
@@ -5544,7 +5528,7 @@ export const GENERATED_TOOLS: readonly GeneratedToolDescriptor[] = [
         }
       },
       "required": [
-        "bindingId",
+        "providerId",
         "templateId"
       ],
       "type": "object"
diff --git a/platform/configurator-mcp/test/generated.test.ts b/platform/configurator-mcp/test/generated.test.ts
index 01a698f45..1459361be 100644
--- a/platform/configurator-mcp/test/generated.test.ts
+++ b/platform/configurator-mcp/test/generated.test.ts
@@ -14,6 +14,8 @@ describe("generated universe tools", () => {
       "environments/registration-keys/read",
       "environments/registration-keys/list",
       "environments/registration-keys/revoke",
+      "environments/registration-keys/update",
+      "environments/registration-keys/rotate",
     ]);
     const expectedMethods = Object.entries(METHOD_INFO)
       .filter(([method, info]) => info.scope === "universe" && !excluded.has(method))
diff --git a/platform/configurator-mcp/tool-filter.json b/platform/configurator-mcp/tool-filter.json
index b89a5be1d..df5ccf043 100644
--- a/platform/configurator-mcp/tool-filter.json
+++ b/platform/configurator-mcp/tool-filter.json
@@ -7,6 +7,8 @@
     "environments/registration-keys/create",
     "environments/registration-keys/read",
     "environments/registration-keys/list",
-    "environments/registration-keys/revoke"
+    "environments/registration-keys/revoke",
+    "environments/registration-keys/update",
+    "environments/registration-keys/rotate"
   ]
 }
diff --git a/platform/web/src/components/bot/environment-card.tsx b/platform/web/src/components/bot/environment-card.tsx
index 34717c48d..433d23262 100644
--- a/platform/web/src/components/bot/environment-card.tsx
+++ b/platform/web/src/components/bot/environment-card.tsx
@@ -1,28 +1,25 @@
 import { useActionPermissions } from "@/lib/permissions";
-import { useState } from "react";
 import { useQuery, useQueryClient } from "@tanstack/react-query";
 import { ArrowUpRight } from "lucide-react";
 import { Link } from "react-router-dom";
-import { api, type Environment } from "@/api";
 import { Badge } from "@/components/ui/badge";
-import { Button } from "@/components/ui/button";
-import { EnvironmentIdlePolicyDialog } from "@/components/environment/idle-policy-dialog";
+import { EnvironmentPowerControls } from "@/components/environment/power-controls";
 import {
-  EnvironmentPowerControls,
   describeIdlePolicy,
-  observedPower,
-  powerDiverges,
-} from "@/components/environment/power-controls";
+  environmentTemplate,
+  environmentTemplatesQuery,
+  lifecycleMessage,
+  openEnvironmentsQuery,
+} from "@/lib/environments";
 import { DetailSection, KeyValue } from "./status";
 
 const GONE = new Set(["closing", "closed", "failed"]);
 
 /**
- * The environment a bot's sessions share: the `existing` environment its
- * profile names. Status, power, and idle policy are shown next to the bot
+ * The environment a bot's sessions share: the default environment its
+ * profile attaches by id. Status and power are shown next to the bot
  * because that is where an operator looks when a bot seems asleep; the
- * policy itself lives on the environment and is edited here or on the
- * Environments page.
+ * provider runs the idle policy its template sets.
  */
 export function BotEnvironmentCard({
   slug,
@@ -34,26 +31,24 @@ export function BotEnvironmentCard({
   universeId: string;
   environmentId: string;
 }) {
-  const target = { kind: "environment" as const, id: environmentId };
   const permissions = useActionPermissions(universeId);
   const manage = permissions.can("configure_resource");
   const queryClient = useQueryClient();
-  const [policyOpen, setPolicyOpen] = useState(false);
-  const environments = useQuery({
-    queryKey: ["environments", universeId],
-    queryFn: () => api<Environment[]>("GET", `/api/v1/universes/${universeId}/environments`),
-    refetchInterval: 15_000,
-  });
+  const environments = useQuery({ ...openEnvironmentsQuery(universeId), refetchInterval: 15_000 });
+  const templates = useQuery(environmentTemplatesQuery(universeId));
   const refresh = () => {
     void queryClient.invalidateQueries({ queryKey: ["environments", universeId] });
   };
   const current = environments.data?.find((environment) => environment.environmentId === environmentId);
   const provisioned = current?.source.type === "provisioned";
+  const template = current ? environmentTemplate(current, templates.data) : undefined;
+  const message = current ? lifecycleMessage(current) : null;
+  const idle = current?.source.type === "provisioned" ? current.source.idle ?? template?.idle : undefined;
 
   return (
     <DetailSection
       title="Environment"
-      description="The existing environment this bot's profile activates in every session. Shared with anything else that names it."
+      description="The default environment this bot's profile attaches in every session. Shared with anything else that names it."
     >
       {environments.isLoading ? (
         <p className="text-xs text-muted-foreground">Loading…</p>
@@ -61,8 +56,8 @@ export function BotEnvironmentCard({
         <p className="rounded-md bg-destructive/10 p-2 text-xs text-destructive">{environments.error.message}</p>
       ) : !current ? (
         <p className="rounded-md bg-destructive/10 p-2 text-xs text-destructive">
-          Environment <code className="font-mono">{environmentId}</code> is not listed in this universe;
-          new sessions of this bot will fail to start until the profile points at an open one.
+          Environment <code className="font-mono">{environmentId}</code> is closed or not listed in this
+          universe; new sessions of this bot will fail to start until the profile points at an open one.
         </p>
       ) : (
         <>
@@ -81,27 +76,23 @@ export function BotEnvironmentCard({
           <KeyValue
             label="Status"
             value={
-              <span className="inline-flex items-center gap-2">
-                <Badge variant={GONE.has(current.status) ? "destructive" : current.status === "ready" ? "secondary" : "outline"}>
-                  {current.status}
-                </Badge>
-                {powerDiverges(current) && (
-                  <span className="text-xs text-muted-foreground">
-                    {observedPower(current) ?? current.status} → {current.desiredPower}
-                  </span>
-                )}
-              </span>
+              <Badge variant={GONE.has(current.status) ? "destructive" : current.status === "ready" ? "secondary" : "outline"}>
+                {current.status}
+              </Badge>
             }
           />
-          <KeyValue label="Idle policy" value={describeIdlePolicy(current.idlePolicy ?? undefined)} />
+          {provisioned && (
+            <KeyValue label="Idle policy" value={describeIdlePolicy(idle)} />
+          )}
+          {message && <p className="text-xs text-muted-foreground">{message}</p>}
           {manage && !GONE.has(current.status) && (
             <div className="flex flex-wrap items-center gap-2">
-              <EnvironmentPowerControls universeId={universeId} environment={current} onChanged={refresh} />
-              {provisioned && (
-                <Button variant="outline" size="xs" onClick={() => setPolicyOpen(true)}>
-                  Idle policy…
-                </Button>
-              )}
+              <EnvironmentPowerControls
+                universeId={universeId}
+                environment={current}
+                powerStates={template?.powerStates ?? []}
+                onChanged={refresh}
+              />
             </div>
           )}
           {GONE.has(current.status) && (
@@ -110,26 +101,12 @@ export function BotEnvironmentCard({
               profile points at an open environment.
             </p>
           )}
-          {!GONE.has(current.status) && provisioned && !current.idlePolicy && (
-            <p className="rounded-md bg-amber-500/10 p-2 text-xs text-amber-700 dark:text-amber-400">
-              No idle policy: this environment never pauses, suspends, or stops while the bot is quiet.
-            </p>
-          )}
           {!GONE.has(current.status) && !provisioned && (
             <p className="rounded-md border border-dashed p-2 text-xs text-muted-foreground">
-              External environment: no power control, so it cannot be paused or stopped while idle.
+              {current.source.type === "registered" ? "Registered" : "External"} environment: its
+              own infrastructure runs it, so Lightspeed has no power control over it.
             </p>
           )}
-          {manage && provisioned && (
-            <EnvironmentIdlePolicyDialog
-              key={`${current.environmentId}:${policyOpen ? "open" : "closed"}`}
-              universeId={universeId}
-              environment={current}
-              open={policyOpen}
-              onOpenChange={setPolicyOpen}
-              onChanged={refresh}
-            />
-          )}
         </>
       )}
     </DetailSection>
diff --git a/platform/web/src/components/bot/setup-summary.ts b/platform/web/src/components/bot/setup-summary.ts
index b2e1eaf9f..f035a008d 100644
--- a/platform/web/src/components/bot/setup-summary.ts
+++ b/platform/web/src/components/bot/setup-summary.ts
@@ -1,6 +1,5 @@
 import { defaultEnvironmentAttachment } from "@/lib/sessions/resource-features";
 import type { BotView, Environment } from "@/api";
-import { describeIdlePolicy } from "@/components/environment/power-controls";
 
 const FEATURE_LABELS: Record<string, string> = {
   web: "Web",
@@ -33,8 +32,7 @@ export function environmentSummary(
   if (environment.environmentId) {
     const current = environments?.find((entry) => entry.environmentId === environment.environmentId);
     const name = current?.displayName ?? environment.environmentId;
-    const policy = current?.idlePolicy ? ` · ${describeIdlePolicy(current.idlePolicy)}` : "";
-    return `${name}${current ? ` · ${current.status}` : ""}${policy}`;
+    return `${name}${current ? ` · ${current.status}` : ""}`;
   }
   return "Inherits the session's environment";
 }
diff --git a/platform/web/src/components/bot/setup.tsx b/platform/web/src/components/bot/setup.tsx
index 8f2230d68..436794487 100644
--- a/platform/web/src/components/bot/setup.tsx
+++ b/platform/web/src/components/bot/setup.tsx
@@ -14,7 +14,6 @@ import {
   type BotStateView,
   type BotTriggerView,
   type BotView,
-  type Environment,
   type ProfileDocument,
   type ProfileSummary,
 } from "@/api";
@@ -46,6 +45,7 @@ import { MetadataMapEditor } from "@/components/session/metadata-editor";
 import { ProfileRetentionEditor } from "@/components/session/profile-retention-editor";
 import { SessionConfigEditor } from "@/components/session/session-config-editor";
 import { useSessionConfigEditorOptions } from "@/lib/sessions/editor-options";
+import { openEnvironmentsQuery } from "@/lib/environments";
 import {
   hasSessionFeature,
   resourceFeatureDisableReasons,
@@ -397,10 +397,7 @@ function SessionProfileSection({
   const queryClient = useQueryClient();
   const profileUrl = `/api/v1/universes/${universeId}/profiles/${encodeURIComponent(bot.profileId)}`;
   const options = useSessionConfigEditorOptions(universeId, true);
-  const environments = useQuery({
-    queryKey: ["environments", universeId],
-    queryFn: () => api<Environment[]>("GET", `/api/v1/universes/${universeId}/environments`),
-  });
+  const environments = useQuery(openEnvironmentsQuery(universeId));
   const bots = useQuery({
     queryKey: ["bots", universeId],
     queryFn: () => api<BotListResponse>("GET", `/api/v1/universes/${universeId}/bots`),
diff --git a/platform/web/src/components/bot/triggers.tsx b/platform/web/src/components/bot/triggers.tsx
index 609217117..61f277b69 100644
--- a/platform/web/src/components/bot/triggers.tsx
+++ b/platform/web/src/components/bot/triggers.tsx
@@ -1798,7 +1798,7 @@ export function pollPayload(form: PollFormState) {
           }
         : {
             kind: "exec" as const,
-            // Blank runs in the bot's own environment (the profile's existing one).
+            // Blank runs in the bot's own environment (the profile's default one).
             ...(form.environmentId.trim() ? { environmentId: form.environmentId.trim() } : {}),
             argv: pollArgv(form),
             ...(form.cwd.trim() ? { cwd: form.cwd.trim() } : {}),
@@ -1814,8 +1814,8 @@ export function pollPayload(form: PollFormState) {
 }
 
 /// `env` is the bot profile's environment intent when known: a blank
-/// environment is fine when the profile activates an existing one (the poll
-/// runs there), and left to the server otherwise.
+/// environment is fine when the profile's default attachment names an
+/// environment (the poll runs there), and left to the server otherwise.
 export function pollFormProblem(form: PollFormState, env?: BotEnvStatus): string | null {
   if (form.sourceKind === "http") {
     if (!/^https?:\/\//.test(form.url.trim())) return "The poll URL must be http(s).";
diff --git a/platform/web/src/components/environment/idle-policy-dialog.tsx b/platform/web/src/components/environment/idle-policy-dialog.tsx
deleted file mode 100644
index da3db5345..000000000
--- a/platform/web/src/components/environment/idle-policy-dialog.tsx
+++ /dev/null
@@ -1,95 +0,0 @@
-import { useState } from "react";
-import { useMutation, useQueryClient } from "@tanstack/react-query";
-import { api, type Environment } from "@/api";
-import { Button } from "@/components/ui/button";
-import {
-  Dialog,
-  DialogContent,
-  DialogDescription,
-  DialogFooter,
-  DialogHeader,
-  DialogTitle,
-} from "@/components/ui/dialog";
-import { IdlePolicyFields, idlePolicyIsMonotone, type IdlePolicy } from "./idle-policy-fields";
-
-/**
- * Edit (or clear) the idle policy of an existing provisioned environment
- * (`environments/idle-policy/put`). The policy lives on the environment,
- * not on any profile or bot that uses it — this is the one place to set it
- * for a box that long-lived sessions share.
- */
-export function EnvironmentIdlePolicyDialog({
-  universeId,
-  environment,
-  open,
-  onOpenChange,
-  onChanged,
-}: {
-  universeId: string;
-  environment: Environment;
-  open: boolean;
-  onOpenChange: (open: boolean) => void;
-  onChanged?: () => void;
-}) {
-  const queryClient = useQueryClient();
-  const [policy, setPolicy] = useState<IdlePolicy | undefined>(environment.idlePolicy ?? undefined);
-  const [error, setError] = useState<string | null>(null);
-  const save = useMutation({
-    mutationFn: (next: IdlePolicy | undefined) =>
-      api<Environment>(
-        "PUT",
-        `/api/v1/universes/${universeId}/environments/${encodeURIComponent(environment.environmentId)}/idle-policy`,
-        { idlePolicy: next ?? null },
-      ),
-    onSuccess: async () => {
-      await queryClient.invalidateQueries({ queryKey: ["environments", universeId] });
-      onChanged?.();
-      setError(null);
-      onOpenChange(false);
-    },
-    onError: (err) => setError(err.message),
-  });
-  const label = environment.displayName ?? environment.environmentId;
-  const valid = idlePolicyIsMonotone(policy);
-  return (
-    <Dialog open={open} onOpenChange={onOpenChange}>
-      <DialogContent className="sm:max-w-lg">
-        <DialogHeader>
-          <DialogTitle>Idle policy for {label}</DialogTitle>
-          <DialogDescription>
-            When nothing has used this environment for the given time — no session, bot, poller,
-            or shell — it is powered down stage by stage, and wakes on the next use. Leave every
-            stage empty to keep it running forever.
-          </DialogDescription>
-        </DialogHeader>
-        <IdlePolicyFields
-          value={policy}
-          warning={
-            policy === undefined
-              ? "No stages: this environment never pauses, suspends, or stops while idle."
-              : policy.closeAfterMs !== undefined && policy.closeAfterMs !== null
-                ? "A close stage destroys the environment; profiles and bots pointing at it will fail until they are repointed."
-                : undefined
-          }
-          onChange={setPolicy}
-        />
-        {error && <p className="text-sm text-destructive">{error}</p>}
-        <DialogFooter>
-          <Button variant="outline" onClick={() => onOpenChange(false)}>
-            Cancel
-          </Button>
-          <Button
-            variant="outline"
-            disabled={save.isPending || environment.idlePolicy == null}
-            onClick={() => save.mutate(undefined)}
-          >
-            Clear policy
-          </Button>
-          <Button disabled={save.isPending || !valid} onClick={() => save.mutate(policy)}>
-            {save.isPending ? "Saving…" : "Save"}
-          </Button>
-        </DialogFooter>
-      </DialogContent>
-    </Dialog>
-  );
-}
diff --git a/platform/web/src/components/environment/idle-policy-fields.test.ts b/platform/web/src/components/environment/idle-policy-fields.test.ts
new file mode 100644
index 000000000..322ea644b
--- /dev/null
+++ b/platform/web/src/components/environment/idle-policy-fields.test.ts
@@ -0,0 +1,21 @@
+import { describe, expect, it } from "vitest";
+import { idlePolicyProblem, idleStagesFor } from "./idle-policy-fields";
+
+describe("idle policy fields", () => {
+  it("offers only the stages the template's power states support, close always", () => {
+    expect(idleStagesFor(["running", "paused", "stopped"]).map((stage) => stage.key)).toEqual([
+      "pauseAfterMs",
+      "stopAfterMs",
+      "closeAfterMs",
+    ]);
+    expect(idleStagesFor([]).map((stage) => stage.key)).toEqual(["closeAfterMs"]);
+  });
+
+  it("requires at least one stage and non-decreasing thresholds", () => {
+    expect(idlePolicyProblem(undefined)).toMatch(/at least one stage/);
+    expect(idlePolicyProblem({})).toMatch(/at least one stage/);
+    expect(idlePolicyProblem({ pauseAfterMs: 60_000, stopAfterMs: 30_000 })).toMatch(/must not decrease/);
+    expect(idlePolicyProblem({ pauseAfterMs: 60_000, stopAfterMs: 60_000 })).toBeNull();
+    expect(idlePolicyProblem({ closeAfterMs: 3_600_000 })).toBeNull();
+  });
+});
diff --git a/platform/web/src/components/environment/idle-policy-fields.tsx b/platform/web/src/components/environment/idle-policy-fields.tsx
index 43f188c22..91d79d77f 100644
--- a/platform/web/src/components/environment/idle-policy-fields.tsx
+++ b/platform/web/src/components/environment/idle-policy-fields.tsx
@@ -1,37 +1,50 @@
-import type { EnvironmentIdlePolicyView } from "@lightspeed-ai/sdk";
+import type { EnvironmentIdlePolicyView, EnvironmentPowerStateView } from "@lightspeed-ai/sdk";
 import { Field, FieldDescription, FieldLabel } from "@/components/ui/field";
 import { Input } from "@/components/ui/input";
 
-export type IdlePolicy = EnvironmentIdlePolicyView;
+type IdlePolicy = EnvironmentIdlePolicyView;
 
-export const IDLE_STAGES: Array<{ key: keyof IdlePolicy; label: string; hint: string }> = [
-  { key: "pauseAfterMs", label: "Pause after", hint: "Freeze execution; RAM stays resident, resume is instant." },
-  { key: "suspendAfterMs", label: "Suspend after", hint: "Save state to disk and free RAM (providers that support it)." },
-  { key: "stopAfterMs", label: "Stop after", hint: "Power off; disk is kept, resume is a fresh boot." },
-  { key: "closeAfterMs", label: "Close after", hint: "Destroy the environment. Not for a box a bot or several sessions rely on." },
+/// Each stage with the power state its provider template must support;
+/// closing needs none.
+const IDLE_STAGES: Array<{
+  key: keyof IdlePolicy;
+  label: string;
+  hint: string;
+  power?: EnvironmentPowerStateView;
+}> = [
+  { key: "pauseAfterMs", label: "Pause after", hint: "Freeze execution; memory stays resident and resume is instant.", power: "paused" },
+  { key: "suspendAfterMs", label: "Suspend after", hint: "Save state to disk and free memory.", power: "suspended" },
+  { key: "stopAfterMs", label: "Stop after", hint: "Power off; the disk is kept and resume is a fresh boot.", power: "stopped" },
+  { key: "closeAfterMs", label: "Close after", hint: "Destroy the environment." },
 ];
 
-/** True when every set stage is at or after the previous one (pause ≤ suspend ≤ stop ≤ close). */
-export function idlePolicyIsMonotone(value: IdlePolicy | undefined): boolean {
-  const ordered = IDLE_STAGES
-    .map((stage) => value?.[stage.key])
+/// The stages a template can carry out, in escalation order.
+export function idleStagesFor(powerStates: EnvironmentPowerStateView[]) {
+  return IDLE_STAGES.filter((stage) => !stage.power || powerStates.includes(stage.power));
+}
+
+/// Why `policy` cannot be sent, or `null` when it is valid: at least one
+/// stage, and each set stage no earlier than the one before it.
+export function idlePolicyProblem(policy: IdlePolicy | undefined): string | null {
+  const thresholds = IDLE_STAGES
+    .map((stage) => policy?.[stage.key])
     .filter((ms): ms is number => typeof ms === "number");
-  return ordered.every((ms, index) => index === 0 || ms >= (ordered[index - 1] ?? 0));
+  if (thresholds.length === 0) return "Set at least one stage.";
+  if (!thresholds.every((ms, index) => index === 0 || ms >= (thresholds[index - 1] ?? 0))) {
+    return "Stages must not decrease: pause ≤ suspend ≤ stop ≤ close.";
+  }
+  return null;
 }
 
-/// Idle policy: minutes of daemon-reported idle time per stage. Empty
-/// stages are omitted; stages the provider cannot realize are skipped at
-/// runtime. A powered-down environment wakes when a session uses it. Shared
-/// by the
-/// environment create dialog, and the per-environment idle-policy editor.
+/// Minutes of envd-reported idle time per stage, for the stages the template
+/// supports. Empty stages are omitted from the policy.
 export function IdlePolicyFields({
   value,
-  warning,
+  powerStates,
   onChange,
 }: {
   value: IdlePolicy | undefined;
-  /// Shown instead of the default hint while the policy is valid.
-  warning?: string;
+  powerStates: EnvironmentPowerStateView[];
   onChange: (policy: IdlePolicy | undefined) => void;
 }) {
   const update = (key: keyof IdlePolicy, minutes: string) => {
@@ -44,18 +57,19 @@ export function IdlePolicyFields({
     }
     onChange(Object.keys(next).length ? next : undefined);
   };
-  const monotone = idlePolicyIsMonotone(value);
+  const problem = idlePolicyProblem(value);
   return (
     <Field>
-      <FieldLabel>Idle policy (minutes, optional)</FieldLabel>
+      <FieldLabel>Idle policy (minutes)</FieldLabel>
       <div className="grid gap-2 sm:grid-cols-2">
-        {IDLE_STAGES.map((stage) => (
+        {idleStagesFor(powerStates).map((stage) => (
           <label key={stage.key} className="flex flex-col gap-1 text-xs">
             <span className="text-muted-foreground">{stage.label}</span>
             <Input
               type="number"
               min={1}
               step={1}
+              aria-label={stage.label}
               value={value?.[stage.key] ? String((value[stage.key] ?? 0) / 60_000) : ""}
               placeholder="—"
               title={stage.hint}
@@ -64,19 +78,9 @@ export function IdlePolicyFields({
           </label>
         ))}
       </div>
-      <FieldDescription
-        className={
-          !monotone
-            ? "text-xs text-destructive"
-            : warning
-              ? "text-xs text-amber-700 dark:text-amber-400"
-              : "text-xs"
-        }
-      >
-        {!monotone
-          ? "Stages must be non-decreasing: pause ≤ suspend ≤ stop ≤ close."
-          : warning
-            ?? "Measured from the environment's own idle clock; each later stage must not come before an earlier one. The environment wakes automatically when a session uses it."}
+      <FieldDescription className={problem ? "text-xs text-destructive" : "text-xs"}>
+        {problem ??
+          "Measured by the environment's own idle clock. The provider applies it; it cannot be changed after the environment is created."}
       </FieldDescription>
     </Field>
   );
diff --git a/platform/web/src/components/environment/power-controls.tsx b/platform/web/src/components/environment/power-controls.tsx
index c8ed32165..01740c55a 100644
--- a/platform/web/src/components/environment/power-controls.tsx
+++ b/platform/web/src/components/environment/power-controls.tsx
@@ -1,67 +1,43 @@
 import { useMutation, useQueryClient } from "@tanstack/react-query";
+import type { EnvironmentPowerStateView } from "@lightspeed-ai/sdk";
 import { api, type Environment } from "@/api";
 import { Button } from "@/components/ui/button";
 
-/// Observed steady power state derived from the lifecycle status.
-export function observedPower(environment: Environment): Environment["desiredPower"] | null {
-  switch (environment.status) {
-    case "ready":
-      return "running";
-    case "paused":
-      return "paused";
-    case "suspended":
-      return "suspended";
-    case "offline":
-      return "stopped";
-    default:
-      return null;
-  }
-}
-
-export function powerDiverges(environment: Environment): boolean {
-  if (environment.source.type !== "provisioned") return false;
-  const observed = observedPower(environment);
-  return observed !== null && observed !== environment.desiredPower;
-}
-
-const IDLE_STAGES: Array<[keyof NonNullable<Environment["idlePolicy"]>, string]> = [
-  ["pauseAfterMs", "pause"],
-  ["suspendAfterMs", "suspend"],
-  ["stopAfterMs", "stop"],
-  ["closeAfterMs", "close"],
+const OPTIONS: Array<[EnvironmentPowerStateView, string]> = [
+  ["running", "Resume"],
+  ["paused", "Pause"],
+  ["suspended", "Suspend"],
+  ["stopped", "Stop"],
 ];
 
-export function describeIdlePolicy(policy: Environment["idlePolicy"] | undefined): string {
-  if (!policy) return "none";
-  const stages = IDLE_STAGES
-    .filter(([key]) => policy[key] !== undefined && policy[key] !== null)
-    .map(([key, label]) => `${label} after ${formatDuration(policy[key] as number)}`);
-  return stages.length ? stages.join(", ") : "none";
-}
-
-export function formatDuration(ms: number): string {
-  if (ms % 3_600_000 === 0) return `${ms / 3_600_000}h`;
-  if (ms % 60_000 === 0) return `${ms / 60_000}m`;
-  if (ms % 1_000 === 0) return `${ms / 1_000}s`;
-  return `${ms}ms`;
+/// The power state the provider last reported, while the target is active.
+function observedPower(environment: Environment): EnvironmentPowerStateView | null {
+  if (environment.source.type !== "provisioned") return null;
+  const observed = environment.source.observed;
+  if (!observed) return "running";
+  return observed.phase === "active" ? observed.power ?? "running" : null;
 }
 
-/// Power intent: pause/suspend/stop/resume a provisioned environment.
-/// Only the states the provider reported are offered; a powered-down
-/// environment also wakes by itself when a session uses it. `onChanged`
-/// lets a caller refresh its own query on top of the environments list.
+/// One-shot `environments/power/put` buttons for an open provisioned
+/// environment. The provider moves the target at once and owns every later
+/// transition; a powered-down environment also wakes when a tool uses it.
+/// `powerStates` are the states the environment's template supports.
+/// `onChanged` lets a caller refresh its own query on top of the
+/// environments list.
 export function EnvironmentPowerControls({
   universeId,
   environment,
+  powerStates,
   onChanged,
 }: {
   universeId: string;
   environment: Environment;
+  powerStates: readonly EnvironmentPowerStateView[];
   onChanged?: () => void;
 }) {
   const queryClient = useQueryClient();
   const power = useMutation({
-    mutationFn: (next: Environment["desiredPower"]) => api<Environment>(
+    mutationFn: (next: EnvironmentPowerStateView) => api<Environment>(
       "PUT",
       `/api/v1/universes/${universeId}/environments/${encodeURIComponent(environment.environmentId)}/power`,
       { power: next },
@@ -71,36 +47,25 @@ export function EnvironmentPowerControls({
       onChanged?.();
     },
   });
-  const supported = environment.incarnation.powerStates ?? [];
-  const closed = ["closing", "closed", "failed"].includes(environment.status);
-  if (closed || supported.length === 0) return null;
-  const busy = power.isPending || powerDiverges(environment);
+  if (environment.source.type !== "provisioned" || environment.state !== "open" || powerStates.length === 0) {
+    return null;
+  }
   const observed = observedPower(environment);
-  const options: Array<[Environment["desiredPower"], string]> = [
-    ["running", "Resume"],
-    ["paused", "Pause"],
-    ["suspended", "Suspend"],
-    ["stopped", "Stop"],
-  ];
   return (
     <>
-      {options
-        .filter(([state]) => supported.includes(state) && state !== environment.desiredPower)
-        .filter(([state]) => (state === "running" ? observed !== "running" : observed === "running" || observed === null))
+      {OPTIONS
+        .filter(([state]) => powerStates.includes(state) && state !== observed)
         .map(([state, label]) => (
           <Button
             key={state}
             variant="outline"
             size="xs"
-            disabled={busy}
+            disabled={power.isPending}
             onClick={() => power.mutate(state)}
           >
             {label}
           </Button>
         ))}
-      {busy && !power.isPending && (
-        <span className="text-xs text-muted-foreground">Converging to {environment.desiredPower}…</span>
-      )}
       {power.error && <span className="text-xs text-destructive">{power.error.message}</span>}
     </>
   );
diff --git a/platform/web/src/components/session/session-resources.tsx b/platform/web/src/components/session/session-resources.tsx
index d999fd41d..a0b903ba0 100644
--- a/platform/web/src/components/session/session-resources.tsx
+++ b/platform/web/src/components/session/session-resources.tsx
@@ -1,7 +1,8 @@
 import type { ReactNode } from "react";
 import { Link } from "react-router-dom";
 import { useQuery } from "@tanstack/react-query";
-import { api, type Environment } from "@/api";
+import { api } from "@/api";
+import { openEnvironmentsQuery } from "@/lib/environments";
 import type { McpServerOption, WorkspaceOption } from "@/components/session/session-config-editor";
 import { Clock3, Code2, FolderOpen, Globe2, Network, Server, Settings2, Wrench, type LucideIcon } from "lucide-react";
 import { sessionResources, type ResourceTone, type SessionResources } from "@/lib/sessions/session-resources";
@@ -23,7 +24,8 @@ const ENV_STATUS: Record<string, string> = {
   suspended: "Suspended · wakes on use",
   stopped: "Stopped · wakes on use",
   provisioning: "Provisioning",
-  booting: "Booting",
+  unknown: "Status unknown",
+  away: "Daemon disconnected",
   closing: "Closing",
   closed: "Closed",
   failed: "Failed",
@@ -39,8 +41,7 @@ const MCP_STATUS: Record<string, string> = {
 /// machine waking or failing shows without a reload.
 export function useSessionResources(universeId: string, config: unknown, activeEnvironmentId: string | null | undefined, enabled: boolean) {
   const environments = useQuery({
-    queryKey: ["environments", universeId],
-    queryFn: () => api<Environment[]>("GET", `/api/v1/universes/${universeId}/environments`),
+    ...openEnvironmentsQuery(universeId),
     enabled,
     refetchInterval: enabled ? 30_000 : false,
   });
@@ -95,7 +96,7 @@ export function SessionResourceChips({ resources, slug, onConfigure }: {
             : environments.items.map((item) => (
               <Row key={item.key} tone={item.tone}
                 primary={item.label}
-                secondary={[item.status ? ENV_STATUS[item.status] ?? item.status : "Not in this universe's list", item.access && `${item.access} access`].filter(Boolean).join(" · ")}
+                secondary={[item.status ? ENV_STATUS[item.status] ?? item.status : "Closed or not in this universe's list", item.access && `${item.access} access`].filter(Boolean).join(" · ")}
                 badges={[item.active && "Active", item.isDefault && "Default"]} />
             ))}
           {(environments.instructions || environments.skills) && (
diff --git a/platform/web/src/components/session/session-settings-sheet.tsx b/platform/web/src/components/session/session-settings-sheet.tsx
index 69b4219de..3d2de152b 100644
--- a/platform/web/src/components/session/session-settings-sheet.tsx
+++ b/platform/web/src/components/session/session-settings-sheet.tsx
@@ -40,6 +40,7 @@ import {
   DialogTitle,
 } from "@/components/ui/dialog";
 import { useSessionConfigEditorOptions } from "@/lib/sessions/editor-options";
+import { environmentName, openEnvironmentsQuery } from "@/lib/environments";
 import {
   hasSessionFeature,
   isActivatableEnvironmentStatus,
@@ -118,11 +119,7 @@ function LiveSessionSetup({
     ),
     enabled,
   });
-  const environments = useQuery({
-    queryKey: ["environments", universeId],
-    queryFn: () => api<Environment[]>("GET", `/api/v1/universes/${universeId}/environments`),
-    enabled,
-  });
+  const environments = useQuery({ ...openEnvironmentsQuery(universeId), enabled });
   const [configDraft, setConfigDraft] = useState<SessionConfig | undefined>();
   const [originalConfig, setOriginalConfig] = useState<SessionConfig | undefined>();
   const [instructionsDraft, setInstructionsDraft] = useState<string | undefined>();
@@ -583,10 +580,7 @@ function activeEnvironmentSelectionError(
 }
 
 function environmentLabel(environment: Environment): string {
-  return `${environment.displayName
-    ?? environment.incarnation.templateId
-    ?? environment.incarnation.providerTargetId
-    ?? environment.environmentId} (${environment.environmentId})`;
+  return `${environmentName(environment)} (${environment.environmentId})`;
 }
 
 function sameConfig(left: SessionConfig | undefined, right: SessionConfig | undefined): boolean {
diff --git a/platform/web/src/demo/fixtures/builders.ts b/platform/web/src/demo/fixtures/builders.ts
index a1d489d2e..a7965df33 100644
--- a/platform/web/src/demo/fixtures/builders.ts
+++ b/platform/web/src/demo/fixtures/builders.ts
@@ -5,6 +5,7 @@
 /// clocks, ids, tool calls as transcripts show them, records with their
 /// defaults, bot event logs, bot state — lives here.
 import type {
+  Environment,
   EnvironmentProviderBinding,
   EnvironmentTemplate,
   ManagedWorkflowTool,
@@ -39,6 +40,10 @@ import type {
   ChatActivation,
   ChatAccess,
   ChatScope,
+  EnvironmentCloseReasonView,
+  EnvironmentIdentityModeView,
+  EnvironmentIdlePolicyView,
+  EnvironmentPowerStateView,
   ModelConfig,
   PollCursorSpec,
   PollCursorState,
@@ -443,26 +448,23 @@ export function workspace(store: DemoStore, universe: UniverseState, init: Works
 export interface ProviderBindingInit {
   /// Defaults to the platform's Incus provider.
   providerId?: string;
-  revision: number;
-  metadata?: Record<string, string>;
   createdAtMs: number;
   updatedAtMs: number;
 }
 
 /// The universe's enabled binding to an operator-registered provider.
 export function providerBinding(init: ProviderBindingInit): EnvironmentProviderBinding {
-  const providerId = init.providerId ?? INCUS_PROVIDER_ID;
   return {
-    bindingId: providerId,
-    providerId,
-    status: "enabled",
-    revision: init.revision,
-    ...(init.metadata === undefined ? {} : { metadata: init.metadata }),
+    providerId: init.providerId ?? INCUS_PROVIDER_ID,
+    enabled: true,
     createdAtMs: init.createdAtMs,
     updatedAtMs: init.updatedAtMs,
   };
 }
 
+/// The Incus provider's power states; it has no suspend.
+export const DEMO_POWER_STATES: EnvironmentPowerStateView[] = ["running", "paused", "stopped"];
+
 export interface TemplateInit {
   /// Defaults to the platform's Incus provider.
   providerId?: string;
@@ -471,23 +473,154 @@ export interface TemplateInit {
   description: string;
   publicIngress: boolean;
   deprecated: boolean;
+  /// The provider's idle policy for targets created without an override.
+  idle?: EnvironmentIdlePolicyView;
   metadata: Record<string, string>;
 }
 
 export function template(init: TemplateInit): EnvironmentTemplate {
-  const providerId = init.providerId ?? INCUS_PROVIDER_ID;
   return {
-    bindingId: providerId,
-    providerId,
+    providerId: init.providerId ?? INCUS_PROVIDER_ID,
     templateId: init.templateId,
     displayName: init.displayName,
     description: init.description,
     publicIngress: init.publicIngress,
     deprecated: init.deprecated,
+    powerStates: DEMO_POWER_STATES,
+    ...(init.idle ? { idle: init.idle } : {}),
     metadata: init.metadata,
   };
 }
 
+/// The display status the core derives from an environment's state and the
+/// provider's or daemon's latest observation.
+export function displayStatus(environment: Omit<Environment, "status">): Environment["status"] {
+  switch (environment.state) {
+    case "provisioning":
+    case "closing":
+    case "closed":
+    case "failed":
+      return environment.state;
+    case "open":
+      break;
+  }
+  const source = environment.source;
+  if (source.type === "external") return "ready";
+  if (source.type === "registered") return source.connected ? "ready" : "away";
+  const observed = source.observed;
+  if (!observed) return "ready";
+  switch (observed.phase) {
+    case "active":
+      return observed.power === "paused" || observed.power === "suspended" || observed.power === "stopped"
+        ? observed.power
+        : "ready";
+    case "provisioning":
+    case "closing":
+      return observed.phase;
+    default:
+      return "unknown";
+  }
+}
+
+const DEMO_DAEMON = { version: "0.1.0", protocolVersion: 4 };
+
+interface EnvironmentInit {
+  environmentId: string;
+  displayName?: string | null;
+  metadata?: Record<string, string>;
+  createdAtMs: number;
+  updatedAtMs: number;
+  /// Closed at this time; open when absent.
+  closedAtMs?: number;
+  closeReason?: EnvironmentCloseReasonView;
+}
+
+function lifecycle(init: EnvironmentInit) {
+  const closed = init.closedAtMs !== undefined;
+  return {
+    environmentId: init.environmentId,
+    displayName: init.displayName ?? null,
+    state: closed ? "closed" as const : "open" as const,
+    ...(closed ? { closeReason: init.closeReason ?? "requested", closedAtMs: init.closedAtMs } : {}),
+    stateChangedAtMs: init.closedAtMs ?? init.createdAtMs,
+    daemon: DEMO_DAEMON,
+    metadata: init.metadata ?? {},
+    createdAtMs: init.createdAtMs,
+    updatedAtMs: init.updatedAtMs,
+  };
+}
+
+export interface ProvisionedEnvironmentInit extends EnvironmentInit {
+  requestId: string;
+  /// Defaults to the platform's Incus provider.
+  providerId?: string;
+  templateId: string;
+  targetId: string;
+  /// What the provider last reported; running when absent.
+  power?: EnvironmentPowerStateView;
+  publicEndpoint?: string;
+  idle?: EnvironmentIdlePolicyView;
+}
+
+export function provisionedEnvironment(init: ProvisionedEnvironmentInit): Environment {
+  const closed = init.closedAtMs !== undefined;
+  const environment: Omit<Environment, "status"> = {
+    ...lifecycle(init),
+    requestId: init.requestId,
+    source: {
+      type: "provisioned",
+      providerId: init.providerId ?? INCUS_PROVIDER_ID,
+      templateId: init.templateId,
+      targetId: init.targetId,
+      ...(init.idle ? { idle: init.idle } : {}),
+      observed: closed
+        ? { phase: "closed", observedAtMs: init.closedAtMs! }
+        : { phase: "active", power: init.power ?? "running", observedAtMs: init.updatedAtMs },
+      ...(init.publicEndpoint && !closed ? { publicEndpoint: init.publicEndpoint } : {}),
+    },
+  };
+  return { ...environment, status: displayStatus(environment) };
+}
+
+export interface ExternalEnvironmentInit extends EnvironmentInit {
+  requestId: string;
+  endpoint: string;
+}
+
+export function externalEnvironment(init: ExternalEnvironmentInit): Environment {
+  const environment: Omit<Environment, "status"> = {
+    ...lifecycle(init),
+    requestId: init.requestId,
+    source: { type: "external", endpoint: init.endpoint },
+  };
+  return { ...environment, status: displayStatus(environment) };
+}
+
+export interface RegisteredEnvironmentInit extends EnvironmentInit {
+  registrationKeyId: string;
+  daemonId: string;
+  identityMode: EnvironmentIdentityModeView;
+  connected: boolean;
+  connectionChangedAtMs: number;
+  lastSeenAtMs: number;
+}
+
+export function registeredEnvironment(init: RegisteredEnvironmentInit): Environment {
+  const environment: Omit<Environment, "status"> = {
+    ...lifecycle(init),
+    source: {
+      type: "registered",
+      registrationKeyId: init.registrationKeyId,
+      daemonId: init.daemonId,
+      identityMode: init.identityMode,
+      connected: init.connected,
+      connectionChangedAtMs: init.connectionChangedAtMs,
+      lastSeenAtMs: init.lastSeenAtMs,
+    },
+  };
+  return { ...environment, status: displayStatus(environment) };
+}
+
 export type McpServerInit = Partial<McpServer> &
   Pick<McpServer, "serverId" | "serverUrl" | "authPolicy" | "status" | "createdAtMs" | "updatedAtMs">;
 
diff --git a/platform/web/src/demo/fixtures/personal-assistant.ts b/platform/web/src/demo/fixtures/personal-assistant.ts
index 33b7ba4d5..b10f3d404 100644
--- a/platform/web/src/demo/fixtures/personal-assistant.ts
+++ b/platform/web/src/demo/fixtures/personal-assistant.ts
@@ -6,7 +6,7 @@
 /// writes, delegates research to a second bot that runs sub-agents, and
 /// takes the Monday numbers from a metrics bot — the personal-agent pattern
 /// built from bots, triggers, workspaces, skills, and one Mac mini at home.
-import type { Environment, SecretGrant, UniverseSetup } from "@/api";
+import type { SecretGrant, UniverseSetup } from "@/api";
 import type { SessionSummaryView } from "@lightspeed-ai/sdk";
 import { appendExchange, appendScriptedRun, closeSession, newSession, refreshDemoCompactionView } from "../engine";
 import { universeApiKey, type DemoResponder, type DemoStore, type DemoToolCall, type DemoTurn, type SessionRecord, type UniverseState } from "../store";
@@ -53,7 +53,9 @@ import {
   modelProvider,
   pollTrigger,
   profile,
+  externalEnvironment,
   providerBinding,
+  registeredEnvironment,
   receipt,
   recent,
   runCommand,
@@ -71,7 +73,7 @@ import {
   type ScriptedEvent,
   mcpDisplay,
 } from "./builders";
-import { INCUS_PROVIDER_ID, TELEGRAM_ADA_ACCOUNT_ID, WHATSAPP_ADA_ACCOUNT_ID } from "./platform";
+import { TELEGRAM_ADA_ACCOUNT_ID, WHATSAPP_ADA_ACCOUNT_ID } from "./platform";
 
 export const PERSONAL_ASSISTANT_UNIVERSE_ID = "33333333-3333-4333-8333-333333333333";
 export const PERSONAL_ASSISTANT_SLUG = "personal-assistant";
@@ -872,23 +874,11 @@ function seedWorkspaces(store: DemoStore, universe: UniverseState): void {
 }
 
 function seedEnvironments(universe: UniverseState): void {
-  const macMini: Environment = {
+  universe.environments.set(ENV_MAC_MINI, externalEnvironment({
     environmentId: ENV_MAC_MINI,
     requestId: `req-${hex("ada-mac-mini", 12)}`,
-    source: {
-      type: "external",
-      endpoint: "ws://mac-mini.tailnet:19091",
-    },
+    endpoint: "ws://mac-mini.tailnet:19091",
     displayName: "Mac mini (home)",
-    status: "ready",
-    desiredPower: "running",
-    incarnation: {
-      incarnationId: `inc-${hex("ada-mac-mini-inc", 10)}`,
-      createdAtMs: ago(35 * DAY_MS),
-      updatedAtMs: ago(HOUR_MS + 42 * MINUTE_MS),
-    },
-    publicIngressEnabled: false,
-    publicEndpoint: null,
     metadata: {
       owner: "ada",
       os: "macOS 15",
@@ -897,12 +887,11 @@ function seedEnvironments(universe: UniverseState): void {
     },
     createdAtMs: ago(35 * DAY_MS),
     updatedAtMs: ago(HOUR_MS + 42 * MINUTE_MS),
-  };
-  universe.environments.set(ENV_MAC_MINI, macMini);
+  }));
 
   // A registration key is the group of the daemons it admitted: Ada's
   // laptop dials in from wherever she is, keeps its identity in its state
-  // directory, and simply shows as offline while the lid is closed.
+  // directory, and simply shows as disconnected while the lid is closed.
   const homeDevicesKey = "registration_key_home_devices";
   universe.registrationKeys.push({
     registrationKeyId: homeDevicesKey,
@@ -915,40 +904,22 @@ function seedEnvironments(universe: UniverseState): void {
     activeEnvironmentCount: 1,
     lastRegisteredAtMs: ago(9 * DAY_MS),
     createdAtMs: ago(9 * DAY_MS),
+    updatedAtMs: ago(9 * DAY_MS),
   });
-  const laptopDaemonId = `daemon_${hex("ada-laptop-daemon", 64)}`;
-  universe.environments.set("env-ada-laptop", {
+  universe.environments.set("env-ada-laptop", registeredEnvironment({
     environmentId: "env-ada-laptop",
-    requestId: `daemon:${laptopDaemonId}`,
-    source: {
-      type: "registered",
-      registrationKeyId: homeDevicesKey,
-      daemonId: laptopDaemonId,
-      identityMode: "persistent",
-    },
-    displayName: "Ada's laptop",
-    status: "offline",
-    desiredPower: "running",
-    incarnation: {
-      incarnationId: `inc-${hex("ada-laptop-inc", 10)}`,
-      createdAtMs: ago(9 * DAY_MS),
-      updatedAtMs: ago(3 * HOUR_MS),
-    },
-    publicIngressEnabled: false,
-    publicEndpoint: null,
-    metadata: {
-      "envd.os": "macos",
-      "envd.arch": "arm64",
-      "lightspeed.envd.version": "0.1.0",
-    },
+    registrationKeyId: homeDevicesKey,
+    daemonId: `daemon_${hex("ada-laptop-daemon", 64)}`,
+    identityMode: "persistent",
+    connected: false,
+    connectionChangedAtMs: ago(3 * HOUR_MS),
     lastSeenAtMs: ago(3 * HOUR_MS),
+    displayName: "Ada's laptop",
     createdAtMs: ago(9 * DAY_MS),
     updatedAtMs: ago(3 * HOUR_MS),
-  });
+  }));
   universe.providerBindings.push(
     providerBinding({
-      revision: 1,
-      metadata: { project: "personal-assistant", note: "enabled for provisioned sandboxes; nothing uses it yet" },
       createdAtMs: ago(24 * DAY_MS),
       updatedAtMs: ago(24 * DAY_MS),
     }),
diff --git a/platform/web/src/demo/fixtures/platform.ts b/platform/web/src/demo/fixtures/platform.ts
index 6c4f00ba7..2b8191a93 100644
--- a/platform/web/src/demo/fixtures/platform.ts
+++ b/platform/web/src/demo/fixtures/platform.ts
@@ -66,9 +66,8 @@ export function seedPlatform(store: DemoStore): void {
     providerId: INCUS_PROVIDER_ID,
     displayName: "Incus (eu-1)",
     controllerEndpoint: "wss://incus-eu-1.lightspeed.demo:19090/control",
-    controllerFeatures: { adoptTarget: true, ingress: true },
-    dataRouteBase: "wss://incus-eu-1.lightspeed.demo:19090/routes",
-    metadata: { region: "eu-1", mode: "cluster" },
+    effectiveDataRouteBase: "wss://incus-eu-1.lightspeed.demo:19090/routes",
+    hasCredential: true,
     createdAtMs: Date.parse("2026-06-05T12:00:00.000Z"),
     updatedAtMs: Date.parse("2026-08-10T09:00:00.000Z"),
   });
diff --git a/platform/web/src/demo/fixtures/software-factory.ts b/platform/web/src/demo/fixtures/software-factory.ts
index a80c7e877..1a99aa4b5 100644
--- a/platform/web/src/demo/fixtures/software-factory.ts
+++ b/platform/web/src/demo/fixtures/software-factory.ts
@@ -45,7 +45,9 @@ import {
   modelProvider,
   pollTrigger,
   profile,
+  externalEnvironment,
   providerBinding,
+  provisionedEnvironment,
   readFile,
   recent,
   runCommand,
@@ -63,7 +65,6 @@ import {
   type ScriptedEvent,
   mcpDisplay,
 } from "./builders";
-import { INCUS_PROVIDER_ID } from "./platform";
 
 export const SOFTWARE_FACTORY_UNIVERSE_ID = "11111111-1111-4111-8111-111111111111";
 export const SOFTWARE_FACTORY_SLUG = "software-factory";
@@ -1019,7 +1020,7 @@ A Linear issue becomes pull requests without a person in the loop until review:
 2. **planner** — splits the spec into independent tasks in \`/specs/<ISSUE>-plan.md\`
    and emits one \`task.ready\` per task.
 3. **implementer** — one keyed session per task (\`task.id\`), each in its own Incus
-   sandbox that closes with the session. Sub-agents: repo-explorer (read-only),
+   sandbox environment, created for the task and closed when it is done. Sub-agents: repo-explorer (read-only),
    test-writer. Opens the PR and emits \`pr.opened\`.
 4. **ci-watch** — polls Actions every two minutes; a failure on a task branch is
    steered into the implementer's running task and told to pr-reviewer.
@@ -1202,8 +1203,6 @@ function seedWorkspaces(store: DemoStore, universe: UniverseState): void {
 // Environments
 // ---------------------------------------------------------------------------
 
-const POWER_STATES: Environment["desiredPower"][] = ["running", "paused", "stopped"];
-
 interface SandboxInit {
   id: string;
   displayName: string;
@@ -1214,37 +1213,22 @@ interface SandboxInit {
 
 /// An independently managed sandbox selected by task sessions.
 function sandbox(init: SandboxInit): Environment {
-  const requestId = `req-${hex(init.id, 12)}`;
-  const updatedAtMs = init.closedAtMs ?? init.createdAtMs + 3 * MINUTE_MS;
-  return {
+  return provisionedEnvironment({
     environmentId: init.id,
-    requestId,
-    source: { type: "provisioned", providerId: INCUS_PROVIDER_ID, bindingId: INCUS_PROVIDER_ID },
+    requestId: `req-${hex(init.id, 12)}`,
+    templateId: "dev-small-v1",
+    targetId: `ls-${init.id.slice(4)}-${hex(init.id, 6)}`,
     displayName: init.displayName,
-    status: init.closedAtMs === undefined ? "ready" : "closed",
-    desiredPower: init.closedAtMs === undefined ? "running" : "stopped",
-    idlePolicy: { pauseAfterMs: 15 * MINUTE_MS, stopAfterMs: 2 * HOUR_MS },
-    incarnation: {
-      incarnationId: `inc-${hex(`${init.id}-inc`, 10)}`,
-      provisionRequestId: requestId,
-      providerTargetId: `ls-${init.id.slice(4)}-${hex(init.id, 6)}`,
-      templateId: "dev-small-v1",
-      powerStates: POWER_STATES,
-      createdAtMs: init.createdAtMs,
-      updatedAtMs,
-    },
-    publicIngressEnabled: false,
     metadata: { repo: "acme/acme-web", checkout: "main", issue: ISSUE },
     createdAtMs: init.createdAtMs,
-    updatedAtMs,
-  };
+    updatedAtMs: init.closedAtMs ?? init.createdAtMs + 3 * MINUTE_MS,
+    ...(init.closedAtMs === undefined ? {} : { closedAtMs: init.closedAtMs }),
+  });
 }
 
 function seedEnvironments(universe: UniverseState): void {
   universe.providerBindings.push(
     providerBinding({
-      revision: 2,
-      metadata: { project: "acme", network: "lightspeed-envs" },
       createdAtMs: ago(50 * DAY_MS),
       updatedAtMs: ago(17 * DAY_MS),
     }),
@@ -1256,6 +1240,7 @@ function seedEnvironments(universe: UniverseState): void {
       description: "2 vCPU / 4 GiB, Git, Node 22, Docker, envd. The default for task sandboxes.",
       publicIngress: true,
       deprecated: false,
+      idle: { pauseAfterMs: 15 * MINUTE_MS, stopAfterMs: 2 * HOUR_MS },
       metadata: { cpu: "2", memory: "4GiB", disk: "40GiB", image: "acme/dev:2026.08" },
     }),
     template({
@@ -1276,72 +1261,38 @@ function seedEnvironments(universe: UniverseState): void {
     }),
   );
 
-  const ciRequestId = `req-${hex("ci-runner", 12)}`;
-  universe.environments.set(ENV.ci, {
+  universe.environments.set(ENV.ci, provisionedEnvironment({
     environmentId: ENV.ci,
-    requestId: ciRequestId,
-    source: { type: "provisioned", providerId: INCUS_PROVIDER_ID, bindingId: INCUS_PROVIDER_ID },
+    requestId: `req-${hex("ci-runner", 12)}`,
+    templateId: "dev-small-v1",
+    targetId: "ls-ci-runner-4e1d9b",
     displayName: "CI runner",
-    status: "ready",
-    desiredPower: "running",
-    idlePolicy: { pauseAfterMs: 30 * MINUTE_MS, stopAfterMs: 6 * HOUR_MS },
-    incarnation: {
-      incarnationId: `inc-${hex("ci-runner-inc", 10)}`,
-      provisionRequestId: ciRequestId,
-      providerTargetId: "ls-ci-runner-4e1d9b",
-      templateId: "dev-small-v1",
-      powerStates: POWER_STATES,
-      createdAtMs: ago(30 * DAY_MS),
-      updatedAtMs: p(13),
-    },
-    publicIngressEnabled: true,
+    idle: { pauseAfterMs: 30 * MINUTE_MS, stopAfterMs: 6 * HOUR_MS },
     publicEndpoint: "https://ci-runner-4e1d9b.env.acme.example",
     metadata: { role: "ci", repo: "acme/acme-web", team: "platform" },
     createdAtMs: ago(30 * DAY_MS),
     updatedAtMs: p(13),
-  });
-  universe.environments.set(ENV.laptop, {
+  }));
+  universe.environments.set(ENV.laptop, externalEnvironment({
     environmentId: ENV.laptop,
     requestId: `req-${hex("priya-laptop", 12)}`,
-    source: {
-      type: "external",
-      endpoint: "ws://priya-mbp.tailnet.acme.example:19091",
-    },
+    endpoint: "ws://priya-mbp.tailnet.acme.example:19091",
     displayName: "Priya's laptop (envd)",
-    status: "ready",
-    desiredPower: "running",
-    incarnation: {
-      incarnationId: `inc-${hex("priya-laptop-inc", 10)}`,
-      createdAtMs: ago(20 * DAY_MS),
-      updatedAtMs: ago(25 * MINUTE_MS),
-    },
-    publicIngressEnabled: false,
     metadata: { owner: "priya", os: "macOS 15" },
     createdAtMs: ago(20 * DAY_MS),
     updatedAtMs: ago(25 * MINUTE_MS),
-  });
-  const oldRequestId = `req-${hex("old-sandbox", 12)}`;
-  universe.environments.set(ENV.old, {
+  }));
+  universe.environments.set(ENV.old, provisionedEnvironment({
     environmentId: ENV.old,
-    requestId: oldRequestId,
-    source: { type: "provisioned", providerId: INCUS_PROVIDER_ID, bindingId: INCUS_PROVIDER_ID },
+    requestId: `req-${hex("old-sandbox", 12)}`,
+    templateId: "dev-small-v0",
+    targetId: "ls-sandbox-9f8e7d",
     displayName: "repo-explorer sandbox",
-    status: "closed",
-    desiredPower: "stopped",
-    incarnation: {
-      incarnationId: `inc-${hex("old-sandbox-inc", 10)}`,
-      provisionRequestId: oldRequestId,
-      providerTargetId: "ls-sandbox-9f8e7d",
-      templateId: "dev-small-v0",
-      powerStates: POWER_STATES,
-      createdAtMs: ago(33 * DAY_MS + 2 * HOUR_MS),
-      updatedAtMs: ago(33 * DAY_MS),
-    },
-    publicIngressEnabled: false,
     metadata: { repo: "acme/acme-web", checkout: "main" },
     createdAtMs: ago(33 * DAY_MS + 2 * HOUR_MS),
     updatedAtMs: ago(33 * DAY_MS),
-  });
+    closedAtMs: ago(33 * DAY_MS),
+  }));
   universe.environments.set(ENV.taskA, sandbox({ id: ENV.taskA, displayName: "implementer sandbox · lin-1421-a", createdAtMs: p(2.1), closedAtMs: p(4.9) }));
   universe.environments.set(ENV.taskB, sandbox({ id: ENV.taskB, displayName: "implementer sandbox · lin-1421-b", createdAtMs: p(2.1), closedAtMs: p(12.4) }));
   universe.environments.set(ENV.taskC, sandbox({ id: ENV.taskC, displayName: "implementer sandbox · lin-1421-c", createdAtMs: p(2.1) }));
diff --git a/platform/web/src/demo/fixtures/technical-support.ts b/platform/web/src/demo/fixtures/technical-support.ts
index f83b8f51f..f0fba56f5 100644
--- a/platform/web/src/demo/fixtures/technical-support.ts
+++ b/platform/web/src/demo/fixtures/technical-support.ts
@@ -5,7 +5,7 @@
 /// that files minimal-repro issues, while a status watcher and the on-call
 /// bot it pages keep the helpdesk briefed during incidents — bot federation
 /// end to end, plus the profiles, KB, environment, and integrations behind it.
-import type { Environment, GitHubApp, SecretGrant } from "@/api";
+import type { GitHubApp, SecretGrant } from "@/api";
 import { appendScriptedRun, newSession } from "../engine";
 import { universeApiKey, type DemoResponder, type DemoStore, type DemoToolCall, type DemoTurn, type UniverseState } from "../store";
 import {
@@ -50,6 +50,7 @@ import {
   pollTrigger,
   profile,
   providerBinding,
+  provisionedEnvironment,
   recent,
   runCommand,
   scheduleTrigger,
@@ -711,33 +712,21 @@ function seedWorkspaces(store: DemoStore, universe: UniverseState): void {
 }
 
 function seedEnvironments(universe: UniverseState): void {
-  const requestId = `req-${hex("support-tools", 12)}`;
-  const environment: Environment = {
+  universe.environments.set(ENV_SUPPORT_TOOLS, provisionedEnvironment({
     environmentId: ENV_SUPPORT_TOOLS,
-    requestId,
-    source: { type: "provisioned", providerId: "incus-eu-1", bindingId: "incus-eu-1" },
+    requestId: `req-${hex("support-tools", 12)}`,
+    providerId: "incus-eu-1",
+    templateId: "dev-small-v1",
+    targetId: "ls-support-tools-7b2e91",
     displayName: "Support tools",
-    status: "paused",
-    desiredPower: "paused",
-    idlePolicy: { pauseAfterMs: 30 * MINUTE_MS, stopAfterMs: 12 * HOUR_MS },
-    incarnation: {
-      incarnationId: `inc-${hex("support-tools-inc", 10)}`,
-      provisionRequestId: requestId,
-      providerTargetId: "ls-support-tools-7b2e91",
-      templateId: "dev-small-v1",
-      powerStates: ["running", "paused", "stopped"],
-      createdAtMs: ago(29 * DAY_MS),
-      updatedAtMs: ago(2 * HOUR_MS + 6 * MINUTE_MS),
-    },
-    publicIngressEnabled: false,
-    publicEndpoint: null,
+    power: "paused",
+    idle: { pauseAfterMs: 30 * MINUTE_MS, stopAfterMs: 12 * HOUR_MS },
     metadata: { role: "support-tooling", tools: "nw (sandbox + read-only production key), slack, jq, curl" },
     createdAtMs: ago(29 * DAY_MS),
     updatedAtMs: ago(2 * HOUR_MS + 6 * MINUTE_MS),
-  };
-  universe.environments.set(ENV_SUPPORT_TOOLS, environment);
+  }));
   universe.providerBindings.push(
-    providerBinding({ revision: 2, metadata: { project: "technical-support" }, createdAtMs: ago(30 * DAY_MS), updatedAtMs: ago(30 * DAY_MS) }),
+    providerBinding({ createdAtMs: ago(30 * DAY_MS), updatedAtMs: ago(30 * DAY_MS) }),
   );
   universe.environmentTemplates.push(
     template({
diff --git a/platform/web/src/demo/router.test.ts b/platform/web/src/demo/router.test.ts
index 531620dbe..742428fa4 100644
--- a/platform/web/src/demo/router.test.ts
+++ b/platform/web/src/demo/router.test.ts
@@ -632,7 +632,7 @@ describe("demo router", () => {
   it("session start, close, and deletion leave environments independently managed", async () => {
     const { call, store } = await boot();
     const base = `/api/v1/universes/${SOFTWARE_FACTORY_UNIVERSE_ID}`;
-    const before = (await call("GET", `${base}/environments`)).json as Environment[];
+    const before = ((await call("GET", `${base}/environments`)).json as { environments: Environment[] }).environments;
     const profile = (await call("GET", `${base}/profiles/implementer`)).json as { config: unknown };
     const existing = before.find((environment) => environment.environmentId === defaultEnvironmentAttachment(profile.config)?.environmentId)!;
     expect(existing).toBeDefined();
@@ -641,7 +641,7 @@ describe("demo router", () => {
     });
     expect(created.status).toBe(200);
     const session = created.json as SessionView;
-    expect(((await call("GET", `${base}/environments`)).json as Environment[]).map((env) => env.environmentId))
+    expect((((await call("GET", `${base}/environments`)).json as { environments: Environment[] }).environments).map((env) => env.environmentId))
       .toEqual(before.map((env) => env.environmentId));
     expect((await call("POST", `${base}/sessions/${session.id}/close`, { force: true })).status).toBe(200);
     expect(store.auditEvents.filter((event) => event.targetId === session.id)).toEqual([]);
@@ -656,7 +656,7 @@ describe("demo router", () => {
     expect(store.deletedSessions.size).toBe(0);
     const audit = (await call("GET", "/api/v1/admin/audit")).json as { action: string; targetId: string }[];
     expect(audit.filter((event) => event.targetId === session.id).map((event) => event.action)).toEqual(["session.purge"]);
-    const after = (await call("GET", `${base}/environments`)).json as Environment[];
+    const after = ((await call("GET", `${base}/environments`)).json as { environments: Environment[] }).environments;
     expect(after.find((env) => env.environmentId === existing.environmentId)).toEqual(existing);
   });
 
@@ -665,7 +665,7 @@ describe("demo router", () => {
     const base = `/api/v1/universes/${SOFTWARE_FACTORY_UNIVERSE_ID}`;
     const profile = (await call("GET", `${base}/profiles/implementer`)).json as { config: Record<string, unknown> };
     const defaultId = defaultEnvironmentAttachment(profile.config)!.environmentId!;
-    const environments = (await call("GET", `${base}/environments`)).json as Environment[];
+    const environments = ((await call("GET", `${base}/environments`)).json as { environments: Environment[] }).environments;
     const other = environments.find((environment) => environment.environmentId !== defaultId && environment.status === "ready")!;
     expect(other).toBeDefined();
     const created = (await call("POST", `${base}/sessions`, { profile: { kind: "named", profileId: "implementer" } })).json as SessionView;
diff --git a/platform/web/src/demo/routes/admin.ts b/platform/web/src/demo/routes/admin.ts
index 429d370b5..26ac6fa95 100644
--- a/platform/web/src/demo/routes/admin.ts
+++ b/platform/web/src/demo/routes/admin.ts
@@ -10,18 +10,20 @@ import type {
   MethodGroup,
 } from "@lightspeed-ai/sdk";
 import { groupsFor } from "@/lib/method-groups";
+import { DEMO_POWER_STATES } from "../fixtures/builders";
 import type { DemoStore, UniverseState } from "../store";
 import { badRequest, conflict, notFound, readBody } from "./common";
 
 /// What a fresh binding provisions from when no other universe already
 /// lists this provider's templates.
-const DEFAULT_TEMPLATES: Array<Omit<EnvironmentTemplate, "providerId" | "bindingId">> = [
+const DEFAULT_TEMPLATES: Array<Omit<EnvironmentTemplate, "providerId">> = [
   {
     templateId: "dev-small-v1",
     displayName: "Development VM (small)",
     description: "2 vCPU / 4 GiB, Git, Docker, common toolchains, envd.",
     publicIngress: true,
     deprecated: false,
+    powerStates: DEMO_POWER_STATES,
     metadata: { cpu: "2", memory: "4GiB", disk: "40GiB" },
   },
   {
@@ -30,29 +32,24 @@ const DEFAULT_TEMPLATES: Array<Omit<EnvironmentTemplate, "providerId" | "binding
     description: "8 vCPU / 16 GiB, same image as small.",
     publicIngress: true,
     deprecated: false,
+    powerStates: DEMO_POWER_STATES,
     metadata: { cpu: "8", memory: "16GiB", disk: "120GiB" },
   },
 ];
 
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
 function optionalString(value: unknown): string | undefined {
   return typeof value === "string" && value.trim() ? value.trim() : undefined;
 }
 
-function stringMetadata(value: unknown): Record<string, string> {
-  const metadata: Record<string, string> = {};
-  if (!isRecord(value)) return metadata;
-  for (const [key, entry] of Object.entries(value)) {
-    if (typeof entry === "string") metadata[key] = entry;
-  }
-  return metadata;
-}
-
 /// The controller URL schemes the engine accepts.
 const CONTROLLER_ENDPOINT = /^(wss?:\/\/|unix:\/\/\/)[^\s]+$/;
+const DATA_ROUTE_BASE = /^wss?:\/\/[^\s]+$/;
+
+/// The base the core derives from a ws:// or wss:// controller endpoint.
+function derivedDataRouteBase(controllerEndpoint: string): string | null {
+  const match = /^(wss?:\/\/[^/\s]+)/.exec(controllerEndpoint);
+  return match ? `${match[1]}/routes` : null;
+}
 
 /// The admin page addresses universes by their engine id; the platform id
 /// resolves too so either spelling works.
@@ -69,17 +66,13 @@ function universeByAnyId(store: DemoStore, id: string): UniverseState | null {
 /// what the provider offers elsewhere (or the default set) so a newly bound
 /// universe can provision right away.
 function seedTemplates(store: DemoStore, universe: UniverseState, binding: EnvironmentProviderBinding): void {
-  let source: Array<Omit<EnvironmentTemplate, "providerId" | "bindingId">> = [];
+  let source: Array<Omit<EnvironmentTemplate, "providerId">> = [];
   for (const other of store.universes.values()) {
     source = other.environmentTemplates.filter((template) => template.providerId === binding.providerId);
     if (source.length > 0) break;
   }
   for (const template of source.length > 0 ? source : DEFAULT_TEMPLATES) {
-    universe.environmentTemplates.push({
-      ...template,
-      providerId: binding.providerId,
-      bindingId: binding.bindingId,
-    });
+    universe.environmentTemplates.push({ ...template, providerId: binding.providerId });
   }
 }
 
@@ -149,32 +142,36 @@ export function adminRoutes(store: DemoStore): Hono {
     if (!providerId) return badRequest(c, "providerId is required");
     const body = await readBody<{
       displayName?: unknown;
-      metadata?: unknown;
       controllerEndpoint?: unknown;
+      dataRouteBase?: unknown;
       credential?: unknown;
+      clearCredential?: unknown;
     }>(c);
     const controllerEndpoint = optionalString(body.controllerEndpoint);
     if (!controllerEndpoint || !CONTROLLER_ENDPOINT.test(controllerEndpoint)) {
       return badRequest(c, "controllerEndpoint must be a ws://, wss:// or unix:// URL");
     }
-    const existing = store.environmentProviders.get(providerId);
-    if (!existing && !optionalString(body.credential)) {
-      return badRequest(c, "credential is required for a new provider");
+    const dataRouteBase = optionalString(body.dataRouteBase);
+    if (dataRouteBase && !DATA_ROUTE_BASE.test(dataRouteBase)) {
+      return badRequest(c, "dataRouteBase must be a ws:// or wss:// URL");
+    }
+    if (!dataRouteBase && controllerEndpoint.startsWith("unix://")) {
+      return badRequest(c, "a unix:// controller needs a dataRouteBase");
     }
+    const credential = optionalString(body.credential);
+    if (credential && body.clearCredential === true) {
+      return badRequest(c, "credential and clearCredential are mutually exclusive");
+    }
+    const existing = store.environmentProviders.get(providerId);
     const now = Date.now();
+    const effectiveDataRouteBase = dataRouteBase ?? derivedDataRouteBase(controllerEndpoint);
     const provider: DeploymentEnvironmentProviderView = {
       providerId,
       ...(optionalString(body.displayName) ? { displayName: optionalString(body.displayName) } : {}),
       controllerEndpoint,
-      // The demo has no controller to reach, so a changed endpoint has
-      // not advertised anything yet.
-      ...(existing && existing.controllerEndpoint === controllerEndpoint
-        ? {
-          controllerFeatures: existing.controllerFeatures ?? null,
-          dataRouteBase: existing.dataRouteBase ?? null,
-        }
-        : {}),
-      metadata: stringMetadata(body.metadata),
+      ...(dataRouteBase ? { dataRouteBase } : {}),
+      ...(effectiveDataRouteBase ? { effectiveDataRouteBase } : {}),
+      hasCredential: credential ? true : body.clearCredential === true ? false : existing?.hasCredential ?? false,
       createdAtMs: existing?.createdAtMs ?? now,
       updatedAtMs: now,
     };
@@ -209,36 +206,21 @@ export function adminRoutes(store: DemoStore): Hono {
     ),
   );
 
-  app.put("/admin/universes/:universeId/environment-provider-bindings/:bindingId", async (c) => {
+  app.put("/admin/universes/:universeId/environment-provider-bindings/:providerId", async (c) => {
     const universe = universeByAnyId(store, c.req.param("universeId"));
     if (!universe) return notFound(c);
-    const body = await readBody<{
-      providerId?: unknown;
-      status?: unknown;
-      expectedRevision?: unknown;
-      metadata?: unknown;
-    }>(c);
-    const providerId = optionalString(body.providerId);
-    if (!providerId) return badRequest(c, "providerId is required");
-    if (body.status !== "enabled" && body.status !== "disabled") {
-      return badRequest(c, "status must be enabled or disabled");
-    }
+    const body = await readBody<{ enabled?: unknown }>(c);
+    if (typeof body.enabled !== "boolean") return badRequest(c, "enabled must be a boolean");
+    const providerId = c.req.param("providerId");
     if (!store.environmentProviders.has(providerId)) {
       return notFound(c, `environment provider not found: ${providerId}`);
     }
-    const bindingId = c.req.param("bindingId");
-    const index = universe.providerBindings.findIndex((binding) => binding.bindingId === bindingId);
+    const index = universe.providerBindings.findIndex((binding) => binding.providerId === providerId);
     const existing = universe.providerBindings[index];
-    if (existing && typeof body.expectedRevision === "number" && existing.revision !== body.expectedRevision) {
-      return conflict(c, "binding revision conflict");
-    }
     const now = Date.now();
     const binding: EnvironmentProviderBinding = {
-      bindingId,
       providerId,
-      status: body.status,
-      revision: (existing?.revision ?? 0) + 1,
-      metadata: stringMetadata(body.metadata),
+      enabled: body.enabled,
       createdAtMs: existing?.createdAtMs ?? now,
       updatedAtMs: now,
     };
@@ -251,15 +233,20 @@ export function adminRoutes(store: DemoStore): Hono {
     return c.json(binding);
   });
 
-  app.delete("/admin/universes/:universeId/environment-provider-bindings/:bindingId", (c) => {
+  app.delete("/admin/universes/:universeId/environment-provider-bindings/:providerId", (c) => {
     const universe = universeByAnyId(store, c.req.param("universeId"));
     if (!universe) return notFound(c);
-    const bindingId = c.req.param("bindingId");
-    const index = universe.providerBindings.findIndex((binding) => binding.bindingId === bindingId);
+    const providerId = c.req.param("providerId");
+    const index = universe.providerBindings.findIndex((binding) => binding.providerId === providerId);
     if (index < 0) return notFound(c);
+    const open = [...universe.environments.values()].some((environment) =>
+      environment.source.type === "provisioned"
+      && environment.source.providerId === providerId
+      && environment.state !== "closed");
+    if (open) return conflict(c, "the universe still has open environments of this provider");
     const [binding] = universe.providerBindings.splice(index, 1);
     universe.environmentTemplates = universe.environmentTemplates.filter(
-      (template) => template.bindingId !== bindingId,
+      (template) => template.providerId !== providerId,
     );
     return c.json(binding);
   });
diff --git a/platform/web/src/demo/routes/environments.ts b/platform/web/src/demo/routes/environments.ts
index 39829073e..c44f30c8f 100644
--- a/platform/web/src/demo/routes/environments.ts
+++ b/platform/web/src/demo/routes/environments.ts
@@ -1,73 +1,70 @@
-/// Universe environments: provisioned and external records, the provider
-/// bindings and templates they come from, credential bindings, and a
-/// simulated provider lifecycle (provisioning → booting → ready, closing →
-/// closed, power convergence) so the Environments page has state to watch.
+/// Universe environments: provisioned, external and registered records, the
+/// provider bindings and templates they come from, credential bindings, and a
+/// simulated provider lifecycle (provisioning → open, closing → closed) so
+/// the Environments page has state to watch. Power and ingress are
+/// synchronous provider calls, as in the core.
 import { Hono } from "hono";
 import type { Context } from "hono";
+import type {
+  EnvironmentIdlePolicyView,
+  EnvironmentPowerStateView,
+  EnvironmentStateView,
+} from "@lightspeed-ai/sdk";
 import type {
   Environment,
   EnvironmentCredential,
   EnvironmentCredentialSource,
   EnvironmentRegistrationKey,
 } from "@/api";
+import { displayStatus } from "../fixtures/builders";
 import type { DemoStore, UniverseState } from "../store";
 import { badRequest, conflict, notFound, readBody, universeFor } from "./common";
 
-type PowerState = Environment["desiredPower"];
-type LifecycleStatus = Environment["status"];
-type IdlePolicy = NonNullable<Environment["idlePolicy"]>;
-
-/// What the demo provider advertises once a target is observed — the Incus
-/// provider's set, which has no suspend.
-const DEMO_POWER_STATES: PowerState[] = ["running", "paused", "stopped"];
-
-/// The observed status a converged power intent settles on.
-const POWER_STATUS: Record<PowerState, LifecycleStatus> = {
-  running: "ready",
-  paused: "paused",
-  suspended: "suspended",
-  stopped: "offline",
-};
-
 const IDLE_STAGES = ["pauseAfterMs", "suspendAfterMs", "stopAfterMs", "closeAfterMs"] as const;
 const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
 const ENVD_ENDPOINT = /^(wss?:\/\/|unix:\/\/\/)[^\s]+$/;
 const DEV_ENVD_ENDPOINT = "ws://127.0.0.1:19091";
+const DEMO_DAEMON = { version: "0.1.0", protocolVersion: 4 };
+const LIST_DEFAULT_LIMIT = 100;
 
 export interface ProvisionParams {
   requestId: string;
-  bindingId: string;
+  providerId: string;
   templateId: string;
   displayName?: string | null;
-  idlePolicy?: unknown;
+  idle?: EnvironmentIdlePolicyView | null;
   metadata?: Record<string, unknown>;
 }
 
-/// Pending simulated transitions per environment. A newer intent (close, a
-/// power change) bumps the epoch so stale timers drop instead of overwriting
-/// what the newer intent already settled.
+/// Recompute the derived display status after any write, the way the core's
+/// view derives it on every read.
+function settle(environment: Environment, now = Date.now()): Environment {
+  environment.status = displayStatus(environment);
+  environment.updatedAtMs = now;
+  return environment;
+}
+
+function setState(environment: Environment, state: EnvironmentStateView, now = Date.now()): void {
+  environment.state = state;
+  environment.stateChangedAtMs = now;
+  if (state === "closed") {
+    environment.closedAtMs = now;
+    environment.stateMessage = null;
+  }
+  settle(environment, now);
+}
+
+/// Pending simulated provider work per environment. A close bumps the epoch
+/// so stale provisioning timers drop instead of reopening the row.
 const epochs = new WeakMap<Environment, number>();
 
-function transition(environment: Environment, steps: Array<[LifecycleStatus, number]>): void {
+function schedule(environment: Environment, steps: Array<[number, () => void]>): void {
   const epoch = (epochs.get(environment) ?? 0) + 1;
   epochs.set(environment, epoch);
-  for (const [status, delayMs] of steps) {
+  for (const [delayMs, step] of steps) {
     setTimeout(() => {
-      if (epochs.get(environment) !== epoch || environment.status === "closed") return;
-      const now = Date.now();
-      environment.status = status;
-      environment.updatedAtMs = now;
-      environment.incarnation.updatedAtMs = now;
-      if (status === "booting" && !environment.incarnation.providerTargetId) {
-        environment.incarnation.providerTargetId = `ls-${environment.environmentId}`;
-      }
-      if (
-        status === "ready"
-        && environment.source.type === "provisioned"
-        && !environment.incarnation.powerStates?.length
-      ) {
-        environment.incarnation.powerStates = [...DEMO_POWER_STATES];
-      }
+      if (epochs.get(environment) !== epoch || environment.state === "closed") return;
+      step();
     }, delayMs);
   }
 }
@@ -76,7 +73,7 @@ function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
-function isPowerState(value: unknown): value is PowerState {
+function isPowerState(value: unknown): value is EnvironmentPowerStateView {
   return value === "running" || value === "paused" || value === "suspended" || value === "stopped";
 }
 
@@ -90,26 +87,26 @@ function stringMetadata(value: unknown): Record<string, string> {
   return metadata;
 }
 
-/// The engine's idle-policy rules: at least one stage, every threshold a
+/// The protocol's idle-policy rules: at least one stage, every threshold a
 /// positive integer, non-decreasing pause → suspend → stop → close.
-function parseIdlePolicy(value: unknown): { policy: IdlePolicy | null } | { error: string } {
+function parseIdlePolicy(value: unknown): { policy: EnvironmentIdlePolicyView | null } | { error: string } {
   if (value === undefined || value === null) return { policy: null };
   if (!isRecord(value)) return { error: "idle policy must be an object" };
-  const policy: IdlePolicy = {};
+  const policy: EnvironmentIdlePolicyView = {};
   let previous: [string, number] | null = null;
   for (const key of IDLE_STAGES) {
     const threshold = value[key];
     if (threshold === undefined || threshold === null) continue;
     if (typeof threshold !== "number" || !Number.isInteger(threshold) || threshold <= 0) {
-      return { error: `idle policy ${key} must be a positive integer` };
+      return { error: `idle policy ${key} threshold must be positive` };
     }
     if (previous && threshold < previous[1]) {
-      return { error: `idle policy ${key} must not be below ${previous[0]}` };
+      return { error: `idle policy ${key} threshold must not be below ${previous[0]}` };
     }
     policy[key] = threshold;
     previous = [key, threshold];
   }
-  if (!previous) return { error: "idle policy must set at least one stage" };
+  if (!previous) return { error: "idle policy sets no stage" };
   return { policy };
 }
 
@@ -123,6 +120,7 @@ function findByRequestId(universe: UniverseState, requestId: string): Environmen
 /// `environments/create` semantics: the request id dedupes inside the
 /// universe, the binding must be enabled, and the record is accepted before
 /// any provider work. An unknown template fails asynchronously, the way a
+/// provider refusal of `target/create` does.
 export function provisionEnvironment(
   store: DemoStore,
   universe: UniverseState,
@@ -130,66 +128,82 @@ export function provisionEnvironment(
 ): { environment: Environment; created: boolean } | { error: string } {
   const existing = findByRequestId(universe, params.requestId);
   if (existing) return { environment: existing, created: false };
-  const binding = universe.providerBindings.find(
-    (candidate) => candidate.bindingId === params.bindingId,
-  );
-  if (!binding || binding.status !== "enabled") {
-    return { error: "environment provider binding is missing or disabled" };
-  }
-  const idlePolicy = parseIdlePolicy(params.idlePolicy);
-  if ("error" in idlePolicy) return { error: idlePolicy.error };
+  const binding = universe.providerBindings.find((candidate) => candidate.providerId === params.providerId);
+  if (!binding) return { error: `environment provider binding not found: ${params.providerId}` };
+  if (!binding.enabled) return { error: `environment provider binding is disabled: ${params.providerId}` };
   const template = universe.environmentTemplates.find(
-    (candidate) =>
-      candidate.templateId === params.templateId
-      && (candidate.bindingId === binding.bindingId || candidate.providerId === binding.providerId),
+    (candidate) => candidate.providerId === params.providerId && candidate.templateId === params.templateId,
   );
   const environmentId = store.nextId("env");
   const now = Date.now();
   const environment: Environment = {
     environmentId,
     requestId: params.requestId,
-    source: { type: "provisioned", providerId: binding.providerId, bindingId: binding.bindingId },
-    displayName: params.displayName ?? null,
-    status: "provisioning",
-    desiredPower: "running",
-    ...(idlePolicy.policy ? { idlePolicy: idlePolicy.policy } : {}),
-    incarnation: {
-      incarnationId: `inc-${environmentId}-1`,
-      provisionRequestId: params.requestId,
+    source: {
+      type: "provisioned",
+      providerId: params.providerId,
       templateId: params.templateId,
-      createdAtMs: now,
-      updatedAtMs: now,
+      ...(params.idle ? { idle: params.idle } : {}),
     },
-    publicIngressEnabled: false,
+    displayName: params.displayName ?? null,
+    state: "provisioning",
+    status: "provisioning",
+    stateChangedAtMs: now,
     metadata: stringMetadata(params.metadata),
     createdAtMs: now,
     updatedAtMs: now,
   };
   universe.environments.set(environmentId, environment);
+  const source = environment.source;
+  if (source.type !== "provisioned") throw new Error("unreachable");
   if (template) {
-    transition(environment, [["booting", 2_500], ["ready", 6_000]]);
+    schedule(environment, [
+      [2_500, () => {
+        source.targetId = `ls-${environmentId}`;
+        source.observed = { phase: "provisioning", message: "booting", observedAtMs: Date.now() };
+        environment.stateMessage = "waiting for the provider: booting";
+        settle(environment);
+      }],
+      [6_000, () => {
+        source.observed = { phase: "active", power: "running", observedAtMs: Date.now() };
+        environment.stateMessage = null;
+        environment.daemon = DEMO_DAEMON;
+        setState(environment, "open");
+      }],
+    ]);
   } else {
-    environment.lifecycleError = {
-      message: `unknown template ${params.templateId}`,
-      firstAtMs: now,
-      lastAtMs: now,
-    };
-    transition(environment, [["failed", 1_500]]);
+    schedule(environment, [[1_500, () => {
+      environment.stateMessage = `the provider refused target/create: unknown template ${params.templateId}`;
+      setState(environment, "failed");
+    }]]);
   }
   return { environment, created: true };
 }
 
-/// `environments/close`: closing at once, closed a moment later. Ingress
-/// drops immediately because nothing will answer on it.
-export function closeEnvironment(universe: UniverseState, environmentId: string): Environment | null {
+/// `environments/close`: a provisioned environment is closing until the
+/// provider reports its target gone; external and registered ones close at
+/// once.
+export function closeEnvironment(
+  universe: UniverseState,
+  environmentId: string,
+  reason: NonNullable<Environment["closeReason"]> = "requested",
+): Environment | null {
   const environment = universe.environments.get(environmentId);
   if (!environment) return null;
-  if (environment.status === "closed" || environment.status === "closing") return environment;
-  environment.status = "closing";
-  environment.updatedAtMs = Date.now();
-  environment.publicIngressEnabled = false;
-  environment.publicEndpoint = null;
-  transition(environment, [["closed", 2_000]]);
+  if (environment.state === "closed" || environment.state === "closing") return environment;
+  environment.closeReason = reason;
+  const source = environment.source;
+  if (source.type !== "provisioned") {
+    setState(environment, "closed");
+    return environment;
+  }
+  environment.stateMessage = null;
+  setState(environment, "closing");
+  schedule(environment, [[2_000, () => {
+    source.observed = { phase: "closed", observedAtMs: Date.now() };
+    source.publicEndpoint = null;
+    setState(environment, "closed");
+  }]]);
   return environment;
 }
 
@@ -262,6 +276,42 @@ function locate(
   return universe && environment ? { universe, environment } : null;
 }
 
+type RegistrationKeyBody = {
+  displayName?: string;
+  identityMode?: "persistent" | "ephemeral";
+  maxActiveEnvironments?: number;
+  ephemeralDisconnectGraceMs?: number;
+  offlineCloseAfterMs?: number;
+  expiresAtMs?: number;
+};
+
+/// The editable policy of `registration-keys/create` and `/update`: a full
+/// replace, so an absent field is unset.
+function registrationKeyPolicy(
+  body: RegistrationKeyBody,
+  identityMode: "persistent" | "ephemeral",
+): Pick<
+  EnvironmentRegistrationKey,
+  "displayName" | "maxActiveEnvironments" | "ephemeralDisconnectGraceMs" | "offlineCloseAfterMs" | "expiresAtMs"
+> | { error: string } {
+  const displayName = body.displayName?.trim();
+  if (!displayName) return { error: "displayName is required" };
+  if (body.offlineCloseAfterMs !== undefined && identityMode === "ephemeral") {
+    return { error: "offlineCloseAfterMs applies to persistent keys only" };
+  }
+  return {
+    displayName,
+    maxActiveEnvironments: body.maxActiveEnvironments ?? null,
+    ephemeralDisconnectGraceMs: body.ephemeralDisconnectGraceMs ?? 300_000,
+    offlineCloseAfterMs: body.offlineCloseAfterMs ?? null,
+    expiresAtMs: body.expiresAtMs ?? null,
+  };
+}
+
+function mintSecret(): string {
+  return `lsrk_${crypto.randomUUID().replace(/-/g, "")}${crypto.randomUUID().replace(/-/g, "").slice(0, 11)}`;
+}
+
 export function environmentRoutes(store: DemoStore): Hono {
   const app = new Hono();
 
@@ -271,40 +321,48 @@ export function environmentRoutes(store: DemoStore): Hono {
     return c.json(universe.providerBindings);
   });
 
-  /// Templates of enabled bindings only, like the gateway's fan-out.
+  /// Templates of enabled bindings only, like `environments/templates/list`.
   app.get("/:id/environment-templates", (c) => {
     const universe = universeFor(store, c);
     if (!universe) return notFound(c);
-    const bindingId = c.req.query("bindingId");
+    const providerId = c.req.query("providerId");
     const enabled = new Set(
-      universe.providerBindings
-        .filter((binding) => binding.status === "enabled")
-        .map((binding) => binding.bindingId),
+      universe.providerBindings.filter((binding) => binding.enabled).map((binding) => binding.providerId),
     );
     return c.json(
       universe.environmentTemplates.filter(
-        (template) =>
-          enabled.has(template.bindingId) && (!bindingId || template.bindingId === bindingId),
+        (template) => enabled.has(template.providerId) && (!providerId || template.providerId === providerId),
       ),
     );
   });
 
+  /// One page of `environments/list`, in environment id order; closed rows
+  /// only with `includeClosed` or `state=closed`.
   app.get("/:id/environments", (c) => {
     const universe = universeFor(store, c);
     if (!universe) return notFound(c);
     const providerId = c.req.query("providerId");
-    const bindingId = c.req.query("bindingId");
-    const status = c.req.query("status");
+    const state = c.req.query("state");
     const registrationKeyId = c.req.query("registrationKeyId");
-    const environments = [...universe.environments.values()].filter((environment) => {
-      const source = environment.source;
-      return (!providerId || (source.type === "provisioned" && source.providerId === providerId))
-        && (!bindingId || (source.type === "provisioned" && source.bindingId === bindingId))
-        && (!status || environment.status === status)
-        && (!registrationKeyId
-          || (source.type === "registered" && source.registrationKeyId === registrationKeyId));
+    const includeClosed = c.req.query("includeClosed") === "true" || state === "closed";
+    const after = c.req.query("after");
+    const limit = Math.min(Math.max(Number(c.req.query("limit") ?? LIST_DEFAULT_LIMIT) || LIST_DEFAULT_LIMIT, 1), 500);
+    const matching = [...universe.environments.values()]
+      .filter((environment) => {
+        const source = environment.source;
+        return (includeClosed || environment.state !== "closed")
+          && (!providerId || (source.type === "provisioned" && source.providerId === providerId))
+          && (!state || environment.state === state)
+          && (!registrationKeyId
+            || (source.type === "registered" && source.registrationKeyId === registrationKeyId))
+          && (!after || environment.environmentId > after);
+      })
+      .sort((a, b) => (a.environmentId < b.environmentId ? -1 : a.environmentId > b.environmentId ? 1 : 0));
+    const environments = matching.slice(0, limit);
+    return c.json({
+      environments,
+      nextAfter: matching.length > limit ? environments[environments.length - 1]!.environmentId : null,
     });
-    return c.json(environments);
   });
 
   app.get("/:id/environment-registration-keys", (c) => {
@@ -316,35 +374,51 @@ export function environmentRoutes(store: DemoStore): Hono {
   app.post("/:id/environment-registration-keys", async (c) => {
     const universe = universeFor(store, c);
     if (!universe) return notFound(c);
-    const body = await readBody<{
-      displayName?: string;
-      identityMode?: "persistent" | "ephemeral";
-      maxActiveEnvironments?: number;
-      ephemeralDisconnectGraceMs?: number;
-      expiresAtMs?: number;
-    }>(c);
-    const displayName = body.displayName?.trim();
-    if (!displayName) return badRequest(c, "displayName is required");
+    const body = await readBody<RegistrationKeyBody>(c);
+    const identityMode = body.identityMode === "ephemeral" ? "ephemeral" : "persistent";
+    const policy = registrationKeyPolicy(body, identityMode);
+    if ("error" in policy) return badRequest(c, policy.error);
     const now = Date.now();
-    const random = crypto.randomUUID().replace(/-/g, "");
-    const secret = `lsrk_${random}${crypto.randomUUID().replace(/-/g, "").slice(0, 11)}`;
+    const secret = mintSecret();
     const key: EnvironmentRegistrationKey = {
-      registrationKeyId: `registration_key_${random}`,
-      displayName,
+      registrationKeyId: `registration_key_${crypto.randomUUID().replace(/-/g, "")}`,
       keyPrefix: secret.slice(0, 12),
-      identityMode: body.identityMode === "ephemeral" ? "ephemeral" : "persistent",
-      ...(body.maxActiveEnvironments === undefined ? {} : { maxActiveEnvironments: body.maxActiveEnvironments }),
-      ephemeralDisconnectGraceMs: body.ephemeralDisconnectGraceMs ?? 300_000,
-      ...(body.expiresAtMs === undefined ? {} : { expiresAtMs: body.expiresAtMs }),
+      identityMode,
+      ...policy,
       status: "active",
       registeredEnvironmentCount: 0,
       activeEnvironmentCount: 0,
       createdAtMs: now,
+      updatedAtMs: now,
     };
     universe.registrationKeys.push(key);
     return c.json({ registrationKey: withUsage(universe, key), secret }, 201);
   });
 
+  app.put("/:id/environment-registration-keys/:keyId", async (c) => {
+    const universe = universeFor(store, c);
+    if (!universe) return notFound(c);
+    const key = universe.registrationKeys.find((k) => k.registrationKeyId === c.req.param("keyId"));
+    if (!key) return notFound(c);
+    const policy = registrationKeyPolicy(await readBody<RegistrationKeyBody>(c), key.identityMode);
+    if ("error" in policy) return badRequest(c, policy.error);
+    Object.assign(key, policy, { updatedAtMs: Date.now() });
+    return c.json(withUsage(universe, key));
+  });
+
+  /// Retires the live secret; daemons already admitted keep reconnecting.
+  app.post("/:id/environment-registration-keys/:keyId/rotate", (c) => {
+    const universe = universeFor(store, c);
+    if (!universe) return notFound(c);
+    const key = universe.registrationKeys.find((k) => k.registrationKeyId === c.req.param("keyId"));
+    if (!key) return notFound(c);
+    if (key.status === "revoked") return conflict(c, "registration key unavailable: revoked");
+    const secret = mintSecret();
+    key.keyPrefix = secret.slice(0, 12);
+    key.updatedAtMs = Date.now();
+    return c.json({ registrationKey: withUsage(universe, key), secret });
+  });
+
   app.post("/:id/environment-registration-keys/:keyId/revoke", async (c) => {
     const universe = universeFor(store, c);
     if (!universe) return notFound(c);
@@ -361,9 +435,9 @@ export function environmentRoutes(store: DemoStore): Hono {
         if (
           environment.source.type === "registered"
           && environment.source.registrationKeyId === key.registrationKeyId
-          && !["closing", "closed"].includes(environment.status)
+          && environment.state !== "closed"
         ) {
-          closeEnvironment(universe, environment.environmentId);
+          closeEnvironment(universe, environment.environmentId, "keyRevoked");
           closedEnvironmentIds.push(environment.environmentId);
         }
       }
@@ -376,35 +450,35 @@ export function environmentRoutes(store: DemoStore): Hono {
     if (!universe) return notFound(c);
     const body = await readBody<{
       requestId?: unknown;
-      bindingId?: unknown;
+      providerId?: unknown;
       templateId?: unknown;
       displayName?: unknown;
       metadata?: unknown;
-      idlePolicy?: unknown;
+      idle?: unknown;
     }>(c);
     const requestId = typeof body.requestId === "string" ? body.requestId.trim() : "";
-    const bindingId = typeof body.bindingId === "string" ? body.bindingId.trim() : "";
+    const providerId = typeof body.providerId === "string" ? body.providerId.trim() : "";
     const templateId = typeof body.templateId === "string" ? body.templateId.trim() : "";
-    if (!requestId || !bindingId || !templateId) {
-      return badRequest(c, "requestId, bindingId, and templateId are required");
+    if (!requestId || !providerId || !templateId) {
+      return badRequest(c, "requestId, providerId, and templateId are required");
     }
-    const idlePolicy = parseIdlePolicy(body.idlePolicy);
-    if ("error" in idlePolicy) return badRequest(c, idlePolicy.error);
+    const idle = parseIdlePolicy(body.idle);
+    if ("error" in idle) return badRequest(c, idle.error);
     const result = provisionEnvironment(store, universe, {
       requestId,
-      bindingId,
+      providerId,
       templateId,
       displayName: typeof body.displayName === "string" && body.displayName.trim()
         ? body.displayName.trim()
         : null,
-      idlePolicy: idlePolicy.policy,
+      idle: idle.policy,
       metadata: isRecord(body.metadata) ? body.metadata : {},
     });
     if ("error" in result) return conflict(c, result.error);
     return c.json(result.environment, 201);
   });
 
-  /// A directly attached `lightspeed-envd`: no provider, ready at once.
+  /// A directly attached `lightspeed-envd`: no provider, open at once.
   app.post("/:id/environments/external", async (c) => {
     const universe = universeFor(store, c);
     if (!universe) return notFound(c);
@@ -425,10 +499,9 @@ export function environmentRoutes(store: DemoStore): Hono {
       displayName: typeof body.displayName === "string" && body.displayName.trim()
         ? body.displayName.trim()
         : null,
+      state: "open",
       status: "ready",
-      desiredPower: "running",
-      incarnation: { incarnationId: `inc-${environmentId}-1`, createdAtMs: now, updatedAtMs: now },
-      publicIngressEnabled: false,
+      stateChangedAtMs: now,
       metadata: {},
       createdAtMs: now,
       updatedAtMs: now,
@@ -449,89 +522,75 @@ export function environmentRoutes(store: DemoStore): Hono {
     return c.json(found.environment);
   });
 
+  /// `environments/update`: a full replace of name and caller metadata.
+  app.patch("/:id/environments/:environmentId", async (c) => {
+    const found = locate(store, c);
+    if (!found) return notFound(c);
+    const { environment } = found;
+    if (environment.state === "closed") return badRequest(c, "environment closed");
+    const body = await readBody<{ displayName?: unknown; metadata?: unknown }>(c);
+    environment.displayName = typeof body.displayName === "string" && body.displayName.trim()
+      ? body.displayName.trim()
+      : null;
+    environment.metadata = stringMetadata(body.metadata);
+    return c.json(settle(environment));
+  });
+
   app.delete("/:id/environments/:environmentId", (c) => {
     const found = locate(store, c);
     if (!found) return notFound(c);
     return c.json(closeEnvironment(found.universe, found.environment.environmentId));
   });
 
+  /// `environments/power/put`: a synchronous provider call; only the
+  /// returned observation is kept.
   app.put("/:id/environments/:environmentId/power", async (c) => {
     const found = locate(store, c);
     if (!found) return notFound(c);
-    const { environment } = found;
+    const { universe, environment } = found;
     const body = await readBody<{ power?: unknown }>(c);
     const power = body.power;
     if (!isPowerState(power)) {
       return badRequest(c, "power must be one of running, paused, suspended, stopped");
     }
-    if (environment.source.type !== "provisioned") {
-      return conflict(c, "external environments have no power control");
-    }
-    if (["closing", "closed", "failed"].includes(environment.status)) {
-      return badRequest(c, "cannot change power of a closing, closed, or failed environment");
+    const source = environment.source;
+    if (source.type !== "provisioned") {
+      return badRequest(c, "only provisioned environments have provider power control");
     }
-    const supported = environment.incarnation.powerStates ?? [];
-    if (power !== "running" && !supported.includes(power)) {
-      return conflict(c, `environment power state ${power} is not supported by the provider`);
-    }
-    environment.desiredPower = power;
-    environment.updatedAtMs = Date.now();
-    // The reconciler converges asynchronously; simulate it. Waking goes
-    // through booting like a real resume, and an environment still coming
-    // up keeps the lifecycle it is already on.
-    if (POWER_STATUS[power] !== environment.status) {
-      if (power !== "running") {
-        transition(environment, [[POWER_STATUS[power], 1_200]]);
-      } else if (environment.status !== "provisioning" && environment.status !== "booting") {
-        transition(environment, [["booting", 800], ["ready", 2_500]]);
-      }
-    }
-    return c.json(environment);
-  });
-
-  app.put("/:id/environments/:environmentId/idle-policy", async (c) => {
-    const found = locate(store, c);
-    if (!found) return notFound(c);
-    const { environment } = found;
-    const body = await readBody<{ idlePolicy?: unknown }>(c);
-    if (environment.source.type !== "provisioned") {
-      return badRequest(c, "external environments have no power control");
-    }
-    const parsed = parseIdlePolicy(body.idlePolicy);
-    if ("error" in parsed) return badRequest(c, parsed.error);
-    if (parsed.policy) {
-      environment.idlePolicy = parsed.policy;
-    } else {
-      delete environment.idlePolicy;
+    if (environment.state !== "open") return badRequest(c, `environment is ${environment.state}`);
+    const template = universe.environmentTemplates.find(
+      (candidate) => candidate.providerId === source.providerId && candidate.templateId === source.templateId,
+    );
+    if (!template?.powerStates.includes(power)) {
+      return badRequest(c, `the template does not support power state ${power}`);
     }
-    environment.updatedAtMs = Date.now();
-    return c.json(environment);
+    source.observed = { phase: "active", power, observedAtMs: Date.now() };
+    return c.json(settle(environment));
   });
 
+  /// `environments/ingress/put`: a synchronous provider call that returns
+  /// the public endpoint.
   app.put("/:id/environments/:environmentId/ingress", async (c) => {
     const found = locate(store, c);
     if (!found) return notFound(c);
     const { universe, environment } = found;
     const body = await readBody<{ enabled?: unknown }>(c);
     if (typeof body.enabled !== "boolean") return badRequest(c, "enabled must be a boolean");
-    if (environment.source.type !== "provisioned") {
-      return conflict(c, "public ingress is available only for provisioned environments");
+    const source = environment.source;
+    if (source.type !== "provisioned") {
+      return badRequest(c, "public ingress is available only for provisioned environments");
     }
+    if (environment.state !== "open") return badRequest(c, `environment is ${environment.state}`);
     const template = universe.environmentTemplates.find(
-      (candidate) => candidate.templateId === environment.incarnation.templateId,
+      (candidate) => candidate.providerId === source.providerId && candidate.templateId === source.templateId,
     );
     if (body.enabled && !template?.publicIngress) {
-      return conflict(c, "provider template does not permit public ingress");
-    }
-    if (body.enabled && environment.status !== "ready") {
-      return conflict(c, "environment must be ready before ingress can be enabled");
+      return badRequest(c, "provider template does not permit public ingress");
     }
-    environment.publicIngressEnabled = body.enabled;
-    environment.publicEndpoint = body.enabled
+    source.publicEndpoint = body.enabled
       ? `https://${environment.environmentId.replace(/[^a-z0-9]/gi, "")}.env.lightspeed.demo`
       : null;
-    environment.updatedAtMs = Date.now();
-    return c.json(environment);
+    return c.json(settle(environment));
   });
 
   app.get("/:id/environments/:environmentId/credentials", (c) => {
@@ -607,7 +666,7 @@ function withUsage(universe: UniverseState, key: EnvironmentRegistrationKey): En
   return {
     ...key,
     registeredEnvironmentCount: mine.length,
-    activeEnvironmentCount: mine.filter((environment) => environment.status !== "closed").length,
+    activeEnvironmentCount: mine.filter((environment) => environment.state !== "closed").length,
     ...(lastRegisteredAtMs === null ? {} : { lastRegisteredAtMs }),
   };
 }
diff --git a/platform/web/src/demo/routes/sessions.ts b/platform/web/src/demo/routes/sessions.ts
index 78ca2508d..3e878240d 100644
--- a/platform/web/src/demo/routes/sessions.ts
+++ b/platform/web/src/demo/routes/sessions.ts
@@ -579,13 +579,13 @@ function resolveEnvironment(
   return { environmentId };
 }
 
-/// Provisioning and booting are valid activation targets; a terminal or
-/// terminating environment is not.
+/// Provisioning, powered-down and disconnected environments are valid
+/// activation targets; a terminal or terminating one is not.
 function usable(environment: Environment): boolean {
   return (
-    environment.status !== "closed" &&
-    environment.status !== "closing" &&
-    environment.status !== "failed"
+    environment.state !== "closed" &&
+    environment.state !== "closing" &&
+    environment.state !== "failed"
   );
 }
 
diff --git a/platform/web/src/lib/environments.ts b/platform/web/src/lib/environments.ts
new file mode 100644
index 000000000..9c3b9ef79
--- /dev/null
+++ b/platform/web/src/lib/environments.ts
@@ -0,0 +1,121 @@
+import type { EnvironmentCloseReasonView, EnvironmentIdlePolicyView } from "@lightspeed-ai/sdk";
+import { api, type Environment, type EnvironmentTemplate } from "@/api";
+
+/// One page of `GET /environments`, in environment id order.
+export type EnvironmentPage = {
+  environments: Environment[];
+  nextAfter: string | null;
+};
+
+/// The Platform route that reads one page of `environments/list`.
+export function environmentPagePath(
+  universeId: string,
+  options: { includeClosed?: boolean; after?: string | null; limit?: number } = {},
+): string {
+  const query = new URLSearchParams();
+  if (options.includeClosed) query.set("includeClosed", "true");
+  if (options.after) query.set("after", options.after);
+  if (options.limit) query.set("limit", String(options.limit));
+  const suffix = query.toString();
+  return `/api/v1/universes/${universeId}/environments${suffix ? `?${suffix}` : ""}`;
+}
+
+/// Every non-closed environment of the universe, read page by page. Pickers
+/// and status cards use this under the `["environments", universeId]` key.
+export async function listOpenEnvironments(universeId: string): Promise<Environment[]> {
+  const environments: Environment[] = [];
+  let after: string | null = null;
+  do {
+    const page: EnvironmentPage = await api<EnvironmentPage>(
+      "GET",
+      environmentPagePath(universeId, { after, limit: 500 }),
+    );
+    environments.push(...page.environments);
+    after = page.nextAfter;
+  } while (after);
+  return environments;
+}
+
+/// The shared query for a universe's open environments.
+export function openEnvironmentsQuery(universeId: string) {
+  return {
+    queryKey: ["environments", universeId] as const,
+    queryFn: () => listOpenEnvironments(universeId),
+  };
+}
+
+/// Templates of every enabled provider binding, listed live by the providers.
+export function environmentTemplatesQuery(universeId: string) {
+  return {
+    queryKey: ["environment-templates", universeId] as const,
+    queryFn: () =>
+      api<EnvironmentTemplate[]>("GET", `/api/v1/universes/${universeId}/environment-templates`),
+  };
+}
+
+/// Template id and provider id of a provisioned environment.
+export function provisionedSource(environment: Environment) {
+  return environment.source.type === "provisioned" ? environment.source : undefined;
+}
+
+/// The template a provisioned environment was created from, when listed.
+export function environmentTemplate(
+  environment: Environment,
+  templates: readonly EnvironmentTemplate[] | undefined,
+): EnvironmentTemplate | undefined {
+  const source = provisionedSource(environment);
+  if (!source) return undefined;
+  return templates?.find((template) =>
+    template.providerId === source.providerId && template.templateId === source.templateId);
+}
+
+export function environmentName(environment: Environment): string {
+  return environment.displayName
+    ?? provisionedSource(environment)?.templateId
+    ?? environment.environmentId;
+}
+
+const CLOSE_REASONS: Record<EnvironmentCloseReasonView, string> = {
+  requested: "Closed on request",
+  keyRevoked: "Closed when its registration key was revoked",
+  ephemeralGrace: "Closed after its daemon stayed away past the disconnect grace",
+  departed: "Closed when its ephemeral daemon said goodbye",
+  offlineTimeout: "Closed after its daemon stayed offline past the key's limit",
+  providerEnded: "Ended by the provider",
+};
+
+export function closeReasonLabel(reason: EnvironmentCloseReasonView | null | undefined): string | null {
+  return reason ? CLOSE_REASONS[reason] : null;
+}
+
+/// The lifecycle message worth showing: why it failed, or what provisioning
+/// or closing waits on, or why it closed.
+export function lifecycleMessage(environment: Environment): string | null {
+  if (environment.state === "closed") return closeReasonLabel(environment.closeReason);
+  if (["failed", "provisioning", "closing"].includes(environment.state)) {
+    return environment.stateMessage ?? null;
+  }
+  return null;
+}
+
+const IDLE_STAGES: Array<[keyof EnvironmentIdlePolicyView, string]> = [
+  ["pauseAfterMs", "pause"],
+  ["suspendAfterMs", "suspend"],
+  ["stopAfterMs", "stop"],
+  ["closeAfterMs", "close"],
+];
+
+export function describeIdlePolicy(policy: EnvironmentIdlePolicyView | null | undefined): string {
+  if (!policy) return "none";
+  const stages = IDLE_STAGES
+    .filter(([key]) => typeof policy[key] === "number")
+    .map(([key, label]) => `${label} after ${formatDuration(policy[key] as number)}`);
+  return stages.length ? stages.join(", ") : "none";
+}
+
+export function formatDuration(ms: number): string {
+  if (ms % 3_600_000 === 0) return `${ms / 3_600_000}h`;
+  if (ms % 60_000 === 0) return `${ms / 60_000}m`;
+  if (ms % 1_000 === 0) return `${ms / 1_000}s`;
+  return `${ms}ms`;
+}
diff --git a/platform/web/src/lib/sessions/editor-options.ts b/platform/web/src/lib/sessions/editor-options.ts
index eb0180db1..1549c9355 100644
--- a/platform/web/src/lib/sessions/editor-options.ts
+++ b/platform/web/src/lib/sessions/editor-options.ts
@@ -2,11 +2,8 @@ import { useActionPermissions } from "@/lib/permissions";
 import { useMcpToolDiscoverySource } from "@/lib/mcp/tool-discovery";
 import { useQuery } from "@tanstack/react-query";
 import { modelLabel, useModelDefaults, useModelDiscovery } from "@/lib/model-defaults";
-import {
-  api,
-  type Environment,
-  type ProfileSummary,
-} from "@/api";
+import { api, type ProfileSummary } from "@/api";
+import { openEnvironmentsQuery } from "@/lib/environments";
 import type {
   McpServerOption,
   WorkspaceOption,
@@ -35,11 +32,7 @@ export function useSessionConfigEditorOptions(
     queryFn: () => api<ProfileSummary[]>("GET", `/api/v1/universes/${universeId}/profiles`),
     enabled,
   });
-  const environments = useQuery({
-    queryKey: ["environments", universeId],
-    queryFn: () => api<Environment[]>("GET", `/api/v1/universes/${universeId}/environments`),
-    enabled,
-  });
+  const environments = useQuery({ ...openEnvironmentsQuery(universeId), enabled });
   const permissions = useActionPermissions(enabled ? universeId : undefined);
   const mcpToolDiscovery = useMcpToolDiscoverySource(universeId);
   return {
diff --git a/platform/web/src/lib/sessions/resource-features.ts b/platform/web/src/lib/sessions/resource-features.ts
index fa2fdfda0..9e561dee7 100644
--- a/platform/web/src/lib/sessions/resource-features.ts
+++ b/platform/web/src/lib/sessions/resource-features.ts
@@ -61,9 +61,10 @@ function record(value: unknown): Record<string, unknown> {
 }
 
 /// Environments a session may still select. Closed and closing environments
-/// are gone for good and never offered; `provisioning`/`booting` are valid
-/// selection intent (tools wait for readiness). A currently saved id is kept
-/// even when its environment is closed so the editor can show it as unavailable.
+/// are gone for good and never offered; provisioning, powered-down and
+/// disconnected environments are valid selection intent (tools wait for
+/// readiness). A currently saved id is kept even when its environment is
+/// closed so the editor can show it as unavailable.
 export function selectableEnvironments<T extends { environmentId: string; status?: string }>(
   environments: T[],
   keepEnvironmentId?: string | null,
diff --git a/platform/web/src/lib/sessions/session-resources.test.ts b/platform/web/src/lib/sessions/session-resources.test.ts
index 708d75871..5bccfd7ee 100644
--- a/platform/web/src/lib/sessions/session-resources.test.ts
+++ b/platform/web/src/lib/sessions/session-resources.test.ts
@@ -79,5 +79,5 @@ it("includes code mode as a resource only when its feature grant is present", ()
 });
 
 it("treats sleeping machines as idle because tools wake them", () => {
-  expect(["ready", "paused", "booting", "failed"].map(environmentTone)).toEqual(["ok", "idle", "busy", "problem"]);
+  expect(["ready", "paused", "provisioning", "away", "failed"].map(environmentTone)).toEqual(["ok", "idle", "busy", "busy", "problem"]);
 });
diff --git a/platform/web/src/lib/sessions/session-resources.ts b/platform/web/src/lib/sessions/session-resources.ts
index de59b845d..1f8f6b170 100644
--- a/platform/web/src/lib/sessions/session-resources.ts
+++ b/platform/web/src/lib/sessions/session-resources.ts
@@ -58,12 +58,13 @@ function text(value: unknown): string | undefined {
 }
 
 /// Ready is running; paused, suspended, and stopped machines wake when a tool
-/// uses them, so they are idle rather than broken.
+/// uses them, so they are idle rather than broken. A registered daemon that is
+/// away may reconnect.
 export function environmentTone(status: string | undefined): ResourceTone {
   switch (status) {
     case "ready": return "ok";
-    case "paused": case "suspended": case "stopped": return "idle";
-    case "provisioning": case "booting": return "busy";
+    case "paused": case "suspended": case "stopped": case "unknown": return "idle";
+    case "provisioning": case "away": return "busy";
     case "closing": case "closed": case "failed": return "problem";
     default: return "idle";
   }
diff --git a/platform/web/src/pages/AdminEnvironmentProvidersPage.tsx b/platform/web/src/pages/AdminEnvironmentProvidersPage.tsx
index c8c89bd33..82507375d 100644
--- a/platform/web/src/pages/AdminEnvironmentProvidersPage.tsx
+++ b/platform/web/src/pages/AdminEnvironmentProvidersPage.tsx
@@ -1,7 +1,7 @@
 import { ReadError } from "@/components/read-error";
 import { useState, type FormEvent } from "react";
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
-import { Plus, Trash2 } from "lucide-react";
+import { Pencil, Plus, Trash2 } from "lucide-react";
 import type {
   EnvironmentProviderBindingView,
   DeploymentEnvironmentProviderView,
@@ -37,8 +37,8 @@ import {
   SelectTrigger,
   SelectValue,
 } from "@/components/ui/select";
+import { Switch } from "@/components/ui/switch";
 import {
-  IdText,
   Table,
   TableActionsCell,
   TableBody,
@@ -67,11 +67,13 @@ type UniverseBindings = {
 
 /// Deployment-scoped environment provider administration: physical
 /// providers are registered once by a platform admin and shared with
-/// universes through revisioned bindings. Universe owners consume enabled
-/// bindings from their Environments page; only admins mutate them here.
+/// universes through bindings, one per universe and provider. Universe
+/// owners consume enabled bindings from their Environments page; only admins
+/// mutate them here.
 export function AdminEnvironmentProvidersPage() {
   const queryClient = useQueryClient();
   const [registerOpen, setRegisterOpen] = useState(false);
+  const [editing, setEditing] = useState<Provider | null>(null);
   const [bindingFor, setBindingFor] = useState<Provider | null>(null);
 
   const providers = useQuery({
@@ -121,9 +123,16 @@ export function AdminEnvironmentProvidersPage() {
           </Button>
         }
       />
-      <RegisterProviderDialog
-        open={registerOpen}
-        onOpenChange={setRegisterOpen}
+      <ProviderDialog
+        key={editing?.providerId ?? (registerOpen ? "new" : "closed")}
+        provider={editing}
+        open={registerOpen || editing !== null}
+        onOpenChange={(open) => {
+          if (!open) {
+            setRegisterOpen(false);
+            setEditing(null);
+          }
+        }}
         onSaved={refresh}
       />
       <BindUniverseDialog
@@ -163,15 +172,26 @@ export function AdminEnvironmentProvidersPage() {
                     <span className="font-mono text-xs text-muted-foreground">
                       {provider.providerId}
                     </span>
-                    {providerFeatureLabels(provider).map((label) => (
-                      <Badge key={label} variant="outline">{label}</Badge>
-                    ))}
+                    <Badge variant="outline">
+                      {provider.hasCredential ? "credential" : "no credential"}
+                    </Badge>
                   </div>
                   <p className="mt-1 truncate font-mono text-xs text-muted-foreground">
                     {provider.controllerEndpoint}
                   </p>
+                  <p className="mt-1 truncate text-xs text-muted-foreground">
+                    Data routes{" "}
+                    <span className="font-mono">
+                      {provider.effectiveDataRouteBase ?? "cannot be derived"}
+                    </span>
+                    {provider.dataRouteBase ? "" : " (derived)"}
+                  </p>
                 </div>
                 <div className="flex items-center gap-2">
+                  <Button variant="outline" size="sm" onClick={() => setEditing(provider)}>
+                    <Pencil data-icon="inline-start" />
+                    Edit
+                  </Button>
                   <Button variant="outline" size="sm" onClick={() => setBindingFor(provider)}>
                     <Plus data-icon="inline-start" />
                     Bind universe
@@ -196,9 +216,10 @@ export function AdminEnvironmentProvidersPage() {
                         </AlertDialogTitle>
                         <AlertDialogDescription>
                           Removes the registration from this deployment. The engine
-                          rejects the delete while any universe binding still
-                          references it; delete those bindings first. Provider-side
-                          machines are not touched.
+                          refuses the delete while any universe binding or any
+                          non-closed environment of this provider exists; delete
+                          those bindings and close those environments first.
+                          Provider-side machines are not touched.
                         </AlertDialogDescription>
                       </AlertDialogHeader>
                       <AlertDialogFooter>
@@ -215,16 +236,6 @@ export function AdminEnvironmentProvidersPage() {
                 </div>
               </div>
               <div className="px-4 py-3 md:px-5">
-                {Object.keys(provider.metadata ?? {}).length > 0 && (
-                  <dl className="mb-3 flex flex-wrap gap-x-6 gap-y-1 text-xs text-muted-foreground">
-                    {Object.entries(provider.metadata ?? {}).map(([key, value]) => (
-                      <div key={key}>
-                        <dt className="inline font-medium">{key}: </dt>
-                        <dd className="inline font-mono">{value}</dd>
-                      </div>
-                    ))}
-                  </dl>
-                )}
                 {providerBindings.length === 0 ? (
                   <p className="text-sm text-muted-foreground">
                     No universe is bound to this provider yet.
@@ -235,16 +246,14 @@ export function AdminEnvironmentProvidersPage() {
                       <TableHeader>
                         <TableRow>
                           <TableHead>Universe</TableHead>
-                          <TableHead>Binding</TableHead>
-                          <TableHead>Status</TableHead>
-                          <TableHead>Revision</TableHead>
+                          <TableHead>Enabled</TableHead>
                           <TableHead className="w-0" />
                         </TableRow>
                       </TableHeader>
                       <TableBody>
                         {providerBindings.map(({ universe, binding }) => (
                           <BindingRow
-                            key={`${universe.universeId}:${binding.bindingId}`}
+                            key={`${universe.universeId}:${binding.providerId}`}
                             universe={universe}
                             binding={binding}
                             onChanged={refresh}
@@ -272,17 +281,6 @@ export function AdminEnvironmentProvidersPage() {
   );
 }
 
-/// What the controller advertised at its last successful handshake, or
-/// that Lightspeed has not reached it at this endpoint yet.
-function providerFeatureLabels(provider: Provider): string[] {
-  const features = provider.controllerFeatures;
-  if (!features) return ["not reached yet"];
-  return [
-    ...(features.adoptTarget ? ["adoption"] : []),
-    ...(features.ingress ? ["ingress"] : []),
-  ];
-}
-
 function BindingRow({
   universe,
   binding,
@@ -292,50 +290,29 @@ function BindingRow({
   binding: EnvironmentProviderBindingView;
   onChanged: () => void;
 }) {
-  const setStatus = useMutation({
-    mutationFn: (status: "enabled" | "disabled") =>
-      api<EnvironmentProviderBindingView>(
-        "PUT",
-        `/api/v1/admin/universes/${universe.lightspeedUniverseId}/environment-provider-bindings/${encodeURIComponent(binding.bindingId)}`,
-        {
-          providerId: binding.providerId,
-          status,
-          expectedRevision: binding.revision,
-          ...(binding.metadata && Object.keys(binding.metadata).length > 0 ? { metadata: binding.metadata } : {}),
-        },
-      ),
+  const path = `/api/v1/admin/universes/${universe.lightspeedUniverseId}/environment-provider-bindings/${encodeURIComponent(binding.providerId)}`;
+  const setEnabled = useMutation({
+    mutationFn: (enabled: boolean) =>
+      api<EnvironmentProviderBindingView>("PUT", path, { enabled }),
     onSuccess: onChanged,
   });
   const remove = useMutation({
-    mutationFn: () =>
-      api<EnvironmentProviderBindingView>(
-        "DELETE",
-        `/api/v1/admin/universes/${universe.lightspeedUniverseId}/environment-provider-bindings/${encodeURIComponent(binding.bindingId)}`,
-      ),
+    mutationFn: () => api<EnvironmentProviderBindingView>("DELETE", path),
     onSuccess: onChanged,
   });
-  const error = setStatus.error ?? remove.error;
+  const error = setEnabled.error ?? remove.error;
   return (
     <TableRow>
       <TableTitleCell title={universe.name} subtitle={universe.lightspeedUniverseId} />
-      <TableCell className="max-w-48">
-        <IdText>{binding.bindingId}</IdText>
-      </TableCell>
       <TableCell>
-        <Badge variant={binding.status === "enabled" ? "secondary" : "outline"}>
-          {binding.status}
-        </Badge>
+        <Switch
+          aria-label={`Enable ${binding.providerId} for ${universe.name}`}
+          checked={binding.enabled}
+          disabled={setEnabled.isPending}
+          onCheckedChange={(enabled) => setEnabled.mutate(enabled)}
+        />
       </TableCell>
-      <TableCell className="text-muted-foreground">{binding.revision}</TableCell>
       <TableActionsCell>
-        <Button
-          variant="ghost"
-          size="sm"
-          disabled={setStatus.isPending}
-          onClick={() => setStatus.mutate(binding.status === "enabled" ? "disabled" : "enabled")}
-        >
-          {binding.status === "enabled" ? "Disable" : "Enable"}
-        </Button>
         <AlertDialog>
           <AlertDialogTrigger
             render={<Button variant="ghost" size="sm" className="text-destructive" disabled={remove.isPending} />}
@@ -344,12 +321,12 @@ function BindingRow({
           </AlertDialogTrigger>
           <AlertDialogContent>
             <AlertDialogHeader>
-              <AlertDialogTitle>Delete binding {binding.bindingId}?</AlertDialogTitle>
+              <AlertDialogTitle>Unbind {universe.name}?</AlertDialogTitle>
               <AlertDialogDescription>
                 {universe.name} will no longer be able to provision from{" "}
                 <span className="font-mono text-xs">{binding.providerId}</span>. The engine
-                rejects the delete while a non-closed environment still references this
-                binding; disable it instead to stop new provisioning.
+                rejects the delete while a non-closed environment of this provider is still
+                open in the universe; disable the binding instead to stop new provisioning.
               </AlertDialogDescription>
             </AlertDialogHeader>
             <AlertDialogFooter>
@@ -369,39 +346,39 @@ function BindingRow({
   );
 }
 
-function RegisterProviderDialog({
+/// Register a provider, or edit one when `provider` is set. The credential
+/// is write-only and optional: empty keeps the stored one.
+function ProviderDialog({
+  provider,
   open,
   onOpenChange,
   onSaved,
 }: {
+  provider: Provider | null;
   open: boolean;
   onOpenChange: (open: boolean) => void;
   onSaved: () => void;
 }) {
-  const [providerId, setProviderId] = useState("");
-  const [displayName, setDisplayName] = useState("");
-  const [endpoint, setEndpoint] = useState("");
+  const [providerId, setProviderId] = useState(provider?.providerId ?? "");
+  const [displayName, setDisplayName] = useState(provider?.displayName ?? "");
+  const [endpoint, setEndpoint] = useState(provider?.controllerEndpoint ?? "");
+  const [dataRouteBase, setDataRouteBase] = useState(provider?.dataRouteBase ?? "");
   const [credential, setCredential] = useState("");
+  const [clearCredential, setClearCredential] = useState(false);
   const [error, setError] = useState<string | null>(null);
-
-  const reset = () => {
-    setProviderId("");
-    setDisplayName("");
-    setEndpoint("");
-    setCredential("");
-    setError(null);
-  };
+  const editing = provider !== null;
 
   const save = useMutation({
     mutationFn: () =>
       api<Provider>("PUT", `/api/v1/admin/environment-providers/${encodeURIComponent(providerId.trim())}`, {
         ...(displayName.trim() ? { displayName: displayName.trim() } : {}),
         controllerEndpoint: endpoint.trim(),
-        credential,
+        ...(dataRouteBase.trim() ? { dataRouteBase: dataRouteBase.trim() } : {}),
+        ...(credential ? { credential } : {}),
+        ...(clearCredential ? { clearCredential: true } : {}),
       }),
     onSuccess: () => {
       onOpenChange(false);
-      reset();
       onSaved();
     },
     onError: (err) => setError(err.message),
@@ -414,18 +391,25 @@ function RegisterProviderDialog({
     if (!/^(wss?:\/\/|unix:\/\/\/)\S+$/.test(endpoint.trim())) {
       return setError("the controller endpoint must be a ws://, wss:// or unix:// URL");
     }
-    if (!credential) return setError("the provider credential is required");
+    if (dataRouteBase.trim() && !/^wss?:\/\/\S+$/.test(dataRouteBase.trim())) {
+      return setError("the data route base must be a ws:// or wss:// URL");
+    }
+    if (endpoint.trim().startsWith("unix://") && !dataRouteBase.trim()) {
+      return setError("a unix:// controller needs a data route base");
+    }
     save.mutate();
   };
 
   return (
-    <Dialog open={open} onOpenChange={(next) => { onOpenChange(next); if (!next) reset(); }}>
+    <Dialog open={open} onOpenChange={onOpenChange}>
       <DialogContent>
         <DialogHeader>
-          <DialogTitle>Register environment provider</DialogTitle>
+          <DialogTitle>
+            {editing ? `Edit ${provider.displayName ?? provider.providerId}` : "Register environment provider"}
+          </DialogTitle>
           <DialogDescription>
-            Records how Lightspeed reaches the provider's controller endpoint and
-            the credential it presents there. The provider never self-registers.
+            Records how Lightspeed reaches the provider's controller and data routes, and the
+            optional bearer credential it presents there. The provider never self-registers.
             Universes get access through bindings.
           </DialogDescription>
         </DialogHeader>
@@ -437,7 +421,8 @@ function RegisterProviderDialog({
               value={providerId}
               onChange={(e) => setProviderId(e.target.value)}
               placeholder="incus-hz02"
-              autoFocus
+              disabled={editing}
+              autoFocus={!editing}
             />
             <FieldDescription className="text-xs">
               Stable deployment-wide identifier; profiles reference providers by this id.
@@ -462,18 +447,49 @@ function RegisterProviderDialog({
             />
           </Field>
           <Field>
-            <FieldLabel htmlFor="provider-credential">Credential</FieldLabel>
+            <FieldLabel htmlFor="provider-data-route-base">Data route base (optional)</FieldLabel>
+            <Input
+              id="provider-data-route-base"
+              value={dataRouteBase}
+              onChange={(e) => setDataRouteBase(e.target.value)}
+              placeholder={derivedDataRouteBase(endpoint) ?? "wss://provider.internal:19090/routes"}
+            />
+            <FieldDescription className="text-xs">
+              {editing && provider.effectiveDataRouteBase
+                ? <>Lightspeed dials <span className="font-mono">{provider.effectiveDataRouteBase}</span>. </>
+                : null}
+              Empty derives it from the controller endpoint's origin plus{" "}
+              <span className="font-mono">/routes</span>; a unix:// controller needs one.
+            </FieldDescription>
+          </Field>
+          <Field>
+            <FieldLabel htmlFor="provider-credential">Credential (optional)</FieldLabel>
             <Input
               id="provider-credential"
               type="password"
               autoComplete="off"
               value={credential}
+              disabled={clearCredential}
               onChange={(e) => setCredential(e.target.value)}
+              placeholder={editing && provider.hasCredential ? "Unchanged" : "None"}
             />
             <FieldDescription className="text-xs">
-              The bearer secret the provider is configured with. Write-only: it is
-              never shown again.
+              The bearer secret the provider is configured with. Write-only: it is never shown
+              again. Without one, Lightspeed sends no Authorization header.
             </FieldDescription>
+            {editing && provider.hasCredential && (
+              <label className="flex items-center gap-2 text-sm">
+                <input
+                  type="checkbox"
+                  checked={clearCredential}
+                  onChange={(event) => {
+                    setClearCredential(event.target.checked);
+                    if (event.target.checked) setCredential("");
+                  }}
+                />
+                Remove the stored credential
+              </label>
+            )}
           </Field>
           {error && <p className="text-sm text-destructive">{error}</p>}
           <DialogFooter>
@@ -481,7 +497,7 @@ function RegisterProviderDialog({
               Cancel
             </Button>
             <Button type="submit" disabled={save.isPending}>
-              {save.isPending ? "Saving…" : "Register"}
+              {save.isPending ? "Saving…" : editing ? "Save" : "Register"}
             </Button>
           </DialogFooter>
         </form>
@@ -490,6 +506,12 @@ function RegisterProviderDialog({
   );
 }
 
+/// The base Lightspeed derives from a ws:// or wss:// controller endpoint.
+function derivedDataRouteBase(endpoint: string): string | null {
+  const match = /^(wss?:\/\/[^/\s]+)/.exec(endpoint.trim());
+  return match ? `${match[1]}/routes` : null;
+}
+
 function BindUniverseDialog({
   provider,
   universes,
@@ -502,7 +524,6 @@ function BindUniverseDialog({
   onSaved: () => void;
 }) {
   const [universeId, setUniverseId] = useState("");
-  const [bindingId, setBindingId] = useState("");
   const [error, setError] = useState<string | null>(null);
   const candidates = universes.filter(
     (universe) =>
@@ -511,11 +532,9 @@ function BindUniverseDialog({
       && !universe.bindings.some((binding) => binding.providerId === provider?.providerId),
   );
   const selected = universes.find((universe) => universe.lightspeedUniverseId === universeId);
-  const effectiveBindingId = bindingId.trim() || provider?.providerId || "";
 
   const reset = () => {
     setUniverseId("");
-    setBindingId("");
     setError(null);
   };
 
@@ -523,8 +542,8 @@ function BindUniverseDialog({
     mutationFn: () =>
       api<EnvironmentProviderBindingView>(
         "PUT",
-        `/api/v1/admin/universes/${universeId}/environment-provider-bindings/${encodeURIComponent(effectiveBindingId)}`,
-        { providerId: provider!.providerId, status: "enabled" },
+        `/api/v1/admin/universes/${universeId}/environment-provider-bindings/${encodeURIComponent(provider!.providerId)}`,
+        { enabled: true },
       ),
     onSuccess: () => {
       onOpenChange(false);
@@ -537,7 +556,6 @@ function BindUniverseDialog({
   const submit = (event: FormEvent) => {
     event.preventDefault();
     if (!universeId) return setError("choose a universe");
-    if (!effectiveBindingId) return setError("a binding id is required");
     save.mutate();
   };
 
@@ -584,18 +602,6 @@ function BindUniverseDialog({
                   : "Only active universes without an existing binding are listed."}
             </FieldDescription>
           </Field>
-          <Field>
-            <FieldLabel htmlFor="binding-id">Binding id</FieldLabel>
-            <Input
-              id="binding-id"
-              value={bindingId}
-              onChange={(e) => setBindingId(e.target.value)}
-              placeholder={provider?.providerId ?? ""}
-            />
-            <FieldDescription className="text-xs">
-              Universe-scoped identifier; defaults to the provider id.
-            </FieldDescription>
-          </Field>
           {error && <p className="text-sm text-destructive">{error}</p>}
           <DialogFooter>
             <Button type="button" variant="outline" onClick={() => onOpenChange(false)}>
diff --git a/platform/web/src/pages/BotsPage.permissions.test.tsx b/platform/web/src/pages/BotsPage.permissions.test.tsx
index b3b9036fa..e55fa1509 100644
--- a/platform/web/src/pages/BotsPage.permissions.test.tsx
+++ b/platform/web/src/pages/BotsPage.permissions.test.tsx
@@ -47,7 +47,8 @@ beforeEach(() => {
     if (path.endsWith("/profiles/shared")) return { profileId: "shared", revision: 1, config: { features: { environments: { environments: [{ environmentId: "env", default: true }] } } } };
     if (path.endsWith("/triggers")) return { triggers: [] };
     if (path.endsWith("/channel-accounts")) return { accounts: [] };
-    if (path.endsWith("/environments")) return [{ environmentId: "env", displayName: "Shared environment", status: "ready", desiredPower: "running", source: { type: "provisioned" }, incarnation: { powerStates: ["running", "paused"] } }];
+    if (path.includes("/environments?")) return { environments: [{ environmentId: "env", displayName: "Shared environment", state: "open", status: "ready", source: { type: "provisioned", providerId: "incus", templateId: "small", observed: { phase: "active", power: "running", observedAtMs: 0 } } }], nextAfter: null };
+    if (path.endsWith("/environment-templates")) return [{ providerId: "incus", templateId: "small", displayName: "Small", powerStates: ["running", "paused"], publicIngress: false, deprecated: false }];
     throw new Error(`Unexpected request: ${method} ${path}`);
   });
   client = new QueryClient({ defaultOptions: { queries: { retry: false, gcTime: Infinity } } });
@@ -122,7 +123,6 @@ it("does not turn bot management into profile or environment administration", as
   expect(container.querySelector('[aria-label="Profile configuration"]')).not.toBeNull();
   expect(container.textContent).toContain("Shared environment");
   expect(button("Pause")).toBeUndefined();
-  expect(button("Idle policy…")).toBeUndefined();
   // Configuring the environment is an operator's.
   mocks.role = "operator";
   await act(async () => root.render(
@@ -130,7 +130,6 @@ it("does not turn bot management into profile or environment administration", as
   ));
   await settle();
   expect(button("Pause")).toBeDefined();
-  expect(button("Idle policy…")).toBeDefined();
 });
 
 it.each(["viewer", "contributor", "operator"])("offers conversation compaction according to the %s role", async (role) => {
diff --git a/platform/web/src/pages/EnvironmentsPage.tsx b/platform/web/src/pages/EnvironmentsPage.tsx
index 02e759d22..ba30455ca 100644
--- a/platform/web/src/pages/EnvironmentsPage.tsx
+++ b/platform/web/src/pages/EnvironmentsPage.tsx
@@ -1,13 +1,12 @@
 import { useActionPermissions } from "@/lib/permissions";
 import { ReadError } from "@/components/read-error";
 import { useState } from "react";
-import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
-import { Boxes, Check, ChevronDown, Copy, KeyRound, Plus, Trash2 } from "lucide-react";
+import { useInfiniteQuery, useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import { Boxes, Check, ChevronDown, Copy, KeyRound, Pencil, Plus, RotateCw, Trash2 } from "lucide-react";
 import {
   api,
   type Environment,
   type EnvironmentCredential,
-  type EnvironmentCredentialSource,
   type EnvironmentProviderBinding,
   type EnvironmentRegistrationKey,
   type EnvironmentRegistrationKeyCreated,
@@ -49,30 +48,32 @@ import {
   SelectTrigger,
   SelectValue,
 } from "@/components/ui/select";
+import { Switch } from "@/components/ui/switch";
 import { EmptyState, LoadingNote, PageHeader, ShowHiddenToggle, UniverseNotFound } from "@/components/page";
-import { EnvironmentIdlePolicyDialog } from "@/components/environment/idle-policy-dialog";
-import {
-  IdlePolicyFields,
-  idlePolicyIsMonotone,
-  type IdlePolicy,
-} from "@/components/environment/idle-policy-fields";
-import {
-  EnvironmentPowerControls,
-  describeIdlePolicy,
-  observedPower,
-  powerDiverges,
-} from "@/components/environment/power-controls";
+import type { EnvironmentIdlePolicyView } from "@lightspeed-ai/sdk";
+import { EnvironmentPowerControls } from "@/components/environment/power-controls";
+import { IdlePolicyFields, idlePolicyProblem, idleStagesFor } from "@/components/environment/idle-policy-fields";
+import { MetadataMapEditor } from "@/components/session/metadata-editor";
 import {
   environmentCredentialAvailable,
   environmentCredentialOptions,
   environmentCredentialSourceFromValue,
   environmentCredentialSourceLabel,
-  environmentCredentialSourceValue,
 } from "@/lib/environment-credentials";
+import {
+  describeIdlePolicy,
+  environmentName,
+  environmentPagePath,
+  environmentTemplate,
+  environmentTemplatesQuery,
+  formatDuration,
+  lifecycleMessage,
+  type EnvironmentPage,
+} from "@/lib/environments";
 import { useActiveUniverse } from "@/lib/universes";
 
-/// Universe environments are provisioned through operator-enabled bindings and
-/// immutable provider templates. Physical provider registration stays admin-only.
+/// Universe environments are provisioned from the templates offered by the
+/// universe's enabled providers. Physical provider registration stays admin-only.
 export function EnvironmentsPage({ admin: _admin }: { admin: boolean }) {
   const { universe, slug, isLoading } = useActiveUniverse();
   const permissions = useActionPermissions(universe?.id);
@@ -84,13 +85,14 @@ export function EnvironmentsPage({ admin: _admin }: { admin: boolean }) {
     return <UniverseNotFound slug={slug} />;
   }
 
-  return <ProviderList universeId={universe.id} />;
+  return <EnvironmentList universeId={universe.id} />;
 }
 
 const REFRESH_MS = 10_000;
 
-function ProviderList({ universeId }: { universeId: string }) {
+function EnvironmentList({ universeId }: { universeId: string }) {
   const writable = useActionPermissions(universeId).can("configure_resource");
+  const [showClosed, setShowClosed] = useState(false);
   const bindings = useQuery({
     queryKey: ["environment-provider-bindings", universeId],
     queryFn: () =>
@@ -99,26 +101,21 @@ function ProviderList({ universeId }: { universeId: string }) {
         `/api/v1/universes/${universeId}/environment-provider-bindings`,
       ),
   });
-  const templates = useQuery({
-    queryKey: ["environment-templates", universeId],
-    queryFn: () =>
-      api<EnvironmentTemplate[]>(
-        "GET",
-        `/api/v1/universes/${universeId}/environment-templates`,
-      ),
-  });
-  const environments = useQuery({
-    queryKey: ["environments", universeId],
-    queryFn: () =>
-      api<Environment[]>("GET", `/api/v1/universes/${universeId}/environments`),
-    refetchInterval: (query) => {
-      const rows = query.state.data as Environment[] | undefined;
-      return rows?.some((environment) =>
-        ["provisioning", "booting", "closing", "unknown"].includes(environment.status)
-          || powerDiverges(environment)
-          || ingressDiverges(environment)
-      ) ? REFRESH_MS : false;
-    },
+  const templates = useQuery(environmentTemplatesQuery(universeId));
+  // Pages of `environments/list`; closed rows only when asked for. Only the
+  // lifecycle Lightspeed drives (create until accepted, close until gone)
+  // changes without a user action, so polling is limited to those rows.
+  const environments = useInfiniteQuery({
+    queryKey: ["environments", universeId, "pages", showClosed],
+    queryFn: ({ pageParam }) =>
+      api<EnvironmentPage>("GET", environmentPagePath(universeId, { includeClosed: showClosed, after: pageParam })),
+    initialPageParam: null as string | null,
+    getNextPageParam: (page) => page.nextAfter ?? undefined,
+    refetchInterval: (query) =>
+      query.state.data?.pages.some((page) =>
+        page.environments.some((environment) => ["provisioning", "closing"].includes(environment.state)))
+        ? REFRESH_MS
+        : false,
   });
   const secrets = useQuery({
     queryKey: ["secrets", universeId],
@@ -150,22 +147,18 @@ function ProviderList({ universeId }: { universeId: string }) {
   const templateRows = (templates.data ?? [])
     .slice()
     .sort((a, b) => a.displayName.localeCompare(b.displayName));
-  const [showClosed, setShowClosed] = useState(false);
-  const allEnvironmentRows = (environments.data ?? [])
+  const loadedRows = environments.data?.pages.flatMap((page) => page.environments) ?? [];
+  const environmentRows = loadedRows
     .slice()
     .sort((a, b) => environmentName(a).localeCompare(environmentName(b)));
-  const closedCount = allEnvironmentRows.filter((environment) => environment.status === "closed").length;
-  const environmentRows = showClosed
-    ? allEnvironmentRows
-    : allEnvironmentRows.filter((environment) => environment.status !== "closed");
   // One lookup for every card: configuring an environment is decided per
   // environment, not from the universe role alone.
   const decisions = useActionPermissions(universeId);
-  const enabledBindings = new Set(
-    bindingRows.filter((binding) => binding.status === "enabled").map((binding) => binding.bindingId),
+  const enabledProviders = new Set(
+    bindingRows.filter((binding) => binding.enabled).map((binding) => binding.providerId),
   );
   const creatableTemplates = templateRows.filter(
-    (template) => enabledBindings.has(template.bindingId) && !template.deprecated,
+    (template) => enabledProviders.has(template.providerId) && !template.deprecated,
   );
   const keyRows = (registrationKeys.data ?? [])
     .slice()
@@ -185,6 +178,18 @@ function ProviderList({ universeId }: { universeId: string }) {
     environment.source.type === "registered"
     && !keysById.has(environment.source.registrationKeyId));
   const ungroupedRows = environmentRows.filter((environment) => environment.source.type !== "registered");
+  const card = (environment: Environment, registrationKey: EnvironmentRegistrationKey | undefined) => (
+    <EnvironmentCard
+      key={environment.environmentId}
+      universeId={universeId}
+      environment={environment}
+      configurable={decisions.can("configure_resource")}
+      operator={writable}
+      template={environmentTemplate(environment, templateRows)}
+      registrationKey={registrationKey}
+      secrets={secrets.data}
+    />
+  );
 
   return (
     <>
@@ -196,7 +201,7 @@ function ProviderList({ universeId }: { universeId: string }) {
             <RegisterExternalEnvironmentDialog
               universeId={universeId}
               suggestedEndpoint={hints.data?.devEnvdEndpoint ?? null}
-              alreadyRegistered={(environments.data ?? []).some(
+              alreadyRegistered={loadedRows.some(
                 (environment) =>
                   environment.source.type === "external"
                   && hints.data?.devEnvdEndpoint
@@ -226,8 +231,8 @@ function ProviderList({ universeId }: { universeId: string }) {
       {registrationKeys.error && (
         <ReadError error={registrationKeys.error} loading={!registrationKeys.data} prefix="Registration keys unavailable" />
       )}
-      {bindings.data && environments.data && allEnvironmentRows.length === 0 && (
-        <EmptyState icon={Boxes} title="No environments yet">
+      {bindings.data && environments.data && environmentRows.length === 0 && (
+        <EmptyState icon={Boxes} title={showClosed ? "No environments" : "No open environments"}>
           Machines agents run commands on: created from a provider template, or registered by
           running <span className="font-mono">lightspeed-envd</span> on a machine of your own.
         </EmptyState>
@@ -243,47 +248,27 @@ function ProviderList({ universeId }: { universeId: string }) {
               {group.key.maxActiveEnvironments ? ` · limit ${group.key.maxActiveEnvironments}` : ""}
             </span>
           </div>
-          {group.environments.map((environment) => (
-            <EnvironmentCard
-              key={environment.environmentId}
-              universeId={universeId}
-              environment={environment}
-              configurable={decisions.can("configure_resource")}
-              operator={writable}
-              template={undefined}
-              registrationKey={group.key}
-              secrets={secrets.data}
-            />
-          ))}
+          {group.environments.map((environment) => card(environment, group.key))}
         </section>
       ))}
       <div className="grid gap-3">
-        {[...ungroupedRows, ...orphanRegistered].map((environment) => (
-          <EnvironmentCard
-            key={environment.environmentId}
-            universeId={universeId}
-            environment={environment}
-            configurable={decisions.can("configure_resource")}
-            operator={writable}
-            template={templateRows.find((candidate) =>
-              candidate.bindingId === provisionedBindingId(environment)
-              && candidate.templateId === environment.incarnation.templateId
-            )}
-            registrationKey={undefined}
-            secrets={secrets.data}
-          />
-        ))}
+        {[...ungroupedRows, ...orphanRegistered].map((environment) => card(environment, undefined))}
       </div>
-      {environments.data && allEnvironmentRows.length > 0 && environmentRows.length === 0 && (
-        <p className="text-sm text-muted-foreground">Every environment here is closed.</p>
-      )}
-      <div className="mt-3">
-        <ShowHiddenToggle
-          label="Show closed environments"
-          count={closedCount}
-          checked={showClosed}
-          onCheckedChange={setShowClosed}
-        />
+      <div className="mt-3 flex flex-wrap items-center gap-4">
+        {environments.hasNextPage && (
+          <Button
+            variant="outline"
+            size="sm"
+            disabled={environments.isFetchingNextPage}
+            onClick={() => void environments.fetchNextPage()}
+          >
+            {environments.isFetchingNextPage ? "Loading…" : "Load more"}
+          </Button>
+        )}
+        <label className="flex w-fit cursor-pointer items-center gap-2 text-sm text-muted-foreground">
+          <Switch checked={showClosed} onCheckedChange={setShowClosed} />
+          Show closed environments
+        </label>
       </div>
       {writable && keyRows.length > 0 && <RegistrationKeys universeId={universeId} keys={keyRows} />}
       {bindingRows.length > 0 && <ProviderBindings bindings={bindingRows} />}
@@ -302,7 +287,7 @@ function EnvironmentCard({
 }: {
   universeId: string;
   environment: Environment;
-  /** Configuring this environment: power, idle policy, ingress, close. */
+  /** Configuring this environment: rename, power, ingress, close. */
   configurable: boolean;
   /** Universe-wide configuration; publishing secrets into a machine also needs it. */
   operator: boolean;
@@ -311,10 +296,10 @@ function EnvironmentCard({
   secrets: SecretsInventory | undefined;
 }) {
   const [open, setOpen] = useState(false);
-  const [policyOpen, setPolicyOpen] = useState(false);
+  const [editOpen, setEditOpen] = useState(false);
   const source = environment.source;
-  const gone = ["closing", "closed", "failed"].includes(environment.status);
-  const registered = source.type === "registered";
+  const closed = environment.state === "closed";
+  const message = lifecycleMessage(environment);
 
   return (
     <Collapsible open={open} onOpenChange={setOpen}>
@@ -324,18 +309,25 @@ function EnvironmentCard({
             <h2 className="truncate text-sm font-semibold">{environmentName(environment)}</h2>
             <p className="mt-1 truncate text-sm text-muted-foreground">
               {source.type === "provisioned"
-                ? template?.displayName ?? environment.incarnation.templateId ?? "Provisioned environment"
+                ? template?.displayName ?? source.templateId
                 : source.type === "registered"
                   ? `Registered daemon · ${registrationKey?.displayName ?? source.registrationKeyId}`
                   : "External environment"}
             </p>
-            <p className="mt-1 text-xs text-muted-foreground">
-              {registered
-                ? environment.lastSeenAtMs
-                  ? `Last seen ${relativeTime(environment.lastSeenAtMs)}`
-                  : "Never seen"
-                : environment.publicEndpoint ?? "Private environment"}
+            <p className="mt-1 truncate text-xs text-muted-foreground">
+              {source.type === "registered"
+                ? source.connected
+                  ? `Connected · last seen ${relativeTime(source.lastSeenAtMs)}`
+                  : `Disconnected ${relativeTime(source.connectionChangedAtMs)}`
+                : source.type === "external"
+                  ? source.endpoint
+                  : source.publicEndpoint ?? "Private environment"}
             </p>
+            {message && (
+              <p className={`mt-1 text-xs ${environment.state === "failed" ? "text-destructive" : "text-muted-foreground"}`}>
+                {message}
+              </p>
+            )}
           </div>
           <EnvironmentStatusBadge environment={environment} />
           <CollapsibleTrigger className="inline-flex h-8 items-center gap-1.5 rounded-md px-2.5 text-xs font-medium text-muted-foreground outline-none hover:bg-muted hover:text-foreground focus-visible:ring-3 focus-visible:ring-ring/50">
@@ -351,37 +343,52 @@ function EnvironmentCard({
                 label="Source"
                 value={source.type === "provisioned" ? "Provisioned" : source.type === "registered" ? "Registered" : "External"}
               />
+              <Detail label="State" value={`${environment.state} · since ${relativeTime(environment.stateChangedAtMs)}`} />
               {source.type === "registered" && (
-                <Detail label="Registration key" value={registrationKey?.displayName ?? source.registrationKeyId} />
-              )}
-              {source.type === "registered" && <Detail label="Daemon" value={source.daemonId} mono />}
-              {source.type === "registered" && (
-                <Detail
-                  label="Identity"
-                  value={source.identityMode === "ephemeral"
-                    ? "Ephemeral · closes after its key's disconnect grace"
-                    : "Persistent · stays offline until closed"}
-                />
-              )}
-              {source.type === "registered" && environment.lastSeenAtMs && (
-                <Detail label="Last seen" value={relativeTime(environment.lastSeenAtMs)} />
+                <>
+                  <Detail label="Registration key" value={registrationKey?.displayName ?? source.registrationKeyId} />
+                  <Detail label="Daemon" value={source.daemonId} mono />
+                  <Detail
+                    label="Identity"
+                    value={source.identityMode === "ephemeral"
+                      ? "Ephemeral · closes after its key's disconnect grace"
+                      : "Persistent · waits for its daemon to reconnect"}
+                  />
+                  <Detail
+                    label="Connection"
+                    value={`${source.connected ? "Connected" : "Disconnected"} since ${relativeTime(source.connectionChangedAtMs)}`}
+                  />
+                  <Detail label="Last seen" value={relativeTime(source.lastSeenAtMs)} />
+                </>
               )}
-              {source.type === "provisioned" && <Detail label="Binding" value={source.bindingId} mono />}
-              {source.type === "provisioned" && <Detail label="Provider" value={source.providerId} mono />}
-              {environment.incarnation.templateId && <Detail label="Template" value={environment.incarnation.templateId} mono />}
-              {environment.incarnation.providerTargetId && <Detail label="Target" value={environment.incarnation.providerTargetId} mono />}
-
+              {source.type === "external" && <Detail label="Endpoint" value={source.endpoint} mono />}
               {source.type === "provisioned" && (
+                <>
+                  <Detail label="Provider" value={source.providerId} mono />
+                  <Detail label="Template" value={source.templateId} mono />
+                  {source.targetId && <Detail label="Target" value={source.targetId} mono />}
+                  <Detail
+                    label="Provider reports"
+                    value={source.observed
+                      ? `${source.observed.phase}${source.observed.power ? ` · ${source.observed.power}` : ""} · ${relativeTime(source.observed.observedAtMs)}`
+                      : "nothing yet"}
+                  />
+                  <Detail label="Idle policy" value={describeIdlePolicy(source.idle ?? template?.idle)} />
+                </>
+              )}
+              {environment.daemon && (
                 <Detail
-                  label="Power"
-                  value={powerDiverges(environment)
-                    ? `${observedPower(environment) ?? environment.status} → ${environment.desiredPower}`
-                    : environment.desiredPower}
+                  label="Daemon build"
+                  value={[
+                    environment.daemon.version,
+                    environment.daemon.gitSha?.slice(0, 12),
+                    `protocol ${environment.daemon.protocolVersion}`,
+                  ].filter(Boolean).join(" · ")}
                 />
               )}
-              {source.type === "provisioned" && (
-                <Detail label="Idle policy" value={describeIdlePolicy(environment.idlePolicy)} />
-              )}
+              {Object.entries(environment.metadata ?? {}).map(([key, value]) => (
+                <Detail key={key} label={key} value={value} mono />
+              ))}
               <Detail label="Updated" value={relativeTime(environment.updatedAtMs)} />
             </dl>
             <EnvironmentCredentials
@@ -391,35 +398,32 @@ function EnvironmentCard({
               enabled={open}
               writable={configurable && operator}
             />
-            {configurable && source.type === "provisioned" && (
+            {configurable && !closed && (
               <div className="mt-4 flex flex-wrap items-center gap-2 border-t pt-4">
-                <EnvironmentPowerControls universeId={universeId} environment={environment} />
-                {!gone && (
-                  <Button variant="outline" size="xs" onClick={() => setPolicyOpen(true)}>
-                    Idle policy…
-                  </Button>
+                <Button variant="outline" size="xs" onClick={() => setEditOpen(true)}>
+                  <Pencil data-icon="inline-start" />
+                  Rename…
+                </Button>
+                {source.type === "provisioned" && (
+                  <EnvironmentPowerControls
+                    universeId={universeId}
+                    environment={environment}
+                    powerStates={template?.powerStates ?? []}
+                  />
                 )}
-                {template?.publicIngress && (
+                {source.type === "provisioned" && template?.publicIngress && environment.state === "open" && (
                   <EnvironmentIngressButton universeId={universeId} environment={environment} />
                 )}
                 <CloseEnvironmentButton universeId={universeId} environment={environment} />
               </div>
             )}
-            {configurable && registered && !gone && (
-              <div className="mt-4 flex flex-wrap items-center gap-2 border-t pt-4">
-                <CloseEnvironmentButton universeId={universeId} environment={environment} />
-                <span className="text-xs text-muted-foreground">
-                  Closing spends the daemon identity; the machine itself is untouched.
-                </span>
-              </div>
-            )}
-            {configurable && source.type === "provisioned" && !gone && (
-              <EnvironmentIdlePolicyDialog
-                key={`${environment.environmentId}:${policyOpen ? "open" : "closed"}`}
+            {configurable && !closed && (
+              <EditEnvironmentDialog
+                key={`${environment.environmentId}:${editOpen ? "open" : "closed"}`}
                 universeId={universeId}
                 environment={environment}
-                open={policyOpen}
-                onOpenChange={setPolicyOpen}
+                open={editOpen}
+                onOpenChange={setEditOpen}
               />
             )}
           </div>
@@ -464,7 +468,7 @@ function EnvironmentCredentials({
       }),
   });
   const rows = (credentials.data ?? []).slice().sort((a, b) => a.envName.localeCompare(b.envName));
-  const canAssign = environment.status !== "closed" && environment.status !== "closing";
+  const canAssign = environment.state !== "closed" && environment.state !== "closing";
 
   return (
     <div className="mt-4 border-t pt-4">
@@ -708,25 +712,20 @@ function AssignCredentialDialog({
 }
 
 function EnvironmentStatusBadge({ environment }: { environment: Environment }) {
-  if (environment.status === "ready") {
-    return <Badge variant="secondary">ready</Badge>;
-  }
-  if (environment.status === "paused" || environment.status === "suspended") {
-    return (
-      <Badge variant="outline">
-        {environment.status}
-        {powerDiverges(environment) ? " · waking" : ""}
-      </Badge>
-    );
-  }
-  if (environment.status === "failed") {
-    return (
-      <Badge variant="outline" className="border-destructive/50 text-destructive">
-        failed
-      </Badge>
-    );
+  switch (environment.status) {
+    case "ready":
+      return <Badge variant="secondary">ready</Badge>;
+    case "failed":
+      return (
+        <Badge variant="outline" className="border-destructive/50 text-destructive">
+          failed
+        </Badge>
+      );
+    case "away":
+      return <Badge variant="outline">disconnected</Badge>;
+    default:
+      return <Badge variant="outline">{environment.status}</Badge>;
   }
-  return <Badge variant="outline">{environment.status}</Badge>;
 }
 
 function Detail({ label, value, mono = false }: { label: string; value: string; mono?: boolean }) {
@@ -748,6 +747,7 @@ function RegistrationKeys({
   keys: EnvironmentRegistrationKey[];
 }) {
   const [showInactive, setShowInactive] = useState(false);
+  const [editing, setEditing] = useState<EnvironmentRegistrationKey | null>(null);
   const inactiveCount = keys.filter((key) => key.status !== "active").length;
   const rows = showInactive ? keys : keys.filter((key) => key.status === "active");
   return (
@@ -755,8 +755,8 @@ function RegistrationKeys({
       <h2 className="text-sm font-semibold">Registration keys</h2>
       <p className="mt-1 text-sm text-muted-foreground">
         A key lets <span className="font-mono">lightspeed-envd</span> daemons dial in and register as
-        environments; each key is the group its environments belong to. Revoking stops new daemons
-        while registered ones keep reconnecting.
+        environments; each key is the group its environments belong to. Revoking or rotating stops
+        new daemons while registered ones keep reconnecting.
       </p>
       <div className="mt-3 grid gap-2">
         {rows.map((key) => (
@@ -772,8 +772,10 @@ function RegistrationKeys({
               {key.activeEnvironmentCount} active / {key.registeredEnvironmentCount} total
               {key.maxActiveEnvironments ? ` · limit ${key.maxActiveEnvironments}` : ""}
               {key.identityMode === "ephemeral"
-                ? ` · grace ${Math.round(key.ephemeralDisconnectGraceMs / 60_000)} min`
-                : ""}
+                ? ` · grace ${formatDuration(key.ephemeralDisconnectGraceMs)}`
+                : key.offlineCloseAfterMs
+                  ? ` · closes offline after ${formatDuration(key.offlineCloseAfterMs)}`
+                  : ""}
               {key.expiresAtMs ? ` · expires ${relativeTime(key.expiresAtMs).replace(" ago", "")}` : ""}
             </span>
             {key.status === "active" ? (
@@ -781,6 +783,15 @@ function RegistrationKeys({
             ) : (
               <Badge variant="outline">{key.status}</Badge>
             )}
+            {key.status !== "revoked" && (
+              <Button variant="outline" size="xs" onClick={() => setEditing(key)}>
+                <Pencil data-icon="inline-start" />
+                Edit
+              </Button>
+            )}
+            {key.status === "active" && (
+              <RotateRegistrationKeyButton universeId={universeId} registrationKey={key} />
+            )}
             {key.status === "active" && (
               <RevokeRegistrationKeyButton universeId={universeId} registrationKey={key} />
             )}
@@ -798,6 +809,12 @@ function RegistrationKeys({
           onCheckedChange={setShowInactive}
         />
       </div>
+      <EditRegistrationKeyDialog
+        key={editing?.registrationKeyId ?? "closed"}
+        universeId={universeId}
+        registrationKey={editing}
+        onOpenChange={(next) => { if (!next) setEditing(null); }}
+      />
     </section>
   );
 }
@@ -859,30 +876,259 @@ function RevokeRegistrationKeyButton({
   );
 }
 
-/// Mint a registration key. The secret is shown once, with the two
-/// variables a daemon needs to dial in.
+/// Retire the key's live secret and show its replacement once. The group,
+/// its policy, and the daemons it already admitted are unaffected.
+function RotateRegistrationKeyButton({
+  universeId,
+  registrationKey,
+}: {
+  universeId: string;
+  registrationKey: EnvironmentRegistrationKey;
+}) {
+  const queryClient = useQueryClient();
+  const [confirming, setConfirming] = useState(false);
+  const rotate = useMutation({
+    mutationFn: () =>
+      api<EnvironmentRegistrationKeyCreated>(
+        "POST",
+        `/api/v1/universes/${universeId}/environment-registration-keys/${registrationKey.registrationKeyId}/rotate`,
+      ),
+    onSuccess: async () => {
+      setConfirming(false);
+      await queryClient.invalidateQueries({ queryKey: ["environment-registration-keys", universeId] });
+    },
+  });
+  return (
+    <>
+      <Button variant="outline" size="xs" onClick={() => { rotate.reset(); setConfirming(true); }}>
+        <RotateCw data-icon="inline-start" />
+        Rotate
+      </Button>
+      <AlertDialog open={confirming} onOpenChange={setConfirming}>
+        <AlertDialogContent>
+          <AlertDialogHeader>
+            <AlertDialogTitle>Rotate “{registrationKey.displayName}”?</AlertDialogTitle>
+            <AlertDialogDescription>
+              The current secret stops admitting new daemons at once; give the new one to the
+              machines that should still register. Daemons that already registered keep
+              reconnecting by their own identity.
+            </AlertDialogDescription>
+          </AlertDialogHeader>
+          {rotate.error && <p className="text-sm text-destructive">{rotate.error.message}</p>}
+          <AlertDialogFooter>
+            <AlertDialogCancel>Keep</AlertDialogCancel>
+            <AlertDialogAction onClick={() => rotate.mutate()} disabled={rotate.isPending}>
+              {rotate.isPending ? "Rotating…" : "Rotate key"}
+            </AlertDialogAction>
+          </AlertDialogFooter>
+        </AlertDialogContent>
+      </AlertDialog>
+      <Dialog open={rotate.data !== undefined} onOpenChange={(next) => { if (!next) rotate.reset(); }}>
+        <DialogContent showCloseButton={false}>
+          {rotate.data && <RegistrationSecret created={rotate.data} onDone={() => rotate.reset()} />}
+        </DialogContent>
+      </Dialog>
+    </>
+  );
+}
+
+/// The engine's grace for an ephemeral key that sets none. The key view only
+/// carries the effective grace, so the edit form leaves the field empty when
+/// it equals this default and an unchanged save keeps following it.
+const DEFAULT_EPHEMERAL_GRACE_MS = 5 * 60_000;
+
+/// The editable policy of a registration key, in the units the form shows.
+type RegistrationKeyForm = {
+  displayName: string;
+  maxActive: string;
+  graceMinutes: string;
+  offlineCloseMinutes: string;
+};
+
+function registrationKeyForm(key: EnvironmentRegistrationKey | null): RegistrationKeyForm {
+  return {
+    displayName: key?.displayName ?? "",
+    maxActive: key?.maxActiveEnvironments ? String(key.maxActiveEnvironments) : "",
+    graceMinutes:
+      key && key.identityMode === "ephemeral" && key.ephemeralDisconnectGraceMs !== DEFAULT_EPHEMERAL_GRACE_MS
+        ? String(key.ephemeralDisconnectGraceMs / 60_000)
+        : "",
+    offlineCloseMinutes: key?.offlineCloseAfterMs ? String(key.offlineCloseAfterMs / 60_000) : "",
+  };
+}
+
+/// Request fields for `registration-keys/create` and `/update`: absent
+/// fields are unset, so an edit sends the complete policy.
+function registrationKeySettings(
+  form: RegistrationKeyForm,
+  identityMode: "persistent" | "ephemeral",
+  expiresAtMs: number | null | undefined,
+) {
+  const minutes = (value: string) => Math.round(Number(value) * 60_000);
+  return {
+    displayName: form.displayName.trim(),
+    ...(form.maxActive.trim() ? { maxActiveEnvironments: Number(form.maxActive) } : {}),
+    ...(identityMode === "ephemeral" && form.graceMinutes.trim()
+      ? { ephemeralDisconnectGraceMs: minutes(form.graceMinutes) }
+      : {}),
+    ...(identityMode === "persistent" && form.offlineCloseMinutes.trim()
+      ? { offlineCloseAfterMs: minutes(form.offlineCloseMinutes) }
+      : {}),
+    ...(expiresAtMs ? { expiresAtMs } : {}),
+  };
+}
+
+function registrationKeyFormError(form: RegistrationKeyForm): string | null {
+  if (!form.displayName.trim()) return "Name the group.";
+  if (form.maxActive.trim() && !(Number.isInteger(Number(form.maxActive)) && Number(form.maxActive) >= 1)) {
+    return "The active environment limit must be a whole number of at least 1.";
+  }
+  for (const value of [form.graceMinutes, form.offlineCloseMinutes]) {
+    if (value.trim() && !(Number(value) > 0)) return "Durations must be positive minutes.";
+  }
+  return null;
+}
+
+function RegistrationKeyFields({
+  form,
+  identityMode,
+  onChange,
+}: {
+  form: RegistrationKeyForm;
+  identityMode: "persistent" | "ephemeral";
+  onChange: (form: RegistrationKeyForm) => void;
+}) {
+  return (
+    <>
+      <Field>
+        <FieldLabel htmlFor="registration-key-name">Group name</FieldLabel>
+        <Input
+          id="registration-key-name"
+          value={form.displayName}
+          onChange={(event) => onChange({ ...form, displayName: event.target.value })}
+          placeholder="CI runners"
+          maxLength={128}
+          autoFocus
+        />
+      </Field>
+      {identityMode === "ephemeral" ? (
+        <Field>
+          <FieldLabel htmlFor="registration-key-grace">Disconnect grace (minutes)</FieldLabel>
+          <Input
+            id="registration-key-grace"
+            value={form.graceMinutes}
+            onChange={(event) => onChange({ ...form, graceMinutes: event.target.value })}
+            placeholder={String(DEFAULT_EPHEMERAL_GRACE_MS / 60_000)}
+            inputMode="decimal"
+          />
+          <FieldDescription>An environment whose daemon stays away this long is closed. Empty uses the default.</FieldDescription>
+        </Field>
+      ) : (
+        <Field>
+          <FieldLabel htmlFor="registration-key-offline">Close when offline for (minutes)</FieldLabel>
+          <Input
+            id="registration-key-offline"
+            value={form.offlineCloseMinutes}
+            onChange={(event) => onChange({ ...form, offlineCloseMinutes: event.target.value })}
+            placeholder="never"
+            inputMode="decimal"
+          />
+          <FieldDescription>
+            Empty keeps a disconnected environment open until it is closed, for machines that
+            come back; set it when scaled-down machines do not.
+          </FieldDescription>
+        </Field>
+      )}
+      <Field>
+        <FieldLabel htmlFor="registration-key-max">Active environment limit</FieldLabel>
+        <Input
+          id="registration-key-max"
+          value={form.maxActive}
+          onChange={(event) => onChange({ ...form, maxActive: event.target.value })}
+          placeholder="unlimited"
+          inputMode="numeric"
+        />
+        <FieldDescription>Bounds what a leaked key can add to this universe.</FieldDescription>
+      </Field>
+    </>
+  );
+}
+
+/// The one-time view of a registration secret, with the two variables a
+/// daemon needs to dial in.
+function RegistrationSecret({
+  created,
+  onDone,
+}: {
+  created: EnvironmentRegistrationKeyCreated;
+  onDone: () => void;
+}) {
+  const [copied, setCopied] = useState(false);
+  const bootstrap = [
+    "LIGHTSPEED_ENVD_GATEWAY_URL=wss://<lightspeed host>/environment-gateway/connect",
+    `LIGHTSPEED_ENVD_REGISTRATION_KEY=${created.secret}`,
+    "lightspeed-envd",
+  ].join("\n");
+  return (
+    <>
+      <DialogHeader>
+        <DialogTitle>Copy the registration key</DialogTitle>
+        <DialogDescription>
+          Shown once. Give it to the machines that should register under
+          “{created.registrationKey.displayName}”; in a sandbox, mount it as a file and delete
+          it after the daemon's receipt appears.
+        </DialogDescription>
+      </DialogHeader>
+      <div className="grid gap-2">
+        <FieldLabel htmlFor="registration-key-secret">Registration key</FieldLabel>
+        <div className="flex gap-2">
+          <Input
+            id="registration-key-secret"
+            value={created.secret}
+            readOnly
+            className="font-mono text-xs"
+            onFocus={(event) => event.currentTarget.select()}
+          />
+          <Button
+            type="button"
+            variant="outline"
+            onClick={() => {
+              void navigator.clipboard.writeText(created.secret).then(() => setCopied(true));
+            }}
+          >
+            {copied ? <Check data-icon="inline-start" /> : <Copy data-icon="inline-start" />}
+            {copied ? "Copied" : "Copy"}
+          </Button>
+        </div>
+        <FieldLabel htmlFor="registration-key-bootstrap">Bootstrap</FieldLabel>
+        <textarea
+          id="registration-key-bootstrap"
+          className="min-h-20 w-full rounded-md border border-input bg-transparent px-3 py-2 font-mono text-xs outline-none"
+          value={bootstrap}
+          readOnly
+          onFocus={(event) => event.currentTarget.select()}
+        />
+      </div>
+      <DialogFooter>
+        <Button type="button" onClick={onDone}>I saved the key</Button>
+      </DialogFooter>
+    </>
+  );
+}
+
+/// Mint a registration key. The secret is shown once.
 function CreateRegistrationKeyDialog({ universeId }: { universeId: string }) {
   const queryClient = useQueryClient();
   const [open, setOpen] = useState(false);
-  const [displayName, setDisplayName] = useState("");
+  const [form, setForm] = useState(() => registrationKeyForm(null));
   const [identityMode, setIdentityMode] = useState<"persistent" | "ephemeral">("persistent");
-  const [maxActive, setMaxActive] = useState("");
-  const [graceMinutes, setGraceMinutes] = useState("");
   const [created, setCreated] = useState<EnvironmentRegistrationKeyCreated | null>(null);
-  const [copied, setCopied] = useState(false);
   const create = useMutation({
     mutationFn: () =>
       api<EnvironmentRegistrationKeyCreated>(
         "POST",
         `/api/v1/universes/${universeId}/environment-registration-keys`,
-        {
-          displayName: displayName.trim(),
-          identityMode,
-          ...(maxActive.trim() ? { maxActiveEnvironments: Number(maxActive) } : {}),
-          ...(identityMode === "ephemeral" && graceMinutes.trim()
-            ? { ephemeralDisconnectGraceMs: Math.round(Number(graceMinutes) * 60_000) }
-            : {}),
-        },
+        { identityMode, ...registrationKeySettings(form, identityMode, null) },
       ),
     onSuccess: async (result) => {
       setCreated(result);
@@ -891,21 +1137,12 @@ function CreateRegistrationKeyDialog({ universeId }: { universeId: string }) {
   });
   const reset = () => {
     setOpen(false);
-    setDisplayName("");
+    setForm(registrationKeyForm(null));
     setIdentityMode("persistent");
-    setMaxActive("");
-    setGraceMinutes("");
     setCreated(null);
-    setCopied(false);
     create.reset();
   };
-  const bootstrap = created
-    ? [
-        "LIGHTSPEED_ENVD_GATEWAY_URL=wss://<lightspeed host>/environment-gateway/connect",
-        `LIGHTSPEED_ENVD_REGISTRATION_KEY=${created.secret}`,
-        "lightspeed-envd",
-      ].join("\n")
-    : "";
+  const formError = registrationKeyFormError(form);
 
   return (
     <>
@@ -916,49 +1153,7 @@ function CreateRegistrationKeyDialog({ universeId }: { universeId: string }) {
       <Dialog open={open} onOpenChange={(next) => { if (!next) reset(); }}>
         <DialogContent showCloseButton={!created}>
           {created ? (
-            <>
-              <DialogHeader>
-                <DialogTitle>Copy the registration key</DialogTitle>
-                <DialogDescription>
-                  Shown once. Give it to the machines that should register under
-                  “{created.registrationKey.displayName}”; in a sandbox, mount it as a file and delete
-                  it after the daemon's receipt appears.
-                </DialogDescription>
-              </DialogHeader>
-              <div className="grid gap-2">
-                <FieldLabel htmlFor="registration-key-secret">Registration key</FieldLabel>
-                <div className="flex gap-2">
-                  <Input
-                    id="registration-key-secret"
-                    value={created.secret}
-                    readOnly
-                    className="font-mono text-xs"
-                    onFocus={(event) => event.currentTarget.select()}
-                  />
-                  <Button
-                    type="button"
-                    variant="outline"
-                    onClick={() => {
-                      void navigator.clipboard.writeText(created.secret).then(() => setCopied(true));
-                    }}
-                  >
-                    {copied ? <Check data-icon="inline-start" /> : <Copy data-icon="inline-start" />}
-                    {copied ? "Copied" : "Copy"}
-                  </Button>
-                </div>
-                <FieldLabel htmlFor="registration-key-bootstrap">Bootstrap</FieldLabel>
-                <textarea
-                  id="registration-key-bootstrap"
-                  className="min-h-20 w-full rounded-md border border-input bg-transparent px-3 py-2 font-mono text-xs outline-none"
-                  value={bootstrap}
-                  readOnly
-                  onFocus={(event) => event.currentTarget.select()}
-                />
-              </div>
-              <DialogFooter>
-                <Button type="button" onClick={reset}>I saved the key</Button>
-              </DialogFooter>
-            </>
+            <RegistrationSecret created={created} onDone={reset} />
           ) : (
             <>
               <DialogHeader>
@@ -969,17 +1164,6 @@ function CreateRegistrationKeyDialog({ universeId }: { universeId: string }) {
                 </DialogDescription>
               </DialogHeader>
               <div className="grid gap-4">
-                <Field>
-                  <FieldLabel htmlFor="registration-key-name">Group name</FieldLabel>
-                  <Input
-                    id="registration-key-name"
-                    value={displayName}
-                    onChange={(event) => setDisplayName(event.target.value)}
-                    placeholder="CI runners"
-                    maxLength={128}
-                    autoFocus
-                  />
-                </Field>
                 <Field>
                   <FieldLabel>Identity</FieldLabel>
                   <Select value={identityMode} onValueChange={(next) => setIdentityMode(next as "persistent" | "ephemeral")}>
@@ -987,48 +1171,26 @@ function CreateRegistrationKeyDialog({ universeId }: { universeId: string }) {
                       <SelectValue>
                         {(value: string) => value === "ephemeral"
                           ? "Ephemeral · close after the daemon stays away"
-                          : "Persistent · stay offline until closed"}
+                          : "Persistent · wait for the daemon to reconnect"}
                       </SelectValue>
                     </SelectTrigger>
                     <SelectContent>
-                      <SelectItem value="persistent">Persistent · stay offline until closed</SelectItem>
+                      <SelectItem value="persistent">Persistent · wait for the daemon to reconnect</SelectItem>
                       <SelectItem value="ephemeral">Ephemeral · close after the daemon stays away</SelectItem>
                     </SelectContent>
                   </Select>
                   <FieldDescription>
                     Persistent suits VMs and stateful pods whose daemon state survives restarts.
-                    Ephemeral suits replaceable workers and sandboxes.
+                    Ephemeral suits replaceable workers and sandboxes. It cannot be changed later.
                   </FieldDescription>
                 </Field>
-                {identityMode === "ephemeral" && (
-                  <Field>
-                    <FieldLabel htmlFor="registration-key-grace">Disconnect grace (minutes)</FieldLabel>
-                    <Input
-                      id="registration-key-grace"
-                      value={graceMinutes}
-                      onChange={(event) => setGraceMinutes(event.target.value)}
-                      placeholder="5"
-                      inputMode="decimal"
-                    />
-                  </Field>
-                )}
-                <Field>
-                  <FieldLabel htmlFor="registration-key-max">Active environment limit</FieldLabel>
-                  <Input
-                    id="registration-key-max"
-                    value={maxActive}
-                    onChange={(event) => setMaxActive(event.target.value)}
-                    placeholder="unlimited"
-                    inputMode="numeric"
-                  />
-                  <FieldDescription>Bounds what a leaked key can add to this universe.</FieldDescription>
-                </Field>
+                <RegistrationKeyFields form={form} identityMode={identityMode} onChange={setForm} />
                 {create.error && <p className="text-sm text-destructive">{create.error.message}</p>}
                 <DialogFooter>
                   <Button type="button" variant="outline" onClick={reset}>Cancel</Button>
                   <Button
                     type="button"
-                    disabled={create.isPending || !displayName.trim()}
+                    disabled={create.isPending || formError !== null}
                     onClick={() => create.mutate()}
                   >
                     {create.isPending ? "Minting…" : "Mint key"}
@@ -1043,9 +1205,67 @@ function CreateRegistrationKeyDialog({ universeId }: { universeId: string }) {
   );
 }
 
+/// Replace a key's editable policy (`registration-keys/update`). The
+/// identity mode is fixed when the key is minted.
+function EditRegistrationKeyDialog({
+  universeId,
+  registrationKey,
+  onOpenChange,
+}: {
+  universeId: string;
+  registrationKey: EnvironmentRegistrationKey | null;
+  onOpenChange: (open: boolean) => void;
+}) {
+  const queryClient = useQueryClient();
+  const [form, setForm] = useState(() => registrationKeyForm(registrationKey));
+  const save = useMutation({
+    mutationFn: (key: EnvironmentRegistrationKey) =>
+      api<EnvironmentRegistrationKey>(
+        "PUT",
+        `/api/v1/universes/${universeId}/environment-registration-keys/${key.registrationKeyId}`,
+        registrationKeySettings(form, key.identityMode, key.expiresAtMs),
+      ),
+    onSuccess: async () => {
+      await queryClient.invalidateQueries({ queryKey: ["environment-registration-keys", universeId] });
+      onOpenChange(false);
+    },
+  });
+  const formError = registrationKeyFormError(form);
+  return (
+    <Dialog open={registrationKey !== null} onOpenChange={onOpenChange}>
+      <DialogContent>
+        <DialogHeader>
+          <DialogTitle>Edit “{registrationKey?.displayName}”</DialogTitle>
+          <DialogDescription>
+            {registrationKey?.identityMode === "ephemeral" ? "Ephemeral" : "Persistent"} key. The active limit
+            and expiry apply to later admissions; a changed disconnect grace or offline close-after applies to
+            admitted environments whose daemon is away.
+          </DialogDescription>
+        </DialogHeader>
+        {registrationKey && (
+          <div className="grid gap-4">
+            <RegistrationKeyFields form={form} identityMode={registrationKey.identityMode} onChange={setForm} />
+            {save.error && <p className="text-sm text-destructive">{save.error.message}</p>}
+            <DialogFooter>
+              <Button type="button" variant="outline" onClick={() => onOpenChange(false)}>Cancel</Button>
+              <Button
+                type="button"
+                disabled={save.isPending || formError !== null}
+                onClick={() => save.mutate(registrationKey)}
+              >
+                {save.isPending ? "Saving…" : "Save"}
+              </Button>
+            </DialogFooter>
+          </div>
+        )}
+      </DialogContent>
+    </Dialog>
+  );
+}
+
 function ProviderBindings({ bindings }: { bindings: EnvironmentProviderBinding[] }) {
   const [open, setOpen] = useState(false);
-  const enabled = bindings.filter((binding) => binding.status === "enabled").length;
+  const enabled = bindings.filter((binding) => binding.enabled).length;
 
   return (
     <Collapsible open={open} onOpenChange={setOpen}>
@@ -1060,19 +1280,22 @@ function ProviderBindings({ bindings }: { bindings: EnvironmentProviderBinding[]
         <CollapsibleContent>
           <div className="divide-y border-t">
             {bindings.map((binding) => (
-              <div key={binding.bindingId} className="grid gap-3 px-4 py-4 md:grid-cols-[minmax(0,1fr)_auto] md:px-5">
+              <div key={binding.providerId} className="grid gap-3 px-4 py-4 md:grid-cols-[minmax(0,1fr)_auto] md:px-5">
                 <div className="min-w-0">
                   <div className="flex flex-wrap items-center gap-2">
                     <p className="text-sm font-medium">{humanizeIdentifier(binding.providerId)}</p>
-                    <ProviderStatusBadge status={binding.status} />
+                    {binding.enabled ? (
+                      <Badge variant="secondary">enabled</Badge>
+                    ) : (
+                      <Badge variant="outline" className="border-destructive/50 text-destructive">disabled</Badge>
+                    )}
                   </div>
                   <p className="mt-2 font-mono text-xs text-muted-foreground">
-                    {binding.bindingId}
+                    {binding.providerId}
                   </p>
                 </div>
                 <div className="text-xs text-muted-foreground md:text-right">
-                  <p>Revision {binding.revision}</p>
-                  <p className="mt-1">Updated {relativeTime(binding.updatedAtMs)}</p>
+                  <p>Updated {relativeTime(binding.updatedAtMs)}</p>
                 </div>
               </div>
             ))}
@@ -1083,15 +1306,8 @@ function ProviderBindings({ bindings }: { bindings: EnvironmentProviderBinding[]
   );
 }
 
-function ProviderStatusBadge({ status }: { status: EnvironmentProviderBinding["status"] }) {
-  if (status === "enabled") return <Badge variant="secondary">enabled</Badge>;
-  return (
-    <Badge variant="outline" className="border-destructive/50 text-destructive">
-      {status}
-    </Badge>
-  );
-}
-
+/// One-shot `environments/ingress/put`: the provider adds or removes the
+/// public endpoint during the call, and the page shows what it returned.
 function EnvironmentIngressButton({
   universeId,
   environment,
@@ -1100,6 +1316,7 @@ function EnvironmentIngressButton({
   environment: Environment;
 }) {
   const queryClient = useQueryClient();
+  const publicEndpoint = environment.source.type === "provisioned" ? environment.source.publicEndpoint : null;
   const ingress = useMutation({
     mutationFn: (enabled: boolean) => api<Environment>(
       "PUT",
@@ -1113,26 +1330,21 @@ function EnvironmentIngressButton({
       <Button
         variant="outline"
         size="xs"
-        disabled={ingress.isPending || environment.status !== "ready"}
-        onClick={() => ingress.mutate(!environment.publicIngressEnabled)}
+        disabled={ingress.isPending}
+        onClick={() => ingress.mutate(!publicEndpoint)}
       >
         {ingress.isPending
           ? "Updating ingress…"
-          : environment.publicIngressEnabled ? "Disable public ingress" : "Enable public ingress"}
+          : publicEndpoint ? "Disable public ingress" : "Enable public ingress"}
       </Button>
-      {ingressDiverges(environment) && (
-        <span className="text-xs text-muted-foreground">
-          {environment.publicIngressEnabled ? "Public endpoint pending…" : "Removing public endpoint…"}
-        </span>
-      )}
-      {environment.publicIngressEnabled && environment.publicEndpoint && (
+      {publicEndpoint && (
         <a
           className="break-all text-xs text-primary underline-offset-4 hover:underline"
-          href={environment.publicEndpoint}
+          href={publicEndpoint}
           target="_blank"
           rel="noreferrer"
         >
-          {environment.publicEndpoint}
+          {publicEndpoint}
         </a>
       )}
       {ingress.error && <span className="text-xs text-destructive">{ingress.error.message}</span>}
@@ -1140,15 +1352,6 @@ function EnvironmentIngressButton({
   );
 }
 
-/**
- * `environments/ingress/put` records the intent; the reconciler realizes it
- * later, so `publicEndpoint` lags `publicIngressEnabled` until it converges.
- */
-function ingressDiverges(environment: Environment): boolean {
-  if (environment.source.type !== "provisioned") return false;
-  return environment.publicIngressEnabled !== Boolean(environment.publicEndpoint);
-}
-
 function CloseEnvironmentButton({
   universeId,
   environment,
@@ -1164,12 +1367,11 @@ function CloseEnvironmentButton({
     ),
     onSuccess: () => queryClient.invalidateQueries({ queryKey: ["environments", universeId] }),
   });
-  if (environment.source.type !== "provisioned"
-    || environment.status === "closed"
-    || environment.status === "closing") {
+  if (environment.state === "closed" || environment.state === "closing") {
     return null;
   }
-  const label = environment.displayName ?? environment.environmentId;
+  const source = environment.source;
+  const label = environmentName(environment);
   return (
     <div className="ml-auto flex flex-col items-end gap-1">
       <AlertDialog>
@@ -1185,13 +1387,28 @@ function CloseEnvironmentButton({
           <AlertDialogHeader>
             <AlertDialogTitle>Close {label}?</AlertDialogTitle>
             <AlertDialogDescription>
-              This permanently destroys the provider target
-              {environment.incarnation.providerTargetId
-                ? <> <span className="font-mono text-xs">{environment.incarnation.providerTargetId}</span></>
-                : null}
-              {" "}and everything stored on it. A closed environment cannot be
-              reopened; sessions that still select it will see it as
-              unavailable and its public endpoint stops working.
+              {source.type === "provisioned" ? (
+                <>
+                  This permanently destroys the provider target
+                  {source.targetId
+                    ? <> <span className="font-mono text-xs">{source.targetId}</span></>
+                    : null}
+                  {" "}and everything stored on it, and its public endpoint stops working.
+                </>
+              ) : source.type === "registered" ? (
+                <>
+                  The daemon is told to stop registering and its identity is spent; the machine
+                  itself and its files are untouched.
+                </>
+              ) : (
+                <>
+                  Lightspeed stops using the daemon at{" "}
+                  <span className="font-mono text-xs">{source.endpoint}</span>; the daemon itself
+                  keeps running.
+                </>
+              )}
+              {" "}A closed environment cannot be reopened; sessions that still select it will
+              see it as unavailable.
             </AlertDialogDescription>
           </AlertDialogHeader>
           <AlertDialogFooter>
@@ -1210,6 +1427,77 @@ function CloseEnvironmentButton({
   );
 }
 
+/// Replace the environment's display name and caller metadata
+/// (`environments/update`).
+function EditEnvironmentDialog({
+  universeId,
+  environment,
+  open,
+  onOpenChange,
+}: {
+  universeId: string;
+  environment: Environment;
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+}) {
+  const queryClient = useQueryClient();
+  const [displayName, setDisplayName] = useState(environment.displayName ?? "");
+  const [metadata, setMetadata] = useState<Record<string, string> | undefined>(
+    Object.keys(environment.metadata ?? {}).length ? environment.metadata : undefined,
+  );
+  const save = useMutation({
+    mutationFn: () => api<Environment>(
+      "PATCH",
+      `/api/v1/universes/${universeId}/environments/${encodeURIComponent(environment.environmentId)}`,
+      {
+        displayName: displayName.trim() || null,
+        metadata: metadata ?? {},
+      },
+    ),
+    onSuccess: async () => {
+      await queryClient.invalidateQueries({ queryKey: ["environments", universeId] });
+      onOpenChange(false);
+    },
+  });
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="sm:max-w-lg">
+        <DialogHeader>
+          <DialogTitle>Rename {environmentName(environment)}</DialogTitle>
+          <DialogDescription>
+            The name shown throughout Lightspeed, and labels for finding the environment.
+            Neither changes how it runs.
+          </DialogDescription>
+        </DialogHeader>
+        <div className="grid gap-4">
+          <Field>
+            <FieldLabel htmlFor="environment-rename">Display name</FieldLabel>
+            <Input
+              id="environment-rename"
+              value={displayName}
+              onChange={(event) => setDisplayName(event.target.value)}
+              placeholder={environment.environmentId}
+              maxLength={200}
+              autoFocus
+            />
+          </Field>
+          <Field>
+            <FieldLabel>Metadata</FieldLabel>
+            <MetadataMapEditor value={metadata} onChange={setMetadata} />
+          </Field>
+          {save.error && <p className="text-sm text-destructive">{save.error.message}</p>}
+        </div>
+        <DialogFooter>
+          <Button variant="outline" onClick={() => onOpenChange(false)}>Cancel</Button>
+          <Button disabled={save.isPending} onClick={() => save.mutate()}>
+            {save.isPending ? "Saving…" : "Save"}
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  );
+}
+
 function CreateEnvironmentDialog({
   universeId,
   templates,
@@ -1221,36 +1509,46 @@ function CreateEnvironmentDialog({
   const [open, setOpen] = useState(false);
   const [templateKey, setTemplateKey] = useState("");
   const [displayName, setDisplayName] = useState("");
-  const [idlePolicy, setIdlePolicy] = useState<IdlePolicy | undefined>(undefined);
+  const [customIdle, setCustomIdle] = useState(false);
+  const [idle, setIdle] = useState<EnvironmentIdlePolicyView | undefined>(undefined);
   const [requestId, setRequestId] = useState(() => crypto.randomUUID());
   const [error, setError] = useState<string | null>(null);
-  const selectedTemplate = templates.find((template) =>
-    templateKey === `${template.bindingId}:${template.templateId}`
-  ) ?? templates[0];
+  const selectedTemplate = templates.find((template) => templateKey === templateValue(template)) ?? templates[0];
+  const idleProblem = customIdle ? idlePolicyProblem(idle) : null;
+  /// The override starts from the template's default, limited to the stages
+  /// the template can carry out.
+  const resetIdle = (template: EnvironmentTemplate | undefined) => {
+    const stages = idleStagesFor(template?.powerStates ?? []);
+    const defaults = Object.fromEntries(
+      stages
+        .map((stage) => [stage.key, template?.idle?.[stage.key]] as const)
+        .filter(([, ms]) => typeof ms === "number"),
+    ) as EnvironmentIdlePolicyView;
+    setIdle(Object.keys(defaults).length ? defaults : undefined);
+  };
   const create = useMutation({
     mutationFn: () => {
       if (!selectedTemplate) throw new Error("Choose an environment template.");
       return api<Environment>("POST", `/api/v1/universes/${universeId}/environments`, {
         requestId,
-        bindingId: selectedTemplate.bindingId,
+        providerId: selectedTemplate.providerId,
         templateId: selectedTemplate.templateId,
         ...(displayName.trim() ? { displayName: displayName.trim() } : {}),
-        ...(idlePolicy ? { idlePolicy } : {}),
+        ...(customIdle && idle ? { idle } : {}),
       });
     },
     onSuccess: async () => {
       await queryClient.invalidateQueries({ queryKey: ["environments", universeId] });
       setOpen(false);
       setDisplayName("");
-      setIdlePolicy(undefined);
+      setCustomIdle(false);
+      setIdle(undefined);
       setRequestId(crypto.randomUUID());
       setError(null);
     },
     onError: (cause) => setError(cause.message),
   });
-  const selectedTemplateKey = selectedTemplate
-    ? `${selectedTemplate.bindingId}:${selectedTemplate.templateId}`
-    : "";
+  const selectedTemplateKey = selectedTemplate ? templateValue(selectedTemplate) : "";
 
   return (
     <>
@@ -1276,20 +1574,31 @@ function CreateEnvironmentDialog({
               <FieldLabel>Template</FieldLabel>
               <Select
                 value={selectedTemplateKey}
-                onValueChange={(value) => setTemplateKey(value as string)}
+                onValueChange={(value) => {
+                  setTemplateKey(value as string);
+                  resetIdle(templates.find((template) => templateValue(template) === value));
+                }}
               >
                 <SelectTrigger className="w-full"><SelectValue /></SelectTrigger>
                 <SelectContent>
                   {templates.map((template) => (
-                    <SelectItem
-                      key={`${template.bindingId}:${template.templateId}`}
-                      value={`${template.bindingId}:${template.templateId}`}
-                    >
+                    <SelectItem key={templateValue(template)} value={templateValue(template)}>
                       {template.displayName}
                     </SelectItem>
                   ))}
                 </SelectContent>
               </Select>
+              {selectedTemplate && (
+                <FieldDescription>
+                  {humanizeIdentifier(selectedTemplate.providerId)} · idle policy{" "}
+                  {describeIdlePolicy(selectedTemplate.idle)}
+                  {selectedTemplate.powerStates.length
+                    ? ` · power ${selectedTemplate.powerStates.join(", ")}`
+                    : " · no power control"}
+                  . The provider runs the idle policy; a powered-down environment wakes when a
+                  tool uses it.
+                </FieldDescription>
+              )}
             </Field>
             <Field>
               <FieldLabel htmlFor="environment-display-name">Display name</FieldLabel>
@@ -1305,21 +1614,34 @@ function CreateEnvironmentDialog({
                   "Optional name shown throughout Lightspeed."}
               </FieldDescription>
             </Field>
-            <IdlePolicyFields
-              value={idlePolicy}
-              warning={
-                idlePolicy === undefined
-                  ? "No stages: the environment never sleeps while idle. A box a bot or several sessions share should at least pause. You can change this later from the environment's details."
-                  : undefined
-              }
-              onChange={setIdlePolicy}
-            />
+            {selectedTemplate && (
+              <Field orientation="horizontal">
+                <Switch
+                  id="environment-custom-idle"
+                  checked={customIdle}
+                  onCheckedChange={(checked) => {
+                    setCustomIdle(checked);
+                    if (checked) resetIdle(selectedTemplate);
+                  }}
+                />
+                <FieldLabel htmlFor="environment-custom-idle">
+                  Custom idle policy instead of the template's
+                </FieldLabel>
+              </Field>
+            )}
+            {selectedTemplate && customIdle && (
+              <IdlePolicyFields
+                value={idle}
+                powerStates={selectedTemplate.powerStates}
+                onChange={setIdle}
+              />
+            )}
             {error && <p className="text-sm text-destructive">{error}</p>}
           </div>
           <DialogFooter>
             <Button variant="outline" onClick={() => setOpen(false)}>Cancel</Button>
             <Button
-              disabled={!selectedTemplate || create.isPending || !idlePolicyIsMonotone(idlePolicy)}
+              disabled={!selectedTemplate || create.isPending || idleProblem !== null}
               onClick={() => create.mutate()}
             >
               {create.isPending ? "Provisioning…" : "Provision"}
@@ -1331,11 +1653,8 @@ function CreateEnvironmentDialog({
   );
 }
 
-function environmentName(environment: Environment): string {
-  return environment.displayName
-    ?? environment.incarnation.templateId
-    ?? environment.incarnation.providerTargetId
-    ?? humanizeIdentifier(environment.environmentId);
+function templateValue(template: EnvironmentTemplate): string {
+  return JSON.stringify([template.providerId, template.templateId]);
 }
 
 function humanizeIdentifier(value: string): string {
@@ -1351,10 +1670,6 @@ function humanizeIdentifier(value: string): string {
     .join(" ");
 }
 
-function provisionedBindingId(environment: Environment): string | null {
-  return environment.source.type === "provisioned" ? environment.source.bindingId : null;
-}
-
 function relativeTime(ms: number): string {
   const delta = Date.now() - ms;
   if (delta < 10_000) return "just now";
diff --git a/release/metadata.env b/release/metadata.env
index 7690fe094..bbcab1d85 100644
--- a/release/metadata.env
+++ b/release/metadata.env
@@ -12,9 +12,9 @@ LIGHTSPEED_API_PROTOCOL_VERSION=lightspeed.agent.api.v1
 # covers the data plane and the registration channel: a change here is the
 # release event that stops older daemons from registering. The controller
 # number covers provider controllers.
-LIGHTSPEED_ENVD_PROTOCOL_VERSION=3
-LIGHTSPEED_CONTROLLER_PROTOCOL_VERSION=3
-LIGHTSPEED_SCHEMA_REVISION=12
+LIGHTSPEED_ENVD_PROTOCOL_VERSION=4
+LIGHTSPEED_CONTROLLER_PROTOCOL_VERSION=4
+LIGHTSPEED_SCHEMA_REVISION=11
 # Drizzle journal length and the oldest platform migration boundary accepted by
 # the current release's automated upgrade gate.
 LIGHTSPEED_PLATFORM_SCHEMA_REVISION=4
diff --git a/scripts/dev/env.sh b/scripts/dev/env.sh
index 6761171ba..bc76b9035 100755
--- a/scripts/dev/env.sh
+++ b/scripts/dev/env.sh
@@ -25,6 +25,8 @@ export LIGHTSPEED_OBJECT_STORE_REGION
 export LIGHTSPEED_OBJECT_STORE_PREFIX
 export LIGHTSPEED_OBJECT_STORE_FORCE_PATH_STYLE
 export LIGHTSPEED_SECRETS_MASTER_KEY
+# Loopback MCP servers, as ./dev.sh profiles allow them.
+export LIGHTSPEED_MCP_PRIVATE_NETWORKS="${LIGHTSPEED_MCP_PRIVATE_NETWORKS:-localhost,127.0.0.1,::1}"
 export AWS_ACCESS_KEY_ID="${AWS_ACCESS_KEY_ID:-${MINIO_ROOT_USER}}"
 export AWS_SECRET_ACCESS_KEY="${AWS_SECRET_ACCESS_KEY:-${MINIO_ROOT_PASSWORD}}"
 
@@ -39,6 +41,7 @@ echo "  LIGHTSPEED_ENVIRONMENT_GATEWAY_URL=${LIGHTSPEED_ENVIRONMENT_GATEWAY_URL}
 echo "  LIGHTSPEED_OBJECT_STORE_BUCKET=${LIGHTSPEED_OBJECT_STORE_BUCKET}"
 echo "  LIGHTSPEED_OBJECT_STORE_ENDPOINT=${LIGHTSPEED_OBJECT_STORE_ENDPOINT}"
 echo "  LIGHTSPEED_OBJECT_STORE_PREFIX=${LIGHTSPEED_OBJECT_STORE_PREFIX}"
+echo "  LIGHTSPEED_MCP_PRIVATE_NETWORKS=${LIGHTSPEED_MCP_PRIVATE_NETWORKS}"
 if [[ "${LIGHTSPEED_SECRETS_MASTER_KEY}" == "${LIGHTSPEED_DEV_SECRETS_MASTER_KEY_DEFAULT}" ]]; then
   echo "  LIGHTSPEED_SECRETS_MASTER_KEY=(local dev default)"
 else

From 1dcbc4fe0f05714f37bbb288265c757db11ce709 Mon Sep 17 00:00:00 2001
From: lb <542828+lukebuehler@users.noreply.github.com>
Date: Wed, 28 Oct 2026 12:52:50 +0100
Subject: [PATCH 3/5] live fixes

---
 crates/temporal-runtime/tests/runs_live.rs | 34 ++++------------------
 1 file changed, 6 insertions(+), 28 deletions(-)

diff --git a/crates/temporal-runtime/tests/runs_live.rs b/crates/temporal-runtime/tests/runs_live.rs
index 3ab485362..d8fe71cc9 100644
--- a/crates/temporal-runtime/tests/runs_live.rs
+++ b/crates/temporal-runtime/tests/runs_live.rs
@@ -690,10 +690,9 @@ async fn run_queue_live_client(
 
     // Exactly one generation per executed run (first, third, fourth), since
     // the fake model answers directly; the cancelled first run never got a
-    // second turn. Whether the worker
-    // abandoned the first generation or it completed (and was discarded)
-    // depends on heartbeat timing with this short delay and is covered by
-    // the mid-generation cancel scenario.
+    // second turn. Whether the worker abandoned the first generation or it
+    // completed (and was discarded) depends on heartbeat timing with this
+    // short delay and is covered by the mid-generation cancel scenario.
     assert_eq!(counters.generations_started(), 3);
     assert_eq!(
         counters.generations_completed() + counters.generations_abandoned(),
@@ -1107,32 +1106,11 @@ async fn run_unbounded_hosted_run_live_client(
         })
         .await?;
     // Thirty-one generations and thirty tool batches run back to back, which
-    // can approach the default 30 s terminal-run budget on a loaded local
-    // stack; wait with headroom, since the test is about transition count,
-    // not latency.
-    let diag_started = std::time::Instant::now();
+    // takes about 30 s on the local dev stack, right at the default
+    // terminal-run budget. Wait with headroom: the test is about transition
+    // count, not latency.
     let run =
         wait_for_terminal_run_with_timeout(&api, &session_id, &started.result.run.id, 120).await?;
-    eprintln!("DIAG128 run took {:?}", diag_started.elapsed());
-    {
-        let events = api
-            .read_session_events(SessionEventsReadParams {
-                direction: Default::default(),
-                before: None,
-                session_id: session_id.as_str().to_owned(),
-                after: None,
-                limit: Some(80),
-                wait_ms: None,
-            })
-            .await?
-            .result
-            .events;
-        let base = events.first().map(|e| e.observed_at_ms).unwrap_or(0);
-        for event in &events {
-            let k = format!("{:?}", event.kind);
-            eprintln!("DIAG128 +{} {}", event.observed_at_ms - base, &k[..k.len().min(60)]);
-        }
-    }
     assert!(
         final_assistant_text(&run).is_some_and(|text| text.contains("Fake agent completed run"))
     );

From 01b315f6d4f3870f83570cb54a6e62aeb9bdddbd Mon Sep 17 00:00:00 2001
From: lb <542828+lukebuehler@users.noreply.github.com>
Date: Wed, 28 Oct 2026 13:10:36 +0100
Subject: [PATCH 4/5] fix

---
 platform/web/src/index.css | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/platform/web/src/index.css b/platform/web/src/index.css
index be00d98e7..84859c150 100644
--- a/platform/web/src/index.css
+++ b/platform/web/src/index.css
@@ -150,4 +150,13 @@
   html {
     @apply font-sans font-normal antialiased;
     }
+  /* IBM Plex's thin regular strokes render soft at standard pixel density
+     (notably Windows ClearType at 100–150% scaling); a slightly heavier
+     default weight snaps to the pixel grid more cleanly. High-density
+     screens keep the regular weight. */
+  @media (max-resolution: 1.5dppx) {
+    html {
+      font-weight: 450;
+      }
+  }
 }

From 1d1753ebe85f8ff55d9311b89000840df569f913 Mon Sep 17 00:00:00 2001
From: lb <542828+lukebuehler@users.noreply.github.com>
Date: Wed, 28 Oct 2026 13:19:57 +0100
Subject: [PATCH 5/5] Fix envd birth-time check on Linux

rustix 1.x exposes statx's stx_mask as a raw u32, so wrap it in
StatxFlags before testing for BTIME. The path only compiles on Linux,
which local macOS checks never exercised.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/environment-daemon/src/filesystem/os.rs | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/crates/environment-daemon/src/filesystem/os.rs b/crates/environment-daemon/src/filesystem/os.rs
index f0bf7f017..9119d35dd 100644
--- a/crates/environment-daemon/src/filesystem/os.rs
+++ b/crates/environment-daemon/src/filesystem/os.rs
@@ -344,8 +344,7 @@ fn birth_ms(directory: &OwnedFd, name: &OsStr, _: &rfs::Stat) -> Option<i64> {
         rfs::StatxFlags::BTIME,
     )
     .ok()?;
-    statx
-        .stx_mask
+    rfs::StatxFlags::from_bits_retain(statx.stx_mask)
         .contains(rfs::StatxFlags::BTIME)
         .then(|| to_ms((statx.stx_btime.tv_sec, statx.stx_btime.tv_nsec as i64)))
 }